Tales from the Tweetstream: Are You Trusting AV Software Alone to Detect Malware?

(To read more interesting discoveries, follow Brent Huston on Twitter.)

[blackbirdpie url=”http://twitter.com/#!/lbhuston/status/61498319142260737″]

[blackbirdpie url=”http://twitter.com/#!/lbhuston/status/61499509645127680″]

[blackbirdpie url=”http://twitter.com/#!/lbhuston/status/61499751950069760″]

[blackbirdpie url=”http://twitter.com/#!/lbhuston/status/61513076557615104″]

AV software is not a “deploy and forget” solution to detect malware. More surveillance is needed, such as checking the logs to see if there are any occurrences of strange activity. Too often, attackers can drop files in the PHP servers and AV software will rarely detect it.

As I said, the moral of the story is that if you’re depending upon an AV detection mechanism for compromised PHP servers, you’re mistaken. Protect your servers by analyzing your logs. And using our HoneyPoint Wasp would help greatly by giving you more visibility and alerts when malware has entered into your system.

The Holy Grail of Information Security

Have you ever heard of the list of most needed inventions?

These are the sorts of inventions that, if realized, would overcome technological hurdles that are preventing mankind from reaching our most cherished dreams. Room temperature super conductors, advanced nanotechnology and practical fusion power are just a few. There are a number of inventions like this that are needed to make information security a reliable, efficient and low cost process. And chief among them is the Holy Grail of information security: an un-spoofable identity authentication mechanism.

Just think of it! A way for people and machines to know with a certainty that it is you and only you that they are communicating with. No more worries that someone will steal your identity and empty your bank accounts. No problems with cyber criminals impersonating IT personnel and stealing information or crashing systems. Think of the money and time you could save on complex intrusion detection and prevention systems and complicated processes. It is fun to contemplate. But, unfortunately, it is all just wishful thinking. Despite years of concentrated thought and effort, nobody has a clue how to make it work!

There are just three ways known to authenticate identity:

  • Using something you know
  • Using something you have or
  • Using something you are

When talking about authenticating yourself to a computer system, something you know is typically a user name, a password or an encryption key. I think all of us know that despite all efforts to keep these mechanisms secret and secure, it doesn’t prevent intruders from getting them. The problem is that people have to know them, they need to store them and they need to use them, and that makes them vulnerable. So something you know isn’t the answer.

Let’s go to the second mechanism: something you have. In the computer world this is usually a smart card, token or the like. Combined with a user name and password, this mechanism provides another layer of security that can be very effective. But it is far from perfect. Smart cards and tokens can be stolen or misplaced. Perhaps a certificate authority or token provider’s servers are compromised. Some mechanisms can be reverse engineered. So, the upshot is, you can add something you have, to something you know and get better, albeit far from perfect, identity authentication. But the cost you pay in dollars and personnel hours has just gone way up.

So let’s go to the final possible authentication mechanism: something you are. For computer systems this is presently typically finger prints or retinal scans, although other possible mechanisms include facial recognition, voice recognition, heuristics (behavior matching) and DNA matching. This mechanism, once again, provides added security to the identity authentication process, but still is not perfect. For one thing, this kind of authentication mechanism works best in person. If a fingerprint, for example, is transmitted it really travels as a series of electromagnetic signals and these can be spoofed. But even in person, this type of mechanism can possibly be spoofed. So adding something you are to something you have and something you know once again makes it much more difficult to spoof identity, but still doesn’t render it impossible. And imagine the added burden in money and inconvenience using all three mechanisms would mean to your organization! Seems like way too much just to protect some financial data or health information, huh?

So, please, let’s all of us spend some thought trying to find the perfect identity authentication mechanism. It may be like trying to come up with perpetual motion, but if you do manage it, I guarantee you the rewards will keep you and yours in clover for the rest of your lives!

HoneyPoint Wasp Now Monitors Domain User and Admin Accounts


Do you:

  • Need a quick and easy way to provide monitoring of when new user accounts are created in your AD forest and domains?
  •  

  • Need an easy way to know when a user becomes a member of the administrator groups?
  •  

  • Want a powerful, flexible and effective tool for knowing what is running on your AD servers and when new code gets executed on these critical devices?
  •  

If you answered yes to any of these questions, read on.

HoneyPoint Wasp, a bleeding edge tool for anomaly detection on Windows Desktops and Servers has just been enhanced with the current release to extend these types of coverage (and more) to Windows 2003 & 2008 servers running an AD context of Primary Domain Controller & Backup Domain Controller. Yes, our customers have been asking for it, and we listened. Now, with a simple, no signature/no tuning/0-interface deployment, you can get centralized monitoring and visibility over your critical AD identity store. You can know what is running on these essential servers all of the time and when new users are created or promoted to administrative status.

Attackers commonly infect AD components as they move through the enterprise, often adding and promoting users as they go. In most incidents we have worked over the last several years, these changes have usually gone unnoticed until it was too late. That’s exactly why we built HoneyPoint in general and Wasp in particular, to answer this dire need and to help turn the tide against malware-based compromises.

Want to discuss how Wasp fits in your organization? Simply drop us a line at: (1info2@3microsolved4.5com6) (remove the numbers/spam protection), or give us a call at 614-351-1237 to discuss it with your account rep. Wasp is powerful, yet easy to use, detection and with it in your corner, “Attackers Get Stung, Instead of YOU.”

Thanks for reading and stay safe out there!

All Your Creds Are Belong To Us? How To Harden Your Passwords and Protect Your ‘Base.’

In an article published some time ago, a project led by a computer science professor at Columbia University had done some preliminary scanning of some of the largest Internet Service Providers (ISPs) in North America, Europe, and Asia and uncovered thousands of embedded devices susceptible to attack, thanks to default credentials and remote administration panels being available to the Internet.

This is amazing to us here at MSI. It is astounding that such a number of people (and possibly organizations) who don’t take into account the security implications of not changing these credentials on outward facing devices, exists! This goes beyond patching systems and having strong password policies. It’s highly unlikely you’re developing strong passwords internally if you’re not even changing what attackers know is true externally.

The fact that these devices are available is quite scary. It becomes trivial for an attacker to take over control of what is likely the only gateway in a residential network. The average user has little need to access these devices on a regular basis, so hardening the password and recording it on paper or even using a password vault like TrueCrypt is a good option for reducing the threat level. More importantly, how many home users need outside access to their gateway?

This all goes back to the common theme of being an easy target. If you let attackers see you as the low hanging fruit, you’re just asking to become a statistic. This is the digital equivalent to walking down a dangerous street at night with your head down, shoulders slumped, avoiding eye contact, and having hundred dollar bills popping out of your pockets! We can’t make it easy for them. It’s important that we make them think twice about attacking us- and simple things like changing default passwords or patching our machines (automatic updates, anyone?) allow us to take advantage of that 80% result with only 20% effort!

Martin McKeay Interview: Verizon Data Breach Investigations Report

I just listened to Martin McKeay’s interview with Alex Hutton and Chris Porter on the latest Verizon Data Breach Investigations Report.

It’s a good interview, with Hutton and Porter both outlining how the report compared with last year’s and what surprised them. Here’s a link to the report.

Check out the podcast, which is about 30 minutes in length. And if you can figure out what the “secret code” is on the report’s cover, let us know. We like mysteries!

Massachusetts Getting Tough On Data Breach Law

From Slashdot:

“A Massachusetts restaurant chain was the first company fined under the state’s toughest-in-the-nation data breach law, according to a statement by the Massachusetts Attorney General. The Briar Group, which owns a number of bars and restaurants in Boston, is charged with failing to protect patrons’ personal information following an April, 2009 malware infestation. It was ordered to pay $110,000 in penalties and, essentially, get its *&@! together. Among the revelations from the settlement: Briar took six months to detect and remove the data stealing malware, continuing to take credit and debit cards from patrons even after learning of the data breach, said Massachusetts Attorney General Martha Coakley.”

Full Story

This is exactly why we developed our latest addition to our HoneyPoint family of products: HoneyPoint Wasp. It is a great way to monitor Windows-based desktops with minimal fuss, decreasing help desk calls while allowing the IT department to quickly take action when malware is detected. Learn more about HoneyPoint Wasp.

Hey, You! Get Off My Secure Cloud!

Recently, the issue of cloud security came up in one of our meetings.

“USB’s are going to be a thing of the past,” quipped our CEO. At first we had the hype. Now we have the reality. More and more data is being stored in the cloud.

A recent article in PC World asks the question: Public Cloud vs. Private Cloud: Why Not Both?

…a recent Info-Tech survey shows that 76% of IT decision-makers will focus initially or, in the case of 33% of respondents, exclusively on the private cloud.

“The bulk of our clients come in thinking private. They want to understand the cloud, and think it’s best to get their feet wet within their own four walls,” says Joe Coyle, CTO at Capgemini in North America.

But experts say a better approach is to evaluate specific applications, factor in security and compliance considerations, and then decide what apps are appropriate for a private cloud, as well as what apps can immediately be shifted to the public cloud.

Last year, we noticed the trend toward “consumer use of the cloud” and how that would leak into your enterprise. Now more companies are utilizing the cloud, even building private clouds that act as gated communities.

One thing is certain. Attackers will be also looking to land on one of those clouds. Keep current with best practices by bookmarking sites like Cloud Security Alliance. Forewarned is forearmed.