HoneyPoint Cracks with a Hidden Cost

Posted on by
Reply

OK, so we have been aware of a couple of cracked versions of HoneyPoint Personal Edition for a while now. The older version was cracked just before the 2.00 release and made its way around the torrent sites. We did not pay much attention to it, since we believe that most people are honest and deserve to be trusted. We also feel like people who value our work will pay the small cost for the software and those that just want to play with it and are willing to risk the issues of the “warez” scene would not likely buy it anyway….

However, today, someone sent me a link to a site that was offering a crack for HoneyPoint Personal Edition. The site was not one I had seen before, so I went to explore it. I fired up a virtual lab throw away machine and grabbed a copy of the crack application.

As one might expect, the result was a nice piece of malware. Just for grins, I uploaded it to Virus Total and here is the result:

http://hurl.ws/432e

Now, two things are interesting here. First, the crack is not even real and does not work. Second, once again, the performance of significant anti-virus tools are just beyond poor. 6 out of 41 products detected the malware in this file. That’s an unbelievably low 14.6% detection rate!

The bottom line on this one is that if you choose to dabble in the pirate world, it goes without saying that, sometimes you will get more than you bargained for. In this case, trying to get HoneyPoint Personal Edition for free would likely get you 0wned! Ahh, the hidden costs of things…..

If you are interested in a legitimate version of HPPE, check it out here.

In the meantime, true believers, take a deep breath the next time your management team says something along the lines of “…but, we have anti-virus, right…” and then start to educate them about how AV is just one control in defense in depth, and not a very significant one at that…

MicroSolved’s “Best Of” Security News July 10, 2009

Posted on by
Reply

What an interesting week! South Korea and the United States experienced attacks on computers with a nasty virus that supposedly today, erased data from computers that had not been updated with anti-virus software.

Korea DDOS virus mission shifts to destroying, erasing data

IBM researches rolled out new technology to mask sensitive data. Their approach differs from others in that it doesn’t make copies of the data and removes certain elements of it depending on who will be viewing it and their user rights to the data. The masking is done “on the fly.”

IBM Researchers Unveil New Data-Masking Technology

Apple is pretty quiet regarding all this issues that are starting to pop up with their brand spankin’ new iPhone 3GS. Everything from a shorter battery life to phones heating up, customers have been more than disappointed by all the hype regarding this latest version of the popular tech gadget. Security vulnerability sent up a red flag. (And I’m sure @lbhuston is very grateful now that he didn’t purchase the 3GS. As for me, I just signed a two-year contract in January, so I’m not budging, either.)

As Three Big iPhone Troubles Surface, Apple Dinged for Secrecy

What were some of the infosec stories this past week that caught your eye?

Security Guard Charged With Hacking Hospital Systems

Posted on by
Reply

I came upon this story today, which should remind every hospital guard administrator of Pogo’s wry observation, “We have met the enemy and he is US.”

On Friday the federal authorities arrested Jesse William McGraw on a charge of felony computer intrusion, saying he intended to use the botnet to launch a massive distributed denial of service (DDOS) attack on July 4, the day after he was set to stop working there. He’d nicknamed the day “Devil’s Day.”

He worked for a Dallas security company called United Protection Services, on the 11 p.m. to 7 a.m. shift at the clinic.

McGraw, who went by the hacker name GhostExodus, allegedly installed malicious software all over the Carrell Clinic, including systems that contained confidential information, and others that managed the building’s climate-control systems, authorities said Tuesday.

The hacker could have harmed patients or damaged drugs if he had turned off air conditioning during Texas’s hot summer months, authorities said.

Rest of article

It would seem he was itching to prove his mad hacking skilz by donning a hoodie while riding an elevator, looking into the camera and while the theme from “Mission: Impossible” played, said, “You’re on a mission with me: Infiltration.” As brilliant as he thought he was, he earned a major FAIL by typing on a keyboard and then putting gloves on to mask his fingerprints. Also he posted the ubiquitous YouTube videos to explain said brilliance. (And yet he can play the violin pretty well.)

All the more reason to pay attention to who’s wandering down your hallways. Not only would this guy have attacked the hospital’s network system, but they could easily have been sued for negligence when Uncle Bob suddenly keeled over because his room became an oven.

Encryption: 3 solutions to fit your budget

Posted on by
Reply

When your worst fears become a reality and you notice there has been some breech of your data (a stolen laptop, an unlocked or unattended computer) and someone has either access to your machine or has a copy of it for themselves, is there any hope left? Although most don’t think it’s necessary, encrypting data is another link in the chain mail that is our security policy. While this link is not substantial on it’s own, the entire suit of armor is where the true strength lies.

Data encryption sounds scary. People think of lines of binary crossing the screen at lightening speed like a scene from The Matrix or Hackers, but it’s become something so simple that everyone should be doing it! In this post, we’ll review some free and open source solutions to offer protection and peace of mind that what’s yours stays yours!

Encrypted Password Manager: KeePass

KeePass is a powerful password manager that supports the Advanced Encryption Standard (AES) and the Twofish algorithms to encrypt your passwords and various account information. In addition, SHA-256 is used as password hash. This means a master password is hashed using this algorithm and the output is used as a key for the encryption. One master password will decrypt the entire database which supports multiple user keys, which offers the option to have your key on CD, USB or floppy (floppy disk, really?) in addition to or in lieu of a password. KeePass is small and portable. This means it runs just as smoothly from a USB disk as it does installed to a hard drive. KeePass doesn’t store anything on your system. No registry keys are created or modified and no INI files are added to the Windows directory. Deleting the KeePass directory or using the uninstaller leaves no trace of the program after removal. This tool has too many features to list completely if we intend to discuss others, but a random password generator allows you to create a password within KeePass and then copy it and paste into the necessary forms using intuitive and secure clipboard handling. One final feature that can’t be left out is the ease of database transfer. When passwords need to be available on multiple machines or in a multi user setting, a simple copy and paste of a single database file is all it takes to solve the problem.

“The sun will go nova before you can decrypt the database”- www.KeePass.info

Encrypted Volume Manager: TrueCrypt

TrueCrypt is an open source disk encryption program that creates a virtual encrypted disk within a file and mounts it as a real disk. Encryption is automatic, real time, and transparent. This virtual partition can be read and written to as fast as if it were not encrypted thanks to the use of parallelization and piplelining of data. This tool allows multiple encrypted volumes to be created and relies on AES-256, Twofish, and Serpent algorithms to protect your sensitive data. TrueCrypt can be downloaded and installed quite easily and includes a setup wizard which will guide the creation of the encrypted volume. Once created, the interface allows you to mount one or multiple volumes, which then gives the ability to treat these as local drives to store data at will. Very smooth in use, very user friendly, and something any user should employ to protect personal and/or private data of any kind. – www.truecrypt.org

Email Encryption: x.509 Certificates

x.509 email encryption assumes a strict hierarchical system of certificate authorities, much unlike the “web of trust” models like PGP, x.509 is a ITU-T standard for public key infrastructure (PKI) for single sign-on and Privilege Management Infrastructure (PMI). Specified within x.509 are standard formats for public key certificates, certificate revocation lists, attribute certifications, and certification path validation amongst other things. While the TrueCrypt’s use of MD5 based certificates was in question as recently as 2008, x.509 certificates based on SHA-1 are deemed to be secure. While it is prudent for companies to use enterprise level encryption solutions, individuals can protect themselves with the help of a free x.509 personal email certificate from www.thawte.com.

More often than not people see encryption, passwords, and monitoring policies more of an annoyance than anything else. Few would argue that it’s a pain to have to input a password to do anything at the system level or to have to remember to mount, unlock, and unmount an encrypted volume, or to have to allow access through a firewall- until you need it. When someone steals your data, you’ll be happy to know your passwords are locked up safe, and your data is encrypted to the point you can back up and change anything sensitive before the bad guys can get to it! Keep your armor strong and polished and most foes will seek alternative victims. Don’t be an easy target!

Table Top Testing Your Incident Response Process

Posted on by
1

Here is a slide deck for a presentation I gave today about a cheap, easy and effective way to test your incident response process.

It is a lot like a corporate game of Dungeons and Dragons (IT Manager needs food badly!), except that you get to actually see what your team knows and needs training on about your environment, the process itself and/or other specifics that could be useful during a real information security event.

If your interested in the topic and would like to schedule a presentation or the like, just let me know. Enjoy the slides and take a stab at role playing as a mechanism for testing business processes. Our experiences have shown it to be a worthwhile investment, and of course, let me know if you need me to be the “Dungeon Master”… 🙂

Testing your Incident Response Team

If the above link does not work, try this one.

HoneyPoint Managed Service Now Available

Posted on by
Reply

The initial private launch is complete, and the public launch has begun. HoneyPoint Security Server is now available as a managed service!

HoneyPoints can be deployed as software on your internal existing servers and workstations or on our VMWare virtual appliance. We manage the console and deliver real time email alerts, support and advice on security incidents. Incident response consulting and handling help is also available at a reduced hourly rate to HP Managed Service clients.

In addition to leveraging the power of HoneyPoints and HornetPoints, you also get easy, automated monthly reporting to make your life as an IT administrator or security team member easier.

As a special introductory price for readers of the blog, our newsletter and friends of the firm, you can sign up now for HoneyPoint Managed Services for as low as $99.00 (US) per month. Plus, for being a supporter of MicroSolved and our efforts, we will waive the setup fee ($195.00 normally) if you join the program before the end of July, 2009!

Interested in putting the power of the HoneyPoint Hive to work for your organization? Give us a call (614-351-1237 x206) or drop us a line (info@microsolved.com) and learn more about how to get more security with the least amount of effort. We’ll be happy to share our success stories with you. We look forward to working with your team!

Thoughts on Increasing Security in the Smart Grid

Posted on by
Reply

There has been a lot of attention lately on the “smart grid” and the coming evolution of the US (and global) power grid into a more robust, information and data-centric environment. Much press has been generated around the security and insecurity of these changes.

Currently, NIST and various other concerned parties, are hard at work on formalizing the standards around this particular environment and the products that will eventually make up this public spectrum of life. In the MSI lab, we have researched and reviewed much of this data and would like to offer forth some general recommendations for both the consideration of the various standards bodies and the particular vendors developing products in this area. Here they are, in no particular order:

First, we would ask that you design your products and the underlying standards with industry standard best practices for information security in mind. The security practices for IT are well established, mature and offer a large amount of protection against common security issues. Please include them in your designs.

Next, we would offer the following bullet items for your consideration:

  • Please take steps to minimize the attack surfaces of all products throughout the system to reduce the chances that attackers have to interact with the system components. Many of the products we have looked at offer far too wide and too many attack surfaces. This should definitely include reducing the attack surfaces available to system processes and thus, by implication, malware.
  • Please ensure that your system includes the ability to update the components in a meaningful way. As the smart grid system evolves, security issues are bound to arise and being able to patch, upgrade and mitigate them where possible will be a powerful feature.
  • Please implement end-to-end detective controls that include the ability to monitor the components for fraud, tampering, etc. Please include not just operational detective controls, but also logging, reporting and support for forensic hashing and other incident analysis capabilities.
  • You MUST be prepared to implement these systems with strongly authenticated, role-based access controls. Implementations that rely solely on single factor authentication are not strong enough for banking applications, so they should not be considered strong enough for the power grid either.
  • Please take every opportunity to prevent and restrict data leaks. Reducing the information available to the casual attacker does help prevent casual compromise. While these reductions might not prevent the determined, focused attacker, the exposure of these attack surfaces to the casual attacker is much more probable and thus should be controlled for in your security equation.
  • When you implement encryption into your products and systems, please choose appropriate, strongly peer-reviewed encryption. Proprietary encryption is too large of a risk for the public infrastructure. Also, please ensure effective, yet low resource requirement key management. Complicated key managed approaches do not differentiate your product in a good way, nor do they usually enhance security in any meaningful way. Proper key management technologies and encryption exist, please use them.
  • The same goes for protocols as encryption. We have standard protocols defined that are mature, stable, understood and effective. Please leverage these protocols and standards wherever possible and reduce or eliminate proprietary protocols. Again, the risk is just too large for the world to take a chance on unproven, non-peer reviewed math and algorithms.
  • Please design these systems with defense in depth in mind. You must provide multiple controls for confidentiality, integrity and availability. Failure to do this at a meaningful level creates substantial risk for you, your clients and the public.
  • Please ensure that your allow for rational processes for risk assessment, risk management and mitigation. If systems require high complexity or resources to perform these tasks, they simply are not likely to get done in the longer term of the smart grid when the shiny newness rubs off.
  • Please apply the same care and attention to consumer privacy and protection as you do to managing waste, fraud and abuse. This helps you design more secure components and protects both you and the public in a myriad of ways.
  • Please ensure that your product or system includes appropriate training materials, documentation and ongoing support for handling security and operational issues. Very little of the smart grid technology is likely to be “fire and forget” over the long haul. Please make sure your organization continues to create appropriate materials to educate and inform your users.

Largely, the rewards of the smart grid are incredible. Energy savings and reduced ecological impact are both key components of why the smart grid is in the public eye and is achieving so much momentum. However, like all change, the public is right to fear some facets. If done right, this will become the largest, most technological network ever created. Done wrong, it represents a significant risk for privacy, safety and national security. At MSI, we believe that the project can and will be done right! Thus, we want to contribute as much as possible to the right outcome.

Thanks for reading and please, take some time and educate yourself about the smart grid technologies. Your voice is very important and we all need to lend a hand and mind to the effort!

MicroSolved’s CEO and Security Evangelist Interview With [IN]SECURE Magazine

Posted on by
Reply

issue-main-21

[IN]SECURE Magazine, the fresh and innovative online magazine from Help Net Security (HNS), interviewed Brent for their June issue. Mirko Zorz, Editor-In-Chief, caught up with Brent to pose some great questions that allow the readers a glimpse into a “different kind” of CEO. Brent shares his insights about his role within MSI, future security threats, and developments within the information security field.

You may download the interview here.

Help Net Security is an online portal that covers all the major information security happenings. The portal has been online since 1998 and caters a large number of Information Technology readers specifically interested in computer security. For the entire June issue of [IN]SECURE Magazine, you can download it here. Great reading!

Interview with Syhunt CEO

Posted on by
Reply

This week I got a chance to ask a couple of questions about Syhunt SandCat and the future of web application security. Here is the exchange with some great insights into where the web and attackers are heading!

Quick Interview with Felipe Aragon, CEO of Syhunt.

Q: The 3.8 release represents a significant step forward in application security scanning, especially around Javascript. What are the key features that application testers should know about in the 3.8 product?

R: Browsers and the web evolved significantly over the past years. Sandcat has evolved together with the new advancements and now has a lot in common with modern web browsers. This is essential because if you want to seriously hunt security breaches in web 2.0 applications you have to emulate modern Web technologies. So, naturally Sandcat evolved to understand JavaScript, AJAX and PHP and is now what is known as a hybrid web application security scanner. We also implemented multi-thread sessions, making each host scan a different process (Google Chrome, for example, employ a similar technique, making each tab a different process). Other important features we got working in Sandcat is the ability to simulate user interaction and multi-layer defense evasion. Sometimes, after evading a WAF (web application firewall), the last layer of defense against exploitation is a regular expression filter, which can also be bypassed by using many different techniques, so we got this working in Sandcat. Unfortunately weak filters were popularized and today many websites are vulnerable to this attack.

Q: How are Javascript threats influencing the state of application security today?

R: Thanks to JavaScript, Web applications are becoming increasingly more sophisticated, so next-generation web applications must be handled like desktop applications. Browsers like Opera, Firefox, Safari, Chrome are now adding faster JavaScript VMs each release because this is where the Web is going. Increased usage of JavaScript changes everything. It changes the way web developers build web sites, and the way hackers search for vulnerabilities or take advantage of weak spots in web applications. It makes more difficult for web developers to build secure web applications and, of course, for pen-testers that are unskilled web programmers to fit in in this new world. JavaScript can be used to steal cookies, spread worms, launch XSRF attacks and many other malicious purposes. The attacks are limited only by the attacker’s imagination.

Q: Where do you see application security heading in the next 12 months? What types of attacks should we be paying attention to that are slipping below our radar right now?

R: Right now we are monitoring the emergence of new web platforms (such as the recently announced Google Wave) that will make the 3.0 version of the Web possible. I believe we are heading towards the end of an era for the Web, a Web OS is materializing. These web 3.0 platforms and extensions built for these platforms will be a major target for cybercriminals. We have a set of new vulnerability classes and combined attacks (using both old and new classes) on the horizon. It will take a lot of time for web developers to understand how certain lines of code, client-side or server-side, translate to some serious security issues and how to avoid them. It might actually never happen because the Web and attack methods will continue to evolve faster. Without innovation, there is no future for the web, but I hope organizations will do whatever they can to understand and minimize security risks within their Web systems and not allow the cyberspace to become more insecure than it is today.

Check out SandCat’s new release at http://www.syhunt.com.

PS – In fair disclosure, MSI has a business relationship with Syhunt.