Security B-Sides Boston - 5/18/2013

See http://bsidesboston.com/ and http://www.securitybsides.com for background on Security B-sides conferences.

Keynote: Privacy as Identity

Dr. Geer

The speaker works with a company called Inqtel. Inqtel is an investment firm whose funding comes by way of the US intelligence community. One of their companies was Keyhole, now Google Earth. They're headquartered in DC, with a local office in Waltham.

Technology changes very quickly. So quickly, that the implications of new technologies cannot be reflected in policy prior to adoption. Policy struggles to keep up. This isn't a bad thing. We live in a free society; you're allowed to do anything that isn't explicitly forbidden. The alternative is authoritariansm, where you're only allowed to do things that are explicitly permitted.

You don't need laws to prevent the impossible. But things that were impossible a few years ago are possible today. The rate of change isn't just about technology; it's about the implications of new technology.

There are around 25 congressional bills that deal with cybersecurity, most of which you wouldn't like.

We have so many laws that all enforcement is selective. See Harvey Silvergate's book Three Felonies a Day. Given our current laws, the average person commits three felonies a day, whether they realize it or not.

NSTIC: National Stratgies for Trusted Identies in Cyberspace. The people who wrote this legislation are concerned with attribution. They consider privacy a problem.

The internet was built on the end-to-end principle. The network is nothing more than a transmission mechanism; it doesn't enforce policy. All policy enforcement takes place at the endpoints.

When reading public policy documents, always start with the definitions. Most of the substance is in the definitions. The definitions will give you a good sense of what the rest of the policy is about.

At the moment, technology isn't out of our control. Someday, it could be.

Tomorrow night, 60 minutes will air a segment on reidentification technologies. It's worth watching. If you're unique in any way, then you can probably be identified.

The world's corpus of data is doubling every 30 months. This rate of increase surpasses improvements in storage, and improvements in bandwidth.

Punctuated Equilibrium: period of relative calm, punctuated by periods of rapid change.

Many of our security problems started when Microsoft included a free TCP/IP stack in Windows 3. They took an operating system that was designed for a single user, and exposed it to the rest of the world. On the internet, every sociopath is your next door neighbor.

In the last five years, vulnerability research has gone from being a hobby to a full time job. When it was a hobby, your "income" was recognition (for finding a new exploit), and new exploits were announced shortly after discovery. Today, exploit discovery is motivated by profit, and new exploits aren't announced as quickly. When you're paid to find exploits, you don't share.

Intrusion prevention is probably a lost cause. Intrusion toleration is a more tractible approach.

The US could corner the world market for cyber vulnerabilities if it wanted to. The cost to buy this things is barely a drop in the bucket. We should do this, and we should make all of the vulnerabilities public. This would empty everyone's warehouse of exploits. If we keep exploits secret, then other countries will too, and everyone will be sitting on their own little nuclear arsenal of zero-day vulnerabilities.

Many computer security laws only address what you've done; they completely ignore the issue of intent. That's a major departure from our legal tradition.

The practice of law is the search for analogy.

Denial of service attacks can be purchased rather cheaply.

Washington is relying on ISPs and other service providers to enforce their laws. They've deputized many of the companies, often against their will. Instead of deputies, service providers should be treated as common carriers.

Lately, there are been discussions about a potential back door in Skype. What motivation would Microsoft have for putting a back door in Skype. Some country probably insisted on it. That's the downside of doing business internationally; you'll have to conform to a lot of different laws.

Recording everything is cheaper than recording things selectively. To security professionals, "how long has this been going on?" is often more important than "who is doing this?".

According to the Cyber Security Confidence Index (?) risk tends to go up month over month, but the types of risks move around. This index is compiled from a list of surveys, solicited to security professionals.

Most firms don't know what data they have. If you don't know what data you have, then how do you go about protecting it?

The average zero-day exploit is in use for 300 days before becoming public knowledge.

The ability to observe is increasing rapidly. We can do facial recognition at 500 meters and iris recognition at 50 meters. We also have the ability to identify people by reading their cell phone acclerometers (we all walk a little differently). Once you have observability, how far is the leap to identifiability.

The speaker prefers the following definition of security: security is the absense of unmitigated surprise. Along similar lines, privacy is where you've retained the capacity to misrepresent yourself.

All security technologies are dual use. Any technology can be used for offsensive or defensive means.

What will you own in five years? You can't will (for example) your iTunes collection to a friend, because you don't own it. Your entire iTunes collection is licensed. Who owns your face? If all of your mail is stored in GMail, then who owns that?

The most important things are usually uninteresting. The most interesting things are usually unimportant.

Cloudy Weather: How Secure is the Cloud?

Dan Stolts

The speaker's web site is http://itproguru.com. He also maintains http://bostonusergroups.org.

This talk will focus on Microsoft Azure, but many of the issues we'll discuss are common to all cloud providers.

Thinking about putting your data in the cloud? Here are some factors to consider:

• Confidentiality. Who can see your data?
• Integrity. Once you've stored data in the cloud, how can you be sure it isn't changed?
• Availability
• Risk management and compliance

Moving data to the cloud involves some customer accountability. For example, you'll want to choose a better password than "password".

In a multi-tenant system, who can read your data? At the cloud provider, who has access to your data? There's inherently some level of trust involved.

Google's cloud policy: Your data is our data.

Microsoft's cloud policy: Your data is your data.

Windows Azure complies with SSAE-16, EU-US Safe Harbor, ISO 27001:2005, and several other certification programs. See the Windows Azure Trust Center for more information about Microsoft's privacy, transparency, and compliance policies.

When you store data with a cloud provider, you need to understand their policies, and you need to decide whether (or how much) you trust them.

Security considerations:

• Physical data center security and monitoring

• Network. Firewall and packet filtering. Azure does automatic, on the fly network changes as new systems are spun up. This prevents tenants from accessing each other's network segments. Tenants should not be able to tweak network security settings.

• Host. Azure dedicates specific cores to specific tenants. This prevents tenants from watching each other's CPU activity.

• Applications. The issues of trust and policy apply when choosing applications, as much as they apply when choosing cloud providers.

• Data and Database. Store keys and data in different places.

Is the cloud secure? Yes, if

• You trust the cloud provider's certifications

• You trust your users

• You trust your cryptography implementations

Question: How do the security models differ between Amazon EC2 and Azure?

That's a long discussion, because there are a lot of differences.

Question: Does Azure's trust center allow you to store key encryption keys in an external service?

I think so, but I'll have to double-check.

Plunder, Pillage, and Print

Deral Heiland

This talk is about information discovery and extraction from embedded devices, such as printers, routers, switches, and power distribution units.

Embedded devices are plagued by security issues: default passwords are never changed, poor product design, lack of patch management.

What information can you obtain from embedded devices? The most useful things are: information about other network hosts, user credentials, and SNMP community strings.

See http://foofus.net

Pen Test Story #1. This story comes from a penetration testing engagement. We were trying to obtain A/D credentials from the client's network. The client was very proactive about security, and tried to follow best practices. Machines were all running current versions of windows, security patches were up to date, and users didn't have administrative access on their local machines.

We found a couple of (Canon) printers that still had default passwords. These printers were configured to use the client's active directory server. The printers also had several address books. These address books contained domain usernames, and clear-text passwords.

Why does a printer need an LDAP addressbook? Good question.

Canon IR address books store passwords in clear-text. Canon IRadv printers encrypt passwords during address book export. However, there's a configuration option to turn off the encryption. Aside from a configuration option, you can turn off encryption via HTTP POST. And address book export is a response to an HTTP POST to the printer's admin interface. The POST contains a parameter called enc. Changing enc=2 to enc=0 gets you clear-text passwords.

Lesson: if you have a multi-function printer, be sure to change the default password.

Pen Test Story #2. Our goal is to steal all of the client's Active Directory credentials, and use them to escalate our privileges.

Network file shares are a good place to collect information. Sometimes you'll find backup firewall configurations. Or, if you know the right community strings, you can extract configurations via SNMP.

APC devices can be a good way to obtain community strings. The default password is apc/apc, and many people forget to change it.

You should use different community strings in different security levels. For example, your office firewall and your APC PDU have different security levels.

APC devices are in every data center. If you hack into one, you have the ability to power down hardware.

Over the last few years of doing security engagements, we've found that embedded device vulnerabilities have become more common.

Pen Test Story #3. Newer printers have the ability to do LDAP authentication. If you can get into one of these printers, set up an `evil' LDAP server, and tell the printer that `evil' is its LDAP directory. Some printers will send clear-text passwords to `evil'. This is called a pass-back attack.

Sharp printers can be configured to use plaintext (LDAP) authentication. Unauthenticated users have the ability to make this change.

Leasing companies are an attack vector. Companies that lease printers also service them. These companies tend to use the same passwords everywhere. If you know a password that works at one site, it will probably work at other sites.

At the very least, multi-function printers will give you a list of usernames. Once you have this list, start searching through file shares. You'd be surprised at how often you'll find a document with passwords.

Praeda. Praeda is an embedded device information harvesting tool. See http://github. com/percx/praeda.

Praeda has profiles for around 72 devices, and we'd welcome contributions of new device profiles.

Question: Have you ever tried to get information out of data stored on the printer (e.g., the printer's hard drive).

We haven't tried. But you can get some interesting things out of scanners. Lots of offices provide employees with cheap personal scanners, and employees sometimes leave sensitive documents on the scanner bed. If you can get into the scanner, you can get a copy of whatever's on the scanner bed.

Most printers take firmware upgrades via the print port (e.g., port 9300), and none of them verify the integrity of the upgrades. With some manufacturers, it's very easy to embed malware in a printer firmware upgrade, and the printer is happy to let you install it.

Every device that plugs into your network has a web interface. That should be your first attack vector.

Security Change Call for Volunteers

Oliver Day

Security Change is a non-profit that does security consulting to agents of change. Who are agents of change? They're the people trying to make a difference in the world.

Our web site is http://securingchange.org.

Many non-profits don't have a security budget. They fall below the security poverty line.

Security change uses a "pay what you can" model. We're trying to lower the security poverty line. Many small non-profits have as many adversaries as large well-funded organizations.

We need volunteers in order to offer pro-bono security work. For example, to run automated vulnerability scans against the non-profit's web site, then sit down with the organization's director and explain the results. We need people to do this kind of work.

In the non-profit space, security issues often require creative solutions - not the typical things you'd do in a large corporation. For example, a robust backup strategy might be the most cost-effective countermeasure.

We also need incident response people (e.g., when an NGO's web site is hacked by an adversary). This is the most common security incident that we see.

We're planning to develop a backup service, inspired by the EFF's mirroring site. In version 1, we'll make a copy of your web site as static HTML pages. Version 2 will be a more thorough backup system.

We're also thinking about creating a security operations center, and offering forensic log analysis.

We started this organization in October 2012, and we have three clients so far. The mechanics of becoming a non-profit have taken a lot of time.

We have 14 volunteers. We're asking for minimum commitment of one hour per month.

We want to assign two volunteers per client, so they can cover for each other.

Question: Are there organizations that you won't work with?

Yes. Hate-based groups are out. Political groups are tricky. It depends on who volunteers do and do not want to work with.

If you'd like to volunteer, contact us at volunteer@securitychange.org.

Good Enough Isn't Anymore: the Value of Hitting Rock Bottom

Josh Corman

No one changes until the pain of maintaining inertia is greater than the pain of changing.

We spend a lot of money on signature-based anti-virus products, and those are becoming less and less effective.

State-sponsored espionage is very common to those in the security world.

We're getting better, but we're getting worse faster.

Burnout is becoming more and more common in the infosec world. The Maslock stress index measures fatigue, cynicism, and perceived self-efficacy. Infosec people are off the charts in the first two categories.

When protecting assets, it's important to consider replaceability (i.e., how easily can the asset be replaced). Credit cards are highly replaceable, yet we spend a ton of effort protecting them.

Our dependence on software and IT is growing faster than our ability to secure it. For example, the first SQL injection attacks appeared 14 years ago. SQL injection attacks are still a problem today.

A lot of embedded devices are directly connected to the internet, and completely unsecured.

Today, we have cars with vulnerable, unpatchable, operating systems.

Try this exercise for 24 hours: when talking, replace the word "software" with "vulnerability", and replace "connected" with "exposed".

Vendors don't need to be ahead of security threats. They just need to be ahead of the buyers.

HD Moore's law: the power of a script kiddie doubles every day.

When doing vulnerability assessments, the adversary makes all the difference.

The Future of Drones and the Impact on Infosec

Andrew Clare

We tend to think of drones as being for military use. In the next few years, expect to see more non-military uses. For example, searching for lost people (search and rescue), crop dusting, tracking weather, finding poachers, cleanup of nuclear disasters, journalism, and wildlife studies.

halab.mit.edu: human and automation labs.

Some research focuses on making it easier to humans to control unmanned vehicles. We're enhancing vehicle autonomy, but we're also increasing vulnerability.

There's research in operating UAVs in GPS-denied environments. For example, drones that can fly inside underground parking garages. The drone has to learn its way around. There's also research in miniaturization: flying drones that are the size of a quarter.

An expected time line for non-military UAV deployment:

• Within 5 years: agriculture, low altitude photography
• 5-7 years: Self-driving cars and passenger trains.
• 10+ years: cargo delivery
• 20+ years: unmanned commercial flights, personal flying cars.

Certification is a challenge. How do you certify complex automation systems? Who's ultimately responsible for what UAVs do? The operator? The computer? The company that developed the UAV? The engineer(s) that wrote the UAV software?

Infosec issues affecting UAVs:

• GPS spoofing
• Hacking control links
• Supply chain security (who made the parts that were used to build the UAV?)
• Interaction between unmanned vehicles
• Relying on automation systems before we have the ability to secure them

Question: Are the precedents for UAVs technology systems?

Fly-by-wire might be a predecessor, but it's not quite the same. Fly-by-wire operates on a closed system. UAVs are exposed on standard networks.

Question: What about regulation?

The FAA is required to attempt to integrate UAV regulation by 2014. Some local communities are passing their own laws. As the technology becomes more popular, anti-UAV measures will probably become more widespread.

Question: What about other governments?

Many other countries are ahead of us in UAV implementation. For example, Canada, Japan, Russia, India, and the United Kingdom.

Comment: Cost savings was a huge motivation for the military use of UAVs. Keeping people out of risky situations was another motivation.

UAVs can be used to analyze networks. For example, by reading electromagnetic energy emissions from wires. There's a conflict of interest in UAV security. Security costs money, which goes against the goal of making low-cost UAVs.

Question: Why has there been more adoption outside the US than inside the US?

Regulatory factors are the biggest reason. We also have a more complex airspace inside the United States. Our military has done more work than other countries, but the military can control the airspace.

Comment: The NTHSB has asked for money to research vulnerabilities in automotive computers. A lot of technology is feature-driven, without being secure.

Three states allow autonomous vehicle testing. Some people jam the GPS systems in their cars. This would be a major problem for precision GPS systems in self-driving vehicles.

The State of Privacy and Proper Planning for the Future

Jeff Northrop

In 1890, Judge Louis Brandeis published one of the first articles about the loss of privacy to technology. Camera were the technology in question. Similar arguments were made with the advent of audio and video recording.

In 1967, Alan Westin wrote about the risks of privacy loss due to computers. He saw loss of privacy coming from data correlation. He also helped push forward the Privacy Act of 1974. In 1974, the main fear involved what the government would do with your personal data.

In 1998, we saw passage of the EU Data Directive. It's a set of suggested regulations that gives citizens a lot of control over their own data.

Forrester research produces a heat map of privacy laws. Europe is hot. The US is cold, on par with Russia, and only slightly warmer than China.

Today, we have a menagerie of privacy laws, both at the federal and state level. There are 25 congressional bills on the internet. Nearly all of them have some privacy component.

Question: How difficult is compliance with EU regulations?

It's an entirely different creature. The EU Data Directive was a framework, rather than a set of regulations.

Security and privacy does not equal compliance. For example, there's a social mobile app called Path. Path was mining data from mobile phone address books. The FTC issued a judgment against them, and Path has to undergo 20 years of regular privacy audits. Google Street view was fined $7 million, and required to do public education on security and privacy. Neither Path nor Google overtly broke any law, but they violated general expectations of privacy.

We've had advances in data analytics, and consumers feel they are losing control of the personal information. This is a source of tension, and there's no solution yet.

We share personal information in a lot of ways: phones, shopping cards, EZ passes. The primary uses of data are okay. Secondary and tertiary uses are the problem.

Comment: I think people are not paying attention to what they're doing, in terms of EULAs, etc.

Facebook actually gives you a fair amount of control, but not everyone takes advantages of those controls.

Question: How many people here read privacy policies?

Around 5 of 25 people raise their hands.

Comment: A key challenge with privacy policies is keeping track of third parties that you've shared data with, and being able to retract data from those third parties.

NIST 800-53 covers information security and privacy controls for government agencies. That might be relevant here.

On one hand, consumers fear the proliferation of their PI. On the other hand, technology makes it easier to store data, and to do analytics. PII is the fuel that makes analytics run. Reducing fear and allowing innovation to move forward is a major challenge.

To get privacy right, we need transparency and accountability.

What does a privacy program entail? Typically a Chief Privacy officer, a team, and a vision. Internal privacy teams are focused on risk management. This is a form of security management. Set your metrics, and measure how well you're doing.

Cyber insurance is useful. It can help you cover the cost of a data breach. You should have plans for resolving data and privacy breaches.

Question: Is the advancement of privacy complicated by customer misconceptions?

Meaningful transparency is the hardest part, and the most important part.

The Noob Persistent Threat

Allison Nixon and Brandon Levene

Some people just need a high-five. In the face. With a chair.

What is the Noob persistent threat? It's usually script kiddies. They're 14-18 years old, and the bottom feeders in the criminal landscape. They generally have a low level of technology skills.

There are web sites that sell DDoS services. Others will sell credentials, or root kits. Many of these are just scams.

Carder shops are market places to buy credit card numbers. Type "Credit Card CCV" in your favorite search engine, and see what comes up.

Booter shells are DDoS for hire sites. They're often used to target gaming web sites, or whatever your average 15 year old wants to get back at. Some booter shells use IaaS servers to amplify DDoS attacks. Oddly, nearly all booter shell sites accept payment via paypal. 70% of booter shells run on cloudflare.

It's not unusual for noobs to use booter shell sites to attack other booter shell sites. Question: can booter shells be used to attack smartphones?

Theoretically, yes. Practically, no.

See http://bit.ly/12iqEn1 for source code to one booter shell site.

Blucat: Netcat for Bluetooth

Joseph Cohen

The Blucat project was inspired by netcat.

Bluetooth URLs contain a protocol, a bluetooth address (which looks like a MAC address), and a channel number.

rfcomm is the most common protocol. b4spp, the bluetooth serial port protocol, is also common.

When probing, the first step is network discovery: what devices are in range, and what services are they advertising?

Once you discover a bluetooth address, you can scan the device's list of channels (there are around 30 of them). The device might offer services that it's not advertising.

We've found that some mobile phones accept AT commands over bluetooth.

Blucat is java based. It uses a popular bluetooth stack, and it's compatible with many devices.

Linux has a bluetooth stack called bluez.

Once you've paired an android phone, it's very easy to get a root shell over bluetooth. The lesson here: be very careful about what you pair with.

In cars, bluetooth connections are usually protected by trivial passwords, like "1111".