Archive for the 'Security Engineering' Category

Update to Single-Site-Browsers (SSBs)

Published on April 28, 2008 in Psychology of Security, Risk Analysis, Security Engineering, Security Industry, Social Engineering and Web. 3 Comments

I spent a lot more time thinking about SSBs over the last week or so and I’d like to use this blog to do a bit of a brain dump. A few days ago, Andrew Jaquith publicly posted the presentation that was sent me to privately. Here are links to his blog and to his presentation.

His presentation makes a number of claims about the security benefits of SSBs. It lists protection against phishing, CSRF, some types of XSS (likely all non-persistent varieties), and domain whitelisting as a future improvement to harden those protections.

I don’t think [current] SSBs completely provide those security benefits unless you do two things:

  1. You block non-SSBs from accessing your website (blocking on user agent string would be enough)
  2. You train users that an SSB is the only acceptable place to enter their password

Without those two requirements satisfied, it is my opinion that SSBs give little security benefit.

If you still allow non-SSBs to access citibank.com, then when a user clicks an XSS’d link to citibank.com, the citibank.com page will still load, and they will still be XSS’d. Similarly, CSRF continues to function as it is likely that the ’session cookie isolation’ benefit of SSBs are negated by the user likely having duplicate cookies in both their SSB and in Firefox (you must ensure the user never logs into citibank.com with their normal browser and obtain a session cookie there, hence the first requirement).

In order for the phishing protection to be effective, users must be aware that they are only supposed to encounter Citibank content in their SSB and not in their normal browser. For instance, if an SSB user encounters a Citibank phishing website in Firefox, will they close their browser and open their SSB instead? It might be the case that users will behave in this way, but I haven’t seen any verifiable proof either way.

[This hasn't been reported on ISIS Blogs yet, but next week marks the end of our first run of "The Psychology of Security/Social Engineering", a first-run research course here at Poly. I'm writing up a research proposal to test the above hypothesis with a group of students in the Fall.]

Lastly, if a bank starts deploying SSBs to their customers, I see this as a first step towards successfully forcing client-side requirements on users where the end-game is fully trusted computing and the open commercial web starts to disappear. This actually goes back to our “Refusing Insecure Customers” debate. It’s an evolution of the same (bad, according to readers) idea.

So, although I see where SSBs have some use and can positively affect your web security, let’s not kid ourselves, they don’t solve that much. To really be effective, they require major changes in the way you do business and [still] rely on an intelligent user. Rather, they look like avoidance of the base problem and an idealistic patch that isn’t going to work.

Oddly enough, I have been using a set of 4 Prism SSBs for the last 2 weeks and have actually grown fond of them, but not for security reasons at all. I like how they show up in my dock, that they rarely crash, and it seems natural to give such webapps “first-class” status as desktop applications. I’ll probably continue using them, but I don’t think I’ve gained any security from doing so.

That said, I think part of the problem here is that SSBs haven’t fully matured yet. I just heard about these things 2 weeks ago and I haven’t heard anyone else in the security community talking about them besides Andrew. They are a topic that deserves more attention and particularly more research from the security community as they embody a lot of attractive ideas. Despite my harsh words, I’m not ready to give up on them yet.

Let’s brainstorm: how could SSBs be more useful to security? Could we change the way they work or change how they are deployed to give us additional benefits? If you’re an InfoSec student with no good topic to research, this is without a doubt a good avenue to explore.

SFS presentation about Synology

Published on April 16, 2008 in Exploits and Security Engineering. 0 Comments

This morning I summed up everything that happened with Synology and everything I have continued working on since my previous article was written in a deck of slides at the weekly SFS meeting.

Here is an overview of the items not covered in the previous article:

  • The director of software development at Synology contacted me one business day after my ISIS Blogs post. They have already released a firmware update to fix the most critical issues and came up with an “enhancement” plan (security fixes are not enhancements, but I digress) to fix the rest!
  • I’ve started developing ARM/Linux2.6 shellcode so I can integrate a Synology exploit into Metasploit. First try: virtualize the firmware inside of qemu. Failed. Second try: install gcc directly on device. So far so good.
  • I wrote an FTP request module for Sulley to fuzz the FTP server Synology is using. I haven’t been able to use yet because I hit the built-in connection limit on the FTP server and it starts ignoring me. That is a project for another day.

See the entire deck of slides here: http://cryptocity.net/archive/synology_presentation.pdf

Multiple Vulnerabilities in ALL Synology Products

Published on April 4, 2008 in Exploits, Network Security, Operating Systems, Press Release and Security Engineering. 13 Comments

In an earlier post to my personal blog as well as to this blog, I enthusiastically recommended the Synology CS407 NAS as a data storage/backup platform. I am now taking that recommendation back.

Let me just say this: it seemed like a good choice at the time, and, if I could have trusted the vendor to deploy the software on it properly, it might still be. Here is a short summary of some of the issues I found:

Table of Vulnerability Exposure for Synology Products

You can skip to the full report here: A Security Audit of the Synology Disk Station Manager (DSM) v2.0-0590 Firmware.

What follows is a complete retelling of how I got here, sort of a lesson in vulnerability disclosure (not so much discovery, you’ll see why). It’s not pretty, I didn’t do all the right things, and it’s kind of long.

Continue reading ‘Multiple Vulnerabilities in ALL Synology Products’

Q&A with ISIS: Outsourced Backup

Published on January 18, 2008 in Privacy, Risk Analysis and Security Engineering. 4 Comments

Q: What do you think of outsourced backup solutions? Are they secure? Would you use one? I want to backup my data but I’m not sure I can trust an outsourced backup provider.

Continue reading ‘Q&A with ISIS: Outsourced Backup’

Learning Program Behavior Profiles for Intrusion Detection

Published on February 21, 2007 in Low-level and Security Engineering. 0 Comments

Here’s a presentation, “Learning Program Behavior Profiles for Intrusion Detection“, intended to talk about a few neural network approaches to the problem of detecting anomalous behavior in a network setting. The material is taken from a 1999 paper, of the same name as the post, by Anup Ghosh, Aaron Schwartzbard, et al. from Reliable Software Technologies Corp., under Usenix. The truth is there are many other alternate machine learning approaches alive and well out there not covered in this paper that have more mathematically dependable results, while neural nets work almost magically without too many people understanding why, lacking the sufficient proofs. However, I think there is still value in understanding older methods even though a decade has been enough to cover the nets in dust. Another point is that though this group does present well above average results in its paper which demonstrate that the method can be used for less critical networks, they are not acceptable for companies and orgs that don’t have room for errors.

The original paper can be found listed under Usenix.


Free Security

Published on February 11, 2007 in Security Engineering. 4 Comments

One of the large internet service providers has a new commercial advertising its broadband product which now comes with “FREE SECURITY.” Finally, an end to our concerns about computer security and identity theft! The product includes a firewall, anti-virus, anti-spam, and pop-up blocker but most importantly, peace of mind. Keeping information private on the internet is no longer something to concern yourself with, or at least that is the idea they are trying to sell.

Apparently, ISP’s have completely given up on educating users. While teaching people how to use their computer safely does seem like an impossible task I believe selling this idea of ’security in a box’ actually does more harm than good. Although, I hate the idea of spreading fear, a little dose of paranoia would at least keep everyone mindful of what information they distribute.

Continue reading ‘Free Security’