Information Centric Security

Yet more data losses; JC Penny & British Royal Navy

Seems that GE Money lost backup data for JC Penny's recently, with some 650,000 customers information.  JC Penny's stated they believe that there is 150,000 social security numbers contained in the backup.   

I am curious, so if there is an obvious answer I am overlooking please educate me: Why does JC Penny's have social security numbers to 150k customers?  This strikes me as odd. 

And this one is interesting also ... a laptop stolen from a Royal Navy Officer contained banking account information, mortgage payment information, medical claim information and a lot more.  And I am tired of asking this question, but why was this on a laptop outside the facility?  And it was a military officer ... why was the data not encrypted? 

Re: Yet more data losses; JC Penny & British Royal Navy  

 

            Comment from Christofer Hoff on January 20, 2008 7:48:28 AM PST  

 

Why does JC Penney's have SS#'s? Easy. They offer the JC Penney charge cards. Why isn't the naval officer's laptop not encrypted? Easy. Probably because there's no requirement for it to be; unless there's a rule, it won't be followed. Either that, or this information does not meet the classification level that requires encryption? (anyone know if there is a mandate/rule that the RBN's laptops be encrypted?) /Hoff

                     

                      

     

    Re: Yet more data losses; JC Penny & British Royal Navy  

 

            Comment from Adrian Lane on January 21, 2008 10:20:23 AM PST  

 

    Chris,

Thanks for the post. A couple of people have now pointed out that JC Penny's offered Credit Cards, which is also probably why GE Money was involved.  I probably should have realized that, and may have if I had not been distracted by Mr. Hirsch and Old Man Winkle having a heated argument in my living room Saturday night. 

I also should have included the other dozen rhetorical questions on the Royal Navy theft ... why was the data there to begin with, why was it un-obfuscated, etc, to which you would probably have the same response.  I keep thinking that this problem could avoided in so many ways ... it's becoming a bad joke.

      

My Business Plan Contest

Send your business plans to be judged!

A Business Plan contest is being offered at the Data Protection Summit, to be held in Irvine March of this year, with details of the  business plan contest here.  Send your business plan and you may get a prize! 

From the Data Protection Summit email, I quote "

To enter the contest, prepare a business plan related to computer security (hardware, software, peripherals, accessories, services, or systems). Plans must not exceed one page in length (10-point type) and must be submitted using the VC Business Plan  form at the Data Protection Summit website (look for the Big Red Button.

Submit your plan via  the form starting now and ending on Friday, February 15 at midnight  (Pacific Time). All submissions will be kept confidential, and no copies will be  retained by anyone.

Your business plan will be reviewed by the distinguished panel of VCs. Our panel will grade the submissions on a 1 to 10 scale (overall, technology, marketing, and organization), and we will give prizes to the top 3 at the end of the panel session."

Seriously.  First prize is a iPod! 

This is a great idea.  Especially for VC.  You may get to have some great business ideas, delivered to you, without having to run around, do research and make connections.  And you won't have to hassle with those pesky Intellectual Property Agreements, and people submitting their idea can be confident it is safe because a copy of the documents sent are not kept long term.  They promise.   

As for the submittor?  VC will be eager to invest in -you-, the wonderful, trusting person who was gullible nice enough to actually send your wonderful business plan.  Good prose and such good business sense!

I am drafting my submission now!  It's for a social engineering engine that produces business plans!

As luck would have it, I am ALSO having a business plan contest! Please send send me -your- business plans for this 1st annual contest. Please keep them to five pages or less, text or RTF documents only please.  First prize is a $10 Starbuck's gift card to the best security service or product plan;  and second prize is an IPLocks coffee mug.  I will do all of the judging, but I am going to ask Richard Hofstadter to assist should he be available.  Deadline for submissions is midnight January 15th.  Look forward to your submissions!

SAMP Stack

SUN buys MySQL

This is very interesting, and a smart move in my opinion.  Sun acquiring MySQL could shake up the database marketplace.  I have spoken with a number of executives at Sun over the last few years, and the notion of providing lower cost 'greefield' applications platform has been on their agenda for some time now.  In essence, using a LAMP stack in testing or proof of concepts, and continuing to use Oracle/ DB2 for production is a way to reduce overall software licensing costs. 

But MySQL has really started to shed it's not ready for prime time image in the last year and has become a production viable data repository option.  Couple it with a secure and scalable Solaris OS, and you have a SAMP stack that is a very enticing option.  How long before we see these environments pre-packaged for virtualized servers, tailored for specific business functions?  Not very is my guess.

Boeing nuttiness.

Coffee? Tea? Hacked Control System?

One of the more interesting stories this week had to do with published reports of the Boeing 787 control system being shared with a passenger Internet connection.  I did not make any Blog posts on this week on the Boeing 787 control system fiasco because I thought it was some Internet hoax; I mean, no one could be this stupid. Right? 

But here is the quote in the San Jose Mercury news, with Boeing representative Lori Gunter telling us how it's secure because we have both software -and- hardware protection. Golly, that sounds super secure, just like my computer and network, cause ...oh wait, that’s not very secure.  

 

Of course details cannot be discussed because "One of the things you do to ensure security is not talk about the protections in any great detail". Strike two.

 

And the FAA is thoroughly satisfied.  Uh, OK. Strike three.

 

And thanks to Chris Hoff for catching the Polish Train derailment by a teenage hacker. Just in case you think the security professionals of the world are ‘crying wolf' on this subject.

 

I think Bruce Schneier’s quote is perfect: "It's possible Boeing can make their connection to the Internet secure. If they do, it will be the first time in mankind anyone's done that."

Real Player & SQL Injection Attack

Bad software is not Free

Real Player has a fairly severe security hole.  Sigh.  It seems there is no such thing as ‘free’ software any longer. While you may not pay for it with cash or credit cards, it’s not really free if you pay for it through Spyware or security holes.

 

I was in the process of registering for Rich Mogull’s  eSeminar , presented by Ziff Davis and sponsored by Oracle,  on the 25th of this month.  Once I signed up I needed to verify that my system met the minimum requirements. I ran the diagnostic, and I met all but one of the system requirements: Real Player needed to be installed. Argh!

 

My bias to not installing some of these applications like Quicktime, Real Player, AOL Instant Messenger, anything Yahoo or most of the other ‘free’ tools is not just because I don’t trust them. I don’t. My main reason is they have zero respect for me or my machine. I want one specific function … ONE … and I get (what seems like) 50 that I don’t want. I don’t want these other ‘features’ installed, don’t want them automatically turned on, don’t want resident in memory, don’t want them scanning my machine for software and versions, don’t want them communicating with other software or servers, don’t want them attempting to update themselves, don’t want them installing into the start menu, don’t want them updating the MS registry, don’t want them automatically popping up services and ‘news’ items about Soulja Boy’s baby or Britney Spears latest stupidity.

 

So I installed it … clearly because I am a moron, and I also have some business needs that require Real Player … like this and other e-Seminars. An easy install, but sure enough, it was flagged by AVG and SpyHunter because some of the DLLs are considered Spyware. I quarantined them and I hope that there is nothing else I need to worry about and that the application functions now that I disabled some of the DLLs.

 

Worry got the better of me and I started searching the web about what sort of vulnerabilities or Spyware is also present. I did not get far. A quick Google Search revealed this: http://isc.sans.org/diary.html?storyid=3810 . So it opens up a hole on the machine.

 

OK, fine. Are there known exploits? In fact there is, as documented here: http://isc.sans.org/diary.html?date=2008-01-04. Which is a pretty well executed SQL injection attack, with some well done obfuscation of the code itself, making it harder for the average person to detect. In a nutshell, the SQL statement queries Sysobjects table looking for all user tables, and recursively scans all of the table references it finds. For every Varchar column in the tables found, the program appends a small piece of code.  I was not curious enough to find out what that code does.  I do not believe the injection attack is smart enough to auto-alter itself depending upon the type of database present, this one looking for SQL Server, but I am sure that enhancement will be in the next release of the attack.

 

OK, is there a patch? Not that I can find. CVE-2007-5601 talks about a buffer overflow attack, but the arbitrary execution of code in this attack does not appear to be reliant on a buffer overflow to initiate. My guess is the author of the first Blog post is correct and there is no patch available. I un-installed it and selected and older version as I figured that the Spyware was not as evolved in the older versions. Sure, it may have vulnerabilities as well, but I needed to pick my threat model, so I picked the unknown threat instead of the known threat.

 

It’s ironic that I want to watch a database security presentation, and I need to introduce a vulnerability onto my computer to do so, one with known exploits and no patches at this time. Yippee.

Re: Real Player & SQL Injection Attack  

 

            Comment from Anonymous on January 11, 2008 3:22:49 PM PST  

 

I sort of understand how SQL injection attacks gain database access. What I don't understand is how they insert code into the database.  How do they get dba-level access?

                     

                      

     

    Re: Real Player & SQL Injection Attack  

 

            Comment from Adrian Lane on January 12, 2008 3:55:37 PM PST  

 

That is a good question, and I should have actually mentioned how to fix this in the initial post ... sorry about that.  Typically this is caused by a common mistake of allowing applications, or running the desktop user, with administrative rights.  So when a SQL injection attack comes in, it has an elevated level of privileges.   Shameless plug alert … this is one of the basic operational policies that IPLocks offers with out Vulnerability Assessment product.  You want separation of duties between the OS admin, the database admin and the web services admin, so they should not be the same user, nor should any one have elevated access rights to the other accounts.  We offer another dozen or so checks for this type of weakness.

But this is a good example of how tiered or multiple levels of security helps catch and stop problems.   It's also one of the reasons why I am an advocate of spending as much time and attention to detail on back end infrastructure security as firewall and front end security.

      

 

Microsoft Security Bulletins

MS08-001 & MS08-002

IPLocks offers a Vulnerability Assessment product. While we, IPLocks, provide OS level assessments, we focus on the database. So the OS and network policies we do provide are those that affect database configuration, security and operations. The types of vulnerabilities listed above, having to do with multi-casting and Windows security, is not something I will typically comment on and not something IPLocks will provide a policy for.

 

That said, a subversion of the Microsoft Windows Local Security Authority Subsystem Service (lsass.exe), as is the case with MS08-002, I suspect it would be possible to bypass authentication to SQL Server databases that use Windows authentication. That is if you were a hacker and wanted to be subtle about subverting the system without being detected. I am not aware of any specific attacks, but if you can compromise lasass.exe, there a good possibility you can gain access to any account and thus brute force take over the server entirely, or subtlety monitor all inter-process communication.  Your pwned at that point. I am not a Windows kernel expert by any stretch, but I suspect that there are also RPC trust relationships based upon LCP API’s and lsass.exe being secure and friendly. I am hypothesizing that one subverted kernel may provide additional attack avenues into another kernel, which is fairly scary. 

 

Regardless, I would recommend patching your Windows servers ASAP. 

Sears

Corporate Sponsored Spyware

A big thanks to Benjamin Googins at Computer Associates for his Sears Spyware post, drawing attention to what I consider to be the electronic equivalent of a prowler.  Come into your home, rummage through your drawers, wallet & purse.  What are you reading, what are you watching on TV, when you do it, and using this information for profit or gain.  And it is shocking, shocking stupidity that Sears would do this. 

So what data are they collecting? Every piece of information they can, and if that includes sensitive information like Social Security Numbers, so be it.  In fact, if they are targeting HTTPS sessions, they are in fact targeting sensitive personal information. There is no such thing as “commercially viable efforts” to filter personal information from key stroke loggers or Internet session capture. And stating “automatically filter confidential personally identifiable information” is specious, because if this was in fact your intention, you would not willfully capture HTTPS sessions. 

 

Where is it being sent?  None of your business! It will be sent to one or more places they are not going to tell you about. The statement “stored in a confidential database owned by myshccommunity.com and is never delivered to a client” is also troubling. Wholesale delivery is not what I am worried about.  I am worried about any and all access. Even if you sell a report of the data that you can view, you in essence have a copy, that’s the way electronic data works.  What about hackers?  What  happens if Google 'bots discover it?  You, as the consumer, have no control over who gets to view it. Can you delete it?  No.  Can you edit it?  No. 

 

It’s going to be secured by, wait, we do not know that it is going to be secured. It might be it might not be. The database where it is stored is ‘confidential’, but is it secure?  How do we know their IT systems are secure? Does the act of installing the proxy on my computer open up other holes in my firewall?  Has the agent being installed on the ‘customer’ machine have any security at all? Probably not, if you consider the data collected is re-sent over the wire unprotected.  And I see no reason why they get the benefit of the doubt.  Some marketing organization installed it, so there is no reasonable expectation that this will not be trivial to hack, subvert, alter and do whatever with. If it was secure, I am certain they would be marketing their security certifications, but most likely there was not even a security portion of the specification to this virus.

 

But it’s for your benefit … right!  There is no possible way that you can justify this as good for the consumer. Nada. It is only for the company to collect intelligence. Consumers are perfectly capable of browsing & searching on line; we do not need our email searched and our checking account balanced investigated to see what else can be shoved at us. We do not need a Sears agent installed onto our computer, sucking up our resources so Sears can try to get more of our money. It goes back to my earlier posts on inept marketing organizations putting code on people’s computers invites liability, that certain tell tales show how companies focus on making a buck without care or regard for their customers, and the custodial responsibility of collectors of information.  This is reckless behavior that compromises YOUR security for THEIR benefit.

###Update###

So it appears that the 'confidential' database is not confidential at all, in fact it is leaking data like a sieve: http://blog.washingtonpost.com/securityfix/2008/01/searss_privacy_promises_broken_1.html article shows you can pretend to be anyone who shops at Sears and see their entire buying history.  I wonder if they have other vendors sales records their as well?