Weakspot in the Company Servers

Before we get started, let me conceptualize the following:

There are always 2 distinguish types of people in your company: Management or Technical

Ok, now let us proceed to the next thing, the network architecture.

For example, this is the network architecture for a company:

As you can see, the network environment is divided into the internal network for the company, the external network for their clients and the De-militarize Zone (DMZ). The DMZ are usually protected by a lots of firewalls and Intrusion Detection System (IDS) . Let's say the interaction between the clients to proxy server and to application server are using the SSL 2 and TTLS (Oh yeah, it's a standard secured and properly tunneled system), and everything seems so secure, as the Technical told to the Management :)Management would definitely satisfied, as it's all covered up by the expected budget.

Now here's a thing, most of the companies, does NOT have the secured internal network. Especially when the application servers are interacting to other servers, are not encrypted. The data (eg. username and password) are transmitted in clear plain-text. It's because the server to server encryptions and secured communications required additional financial and human resource, thus increases the project budget and eventually leads to a bad project.

From the management P.O.V, it's unnecessary and can be labelled as the managed risk. Yes, they don't believe in James Bond :-) Now, if you refer back to the network architecture, you'll notice that there's an Lightweight Directory Access Protocal (LDAP) server. Now you might think, all the usernames and passwords are nicely encrypted, and you're right~!!! It's ONLY nicely encrypted when the LDAP server response to the Application server, but when the Application server response to the LDAP server, usually and mostly it's NOT even encrypted. In fact, poorly configured Web Application server will also triggered the LDAP server to dump a lot of sensitive data back to the Web App server in plain text. With a simple sniffer and with the condition you're taping to the selected web app server, your job can be done easily :-) (You're Micheal Western ^^)

Therefore, next time when you're looking for a leak, this might be one of the possible weakspots.

Click here to: Spicy & Fury Blog

Is Your Email being Watched?

Most of the time, we as the email service users are worried if the emails are being read by someone else. When the email itself contains the confidential data or attached documentations, we might start wondering if there's other more secured email service provider available.


General Facts:
Yes, it's possible that your emails can be read by system administrator at the company which is hosting your email.

Odd of occurrence:
Nearly impossible. Apparently the emails are routed on the servers which are owned by many government and private sector organizations. The numbers can be thousands or more. Let's say if a system administrator would like to capture a particular email and read it. Consider more than 2 million emails are sent every second, and thousands of paths available for email to move through randomly, it could be difficult and unpredictable.

What if someone hit the Jackpot:
Yes, no matter how low the chances, there's always 0.000000001% (amazing or wonderful occurrence) a.k.a Miracle.


Here's the good practices:
If you're sending highly confidential data via emails, make sure your attachments are encrypted. So does your message bodies. And try not to be explicit on your email title, as long as the sender and the receiver understand each other.
If it's for the company or bank or government, the best practice is to use their provided online email or forms. It's because the message is encrypted between your machine and their server through the internet (Make sure it's a https://)

Last Word
Be extremely cautious in the cyber world, things might get really HOT if you lost your focus.

Add-On
commandrine said...

Though HTTPS offers point-to-point encryption, I want to highlight the following:
- Not all webmail providers offer complete HTTPS sessions. Most webmail (eg. Hotmail, Yahoo) only encrypt your webmail login with Gmail the only exception where the whole session (from login to logout) is encrypted.
- MITM attack is still possible with HTTPS. Most users might encounter a pop-up warning them that the digital certificate is suspicious and studies show that they automatically accept the suspicious cert without reading the warning.
Besides encrypting attachments, you might even explore encrypting the email text as well.

spicynfury.blogspot.com

TLS cipher suites

The TLS/SSL3.0 protocol uses cryptographic mechanisms to implement a secure connection. These cryptographic mechanisms are actually cipher suites that define each mechanism used.

The four main mechanisms are
- Key Establishment, the rules and protocols that generate, establish and handle keys.
- Confidentiality, the symmetric encryption used to provide confidentiality.
- Signature, digital signature algorithm used.
- Hash, hash algorithm used.

When doing assessment, people might ask whether the cipher suite is FIPS (Federal Information Processing Standards) compliant. Some web server comes with FIPS compliant cipher suites setting. But FIPS did not explicitly provide a list of approved cipher suites. It only define the approved encryption, digital signature and hashing algorithm.

NIST (National Institute of Standards and Technology) based on the FIPS approved algorithm, provides a guideline (under NIST Special Publication 800-52) that gave a list of recommended cipher suites for TLS implementation.

-TLS_DHE_DSS_WITH_AES_256_CBC_SHA
-TLS_DHE_RSA_WITH_AES_256_CBC_SHA
-TLS_RSA_WITH_AES_256_CBC_SHA
-TLS_DH_DSS_WITH_AES_256_CBC_SHA
-TLS_DH_RSA_WITH_AES_265_CBC_SHA
-TLS_DHE_DSS_WITH_AES_128_CBC_SHA
-TLS_DHE_RSA_WITH_AES_128_CBC_SHA
-TLS_RSA_WITH_AES_128_CBC_SHA
-TLS_DH_DSS_WITH_AES_128_CBC_SHA
-TLS_DH_RSA_WITH_AES_128_CBC_SHA
-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
-TLS_RSA_WITH_3DES_EDE_CBC_SHA
-TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
-TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA

SSL is not everything

Secure Socket Layer (SSL) or Transport Layer Security (TLS - a standard protocol by IETF) is a cryptographic technologies used for the protection of data transmission streams by encrypting the communications streams between two end points (the client and the server). This provides confidentiality of the communication session, typically used in Web services such as online banking. The term HTTPS is commonly used to referred SSL/TLS implement on web services (which both maybe of different protocol).

Besides providing confidentiality (by having encryption and authentication), it also provide integrity, which ensure that no alteration to the data during transmission.

I wrote this posting is to share on the misconception on SSL/TLS by many people including IT professional. Below are some of the common misconception:

- "Web servers and their data are secure as long as they use SSL"

- "With SSL, applications and web servers are not susceptible to known exploits or vulnerabilities"

The fact is that using SSL don't protect you against systems and applications vulnerabilities. It only protects the data transmission. In fact, even SSL have vulnerabilities and exploits found on their previous versions. Don't blindly implement SSL and thinks that everything is secured.

Related Links:
- RFC2246 on TLS protocol

- Wiki on TLS/SSL

What is data sanitization?

I always wanted to write about secure data deletion (or data sanitization), especially when we read news on sensitive data (e.g Credit card numbers) been collected from 2nd hand harddisks and discarded system.

Many people thought that when they empty their "Recycle Bin" in their system, all the data are totally lost and cannot be recovered. The data was only not accessable by the OS but it can be easily recovered using Data recovery software (easily found in the Internet). When you empty the recycle bin, the data was still on the physical harddisk. The data were not "erased", only mark as "overwritable" by the OS and will only be over-written when new data need to be saved in the Harddisk.

Method of Secure Deletion
- Overwriting
It is the most common way of securely deleting data these days. It is commonly known as data wiping. Basically, this method simply overwrite the data with a pattern of all zeros or ones.
But as more and more advanced data recovery and forsenic methods used, simply overwriting with ones or zeros was not effective. More patterns of overwriting were used. Beside the alternating patterns of using ones and zeros, patterns uses the complement, bitwise inverse and NOT of the existing data were also used.The Gutmann method, which uses 35 patterns to overwrite data.

The more patterns you used, the more secure the deletion will be. But more time will also be needed to complete the "deletion" as the system need to overwrite the same amount of data the number of times (patterns).

Previously, overwriting is a DoD (US Department of Defense) acceptable method of secure deletion for magnetic media. DoD 7 passes (patterns) method was widely followed as a best practise. But due to the problem of media degration and errors, overwriting on some areas of the media may not be possible. On Nov 2007, overwriting is no longer accepted as a D0D secure deletion method. Only degaussing or physical destruction is acceptable.

Note:
To recommend a program to securely delete a harddisk, i will recommend DBAN (Darik's Boot and Nuke). It is an freeware (based on open source project), which supports DoD 7 passes and Gutmann method. It can be boot up from floppy, CD or flashdrive. It can also work on IDE, SCSI and SATA harddisk.

- Degaussing
It uses magnetic field that makes the data in the magnetic media to be unreadable. Degaussed harddisks are normally not operational as the magnetic field will erase the low-level formatting(servo control data) that is created during manufacturing.

- Physical Destruction
Physically breaking the media is the most straight forward way of destroying the data. But in order to securely destroying the data, grinding and shredding should be properly carried out. Incinerating of the media can also be used as a way to physically destroying of data.
Using of corrosive chemical, such as acids, can also be used.

- Encryption
With FDE (Full Disk Encryption) harddisk getting popular in the market, encryption became the fastest and probably the easiest way of securely "delete" all the data in a harddisk.
Basically how it works is that since the harddisk is fully encryption, by simply "overwriting" (secure delete) the decryption key, it is almost "impossible" to recover any data from the harddisk. The time taken to overwrite the decryption key is much faster than overwrite the whole harddisk.

Some recommended software (Overwriting):
- Eraser is a secure data removal tool for Windows. It supports DoD 3/7 passes and Gutmann method. It can also be scheduled to securely delete files/folders.

- Darik's Boot and Nuke is used for secure deletion of the whole harddisk. It is an freeware (based on open source project), which supports DoD 3/7 passes and Gutmann method. It can be boot up from floppy, CD or flashdrive. It can also work on IDE, SCSI and SATA harddisk.

Edison Chan Sex Scandal. Lesson to be learned!

Last week, the hottest news was seems to be Edison Chan Sex Scandal. TV news, newspapers and various magazines were reporting on it. Colleagues in the office and people in the coffee shop were also talking about it.

For the benefit of those who do not know about this news, photographs of Edison Chan(famous Hong Kong actor) in bed with several top female actresses and singers were circulated in the Internet. According to reports, those photographs were illegally copied from Edison's laptop while it was being serviced. Rumours that the culprit had attempt to blackmail Edison's management company but failed.

I decided to highlight this scandal because i think that there are afew lessons that people can learned from it. As mention previously in my blog ("Mobile Warrior - Part 1, Disk Encryption" by AhTan), everyone should encrypt their important data in their computers. Beside sexy pictures, sensitive documents (such as company proposal, financial data) and personal information (such as Bank accounts number) should be properly encrypted.

Beside properly encrypting your important data, those data should also be properly backup (previous acticle "Mobile Warrior- Part 2: Backup, Backup"). With important data properly encrypted and backup, you will not have much worries that your data be stolen or lost when sending your laptop for servicing.

There were also reports that several spoofed and virus emails, claiming to contain Edison's sex photo, were found "tricking" curious users to download malware. Those emails contains links to "Edison's Sex pictures", which actually lead to websites containing malwares. Those "malicious" links were also found in online forums discussing on Edison's scandal.

Curiosity killed the cat, this is not the first time "hackers" are using "famous" topics (e.g Paris Hilton Sex video, Asian Tsunami video) to trick users to download malware. So be careful when trying to download files from untrusted source.

Related Reports:
- Sex scandal rocks Hong Kong
- AusCERT National Alerts - Tsunami Warning Fraudulent E-mails and Malicious Web Sites

What is WIFI..?? - WLAN Part 1

Recently my friend ask about getting and securing a wireless Access Point (AP). So i think i should share some of my knowledge on Wireless Local Area Network (WLAN).



802.11 Standard
Some people might be asking, "Which is more secure? 802.11a, b, g or n?", "Which stardard should your access point support?"
IEEE 802.11 is a set of standards for wireless LAN. It define protocol used in the data link layer. The difference between various standard (802.11a, b, g, n) are mainly on the Frequency, the Data rate and the Range. You should get the AP that support the latest as it will normally be backward compatible with older protocol. But be careful on those AP that uses protocol that is still under "draft". As those "draft" protocol, various vendors may implement them differently. Network card and AP from different vendors may not be compatible.

-802.11a (release on 1999)
Frequency 5 GHz
Data Rate 54 Mbit/s
Range estimated 35m

-802.11b (release on 1999)
Frequency 2.4 GHz
Data Rate 11 Mbit/s
Range estimated 38m

-802.11g (release on 2003)
Frequency 2.4 GHz
Data Rate 54 Mbit/s
Range estimated 38m

- 802.11n (draft)
Frequency 2.4 GHz or 5 GHz
Data Rate 300 Mbit/s
Range estimated 70m

WIFI Encryption
So what are the different encryption type (WEP, WPA, WPA2, Dynamic WEP)? Which is more secured?
It is always recommended to use the latest encryption method (WPA2). But if not possible (latest method not supported), you should never leave your WLAN running without any encryption. Even weak WEP is better than nothing.

-Wired Equivalent Privacy (WEP)
WEP uses the stream cipher RC4 for confidentiality (encryption) and the CRC-32 checksum for integrity. It can be configured to use between 64 to 128bit. It can be easily cracked within minutes and was replaced by Wi-Fi Protected Access.

-Dynamic WEP
WEP keys change dynamically. It could change a user’s WEP key every few minutes. But with new wireless hacking technique, hacker can actively inject packets into a wireless LAN and cracked Dynamic WEP keys in minutes.

-Wi-Fi Protected Access (WPA)
It comes with two flavors of WPA: enterprise and personal. Enterprise is meant for use with an IEEE 802.1X authentication server, which distributes different keys to each user. Personal WPA utilizes less scalable "pre-shared key" (PSK) mode, where every allowed computer is given the same passphrase. In PSK mode, security depends on the strength and secrecy of the passphrase

Data is encrypted using the RC4 stream cipher, with a 128-bit key and a 48-bit initialization vector (IV). One major improvement in WPA over WEP is the Temporal Key Integrity Protocol (TKIP), which dynamically changes keys as the system is used. When combined with the much larger initialization vector, this provides greatly improved protection against, and effectively defeats, the well-known key recovery attacks on WEP

-Wi-Fi Protected Access 2 (WPA2)
WPA2 support CCMP (Counter Mode with Cipher Block Chaining Message Authentication Code Protocol) encryption mechanism based on the Advanced Encryption Standard (AES). It is the implementation of the full 802.11i standard.

After sharing on the basic of WLAN, i will discuss more on the basic in securing WLAN setup in the next blog (part 2) and demostrate how easily WEP and WPA can be cracked in my future blog.

Mobile Warrior - Part 1, Disk Encryption

As a mobile warrior, doing active work on our laptop is part of the daily event. The laptop is the closest device to us next to the mobile phone.

We keep almost anything in it, personal and work matter. It is not a common news that important data are lost and there are no proper means of protecting it.

Is the company to blame or should we as the data custodian responsible? While these questions can open up a whole new can of worms for discussion. We can take some simple measures into our own hand to ensure something can be done or at least things are safe during your watch.

Thanks to the new power of Open Source, most of the applications are free and with qualities equal if not better than the paid version. In addition, some are just simple behavior changes and prospective that can be considered that are again: Free.

To start off let consider disk encryption. The simple thing to do is to hide the data from easy access. This can be done by simply use any encryption software that create single or multi-folders that look like partitioned disk which you can mount and dismount accordingly.

A good example of such disk encryption software (Open Source) : http://www.truecrypt.org/
After playing with it, you might get addicted to have everything encrypted down to the last thumb-drive but remember to back up the key files as well as the good strong password that you had created.

If not, you will be having more problems trying to recover it. Have fun.