TLS cipher suites

The TLS/SSL3.0 protocol uses cryptographic mechanisms to implement a secure connection. These cryptographic mechanisms are actually cipher suites that define each mechanism used.

The four main mechanisms are
- Key Establishment, the rules and protocols that generate, establish and handle keys.
- Confidentiality, the symmetric encryption used to provide confidentiality.
- Signature, digital signature algorithm used.
- Hash, hash algorithm used.

When doing assessment, people might ask whether the cipher suite is FIPS (Federal Information Processing Standards) compliant. Some web server comes with FIPS compliant cipher suites setting. But FIPS did not explicitly provide a list of approved cipher suites. It only define the approved encryption, digital signature and hashing algorithm.

NIST (National Institute of Standards and Technology) based on the FIPS approved algorithm, provides a guideline (under NIST Special Publication 800-52) that gave a list of recommended cipher suites for TLS implementation.

-TLS_DHE_DSS_WITH_AES_256_CBC_SHA
-TLS_DHE_RSA_WITH_AES_256_CBC_SHA
-TLS_RSA_WITH_AES_256_CBC_SHA
-TLS_DH_DSS_WITH_AES_256_CBC_SHA
-TLS_DH_RSA_WITH_AES_265_CBC_SHA
-TLS_DHE_DSS_WITH_AES_128_CBC_SHA
-TLS_DHE_RSA_WITH_AES_128_CBC_SHA
-TLS_RSA_WITH_AES_128_CBC_SHA
-TLS_DH_DSS_WITH_AES_128_CBC_SHA
-TLS_DH_RSA_WITH_AES_128_CBC_SHA
-TLS_DHE_DSS_WITH_3DES_EDE_CBC_SHA
-TLS_DHE_RSA_WITH_3DES_EDE_CBC_SHA
-TLS_RSA_WITH_3DES_EDE_CBC_SHA
-TLS_DH_DSS_WITH_3DES_EDE_CBC_SHA
-TLS_DH_RSA_WITH_3DES_EDE_CBC_SHA

Web Security Rating

"Web Security Rating" is a website or tools that are hosted by security vendors or team that rate each web domain whether they are safe to access.

Was trying out some of this website and tools to recommend to my colleagues and friends. Notice that even big vendor can give an incorrect rating for publicly known malicious sites.

Did a few tests and decided to show the result of "aboutadding.com". On the Malwareurl website, it shows a list of malwares detected from that domain.

McAfee SiteAdvisor detected "potential security risks ... Use with extreme caution".

While Norton Safe Web given a "SAFE" rating for this site (even though a user feedback that the domain is harmful).

Besides McAfee SiteAdvisor and Norton Safe Web, there are also other common tools such as TrendMicro's TrendProtect and Finjan SecureBrowsing.

Even Google provide warning for potential harmful sites.

This blog is not to comment on which vendor is better. Just want to share some of the available tools on secure web surfing and to advise users not to trust on one result.

Emerging Internet Security Threats: Spring 2009

Saw this video by Lenny Zeltser, the instructor for my GIAC Reverse-Engineering Malware(GREM) certification. Most of the stuffs presented may not be new to you, but it provide as a reminder with real life examples on some of the "attacks".

This video explores today's emerging Internet security threats to help organizations fine-tune their defenses. He examines attack patterns that have included the use of email as a gateway for fraud, the mighty power of network bots, the fertile ecosystem for web-based attacks, and the increased precision of modern attacks. The presentation presents lots of real-world examples of cyber attacks, and discusses the financial incentives behind the malicious activities that occur on the Internet.

He also covers:

• What is driving modern-day attackers to large-scale and targeted attacks
• Which recent breaches exemplify threat categories organizations need to track
• The approaches Internet criminals employ to trick victims and bypass defenses
• Whether you should adjust security architecture to match today's threat landscape

Part 1


Part 2


Part 3


About the speaker: Lenny Zeltser leads a security consulting team at Savvis. He is also a board of directors member at SANS Technology Institute, a SANS faculty member, and an incident handler at the SANS Internet Storm Center. Lenny frequently speaks on information security and related business topics at conferences and private events, writes articles, and has co-authored several books. Lenny is one of the few individuals in the world who has earned the highly regarded GIAC Security Expert (GSE) designation. He also holds the CISSP certification. Lenny has an MBA degree from MIT Sloan and a computer science degree from the University of Pennsylvania. For more information about his projects, see www.zeltser.com.

Bypass bandwidth management

Last week, i was informed that video streaming from the "trailers" in "Movies.yahoo.com" was fast even though the bandwidth for media streaming was "cramped".

I initally suspect that they might be streaming with low-resolution videos or by downloading and play the video on local drive. But after checking the HTML codes and sniffing the traffic, they were actually using SSL traffic. As the content were encrypted, bandwidth management device was not able to detect these traffic.



Many malware, Botnet, Remote access, File sharing, P2P and more these days, uses SSL to hide their presence and circumvent the detection of security devices such as firewall. SSL is a double-edge sword. It protect our sensitive traffic such as Online banking but also been used by "bad" guys to bypass security detection.

Companies should be careful in allowing SSL traffic in and out of their network. You never know what activity is happening under the cover of SSL.

More MSN Spam

I receive some new Spam again. It was nothing new, coz i have post on MSN Spam since May (MSN spam or malicious link??).

This time around, they "recommend" slimming product and the message as follows:
- "Woah those acai berry pills are no joke I just lost like 23 pounds in two weeks, I am living proof that they work with no special diet or nothing, they only cost me five dollars over at www.towndesk.com"

The website "www.towndesk.com" (shown below) is actually selling the diet pills. But don't be easily fool by the webpage, it may contains malicious links or capture user information such as credit card numbers.



w01f advise: If you notice, Spam messages always send when your friend's account is "offline". Be careful on message that were send when "offline", especially those that contains URL links. Make sure you check with your friend on the message/link before clicking it. It may contains malicious script for all you know.

How Secure is your forum login?

After doing a video on sidejacking, i received comments and feedbacks asking on bypassing other web login that does not use SSL(HTTPS). So i decided to do a simple video to show how easy to collect user's login credential on unsecured website. The most common unsecured login is Internet forum.

In this video, i will sniffed the web traffic and extracted the username and password. This particular forum uses MD5 hash to protect the password. But common hash values can be search from the Internet. Even if the hash value cannot be found(due to strong password), you can still use the captured login data to login as the user via a webproxy.

Malicious links or pop-up

Someone submitted this malicious link "http://jjxp22.cn/a/iqq.html" to me . It seems to be a pop-up or hidden link from some compromised sites.

It contains obfuscated Javascript that embed malicious Shockwave Flash, which compromise the Integer overflow vulnerbility in Adobe Flash Player 9.0.115.0 and earlier (CVE-2007-0071), which allows remote attackers to execute arbitrary code.

One of the Sample Flash file info
#######################

Filename: i16.swf
Size: 17897
MD5: 426969FD0D7324EE170D6F46BDB203B6
Virus Found: Bloodhound.Exploit.193 (Symantec)

On the VirusTotal website, 13 out of 39 AV detected it - Link.

For more details of my finding, visit W01f Labs

w01f advise: Patch up your Shockwave Flash Player and be careful on suspicious and hidden links.

You can check your Flash Player version by going to this website or to the link below -
http://www.adobe.com/software/flash/about/

MSN spam or malicious link??

I recently receive a Spam MSN message. Besides the standard URL links, they include some messages to "trick" the victim to believe that it is from your friend and click the link.

The messages i got were as follows:

- "damn, saw naked pics of yours or maybe the one in pic is similar to you :) .... crazy lol"

- "omg omg i cant belive you could be so cheap +0( lol ..."

I have try to do a quick check on the suspicious link. It will load a Flash (yet to do an analysis on it) and provide a MSN login.

Besides that, no malicious script was found on the website. I guess it is likely to be using the MSN login to harvest victim's username and password.



New updates! - 02 June 2009

I receive new spam MSN message. The message as follows:

- "WTF NO WAY did u upload these of yourself?? :s"

The link seems to be similar to the previous website, which uses the MSN login to harvest victim's username and password.





w01f advise: Make sure you check with your friend on the link before clicking it. They may contains malicious script like those that i have analysed in W01f Labs previously

Download Limits in Internet Explorer

Recently, i heard an old question: "Why can only download 2 files at a time" again. This question was commonly asked during the times where most people were using dial-up and bandwidth were limited. I decided to blog this down as reference for those who might ask me again in future.

This download limitation only occurs in IE (Internet Explorer). But why does IE behave this way while some other Internet browsers don't?

This is because IE comply to the Internet standard (RFC2616). According to the RFC, Not more than 2 simultaneous connections should be maintain.

"Clients that use persistent connections SHOULD limit the number of simultaneous connections that they maintain to a given server. A single-user client SHOULD NOT maintain more than 2 connections with any server or proxy."

However, you can still bypass this restriction in IE by changing the registry setting. To increase the number of simultaneous connections follow these steps:

1) Run Registry Editor (Click on Start > Run, type "Regedit" and press OK)

2) Go to "HKEY_CURRENT_USER \ Software \ Microsoft \ Windows \ CurrentVersion \ Internet Settings"

3) Select New > DWORD Value from the Edit menu

4) Name the new value "MaxConnectionsPer1_0Server"

5) Right-click the MaxConnectionsPer1_0Server value and choose Modify

6) Under Base, click the radio button next to "Decimal"

7) In the Value Data, enter the number of simultaneous connections you want to set (e.g. 10), and click OK

8) Repeat steps 3 - 7 using the new value MaxConnectionsPerServer

9) Exit the registry editor

Please note that changing this setting violates RFC standards. Use at your own risk!

Related Articles:
- Microsoft Help and Support: WinInet limits connections per server

- RFC2616 - Hypertext Transfer Protocol -- HTTP/1.1

What is Web 2.0??

Many people like me have heard about Web 2.0 somewhere but not really know what it actually is? Is it a new web programming language or a version number of a program?
I got to know more about it after a recent seminar on Web security.

Web 2.0 is actual a concept that uses Internet technology and Web design to enhance creativity, information sharing and collaboration among users.
Web 2.0 technologies enable Web architectures greater access to data and functions. Web 2.0 applications should not be understood as a new technology, but a new use of old technologies.

Web 2.0 websites allow users to do more than just retrieve information. They can build on the interactive facilities of "Web 1.0" to provide "Network as platform" computing, allowing users to run software-applications entirely through a browser. Users can own the data on a Web 2.0 site and exercise control over that data. These sites may have an "Architecture of participation" that encourages users to add value to the application as they use it. This stands in contrast to very old traditional websites, the sort which limited visitors to viewing and whose content only the site's owner could modify. Web 2.0 sites often feature a rich, user-friendly interface.

Some misconception that Web 2.0 is AJAX because many Web 2.0 sites rely heavily on AJAX. But there are many technologies that supports Web 2.0, to list afew:
- AJAX (Asynchonous Javascript and XML)
- XML (eXtensible Markup Language)
- JSON (JavaScript Object Notation)
- SOAP (Simple Object Access Protocol)
- WSDL (Web Services Description Language)
- RSS/Atom feeds
- Flash, ActiveX

Web 2.0 have led to the development and evolution of web-based communities and hosted services, such as Google, Linkin, MySpace to name afew.