Insecure security

Dear credit cards users:
Next time when you gonna pay by credit card take a look on security camera behind the salesman. Today almost all point of sale equipped with a surveillance cameras. The best place to  install it - up at the wall right behind the salesman. But, this camera could not only capture your face for security purpose , but located at the best position and view angles to take a snapshot of both side of your credit card when salesman  or you rotate it looking for appropriate side to insert it in pos-terminal.

Hey, U , security guys, have you hide CVV code on your credit card? Or flashing it everywhere when take your card out of pocket?
Yes, current standart security camera resolution not enough for good snapshot, but time flies. 


PS. It's almost social engineering thing - we used to see surveillance cameras in any shop and never think about it as a possible security threat.

Security overseas

I thought that even people who faraway from infosec knows that WEP encryption for personal access point is bad idea.... But not for the biggest Canada telecom: Bell.

All Bell's new DSL-modem (with AP) shipping to the customer WEP enabled! More over it's not just shipping from stock- all AP already came preconfigured for the customer!

 The second surprise was: Canadian banks have no slightest idea about such simple thing of m-banking as sms notifications! So, in country where cash is used really rarely  there is absolutely  no way to stay informed by sms about you credit/debit card transactions! 

Sure thing, all bank have self-care web portals or , even, an iPhone apps, but , guess what? - no two-factors  authentication for end customer at all! No sms notification of login attempts to your online account too.

Google secure search

Hi folks

You must've knew that Google support search over ssl.
So, do not forget to turn it on in your browser. It's a snap:
1. Change your default home page to https://www.google.com/
2. For Chrome browser  add to search engines list new entry (Preference/Basic):
-name: secure_google or whatever you like
-keywords: whatever you like
-url: https://encrypted.google.com/search?q=%s  - sure thing you can add more parameters to this search string if your want.
3.Make this search engine your default search engine.

That's all. Stay secure.

PKI authentication and legacy web application

One of the most secure ways of user authentication- is the PKI authentication. A lot of modern systems support this method and everything works nice and smoothly (almost everything - details in the my next post). But, as usually, in real big enterprise you have a dilemma: you need the strongest authentication but you have a lot of legacy systems (or it takes ages to get changes in authentication method from vendor).

The best way (IMHO) to resolve this problem is to use mutual ssl on certificates.

SSL will terminate on reverse proxy server in front of your Business Application Server inside the high secure network zone . So, here the scheme:

It looks really easy, isn't it?

How it works:

1. Each user has his own certificate and private key. It could be located on smart card, token or inside OS key storage.

2. User's browser must be configured to use this certificate for authentication (It's easy - just import it in browser or point it to OS key storage)

3. User must connect to revers proxy server (ssl termination point) for getting access to Business Application Server.

4. Revers proxy server checks validity of user's certificate and some certificate's fields (if you need to restrict access to only some users groups) like OU, CN or "extended key usage" and establish mutual ssl connection.

5. Revers proxy server offloads ssl and make direct connection over http (or non-mutual ssl connection) to your business application server.

6. Business application server authenticate user and authorised them by user/password pair.

The key point of this scheme is the Revers Proxy Server with ssl offloading feature (May be the better name for it - Secure Application Gateway).

How this servers looks like?

1. Open Source:

Any *nix + Apache web server with mod_proxy and mod_ssl + some changes in Apache config for certificate verification.

2. Load balancer or Web Application firewall from your favorite vendor. I have tested this on F5 BigIP and everything works perfectly.

Almost forget. You will get a lot of users' web request logging possibilities during  implementation of this scheme. So you can easily control users' activity within business application server.

That's all folks. Stay secure.

using smart card for standalone management station security

Dedicated standalone management workstation frequently used for control automated equipment (telco systems, smart devices, etc) and is a part of vendor's solution. Usually these stations run on Windows and vendor do not recommend to connect it to the domain or it couldn't be done (or not recommended) by some technical reasons.

Very often these management nodes control company's mission critical equipment, so, password protection not enough for real security. For better security you must use two-factor authentication. I prefer to use smart card. The problem is, that normally, windows does not support smart card authentication on standalone workstation. But,there is a trick: you can use smart card for store windows password on it. In this case your smart card vendor must provide custom logon GINA. In my case ActivIdentity provide me this GINA and all necessary software. So, what have been done:

1. Created a list of management nodes

2. Installed smart card drivers and software on each node.

3. Create account for each technician and store it on smart card. (Hint: password must be randomly generated or created manually by 2 persons who only know a part of whole password. )

4. Prohibit user from changing password manually.

5. If you would like to secure even physical network connection of this node - add 802.1x support based on smart card certificates (But it a bit more tricky)

More over, using this scheme you could create a high secure management node for emergency direct access to your mission critical systems (bypassing terminal servers, firewalls or switches)

Multiboot USB Flash drive

Summer's over, so I'm back (Again)

Let's start from a small trick. If you are security guy (i hope you are) you definitely need to have hell of a lot different liveOS . Sure thing you can have a lot of boot CD, DVD or flash drives with you. But what about one flash disk with multiply different liveOS on it? More over they start from .iso files on flash drive! Very useful!
So, here the steps to create this flash drive.
1. Partition your flash disk. Normally you flash drive is in superfloppy mode with no partition on it.
You can't partition your flash disk by standart Windows format tool. For this purpose use HP USB Format Tool on Windows or Disk Utility on MacOS.
2. Now you have two options:
- use Multiboot USB program on windows and install everything using GUI. In this case just choose which linux you wish to install from the list of preconfigured options.
- use GRUB4DOS (Multiboot USB based on it too) project and do the same manualy.

In my case I've got BackTrack4,Ubuntu NR, Ophcrack XP,Ultimate Boot CD and Offline NT Password Remover on the 4Gb flash disk.

Security Incident Report

Hi All,

According to a lot of information security standards you must write a special report in case security incident occurs.

Having well-designed template for this purpose will save your time and simplify process of security event registration.

For this purpose I propose you two self-made templates: in English and Russian:

English version

Security incident Report#04.01.08_email

Detected.

1.st time detected 05.12.2007

2.nd time detected 04.01.2008

Description:

Internal email message in foreign e-mail box.

Result of investigation:

This situation occurs when user choose account ……

Scope of vulnerability:

All Corporate e-document flow solutions based on Lotus.

Security risk: Low

Desc: foreign user can obtain only notification without any confidential information

Way to fix.

1. way - block all e-emails from local user going

Responsible: It could be done by system administrator by IT department.

Current status: Not done. Reason: Possible problem with e-mail system stability.

2. way - change all E-document flow notification mechanism.

Responsible: IT department.

Current status. Not done. Reason: Impossible according to built-in e-document flow mechanism..

Investigation process:

1st

2nd

3d

Signatures:

Head of it-security group ___________ Smith J.

It-security group investigator ___________ McDonald D.

Head of IT _________ Watson H.

Russian version:

Security incident Report #28.05.08_Taburetka

Обнаружено.

27 мая 2008 года

Краткое описание:

Попытки рассылки спама.

Результаты расследования:

Наличие широкого спектра активного шпионского и вредоносного ПО на рабочей станции сотрудника

Высокая вероятность заражения серверного сегмента

Потенциально уязвимые системы:

Система Табуретка

Уровень рисков безопасности: Высокий

Описание: существует высокая вероятность того, что произошло заражение серверного сегмента системы Табуретка.

Это может привести как к некорректной работе системы так и к утечке конфиденциальных данных.

Также риску заражения подвергнуты другие ИС компании.

Возможные методы локализации и устранения.

Регулярное обновление и проведение полного сканирования с помощью антивирусного ПО всех рабочих станций сотрудников

Сканирование на наличие шпионского и вредоносного ПО серверного сегмента системы Табуретка.

Риск – серьезное падение производительности в момент сканирования.

Установка серверного антивирусного ПО и обновлений на сервера.

Пересмотр в сторону уменьшения доступов и полномочий сотрудников на системе Табуретка и других ИС.

Ход расследования:

1.

2.

3.

Руководитель Группы IT безопасности ___________ Петро З.Е.

специалист Группы IT безопасности ___________ Ветров Э.М

Администратор системы Табуретка _________ Иванов Г.П.

Stay secured!