Another Cup of Cocoa: Responsibility

MySpace, YouTube, Web 2.0 there is so much happening and available out there. It is all exciting and there are so many possibilities opening up.

The freedom of the Internet and web works both ways. The same technology lets you explore web sites on the other side of the world allows anyone in the world to attack your system and steal from you.

In the real world people choose where to go and can avoid areas where the "criminal element" tend to hang out, or if in a less reputable neighborhood one can always be aware of the surroundings. On the Internet it isn't quite as intuitive, but there are steps that should be taken.

First everyone must take responsibility for them selves. Just like when we lock our doors and put safety belts on in the car.

As stated before hardware firewalls, software firewalls, and anti malware software should be installed and kept updated.

Mcafee Site Adviser works on both Internet Explorer and Firefox and can provide a warning when you wander into a "bad" site, and better yet will post warning on Google search listings to warn you prior to an actual visit.

Javascript has contributed greatly to the look and feel of the web today, but while many sites use it on many it is not necessary. Javascript is so powerful that it is used for malicous purposes as well including drive-by-downloading. With Internet explorer script control is an all or nothing option turn it on for a site or turn it off for the site. Firefox with the NoScript add-on allows more granular control and allows controls within the web page.

Stay tuned for the next Cup Of Cocoa post about "sand boxing" to help contain malware. Until next time remember:

In view of all the deadly computer viruses that have been spreading lately, Weekend Update would like to remind you: when you link up to another computer, you're linking up to every computer that that computer has ever linked up to.
— Dennis Miller

A Travel Cup of Hot Cocoa: Defense in depth

Everyone likes to keep their hot Cocoa hot. So travel mugs are insulated, and have a lid to help keep it hot. Yes it keeps it in the mug as well, but you can argue that keeping more in the mug helps keep the heat in ;-)

Which brings me to the topic at hand defense-in-depth for the PC.

If it was made by man, it can be hacked and cracked by man.
- Anonymous

Absolutely nothing is foolproof! On the other hand several good defenses layered will slow down or dissuade an attacker.

Hardware Firewall

A hardware firewall configured to only allow outgoing traffic and responses to the outgoing traffic. Fortunately this is the default. Any wireless should be configured for security, which is not the default. You don't want your neighbor unintentionally, or intentionally, causing you harm. Then there are the war drivers looking for free access or anonymity while committing crimes, that point back to you.

Software Firewall

Yes this should be running even if it is not a laptop that travels outside your network. One area of concern with Windows firewalls. For ease of use and compatibility there is much greater trust on the local network that could be used against your machine while you enjoy your Cup of Cocoa at the local WiFi hotspot.

Anti-Malware

Both anti-spyware and anti-virus should be running and kept up to date.

Windows work Both Ways

The average web browser shows off the babels of the internet, but at the same time, by default and for your viewing pleasure, lets remote sites into your computer.

Internet Explorer is infamous for being the weak link used by many exploits. Firefox has a better default security stance, but is not perfect. Firefox also has a quicker response for security fixes.

Mcafee Site Adviser (http://www.siteadvisor.com) will flag sites that can cause grief if visited. It has an icon that shows the current site rating, and access to the details available. Additionally google searches will show the site adviser graphic next to each search result.

There is still has a free version and is available for no cost. There are plug-ins for both IE (http://www.siteadvisor.com/download/ie.html) and Firefox (http://www.siteadvisor.com/download/ff.html)

NoScript (http://noscript.net/) is a Firefox add-on that provide granular control to scripts. IN a nutshell any web page that is visited may pull content, and scripts from other web sites and servers. Without NoScript there are only two options are allow all scripts on the page, or do not allow any scripts. NoScript allows or disallows scripts based on URL. It is quite flexible and even allows temporary rights to run scripts, in addition to white listing and black listing.

NoScript (http://noscript.net/) is highly recommended.

Cup of Hot Cocoa: Patch Warfare II

What to do?

First

Either update you machines religiously on every Black Tuesday (the second Tuesday of the month when Microsoft releases security patches). I don't trust Microsoft update. I have seen too many machines that have it running and are still unpatched days after new patches are released. I know many of these machines where left running over night to update. So my conclusion is the the Microsoft update services are overwhelmed by the shear numbers to properly serve all the machines clamoring for update.

Third Party Software

Microsoft has no mechanism to update non-Microsoft programs, and who doesn't have those? These must be kept up to date as well. Some offer automatic silent updates, automatic notices of updates or nothing at all. Oh I almost forgot about the automated update notice that is broken... I ran in to this with several versions of Sun Java JRE.

Well there is an option for some of the more popular software out there. Secunia Software's fee online assessment which I wrote about in How to Find Bad Apps (http://sec-soapbox.blogspot.com/2007/02/how-to-find-bad-apps.html) will scan your computer for vulnerable non-Microsoft applications.

Cruft

Not all applications clean up after themselves. Sun Java for one leaves old versions in place, which can be usefule for those few who actually need multiple versions. For the rest of us it leaves security holes on our systems and takes up disk space. I have more details including how to automate the install and de-installation of Sun Java posted here: Do you Java? (http://sec-soapbox.blogspot.com/2007/01/do-you-java.html).

Stay tuned for the next "Cup of Hot Cocoa" episode where I discuss default.

Cup of Hot Cocoa: Patch Warfare

Back in the day...

In the PC world patches where a rare thing. You purchased a program and then when the next version came out you either upgraded or didn't end of story.

As programs became more complex and we actually began to use more of the growing set of features. We found bugs and software companies began to supply patches. If I recall correctly (IIRC) most patches where actually a whole new install that you didn't have to pay for... well maybe a small fee for the media (5 1/4 inch floppies) and shipping.

Most people and companies didn't bother installing patches unless they experienced an error that required the patch to be resolved.

Time and the world moved on and before we knew it people actually started to break into computers. A whole new breed of patches. Security patches.

As the "dark side" evolved their techniques patch management went from an anomaly, to a necessity, to the current arms race.

• Vulnerabilities (http://www.answers.com/main/ntquery?s=vulnerability&gwp=13) are announced.

• Exploits (http://www.answers.com/topic/zero-day-exploit) are found in the wild, or sold on "underground" auctions.

Patch warfare has become a reality. Companies must balance between breaking business applications and vulnerable systems. Leaving systems unpatched is simply not an option anymore Windows Survival Time (http://www.dshield.org/survivaltime.html) tracks the length of time unpatched systems avoid infection by malware, and for Windows the "sweet spot" tends to be 40-60 minutes once connected.

The there is a paper Windows XP: Surviving the First Day (http://www.sans.org/reading_room/whitepapers/windows/1298.php) that has advice on how to patch a new system prior to connecting it to the world, and no it is doubtful the system will survive long enough to finish the windows on-line patch process before it is infected. I personally have had luck with this DIY Service Pack: Installing Windows updates without an internet connection (http://www.heise-security.co.uk/articles/80682/0) for updating new systems and ones that are missing patches.

A Small Cup of Hot Cocoa

Less is More!

Less running or installed on your computer is more secure. With less running on your computer there are fewer attack vectors (http://searchsecurity.techtarget.com/sDefinition/0,290660,sid14_gci1005812,00.html).

To make sure we are all on the same page consider that everything that us running on a computer is a potential weak point where the system can be compromised. Unnecessary or occasionally used programs should not be set to start when your computer starts or you log into the computer. Sun Java is a good example here Java does not start until it is needed.

Some Things are *Not* Optional

This is not to say that there are some thing s that should be running as they specifically add security. Three that come to mind are personal firewalls, anti-virus and anti-spyware. Honestly the line between the last two has been blurring and we should have "anti-malware." Aside from the fact that there is no marketing value in malware and no one would buy it...

In keeping with the theme that more is less I won't do a deep dive on removing excess programs right now, but will look up some good references and post them in another blog entry.

Stay tuned for the next "Cup of Hot Cocoa" episode where I discuss patch warfare.

Hot Cocoa

Based on my recent blog entry on insecure endpoints "https is all I need, right?" (http://sec-soapbox.blogspot.com/2007/03/https-is-all-i-need-right.html)Joe of 2 Guys Named Joe (http://www.2gnj.com) wants to know how to determine if he is secure and if his information is already out there.

First my warning the Cocoa is very hot be careful that you do not burn your tongue. In other words there is no silver bullet in security. My second warning is that since I have covered some of this previously I will reference any previously written blogs entries rather than reproduce them.

Balancing Act

One of the points to understand is that security is a process not a goal. If it was a goal then when your village/town/city was established the police would show up and secure it. Then the police would leave and there would never be any crime. I don't think anyone would subscribe to that option.

On the other hand we can't have a police officer assigned to every person and building to provide 100% security and protection. But some institutions hire guards to protect valuable assets.

In computer security it is much the same. Too much security prevents people from getting anything done and will cause people to circumvent it (the sticky note on the monitor for the assigned password). There must be a balance between security and ease of use. Additionally there must be a balance between value of an asset and cost to protect the asset.

See Risk Options (http://sec-soapbox.blogspot.com/2007/03/risk-options.html) for additional details.

The Basic Goal

The best you can do is make sure you are not the easiest target. In short unless there is a reason to target you the dark side will tend to go after the "low hanging fruit." If a burglar is walking down the street looking for a house to burglarize they will tend to avoid the ones with a alarm in favor of one that doesn't.

See Predators and their Prey (http://sec-soapbox.blogspot.com/2007/01/predators-and-their-prey.html) for an old security joke and more details.

Passwords

Everyone hates passwords, but at the moment they are the a fact of life. Everyone has to have passwords, and too many people use simple easy to break passwords.

I subscribe to the use a very long complex password to protect your password data base. See Anatomy of a Password (http://sec-soapbox.blogspot.com/2007/01/anatomy-of-password.html) for more information on complex usable passwords.

I personally use Password Safe (http://passwordsafe.sourceforge.net/), but it is not the only option. See Password Tools (http://sec-soapbox.blogspot.com/2007/01/password-tools.html) for more information.

More to come

This is a complex topic and I will flesh it out with additional blog entries.