Write Protect USB Drives

To write protect the specific drive, use the sider on the drive itself, if available.

To make all drives behave as if they were write protected when inserted in a specifc machine, there’s a registry hack followed by a restart:

Windows XP SP2 or later:

[HKEY_LOCAL_MACHINE\SYSTEM\CurrentControlSet\Control\StorageDevicePolicies]
“WriteProtect”=dword:00000001

With 64-bit operating systems, make that “qword” instead of “dword”.

Disable Acrobat Javascript

An unpatched vulnerability in Adobe Reader and Acrobat 9.2 and earlier is in the wild. The potential payload is remote arbitrary code execution. The expected patch availability is January 12, 2010. Meanwhile, Adobe suggests implementing the JavaScript Blacklist Framework or disabling Acrobat Javascript as a mitigation measure.

If you need JavaScript functionality and have updated to versions of Adobe Reader which support the JavaScript Blacklist Framework, and the JavaScript API needed isn’t the vulnerable DocMedia.newPlayer API, then the JavaScript Blacklist Framework can preserve your business processes while providing risk mitigation. If you do not need JavaScript functionality, turn it off. If you don’t know if your business processes need JavaScript functionality within PDFs, then start finding out.

JavaScript Blacklist Framework

Designed in anticipation of a vulnerability such as this, the JavaScript Blacklist Framework enables a person to designate the APIs that represent security risks. Download the registry keys [zip]. Even if it is not feasible to implement the JavaScript Blacklist Framework before a patch is released, plan to implement it for another opportunity.

Note that this will not be a complete measure; a signed PDF bypasses the JavaScript Blacklist Framework.

Certified documents signed with certificates that chain up to a trust anchor trusted for executing high privileged Javascript.

Plan to permit the blacklisted API once a patch is released.

Disabling Acrobat Javascript

1. Launch Acrobat or Adobe Reader.
2. Select Edit>Preferences
3. Select the JavaScript Category
4. Uncheck the ‘Enable Acrobat JavaScript’ option
5. Click OK

Plan to reverse this procedure once a patch is released. Perhaps you won’t implement that plan, but have the plan ready.

DNS Client Settings

DNS settings are typically ignored. Management of DNS settings is deferred to the Internet Service Provider (ISP).

Windows Vista IPv4 Configuration tab

Concerns:

1. Malware can replace the DNS settings with its own settings. When this happens, a client who connects to a legitimate web site (such as their bank) tells the malware DNS server who their bank is. The malware DNS server collects information about web sites the client uses. At any time, the malware DNS server can substitute a web address of their own choosing. A prompt for user ID and password would collect responses, returning an dummy “access denied” message. This leaves the bad guy with working credentials.
   Since DNS settings are typically ignored, this payload is typically ignored. Anti-virus software would not detect an “infection” since these are IP addresses, not a file. This is one of the many reasons you should not rely upon “cleaning” a system to make it trustworthy. See Can You Clean a Virus?“
   In a corporate environment, an inventory system which gathers DNS settings (such as Microsoft’s SCCM) can be used to reveal this payload. See Finding the DNS Hijacking Victims.
2. Each DNS implementation has security vulnerabilities. DNS has its own issues; search US-CERT. A DNS service must be managed. In a corporate environment, internal server names should not become known externally, so internal DNS servers are required. As a bonus DNS lookup history is an important intrusion detection mechanism, discovering if malicious sites are being accessed.

At home, you want a vendor who pays careful attention to keeping the DNS service maintained and who you trust. You are not required to use the DNS servers your ISP maintains; there are other options. Configure your clients to use more managed, more secure DNS servers.

If you are using your router to provide IP and DNS addresses, consider providing more secure DNS servers. However, you may wish to revisit how you are managing IP addresses; that would be a subject for a different post.

Google Public DNS	8.8.8.8	8.8.4.4
OpenDNS	208.67.222.222	208.67.220.220

Internet Explorer or Firefox?

Internet Explorer or Firefox? Depends on the context.

Independent (home) user, Firefox. (If only for its lack of native ActiveX support.)

Corporate environment, Internet Explorer.

Hang all the “but Firefox is faster, safer” arguments. Its a maintenance issue. An environment which standardizes upon Firefox will encounter web sites which do not give the appropriate user experience without Internet Explorer. Internet Explorer could be installed on an exception basis. Now there are two web browsers to maintain. On the face of this “reduced maintenance” overrides “faster, safer”.

Exceptions:

Corporate environment web development. They get all expected web browsers and browser maintenance is a cost of doing business.

Corporate environment permits access to a limited, “Firefox-ready,” set of web sites. Firefox.

Revisiting Incident Response

1. Preparation: Gather and learn the necessary tools, become familiar with your environment.
2. Identification: Detect the incident, determine its scope, and involve the appropriate parties.
3. Containment: Contain the incident to minimize its effect on neighboring IT resources.
4. Eradication: Eliminate compromise artifacts, if necessary, on the path to recovery.
5. Recovery: Restore the system to normal operations, possibly via reinstall or backup.
6. Wrap-up: Document the incident’s details, retail collected data, and discuss lessons learned.

Here’s a list, by category, with techniques in order of “importance.”

	Then	Now
Prevention	Anti-Virus Firewall (inbound packets) Firewall (stateful) Application Patches Obscurity	Firewall (inbound packets) Firewall (stateful) Application Whitelist Intrusion Prevention System (IPS) Application Patches Anti-Virus Firewall (source blacklist) Obscurity
Detection	Intrusion Detection System (IDS)	Intrusion Detection System (IDS) Anti-Virus Firewall (destination blacklist) DNS lookup history Information extrusion
Containment	(manual)	(manual)
Recovery	Anti-Virus	Rebuild, Reimage, Restore

Obscurity: Security through obscurity is one of your defenses, just not a very reliable one.

Firewall: General term for “mechanism to drop network traffic.” Drop network traffic you do not intend to manage. (Note about SPAM: Drop email you do not intend to manage.) For example, drop unsolicited network traffic (which means “monitor state”).

Anti-Virus: Note the changed role of Anti-Virus. Its role in Prevention and Recovery is diminished, but its role in Detection is (or should be) more significant. Not “dead“.

Recovery: Does not address what has been disclosed.

Re-imagine Security

Security? As said previously, cross out “security” (wherever you have been using the term) and substitute “availability” or “confidentiality” or “integrity” or “authenticity” if you want to get your point across.

Recognize that there is a common language meaning to the word “security” as well as a technical usage of the term. Re-use of language in this way obstructs clarity. Re-defining words separates the speaker from their audience. Operational definitions (sometimes introduced with “in the following, I will use the term such-and-such to mean …”) are used to slip statements in without awareness, justification or comprehension.

During Winn Schwartau’s presentation at the InformationWeek Dark Reading / Black Hat virtual event (December 9, 2009), we have been warned that RF interference could become a problem for artificial limbs. Picture persons with even short range devices causing Denial of Service problems for a person with an artificial leg. When bioengineers are asked what they were doing to secure these devices, they purportedly responded with “We’re trying to make them work. We don’t have time to add in security.” On the other hand (oops), adding in availability and integrity are part of the reliability problem they already consider part of the “making them work” problem. “Is confidentiality being neglected?” would be a more useful question to pose than “What are you doing about security?” [That's Winn Schwartau of The Security Awareness Company and Simply Security (with Winn Schwartau).]

Don’t blame users. While a certain amount of responsibility is in the user’s hands, making it difficult to be irresponsible is an informed design goal. If you leave a glass near the edge of the table, where someone can knock it over, what went wrong? What could be done differently?

Don’t let marketing define your system view. Marketing introduces terms to differentiate their product from competitors. See, for example, “web application firewall.” In what way are these products firewalls? I realize that there is precedent for using the term “firewall” loosely.

Using the Virtual Patching Challenge presentation byRyan C. Barnett of Breach Security at Black Hat DC 2009 as an authority:

A Web Application Firewall analyzes traffic and enforces the Virtual Patching Logic so that malicious traffic never reaches the web application.

That could describe an input validation filter. He goes on to say that a Web Application Firewall (WAF) “is more than an ‘attack blocking device.” A WAF can also identify and correct Appication Defects. A WAF can be used as an HTTP Auditing device.” He add that Virtual Patching can expedite the implemention of mitigation and provide protection for apps that can’t be updated.

“Virtual patching of web applications” appears to be the technology implemented on web application firewalls. Virtual patching would include filters that drop input that looks like SQL injection or cross site scripting attacks. Virtual patching should include additional approaches which modify output; in effect, wrapping the application to give the effect that the application problem has been fixed  A web application firewall would be the device which implements virtual patching.

I need a better, simpler example.

Compliance. Don’t let regulatory compliance define your information security confidentiality (as well as availability, integrity and authenticity) decisions. The measures defined in regulations specify minimal assurances. Legislatures, regulatory agencies and industry organizations cannot define a “one size fits all” set of measures that will accomplish information confidentiality. At best, a set of of generalizations can be written. Neglecting these generalizations can establish irresponsible behavior, but you would still be irresponsible if all you paid attention to was regulatory compliance.

Log Files

Investing in an Intrusion Detection System is pointless if you have no plans for the log files. Having plans for log files can make your investment in an Intrusion Detection System less important. That is, the IDS is there to detect anomalies; if you are detecting anomalies in another way, through log file management, then you have accomplished your IDS task. If you don’t view your IDS logs, then you have not accomplished your IDS tasks.

In general, get Splunk. See the Splunk tutorial at Ethical Hacker Network. This interprets many log files, consolidating their information based upon date and time.

In specific cases, use Perl and regular expressions (regex). Use Regex Coach or Expresso, interactive tools for creating regular expressions. Adopt tested modules from the Comprehensive Perl Archive Network (CPAN) and other published sources, such as Perl-Fu: Regexp log file processing.

Information Leakage Detection (regex)

When watching outbound files for sensitive information, some specific strings to grep for would be:

IP addresses	(b\d{1,3}\.\d{1,3}\.\d{1,3}\.\d{1,3}\b/)
Visa Credit Card Numbers	(^4[0-9]{12}(?:[0-9]{3})?$)
Social Security Numbers	(^(?!000)([0-6]\d{2}|7([0-6]\d|7[012]))([ -]?)(?!00)\d\d\3(?!0000)\d{4}$)

Use Regex Coach and Expresso to assist when writing regular expressions.

Acknowledgment to Perl-Fu: Regexp log file processing should be inserted here.

Digital Forensics Links

A forensics examination requires more than tools. Documentation, preservation of evidence and the ability to interpret the tools and reach supportable conclusions are necessary to ensure the admissibility evidence in a court of law.

If you are not concerned about admissible evidence, then I wouldn’t call it “forensics.”

Articles

• Computer Forensic Blog Andreas Schuster
• Computer Forensics/E-Discovery Tips/Tricks and Information Mark McKinnon’s blog
• Computer Forensics Resources Collection of Forensics links maintained by Global Digital Forensics
• Digital Forensics Magazine
• E-Evidence Information Center Digital Forensics articles and links
• FAQ: What is the impact of e-discovery law on IT operations?
• File Signatures Tim Coakley’s file signature database. Extend what ProDiscover detects.
• Forensics and Recovery, LLC Paul A. Henry, author of Information Security Management Handbook and other books
• Forensics Wiki Links to articles, tools, file analysis
• Hany Farid: Research about images, image manipulation, digital forensics and steganography
• Mac OS X Forensics George Starcher
• NTFS Disk Internals NTFS indices
• SANS Computer Forensics and eDiscovery blog with Rob Lee
• Scientific Working Group on Digital Evidence (SWGDE) Forensic practices and research
• Volatile Systems Blog Aaron Walters
• Volatility: Volatile Memory Analysis Research Aaron Walters

Podcasts

• Forensic 4cast Lee Whitfield’s digital forensics podcast (also 4cast.whitfields.org)
• Forensics and Recovery podcasts Paul A. Henry, author of Information Security Management Handbook and other books
• CyberSpeak Two former federal agents discussing computer forensics, cybercrime, and computer security.
• Inside The Core Macintosh forensics
• Cybercrime 101
• Talk Forensics

Tools

• University of Massachusetts Recommended List of Tools for Incident Detection and Eradication [PDF]
• AccessData Registry Viewer
• CAINE Live CD Computer Aided INvestigative Environment (CAINE) is a GNU/Linux live distribution created by Giancarlo Giustini as a project of Digital Forensics for Interdepartment Center for Research on Security (CRIS), supported by the University of Modena and Reggio.
• DCode decode the various date/time values found embedded within binary and other file types
• dd command line utility for disk imaging and restoration
• DiskExplorer for NTFS NTFS file system examination
• EnCase from Guidance Software digital forensics software
• Forensic Acquisition Utilities by George M. Garner Jr., includes a Windows-based dd command that can dump memory
• Forensic Toolkit (FTK) from AccessData digital forensics software
• FTK Imager from Access Data. Creating the image is free. Using FTK Imager [swf] (from Edmonds Community College).
• Intella Mail system forensics
• IrfanView and Plugins (specifically, the EXIF plugin) a graphics viewer which can reveal JPEG details
• IsoBuster CD examination utility
• LADS command line utility to find NTFS alternate data stream files
• MiTeC Windows Registry Analyzer
• Mobile Internal Acquisition Tool (MIAT) Symbian and Windows Mobile Forensics
• Passware password recovery software
• Process Dumper (pd) and Memory Parser (mmp) Tobias Klein research and tools for memory analysis
• Registrar Registry Manager from Resplendence Windows registry viewer
• RegistryReport RegistryReport doesn’t process the Registry files of the running operating system. To get information from the running system, use SystemReport.
  With the application RegistryViewer you can view raw Registry files like in the Windows Registry editor.
• RegRipper Harlan Carvey’s RegRipper
• RegViewer
• Revelation password recovery software
• Scalpel data carving software Scalpel is a (free) fast file carver that reads a database of header and footer definitions and extracts matching files from a set of image files or raw device files. Scalpel is filesystem-independent and will carve files from FATx, NTFS, ext2/3, or raw partitions.
• sha_verify command line utility to compute MD5/SHA hashes
• Simple Carver inexpensive data carving and file recovery software
• Sleuth Kit (TSK) & Autopsy: Digital Investigation Tools for Linux, Unix, and Windows TSK is a C library and a collection of command line tools (based on code from The Coroner’s Toolkit (TCT)). Autopsy is a graphical interface to TSK.
• Windows File Analyzer Analyze Thumbs.db, the Prefetch folder, shortcut files, Index.Dat files, Info2 (Recycle Bin) files
• Windows Incident Response (IR) and Computer Forensics (CF) Tools Harlan Carvey
• WinHex from X-Ways digital forensics & data recovery software, hex editor & disk editor

Web browser utilities are in Web Browser Forensics.

Code Review

Notes from the Security Innovation Secure Code Review presentation (pdf) (wmv).

• Focused on security vulnerabilities

Since “security” covers availability, confidentiality, integrity and authenticity, you may feel that this review covers just about everything. Performance, for example, should not distract you.

There’s nothing wrong with saying the same thing in different ways. For example:

• Break into manageable chunks
• Would you be more effective reviewing a million or a thousand lines of code?
• Review iteratively

The iterative reviews focus on the newly added manageable chunks, a few thousand lines of code.

During the code review process, rigorously collect test data today to be used as part of your acceptance test scripts. Test data should test each logical branch of your code. Record the data and its expected result.

In all, the security code review seems much like a structured code review, save that the security code review focuses upon a limited list of coding practices.

Security Innovation whitepapers

Security Innovation list of attacks