1. Search Smarter

Statistically speaking, hackers lurk among popular trends – movies, media scandals, natural disasters, etc. You are more likely to encounter a SEO poisoning attack when searching for something that is recently in the news. Now, I am not advocating ceasing any searches about popular topics by any means. But, it is very important to think about what content you are about to view. Is the charity you are about to donate to actually legitimate? Is the site you’ve visited sending popups with “Free Antivirus” products or warnings? Are you viewing a well-known site, or some spoof site from a third-world-country? Consider your goal and your means when searching, always use your head before clicking (especially the “download” or “run” buttons!)

2. Watch out for Topic Mismatch

Sites are usually dedicated to one niche, or general category. In the example above, it’s odd that a vacation property site links to a popular media topic… This kind of thing, while possible, is rare, and may be indicative of a malware-driven site, or a spoofed site alltogether.

3. Watch the Page Type and Don’t Run Javascript/Flash from Unknown Sources

In the example above, the page is a PHP script (not uncommon), with the search string as a query. However, each time you allow dynamic content to run on your browser (Javascript, Flash, Microsoft Silverlight, etc) – you open up yourself to a range of possible attacks. Recently, a popular SEO poisoning attack leveraged on a vulnerability in Flash to deliver its payload. We recommend a plugin such as No-Script for Firefox, to combat unwanted/unknown code from running. Again, legitimate content from legitimate sites is a good thing, but globally enabling these plugins can result in a vulnerable system. It is easier to exploit a system with many potential vulnerabilities!

4. Patch your system, Run AV and Anti-Spyware Software ALWAYS

This should be a given, but the fact is: many users repeatedly fail to install critical security patches, run anti-virus software and anti-spyware. No system is completely hardened from attacks, and failing to install the needed security software and patches increases the impact of an attack exponentially. Patches exist to correct vulnerabilities that are discovered (read:out in the open for hackers to exploit!). No one tool is completely comprehensive or perfect either.

To protect against SEO poisoning attacks, the following browser plugins are recommended:

• Ad-Block Plus – Blocks annoying advertisements and dangerous content (Firefox)
• Web of Trust – Safe Browing Initiative, Rates Sites Based on User Input (Firefox)
• No-Script – Block Javascript and other annoying (sometimes malicious) dynamic content, except by explicit permission (Firefox)

5. The Moral of the Story: Use common sense!

What this all boils down to is: users need to wake up from the blissful world of “oh, it won’t happen to me” and understand that the internet is inherently untrustworthy. There are tools and resources out there for every operating system, and every browser to make your search experience a safe one, but ultimately, the responsibility rests with you. Think before you type and click – don’t let those hackers steal your machine or your peace of mind.

Share This Article

When new traffic is seen from the IP address (using simple bit by bit and header analysis) – the IDS queries the database, and scores the packet as malicious or not.

What this means essentially is: if you are a penetration tester, or conduct routine tests on your network, or even are simply a user who accesses a lot of admin pages (or uses poorly coded software) – you may be at risk for being blocked or limited by Intrusion Detection Systems, even if you need legitimate access to a network system! IP-based blacklisting is too rigid, and counterproductive if not implemented properly.

This is a strong case against simple rule-filter-table based detection systems, and a case for stronger, smarter detection algorithms and human involvement in network operations. What are you using to detect network anomalies and malicious network traffic?

Share This Article

Czech researchers at Masaryk University’s Institute of Computer Science in Brno, Czech Republic have discovered the “Chuck Norris Botnet”, whose army of compromised computers silently and stealthily probes IP addresses for unsecured routers, wifi-gateways, switches and other network hardware – then attempts to guess the passwords of these machines in order to spread itself.

Botnets are “distributed networks of compromised computers and network-connected hardware which are used to launch attacks against other machines or to steal private information, such as passwords and bank account information, from users.” says Josh Wepman, a Security Researcher at BitForce Consulting LLC, he adds “many users aren’t even aware that their machine is being used against their will – and that’s the beauty of the attack – thousands of computers under the complete and total control of the hacker”.

Anatomy of a Botnet Attack

Major companies affected by this attack, such as D-Link were not aware of the problem, however note that the best way to fix a compromised box is to manually reset the entire system, however the Chuck Norris Botnet resides in RAM, not the hard disk, so simply resetting the router would fix a compromised machine. Changing passwords from factory defaults was also strongly recommended.

The biggest danger of the Chuck Norris Botnet is that it sends poisoned DNS replies to the user, potentially causing the user to visit malicious websites and therefore to divulge secret information (such as passwords) to an attacker.

The easiest and best way to prevent against this particular botnet, and from manual attacks against your system is to always change your passwords from a factory default setting to a secure alternative. Regular patches and updates are very important to routers, as well.

Share This Article

Driven from every other corner of the earth, freedom of thought and the right of private judgment in matters of conscience, direct their course to this happy country as their last asylum. – Sam Adams

Privacy is a mainstay of free society.

In celebration of Data Privacy Day (28 January), CNet released an article discussing privacy, namely the fact that many refuse to pay for privacy. It’s been 10 years: Why won’t people pay for privacy? (available: http://news.cnet.com/8301-13578_3-10443575-38.html). Indeed, the ramifications of data privacy (or lack thereof) is increasingly becoming a crucial issue for businesses and consumers alike. Information leaks are rampant, and chances are, your personal data has already been exposed in some sort of attack.

How, then, are we to deal with data privacy threats and mitigate the risks? Our current network infrastructure is designed in ways that simply don’t guarantee security. Yet, most users also simply trust the system. It is the responsibility of the both user and the system developer to strive for information assurance, and to work towards a more secure future. Security is not necessarily about guaranteeing perfect and complete isolation from attacks (such a feat is, and has proven to be impossible in both the physical realm and in cyberspace), rather, it is about a dynamic and adaptable set of rules and policies governing the control of information and access.

An Additional Problem

Since we can safely assume that the underlying technologies of the internet are generally insecure (with the exception of specific security protocols, TLS, SSL, IpSEC, etc), we conclude that our digital privacy is not at all guaranteed, in fact, quite the contrary. Even if we rely on secure protocols, these protocols are only as secure as the implementation, and implicitly rely on the trust of other systems/organizations (for example Public Key Infrastructure relies on the fact that we generally believe prime number factorization to be difficult; HTTPS websites rely on the integrity of Certificate Authorities to only provide certificates to the owner of a site, not to third parities).

Therefore, trust must be a vital aspect of any security protocol, and every step of the system (from the physical hardware and protocols, to third parties) must be thoroughly vetted before integrated into the system.

Data Breach vs Difficulty – Cost/Benefit Analysis

Let’s take a step back, for a moment, and look at the big picture of data security. Let’s say I am sending an unencrypted email to my friend Alice. Would this email be appealing to the attacker if it contained a beautiful picture of the mountains? Well, maybe, but definitely not as appealing as if it contained my credit card number. The difficulty of “sniffing” (capturing) the contents of this email is not too great, but the payoff in the first case is not great either.

If we modify this example so that the same emails are being exchanged, only the contents are encrypted with a system that we generally trust. Now, the difficulty of obtaining the contents of the email is significantly intensified. Would it be worth the enormous effort to decrypt the email in the first case? Most likely, not. But, let’s say that the attacker really, really wanted the contents of the email (say, it contained important financial info, for example). Now would it be worth the effort?

This example demonstrates the classic issue of cost-benefit analysis. From the attacker’s perspective (and this holds true in general as well), if the payoff (benefit) outweighs the difficulty (cost), the attacker makes the effort. Otherwise, generally speaking from a psychological perspective, most attackers would not waste the time or effort. From the other perspective: would it be worth it to take the extra time (and computational resources) to encrypt an generally unimportant personal message? In other words, is the cost of implementing security protocols commensurate with the level of necessity of information security it provides?

This is the classic question of security through difficulty - if you maximize the cost of breaching your data, when compared to the benefits such a breach would provide, in this area, security is upheld.

A Practical Discussion

Every member of the society spies on the rest, and it is his duty to inform against them. All are slaves and equal in their slavery… The great thing about it is equality… Slaves are bound to be equal. – Fyodor Dostoevsky

Your data, theoretically, is not completely secure over the internet. Perfect data security is an impossible goal, or otherwise an hallucination. Indeed, what we strive for is to provide the level of security that prompts an attacker to “give up” – to minimize our transmitted data, and guard our relevant data using offline means and physical safeguards. This is a call for the user and the administrator to beware of what they post and transact online.

In most areas, there is a reasonable expectation of freedom of information and thought, but the freedom to transact data unobserved should not be relied upon as a reliable safeguard. It is our responsibility to be proactive in implementation, monitoring and enforcement of our infrastructure, and to not transmit unnecessary data over networks. Just like we guard your wallets, our cash, our identities, so must we guard our information.

Share This Article

For more information, please visit our contact us page: Contact BitForce Consulting LLC.

Share This Article

UAC is activated programatically using the following syntax in the manifest by:

or in code through

System::Diagnostics::Process^ proc = gcnew System::Diagnostics::Process();
proc->StartInfo->FileName = "C:\\Windows\\system32\\cmd.exe";
proc->StartInfo->Verb = "runas"; // Elevate the application
proc->Start();

(demonstrating execution of cmd.exe in privileged mode via the “Verb” = “runas” command)

In all uses of this form of privilege escalation, (which appears in a slightly different User Interface form in Linux and Mac OS as well) – tangible security benefits are implemented by default. It is possible to disable these dialogs, however, it is strongly recommended that this not occur, due to the increased potential for compromised software or hackers who gain access to the system to gain root (administrator) permissions.

Privilege escalation attacks historically are among the most fruitful, because if successful, they allow an attacker to elevate their range of potential damage to administrative levels. We find that Windows 7 does indeed help protect against these attacks, through the use of the UAC – at the risk of flooding the user with “annoying” popups. The greatest threat to the UAC system, therefore, is not an instability in the software or a loophole, per se, it is the user carelessly disabling this valuable system, and then subsequently failing to take adequate other security precautions to prevent successful access to the machine, and then trivial privilege escalation.

The moral of the story, folks is: don’t disable a vital security feature unless you are sure that you have other means to protect against exploiting that system.

Share This Article

We plan to add a customer/task tracking system soon. If you are a current client, you will be notified when your tasks are available online. We are glad to be developing this service for you – tracking your tasks, requesting quotes, contacting representatives will be easier than ever before!

Share This Article