November 2007

Vol 11, Issue 3

Security in the News
Your source for up to date security headlines

Greetings!

I am sure that everyone is getting ready for the upcoming Thanksgiving Holiday.

From all of the staff at Secure Anchor we wish you a safe and festive holiday

Eric

NIST Launches Competition for New Hashing Algorithm

The National Institute of Standards and Technology (NIST) is starting a competition for a replacement hashing algorithm for earlier versions of the Secure Hash Algorithms (SHA) to be designated SHA-3.

Hashes are produced by taking a message as input. The hash algorithm then operates on the message, producing an output of a certain length (i.e. a certain number of bits), and are characterized by the fact that if someone else runs the same algorithm against the message, they should get the same hash value as the first person. If there is a difference, then the message has definitely been changed. In this way, hashes are used for message integrity checks - so that if the recipient of a message has a calculated hash value different than the hash value specified as what the message should produce, then the message has been tampered with.

When two different messages produce the same hash value, this is known as a collision. Collisions occur because the hash values are shorter than the messages that produce them. Thus, there is a many to one relationship between messages and hash values. The trick is that because of the probabilistic nature of hashing, the odds of this occurring randomly are very slim. And, in probabilistic terms, the message that would cause the collision with a message which was human readable, would most likely be nonsense, therefore not being a good candidate for the real message. The issue occurs with data other than data which would be human readable.

In recent years, the Chinese have made great advances in discovering weaknesses in the hashing algorithms and causing collisions almost at will.

The algorithm selected to be SHA-3 will be used as an addition to the hashing algorithms specified for use as standards. The Federal Information Processing Standard (FIPS) 180-2 Secure Hash Standard specifies the algorithms which are acceptable for use under the standard.

NIST stated, "FIPS 180-2 specifies five cryptographic hash algorithms, including the SHA-1 and SHA-2 family... Serious attacks have been reported in recent years against cryptographic hash algorithms, including SHA-1. Because SHA-1 and the SHA-2 family share a similar design, NIST has decided to standardize an additional hash algorithm to augment the ones currently in FIPS 180-2."

In This Issue

NIST Launches Competition for New Hashing Algorithm

Russian Business Network Temporarily Offline

U.S. Says to Forget About Online Privacy

Facebook Launches Online Ad Tracking Campaign

Yahoo Executives Answer to Congress

U.S. Gets Canadian Company to Turn Over Information on Individuals

They Can Catch Music Pirates but They Couldn't Catch...

They Did Catch One of the Founders of WabiSabiLabi

Quick Links

CCCure Organization

Sans Institute

CVE Common Vulnerabilities & Exposure

Black Hat

The Honey Pot Project

IT Security

Security Focus

SC Magazine

Dark Reading Daily

Russian Business Network Temporarily Offline

The Web site of one of the most famous cyber-criminal organizations has been taken off line - reported by Trend Micro as going down at 0200 GMT, on November 7. Trend Micro states, "Since then, IP addresses of RBN can no longer be reached because there is no routing for them any longer."

Speculation has it that the Russian Business Network (RBN) upstream providers have cut them off. These providers included Tiscali and Russia's C41.

RBN is infamous as the source of many exploits and for distribution of malware. Trend Micro warns that the reprieve may be temporary. Trend Micro security researcher Feike Hacquebord said, "RBN may find new upstream providers. In recent weeks, moreover, Trend Micro has seen equivalents of RBN pop up in Turkey and Taiwan."

U.S. Says to Forget About Online Privacy

Dr. Donald Kerr was confirmed unanimously by the Senate on October 4, 2007 as principal deputy director of National Intelligence, second in command to Director Mike McConnell. Dr. Kerr gave a speech to the 2007 GEOINT Symposium on October 23 in San Antonio, and shed some light on the direction in which national intelligence is headed.

He informed the gathering that the National Intelligence Coordination Center (NIC-C) opened earlier in October. The NIC-C, according to Dr. Kerr, is "a place to bring together all collection systems and agencies and will increase our opportunity to optimize deployment of our collection capabilities."

He described the discussions that took place at the closed door meeting of the heads of the National Security Agency (NSA), National Geospatial-Intelligence Agency (NGA), Defense Information Agency (DIA), and National Reconnaissance Office (NRO), in terms of the need for greater interconnectedness. The problem, as Dr. Kerr framed it, was that, "What we didn't have necessarily in our control was the ability to set standards that would allow for interoperability and interconnection. And to that end, we're now reaching out to the CIOs of the Department of Defense and the intelligence community."

In this way the NIC-C will be used "in terms of moving from a high level of thinking about our national priorities to being able to collectively task problems against the myriad of collection capabilities that this country has."

Dr. Kerr detailed the intelligence agencies' concerns about sharing information with each other, basically because each agency was afraid the other agency would leak information. And it seems that now there is less fear of that as the agencies are getting used to the idea of sharing information, saying, "we've started to bring down those walls as we require information sharing between intelligence, Homeland Security, and Defense agencies and law enforcement."

Dr. Kerr addressed privacy, and offered a new definition, preferring not to worry about old definitions. "Instead, privacy, I would offer, is a system of laws, rules and customs with an infrastructure of Inspectors General, oversight committees, and privacy boards on which our intelligence community commitment is based and measured. And it is that framework that we need to grow and nourish and adjust as our cultures change."

The best part was when he discussed the workers at ISPs and why anyone would not trust the government when "...they were perfectly willing for a green-card holder at an ISP who may or may not have been an illegal entrant to the United States to handle their data..."

In response to a question about the Intelligence Agency Advanced Research Projects Activity (IARPA), Dr. Kerr indicated that there might be an expansion of the model beyond the manner in which DARPA worked, saying, "It may not be the case that all of the science and technology needed for our community can be attained by grants and contracts. We may have to find other means as well."

Facebook Launches Online Ad Tracking Campaign

Facebook announced its "Facebook Ads" program. This allows advertisers to know users' activity on Facebook and also third-party sites in order that advertisers are able to deliver more targeted ads. The initiative is based on a technology called Beacon, and is an opt-out system.

Facebook claims that it has taken steps to stop misuse of the information they gather, though, "we of course cannot and do not guarantee that all platform developers will abide by such agreements."

Yahoo Executives Answer to Congress

The US House Foreign Affairs Committee was in rare form when questioning Yahoo CEO Jerry Yang and general counsel Michael Callahan.

The two were summoned to answer questions about the case of Chinese human rights activist Shi Tao. Mr. Tao was arrested by Chinese authorities after Yahoo handed over information to the Chinese government which helped them to ascertain his whereabouts.

Democratic Committee chairman Tom Lantos said, "While technologically and financially you are giants, morally you are pygmies." Republican Congressman Chris Smith compared Yahoo's actions with corporations that cooperated with the Nazis in the last century.

Mr. Callahan tried to explain to the Congressional committee that Yahoo had no choice in the matter, and that they had to obey the local laws of China. He also apologized for giving misleading evidence in the matter. He explained, "I cannot ask our local employees to resist lawful demands and put their own freedom at risk even if, in my personal view, the local laws are overbroad."

Mr. Callahan also noted that Yahoo's China operations are now run by Alibaba.com, a Chinese company, of which Yahoo only owns 40 percent. Cisco Systems and Softbank are also investors in Alibaba.com, and it is a publicly traded company on a Hong Kong exchange.

Mr. Callahan would not say if Yahoo would help Shi Tao and his family, nor would he say whether Yahoo has turned over similar information on other people, or how they would handle similar situations in the future.

Congressman Lantos then asked them if they would at least apologize to Shi Tao's mother, who was sitting right behind them, but they would not do that.

They did say however, that they would make things right by trying not to turn people's names over to the Vietnamese government when they open a business in Vietnam.

The case against Mr. Tao was such that his conviction landed him in prison with a ten year sentence. According to Chinese court documents, his sentence will end November 23, 2014. He was accused by the Chinese government of transmitting a top secret document to overseas news organizations. The document, as it had been smuggled out and published, is easy to find, both in translation and in the original Chinese.

The top secret document was a Communist Party list of instructions to news organizations on what stories to print with what slant.

As it turns out, he was lucky to only get ten years. According to the 'Verdict Document from the Middle Criminal Court, Changsha City, Hunan Province,' we see the following:

"The accused Shi Tao's defender claims, 'Based upon the fact that the accused Shi Tao's actions did not cause grave damage to national security and interests and the fact that the accused has admitted his crime, we ask the court to be lenient." Upon studying, this claim corresponds with the facts and therefore the court accepts the advice."

U.S. Gets Canadian Company to Turn Over Information on Individuals

Hushmail Communications, a Canadian company, turned over clear text copies of encrypted communications, having kept the users' passphrases.

Funny though, Hush, up until this incident, said no one, including its own staff, could access the content of encrypted emails it processes.

However, as it turns out, the OpenPGP and AES 256 algorithms are no match for those who have the keys.

In 2006, Hushmail introduced server-side encryption as a convenience for its customers, because they found that people were unable to easily use encryption when they needed to install a Java applet on their client machines. Or as the company maintains, using client side encryption was slow and annoying. (Insert your favorite convenience vs. security joke here.)

Therefore, with server-side encryption and the need for the customer to send the passphrase across the public Internet, those at Hushmail were able to capture and store the users' passphrases.

Even with the Java applet enabled performing client side encryption, there appears to be a mechanism with which Hushmail could extract the user's passphrase. This is implied in the Hushmail threat matrix, which states that if an attacker were able to compromise Hushmail's servers, that 'evidence of the attack' would be able to be found on a user's computer. Some read that statement to mean 'in the Java applet', and if that is the case, then there would be other information which could be recovered from the applet. And that is also assuming that the company is not forced to rig the applet with some other type of surveillance mechanism anyway...

They Can Catch Music Pirates but They Couldn't Catch...

The world is again safe from rampant Canadian music piracy as the Canadian Recording Industry (CRIA) successfully threatened the hosting company for Demonoid.com, a BitTorrent site. That is, according to the Demonoid front page which claims: "The CRIA threatened the company renting servers to us, and because of this it is not possible to keep the site online. Sorry for the inconvenience and thanks for your understanding."

Apparently a report commissioned by the Canadian government states that P2P file sharing is not causing CD sales to suffer.

The record industry surge seems to be working, however. They have kicked in doors in multiple countries, coordinating an international campaign, including raiding OiNK in Great Britain, and seizing eDonkey servers in Germany. And in the legal arena they scored a $220,000 judgment against a Minnesota woman. The question becomes, would a person who spends time messing around with music downloads have $220,000 in assets for the taking?

They Did Catch One of the Founders of WabiSabiLabi

There is quite a cast of characters involved in this scandal. WabiSabiLabi is the online auction site for security researchers and creators of exploit code who wish to get paid for their work. The entrenched interests don't like WabiSabiLabi because they want to hold the line at not paying for information regarding vulnerabilities in their products, preferring that the researchers hand over the information for free. Roberto Preatoni was one of the founders of the site.

Meanwhile, Fabio Ghioni, VP and security CTO at Telecom Italia was going around complaining that governments were spying on people and trying to control the population's behavior.

Neither of these guys is going to cause trouble for anyone, as they and some others are now charged with planting Trojans to steal data and spy on telecom execs, publishers and journalists.

Our mission is to keep your business focused by helping you navigate the sea of security threats you face on a daily basis. Secure Anchor provides creative solutions that keep you ahead of the attacks and provide peace of mind that your critical assests are securely anchored. In addition we are busy developing software solutions to meet the threats of tomorrow.

End your newsletter with a kick -- consider a postscript to reinforce one of the key product or service benefits.

Sincerely,

Eric Cole
Secure Anchor

Pointsec Protector provides a policy driven mechanism that secures an organization's sensitive information by controlling data that enters and exits a PC or server via removable media and I/O devices on any port (USB, Firewire, IDE, Bluetooth etc).

Are you???

Do you Need to...