On " Vista: Where UNIX was in the 1980s"

Vista UAC? Access control "innovation"? "Next-generation" OS security?
Enjoy "Vista: Where UNIX was in the 1980s"

On Security vs Convenience vs Embarassment

I just love this quote from Alan Paller: "convenience trumps security, but embarrassment trumps convenience." Sounds like a new driving principle for security.

Besides the above quote, I was actually quite impressed that "log management was cited [as a funding priority] by 23 percent of respondents"

But all this murks in comparison to the good old some-say-myth-some-say-truth that "everybody is 0wned." Specifically, Alan Paller said: "Federal systems are deeply penetrated, by hackers and other hostile interests."

On "Know your Enemy: Web Application Threats"

A fun new paper from the Honeynet Project on honeynets vs. web hacking.

Future Innovations

Here is a fun doc [PDF] with some predictions of what technologies might will appear before the year 2050.

Anton Security Tip of the Day #9: But He "Wasn't Logged!"

Following the new "tradition" of posting a security tip of the week (mentioned here, here ; SANS jumped in as well), I decided to follow along and join the initiative. One of the bloggers called it "pay it forward" to the community.

So, Anton Security Tip of the Day #9: But He "Wasn't Logged!"

The idea for this tip originated when my presentation on log analysis was rejected by one of the high-profile security conferences on the grounds that "logs don't matter since advanced attackers never leave traces in logs [or erase them before anybody can get to them] ." Indeed, some of my security friends of a more "offensive orientation" :-) have long developed this snobbish attitude about logs.

So, imagine a network that has fallen victim to a 0day-wielding "uber-haxor" :-), who kicked the door open (or snuck in), grabbed the crown jewels and took off like a bat out of hell :-) When, much too late as usual, the "good guys" rushed in to pick up the pieces, only there was seemingly nothing much to pick: the server logs were erased and the network IDS didn't make a peep (and, no, Richard, NSM was not deployed). What do you do now?

So, let's list some uncommon (and some common, but often untapped for the task at hand!) sources of log data and provide a few log analysis tips:

• firewall logs: boring they might be, but it is less likely that those are erased by the attacker (even though firewall logging can sometimes be jammed). And it is hardly possible to "not be logged" by the firewall (the analyst's challenge is in analyzing the huge volume of data to find the attacker's traces and to tell them from normal traffic). What is critical in making these logs useful is logging allowed connections, not only blocked ones.
• router logs and netflow records: same as firewalls logs - they are less likely to be erased, but huge log volumes make their use problematic. And, last but not least, these types of logging are more likely to be turned off completely ("routers should route, not log," grumble many network types)
• application logs: was it a "legacy" network attack or something application-level? If the latter is true, there might be logs found in unusual places. Is there anything in the webserver logs? Websphere made a peep? MySAP recorded something? PHP app logged something fun?
• various client logs: in one old case FTP client logs were extremely helpful, even though the entire syslog directory was blown away and no remote logging was ongoing; look for other client logs (yeah, even a web browser history is kind of a log...) to look for things missed by the attacker
• other systems' logs: was there anything that the attacker did that affected other systems? Might have they logged it? Even an attempted SSH connection or a scan from a compromised machine has a high chance of leaving traces elsewhere - cleaning all of such traces is a major challenge for an attacker (in any case, much harder than erasing logs and stopping logging on the compromised host)
• any remote or centralized logging: was any log saved from destruction by being copied to another system?

To conclude, while there is no "logwatch" pattern for "advanced attacks," logs are still very useful in such circumstances if you prepare by setting up a broad scope of log collection (I suspect using a log management system will be your only choice as log volumes will be pretty bone-crashing) and then combing through the logs after the incident. And remember the less common sources of log data, such as database logs.

I am tagging all the tips on my del.icio.us feed. Here is the link: All Security Tips of the Day.

On "Top Ten Investigative Boo-Boos"

Oldie (eh, from February, 2007, that is :-)), but goldie... An interesting and enlightening read "Top Ten Investigative Boo-Boos" from SecurityMonkey.

Just one example:

"2) Investigators destroy evidence because they didn't follow their own procedures. [...]"

More Fun Stuff on Security vs Security

So, my little poll on security violations by security people is running nicely. I realized that I totally forgot to add an option of "NEVER did anything of this sort."

Check out the current results here and vote here.

So far, it seems like we do like to violate security rules which - I am guessing here - we perceive as 'stupid.' But how can we then complain that users break the rules that they think are stupid?

Something is deeply amiss here... help me out!

Review of my Database Logging Paper

Thanks to Paul Melson for a thoughtful review of my database logging paper. I enjoyed reading his review almost as much as I enjoyed writing the paper :-) The part I liked the most is where he goes over the categories of log use for change management, threat detection, etc (and disagrees with logs being the best tool for some of them ...)

A Fun Question to Ponder ...

A small trivia question: do you know what is "thermorectal cryptanalysis"? No points will be earned if you speak Russian :-)

Security vs Security: Who Wins?

Reading this story by Ira Winkler inspired me to do this little poll here.

So, my esteemed readers of security profession, have you ever knowingly circumvented a security measure?

PCI Book Out Soon!

I am sure that "everybody in the know" is already, well, in the know, but still - here it comes, the first book on PCI: '"PCI Compliance: Understand and Implement Effective PCI Data Security Standard Compliance"by Tony Bradley (Author), Anton Chuvakin (Author), Anatoly Elberg (Author), Brian J Koerner (Author)'

Again and Again on Compliance vs Security

I am going thru my "backblog" of items :-) to blog about - here is one fun item where Andy weigh in on compliance vs security with "Compliance rarely leads to good security but good security almost always leads to compliance." Indeed, claiming the opposite is silly, just look at all this FISMA stuff.

However, what is missed in the above adage are all those areas of compliance and IT governance that have little to do with security: proper change control (which admittedly helps security immensely), documenting controls, SLAs, and a bunch of other stuff that ITIL, COBIT and others are made of.

So, compliance might not lead to security, but security doesn't lead to [full] compliance as well ...

Dumb and Dumber ...

Mike says: "I write one thing about SIM and every friggin' vendor that I've never heard of has to reach out to me and tell me how great they are."

He continues: "1st generation SIM [you know who you are...] is pretty much dead, and those that want to survive need to either focus on log management or more real-time network detection (which means they need to bring in NBA data)"

And then closes with: "But of course, lots of folks were lining up to get briefing slots to tell me how great they are. Without even hearing their pitch, it's a load of crap."

Sorry for that much quoting, but there is just no better way to say it - some companies in this segment have certainly overstayed the market's welcome...

Doing a Media Interview for Security Vendors

Humorous it might be, but oh, so much truth in there ...

A quote:

"The Players

Interviewees generally come in threes. There’s the Main Guy, the Other Guy, and the PR Bodyguard."

"Main Guys can build a 20-slide Powerpoint around a single trivial feature upgrade that is entirely 100% identical to something their competitors introduced and briefed you on three weeks ago."

"...At this point, you need to show that you’re paying attention. So ask, “What are your target verticals?”. The answer is “healthcare and financial services”."

"The sixth slide has a diagram with some boxes on the left, some people typing on the right, and a cloud in the middle."

"The tenth slide has the name of an analyst you can call if you’re a fresh-out-of-college rookie or just totally fucking clueless and lost."

etc, etc, etc

Fun Read: "Bad News Is Good"

Here is an interesting high-level article "Bad News Is Good" with a somewhat duh! conclusion - if neglecting security will make you have to pay ... a lot, things will change in a flash: "But a punch in the wallet: Now that ought to focus an enterprise's attention."

Let's Play a Fun Game Here ... A Scary Game

So, let's suppose somebody who is involved with incident response at a typical US public University has collected a few recent malware samples from the compromised machines and then submitted all the samples to VirusTotal for scanning with pretty much ALL current anti-virus and anti-virus-like products.

What do you think the average detection rate (i.e. a malware sample was identified as "something bad") was?

Any guesses? Here are a few numbers to help you choose:

1. 100%
2. 94%
3. 90%
4. 70%
5. 50%
6. 33%
7. 22%
8. 14%
9. 2%
10. Something else?

Let the games begin!

UPDATE: answer posted

UPDATE2: after much deliberation, I finally replaced anti-virus on my own systems with another technology. Read the details here.

Build A Better ... Top Influencers List :-)

Improving upon something written by others does drive a lot of blogging. So, why not improve a list of top influencers in security? Indeed, Computer Defense list makes a bit more sense, as far as technical credibility is concerned.

Update: any "list watcher" :-) must read the comments over at Matasano and have fun while doing it. Ability to not take oneself too seriously is critical in our biz :-)

On Ego Feasts and Top Lists :-)

Labeled a "list of the most influential security experts of 2007 - from corporate tech officers and government security types, to white hat hackers and bloggers", the list certainly generated a lot of noise in the security blogosphere.

And why not? After all, why do we blog? I am thinking ...

• To share knowledge with the community
• Because it is easier than writing a book :-)
• To generate F&G
  
• Because we need to generate awareness about our favorite technologies
• To vent and rant
  
• Whatever other reasons ...
  

So, in my estimation "fame and glory" is one the more common drivers that apply to just above every security blogger I've met. And if it doesn't apply to you - you are in denial :-) Thus, combine such personalities with whatever "top list of ..." and you get a lot of interest ...

Finally, I am honored to occupy a spot #4 in the sub-list of "Chief Blogging Officers" (I never thought I am one, BTW)!

Discounted Passes for CSI NetSec 2007 Anyone?

If you are into that sort of thing :-), I can give you a deeply discounted pass for the upcoming CSI NetSec 07 conference to take place in June 11-13, 2007 in AZ.

Since I am speaking there on mistakes of log management, I can give out a few of those discount codes that reduce the conference admission price by almost a $1000: "The discount passes cover the entire two-and-half-day conference for only $795 until May 11th (after which the discounted passes will be $995)--a regular conference pass is $1,645. "

To make use of the pass code go to CSI NetSec 07 Registration.

Update: just as I suspected :-) No takers so far...

Discounted Passes for CSI NetSec 2007 Anyone?

If you are into that sort of thing :-), I can give you a deeply discounted pass for the upcoming CSI NetSec 07 conference to take place in June 11-13, 2007 in AZ.

Since I am speaking there on mistakes of log management, I can give out a few of those discount codes that reduce the conference admission price from by almost a $1000: "The discount passes cover the entire two-and-half-day conference for only $795 until May 11th (after which the discounted passes will be $995)--a regular conference pass is $1,645. "

To make use of the pass go to CSI NetSec 07 Registration.

Discounted Passes for CSI NetSec 2007 Anyone?

If you are into that sort of thing :-), I can give you a deeply discounted pass for the upcoming CSI NetSec 07 conference to take place in June 11-13, 2007 in AZ.

Since I am speaking there on mistakes of log management, I can give out a few of those discount codes that reduce the conference admission price from by almost a $1000: "The discount passes cover the entire two-and-half-day conference for only $795 until May 11th (after which the discounted passes will be $995)--a regular conference pass is $1,645. "

To make use of the pass go to CSI NetSec 07 Registration.

On Database Logging and Auditing (Teaser + NOW Full Paper)

Here is a excerpt from a fun paper on database logging that I just wrote:

"Database security have been capturing more and more attention in recent years, even though most of the security issues surrounding the databases existed since the first day commercial database systems were introduced in the market.

Nowadays, database security is often seen as containing the following principal components:
• access control to database software, structures and data
• database configuration hardening
• database data encryption
• database vulnerability scanning

It is interesting to see that logging and auditing underline all of the above domains of database security. Indeed, the only way to verify what access control decisions are being made and who views what data from the RDBMS is to look at the authentication logs. Database configuration hardening includes enabling and increasing the auditing levels. Similarly, data encryption might be verified by log and configuration review. And, vulnerability exploitation usually leaves traces in logs despite what some say (the challenge is more often with understanding what the log said and not with having the logs)

In recent years, insider attacks gathered more attention than periodic outbreaks of malware; and database logging happens to be in the forefront of this fight against insider attacks. Database systems are usually deployed deep inside the company network and thus insiders are usually has the easiest opportunity to attack and compromise them, and then steal (or “extrude” as some would say) the data..."

Read more here if you are a CSI Member. If you are not, the only way to get my paper is to ask me (sorry, copyrighted stuff)

UPDATE: another similar paper by me is posted here.

UPDATE2: full paper mention above is posted, finally! Enjoy my "Introduction to Database Log Management" at InfosecWriters!

So WHAT Is He Doing Right?!

From "The 50 Most Important People on the Web":

"43. Mikko H. HypponenDirector of antivirus research, F-Secure

F-Secure's security news blog, written by director of antivirus research Mikko H. Hypponen, is one of the Internet's go-to places for learning about the latest security threats."


Yes, I do get that Bruce Schneier is on the list (how can he NOT be?), but this puzzles me to no end. Well, I have much to learn about personal marketing, it seems...

On Temptation ...

Every time I see stuff like this (Lynn vs Cisco or Paget vs HID), I can't help but think this: every "whitehat" guy at least knows someone who knows a "blackhat" guy (I am guessing here, but you get the point ... if you think that the above is too extreme replace with "knows someone who knows someone who knows a "blackhat")

Don't companies that try to suppress security research understand that if you do this to a security researcher, even the most ethical guy in the world will be tempted to JUST LEAK IT.

If you corner a rat, it bites. Don't corner security researchers :-) they have bigger teeth... much bigger. You want to suppress the legitimate security research? You think you just did? Go suppress the entire underground now!

On " Encryption Mistakes, Masterpiece by Chuvakin"

I so totally like it when people call what I wrote "a masterpiece."