Selected security news

Pros losing confidence in hard tokens

2011-12-13T10:07:00.001+02:00

I was always a proponent of hardware security devices due to their hard to copy or steal undetected nature. The human factor, though, seems to play the biggest role in this form of authentication as well, and here's why:

Pros losing confidence in hard tokens

I should notice that hardware token such as OTP generator is no security by itself. Such devices must be password- or PIN-protected, so that if the device is lost, it becomes useless. PKCS#11 devices (USB cryptotokens and cryptocards) include such protection on board, and probably this is why they are not mentioned in this articles. Simple access control devices such as pass cards, don't have sufficient protection though. And this can lead to lowered confidence in all types of devices, including strongly protected ones

Possible alternative to CA hierarchy

2011-10-13T15:24:00.003+03:00

Convergence. If you didn't hear about it before, don't worry - so did(n't) we. This is a new invention presented on a conference just a couple of months ago. It aims to make MITM (man-in-the-middle) attacks, which are necessary to make use of the fake SSL certificate, useless. How does it do this?

MITM attack is local, i.e. it can affect usually a limited number of clients. Other clients (in other areas of the world) are not affected. So if our client calls other clients (called notaries here) and asks "do you see what I see?" (i.e. do you get the same certificate from that site), it ensures that the certificate is authentic OR it detects MITM attack. Of course, there exist some technical complexities here, but they are just minor details.

Convergence is a good case of proper use of peer-to-peer technologies, which makes complex (and expensive) CAs completely unnecessary.

The only question left is "who will guard the guards". If MITM can fake server's certificate, how do you ensure that notary's response to your request has not been forged? MITM attacker will quickly pay attention to forging notaries' certificates as well and producing valid response. So the large number of notaries is required, with possibility to switch them on the fly for each new request which needs validating.

Read more details about Convergence on Convergence homepage

Javascript Cryptography Considered Harmful

2011-08-31T08:46:00.000+03:00

The article discusses why implementing any cryptography in JavaScript gives no security and, what's even worse, gives a feeling of false security.

Hackers acquire Google certificate, could hijack Gmail accounts

2011-08-31T08:37:00.002+03:00

The conceptual problem is that PKI stands on the trust to companies that issue certificates (CA). When there were few CAs and they did their job, everything was fine. As the number of certificates issued increased, CAs started to outsource their work to resellers and lower their cost by automating certificate issuance. So now this kind of problems will happen again and again.

Read the story and today's official statement (which proves my words -- if the computer issuing the certificates would not be connected to network, the trouble would not happen).

"Apache Killer" tool spotted in the wild

2011-08-25T18:17:00.000+03:00

Yipe! While DoS attacks hardly have a 100% working remedy, weakness to some special kind of attack means that another generation of script kiddies to put servers down just for fun.

"Apache Killer" tool spotted in the wild

Trojanized Android app intercepts messages to hide costly subscriptions

2011-08-19T18:56:00.000+03:00

Trojanized Android app intercepts messages to hide costly subscriptions

Now that is nasty. Note, however, that the user must install the trojan first, and users who don't pay attention to permissions requested by the installed application, probably deserve some lessons.

What really breaks SSL?

2011-08-16T21:25:00.001+03:00

An article about how SSL is misused (or not used at all).

The point is that SSL itself is secure, and it's people whose mistakes and misunderstandings make SSL-protected resources vulnerable.

Why Sign & Encrypt operation is weaker than you might thought

2011-06-28T10:47:00.001+03:00

The article discusses the problems that arise from using Sign & Encrypt operation carelessly or from putting too much trust into data, secured this way.

Is MacOS X really secure?

2011-06-25T13:49:00.003+03:00

This technical article discusses in details the topic of how [in]secure MacOS X is. The article includes a number of references to flaws in design and implementation of MacOS X and can serve like a good how-to guide for those who plan attacks on MacOS X.

About TCP protocol flaws

2011-05-29T23:11:00.002+03:00

While not about security itself, this topic is about very related question - performance of internet communication (and performance is closely linked to security).

The article discusses alternatives to TCP and includes description of TCP design as part of the discussion. The flaw of the design is caused by the strategy used by TCP stack when detecting undelivered packets - it reduces transmission rates dramatically and increases them back in small steps. This leads to very uneven delivery rate and ineffective transmission in the end.

"Another issue of current TCP implementations is the fact that the AIMD algorithm constantly pushes network loads into an overflow condition. This occurs because the only feedback that the sender gets from the receiver is about whether or not packets are lost along the way. If packets aren’t lost, then the assumption is that the sending rate can be increased; if packets are lost then the sending rate needs to be decreased. In this situation, senders are constantly ramping up data rates to the point when buffer overflow occurs."

Nikon's signature mechanism broken, vendor ignores the problem

2011-05-02T09:48:00.003+03:00

According to this article, russian company ElcomSoft (well-known for the lawsuit in which Adobe attempted to attack the company for finding weaknesses in Adobe's DRM) managed to extract the private key from DSLR cameras, produced by Nikon. This allowed the designers to create fake pictures and make them look as real ones by digitally signing these pictures.

Nikon supposedly doesn't react on the problem, ignoring it. Ostrich position of Nikon is bad cause, as much as with ostrich, while protecting the head it leaves the back (and everything below) opened to attacks.

SFTP Net Drive beta is available

2011-05-02T09:16:00.001+03:00

The fist public beta version of free SFTP Net Drive application is available for download and use.

SFTP Net Drive is a free tool that lets you work with remote SFTP server as if it were a local disk. You can copy the files to and from that disk or open them directly (without prior downloading) in any application, modify those files and save them back (again without creating a local copy) to the remote server.

Looking for SFTP component for .NET?

2011-03-08T22:26:00.003+02:00

EldoS Corporation offers the most feature-rich SFTP component for use in .NET, Mono, Silverlight and .NET CF - SFTPBlackbox (SFTP .NET component). Just the list of offered functions takes several pages of text. Add first-grade support and samples in C# and VB.NET to this and you get the offer that is hard to beat.

Return on security investment - article by Bruce Schneier

2008-09-02T18:16:00.003+03:00

Bruce Schneier puts some economic background to expenses on security measures taken by the company, and explains how those security measures should be justified to the top management.

The evolution of the rootkits

2008-09-01T16:54:00.001+03:00

An interesting reading regarding how rootkits for Windows evolved.

7 business advantages of offering data security

2008-05-22T14:23:00.003+03:00

1. Protection of Valuable Information

Valuable information must be protected. Information is one of the most valuable assets of any enterprise, no matter what kind of product you are developing to handle it: a custom software or in-house automation solution. Its protection is a vital part of IT infrastructure. Make your life easier by integrating security into the solution.

2. Keeping Ahead of Competitors

Stay ahead of competition. Be in the first row of software manufacturers, who build their applications with security in mind. Any software is more welcome, when it fits into existing business processes. Adding another level of data protection is always viewed as a benefit, while its lack is a serious disadvantage.

3. Expanding Into New Markets

Adding security to typical applications is a way to expand the business into new markets. For example, adding a security to you LAN communication application may give you an access to government or military market.

4. Caring About Clients

Offering security drives sales. When you offer security in your software as a bonus, your clients will feel that you really care about their well-being.

5. Reduced Costs of Development

Plugging security into your application beforehand reduces development and support time. Sooner or later you will face the necessity to add security features to your solution. The later you do this, the more code you will have to modify. Inadvertent data loss caused by insecure software may cost you significant money and time lost in courts. This will make you think about adding security anyway.

6. Software Interoperability

By adding security you will improve different software systems interoperability. Some developers choose custom data storage and exchange formats, thinking that they are faster to implement. Later it turns into additional expenses, when proper communication with other applications becomes a must. A lot of resources will be spent on changing formats or creation of data converters. Use of standard security enabled data storage formats and data exchange protocols ensures widest possible interoperability.

7. Meeting Current Standards

In order to be reliable and up-to-date, a software needs to follow current standards. One of the widespread and important standard is requirement of software security. In the majority of industries data protection is a must, and your software should follow these standards to be adequate to current demands.

Alternatives/replacements for ReiserFS

2008-04-29T22:01:00.002+03:00

ZDNet has a blog post regarding alternatives to going-to-die ReiserFS . The review mentions several open- and close-source file systems which can be used as the OS' main filesystem.
Why am I mentioning this in the security blog? First of all, file system is a place to hold the data, and modern file system must include security functions built into the core. Our Solid File System with it's built-in encryption and compression features is perfectly suitable for embedded appliances and other custom tasks for which you could be looking for a file system. Next, if you are looking at implementing file system, or you have a task to virtualize access to files across several devices, you will find Callback File System, a component for creation of virtual file systems, indispensable for your tasks.

Buzz and reality about cold boot analysis of computer memory

2008-02-28T19:01:00.002+02:00

I can hardly remember so widespread coverage of any computer security issue, that the recent analysis report has got. From the first glance the attack is very serious. But is it really that serious?

Bruce Schneier has published his review of the question with references to other discussions. This saves me a couple of keyboard clicks that I would have to do in order to explain the problem.

So ... if the bad guy has stolen your notebook, he can get access to the encryption key for whole-disk encryption software. No remedy so far. In fact, there's no remedy for the particular problem, where the parts of the problem are (a) physical access to the device and it's memory, (b) applications that store the keys in memory.

Neither of these parts are key parts. Physical access is not necessary, the rootkit will do the job perfectly. You have much bigger chance to catch a malware, than to be attacked by the thief hunting for your data. The best attack is the one that remains undiscovered by the legitimate user, and stealing the notebook is probably not the best way to hide the attack. And if the thief is that serious about physical actions, then thermorectal cryptoanalysis will work quite efficiently - with a bit of brute human force or other methods of conviction you will tell all the passwords the thief wants to know.

Applications that store the keys in memory are not a problem at all - just don't use them. It's not that hard to not keep the keys in memory unprotected. The vendors already announced that the keys are kept in memory which is not flushed to disk, but this is just a part of the solution. The application can easily use some encryption on the key and decrypt the key for the tiny period of time when this key is used. Decryption would be made to specially allocated memory, whose location is random and changing for each operation. The key for encryption can be derived from the data, specific to the process that does encryption. Such approach will make it much harder if not impossible for the attacker (both thief of the RAM and various malware) to get access to the key itself.

There's one more solution available, but it's too slow nowadays. The solution is to keep the session key in some hardware device, which doesn't give it away. I am talking about my favorite USB tokens and smartcards. The problem with this hardware is that one security operation can take a second or two, making it very slow for use with whole-disk encryption solutions. But I think one needs to try.

Our Solid File System product can be used to create secure virtual disk solutions. We are going to introduce key protection in one of the upcoming builds of SolFS (both Standard and Driver editions). And it is possible to plug the above mentioned harware protection of the key to Solid File System if needed. More detailed information about the above listed techniques can be obtained by contacting me privately.

Strong authentication for OpenID

2008-02-27T11:35:00.002+02:00

I loved this one ...

I really like the hardware cryptograhic devices and I feel that they add very strong security measures to overall protection of the data.

As known, OpenID is used to login on some site that you trust and let other sites that you use (various community places, forums, commercial services) and where you need to login, use that OpenID login. There's a bit of cryptography in OpenID, but not much.

The problem is with the OpenID login itself. Most OpenID providers (the sites which you trust and where you obtain your OpenID login credentials) use username/password approach which is far from being very secure.

TrustBearer offers you to login using your smartcard or USB token. If you don't have one, you can purchase it directly from them (and the price is very moderate, I must say).

Unfortunately my Aladdin eToken is not listed among the supported devices, and it didn't work. However, they have a good choice of supported devices, so if you decide to get one, you can choose from the listed ones. Also, I will test their service with other devices that we have here (by Entrust and Rainbow). I will then update this post.

BTW our company provides support for cryptographic hardware in it's SecureBlackbox product.

Good introduction to digital cryptography in Windows

2008-02-27T11:18:00.003+02:00

Recently there appeared an article on CodeProject, which is a good overview of cryptography basics and cryptography implementation on Windows.

Even when you know the basics, you will find it interesting to review the reference list at the end of the article. It is quite impressive and contains many useful references.

The article can be found here.

State of e-mail authentication

2008-02-02T11:11:00.001+02:00

Authentication And Online Trust Alliance has published a report that reviews current situation of e-mail authentication among large companies and ogranizations. The report says that more than a half of all e-mail is authenticated. What does this mean?

Authentication of the sender is an important step in fight against unauthorized e-mail. Now, when so much e-mail is authenticated, it's vital that the verification takes place on all stages of e-mail processing, and that e-mail is handled properly (this includes acceptance of the valid authenticated e-mail and lowering the weight of other factors when e-mail is authenticated right).

The most widespread authentication mechanisms are Sender ID (formerly SPF) and DKIM (formerly DomainKeys).

The report itself can be found here.

You will find lots of useful information, related to authentication schemes, their supporters etc. in this report.

MIMEBlackbox package of SecureBlackbox includes both signing and verification of DKIM-signed e-mails.

Obsurity in security

2008-01-18T11:06:00.001+02:00

Here's the good article "for dummies" why obscurity is not always bad.

New cool gadget - smartcard with biometrics

2007-12-06T11:54:00.001+02:00

The manufacturer has offered the smart-card which authenticates it's user biometrically (using a fingerprint). This is an additional protection level, which combines "what user has" (smartcard), "what user knows" (PIN) with "what user is" (fingerprint). Quite reliable solution... The only thing I wish this card could do is optionally give away the fingerprint, working as a fingerprint scanner. This particular card doens't do this, but I believe we'll see such cards soon. Read the description of the card.