Spam - It also impacts the environment

McAfee has released The Carbon Footprint of Email Spam Report. The study looks at the global energy expended to create, store, view, and filter spam across 11 countries: Australia, Brazil, Canada, China, France, Germany, India, Mexico, Spain, the United States, and the United Kingdom. The report correlates the electricity spent on spam with its carbon footprint, because fossil fuels are by far the largest source of electricity in the world today. Since emissions cannot be isolated to one country, the study averages its findings to arrive at the global impact. Key findings include:

• The average greenhouse gas (GHG) emission associated with a single spam message is 0.3 grams of CO2. That’s like driving three feet (one meter); but when multiplied by the yearly volume of spam, that amount is equivalent to driving around the earth 1.6 million times.
• Much of the energy consumption associated with spam (nearly 80 percent) comes from users deleting spam and searching for legitimate email (false-positives). Spam filtering accounts for just 16 percent of spam-related energy use.
• Spam filtering saves 135 terawatt hours (TWh) of electricity per year. That is equivalent to taking 13 million cars off the road.
• If every inbox were protected by a state-of-the-art spam filter, organizations and individuals could reduce today’s spam energy by 75 percent or 25 TWh per year, the equivalent of taking 2.3 million cars off the road.
• Countries with greater Internet connectivity and more users, such as the United States and India, tend to have proportionately higher emissions per email user. The United States, for example, had emissions that were 38 times that of Spain.
• While Canada, China, Brazil, India, the United States and the United Kingdom showed similar energy use for spam by country, Australia, Germany, France, Mexico, and Spain came in about 10 percent lower. Spain had the lowest figure, with both the smallest amount of email that was received as spam and the smallest amount of energy use for spam per email user.

Not only is spam related to cybercrime and a nuisance, but it also impacts the environment. Download the study here. It’s worth a read.

How to Protect Your PC from Malware Infection

How to Protect Your PC from Malware Infection

Malware or malicious software is a program or a file which is harmful to your computer.

These programs have the capability to enter your computer system without your knowledge or consent and cause errors leading to system slow down, crashes and loss of data.

In the United States alone, there are over 60 million computer users who are affected by virus, spyware or some kind of malicious software. Almost everyday a new malware is being released into the cyber world making it easier for the online criminals to make attempts to steal financial information, important data or personal identities. Anti-malware tool manufacturers try to keep up with these new malware by constantly releasing updates and advanced antivirus and antispyware programs.

On the other hand, the response to this huge problem by computer owners is usually delayed. Most of the users wake up to the seriousness of the problem when their computer has already started to show signs of infection, like error messages, system slow downs, and frequent freezes and system crashes. Even then, user response is mostly to take care of the immediate problem, rather than to create a robust defense mechanism for their computer. Over 62% of computer owners surveyed have inadequate protection against malware. This essentially means that either they do not have anti-virus and anti-spyware tools or they do not use or update them regularly.

Protecting your System against Malware

It is essential for you to protect your system from all kinds of malicious software programs, such as the d.exe and aspimgr.exe files. When a system is infected, it is quite expensive and time consuming to restore it to its original condition. Furthermore, you stand the chance of losing a large amount of your data, and if your PC is on a network, other connected computers may become affected as well. At times, these programs come disguised as legitimate Windows files, such as iexplore.exe and alg.exe, and this makes it quite difficult to detect and remove these malicious files manually.

It is humanly impossible to make your computer 100% secure, but by taking simple precautions and continuously updating your computer you can reduce your risk considerably.

The first step in protecting your system is to install reliable and advanced Anti-Virus and Anti-Spyware solutions. It is advisable to run anti-virus and anti-spyware scans on a regular basis. You must also update your tools on a regular basis because manufacturers release new definitions almost daily.

You can also make your system more secure by installing a Firewall. A firewall can be a hardware device or a software application that sits between your computer and the Internet. It filters out the information you send and receive on your computer. In other words, the firewall receives and inspects all incoming and outgoing data. The tool allows you to choose program access permissions on your computer, which to a large extent prevents malware infiltration and unauthorized access to your system.

It is also highly advisable to regularly update your Windows software on a regular basis by using the Windows Update feature, live update features of third-party software, and a reliable driver scanner tool. You must also scan your registry on a regular basis to ensure that no malware data stays within it. You can do this easily and efficiently by using a reliable registry cleaner tool.

Windows Defrag Shows It All !!

I am sure you must have seen this 'ACCESS DENIED' screen if you try and enter the protected 'System Volume Information' folder on your Hard Drive.












Any idea what is there inside the 'System Volume Information' folder there? Well, windows indeed stores a lot of information that is required to be protected there and all the windows restore points are also present in this folder.

Now, security doesn't seem to have covered at all the places in windows. What happens is the path inside System Volume Information is protected by a folder structure which is not easy to guess.

The flaw lies in Windows Defragmentation.



















Windows Defragmentation does not hide the fragmented files present in System Volume Information folder. If the folder structure is revealed here, you get access to lot more sensitive information. This includes windows registry, SAM files, etc.

































So, if I save this report and view the actual path inside the System Volume Information,





I use this path to get inside System Volume Information folder using explorer and I now have the access to "protected" files like SAM file and lots of other information.

Virtualization : Is it Secure?

Virtual machines are often used by security researchers to sandbox malware samples for analysis, or to protect a machine from a potentially hazardous activity. The theory is that any security threat or malicious behaviour will be restricted to the virtual environment which can be discarded and then restored to pristine condition after use.

Virtual machines are sometimes thought of as impenetrable barriers between the guest and host, but in reality they're (usually) just another layer of software between you and the attacker. As with any complex application, it would be naive to think such a large codebase could be written without some serious bugs creeping in. If any of those bugs are exploitable, attackers restricted to the guest could potentially break out onto the host machine.

Tavis Ormandy working with Google Inc., investigated this topic and presented a paper at CanSecWest on a number of ways that an attacker could break out of a virtual machine.

Most of the attacks identified were flaws, such as buffer overflows, in emulated hardware devices. One example of this is missing bounds checking in bitblt routines, which are used for moving rectangular blocks of data around the display. If exploited, by specifying pathological parameters for the operation, this could lead to an attacker compromising the virtual machine process.

While you would typically require root (or equivalent) privileges in the guest to interact with a device at the low level required, device drivers will often offload the parameter checking required onto the hardware, so in theory an unprivileged attacker could be able to access flaws like this by simply interacting with the regular API or system call interface provided by the guest operating system.

Is Software Security Testing Complicated?

Testing software for Security is something that can be quite complicated to do. Those that do test software are also those that have taken classes and know just what it is that they are doing.

If you are all into software, and are very familiar with it, as well as interested in testing it yourself, you are going to want to check out the software testing course that is held closest to you.
Many companies hire a 3rd party to give their employees a security testing course or build an in house team for providing this as a special service to teams across the organization.

I somehow believe that Security testing is something that comes a little easier to someone that understands or has written a software program before. If you have ever written a software application and are looking to get into testing, you are going to find that learning what you need to know to test will be easier for you than someone else.

Data Validation for App Security

Oracle Default Passwords

Hi,

Beware of database Default Accounts before you ship your database to production.
I saw this screen while installing Oracle. I think this kind of screen should be shown in all database tools and also there should be a warning mentioning the harm of keeping the default accounts ON in the database.

For now, enjoy this screen... :)

App Security Testing Cheat Sheet

Hi,

I thought to prepare a brief cheat sheet for Application Security Testing.

Please have a look and drop in your views. In case you wish to use it for your testing, please drop me a mail at dharmeshmm at gmail dot com to notify me about it.

Authentication Checks

1. Login and Change Password pages on SSL?
2. All sensitive pages (accepting SSN, Credit Card) over SSL?
3. Strong Password Policy? (Joe Accounts/Blank Passwords/Max Password Age/Min Password Age, etc)
4. Is Forgot Password page secure?
5. Password Change forced on 1st login?
6. Re-authenticate before moving to sensitive pages (Edit Account Info?)
7. Prompts old password before changing password?
8. Has "Remember Me" feature? If so, how's password stored?
9. Warns before allowing "Remember Me"?
10. Has CAPTCHA to prevent password guessing?
11. Does show error msgs like "Invalid User/Invalid Password"?
12. Can auth. be by-passed for priviledged URL's?
13. Is AutoComplete set to OFF?
14. Is password re-submitted on 'Back/Refresh' of browser?
15. SQL Injection in login?

Session Management

1. Is session id random enough?
2. Session Timeout present?
3. Stored in what form? (persistent cookie/in-memory cookie)?
4. Session Id expires on request tampering?
5. Sensitive data in cookie?
6. Can you see X user's data with Y's session id?
7. Session expires at server-side on logout?
8. Can logged out user's session be re-used?
9. Is new session id generated on login?
10. Is cookie over-written on logout?

SQL Injection Checks

1. SQL Injection : '
2. SQL Injection : ' OR 1=1 --
3. SQL Injection : '; waitfor delay'00:00:05'--

XSS Checks

1. XSS Javascript
2. XSS Encoded
3. XSS Cookie
4. Is CSRF possible?

Input Validation Checks

1. Use proxy to by-pass client side validation?
2. Generate errors for information disclosure?
3. Web Page source reveals sensitive application information
4. HTTP Headers manipulation
5. Viewstate manipulation
6. GET and POST parameter manipulation

Secure Storage Checks

1. Are passwords stored in clear text?
2. Is sensitive information like Credit Card encrypted?
3. What encryption algo used? Standard or Proprietary?
4. Is connection string in clear text?
5. Any passwords hard-coded in application?

Browser Checks
1. Check browser history? Are sensitive pages cached?
2. Is data cached by search engines or desktop search engine?
3. Any hard-coded secrets in javascripts?
4. Web Page code reveals sensitive comments?

File Checks

1. Is file upload /download allowed?
2. Can files be downloaded directly from URL?
3. Can malicious files be uploaded?


Environment Checks

1. Are default apps installed?
2. Are default accounts enabled? Do they have strong passwords?
3. Is firewall deployed?
4. Is code obfuscated?
5. Can detect server details using banner grabbing?
6. Are forms bot resistant?

In case you have your views, please feel free to write here or mail me at dharmeshmm at gmail dot com

Cheers,
Dharmesh.

You can be arrested for using free Wi-Fi

A Michigan man has been arrested and will be prosecuted for using a cafe’s free Wi-Fi network from his car without buying anything.

According to reports, Sam Peterson says he didn’t realize he did anything illegal until he was cuffed (nor did the cafe owner or even the police officer).

Prosecutors believe him, so they’re letting him off easy with a $400.00 USD fine and 40 hours of community service.

So let me get this straight - $400.00 and 40 hours of community service is considered being let off easy?

Apparently under Michigan’s “Fraudulent access to computers, computer systems, and computer networks” law, Peterson’s actions could result in a five-year felony and a $10,000 fine, so I guess the answer is yes.

If the prosecutor and the cop believe him, they should just let the guy walk completely.

Moral of the story… if you plan on using the “free wireless internet” at your local Cafe Coffee Day, Cross Word Store or other favorite hangout, be sure to buy something before hand.

Big B Watching or Is this Intrusion of Privacy?

I ain't talking about Big B - Amitabh Bachhan here....
This is about Big Brother - our own police force.

I read an article in Hindustan Times (April 30th, 2007). In first-of-its-kind intitative to tackle cyber-crime, the Nashik police is keeping an electronic eye on cyber cafe users. They aim to maintain real-time photo record of users at cyber cafes and the times spent surfing. This is all done using a software called Webcafe.

Hence if a user goes to a cyber cafe, his photo, name, address and identity proof gets recorded into the main server which would be connected to a central server located at police head quarters. So everytime a user logs on to a computer the details would be automatically transeferred to the police servers. I saw similar kind of photograph based logs in Hyderabad when I was touring. Now with these kind of systems coming in place, we would hope that cyber crimes would reduce atleast from cyber cafes as point of origin. I am still not seeing such measures from cyber crime cell in Mumbai though.

Let's see the other side of story. How many of us like to be photographed everytime you go to a cyber cafe? What is the guarantee that the cafe owners will not misuse the photographed data? Indian Penal Code asks cafe owners to keep a manual record of every user. I think this is really intrusion of one's privacy. If we see the real world attackers - the so called smart hackers will be doing away with all these measures either by using multiple proxy servers or spoofing IP addresses to cover their tracks. They have thousands of ways to find a victim for attack.

I do not say that we should not do anything. But should the measures be at cost of a general user's privacy? Do the police now storing these information now guarantee the safety of our data same way as our banks do for online transactions. Also one needs to wonder how secure are the central servers at police station. It surely has such large amount of personal data now. Are the softwares and servers tested for security before they store such data?

I think everybody should think about this. Feel free to share your comments here. You can mail me at dharmeshmm at gmail dot com

Thanks,

Dharmesh.

Security Concerns in Web 2.0

Hi,

I did get a chance to submit a paper on security concerns in Web 2.0
This paper has been published by OWASP now and is available at link below:

PDF version:
http://www.owasp.org/index.php/Category:OWASP_Papers

HTML version:
http://www.owasp.org/index.php/OWASP_Papers/Jeopardy_in_Web_2_0

Happy reading !!!
Please feel free to drop in your comments about the paper.
You can mail me at dharmeshmm_at_gmail_com

Wregs,
Dharmesh M Mehta
Mastek Ltd.

Security among The Hottest Skills for 2007

With fewer openings this year, expect these five premium skills to win the jobs

Top skills IT executives say they will hire for in 2007:

1. Programming/application development
2. Project management
3. IT/business analysis
4. Security
5. Help desk/technical support

Source: Computerworld's quarterly Vital Signs survey

Web Services Design Security Considerations

Web Services Design Security Considerations

I. Information Gathering

1. WSDL Retrieval: Identify web method call mechanics
2. SOAP Error Messages
3. Web Method Enumeration: Identify methods not published in the WSDL.

II. Parameter Manipulation

1. Identify mishandling of numerical fields, character strings, Base64 data handling, etc.
2. Identify SQL Injection/XPATH Injection Vulnerabilities
3. XML input data is validated based on an agreed schema.
4. If parameter manipulation is a concern (particularly where messages are routed through multiple intermediary nodes across multiple network links). Messages are digitally signed to ensure that they cannot be tampered with.
5. Determine whether the logging mechanism is vulnerable to arbitrary entry creation via carriage return and line feed injection.
6. Assess the possibility of inserting HTML tags into a HTML based log.
7. Assess the possibility of inserting XML elements and/or attributes into an XML based log.
8. Determine the logging mechanism’s susceptibility to white space injection.
9. Assess the ability of the web service to log messages that contain special separator characters.
10. Assess the handling of log data after reaching the upper log size limit.
11. Assess the web service’s susceptibility to LDAP injection.

III. Authentication and Authorization

1. Web services that support restricted operations or provide sensitive data require and support authentication.
2. Where appropriate, access to publicly accessible Web methods is restricted using declarative principle permission demands.

IV. Sensitive Data

1. Sensitive data in Web service SOAP messages is encrypted using XML encryption OR messages are only passed over encrypted communication channels (for example, using SSL.)
2. Identify the encryption cipher used in the application.
3. Determine the items within web service communications that are encrypted.
4. Determine the items within web service communications that are protected by message integrity checks.

V. Exception Handling

1. SOAP Exceptions are thrown and returned to the client using the standard SOAP element.
2. If application-level exception handling is required a custom SOAP extension is used.

VI. Auditing & Logging

1. The Web service logs transactions and key operations.

VII. Proxy Considerations

1. The URL Behavior property of the Web reference is set to dynamic for added flexibility.
2. The endpoint address in Web Services Description Language (WSDL) is checked for validity.

VIII. Configuration

1. Unnecessary Web service protocols, including HTTP GET and HTTP POST, are disabled.
2. The Web service runs using a least-privileged process account.
3. Debugging and Tracing are disabled.
4. Identify directory traversal vulnerabilities.
5. Assess the level of information disclosure from temporary files.

Design Considerations for Security

1. Do not trust on Client-User Input. Security decisions should not rely on client-side validations; they are made on the server side

2. Identify application to fail gracefully. An approach to exception management should be such that does not reveal any internal software information.

3. Partition the application into public accessible and restricted areas. Isolate higher privileged sections of the application.

4. Granular authorization check for pages and directories.

5. Web controls, user controls, and resource access code are all partitioned in their own assemblies for granular security

6. Mechanisms have been identified to secure credentials, authentication tickets, and other sensitive information over network and in persistent stores

Perspective of Performance and Security in IT

Performance and security are like brothers in IT. They are similar and yet they fight each other at times.

Both performance and security are important inherent qualities in IT systems. Who would not want a fast and secured IT system? You want your home computer to be fast and secured. The bank CEO wants his Internet banking system to be fast and secured for his customers.

This was a very nice article on ACE Team Blog. If you wish to read more...

Here it is: http://blogs.msdn.com/ace_team/archive/2006/07/03/655524.aspx

The Oracle Global Product Security Blog

Have you ever seen this?

The Oracle Global Product Security Blog

Oracle getting committed on security by providing rating to vulnerabilities at the security blog...:)

Security researchers have criticized Oracle in the past for the time the company has taken to fix vulnerabilities.

In July 2005, security experts at Red Database Security outed six flaws, claiming that the company had more than 650 days to fix the security issues.

Peter Finnigan, who first noted the change in policy has provided a great list of tools for auditing and testing oracle databases. If you get a chance, do visit his site at :
http://www.petefinnigan.com

Developing More-Secure Microsoft® ASP.NET 2.0 Applications Now Available

A new book in the Secure Software Development Series, this time from Dominick Baier is now available from Microsoft Press.

It covers ASP.NET 2.0 security features as well as security defenses and design and coding best practices. There’s also a chapter on the not-so-well-understood aspect of building and deploying least-privilege and partial trust ASP.NET 2.0 applications. This is a must-read chapter for Web site hosters.

You can get more info about the book here.

Spoofing threats are usually associated with a wily hacker being able to impersonate a valid system user or resource to get access to the system and thereby compromise system security.

Tampering with data involves the malicious modification of system or user data with or without detection.

Repudiation threats are associated with users—malicious or otherwise—who can deny performing an action without administrators having any way to prove otherwise. An example of a reputability threat is a user performing an illegal operation in a system that lacks the ability to trace such operations.

Information disclosure threats involve the compromising of private or business-critical information through the exposure of that information to individuals who are not supposed to see it.

Denial of service (DoS) threats when carried out deny service to valid users—for example, by making the system temporarily unavailable or unusable or by forcing a reboot or restart of the user’s machine.

Elevation of privilege: In this type of threat, an unprivileged user gains privileged access and thereby has sufficient access to compromise or destroy the entire system.

Attacks against IIS

IIS is one of the most widely used Web server platforms on the Internet.
Microsoft's Web Server has been the frequent target over the years.
It has been attacked by various vulnerabilities.

Examples include:

• ::$DATA vulnerability
• showcode.asp vulnerability
• Piggy backing vulnerability
• Privilege command execution
• Buffer Overflow exploits (IIShack.exe)

IIS Components

• IIS relies heavily on a collection of DLLs that work together with the main server process, inetinfo.exe, to provide various capabilities.
• Example: Server side scripting, Content Indexing, Web Based printing etc.
• This architecture provides attackers with different functionality to exploit via malicious input.

ISAPI DLL Buffer Overflows

• One of the most extreme security vulnerabilities associated with ISAPI DLLs is the buffer overflow.
• In 2001, IIS servers were ravaged by versions of the Code Red and Nimda worms which were both based on buffer overflow exploits.

Download everything from Microsoft without WGA Check

When you want to download a file from Microsoft a WGA (windows genuine advantage) check is performed. Microsoft installs a small piece of software on your computer that contacts the Microsoft server and checks for validity. If the test fails you will not be able to download the file(s). The following method gives you the ability to download every file from Microsoft without a WGA check.

All you need is the tool mgadiag.exe and the download url of the file that you want to download. Mgadiag.exe is the Microsoft Genuine Advantage Diagnostic Tool. Start this tool and check the value of the “Download Center Code”, this should be seven chars consisting of upper case letters and numbers. Remember that code and open the website of the file that you want to download.

A download page looks similar to this one for Internet Explorer 7. All you need to do is append the following value to the url and you will be able to download the file without a WGA check.

&Hash=”download center code”

Replace the “download center code” with the code that you looked up in the mgadiag.exe tool. This code changes frequently, make sure you have the correct code before starting the downloads.

To sum it up:

1. download mgadiag.exe
2. start mgadiag.exe and look at the download center code
3. visit a download page at microsoft.com
4. append &Hash=”download center code” to the url (example &Hash=6VJPCR9), no quotation marks needed
5. Hit enter

Microsoft is probably going to fix this soon, it is working nevertheless at the moment.