Impossible Dream

More details are coming out about the Google/China hacking incident. There’s even talk of how resistance is futile

Dave Aitel from Immunity, who is one the top guys out there on the offensive side, has been making this point for a while. Given a modern penetration toolkit (Canvas for the flush, Metasploit for the cheap), breaking into nearly any organisation is possible. Given more resource, pretty much anything softer than GCHQ/NSA is a target. It’s just a matter of time, effort and economics. How many person-days is it worth the attacker spending on breaking in?

For the defender, things are muddied even further by the issue of unpatched bugs, or zero-days. How do you defend against an attack for which no patch, anti-virus signature or IPS rule exists? To quote Dave again:

Everyone says an attack is “sophisticated” whenever any 0day is involved. But that should be the baseline. Or rather, it IS the baseline and everyone seems to just be finding out

Universities maybe can be less worried by this than most, but not for good reasons. Attackers use their resources wisely: there’s no need to use an expensively developed zero-day Internet Explorer exploit when there’s an unpatched copy of WordPress running on the user webserver and no DMZ.

For most people and organistations this is somewhere between unpalatable and unacceptable. It’s saying that even if we keep all our systems patched and make sure every PHP app anywhere on the network is secure we’ll still be 0wn3d. And the reality is that most Universities (especially the older ones) are so devolved that even getting everything patched is a Sisyphean task.

So if a senior manager asks “What is the point of employing these InfoSec staff if we are going to be broken into anyway” it’d be best to have a good response ready. That’s something we’ll return to in a future post (along with a post on the mechanics of how targetted attacks work)

Not security related particularly, but I’ve just read two interesting articles over at High Scalability.

First up there’s an article entitled MySQL and Memcached, the end of an era (for those of us who work in more “enterprise” shops this raises a wry smile because in this world MySQL is still regarded as daring technology, never mind memcached). Secondly there’s the classic How I learned to stop worrying and love using lots of disk space to scale, which is the best introduction I’ve read so far to the NoSQL model

Following on from yesterday’s discussion of passsword stealing, we have the recent report on the News of the World by the House of Commons Culture, Media and Sport select committee on hacking at the News of the World.

The general aspects of the case are covered elsewhere (and may well be dug up again by a judicial  review it seems), but I’d thought I’d add two comments.

Firstly it shows, again, the uselessness of passwords as a means for protecting sensitive information. Exactly how this “hack” occurred isn’t public, but I’ll put hard up hard cash that it was a social attack and not a technical one. Over on At The Sauce there’s a description how one journalist believes his voicemail was accessed and it seems very plausible. As ever, the simplest solution to obtaining a password is to just ring up the provider and ask for it.

Secondly, the MPs are quoted as being “surprised” that this action wasn’t illegal. It’s always seemed strange that accessing an already read email, or already listened to voicemail, isn’t interception. Hopefully that will change as a result of this. Gaining access by technical means (like the  Prince Phillip Prestel hackers, or the Paris Hilton case) leads to a charge under the Computer Misuse Act, but that doesn’t apply to these attacks.

Yates told the committee it was hard to get convictions for accessing others’ voicemails under the Regulation of Investigatory Powers Act. The committee recommended that the law be amended to cover all hacking of messages. (Source)