A pretty good article about the upcoming LinuxWorld/OpenSolutions World Conference and expo came out in the online magazine Network World today. I was even quoted in it at the bottom of the second page. It was an interesting interview, and I believe I rambled on for way too long, but they managed to get my main point, that is, Security is about finding the right compromises, and there are good tools now and in the near future to help us get there.

Now there is one small issue, and I’m posting this as a correction. I am not currently working on development of SELinux technology. I am working on some policy stuff, but I am not active in the community development of the technology currently. I have worked on it in the recent past, and plan to continue in the near future (though I am thinking of helping out indirectly via SEDarwin). I just wanted to make that clear. I support SELinux, I’m trying to help promote and improve SELinux, but I’m not a core developer of the technology. There are others such as the NSA, Trusted Computer Solutions, IBM, Tresys Technology and several other groups and companies that are putting in the hard work to make this technology a reality in the production world.

Here is the article for those interested.

Interesting article, and I would love to see this presentation at the BlackHat conference. Jon Ellch and David Myanor will be showing off how they can hijack a MacBook laptop in about 60 seconds using vulnerabilities in the wireless card driver. There are a couple of things that make this interesting:

1. All that has to happen is that your wireless card be turned on. You don’t have to be connected to a network. If you wireless card is on, you are a target, period.

2. In theory, there is nothing to say that BlueTooth is safe from this either. I would imagine that similer vulnerabilities could be found in Bluetooth drivers as well.

3. This is not Mac OS specific! Though they used a Mac for the demo, they have also discovered vulnerabilities in Windows. And I see no reason that it couldn’t affect Linux/*BSD as well.

4. Firewalls and anti-virus programs won’t and can’t protect you from this. This is a much lower level attack and will always bypass this. The only way to protect against it is either through better device driver security or not using wireless. SELinux/SEBSD/SEDarwin may help this somewhat, but again drivers are usually in the OS kernel and once you’re in the kernel it’s hard to stop attacks. I’ll have to look into the SE* solutions and see if they might be used to help mitigate this attack (though I’m doubtful).

Currently, there isn’t much you can do to protect yourself. Just turn off wireless when you don’t need it. Apple’s patches just came out, but there was no mention of a fix for this. The researchers are talking to Apple, Microsoft, and others to get this fixed. Also, they are not showing how they did it, just that they did it, so no current “in the wild” exploits are known of at this point.

Ok, I recently have been given the opportunity to play around with a new MacBook Pro 15″ laptop (Mac OS X 10.4 – Tiger). So far I’m impressed, clean easy to use user interface with a nice Unix/BSD system underneath. In the process of getting it set up, I did go through and take care of some security issues to make sure I was happy. Some of these are obvious, some less so:

I. Click on the Apple Icon on the top left and select System Preferences

1. Click on Security
a. Set a master Password, and don’t forget it, this is used to recover lost accounts and such.
b. Turn on FileVault, this is a great security item, but will slow down your computer and could make crash recovery harder. I haven’t done this one yet.
c. Check require password to wake computer.
d. Check Disable Auto Login, don’t make it easier for someone who steals your laptop, it can happen.
e. Check Require password to unlock secure system preferences, this will help against trojans and such that could attack MacOSx.
f. Check user secure virtual memory, this is mostly for a multiple user system. I haven’t done this yet myself.
g. Check disable remote control infrared receiver, less critical, but if you aren’t using, why enable it?

2. Click on Bluetooth
a. Disable Discoverable, you don’t need to advertise that you are a possible hacking target. Most bluetooth devices you use don’t require your desktop to be discoverable. Only when you are trying to send files and such to the desktop for the first time with a device does this need to be enabled. After a pairing trust is setup you don’t need this enabled again for that device.

3. Click on Network
a. Select Airport and then options, then check Require admin password for Computer-to-Computer networks. There have been attacks in the past where machines (in that case, Windows) were able to create a computer-to-computer network while sitting in the airport without the need for the users’ intervention. It’s best to set this option just to make sure it doesn’t happen without your express consent.

4. Click on Sharing
a. Turn on “Remote Login” this turns on the ssh daemon so you can ssh into your box like you normally do with linux.
b. Choose Firewall and turn it on. By default, it seems MacOSX doesn’t turn on its firewall. I personally prefer to have it up and running. You can then enable different remote services though the firewall below that. I enabled Remote Login – SSH, iChat, and Network time.
c. Under Firewall Advanced, enable Block UDP Traffic and Stealth Mode. So far, neither of these have blocked traffic such as iChat Video/Sound or anything else, so better to block unwanted traffic.

5. Click on Startup Disk
a. Make sure that the lock icon on the bottom is selected. Unless you are reinstalling your base OS, no reason to have this easily changed.

Those are the preference you can change via gui. Here are some to change via command line Terminal:

II. Start Terminal, you can find this by clicking on the search tool (magnifying glass in the top right corner) and using the term terminal.


1. Set a root password. There is a root user on MacOSX, and by default it’s disabled from normal use. But I’m paranoid, so unless I know the root password I don’t like it. You can set it by using the command “sudo passwd root” which will then ask you for the new root password. You may want to set this to the same as the masterpassword. I’m not positive, but they may be linked, I haven’t researched it that far yet. Warning, this will enable the root user account. I still prefer having the password set to something I know vs being blank and disabled. Consider this optional and your preference.

2. If you’re using SSHD for remote login, make it more secure. Using “sudo vi /etc/sshd_config” set “Protocol 2″, “PermitRootLogin no”, and “AllowUsers username” to your “username” for your main account if you only want that account to ever be able to SSH into your Mac. This is very important if you enable the root account like I did in step 1.

3. Double check the sudoers file. By default, it’s set up pretty well, only root and admin users can use sudo (which means do anything as admin/root all powerful user). You might want to double check it to make sure “sudo vi /etc/sudoers”.

4. Change your users directory permission. By default, your new users directory is readable by any user on your computer. Though there may not be another user on your computer, it’s best to change that to only be accessible by you. In the terminal you could type in “cd ..” which will put you in the /Users folder. Type ls -l will give you a list of users, most likely just a Shared and your username. Then issue the command “chmod 750 username” username being your actual username. This will give you full control over your directory, but no other users besides root has access full access and admin users have read access. I would go with chmod 700 to block other admin users, but I don’t know about Mac OSX enough and what other system level problems that might cause with software daemons running.

Well that’s what I found, if you know something I missed, or a mistake I made please let me know. So far I haven’t found anything impaired by these settings for normal day-to-day use, but I’m only starting to play with Mac OS X.

Well, Microsoft patch tuesday has delivered a whole host of critical security patches to MS Windows, Office, Explorer, and others. Several of these are actively exploited and can lead to some stranger in a far away land running whatever software they want on your computer.

So go get your updates now.

Here is some more information, and there is a patch for MS Powerpoint on Mac as well:

http://www.theregister.co.uk/2006/06/14/ms_june_patch_tuesday/

http://www.microsoft.com/technet/security/bulletin/ms06-jun.mspx

http://www.us-cert.gov/cas/techalerts/TA06-164A.html

Well, more security bugs in the Mozilla, FireFox, Thunderbird batch of programs. There are about 5 bugs that could allow an evil website to run a program on your computer with your user permissions. Not actively exploited at the moment, but better to update now.

More information here.

Ok first good story I’ve heard about spammers, though it’s not all good news. Apparently there are some card scammers that use stolen credit card numbers to buy goods and get paid by spammers and then run with the goods and the cash to let the spammers deal with the chargebacks and indentity fraud investigations. 🙂  So, it’s good in that it cost spammers money and makes their lives harder, bad in that it’s at the price and annoyance of people who have had their credit cards numbers stolen.

You can read more about it here:

Carders scam spammers – The Register

or here:

How Many Spams Can a Scammer Scam If a Spammer Can Scam Spams? – The Washington Post

Ok, two nasty little vulnerabilities people should be aware of have popped up.

First, late last week, a security hole in MS Word was revealed and a corresponding trojan virus that takes advantage of it.  More information can be found here:

http://www.kb.cert.org/vuls/id/446012

http://www.theregister.co.uk/2006/05/22/trojan_exploit_word_vuln/

There is no patch yet from Microsoft, so follow best practices, don’t open documents/files you weren’t expecting to recieve from people.

Second there is a trojan worm going around that likes to attack yahoo instant messenger users.  It will send a link to a website to your IM contacts encouraging them to download and install a “Safety Browser”.  Of course there is nothing safe about it.  More information here:

http://www.theregister.co.uk/2006/05/22/safety_browser_im_worm/

Again, don’t click on links you aren’t 100% sure of, even when they look like they’ve come from a friend.

Here is a very good article about Security researchers going to jail for doing the right thing. They find a flaw in some instituition/company website, one that exposes valuable or personal information, and they do the good deed and tell the instituition/company about the flaw allowing them to fix it (which most likely they would never have found on their own until some bad guy came in and stole all the information and banckrupted them and their customers/clients). So how do they say thanks to the good guy? They take him to court and sue him for computer intrusion. This is so very backward thinking, and shows how badly they DONT understand security. If I found out a business did this I would not want to be associated with them or in any kind of financial/priviledged relationship with them. They are destined to fail and leak out my information to the real bad guys cause they don’t take security seriously, they are only concerned with their image (which apparently they don’t protect very well either).

Anyway, it’s a good read, and hopefully instituition will learn that they want these researchers on their side, not against them, or worse, out of the picture completely (which affects all of us).

Breach case could curtail web flaw finders

Time to run the update cycle. Some fairly significant security holes were found in most all of the Mozilla Foundations products. These security holes could allow someone to run any program they want on your computer as the user you are logged in as. Please go upgrade/update now.

More information here.

Well, I’m getting ready for LinuxWorld/OpenSolutionsWorld next week. Not to much to do, most things I’m responsible for, I’ve taken care of. Looking forward to it. I hope people enjoy the Security Track I’ve put together. Guess I’ll know soon.

In related news, I’ve been asked back to do be on the Program Committee for San Francisco as well! I’ll also be doing the Security Track again, hopefully I can make it even better.

Going to be fun!

« Previous PageNext Page »

Copyright © 2015 · All Rights Reserved · Cafaro's Ramblings