Category Archives: Security

Posted on
by

Today is The day we fight back.

“The day we fight back” is a international day of activism, held on the anniversary of Aaron Swartz‘s death. Swartz was an American computer programmer, writer and political activist who was driven to suicide by bullying from the US government, after he attempted to make public a number of scientific journals (the copyright wars now have a body count, read more, it’s horrific.)

On this day we commemorate Swartz’s death by holding an international day of protest against the illegal mass surveillance programs, conducted by the NSA and GCHQ (as well as others), that are used to invade the private lives of everyone on the planet, as revealed by whistle blower Edward Snowden.

The NSA and GCHQ, among other things, have attempted to subvert the technologies that we all use – to keep our medical records safe, to communicate in private about sensitive matters, to shop and bank securely online. In short, they have conspired (and succeeded) in making the internet a less safe place for you and your family, so it is fitting that today is also Safer Internet day.

So, today, do something to make the Internet a safe place for you and your family to work and play. Fight back.

Posted on
by

So, we’re on the cusp of 2014, and I was going to write a yearly review of some of the things I’ve done, places I’ve been etc. I might do that later, but right now I thought I’d draw your attention to this absolutely terrifying talk on the scope of the NSA and GCHQ’s surveillance and information warfare capability, by Jacob Applebaum.

It’s fairly long, and somewhat technical, but in short, every paranoid fantasy that we in the IT security world have had, appears to be true, and it gets much much worse…

Militarisation of the Internet

The full capabilities of what has been deployed, in the wild, against ordinary citizens is still coming to light, but here are some highlights, in no particular order:

  • Computer hardware and components have been compromised on mass; including wireless cards, hard drive firmware, Ethernet cables (!!)
  • Your ADSL router can be used to spy on you (natch), but also to perform attacks on those geographically near you, and routinely is.
  • Practically every piece of communication infrastructure has been subverted, which can put lives at risk (for example, the box they use to pretend to be a cell tower and record activity while, say, spying on the Ecuadorian embassy or flying over a city in a drone, doesn’t appear to route 999/112/911 calls).
  • Ordering hardware over the internet? There’s a good chance it has been intercepted and bugged without your knowledge.

The list goes on, seriously, watch the video…

Yes, you are owned

So, some of the capability discussed doesn’t fall under “mass surveillance”. Flying a drone over your house, intercepting your mail, or giving you Cancer so that they can read what’s on your computer screen (and you were worried about the back scatter X-ray at the airport), doesn’t scale. These techniques would likely only be deployed against people of interest – security researches, journalists, democracy advocates, Muslims etc, and then, only if they couldn’t get you another way.

Of course, they almost certainly already have you.

The back doors placed in the computer hardware and software products that every one of us owns need only be switched on, and then they can record your entire life (and keep it for 15 years). Even if you believe that the NSA/GCHQ will never abuse this capability, by accident or design, the documentation presented proves that some of these back doors have been discovered and exploited independently. It is therefore the height of naivety (and I’d go so far to say it’s criminal negligence) to assume that foreign governments, criminals or terrorist organisations won’t be able to use the same exploits to similar effect.

I’m scared, what can I do?

Not a lot at the moment, but the first step to finding a solution is admitting you have a problem.

The fact that many of these exploits could not have been created without the criminal complicity of various US companies is worth noting (it would be good to have a full list), and if you’re in charge of purchasing decisions, it might be worth boycotting these companies. Few things will affect change faster than the market punishing this kind of collaboration.

It’s clear that proprietary software and hardware is a major problem, especially in networking equipment, so the importance of projects like the open router project can not be over stressed. You may also like to consider the surveillance capability of any new hardware you buy, and perhaps you might want to leave your cell phone at home or not buy that internet connected TV?

I also think that detection of these attacks needs to be looked at more closely, and developing new forensic tools for widespread use should be a priority, since raising the risk of detection has a herd immunity/deterrence effect. I think that the fact that the bad guys seem to love RC6 encrypted UDP is interesting, and it is something that we can start actively looking for, and report anything suspicious.

Remember, a secure internet secures everybody, and we as technologists have a moral obligation to do everything we can. This means developing tools and technologies to protect people, and helping our less technical friends and family to use them to protect themselves, and it means building countermeasures against these sorts of attacks into the architectures and platforms we build.

It also means not collaborating with organisations that seek to attack our freedom, saying no to that NSA/GCHQ recruiter, and it means blowing the whistle when you see abuses taking place.

Be safe out there.

Posted on
by

Mod_security is a plugin for the popular Apache web server that lets you block malicious traffic on your web applications based on rules you define. Essentially, it acts as a firewall for web apps, blocking suspicious traffic and malformed requests. It is highly configurable, and comes with a good set of default rules to get you started.

I had need to configure it for a particularly security sensitive client site recently, and while I was at it I thought it’d be cool to fire it up on my personal server. I installed the module, reloaded Apache and began watching the output of the audit log.

Holy Pingback spam Batman!

Pingback, is a way of notifying a site that you’ve written about them in your blog. The receiving blog then usually renders this out as a link in the comments section of the post, allowing visitors to read the expanded discussion.

Watching the mod_security audit log was an eye opener, because I found that my site was being hit by a metric shitload of bogus pingback requests (the order of a couple every minute), all from different sources. None of these messages had made it as far as appearing on my site of course, seemingly they have been blocked by something in WordPress itself (probably Akismet), so I honestly didn’t realise that this was a thing.

ModSecurity was flagging them up because the body of the message was malformed XML, so was kicking them out (legitimate wordpress to wordpress pings were being accepted, at least when I tested it), and closed the connection with a 400 response. In every case the request had similar signatures; it was chunk encoded, it was always linking to a real site (in most cases some poor schmo’s pwned wiki, which didn’t mention the post that was pinging), and the User-Agent was always “PHP/5.2.10”, so we’re clearly dealing with a script kiddy.

One thing I noticed was that, although I was getting pingback spam from multiple sources, each IP would retry every couple of minutes. This meant that my web server was having to spool up to handle each request, even if the spam did not make it through. Negligible in the grand scheme of things, but irritating nonetheless.

Since I am a firm believer in both a strength in depth approach to security, and I like quiet logs, I wrote a fail2ban script to catch these messages. As before, because I’m operating behind a reverse proxy I’m keying off the squid logs (until I can work out how to change mod_security’s log to spit out X-Forwarded-For anyway).

After a couple of hours, this is what my munin graph looked like:

Holy crap.