Malware Drives 4% of PC Sales?

Last week, Rich Cameron, Authentium's COO, pointed me to an article in the latest Consumer Reports magazine.


The article makes an astounding claim, based on internal research - that US consumers and businesses *replace* 1.3m PCs every six months because of viruses and spyware.

"Based on projections from our survey, virus infections prompted 1.8 million households in the survey to replace their PCs in the past two years and spyware infections 850,000 in the past six months." - Consumer Reports, September 2007

Consumer Reports unfortunately didn't take the next step - i.e. determine the economic cost/value of these malware infestations. So let's start by annualizing the numbers:

1.8m / 2 years = 900,000 PCs replaced per year, in the US, because of viruses. 850,000 x 2 = 1.7m PCs replaced per year, in the US, because of spyware. QED: Total PCs replaced each year in the US because of malware: 2.6m.

The total number of PCs sold in 2006 in the US, including desktops, laptops and ultralights, was approximately 66m (IDC), or around 28% of worldwide sales. Assuming Consumer Reports is correct and malware was responsible for 2.6m of those sales, this means approximately 4% of all PCs sold last year in the Unites States were purchased as a result of these infestations.

Which further means that, at roughly seven hundred and fifty dollars per sale (NYT), retailers pulled almost $2bn in additional sales through their cash registers last year - as a direct result of malware.

Now, I'm not sold on the Consumer Reports numbers - they sound high to me - but I am intrigued by the economics. The next time I'm at Circuit City, or Best Buy, you can bet I'm going to ask around and see if there is support for this argument.

Bank of India Site Hacked

Alex Eckelberry and the rest of our friends over at Sunbelt Software have uncovered the latest apparent victim of the MPack toolkit that I have been blogging about the past few weeks. This time, the compromised web site appears to belong to a bank: specifically, the Bank of India.


Sunbelt confirms that the compromised site was, at a minimum, serving up 31 different pieces of malware to the bank's customers (see full list below), via an embedded IFRAME hidden in the bank's landing page.

The Bank of India has confirmed the attack and its US web site is currently displaying an "under maintenance" sign. Sunbelt Software is reporting the attack began last Wednesday evening, but the bank says it is unaware of how long the web site was compromised.

This, and other similarities to attacks on hosting companies in Italy and elsewhere, including the US, point to the Russian Business Network, a criminal group responsible for creating MPack - a PHP-based malware-distribution system that can be designed to look like a legitimate web site administration tool.

Dancho Danchev is reporting that the attackers may have combined MPack with an exploit kit called n404. His analysis of the problem is worth reading and shows that the Fast Flux domain service, javascript obfuscation and multiple IFRAMEs may have been involved - here's an extract:

"At the bank's URL there's a link pointing out to goodtraff.biz (58.65.239.66) where an IFRAME loads to 81.95.144.148/in.cgi?10 whereas while accessing it we get response from 81.95.144.146, where we get the usual javascript obfuscation leading us to 81.95.144.146/at/index.php and 81.95.144.146/rut/index.php."

"Furthermore, the second IFRAME leads us to x-traffic.biz/ts/in.cgi?user0224 (which is a Russian Adult Traffic network) redirecting us to mymoonsite.net/check/version.php?t=167 (81.95.148.13) and a third one loading goodtraff.biz/tds/index.php (empty)."

"What does it mean? It means the Russian Business Network has not just managed to inject its presence on Bank of India's site, but is also using multiple-iframing as an attack vector, thus creating a fast-flux network with multiple campaigns..."

What is an IFRAME? Think of an IFRAME as a transparent "window" inside a web page that can be used to "frame" another web page located either on the same server, or on an entirely different server - in this case, a web page from a server in Russia containing 31 pieces of malware.

How invisible is an IFRAME? The answer is: totally invisible. Creating a transparent IFRAME is beyond easy for even a novice - hackers just need to set the IFRAME parameters such as "height" or "frameborder" to "0" and "background-color=transparent", etc, and customers are never going to see it.

How bad is the malware the bank's hacker web page served up? Really bad. Sunbelt and Panda report that "Pinch", a particularly nasty Trojan designed to steal personal information, was one of the pieces of malware served up to users. Here's the list that Alex posted up yesterday:

Email-Worm.Win32.Agent.l
Rootkit.Win32.Agent.dw
Rootkit.Win32.Agent.ey
Trojan-Downloader.Win32.Agent.cnh
Trojan-Downloader.Win32.Small.ddy
Trojan-Proxy.Win32.Agent.nu
Trojan-Proxy.Win32.Wopla.ag
Trojan.Win32.Agent.awz
Trojan-Proxy.Win32.Xorpix.Fam
Trojan-Downloader.Win32.Agent.ceo
Trojan-Downloader.Win32.Tibs.mt
Trojan-Downloader.Win32.Agent.boy
Trojan-Proxy.Win32.Wopla.ah
Trojan-Proxy.Win32.Wopla.ag
Rootkit.Win32.Agent.ea
Trojan.Pandex
Goldun.Fam
Backdoor.Rustock
Trojan.SpamThru
Trojan.Win32.Agent.alt
Trojan.Srizbi
Trojan.Win32.Agent.awz
Email-Worm.Win32.Agent.q
Trojan-Proxy.Win32.Agent.RRbot
Trojan-Proxy.Win32.Cimuz.G
TSPY_AGENT.AAVG (Trend Micro)
Trojan.Netview

Q. If IFRAMEs can be used to do bad things, then why don't security companies just look for web pages that contain an IFRAME and filter them out?

A. IFRAMEs are a good technology. They are used by millions of legitimate sites. Example: The world's most-trafficked web site - Google - uses IFRAMEs within the popups launched from its homepage. IFRAMEs can be extremely useful in the context of a well-managed, well-designed web site.

Q. How is it possible to infect thousands of web sites at once?

A. Here's a step-wise example of how hosted web sites get affected (my thanks to Robert and Eric and the rest of the Virus Lab team for their presentation on this last week):

Step 1. An over-worked web site administrator with zero budget goes looking for an easy-to-use free admin tool that will help him administer the growing number of web pages and/or sites he is managing/hosting.

Step 2. Searching online, the admin finds, either via Google Ads (yes, hackers buy AdWords too) or a web page, a terrific, full-featured tool that looks professionally-designed.

Step 3. The admin downloads the tool and installs it on his Apache web server, placing it inline with the web pages of his customers.

Step 4. Without the knowledge of the administrator, the toolkit begins surreptitiously inserting an IFRAME into every web page located on that server.

Step 5. An end user surfs to the web site of a trusted brand using a PC that has not be recently patched. Unfortunately, the landing page of the site now contains an IFRAME that points to an entirely different web server, and as the page loads, the invisible IFRAME, and the associated malware, loads with it.

Step 6. The user, his unpatched PC now 100% "owned", pours another cup of coffee, totally unaware that his personal data is now being migrated from his PC to a database in Russia.

Hosting companies in Italy - and their customers - have been hardest-hit by this fake admin tool approach, because the tool includes some rather clever "features".

For example, let's say a web site manager downloads and uses the MPack tool, then later discovers an IFRAME in the web page it was supposed to be administering - and removes it. The tool is smart enough to recognize this has happened and will surreptitiously replace the removed IFRAME without the administrator knowing.

The disturbing thing about all this is the likelihood that thousands of web site administrators will not read any of these posts, and continue to download MPack-based fake administration tools,
and infect tens of thousands more sites - including online banking and commerce sites.

What can you do to stop this happening? Authentium says:

1. Don't use free web site administration tools from unknown companies
2. Don't use web site hosting companies that use free tools - ask them for an audited list of what they are using, and ask them to include *all* software that touches your web site
3. Maintain up-to-date anti-malware software on *all* of your servers
4. Keep an eye on your web pages and especially on your (hopefully legitimate) IFRAMEs

Scary Monster

The theft of data from Monster.com is generating a significant number of new news headlines about spear-phishing attacks, including several, like this article in USA Today, that quote the investigations done by the team here at Authentium.

Financial gain is the leading motive for all attacks on IT infrastructure, and it has been that way for more than three years. Getting control of Monster's data was just the first step of a larger plan - probably to enable some form of spear-phishing.

Spear-phishing is the term used for targeted phishing against a marketing database as opposed to random emailing to non-aligned end users. The criminals that hack customer databases such as Monster.com's and enable spear-phishing lease access to that database to marketers - let's call them "badvertisers" - on a "name per hour" basis.

This is the same basic economic rationale behind the rise of botnets - networks created from millions of hijacked computers, that are leased out to criminals that pretend to be advertisers or rich widows of third-world presidents.

But whereas botnets may be leased by criminals to criminals for anything from a few cents to a few dollars an hour per user/end point, the value of a single, unified customer database like Monster.com's is potentially far higher.

Like all marketers, "badvertisers" understand that messages from a trusted source - or embedded within a trusted source, such as the Wall Street Journal, or Fox News - have far more value than messages from an untrusted source.

This is why legit advertisers get Rush Limbaugh to read those ads out loud on his radio show - his words are far more trusted by his listeners than those of an anonymous announcer. Which means Rush, the more trusted voice, is worth a multiple of what the anonymous announcer would charge.

How much of a multiple? One useful guess is 4.5x - that's the number Hiawatha Bray at The Boston Globe quoted this morning in one of the better-researched articles on the Monster.com problem..

"A 2005 study at Indiana University found that 72 percent of students obeyed the instructions in phishing messages when they appeared to come from a trusted source, while the compliance rate for untrusted messages was just 16 percent."

The ability to target millions of Monster.com customers exclusively with a message that appears to come from a trusted source (Monster.com), is worth many times - 4.5 times, if you agree with the Indiana University study - what a criminal might pay to lease a botnet.

Note: At the end of the day, I'm not sure this attack counts as a "success" from the perspective of the criminals. Smart criminals understand that parasites are more successful when they leave their host (i.e. hijacked database) alive, and most successful if they can remain invisible.

The attackers in this case failed to create much value for themselves because they chose to go too big too fast, causing so much press that even the most in-frequent Monster.com user must now about the attack. By biting off too much, and gaining press attention, the hackers have effectively ruined any chance they might have had for long-term financial gain.

VOIP Eavesdropping

Working in this industry is a little like walking into a supermarket and trying to find something "not unhealthy" to eat: everywhere you look, there are problems.

Take, for example, VOIP.

I'm not talking about the issues that bedevilled Skype this past week (although that seems to be developing into a fascinating story about what happens when one node on a peer-to-peer network gets out of sync and "central command" lacks sufficient permissions to prevent disaster) - I'm talking about the issues that are emerging relevant to VOIP and security.

VOIP, as we all know, stands for Voice Over Internet Protocol. And it is the "IP" part of this anagram this is both the root of its greatness and its largest potential weakness. Because if your systems are not architected just right, introducing VOIP into your business can introduce an easily-exploitable vector for corporate espionage.

By corporate espionage, I mean the ability to "listen in", record, or otherwise intrude on your corporation's most sensitive phone discussions.

Will Stofega, research manager for VoIP services at IDC, recently said “One or two years ago, the discussion of VoIP security risks was theoretical. What we’re going to start seeing is the threat of moving from theoretical to reality.”

This is no longer a theoretical threat. Stan Quintana, VP of Managed Security Services at AT&T, who I had the pleasure of meeting last year, believes, when it comes to VOIP traffic, "there is substantial exposure to intercepting that conversational data and monitoring it."

Bogden Materna, CTO and VP Engineering for VOIPshield Systems, recommends deploying a "multi-layer security infrastructure that... consists of... SBCs, VOIP Network Intrusion Prevention Systems (NIPS), VOIP DoS defenses, VOIP Network Intrusion Detection Systems (IDS), Host IPSs, AAA servers, encryption engines and VOIP antivirus software."

That may not be overkill - it is absolutely essential to protect voice communications in an enterprise, and VOIP needs added protection so confidence doesn't wane.

Because, as we saw last week in the Skype situation, people will very quickly start experiencing fond recollections of 100 year old POTS technologies when VOIP clients suddenly become unavailable, or start affecting (or infecting) other clients on the network.

One and a Half Billion Heartbeats

Many years ago, astronaut-legend Neil Armstrong sat down for an interview with news-legend Walter Cronkite. It was just after the time of the Apollo project, which was coincident with the beginning of the jogging craze.

Cronkite asked Armstrong for his opinion on jogging. Armstrong thought about it for a second, then responded:

"I believe that the Good Lord gave us a finite number of heartbeats and I'm damned if I'm going to use up mine running up and down a street."

This quote has always tickled me. I repeat it whenever anyone asks me to work up a sweat. So I was pleased yesterday, when Geoffrey West, a Santa Fee-based scientist, confirmed what for me has been merely Neil's opinion for the past thirty years.

Interviewed on NPR, West confirmed that the results of his most recent research show the heart of the average mammal, humans included, beats approximately one and a half billion times in its lifetime, regardless of the size of the mammal or its habitat.

In other words, it appears that it doesn't matter if you're an elephant or a mouse. Every mammalian heart is programmed to beat 1.5 billion times - before beating no more.

The story contained a number of nice audio props, such as recordings of the bongo-like heart of a shrew, which beats approximately 1,000 times a minute, and of the whale, whose heart beats (if a low squishy sound can be called a "beat") approximately once every three to four seconds.

But the thing that interested me most was the part the story left out - a quote from one of the most famous humans to yet walk the Earth, which at the time was just his opinion, but which now ranks as a fully-fledged - and very welcome - hypothesis.

Virtualization: The Next Generation

The success of VMWare's IPO last week took none of its customers - which include Authentium - by surprise. The intra-day run-up, from $29 to over $50 a share (resulting in a $19 billion market cap), shows that market watchers believe that virtualization is barely out of the front gate in terms of economic potential.


One of the reasons for this is because virtual machines are still really only being installed on servers. And despite the obvious reduction in support costs and physical overhead that is enabled by installing multiple virtual machines on a single physical server, many IT administrators are only a small way into their migration plan.

Which means, come rain or shine, VMWare revenues should continue to grow healthily for many, many years.

But are servers really the most profitable line of business? Or are there other forms of virtualization that could enable an even bigger payday, a few years down the line?

I believe there are. According to our experience (and Microsoft's volume pricing tables), for every 30 servers in an organization, there are approximately 500 PCs, or, increasingly, laptops. Obviously, desktops and laptops present an attractive market for virtualization in the future.

However, I don't think we're going to see the same form of virtualization take root on the desktop.

I believe by the time new technologies like VirtualATM, which is based on our VERO ("Virtual Environment, Restricted Operations") virtual environment take seed, purely web-based forms of "the applications formerly known as desktop applications" will have arrived in force, creating a situation where the operating system may become redundant with respect to many of today's tasks.

Certainly, tasks requiring heightened security will use virtualization and restricted runtime environments almost exclusively. It makes *zero* sense for a large bank or online trading firm to expose their transactions to processes running in the non-virtualized environment.

Far better to elevate the application and restrict interaction to only those processes and network assets which can be absolutely trusted - which is what we do with VERO.

Of course, this all begs the question as to what will happen to the faithful desktop PC, and/or Mac? Will our computers simply become pretty boxes capable of instantly downloading any number of virtual environments, such as VERO, and metering their use via mechanisms like KPP?

Microsoft seems to think so. Here's a quote from an article in the Wall Street Journal last year that showed up in a 2006 article by the ever-alert Mary Jo Foley, over at ZDNet.com:

“Meanwhile, a cadre of respected Microsoft computer scientists and programmers formed a group under Chief Software Architect Ray Ozzie to start building software that could be a critical piece of what Windows might become, say people familiar with the work.

That group, says a person familiar with the matter, sees the future of Windows as much more as an Internet service than software that runs on a PC.”

In other words, "Windows as a webOS".

I personally think by this time (2012?), virtualization and servicizing of the services we consumers use the most (web browser, word processor, spreadsheet, financial management software, games, etc.) will be so far along, and so easily accessible and secure, that Microsoft - and Apple - could find themselves in 2012 with highly-virtualized operating systems that no one, except die-hard fans, will want or need to use.

Note: One potential piece of gold at the end of the Microsoft virtual rainbow is KPP - otherwise known as PatchGuard. PatchGuard provides metering support for software application usage and license management - such as desktop applications deployed using Microsoft SoftGrid.

KPP - and Microsoft Update - could become the critical components of the Microsoft webOS. It will be interesting to watch Microsoft's upcoming technical releases, including kernel-level APIs, in this area.

Skype's Problem is PR, Not Technology

Before their 2-day outage this week, it was impossible to imagine that Skype would ever find itself comparable to your typical airline in terms of information policy.

But that is exactly the position that Skype's less than impressive PR strategy has put it in. By releasing little tangible data and punctuating releases with periods of "dead air" up to twelve hours in length, Skype has turned itself from "trusted VOIP top dog" into just another big company that doesn't care how long we're going to sit on the runway.

The PR folks handling the Skype situation seem to have forgotten who built the company into the 220 million user powerhouse it is today: a combination of technology-savvy, socially-networked geeks.

This network of super-smart customers needs to be given much more to chew on than an "algorithm deficiency" - otherwise they will use their gray matter to come up with any number of conspiracies involving viruses, saboteurs and terrorists. Indeed, many such theories are doing the rounds.

Tell us more, Skype. Name the data centers and customer base subsets affected, discuss the nature of the breakdown in encryption that has occurred between your clients and servers, tell us if it was caused by a bad update or a piece of malware - share with us.

You will not lose customers because you chose to share this information: the opposite is much more likely.

As a resident of downtown New York during 9/11, I remain thankful for Rudy Giuliani's handling of the situation, and how much he shared with us during that day. Despite having to manage a broken city, and fires on numerous fronts, he found time to address New York's residents and provide enough information for us to understand, react, plan, navigate, and compensate on that horrible day.

Skype's PR team need to maybe take a leaf out of Rudy's book and think about how people use Skype, and how much more information might be warranted above what is currently being released.

Adding the Value Only You Can Add

I sometimes get asked by my employees what I think they should focus on. The answer I usually give is: take a look at the company, take a look at where we're heading, and “add the value only you can add.”

In my experience, there are *four* ways in which value gets created in an organization:

1. The coming-together of capital and people (foundation)
2. The reaction of people to plans and needs (task-based work)
3. Contributions to intellectual property (creative thinking)
4. Self-organization based on a combination of the above (entrepreneurial activity)

Additionally, there are *four* ways in which value gets destroyed:

1. Resistance to change
2. Secretiveness and/or disrespect
3. Lack of communication or understanding
4. Criminal acts: theft, fraud, sabotage

Destroying value is easy - everything you need to know is listed right here, and applies in equal part to religious terrorists or atheist technologists.

I personally prefer to focus my gray matter on how value is created – because when value gets cooked up at companies, a surprising amount can end up in the hands of individuals and their families. And that's a good thing.

1. Task-Based Work

Task-based work is where the bulk of the value gets created in a business – especially in areas like sales, development, QA, and customer support, where repetitive work builds the odds of success, and corporate governance and finance, where process-based attention to detail is critical to a company's prosperity.

But task-based work can also be wearying if you’re kept in the dark or not properly tasked – it can feel at times like negative value is being created.

How do you know if you’re working for a bad manager? If you have a bad manager, you’ll find yourself frequently with time on your hands - or no idea of the value of what you’re doing – because the manager either misjudged your ability to get something done, or because they didn’t provide any context or understanding.

Suggestion: Tell your manager you need to understand why doing the task you’re doing is important. If you don’t have a task, ask your manager what problems they need to solve or processes they are trying to create.

If you are tired of doing a repetitive task, figure out how to automate that task or response, and sell your manager on your plan to do so. Tell everyone when you’re done, so we know the value you’ve created - the value that only you were able to bring to the forefront.

2. Creative Thinking

Creative thinking is highly useful to an organization – but only if it is shared. Ideas are valueless if kept a secret. For an idea to have any value at all, it needs to be shared with managers, or with the custodians of intellectual property – the CTO, the General Counsel, the CEO, and department VPs.

Equally, the ability to see around corners is useful only if shared - taking pleasure in watching someone fail because you recognized the path they were on is a particularly nasty form of amusement.

For an idea to have maximum value, like sushi, it should be served "sliced but raw". The biggest mistake I see people making is the mistake of “polishing their idea”. The only thing that adds value to an idea is *work* – "bulk thinking" seldom adds much value to the initial burst of inspiration.

As Einstein once said, the four steps to success are: saturation, incubation, inspiration… and perspiration. He rated perspiration 99% of the effort.

Suggestion: Don’t assume something is valueless – or valuable – in its current context. Don’t keep it a secret. Make sure someone outside your department is aware of your idea – it may be worth a hundred times more in Legal or Marketing than in Development (or vice-versa).

3. Entrepreneurial Activity

The very best entrepreneurs combine thinking and action, and the best of these guys create value every waking minute of every day. Venture investors are *always* looking for people like this, and, believe it or not, these guys always come to the investors with exactly the same presentation, regardless of the nature of their invention.

At the end of any decent presentation of a business plan, there is always a graph. The graph indicates to the investor that the entrepreneur understands it is their job to add value over time.

In fact, on the graphs I have personally seen, the “x” axis is always “time”, and the “y” axis is always “value”. The guys that get the money are the guys that design the best-looking “hill to climb”, and have the best-looking (and most proprietary) walking sticks to do it with – i.e. the guys that are able to prove their company will add more value over time, and face less competitive pressures, than competing operations.

Suggestion: In today’s world, the folks that add the most value in the least amount of time (Bill Gates, JK Rowling, George Marshall, Steven Spielberg, Paul McCartney, Larry Page and Sergey Brin, Rupert Murdoch, Bono, Steve Jobs, Tiger Woods, Warren Buffet, etc), win.

Note: You hear a lot about the "compromises" entrepreneurs make to become successful. Really? How much do you think each of these guys on this list compromised either their beliefs or their personalities?

Read this list through again - if you can find a compromiser among them, I'll buy dinner.

Don’t think you can add value from where you sit? Look around – there are people rising fast at Authentium because they took an idea home on the weekend and worked on it until it became a product line. These people are inventing valuable work habits and may one day find this approach useful when starting their own business.

Summary

If you find yourself not adding value, ask for tasks, or invent them, or jump in and help someone with too much to do. Share ideas outside your group, and act on them. Take ownership of your output and take pride when others offer you improvements, because they will make your idea more valuable.

The cell phone of today is infinitely more valuable than the first prototype telephone. Don't you think Alexander G. Bell would be proud to hold the iPhone in his hand today? SHARE your idea, and watch it become something far greater than you.

Above all, DO NOT sit idle – because when you do that, you’re not creating value for anyone.

By the way, this is "just my small change" - you're welcome to disagree. But in thirty years of doing this, I have seen a bunch of guys succeed, and watched how. The key to every success, however long coming, is to work as a team, and add the value only you can add.

When Zombies Attack

A couple of days ago, I blogged about a group of Russian criminals that are distributing a PHP-based malware creation kit called MPack, designed to enable criminal gangs to target Internet banking and shopping customers.

The "developers" of this kit recently boasted about creating a network consisting of tens of thousands of hijacked web servers, worldwide.

This weekend, days after my post went up, one of our sites became the target of an attempted DDOS (Distributed Denial Of Service) attack involving tens of thousands of IP addresses.

Coincidence? Maybe, maybe not.

The attack was not harmful. As a security company, we get this kind of stuff aimed at us all the time. Many security companies and commentators do: Microsoft, Symantec, VeriSign, CERT, Steve Gibson, Ben Edelman - the list is a long one, and these are just the guys willing to be open about it. In a 2006 USA Today article, it was claimed that Symantec alone found itself the target of an average of almost a thousand DDOS attacks a day during 2005:

"Security software giant Symantec saw an average 927 DDOS attacks per day in the first half of last year, up 679% from the last six months of 2004."

I imagine the guys at Symantec are pretty well-prepared for these events by now. The Authentium NOC guys, and our ISPs, were also well-prepared for the additional traffic that came our way today, and our systems responded to plan.

Note to Russian authorities: it may turn out that someone else was behind today's incident. That doesn't matter - you should do the Internet users of the world a favor, and arrest these MPack lowlifes: It is naive to imagine the well-funded criminal gangs buying their kits will continue to focus their attention exclusively on banking and commerce targets outside Russia.

Speaking of which... according to research done by VeriSign iDefense (and published on a blog maintained by our partners, IronKey), the MPack Internet banking "crimeware" kit is being used by more than 50 criminal groups - and associated malware has been unintentionally downloaded and installed by an estimated 500,000 PC users worldwide.

Bankers, beware. Readers, if you want to view my previous post on this, click here.

DHS - PCs = No Plan

On Saturday, the DHS computer network at LAX shut down, preventing incoming international passengers, and some passengers from Alaska, from being processed. Peter Gordon, acting port director for customs, said the shutdown, the latest in a series of incidents to affect the DNS system, was unprecedented:

"I've been with the agency for 30 years and I've never seen the system go down and stay down for as long as it did."

During the 10 hour-long outage, which lasted from 2pm until midnight and affected more than 20,000 passengers, air conditioning and water was in short supply, leading to a situation where dehydration was observed among some passengers by two LA Times reporters:

"Water fountains were not accessible due to renovations in the terminal, and the only air conditioning was provided by three industrial fans with limited range."

Ultimately, three people had to be hospitalized. The last passengers were processed at around 3.50am on Sunday - almost 14 hours after the shutdown started.

This is the latest in a series of incidents involving INS or DHS computer systems. I experienced one such incident myself, first-hand, at JFK about a year ago. I was at the front of the line at JFK when the computers went down for about an hour and a half.

Being at the front of the line, I observed uniformed INS staff repeatedly tried to log in to the DHS network. I asked the officer manning the booth in front of me if there was a back-up plan "if the computers don't come back on line".

"Not that I'm aware of", he said. "You just have to be patient".

The computer system that shut down yesterday provides officials with details on who they need to detain for secondary screening, which is without doubt a worthy goal in this day and age. But the lack of a backup plan reveals a critical lack of "defense in depth" thinking - and planning.

The incident at LAX should have created an ideal situation to test the DHS (non-computerized) back-up plan. The fact that no back-up plan appears to exist - none was executed inside ten hours of downtime - indicates a lack of planning that few private companies would allow.

It isn't as if the DHS doesn't have the resources. The Department of Homeland Security has a $30 billion annual budget.

What would happen in the event of a terrorist attack on an airport? What is the plan if the entire US network were to go dark? Are incoming passengers to be carted off to a hanger somewhere? Is there even a plan in existence with that amount of detail?

On July 30th, Bennie G. Thompson, D-Miss., and Chairman of the Subcommittee on Emerging Threats, Cybersecurity, and Science and Technology Chairman James R. Langevin, D-R.I., both signed off on a letter to DHS CIO Scott Charbo, asking him some hard questions. about the 844 security breaches the DHS has experienced over the past two years.

They have given Mr. Chabo until August 27th to respond. Post this incident, I expect his response will draw a significantly greater audience of reporters that it would have previously.

MPack Developer: "Just Creating Ammunition"

An article appeared on the SecurityFocus website a few weeks ago containing an interview with the developer of the MPack Infection Kit, a Russian-based malware-creation toolkit that retails for between $750 and $1,000 on the Internet.


According to Symantec (who made this movie), MPack presents itself as an IFRAME Manager tool, basically an FTP updater client, written in PHP language, that runs on a webserver with MySQL as back-end. It takes as input a list of website administrator accounts (possibly obtained in the black market). It then periodically checks the home pages of those sites to inject a chosen IFRAME into their code.

Nasty stuff. And well-organized - and, apparently, well-funded. In the SecurityFocus interview, the developer appears to not be too concerned about forking out $10,000 for an exploit:

"For our pack, there are two main methods of receiving exploits: The first one is guys sending us any material they find in the wild, bought from others or received from others; the second one is analyzing and improving public reports and PoC (proof-of-concept code). We sometimes pay for exploits. An average price for a 0-day Internet Explorer flaw is $10,000 in case of good exploitation.'

The actual impact of MPack on consumer computing is not known with precision. The developers claim only "tens" of copies of the software have been downloaded. However, the developer appears to admit "tens of thousands" of web pages have been compromised, which lends credence to the claim by SecurityFocus that exploits based on MPack have compromised "hundreds of thousands" of computers.

In the interview, which can be found here on Register.com, the "developer" of the malware toolkit admits that he knows what he is doing is illegal - "we are just a group of people working together, but doing some illegal business" - and that he is aware of Russian laws covering the nature of his work.

He also goes on to illustrate that he cares nothing about the consequences of his work.

Q. Do you feel sorry for the people whose machines are infected by an attack?

A. Well, I feel that we are just a factory producing ammunition.

He then further goes on to complain that "AVers" (i.e. antivirus companies, like Authentium), are painting him as a criminal.

"AVers want to make an image showing us like bad guys stealing something from a store, etc. But really, almost none of my friends have any contact with criminals about our work or anything else."

Authentium to MPack Developer: you *are* an Internet criminal. You are not just "supplying the ammunition", you are fueling the battle by supplying criminals, and making the Internet worse for hundreds of thousands of consumers.

Which is why, one day, you will end up in jail. Hopefully, for a very long time.

Note: Symantec's blog has an excellent posting on this malware.

Monday Diversion: Paul Potts

This is not security-related, and as a general rule I don't watch much TV or video. But this video clip, from the UK version of "America's Got Talent" is a "must see".

Paul Potts Sings Puccini's "Nessum Dorma"

The story of what happened to Mr. Potts next can be found here, on Wikipedia.

The Voting (Machine) Results Are In!

Unsurprisingly, a $1.8m new study funded by CA Secretary of State Debra Bowen, and conducted by researchers at the University of California, has confirmed what researchers at Princeton and many security researchers already knew: the electronic voting machines currently in use are not secure.


The study focused on machines manufactured by Hart, Diebold, and Sequoia. The findings, published today, cover aspects of physical security (i.e. locks, screws, accessibility to hard disk, accessibility of ports, etc), firmware security, and software security.

The researchers also tested the capability of each system to create an audit trail (logs relating to any non-authorized modifications of the system), and whether or not the Windows operating system was still configured to enable things like allow unauthorized wireless devices to operate.

Avi Rubin, a professor of computer science and technical director of the Information Security Institute at Johns Hopkins University, summed it up when he told TechNewsWorld:

"I was shocked by how severe the problems were... what's even scarier is that the researchers were looking at certified systems that have been already used in an election."

I would love to list all of the problems found, but email feedback on my recent essay-length Security 3.0 posting suggests I should keep the length of this post to "one cup of hot cocoa". So here's the summary:

* Sequoia: Researchers analyzing Sequoia's e-voting machine bypassed locks and gained access to a HP ProLiant DL360 G5 server by simply removing screws. In doing this, the researchers discovered "numerous" ways to overwrite the Sequoia Edge firmware using simple tricks such as "malformed font files" or "doctored update cartridges"

* Diebolt: Researchers were able to exploit vulnerabilities in Diebold's Windows operating system to initiate events that the server did not record in its audit logs. Researchers were also able to manipulate components networked to the server. This allowed them to load wireless drivers onto the server so a wireless device could be plugged surreptitiously into the server. Researchers found a number of ways to overwrite the Diebold firmware and change vote totals, among other things - in one example, researchers were able to escalate privileges from "voter" to "poll worker" to "central count administrator", enabling them to reset the election, issue unauthorized voter cards and "close the polls". Diebold's physical security was also lacking, the researchers found.

* Hart: Researchers discovered an undisclosed account on the Hart e-voting system that enabled attackers to penetrate the operating system and gain unauthorized access to the Hart Election Management Database. The researchers were then able to overwrite Hart's firmware and also access menus that were not locked with passwords. Additional attacks allowed researchers to alter vote totals and attach a device that caused Hart's system to authorize access codes without poll worker intervention.

Scary, huh? So now what?

California obviously could choose to get rid of its voting machines, but that isn't really a viable option, budget-wise. Many of these $3,500 machines are just one year into a three year lease. The people that recommended them will lose their jobs.

The smart play here is for one vendor - Hart, Diebold or Sequoia - to say "we hear you", instead of attempting to disparage yet more detailed results from yet another respected source. The smart play is to do that - and spend the considerable cash they have on hand on fixing the problems.

Note to vendors: The whole concept of electronic voting is poised on a knife-edge right now - there is no room left for empty promises. These problems must get fixed. If you don't fix the problems, it will be fifteen years before you get back in the door. The first vendor that successfully commits to solving the problems - and validating the existing investment by government - will win.

Authentium has patent-pending technology available that could significantly assist electronic voting machine vendors when it comes to eradicating software vulnerabilities and hardening the audit trail.

Sabotaged NASA Computer Not "Non-Critical"

Security breaches can be dealt with in any number of sensible ways. However, NASA has chosen a risky strategy in seeking to downplay news that employees at a NASA subcontractor, Invocon, deliberately sabotaged a computer destined for the International Space Station (ISS).


Yesterday, NASA said, in essence, "no big deal". The sabotaged computer was a "non-critical" component.

This is, of course, nonsense. Everyone knows there is no such thing as a "non-critical" component in space. Every gram of mass counts - every kilogram placed in low earth orbit requires 20 kilograms of fuel to get it there, for starters - and every sensor must function.

The consequences of sensor failure are well-known, post the Challenger disaster.

Ten years ago, prior to co-founding Authentium, I worked in the space industry. During my time there, I met and worked alongside a lot of extremely smart engineers - rocket scientists - including some of the Saturn V guys, and some of the engineers charged with designing components for the shuttle and the ISS.

The sabotaged computer sensor was destined to monitor stress on an ISS truss segment - in orbit. This is not a "non-critical" task. The truss is the most critical structural component of the ISS there is - it is the component that all other ISS modules and components are connected to. Here's an overview, courtesy of space.com:

The truss is the backbone of the ISS. When it is completed, it will be the length of a football field, with its axis perpendicular to the station's main axis. Labs, living quarters, payloads and systems equipment will be directly or indirectly connected to it. Also attached will be U.S. solar arrays supplying enough power to light a town.

In other words, the truss "holds everything". Had the computer flown "as is", the sensor would have been blind to any problems with the monitored truss segment, or, as NASA puts it, the sabotage "would have prevented the collection of structural performance data".

In user-speak, this means non-critical data like "this truss is under critical stress, and under-performing relative to the design spec" could potentially have gone unnoticed.

This is hardly likely - space-bound components are tested rigorously prior to launch, which is how this was discovered. But that isn't the issue. The issue is that NASA is once again making a strategic mistake by downplaying this security breach.

They should be showing how committed they are to security by taking extremely touch action - like immediately suspending all work with this contractor, pending a third party investigation, and invoking the maximum financial penalties.

If you think that is harsh, consider this: this sabotaged computer appears to have originated from the same contractor that provides the sensors charged with monitoring the integrity of the space shuttle's wings - i.e. the mechanism designed to prevent another Challenger explosion.

This is a non-critical issue? I think not.

UPDATE: In a separate development, NASA chiefs announced today (Saturday) that they will impose a 12 hour "bottle to throttle" drinking ban on astronauts.

Earth to NASA: you need to do a much better job of reading the tea-leaves. Control of an asset into which tens of *billions* of taxpayer dollars have been poured maybe warrants a tad more discipline than a 12-hour "dry-out" of pilots and commanders.

Fireworks, Diapers and Chemical Screening

After several years of being designated "SSSS" and having my bags selected for "additional screening", due to the disproportionate amount of last-minute travel I do, I have become somewhat blase about the procedure. So you can imagine my surprise when my Sony Vaio laptop set off an alarm upon being swabbed for explosive residue at Palm Beach International.


For a moment, I didn't know quite how things would evolve... it is somewhat unsettling to hear the alarm go off and suddenly have the TSA team turn their attention to you.

Thankfully, they were relaxed about it. No guns were drawn. They tested the laptop a few more times, turned my laptop bag inside out, and finally felt okay enough about things to let me catch my flight.

It left me deeply curious about what could have caused it, however. As we discussed the issue, they asked me if my laptop had been near any explosive materials.

After a few minutes of thought, I realized my laptop *had* been near explosives - during a dinner party, I had briefly taken the laptop from our dinner table, and stored it under our stairs, in exactly the same place I had previously set down a couple of hundred dollars worth of (legal) Fourth of July fireworks.

The white-uniformed guy asking the questions smiled and nodded - it appears I was not the first executive in Florida to store a laptop and explosives in the same location.

Later, researching the situation online, it was revealed that false positives, far from being rare, are somewhat common at TSA checkpoints - somewhere in the order of 2-3%. In fact, a cursory look at the clipboard onto which my laptop was being written up revealed that there had been a half-page full over the previous few days.

Here's some info that will prevent your heart-rate rising if you're also targeted: One of the leading causes? Nitro-based statins (heart drugs) - which are not altogether uncommon in Palm Beach County.

Another frequent cause of false positives? Trace elements of nitrogen-based compounds in urine - most commonly caused when child seats are swabbed for explosive residue (hint for parents - change those diapers regularly).

Security 3.0: Mitigating Real-Time Attacks

Some folks in the business are attempting to build a "Security 2.0" paradigm, suggesting that computer security is moving through a second wave of innovation comparable to the developments taking place as part of "Web 2.0".

I disagree that there is a direct correlation between these innovation cycles. Based on our product history, and using the malware vectors and sales channels associated with the different phases of computer usage as reference points, I would argue that we've already experienced two distinct phases of computer security, and are now on the cusp of Security 3.0.

Authentium (then Command Software) shipped its first Security 1.0 product back in 1989 - "Security Guardian" - a system-level PC security product designed to lock down executables.

The focus then was protecting the device against rudimentary forms of malware propagated via what was back then the primary vector - the floppy disk. The distribution channel back then was primarily the retail store or the OEM manufacturer image.

Authentium's second product, F-Prot Pro, back then a co-venture with F-Secure and Frisk Software, shipped in 1992. F-Prot Pro was considered by many to be the first "professional" on-demand antivirus product to enter the market.

Twelve years later, the Authentium ESP suite introduced advanced firewall and URL management functionality and was designed to enable ISPs to provide protection to consumers worried about the "always on" nature of broadband - and the increasing number of attacks targeting the user's personal data, rather than the device.

Interestingly, during this phase, the malware vector and distribution channel became one and the same - the broadband service provider. However, security measures deployed during this phase, including multi-application security suites and two-factor authentication, were largely effective against non-real time criminals and managed to effectively mitigate problems and prevent large-scale financial losses.

The emerging world of Security 3.0 is quite different.

In this world, the PC is no longer the target of attack, nor is the user's generic - and massively cumbersome - accumulated store of personal information.

The criminals invoking Security 3.0 no longer want to sift through your garbage. These criminals understand that the most valuable information obtainable is the information that is most "fresh" - i.e. your stock trading credentials, your two-factor authenticated session keys, the data you are inputting in real-time into your tax form or mortgage application.

Real-time attacks via the Internet may sound like fantasy, but recent attacks on tax filing sites, and online stock trading firms eTrade and TD Waterhouse have shown us it isn't. The evidence isn't only anecdotal: Gartner and other research firms are predicting a renewed focus on access controls, session management, and ID management. There is a ton of venture money pouring into firms, such as Authentium, that offer advanced session-based security solutions.

Time will tell if the investment bring made is large enough. In the world of Security 3.0, criminals are already moving well beyond the dumpsters, focusing their funds on the targeting of users of financial service providers in real time.

They are building advanced systems capable of manipulating hundreds of stolen trading credentials at once - in support of real time buying and selling. They are developing methods of automatically modifying data inputed via forms - again in real-time - using advanced social engineering techniques combined with an array of client and server-side strategies.

One example: earlier in the year, I blogged about a series of "pass-through attacks" involving bogus tax filing sites that popped up a week or two prior to the April 15th tax filing deadline.

These phishing sites were created for one purpose: to replace, in real-time (or in near real-time), the bank account information entered in the "refund" field by the user prior to submission of the tax form to the IRS. The client-side attack took the form of a spoofed email - the server side took the form of a spoofed web site. The targeted information was tax refund and bank account information.

This attack was successful enough to set off alarm bells at the IRS and security companies, globally. However it is nothing compared to what we're going to see happen in the near future.

Here's my prediction: Next year, attacks on consumers filing their taxes online will take the form of a targeted "mail-merge" advertising campaign to a subset of high net worth individuals identified using a stolen database (i.e. a replay of the recent BBB and FTC attacks, but with zero spelling mistakes). The attack will involve an email personally addressed to the user. It will be signed by the VP Sales of a leading tax management application manufacturer and carry their brand.

Links in the email will enable host file modifications and lead consumers to a site identical to the manufacturer's site. Once there, consumers will experience services identical to that performed by the manufacturer. They will enter first their names, then their social security numbers, then their addresses, then their personal tax information, then the details of the account they wish their refund to be remitted to.

The attackers will modify their approach during the scam, and consumers will not notice changes in the format of the email or the location of the web sites supporting the scam because their experience will constitute one isolated session. However, during the course of the attack, the criminals will systematically change every aspect of the scam, including hosting companies, receiving bank, and email format. They will also, or course, automate the altering the bank account details of every tax return requiring a refund, as per this year's test run.

The criminal sites will not feel to consumers like fake sites. From a QoS perspective, they will potentially mirror the quality of service of existing sites. Smart criminals will avoid attention by passing through even those tax returns not requiring a refund. The IRS will receive the tax form via the criminal as if it were coming from the consumer (or business) and return to the submitting party an acknowledgment that their form is being processed - via email.

A few months after that, their refund payment will be sent. To a bank far far away. If the criminal gangs involved are clever, millions will be stolen. If they are exceptionally smart, that number could run into the billions within a few short years.

None of are looking forward to this coming true. but come true it will - online criminality is evolving fast and the black hats are as competitive as the rest of us. Unfortunately, two-factor authentication and other systems will not help. As most security professional already know, when it comes to real-time attacks, criminals will profit equally from consumers using 2FA (two factor authentication), as from other simpler forms of authentication.

The good news is that I am increasingly convinced we have an answer to this problem - the results of third party testing and technical evaluations of the past few months have convinced me that we can successfully mitigate many of these issues for consumers.

My objective now is to get this technology to market in large enough numbers to make a difference during the 2008 tax filing season.

Get Ready for the iWorm

The Safari browser shipping with the iPhone has been hacked by researchers at Independent Security Evaluators, based in Baltimore.

Charlie Miller, who used to work at the NSA before going over to ISE, appears to have based his attack on a buffer overflow exploit he originally found while researching Safari on his Mac - and planned to reveal next month at Black Hat. He said after the hack he was in "complete control" of the hacked iPhone.


Here's how the New York Times described the attack (I take it that the fact that ISE's web site points to this article establishes this as the "official" version of events - either that or they just think the NYT picture of Miller on his iPhone is cool - which it is):

Dr. Miller, a former employee of the National Security Agency who has a doctorate in computer science, demonstrated the hack to a reporter by using his iPhone’s Web browser to visit a Web site of his own design.

Once he was there, the site injected a bit of code into the iPhone that then took over the phone. The phone promptly followed instructions to transmit a set of files to the attacking computer that included recent text messages — including one that had been sent to the reporter’s cellphone moments before — as well as telephone contacts and e-mail addresses.

“We can get any file we want,” he said. Potentially, he added, the attack could be used to program the phone to make calls, running up large bills or even turning it into a portable bugging device.

This is a pity on many levels. I got to play with the iPhone browser the other day, and it provides a superlative - and extremely responsive - user experience.

But, that said, user experience and coolness counts for less if someone can steal your files, copy your text messages, mess up your game stats, or make phone calls from your phone via your iPhone browser.

The vulnerability is still very new, but with hundreds of press articles likely to land at the feet of the first hacker to design the "iWorm", you can bet there are already several folks out there lining up cases of RedBull and cracking their knuckles.

What does this mean for Apple? It means, with 15% share of the 2007 laptop market and millions of iPhones/computers likely to ship the same year, that they are finally becoming big enough in terms of market share to grab the attention of hackers.

Apple shareholders should read this news as positive. After all, the iPhone security vulnerability will be fixed in short order - that's what operating system developers and security companies, such as Authentium, do for a living.

Will there be more vulnerabilities? Of course - with success comes attention. Parasites love a healthy host, and the iPhone appears to have a long, healthy life in front of it.

Anti-Spam: Gateway vs. Desktop

The argument over where the battle against spam should be fought - on the desktop, or at the gateway - goes back to the dawn of Internet time.

There are two parts to the argument over which approach is best: the first is a "cost" argument concerning the cost of allowing terabytes of spam to travel across a network to the desktop. The second part concerns the "value" of an ISP or consumer portal's email address.

Scanning for spam at the gateway is by far the most sensible and efficient method from the point of view of network management and bandwidth utilization. Authentium partners with the three leading gateway antispam service providers, as ranked by Gartner, and we scan somewhere north of four to five billion emails every week as part of this process.

The ROI provided by scanning at the gateway is easy to visualize, and form the basis for many an "ROI Calculator" out there on the web.

Assuming a spammer targets 1m subscribers of a broadband ISP or retail portal with 100 spam emails in the course of a week-long "campaign", each containing a 12k attachment (i.e. virus or dropper or other form of malware) = 1.2MB of bandwidth x 1m end points. That's 1.2 terabytes worth of unnecessary data moving through the network - not including the potential upstream traffic created by zombified user PCs.

Is 1.2 terabytes of data traveling over a wholly-owned network really that much of a problem? Yes, it is. Service level demands are rising rapidly as video viewing moves increasingly to the small screen and P2P technologies such as BitTorrent continue their rise.

On Friday nights at 10pm, you need every bit of available bandwidth, because slow service = more calls. Gateway spam filtering is a proven way to improve service levels and help reduce call-volume.

The "value of an ISP domain or consumer portal email address" is a far more interesting argument from a business standpoint. Oftentimes, an ISP or portal's email address is cited by bankers as the core credential and most important source of value for that company.

Many ISPs and consumer portals utilize highly-effective gateway scanning and market these email addresses as "safe havens" from spam.

I heard a great example of the power of this approach yesterday while listening to the Kim Commando Show on the radio - IMHO, the best consumer-oriented computing show on the air. An ISP subscriber called up complaining that his ISP in North Carolina was letting through up to 400 spam emails a day.

Kim didn't waste any time. She gave him extremely sensible advice: lose that ISP (and email address) and get another email address from an ISP willing to demonstrate that they value your privacy, time, and patronage, by providing you with a safe haven address.

I would imagine the caller took this advice, and now that ISP (the name of which was mentioned on air) and possibly several hundred more of its subscribers are shopping for a new ISP.

Could happiness have been achieved using desktop antispam software? Yes, but the same level of happiness is possible simply by moving to Yahoo, or any other email portal that implements a decent gateway policy.

At the end of the day, while desktop antispam is capable of decreasing spam for consumers, the only sensible solution for an ISP wishing to grow or retain value for its email address - a core strategic asset - is to adopt the best technology they can at the mail gateway.

Note: Over the past few years, we have licensed in several "best-of-breed" desktop anti-spam technologies at the request of clients, and set about implementing them as part of ESP.

Despite the general excellence of these technologies, we haven't yet been asked to deploy them - smart ISPs know the value of building a solid email offering, and filtering at the gateway. Smart consumers appreciate having at least one email address that doesn't bite back, and stay longer with those companies that provide them.

FTC Targeted By Phishing Scam

A few weeks ago, I blogged about some of the problems the FTC has introduced with the design of their online complaint form (FTC Complaint Form a "Keylogger's Paradise").

The FTC folks now have a new problem, and it is again complaint-related.

The problem the FTC is facing takes the form of a variation of the BBB email phishing scam that emerged in March. This scam looks so real, and is so well crafted, that only a single spelling mistake ("filled" instead of "filed") makes you think twice before opening that attachment.


Catch 22: The FTC cannot now respond by email and warn people pro-actively, because any email from the FTC must now be considered suspect.

Consumers, once again, will need to rely on their antivirus software to strip out this attachment, and hope that their antivirus technology partner has heuristics that are capable of detecting this kind of variant on the fly.

In addition the world's largest database of identified threats and variants, Authentium employs extremely advanced heuristics, designed to detect new threats.

Authentium's antivirus and antimalware services protect against all known forms of this scam.

News Flash: Two Factor Authentication Hacked

Sometimes it takes a long time for news to reach people.

Technology vendors know this and some go to great lengths to try and get rich in between the release of the news of a hack and their customer's realization of it. The hacking of two-factor authentication is one such example.

Two-factor authentication was supposed to save online banking and e-commerce. It arrived on the scene over twenty five years ago, was finally productized into marketable form a decade ago, and finally found its market at the turn of the century: online banks.

Despite the massive costs involved with procuring, customizing, configuring, distributing and supporting two factor authentication, several banks signed up - along with the monetary authorities of several leading high-tech countries.

The first cracks appeared in two-factor authentication were whispered about several years ago, but they showed up in force last year (2006) when two scions of the industry, Mikko Hypponen of F-Secure, and Zulfikar Ramzen of Symantec, both weighed in and essentially called it "game over" for 2FA when asked to comment on a hack targeting Citibank customers.

The reason? It turns out that two-factor authentication *does not* protect online banking customers against a real-time man-in-the-middle phishing attack. In fact, Ramzen went on to say to say, essentially, that two-factor works well against dummies, but is not nearly so great in real time - especially when it comes to an attacker that's serious about getting your money:

"...if an attack is more sophisticated and the phisher can use the credentials in real time, we are the ones out of luck. I believe that two-factor authentication security will be almost futile when we tackle the next generation of phishing attacks."

Ross Andersen of Cambridge University's Computer Lab goes even further. In an address to the e-Crime Congress in London in May 2007, he outlined the vulnerabilities involving two-factor authentication and further warned:

"Banks are resisting because their technical staff know that it will be expensive to introduce and will not be effective. Some banks will introduce it, it will be quickly broken and then quickly forgotten."

Of course, cost is an issue: It can cost more than $50 per customer to procure, customize, configure and distribute a physical token. But the real issue here is trustworthiness, ROI and real risk reduction.

Two factor or single factor, it doesn't matter. Client-side security is not sufficient when it comes to thwarting a man-in-the-middle hack. A comprehensive, end to end, client-to-server security solution (such as Authentium VirtualATM) is the only kind of solution capable of protecting banking customers against fast-evolving forms of malware involving non-trusted downstream devices and the compromise of a branded, trusted channel of communications.

Used in combination with two-factor client-side authentication, or without additional forms of authentication, Authentium VirtualATM could radically reduce the kinds of crimes now being planned by sophisticated online criminals by eliminating man-in-the-middle attacks and forcing criminals towards softer, or less-valuable, targets.

Note: sometimes "two factor" ain't exactly "two factor". For a great article on this, check out Bruce Schneier's comment here.

Time To Blocklist "Blacklist"

The Register, a great read, and a usually sensible source of IT-related news, just published an article under its antivirus section entitled "Time to Blacklist Blacklists" in which the word "blacklist" is used to describe a list of items to be avoided.

Dear folks at The Register: I have friends and family that find the term "black list" offensive. It is time for a change.

Most of the security industry is moving to adopt the terms "Allow" list (or "Allowed" list) and "Block" list (or "Blocked" list) - sometimes known as "A-Lists" and "B-Lists" for short.

As for the plethora of Register articles holding the line that all malware detection should be done using zero-day technologies (rather than Block lists), it's time you went and visited a pharmacy. Every technology has its efficiencies and uses - when it comes to fighting bad guys, there is no "best way", just a "best combination" of available approaches.

The efficacy of scanning files for known issues cannot be disputed - the benefits of including ever more advanced heuristics, including zero-day exploit detection techniques, also cannot be disputed.

Let's continue to use both, when appropriate.

Independence Day Postcard Scam

Further to reports on our blogs recently, another variant of the Postcard Trojan scam appears to be doing the rounds this Independence Day - except that this time, the payload appears to be a Storm worm variant.

This is a simple (some would say dumb) scam - a variant of an old email scam that first appeared in the late nineties. Potential victims are sent an email that says "A friend has sent you a postcard". In the email is a link that connects to a file disguised as a flash movie, shockwave plug-in, or similar innocuous download.

Authentium says: If you receive an email claiming to be an e-postcard or greeting card from a friend or family member, do not click on any links in the email unless you are 100% sure of the source, the sender, and the recency of your antivirus definition files.

If you *must* click on the link, update your antivirus software first and think twice about clicking on anything with the following subject lines (this list courtesy of SANS), or an Independence Day theme:

Celebrate Your Independence
Independence Day At The Park
Fourth of July Party
American Pride, On The 4th
God Bless America
Happy B-Day USA
July 4th Family Day
Your Nations Birthday
July 4th B-B-Q Party
Happy 4th July
4th Of July Celebration
Fireworks on the 4th
Happy Birthday America
Independence Day Celebration
Celebrate Your Nation
Americas B-Day
America's 231 Birthday
July 4th Fireworks Show (new)
America the Beautiful (new)
Independence Day Party (new)
America the beautiful (new)
4th Of July Celebration (new)
God Bless America (new)

DBA is "Weakest Link" at Processing Firm

Corporate buyers of consumer data obtained through illegal acts are leading off the second half of the year when it comes to making consumer data less safe.

Yesterday, it was reported that JAM Marketing, a Seminole-based data broker, had paid "substantial consideration" to one William Sullivan, a former database administrator (DBA) for payments processor Certegy Check Services Inc, a division of Fidelity National Information Services to obtain consumer records held by Sullivan.

Millions of accounts were involved. It is alleged that Sullivan provided JAM with 2.3 million consumer profiles, 2.2 million of which contained bank account information. According to a law suit filed by Certegy against Sullivan, Sullivan sold JAM Marketing the data either through S&S Computer Services, or directly.

JAM then appears to have provided the information to three additional marketing firms - Strategia Marketing in Largo, Data Secure IP LLC in Tampa and Whitehat.com Inc. in Tempe, Ariz.. The suit mentions that Whitehat may have further distributed the consumer information to two other companies, MCList Escrow Inc. in Seminole and Custom Response Teleservices in Elkhorn, Neb., and Quality Resources Inc. in Clearwater.

Several of the firms who obtained the data have since contacted these consumers and made marketing calls to them.

Who deserves what: Certegy's PR team probably deserve some kind of credit for releasing this info the day prior to a national holiday.

Who deserves what: Sullivan deserves more than the boot - he deserves some serious jail time. Unless we start to take this kind of theft seriously, consumers will continue to have their assets placed at risk.

Now that the US Secret Service is involved, hopefully that is what will happen.

Hong Kong E-Card Trojan

Last week, it was fake Father's Day email. Today I received an e-card invitation from a Hong Kong email address - Subject: You've received a postcard from a family member.


Now, several friends of mine live in Hong Kong, including Phil Braden, Authentium's co-founder, who recently went back to live in Hong Kong after ten years. But I'm not aware of any "family member" that would make use of a Japanese email address (xxxxx@echna.ne.jp) cloaked in a Hong Kong email address.

Maybe its a payback for the post last week on HK-based phishing toolkits.

According to Patrick Knight of our malware research labs, the link in the email does not lead to a greeting card (no surprise there) but instead leads to a payload, which, when downloaded, does a UDP scan of random IP addresses. Hmmm - sounds like the same guys.

Patrick will post further analysis on this Trojan when it comes to hand, but in the meantime, if you get an invite to download a greeting card or e-card, be careful.

Why The Internet is Not a Terrorist Target

I could write an entire post about the ironies involved in casting Justin Long, the guy who plays the Apple Mac guy on TV, as a computer hacker in the new Bruce Willis movie "Live Free or Die Hard." But I'm more interested in the plot line and its focus on cyberterror.


Cyberterror is a scary word.

Just saying the word "cyberterror" evokes images of uncontrolled warfare, destructive new technologies, and images of frightened, disenfranchised humans streaming from darkened cities, torchlights held high, children and teddy bears in tow.

The reality is, apart from the *possible* exception of the recent mass-shutdown of computer networks in Estonia, cyberterror hasn't yet arrived at any of our doorsteps. I think there is one very good reason why: terrorists, like us, *like* the Internet.

Back in 2003, IDC predicted that "a major cyberterrorism event will disrupt the economy and bring the Internet to its knees for a day or two" and went on to predict that the war with Iraq would "galvanize hackers" who would most likely use a combination of "denial-of-service attack, a network intrusion or even a physical attack on key network assets."

Q. Why didn't the terrorists attack?

A. Because the Internet is their infrastructure too.

The Internet not only enables free and anonymous communication, but also enables the global transfer of assets and funds, encrypted instant messaging (and instructions), instant creation of false identities, hard-to-police crimes, and the marketing of fundamentalist recruitment videos and propaganda to Internet users far removed from the source of such messaging.

Shutting down the infrastructure of the Internet, even if such a thing were possible, would harm terrorist agendas far more than it would help them. The two largest prolonged attacks on the Internet's root servers - in October 2002 and February 2007 - were both unsuccessful, and during the second attack, the attackers, who used "hundreds" of zombie computers pushing as much as 1Gbs worth of requests at the servers, were thwarted by an implementation of Anycast load-balancing technology.

Just "hundreds" of zombies? Five years between major attacks? Two servers affected out of thirteen after 12 hours? The Internet would not appear to be under serious threat, at least from the statistical point of view.

Various government organizations, including the DoD, appear to be of similar mind - or if not, at least understaffed relative to any perceived threat. The US Joint Task Force-Global Network Operations (JTF-GNO) has just 255 personnel directly employed and monitoring potential threats to GNO assets (which includes GIG or Global Information Grid assets only, not private or non-GIG public assets).

As for other public assets, private companies, and families and their service providers, the IT staff and police charged with protecting these entities are increasingly focusing their efforts on preventing the growing number of targeted attacks by criminals, rather than the "firesale" attack that formed the backbone of this movie.

That's really the reality of cyberterrorism today - cyberterror isn't about scaring the hell out of whole nations or towns, it's about scaring the money out of rich people.

My guess is once "Live Free or Die Hard" has run its course, a next generation of action films will start to reflect the kind of threats we're *really* seeing: highly-targeted, small-batch pieces of malware designed by well-funded criminals to make life really bad for a very small group of infrastructure users.

Note: Justin Long was very good in the film. The guy is the king of sotto voce. He has a long career ahead of him - and not just as a computer geek.