When Your Bank Phishes Its Own Customers

I recently got a bank account with a local credit union. This week they sent me what I can only describe as what amounts to a very good phishing email for their own online banking service. I had to stop in my tracks as I looked at it, as I couldn’t quite believe it. I’m anonymizing the details of the credit union and domains in question as I’ve already sent them some comments as to why this is a bad idea and gotten some positive feedback from their VP of remote services. Try getting that kind of response (or any response) from a larger bank! One of the reasons why credit unions are better than larger banks.

Let’s take a closer look at this “phish”.

image of the suspicious HTML email

Excerpt of the suspicious email

Continue reading

Heartbleed Bug – Serious OpenSSL Vulnerability

Heartbleed Bug

Just a heads up to all readers. A serious vulnerability in OpenSSL was just announced and patched a few hours ago. Vulnerable versions of OpenSSL could potentially leak private keys from memory to an unauthenticated remote attacker. You will need to immediately patch all affected systems and revoke any potentially exposed keys and associated certificates.

Seems like some organizations got advanced notice due to the co-ordination of some of the researchers and NCSC-FI but before they finished their pre notifications someone else discovered the vulnerability and went public with it.

Read more about the vulnerability at the researcher’s website: Heartbleed Bug

Security+ Exam Prep

I’m currently studying for the Security+ exam. Well, I’m done studying. I’m waiting to get my exam voucher from WGU now and go take the exam. Most of it is pretty straight forward stuff. If you have even a passing interest in infosec, most of it should be review. What I found most interesting while studying was disaster recovery and cryptography.

The DR was interesting just because I haven’t really given it a lot of thought before. I make onsite and offsite backups of my personal data and have read and (try to) live the Tao of Backup, but formal DR plans and procedures aren’t something I’ve done. I find it really interesting, especially from mindset of availability being one of a security officer’s responsibilities in conjunction with general IT staff.

My study also included some brush up on cryptography. I’ve always enjoyed learning about cryptography. I read Simon Singh’s “The Code Book” when I was younger and really enjoyed it (great book if you’re interested in learning about crypto and its impact on history). Even though math hasn’t always been my favorite subject, I always enjoyed reading about crypto and how it worked. Of course I knew about symmetric vs asymmetric cryptography and RSA/PGP, but I learned things like the differences between block and stream ciphers, how RC4 is used securely in SSL and insecurely in WEP, Twofish being beat by Rijndael for the AES standard, Blowfish was designed by Bruce Schneier (who I love), etc.

People on the Techexams forums have been singing the praises about Darril Gibson’s Security+ book. Though WGU provided adequate learning resources and only a dead tree edition is available, I decided to just go ahead and buy Darril’s book anyway. I wasn’t at all disappointed that I did, even if I bought it just before Amazon decided to drop the price from list price. 🙁 Hopefully a Kindle edition will be available soon. Last I heard from Darril in a blog post was sometime in the next 3 months. Anyway, you’ll find an excerpt from my review below.

I just finished reading Darril Gibson’s updated Security+ exam preparation guide “CompTIA Security+: Get Certified Get Ahead: SY0-301 Study Guide“. The book is well written and seems to throughly cover the exam objectives of the SY0-301 as posted by CompTIA. I haven’t sat for the exam yet, but feel completely confident I will pass due in part to this guide.

As with most exam prep guides, this book contains practice questions and exams. The one thing that sets this book apart from others is the inclusion of detail explanations as to the correct answer for each question. Sometimes you’re left wondering about the rationale behind a certain answer being correct or the “best” answer, but this book leaves no mystery with its detailed answer keys. This is one feature I’d definitely like to see in more exam prep books.

The New Insider Threat

It’s not a new threat really. People inside an organization can always be a threat. It’s just that many people, some of them prominent security professionals, have been downplaying the insider threat lately in order to hype other emerging threats. I’m of the opinion that we’ll see insider threats rise through the year and probably into next. As the economy worsens, people who are becoming financially stressed may turn to corporate crime, or may retaliate for being laid off.

Prime example, news this week of a former Fannie Mae contractor leaving a malicious script designed to wipe out thousands of computers after he was fired for…a scripting error he made earlier in the month. Luckily they stumbled upon the script before it was set to execute. They might not have been so lucky though. Bruce Schneier has some good tips about reducing the threat trusted individuals can pose.

In the end, you can take several measures to reduce your insider risk but you can never eliminate it entirely. At the end of the day the weakest link always comes down to people. People are sometimes dishonest, it’s simply a fact of life. Luckily for the rest of us, they seem to be a pretty small minority.

Nmap Network Scanning Review

Nmap Network Scanning by Fyodor
Title: The long winded title for this book is Nmap Network Scanning: The Official Nmap Project Guide to Network Discovery and Security Scanning, but I’ll just be calling it NNS.
Author: Gordon “Fyodor” Lyon
Rating: *****
Bottom Line: The definitive nmap book, for all your network scanning needs.

From the moment you start to read NNS, it is engaging and informative. The wealth of information contained in this book will have even hardcore nmap experts learning a thing or two about the preeminent network scanner. Of course, I expected nothing less from NNS because the author is nmap’s chief architect and programmer, Fyodor. Inside you’ll find his 11 years of network scanning experience distilled down into the ultimate nmap guide.

The material is presented in an engaging way, and wherever possible examples are given where the techniques described are applied in real world scenarios. The book is also littered with command line and output examples as well as diagrams. These items in addition to the text allow one to enjoy and learn from the book without having to sit in front of a command line and try every single command yourself. That said, it took me a bit of time to get through the book because I kept stopping to play with new options I’d learned. 🙂

From introductory network scanning (What’s a stealth SYN scan?), to scan optimization (Why is it taking so long?!), to advanced techniques (Learn how to write your own nmap plug ins!), NNS covers the gamut. Anyone who does even occasional network scanning with nmap (And you are scanning your network on a regular basis aren’t you?) owes it to themselves to pick this one up.

Interesting SANS posts

Some interesting posts on the SANS Internet Storm Center blog. I’m sure these have already been posted everywhere (I saw one on delicious earlier), but it’s always good to have these kinda things to refer back to later.

The first post is about targeted social engineering. One of the more interesting aspects:

In one incident, an attacker used phrases directly taken from a public blog, as well as a cordial greeting that the blogger had used when writing about a personal topic. This made the message significantly more authentic to the target, who duly clicked on the attachment.

Pretty clever. Anything you can do to make people even subconsciously believe a message is legitimate will increase your success rate. It only takes one person to fall for it in most cases, to get a foothold that you can leverage for a deep internal attack.

The other post is simply a list of what NOT to do when it comes to IT security. Some of the highlights:

  • Assume the users will read the security policy because you’ve asked them to.
  • Assume that policies don’t apply to executives.
  • Don’t review system, application, and security logs.
  • Expect end-users to forgo convenience in place of security.

I’d add a couple of my own to the list:

  • Assume that because you’ve never been compromised you’re secure
  • Assume that you can prevent all compromises
  • Protect only the perimeter
  • Have no incident response plan