Last week, in a surprise move, Microsoft announced Open Access to Protocol Documentation[microsoft.com]. Microsoft is releasing their protocol technical specifications for interoperability with Windows Vista, Windows Server 2008, Exchange, and others. This means third party and open source software will be able to “talk” directly with Windows components that had previously been closed to them. This is quite a change for Microsoft, who until now kept their protocols propriety, forcing vendors to reverse-engineer the protocols. This should result in greater support between open source products and Windows. I hope other companies follow Microsoft’s lead.
Archive for February, 2008
Microsoft Opens Its Protocols
Wednesday, February 27th, 2008This seems like a smart idea…
Wednesday, February 20th, 2008The new Boeing 787 Dreamliner has been widely reported as a feat of technological engineering. The plane has three separate networks on-board: an administrative network, a flight control/navigation network, and a passenger network. Everything about this plane seems cool from the Ethernet jacks in the armrest of every seat, to the completely computerized flight controls system, to the ability for the plane to automatically adjust humidity settings based on the number of passengers on-board. There’s just one problem. Reports indicate[foxnews.com] that the three networks (administrative, flight, and passenger) are not completely separated. There is at least the ability for one-way communications from one of the networks to another. But unless this is a connectionless, no guarantee of delivery, UDP-like fire-the-message-and-hope-it-arrives communications protocol, there are obviously two-way connections, even if control information was designed (in software) to be transmitted in only one direction.
So these networks are not air-gapped, the only foolproof way to prevent one network from talking to another. To make matters worse, it seems that the administrative network is accessible via Wi-Fi (for maintenance personnel), particularly while the aircraft is sitting at the gate. So a sufficiently skilled 16-year-old Johnny Q. Hacker could sit comfortably in an airport terminal with his laptop and attempt to hack into a 787’s administrative network.
I hope they are using WPA2 with AES encryption and rolling keys…
Legitimately bad
Saturday, February 16th, 2008I have spent a fair amount of time over the last several months analyzing the Security Information Management (SIM) market to see how products like Arcsight[arcsight.com], QRadar[q1labs.com], SecureVue[eiqnetworks.com], and enVision[rsa.com], could benefit us (and our customers) as a Managed Security Service Provider (MSSP)[truedigitalsecurity.com]. I was intrigued, then, when I picked up the December issue of The ISSA Journal and saw an article entitled, “Logs Do Not Lie.”
While there are many advertised benefits to SIM solutions (log management, forensics, threat management, compliance, etc.), one of the take-aways I had from this article regarding the benefits of using a SIM solution was the idea that authorized activity is not always the same thing as safe or legitimate activity.
The two examples provided by the article to illustrate this point involve website mirroring and file transfers. Website mirroring looks a lot like regular web browsing, except it is usually complete (every page is visited) and the pages are viewed in rapid succession. Firewalls and web servers typically log traffic suspected of mirroring the site, but it is not usually treated as actionable information because it is so similar to legitimate activity. Website mirroring is interesting, however, because it could be a precursor to a phishing attack, especially if the source of the mirroring is not a regular client or is located in an interesting geographic region.
The file transfer example is related to Network Behavior Anomaly Detection (NBAD), a feature provided in one form or another by many SIM products. The idea with this illustration is that a given network user may routinely transfer information via external File Transfer Protocol (FTP) servers. If, however, this user’s typical exchanges are around 10K and a 600M exchange is identified, it is noteworthy and probably merits further investigation.
Both examples illustrate the value in collecting information from the various sources on your network (routers, firewalls, servers, IDSs, etc.) in order to analyze and report on that information. Judging by the customer lists on the SIM vendor websites, it would appear that there are quite a few organizations already seeking to take advantage of this information.
February Microsoft Security Advisories
Friday, February 8th, 2008Heads up, everyone. Microsoft is preparing to announce 12 security advisories[microsoft.com] next Tuesday, 7 of which are ‘critical’ meaning that remote-code execution is possible. That’s not good. Stay tuned and stay on your toes…