Category Archives: security

MokaFive, a new take on portable virtualization

Posted on by
Reply

If you don’t want to bring your laptop with you but still want to carry most of your environment, tools, and digital documents, MokaFive gives you an interesting and secure way to do this. The software has a nice collection of utilities to pull this off, and while a bit quirky to get installed and operating, it could be a big convenience for people on the go. I say secure because the product is a lot safer than just using a borrowed PC at a public kiosk or library, too. And it is free, too!

You can read my complete review at Tom’s Guides here.

Using OpenDNS to protect your network

Posted on by
Reply

This week we had another Internet security exploit revealed. And while I don’t want to get into the details, let’s just say that if you aren’t using OpenDNS.com for your home network, now is the time to take the five minutes and get it done. It is simple (well, as these things go), it is free, and it will protect you from any number of issues in the future. And you might get better browsing performance as a result.

Before I tell you how to do this, let’s have a brief explanation of what the Domain Name System is for those of you that really want to know. Think of what a phone book (remember them, before we used online searches to look up a friend’s number, seems so quaint now) does – it allows you if you know someone’s name to look up their phone number. The names are in alphabetical order, so if you know the alphabet, you can quickly page through and find the person, if they are listed.

The DNS does something similar, except for computers: if you type in “google.com” it translates that name into a sequence of four numbers, called an IP address, which in this case for google.com is 72.14.207.99. Paul Mockapetris, a gentleman I have spent some time with and one of the Internet bright lights, put the thing together in the early 1980s, which is enshrined in RFC 882, even before Al Gore had invented the Internet itself.

The overall Internet infrastructure has a series of master phone books, or DNS root servers, located at strategic places around the world and maintained by a collection of public, semi-public, and private providers. They talk to each other on a regular basis, to make sure that as we add new domains they are in synch. As you can imagine, if someone wants to “poison” one of the entries,  or misdirect Internet traffic to a phony domain, it can be done with the right amount of subterfuge.

Here is where OpenDNS comes into play. When you set up your home network, typically you don’t give your DNS settings any further thought. If you have a cable or DSL modem, you hook it up and it automatically gets its DNS settings from the cable or phone company’s DNS servers.

What I am suggesting is that you change these settings, to reflect the DNS servers at OpenDNS. There are instructions on their Web site, but basically you specify the two (one is used for backup) DNS IP addresses for your router or DSL/cable modem. If you have a wireless gateway from Netgear or someone similar, you make the entries there. You need to know the router’s IP address, and how to access it via its Web interface.

There are a few nice things about using OpenDNS. First, you can set it up to block objectionable domains, so that you might be able to get around your kids seeing something that you would rather they didn’t. They also spend time to block known exploit domains, so you have a better chance of not getting trapped by some hacker. You also get better DNS service, because they have servers that will return the domains supposedly faster than the ones for the general Internet. They also catch common typos, so if you are like me and make mistakes typing in names in your browser, they can usually direct you to the place you intended.

How do they make money? If you type in an unknown domain name, you are directed to their search page where they show ads, just like the Google search pages.

OpenDNS is not the answer for everyone, and businesses should go a step further and protect their DNS servers on their networks. While I don’t want to get into that here, you can find out more about the explot from the experts, start with this blog post here:

http://www.circleid.com/posts/87143_dns_not_a_guessing_game/

It is sad that the Internet is at risk: this exploit is serious, and goes at the core protocol that everyone uses all day long. Hopefully, the engineers will find a fix soon.

Understanding two-factor authentication

Posted on by
Reply

There’s a lot to consider before you implement two-factor authentication, because it touches your enterprise infrastructure, applications and networks. The notion of using something whose only purpose is to help identify you to computing systems is older than the Web, but it’s gaining traction as the number of phishing and hacking exploits rises. 

In my story this week for Baseline magazine, I describe the various choices involved in two-factor authentication. 

Protecting your laptop

Posted on by
Reply

With the number of safeguards built into most of today’s computers, there’s no excuse for not protecting your laptop—and your company’s data. It may take a stolen or misplaced laptop for you to realize how easy it is for your company’s data to fall into the wrong hands when you travel. There really is no excuse for this, given the number of protective measures built into most computers these days. The key, of course, is to use these tools before an incident happens.

There are several ways to make your laptop more secure and I discuss them in my story in Baseline magazine this week.

Why endpoint security is still tough

Posted on by
Reply

Having tested a number of endpoint security products and lectured to several audiences is still no substitute for actually seeing what works and what doesn’t in the field. And while the products are getting better, there are still no magic, one-size-fits-all solutions. I wanted to share with you some of the things that I have learned from my visits.

First off, most of the vendors are very XP-centric, and some are only now just getting to supporting that other Windows OS that is finding its way on to desktops, you know, Vista? And when it comes to non-Windows, such as Mac OS, Linux, and PDAs, most of the folks are still behind the times. There are products such as StillSecure’s SateAccess that supports both agent and agentless operations, but still many of the agentless products only provide a small subset of protection that their Windows XP agents do. Of course, one solution is to just standardize on XP SP2 for all your desktops, too.

Second, remediation measures are spotty, and in some cases non-existent. When your security product finds a non-compliant endpoint, how do you get it fixed and what does the end user see? Do you shunt them off to a quarantined network, where they can’t do much beyond update their patch levels and browser protection? Or do you block them entirely? How you go about implementing this will impact your support resources, which is why many of you have not gone whole-hog into 100% remediation, even if it were available.

Third, how you manage your entire security policies across your enterprise can make or break which product you end up purchasing. Some of the products require more or less work to integrate with the firewalls, intrusion systems, and other protective measures that you have in place. In one situation, the corporation used its endpoint strategy to control network access by tying in biometrics. When a user authenticates by swiping their fingerprint, they gain access to the network resources and a fully-encrypted local hard drive too. (Seagate has a very nice built-in encryption to their hard drives that was being used in this case.)

Fourth, do you really need to protect everyone? Some of the shops I have seen implement their endpoint software for just consultants, guests, and others that aren’t on managed desktops. Some have to protect everyone, such as on the college campus of my alma mater Union College.  It largely depends on what your desktop population is: the proportion of managed machines, and the proportion of guest workers who are coming in the front door. The theory is that the managed desktop can be locked down and you don’t have to worry as much with these systems as with the random PC that walks in off the street, infected to the hilt. This can also apply to the remediation measures that you implement: you may want to start small here and work your way up too.

This column also appeared in Baseline magazine’s Web site this week.

MarkMonitor Brandjacking Index Spring 08

Posted on by
Reply

I continue to author this series of white papers for MarkMonitor about brand abuses across the Internet. This report looks at the online travel industry as well as the purchase of commercial aircraft components. Both are experiencing plenty of fraud — you would think selling pieces of F16s wouldn’t have much of a market online, but you would be wrong. There is also a brisk trade in online airticket vouchers, most of which aren’t transferable. That doesn’t stop the bad guys from trying to sell one!

You can download the report here.

Beware of network printer hacks

Posted on by
2

I am not sure that I should be telling you this, but your network is a sitting duck for a break-in that is both so elegant and potentially dangerous.

All you need is your Web browser and some basic knowledge, and while I have put a few things together in this post, it didn’t take me more than a few minutes of research to do it. This exploit can easily pass through your firewalls, it can get around your most sophisticated intrusion prevention systems, and once someone is inside your network, they can operate in full view of your anyone, avoiding the scrutiny of even the savviest network administrator.

How so, you might ask? Go to Google and type in the following text in the search field, and you’ll see an example of what I am talking about:

inurl:hp/device/this.LCDispatcher

What is going on here? Simple. Your print servers (among other devices that are connected to your network) have built-in Web and other servers that can be used to launch an attack on your network. Many of these print servers have been long forgotten about by anyone in IT. They operate from a position of trust inside your network—they have to, otherwise no one would get anything printed out on them. And if you click on any of the retrieved pages in our search above, you will be transported instantly to print servers that are sitting ducks for hackers to take over. I managed to connect to ones in China and Germany, and see that some are needing toner or paper, for example.

Yes, it will take a bit more work to install some rogue application, and yes, just Googling them isn’t really an exploit, but you should have gotten a chill up your back as I did when I first started thinking about this situation.

And print servers aren’t the only sitting ducks, just the easiest to explain. How many other IP-connected devices are running on your network that have been long since installed and forgotten about? Web cameras? Industrial equipment? Fax servers? Scanners? These last two could be even more trouble, because they come with phone lines to the outside world that a hacker could use for further exploits.

As the number of these networked devices increases, the situation is only going to get worse. So what can you do to stop these sorts of attacks? First off, take the time to first locate all these forgotten servers. Do a regular scan of what active IPs are out on your network, and see if you can associate all of them with known users. Start doing the research on the unreconized IP addresses.

Second, scan for traffic on port 9100, this is often the port used by print servers and it is an easy way to track down the servers that you have forgotten. Finally, take some time to read through this documentation from HP (if you have HP servers) or something similar from your vendor:

http://h20000.www2.hp.com/bizsupport/TechSupport/Document.jsp?objectID=bpj05999

Those of you that have additional commentary, I would love to hear from you, please post your suggestions and I will share them.

This column also ran in Baseline Magazine’s Web edition this week.

How to become a security expert

Posted on by
Reply

My friend Fred Avolio (who has helped me host my Web Informant mailing list for several years), has put together a master class that will teach even the most experienced IT person the important fundamentals of network security. (And I say this even with him plugging my first book on Internet Messaging.) What I like about Fred is that he has tremendous wisdom and perspective, and shows the reader some old stuff that is still very much au courant. This post is well worth a deep dive.

Free WiFi at Denver Airport: You get what you pay for

Posted on by
Reply

I have had several trips to Denver in the past year, mostly to visit my daughter in college. Last fall they turned on free WiFi at the airport, and while slow I thought it was a nice amenity, particularly as the airport is so far from any civilization that you usually have to allow plenty of time to get there.

Now the stories are out that they use a filter to block several Web sites, including those of Sports Illustrated and some tech blogging sites. (Irony alert: if you are actually reading this in DIA, you won’t be able to get to the above link, which goes to BoingBoing and is on the blocked list!) The reason for the block is to keep porn from the wandering eyes of kids.

The last time I was at DIA, the WiFi was pretty slow and virtually unusable, but my daughter has reported better results (I guess for Facebook and IM it is acceptable.)

Maybe in addition to a smoking section we need to have a porn-viewing section at airports. That would certainly motivate me to get to the airport early!  Come to think of it, why not have such sections on flights as well, once we start having WiFi access on the planes? I would sit there just to get away from the crying babies.

Baseline March feature: Think Hack

Posted on by
Reply

Defending your digital castle requires a little devious thinking so you can understand—and counter—threats.

These days you have to think like a hacker to protect your enterprise network. This doesn’t mean you have to invest in a lot of tools, have specialized knowledge or hire a security consultant. You just need the ability to understand your adversary’s thinking and methodologies to devise appropriate defenses.

There are three basic steps in the process, which you can read about in the article here in the March edition of Baseline.