Insecure Mag 3

A lot has happened in the security world in the past 2 months since the last issue of (IN)SECURE was
released. It s always a pleasure to hear from the readers and we re happy to report that interest has been
very high with many news and comments rolling in. Keep it up!
This time we have some well-known authors writing on very different topics. We re sure everyone will find
something they find to be interesting. To top it all, we re running a book contest whose winner will be the
people that send in the most interesting suggestions related to (IN)SECURE. Point your browser to
www.insecuremag.com/contest and be creative!
The editorial team:

Mirko Zorz
Berislav Kucan
Visit the magazine website at www.insecuremag.com
(IN)SECURE Magazine contacts
Feedback and contributions: editors@insecuremag.com
Advertising and marketing: marketing@insecuremag.com
Distribution
(IN)SECURE Magazine can be freely distributed in the form of the original, non modified PDF document.
Distribution of substantively modified versions of (IN)SECURE Magazine content is prohibited without the
explicit permission from the editors. For reprinting information please send an email to
reprint@insecuremag.com or send a fax to 1-866-420-2598.
Copyright HNS Consulting Ltd. 2005.
www.insecuremag.com 3
Combat The Rise In Web Attacks With Acunetix Web Vulnerability Scanner 2
Acunetix released Acunetix Web Vulnerability Scanner: a tool to automati-

cally audit website security. Acunetix WVS 2 crawls an entire website,
launches popular web attacks (SQL Injection, Cross Site scripting etc.) and
identifies vulnerabilities that need to be fixed.
Acunetix WVS is available as an enterprise or as a consultant version. A subscription based license can be
purchased for as little as $395, whereas a perpetual license starts at $2995. For more information visit
www.acunetix.com
SmoothWall Launches School Guardian
SmoothWall has launched School Guardian, an integrated Internet gateway firewall and
web content filter designed specifically for educational establishments. School Guardian
addresses the three major challenges faced by school and college networks - blocking un-
suitable web content, controlling access to Internet services and preventing attackers
from compromising private systems and critical data. To learn more visit
www.smoothwall.net.
Criston Releases Precision 5.2
Criston, the leading European provider of systems, patch and vulnerability man-
agement announces that Criston Precision 5.2, an integrated software suite
dedicated to systems and security management on a company-wide scale, is now
available. Precision 5.2 brings a revolutionary autonomic approach to customer
station management. Based on intelligent agent technology, the solution provides users with a tool that is
proven for carrying out the following applications: automatic IT assets inventory and management, large-
scale software distribution, remote administration, security patch management, OS deployment and mi-
gration, mobile device management, self-healing and supervision for systems, etc. More information about
Criston and their products can be found at www.criston.com
CyberGuard SG580 Appliance With Unified Threat Management Functionality
CyberGuard Corporation announced a new all-in-one, centrally managed desktop

security appliance to protect small and mid-sized enterprises against external
and internal threats to their network. A robust network security solution that uni-
fies layers of defense and response mechanisms, the CyberGuard SG580 pro-
vides Unified Threat Management functionality, including a powerful stateful-
inspection firewall, service-based intrusion detection blocking, Anti-Virus protection, and threat contain-
ment through Security Policy Enforcement. For more information visit www.cyberguard.com.
Trend Micro Offers Three New Anti-Spyware Solutions
Trend Micro, Inc. announced three new solutions that detect and remove evasive
spyware. Trend Micro Anti-Spyware represents the first significant offering result-
ing from the company's May 2005 acquisition of InterMute, Inc., a leading developer
of anti-spyware products, and offers immediate protection against some of today's
most insidious spyware programs.
New products include Trend Micro Anti-Spyware 3.0, Trend Micro Anti-Spyware Enterprise Edition 3.0 and
Trend Micro Anti-Spyware for Small and Medium Businesses 3.0. In North America, the suggested retail
price for Trend Micro Anti-Spyware 3.0 is $29.95 with renewal pricing at $14.95. The price for Trend Mi-
cro Anti-Spyware for Small and Medium Businesses 3.0 ranges from $20/seat at the 5-25 user level, to
$11/seat at the 501-1000 user level. For more information visit www.trendmicro.com.
BeCrypt Launches Disk Protect 3.0
BeCrypt, the leading UK encryption security company, has unveiled version

3.0 of its DISK Protect full disk encryption security solution for laptop and
desktop computers. DISK Protect 3.0 offers features specifically tailored to
the needs of business users, including Single Sign-On, secure hibernation,
removable media encryption and extended smart card support.
DISK Protect is easy to install using standard network deployment tools.

Once the user has entered his or her DISK Protect password and logged in to Windows, encryption is
transparent. Everything written to the hard disk is automatically encrypted and everything read from the
hard disk is automatically decrypted, while the user is unaware that anything extra is happening. Find out
more at www.becrypt.com.
Cost Of Sarbanes-Oxley Compliance Is At The Expense Of Other Security

Spending
A new report published by the Information Security

Forum (ISF) warns that the cost of complying with the
Sarbanes-Oxley legislation is diverting spending away
from addressing other security threats. The global not-
for-profit organisation with over 260 Members including half of the Fortune 100, says that many of its
members expect to spend more than $10m on information security controls for Sarbanes-Oxley. The
business imperative to comply also means that in many cases the true cost of compliance is unknown. For
more information about the ISF and a list of their members, visit www.securityforum.org.
With the growing reliance and dependence on our interconnected
world, information security is a subject of interest to nearly
everybody. Information security - with its focus on confidentiality,
integrity and availability - is frequently undermined by security
vulnerabilities.
One of the most drastic demonstrations of or even users being tricked into opening a
security vulnerabilities and exploits was malicious email. All these vulnerabilities
shown during a recently conducted ex- have one issue in common ‒ they cause
periment Time to Live on the Network 1. security exposure to an individual system,
During this test, default-installed, and not or even a whole organization.
fully patched systems were connected to
the Internet and were monitored for activ- The most prevalent and widely exploited
ity. Not surprisingly, within a few minutes security vulnerabilities are caused by pro-
the first system came under attack and gramming flaws in various software prod-
was completely compromised a few min- ucts and applications. Typical examples of
utes later. Security vulnerabilities and ex- such programming flaws are so called
ploits are a real world issue requiring fo- buffer overflows in computer programs.
cus and attention for enterprises as well Buffer overflows trigger accidental over-
as home users. writing of sections of memory, which can
be compared with people filling out hand-
Security Vulnerabilities ‒ The written forms, which provide one space
path to security breaches for each character of a person s name. If

there are not enough spaces for a per-
son s name you have the equivalent of a
Security vulnerabilities linger and conse-
buffer overflow in a computer program.
quently create a breeding ground for ex-
The result of a buffer overflow could
ploits, leading to security breaches. Secu-
crash the affected program, or even allow
rity vulnerabilities originate from many
an attacker to execute arbitrary code, and
different areas - incorrectly configured
therefore take over the system.
systems, unchanged default passwords,
product flaws, missing security patches,
1 Time to Live on the Network , Avantgarde, www.avantgarde.com/xxxxttln.pdf
The security research community as well information or for financial benefit. Fur-
as vendors identify and publish on aver- thermore, exploits are published widely
age 40 new security vulnerabilities per and serve as building blocks for worms
week in various products, from operating and automated attacks. Such malicious
systems, databases, applications to even programs replicate and circulate auto-
networking devices. Upon release of new matically on networks identifying un-
vulnerabilities they are being assigned patched systems. One of the first exam-
unique CVE (Common Vulnerabilities and ples of such automated attacks was the
Exposures) identifiers 2 to uniquely distin- Morris worm in 1988 3, followed by many
guish and reference them throughout more recent examples such as Slammer,
their life-cycle. Depending on the severity Blaster, Sasser, and other worms. Depend-
of an individual security vulnerability, it ing on the specific payload worms are car-
allows an attacker to bring down, access rying, in some cases the victims may be
confidential data, or take control of a vul- able to recover from the attack, but
nerable system. The software develop- mostly it is necessary to fully rebuild com-
ment community is responding with proac- promised systems to ensure system integ-
tive steps. Improved software develop- rity.
ment processes as well as continuous
A critical factor for the impact of an ex-
education of software engineers is one of
ploit is the timing ‒ how quickly the exploit
the steps taken to enhance product secu-
code is created and available for a specific
rity. Focused testing for security flaws
vulnerability. Recent automated attacks
helps to prevent and to identify such flaws
shrank the time-to-exploit window from
before products are released to the mar-
months to days and happened faster than
ket.
any possible human response. Rapid avail-
ability of exploits creates significant win-
Exploits and Attacks dows of exposure for organizations until
they remedy their critical systems. SQL
Exploits are specifically crafted malicious Slammer happened six months after dis-
programs which take advantage of secu- covery, Nimda was four months, Slapper
rity vulnerabilities and their systems. was six weeks, Blaster came just three
Browsing the web, reading email, or just weeks after news of the vulnerability, and
being connected to the Internet can lead the Witty worm struck the day after an-
to exploitation of security vulnerabilities. nouncement of the vulnerability.
Exploit programs are utilized by individual
attackers to target and take over an indi-
vidual system ‒ mostly with a specific mo- The diagram below illustrates compression
tive in mind, such as access to confidential of the discovery/attack life-cycle.
2 Common Vulnerabilities and Exposures , MITRE Corporation, cve.mitre.org
The most forceful scenario was the Witty structive payload; spread in an organized
worm, which on March 19, 2004 struck manner with more ground-zero hosts; had
about 12,000 computers running firewalls shortest interval between vulnerability
from Internet Security Systems. Witty disclosure and worm release (one day);
reached its peak after about 45 minutes. attacked only hosts running security soft-
At that time it had infected most of the ware; and proved that applications in a
vulnerable hosts. According to an analysis niche market are as vulnerable as those
by CAIDA and UCSD 3, Witty earned sev- from a software monopoly.
eral exploitation firsts : widespread, de-
Security Patches ‒ Protecting tion. Intrusion prevention technologies and

other filtering capabilities help to prevent
from Exploits
attacks without the immediate need of in-
stalling patches.
The timely installation of security patches
or other workarounds to every vulnerable
One of the key issues for every organiza-
system is a necessary defense mechanism
tion is to identify the perfect timing for
to prevent exploits from attacking and
patching vulnerable production systems.
compromising the system. In a perfect
Sometimes patching requires downtime
world a vendor provides security patches
and is disruptive. On the other side linger-
at the time of the release of a vulnerabil-
ing exploits require urgent attention. Patch
ity, providing users the ability to protect
strategies within organizations have ma-
their systems from exploits. Unfortu-
tured significantly over the past two years,
nately, this is not always the case, and
and organizations are building metrics to
sometimes a vulnerability becomes known
measure the severity and criticality of vul-
before remedies are available. In some in-
nerabilities to determine their urgency.
stances, even exploits had been circulating
Also, the implementation of predictable
before patches were available. These so
patch release schedules (i.e. monthly,
called zero-day exploits pose a significant
weekly) from various vendors helps to
danger putting users at risk from exploita-
eliminate the patch-of-the-day syndrome
tion. Applying security patches is not the
many organizations were struggling with in
only solution to the problem. Workarounds
the past.
exist to mitigate risk and prevent exploita-
3 See The Spread of the Witty Worm, Cooperative Association for Internet Data Analysis and University of California at
San Diego, www.caida.org/analysis/security/witty
The Vulnerability Management following questions should guide the proc-
ess. Is the vulnerability exploitable from
Process
any system on the network, or does it de-
pend on a user account on the target? Has
Successful defenses against network vul-
exploit code already been released? What
nerabilities require utmost understanding
business resources are affected by the
the nature of the risk they pose. Vulner-
vulnerability? Those factors are unique for
ability Management involves the process
every circumstance and determine the
of identification, prioritization, and reme-
threat level of a vulnerability within a spe-
diation of security vulnerabilities. Follow-
cific environment. Vulnerability bench-
ing the principle of You can't manage
marks, such as the SANS/FBI Top 20 4 are
what you can't measure , many enter-
frequently adopted to measure specific
prises have successfully implemented a
vulnerability exposure of an environment.
systematic vulnerability management
process involving the following six steps:
The Business Side of Vulner-
1) Discovery: Identification and discovery abilities and Exploits
of devices, systems, and network topology
to keep track of constantly changing net- Vulnerabilities have a measurable impact
works. on organizations of any size. When critical
2) Asset Prioritization: Assigning business systems are unavailable and data is not
values and priorities to individual systems accessible due to an attack, organizations
and applications. Network security teams are loosing valuable business. Many en-
should correspondingly prioritize their re- terprises implement vulnerability man-
mediation efforts based on asset value agement as a proactive process closely
and criticality to an organization. linked into a broader risk management
3) Assessment & Analysis: Comprehensive strategy. Business owners within an or-
analysis of systems as well as identifying ganization need to be involved to establish
criticality and severity of security vulner- the required support. Information about
abilities and security exposure. This in- security exposure is reported to the ex-
formation helps to determine what busi- ecutive level and in some organizations
ness resources are at risk and what needs even board level on an ongoing basis. In
attention first. particular, tracking vulnerability informa-
4) Remediation: Eliminating identified se- tion over time is a very valuable tool to
curity vulnerabilities by reconfiguring, up- justify security investment and to proof
dating or patching systems. Sometimes the return of investment. Other driving
workarounds can be applied as a tempo- forces for implementing a consistent vul-
rary solution. nerability management process are regu-
5) Verification: Validation of patches and latory requirements. In particular, indus-
workarounds to confirm proper remedia- tries where confidentiality and integrity of
tion. information (such as financial, health care,
6) Policy Compliance: Measuring and re- or other critical sectors) are most critical
porting against security policies and com- requirements, organizations perform regu-
pliance requirements, such as HIPAA, Sar- lar vulnerability audits to verify and report
banes Oxley, as well as industry specific regulatory compliance. Also, the popular
regulations. trend of outsourcing IT systems and op-
erations drives the implementation of se-
Driven by an organization s security policy, curity service level agreements, whereby
the vulnerability management process the outsourcing provider has to conform
should be implemented as a global effort to specifically defined metrics in terms of
within an enterprise. The level of threat a patching security vulnerabilities. Vulner-
vulnerability poses to an organization ability management processes and secu-
should determine the level of action. The rity audits are a vital part to measure and
enforce such service level agreements.
4 The Twenty Most Critical Internet Security Vulnerabilities , www.sans.org/top20
Actions to be Taken threats and remedies is a crucial success
factor.
In summary, security attacks on networks

and data are increasing in number and
• Regular Audits of Security Systems.
New automated audit solutions discover
sophistication. A new generation of auto- everything susceptible to attack, identify,
mated security threats is exploiting vul- and prioritize vulnerabilities, and provide
nerabilities faster than any possible hu- appropriate remedies.
man response effort. The timely and com-
plete detection of security vulnerabilities • Timely Patch Management. This critical
process frequently requires manual sup-
and rapid application of remedies is the
port with automated solutions to remedy
most effective preventive measure net-
systems in need of urgent care.
work managers can use to thwart auto-
mated attacks and preserve data security. • Implementation of Real-Time Threat
Prevention. Firewalls and intrusion pre-
Best practices can guide vulnerability vention systems can help stop attacks be-
management and remediation, helping fore penetration.
CIOs, chief security officers, network and
IT managers, and security specialists to
• Ongoing Evaluation of Security Policy.
Trend analysis provides data for enforcing
strengthen and prioritize the protection of
policy and ensures that security systems
internal and external networks. Protection
meet the ever-changing nature of attack
strategies include:
threats.
• Education and Awareness. Providing
users with actionable information about
Gerhard Eschelbeck is chief technology officer and vice president of engineering for Qualys, Inc. He
published the industry's first research derived from a statistical analysis of millions of critical vulner-
abilities over a multi-year period. Eschelbeck presented his findings before Congress, and is a signifi-
cant contributor to the SANS Top 20 expert consensus identifying the most critical security vulner-
abilities. He holds several patents in the field of managed network security and earned Masters and
Ph.D. degrees in computer science from the University of Linz, Austria. Eschelbeck can be reached at
ge@qualys.com.
The Tao of Network Security Monitoring: Beyond Intrusion Detection
by Richard Bejtlich
Addison-Wesley Professional, ISBN: 0321246772
By combining a couple of facts about Richard Bejtlich, such as being one of

the the biggest names in the information security community and being an
avid reviewer of technical books at Amazon (currently over 180 reviews
posted), you can be certain that his book must be a perfect read.
In "Tao of Network Security Monitoring" Bejtlich provides a wealth of informa-

tion on the NSM concept, where he especially focuses on products, process
and human interaction with NSM (covering both sides of the coin, security ana-
lysts, as well as attackers). It was also very interesting to read about all the
tools Bejtlich uses and recommends. Bottom line, great book for network se-
curity professionals.
SSH, The Secure Shell : The Definitive Guide, Second Edition

by Daniel J. Barrett, Richard E. Silverman and Robert G. Byrnes
O'Reilly, ISBN: 0596008953
In the second edition of this book, the authors cover the steps of SSH evolu-
tion in the past four years (the first edition was releases in early February
2001).
No doubt, the title of this book is true - this is the definitive guide into wonders
and possibilities of SSH. There is a lot of newly added stuff: deep understand-
ing of the SSH-2 protocol, coverage of the latest version of OpenSSH and SSH
Tectia, new chapters on running OpenSSH on Mac OS X and Microsoft Win-
dows, interesting case study on running a single sign-on between Windows
and Linux with Kerberos, etc. A must read for anyone that wants to know SSH.
Silence on the Wire: A Field Guide to Passive Reconnaissance and Indirect At-
tacks
by Michal Zalewski
No Starch Press, ISBN: 1593270461
This is a book aimed at an audience very much into computer security. It of-
fers a glimpse into some of the aspects of security that the majority of the
consultants didn t consider to be a threat at all. The point here is on how we
are all exposing ourselves to risks without even being aware of it.
The amount of detail is stunning for such a small volume and the examples
are amazing. Many have praised this book for bringing innovative thinking
into the world of security. You will definitely think different after reading this
title.
The author is a well known security expert and you can read an interview with
him in this issue of (IN)SECURE.
Windows Server 2003 Security: A Technical Reference

by Roberta Bragg
Addison-Wesley Professional, ISBN: 0321305019
As the author notes at the beginning, if you read this book (never mind if you
are a Microsoft or Linux buff), you may find that Windows Server 2003 should
have a place in your network.
Security was always a word that lot of people couldn't associate with the Red-
mond based giant, but publications like the one I am taking a look this moment
are here to prove them wrong. The book is planned to be a technical reference
for the security related part of Windows Server 2003 administration. Spread-
ing over 1100 pages, it covers an extreme amount of useful information that is
well suited for a long list of different knowledge level administrators.
Essential Mac OS X Panther Server Administration

by Michael Bartosh and Ryan Faas
There are tons of Mac users out there that are religiously using Apple prod-
ucts, so using Mac OS X Panther as a server solution shouldn't be a bad thing,
right?
This book will guide you through all the details you need to be familiar with to
call yourself a good Mac OS X administration. From the security perspective,
there are a couple of good info-packed chapters on setting up the firewall
service and a virtual private network.
Overall the authors provide a powerful in-depth walkthrough covering all the
aspects of configuring and using Mac OS X Panther as a server solution.
Cybercrime: Incident Response & Digital Forensics
by the Information Systems Audit and Control Association
ISACA, ISBN: 1893209687
This publication serves its content to the executives, giving them both informa-
tion as well as advices on the ever present cyber security topics such as: regu-
latory guidance, addressing cyber risks, creating incident response program as
well as basics on the digital forensic investigations.
The book is accompanied by a a rather lengthy set of step by step incident re-
sponse questionnaires.
Cybercrime: Incident Response & Digital Forensics is published by Information

Systems Audit and Control Association (ISACA) and it is not widely available.
You can get your copy from the ISACA web site - www.isaca.org.
Network Security Tools

by Nitesh Dhanjani and Justin Clarke
The title of this book implies that it contains information on popular network
security tools. While its main topic are this kind of tools, the content delivered
superseded my expectations and definitely placed this book among the most
interesting titles I recently came across. It did that because, while the authors
mention some of the popular security tools, they focus on extending the tool's
reach, by manually coding new signatures, detection algorithms and attack
mechanisms.
Some of the tools in the spotlight include Nessus, Ettercap, Hydra, Nmap,
Nikto and Metasploit network. As you progress towards the middle, you are hit
by some fantastic info on writing your own network sniffers (based on
libppcap) and packed injection tools.
Home Networking Simplified

by Jim Doherty and Neil Anderson
Cisco Press, ISBN: 1587201364
I was very surprised when I took a glimpse at "Home Networking Simplified".

We are used to receiving Cisco Press books, which are almost always very
technical and cover specific network technologies. This time Cisco targets the
average user by delivering a worthy publication discussing networking basics.
This 300+ pages guide is written in the way that makes it possible for the net-
working beginners understand what they need to do and how to do it in a fast
and efficient manner. All of the book's examples are accompanied by either
photos or illustrations, which makes the book pretty easy to apprehend. A
quite large portion of the book covers networking security where the authors
especially deal with wireless (in)security. If each average computer literate
household would own this book, the online world would be a much safer place.
A PDA is generally considered a simple computerized device that is
handy for email/task updates, listening to music, and playing games.
Unfortunately, this simple device mindset has created a loophole in
many corporate networks that can be exploited by attackers.
Since most companies barely recognize while much of this article will focus on
the PDA in their policies or control sys- Windows Mobile devices, the general at-
tems, they often have no idea how they are tacks can apply to a Treo just as easy as a
used on the network or at remote sites. Pocket PC.
This is bad. Not only can the PDA itself be
compromised to the point where an at- Obstacles for the PDA Attacker
tacker can access everything held in its
memory, but in many cases, the PDA itself One of the obstacles a PDA attacker has to
can be made into a trojan that can turn a overcome is the fact that the devices op-
network inside out. This article will examine erating system files are often stored in
just some of the ways that a PDA can be ROM. This can be a challenging obstacle
owned by an attacker and what can hap- because trying to debug a program that
pen as a result. runs from ROM is not always possible. As a
result, an attacker either has to target a
Defining the PDA 3rd party program, or probe a flaw via blind
testing (AKA blackbox testing).
For the sake of this article, a PDA is any
digital device that is used to assist the Second, almost every PDA is unique. For
owner with their daily task management. example, just because Dell and HP both
This includes, for the most part, all Pocket use Windows Mobile, doesn t mean it is the
PC devices, Palm based devices, Smart- same version. Both of these companies
phones, and related products. In addition install their own OEM software in addition
to these more obvious categories, the con- to the core OS files, which can really make
tent in this article also applies to handheld writing malware challenging. As if this isn t
computers that use the CE .NET platform. enough, ROM upgrades also have a huge
impact on how a PDA s file structure is laid
For example, many inventory scanners now out and how the core files are loaded. As a
use embedded operating systems that can result, there are major differences be-
run client/server based programs operat- tween any two PDA s memory addressing.
ing over a wireless link. Please note that
Third, attacking a PDA is relatively new. As files are processed and then subsequently
a result, there is little in the way of support deleted.
or documentation. An attacker has to be
dedicated to the point of obsessed, or else It was discovered early on that CAB files
have some exposure to the processor or self delete themselves after they are exe-
platform used on the target device. cuted. While this attribute is probably an
attempt to help PDA users keep their
The point is this: attacking a PDA is not as memory clean from clutter, it ironically be-
easy as attacking a PC, at least on the sur- haves similar to self deleting trojan files
face. However, once you accept the limita- that can be found on the PC. This alone
tions, a handheld can be a very easy plat- has very little in the way of substance
form to attack. The rest of this article will when it comes to security, but it is a very
demonstrate just some of the vectors and useful way to hide the installation of a
methods we discovered that can leave a backdoors into a PDA. Since the execution
PDA wide open for attack. of the CAB file can create new files and
registry entries, as well as update or delete
The CAB File existing ones, a user can easily be tricked
into installing malware that is hidden away
Cabinet files have long been used by Mi- inside a seemingly valid packaged file. For
crosoft to package up a group of files that example, how do you really know that CAB
are needed during the installation of a file you downloaded off the Pocket PC
software product. As a result, it is no sur- warez site really contains just the game
prise that the same CAB format is used on you thought was there? The good news is
Windows Mobile devices to install pro- that Windows Mobile 5 will not automati-
grams that are either directly downloaded cally delete executed CAB files. This won t
to the PDA, or passed over from the con- stop you from infecting yourself, but it will
nected Active Sync connection. The prob- allow you to investigate the files contents
lem isn't found in the fact that the PDA post install to see what kind of unwanted
uses these files, but more in how these files and settings might be lurking.
The point is this: attacking a PDA is not as easy as attacking a

PC, at least on the surface.
Autorun cated SD Atari game card. This card could

easily be passed around the workplace and
Another minor, but very significant threat infect every PDA user in the company. Of
to Pocket PC users is the fact that inserted course, it would be just as easy for an at-
media cards have the power to execute tacker to install a hidden FTP server, or
code via a relatively unknown Autorun fea- cause the PDA to instantly hard reset.
ture. As designed by Microsoft, if a file

named autorun.exe is placed inside a Soft and Hard Resets
folder named '2577' (on ARM based de-
vices) it will be copied to the local /Win- The PDA is a unique device in that it stores
dows directory and executed. If the its data on internal RAM/ROM memory
autorun.exe is a trojan or some other form chips. In general, the core OS files are
of malware, then it will be executed un- stored onto a flashable ROM chip, with all
knowingly by the PDA user. To illustrate additional programs and files being stored
just one of the possible abuses of the on RAM chips. The latest models have
autorun feature, imagine the conse- started to include more ROM based mem-
quences if the brador.exe trojan (dis- ory, and even drives, but this still not
cussed later) was renamed to autorun.exe where most documents, tasks, calendars,
and placed into the 2577 folder on a dedi- etc. are stored.
The side effect of this design is that the a few lines of code, as illustrated in listing
device must maintain a constant source of 1 below.
power or it will loose all this RAM based
data. Most people are aware of the side If you happen to download an executable,
effect of letting their batteries die, but or perhaps insert a media card with a hard
what most PDA users are not aware of is reset program setup for autorun, your
that a hard reset can be initiated with only PDA will be wiped.
#include <windows.h>
#include <winioctl.h>
#define IOCTL_HAL_REBOOT CTL_CODE(FILE_DEVICE_HAL, 15, METHOD_BUFFERED,
FILE_ANY_ACCESS)
extern "C" __declspec(dllimport)void SetCleanRebootFlag(void);
extern "C" __declspec(dllimport) BOOL KernelIoControl(
DWORD dwIoControlCode,
LPVOID lpInBuf,
DWORD nInBufSize,
LPVOID lpOutBuf,
DWORD nOutBufSize,
LPDWORD lpBytesReturned);
int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,

LPTSTR lpCmdLine, int nCmdShow)
{
SetCleanRebootFlag();
KernelIoControl(IOCTL_HAL_REBOOT, NULL, 0, NULL, 0, NULL);
return 0;
}
Listing 1: The Hard Reset Code
If you happen to download an executable, or perhaps insert a

media card with a hard reset program setup for autorun, your
PDA will be wiped.
The problem isn t so much that this code is free from attacks. The following outlines
exists. Instead, the problem is that the several of the potential ways PIE can be
KernelIOControl command responsible for attacked.
a hard reset is easy to access by any pro-
gram running on the PDA. DoS Attack
In other words, the lack of security of the Although PIE comes with a stripped down
kernel level command can turn a useful version of JavaScript, it is still possible to
function into a potential denial of service perform various annoying script based at-
program. tacks that will force the end user to reboot
their PDA. These are only worth mention-
Pocket IE ing as they are trivial. However, there are
several other problems within Pocket IE
In the PC world, Internet Explorer is the that cause the browser to instantly close.
target of many exploits. Fortunately, most One error in this program can be found in
of these attacks are impossible against the the way it handles HTML lists that use CSS
Pocket PC because Pocket IE (PIE) is a formatting, as illustrated in listing 2 on the
much stripped down version of its big following page.
brother. However, this does not mean PIE
<style>
#layer1 div.sublayer1 { width:50%; margin:0 1 2 3; padding:4;
float:right; }
#layer1 div.sublayer2 { width:50%; margin:0 1 2 3; padding:4;
float:right; }
</style>
<div id="layer1">
<div class="sublayer1">
<ul>111</ul>
</div>
<div class="sublayer2">
<ul>222</ul>
</div>
</div>
Listing 2: HTML Code that will Crash Pocket IE
URL Obfuscation PIE Domain Object Model
Several years ago, it was discovered that Frames have long been used by web de-
Internet Explorer would process Unicode velopers to help them present a collection
encoded URLs. When this flaw is combined of web pages all under one main frame.
with special allowances within the HTTP The catch to this is that code in one frame
protocol for user:pass@domain requests, cannot read from or write to the content in
you have a means to trick people into another frame. The reason for this is that
thinking they are clicking on a valid link. an attacker could hide malicious code in an
Unfortunately, they could be directed to a invisible frame and alter the content in an-
spoofed site. For example, the following other frame such that an end user could
link will take you to www.airscanner.com, be tricked into giving up personal informa-
not www.paypal.com as one may think. tion. The following demonstrates just one
Given the limited size of the PIE address way this could be exploited. Notice the URL
bar, it is easy to imagine that someone which apparently points to
would not suspect they have become the Johnny.ihackstuff.com, but actually points
victim of an attack. to a framed webpage on the Airscanner
http://www.paypal.com&login.ran web server. Once the page loads, the con-

d-%00%01AE67D12EF9090AB933@%36% tent on the main page of Johnny s website
39%2E%30%2E%32%30%30%2E%31%30%3 is altered via hidden code running in an
6/ invisible frame (figure 1).
Figure 1: Using XFS to Alter Web Content

PIE Local File Access trolled by a ROM based DLL file that holds
both the graphic for the input panel and
Another quirk with PIE is that it can access the code needed to convert input from the
local files on the PDA. Combine this with stylus into characters. For example, the
the previously described problem with the main Keyboard option is all controlled by a
domain object model security and there is file called MSIM.DLL.
a risk for exploitation. The following is just
a small list of the types of files that can be Thanks to the way the input panel was de-
loaded into a PIE frame: signed, it is rather easy to create a new
keyboard and install it onto the PDA. In
• xls
fact, there are several keyboard packages
• htc & htp (in IE)
you can buy and install. With this in mind,
• cpl (Control Panel) items
we created our own keyboard with a little
• ini files (in IE)
bit of extra code that captured the input-
• 2bp images (in IE)
ted character and placed it into a text file.
• go to any folder
Next we figured out what registry settings
• go to 00 (root) folder
needed to be altered to remove the exist-
ing Keyboard entry. Finally, we worked
One potential vector for abuse was found
out the necessary registry keys that would
in the fact that PIE can be tricked into
allow our new keyboard to be loaded with
loading up previously cached webpages,
the name of Keyboard , and packaged it all
which can then be altered by code in a
up into a CAB file. After a few tests and
hidden frame. For example, we learned
some trouble shooting, we had a working
that it was fairly simple to pull up a cached
keyboard logger that looked and acted like
version of the Paypal.com home page, alter
the default keyboard that comes with our
the Form field properties to point to our
version of Windows Mobile, except it out-
own server, which would then capture any
putted a copy of each character into a
passed user credentials when the submit
hidden file.
button was pressed.
The following lists the registry settings we

Keyboard Logger
had to update:
The PC world has long been wary about

keyboard loggers because they have been • IsSIPInputMethod disabled for real
used by attackers for many years. How- keyboard
ever, when it comes to the Pocket PC, not o CLSID: 42429667-ae04-
much thought is given to the possibility of 11d0-a4f8-00aa00a749b9
a logger that can capture all your key- (set 1 to 0)
strokes because the concept of a key- • Keyboard name & icon borrowed
board is completely different. by keylogger.dll

• New keyboard has own CLSID with
settings
Instead of a physical button based key-
• HKCU\ControlPanel\SIP\Defaul-
board, the Pocket PC uses a SIP (Soft In-
tIM\{CLSID}
put Panel) that combines a graphical key-
• IsSIPInputMethod enabled for fake
board with some code to emulate key-
keyboard
presses and output a character into the
part of the screen that has the focus.
Once installed, the end user will have no
While it is true that this makes it a little bit
idea their keyboard was swapped out for a
harder to capture keystrokes, it is by no
newer improved model. In addition, the
means impossible.
only way to tell that a new DLL is being
loaded with the system is if you use a de-
When you PDA boots up, it first scans the
bugger to view the DLL files associated
registry for all installed input panels. By
with the executable responsible for han-
default, this includes the Block Recognizer,
dling the keyboard and other hardware on
Keyboard, Letter Recognizer, and Tran-
the PDA.
scriber. Each of these methods is con-
Forensics/ROM Rips scene. To help with this, there are several
forensics programs available that can
The PDA has a very limited amount of data make short work of pulling across the en-
storage ability, with the exception of the tire contents of the PDA. For example, Pa-
1+ gig memory cards you can now buy for raben software makes just such a program
them. However, if you want quick access to that temporarily installs a client on the
that data you would have to take the PDA PDA and uses that to create a connection
back to your computer, hook it up, and with a PC to download the contents of the
manually copy over all the data stored on PDA. In addition to this, there are several
the device. At least, that is unless you take tools available at sites like xda-developers
advantage of the power of a forensics or that can extract the entire contents of
ROM/RAM data dumper. your PDA into an inserted SD card via the
autorun.exe method we discussed earlier.
What this means to the PDA owner is that
The law enforcement community has
their PDA only has to be in the wrong
started to notice PDA s and now examine
hands for a short period of time for it to
them when they are found at a crime
have its contents complete ripped.
The law enforcement community has started to notice PDA s

and now examine them when they are found at a crime scene.
Disassembling Binaries To get inside the binary files on a Pocket

PC, you will need a few programs. First,
The Pocket PC/Windows Mobile platform is you will need a disassembler to convert the
typically run on an ARM processor, which raw hex code into a more readable opcode
is common in low heat and reduced power format. We generally use IDA Pro, which
environments. understands Windows CE files. Second, we
use the debugger included with Embedded
This small fact combined with the limited CE++ from Microsoft.
number of instructions (ARM - Advanced
RISC Multiprocessor //RISC ‒ Reduced In- This is needed to watch and change the
struction Set) makes learning and under- operation of the code on the fly and to
standing the ARM instructions relatively generally see what is happening live. Fi-
easy, especially when compared to other nally, you will need some sort of hex editor
processors. to make changes to the code for on sys-
tem testing. We use UltraEdit, but there
The first thing you would need to under- are many other options. Once you have all
stand to disassemble binary files is how a these tools, you can start peeking around
processor works. In general, it read the inside your Windows Mobile device to see
opcodes at a specific location in memory what is really happening.
(program counter) and performs the very
specific command. Depending on the in- The only other item to deal with is that you
struction, the processor will add, subtract, have to understand the opcodes and in-
branch to a different part of the code in structions used by the processor.
memory, or even do nothing at all. To help
the processor do its job, it has 32 regis- In other words, you have to speaking the
ters, which are nothing more than 8-byte language of ARM assembly. Fortunately, by
memory storage sites located in the proc- understanding o the following few instruc-
essor. This onsite storage simply helps the tions, it is possible for you to read and
processor move faster by keeping memory even write ARM based assembly code that
access local, instead of reading and writing can run on a Pocket PC.
directly to and from the RAM.
Move (MOV) - Moves a value into a regis- There are other opcodes that you will
ter. This could be a hard coded value or come across. If you really want to dig into
the data in another register. a processor at this level, we recommend
you visit www.arm.com and download their
Compare (CMP) - Compares the value in a processor manuals.
register with a hard coded value or the
data in another register. Backdoor FTP
Branch (B) - Branches the execution to a Once you understand how a program
specified memory location. works at the processor level, you can do all
kinds of things to change its functionality.
Branch Link (BL) - Branches the code exe-
cution, and then returns to original mem- In this specific case, we were able to turn a
ory address. visible and perfectly legit FTP server (fig-
ure 2) into a hidden and undetectable
Load Register (LDR) / Store Register (STR) backdoor.
- Stores data or loads data to or from the
RAM into the processors registers.
Figure 2: Visible FTP Server Icon
To do this, we first locate the code respon- We also changed the default port number
sible for the icon that appears on the menu from the standard port 21 to a higher port
bar. This took a few minutes, but thanks to number that would probably not attract
the function name listing in IDA Pro, we much attention. This was as simple as lo-
traced this part of the code back to a cating the hard coded port and changing it
function named Shell_NotifyIcon. Once to the hex equivalent of our preferred
found, we then changed the code as fol- port.
lows:
Hidden Remote Control
MOV Shell_NotifyIcon to MOV R0,
For our next example, we found another
R03A 01 00 EB to 00 00 A0 E1
program that gave us remote control ac-
cess to the Windows Mobile device; vRe-
The left side shows the original command,
mote.
below which is the original hex values. To
remove the icon, we updated the code to
This program again had a very visible win-
never show the icon. In its place we in-
dow that pops up on startup, which we
serted a virtual non-operation (NOP) by
wanted to remove (figure 3 on the follow-
writing in the command to move R0 into
ing page).
R0.
Figure 3: vRemote Window
The following shows the changes we made, of malware for Windows Mobile device. Al-
which complete removed all visible indica- though the number of malware is small,
tion that the vRemote program was run- their technical sophistication is great, as
ning on the device. we will discuss next month in part two of
this series.
BL ShowWindow to MOV R0, R0 (Vir-

tual NOP) Network Based Attacks
A6 15 00 EB to 00 00 A0 E1
The Windows Mobile platform is designed
Again, we were able to do this by targeting for wireless networking. As a result, it is
the ShowWindow function in IDA and vulnerable to many of the same types of
overwriting it with a simple NOP function. problems that regular PC s must deal with
In this case, we also had to overwrite two on an hourly basis. The following outlines
other parts of the program that made ref- several types of attacks that can be used
erence to this code. against a PDA over a network.
The point of these two examples is that Denial of Service

Windows Mobile programs can easily be
altered to create malicious versions that
A PDA generally uses a low power wireless
can create havoc or assist an attacker in
network card to access a local Wi-Fi net-
gaining access to sensitive data stored on
work. From here it can use the web, down-
a PDA. If this low level modification is in-
load email, etc. Since this device is lower
teresting, you can read more about it in
power, its wireless signal strength is not
Aggressive Network Self Defense . Chap-
that strong. As a result, it is rather easy to
ter one of the book goes into great detail
create enough interference using a rouge
about how two PDA owners fight a digital
access point or laptop to keep a PDA from
war by modifying and re-modifying code at
getting a good connection. In addition, it is
the ASM level.
sometimes possible to perform a rapid
ping DoS against a PDA, which simple
Known Malware takes up enough resources that the PDA
slows to a crawl. Finally, an attacker can
Windows Mobile has not yet attracted target services on regular PC s, such as
much attention when it comes to publicly the Active Sync port 901, which will keep
released viruses and Trojans. In fact, to an associated PDA from ever establishing
this date, there are only two known pieces a connection.
Since DoS attacks are a dime a dozen we The next issue that can affect PDA owners
will not spend any more time on them. Just is Bluetooth denial of service attacks. One
know that they can be used by attackers. method for this is to send a ping packet
to the Bluetooth enabled devices, which
Bluetooth Issues ties up the system resources and ensures
no one else can connect to the device.
Bluetooth attacks have long been making

headlines. However, when it comes to the There are also other related attacks that
details of the attacks, most of them are can disable or disrupt service.
targeted for the cell phone, not the PDA.

Despite this, there are a couple issues that PIN cracking is the final issue we would like
we should address. Note that these prob- to mention. Since Bluetooth is only pro-
lems may or may not affect your device tected by a 4-digit pin number, it is fairly
depending on the Bluetooth software in- easy to brute for attack the pin on a target
stalled by the vendor/OS maker. device. Generally, this can be accomplished

in several hours, depending on how many
The first is the attack of bluejacking, client devices are guessing the pin and if
which is really nothing more than sending the right programs are used. It is also pos-
messages to a Bluetooth enabled PDA or sible to find non-discoverable devices via a
phone. There are numerous sites online, brute force approach that scans for MAC
such as bluejackq.com where you can addresses used by Bluetooth devices.
learn more about this issue.
Since Bluetooth is only protected by a 4-digit pin number, it is

fairly easy to brute for attack the pin on a target device.
Wi-Fi Issues Buffer Overflow Attacks
Wireless networking attacks against a PDA It seems as if every day brings a new
are not specifically a PDA threat. However, buffer overflow exploit against some PC
given the fact that PDA owners generally based program. As a result, most people
use Wi-Fi connections to view email, con- are familiar with the term. However, how
nect back to the office, and surf the inter- many people look at a PDA and think they
net, we have to at least mention this vector could be attacked via the same type of
of attack. weakness?
In short, a PDA owner can be attacked in As it turns out, Windows Mobile devices
the following ways: WEP key cracking, WPA are vulnerable to buffer overflow attacks
key cracking, MiTM attacks, web content in much the same way as their big broth-
injection, sniffing related issues, rouge ers. In fact, it only took us about 10 min-
AP s, and denial of service attacks. utes to find one in the same FTP server
program we previously discussed.
Using these types of attacks, an malicious
hacker can capture and view emails, obtain Specially, the ftpsvr.exe file uses the gen-
access to corporate networks, learn pass- eral FTP commands much like any other
word information, trick PDA users into ac- FTP server. However, it fails to properly
cessing spoofed content online, and much check the parameters of the command,
more. which means an attacker can overflow the
memory stack with raw code with a long
The point is, every thing that affects regu- and padded hex string that contains ARM
lar PC users when it comes to wireless assembly code.
connectivity, also affects PDA owners.
While the details vary from device to de- ally requires ARP manipulation or some
vice and OS version to OS version, we dis- other type of network trickery. The excep-
covered it was possible to inject the code tion to this is the wireless network, which is
responsible for a hard reset over a net- where most PDA s operate.
work and cause a PDA to hard reset.
A wireless network operates much like a
Fortunately, buffer overflow attacks are hub, when looking at it from a sniffers per-
somewhat limited on a PDA. Since there is spective. All the data is available to any
no real command shell, an attacker would device that is close enough to see the traf-
have to essentially upload an entire pro- fic. Since PDA s often go unnoticed and
gram to gain access to the Pocket PC. can be used inconspicuously, it provides
an attacker with the perfect device to get
On the other hand, brador is a small trojan inside a building and collect wireless traffic
and could be used in just such an attack. for future analysis.
PDA Attack Tool While Windows Mobile based sniffers gen-

erally require the user to be associated
We demonstrated several ways that a PDA with a network before it will detect any
can be abused and attacked. However, this traffic, Linux based Pocket PC s can cap-
is just one side of the story because a PDA ture data easily on any selected channel
can also be used to facilitate attacks using popular tools like Kismet or
against other computer users. tcpdump. Figure 4 is a screen shot of a

vxSniffer capturing the data from another
This section will look at just some of the wireless user as they view Google.com.
ways that a Pocket PC can be used by an

attacker to penetrate a network from the It is also important to note that a Pocket
palm of their hand. PC can include an Ethernet card as well as

a wireless card.
Sniffer
With this optional component installed, it is
possible to plug a PDA into a switch or hub
A sniffer provides the user with a look into
and directly access the data passing over
the data that is traversing the network. In
the wire.
today s switched network, sniffing gener-
Figure 4: vxSniffer in Action
Vulnerability Scanner stalled, it is fairly easy to build perl scripts
that can do all kinds of automated pene-
Once a PDA has access to a network, it can tration testing.
perform the same kind of scans and
probes that typically are ran from a regu- Drop and Go Backdoor
lar computer. Ping scans and sweeps,
probes for popular services, and even ex- A PDA is a fairly cheap device. You can
ploits can be execute from a Pocket PC in pick an iPAQ off Ebay for under $100.
order to penetrate a network. For example, Combine this with an extension sleeve, a
we use an iPAQ running Linux routinely to wireless NIC and Ethernet card and you
perform nmap scans and more inside tar- have the perfect drop and go backdoor
get networks. In addition, with Linux in- into most any network (figure 5).
Figure 5: An example iPaq Backdoor with Linux, WNIC, and Ethernet NIC
The following outlines the general steps to 5. Take device to site and find a free port
having a disposable hardware based back- behind a printer, under a desk, or in a
door that can be easily dropped into a wir- closet and plug it in. If necessary, you can
ing closet and remotely accessed via a use a passive hub to create a free port be-
wireless link to provide anonymous access tween an existing computer and the wall.
into a companies network. 6. Turn on PDA and walk away. Then from
laptop or another PDA, establish a connec-
1. Install familiar Linux onto iPAQ. tion with the PDA using the pre-established
2. Install drivers as needed for wireless IP address, and connect via an ssh tunnel.
card and Ethernet card. 7. You can now run tcpdump to establish
3. Create a script to configure the wireless correct internal IP scheme, and configure
card upon boot up in ad-hoc mode, with Ethernet card with corresponding IP ad-
optional encryption, on a free wireless dress information.
channel.
4. Install ssh, tcpdump and nmap on the The rest is up to you to figure out...
iPAQ.
If you don t think this is a reality, we re- protection strategy. To address problems
cently used this exact setup in a site test for enterprise users, we will take a closer
and were able to connect to their network look at the details behind implementing an
remotely via the P2P wireless link. In addi- enterprise wide PDA security policy in part
tion, one of the Stealing the Continent three of this series.
books from Syngress outlines a similar
type of device they call a creeper . The Summary of PDA Attacks
point is, a PDA makes for a great dispos-
able device that an attacker can drop in A PDA can provide its user with games,
behind a firewall and use to remotely own productivity tools, web browsing, email,
your network. document writing, and more. However,
along with these valuable tools comes a
Securing the PDA risk that can not be denied ‒ a Pocket PC
can become the target for attack. Be it a
By this point you should be able to recog- malicious piece of code, or a Pocket IE
nize many of the dangers involved with trick, it is important to recognize that that
owning and using a PDA. For the SOHO PDA is not free from harm. In addition to
user, most of these problems can be miti- this, it is also important to see the PDA as
gated through the same general care a potential threat to your own security.
shown when using regular PC s; don t These devices are easy to smuggle into a
download unknown files, use antivirus and business and can be used to propagate an
firewall as needed, etc. However, the en- attack against network devices. Don t
terprise environment is a different issue. make the mistake of assuming a PDA is a
Here the company is responsible for moni- simple date keeper. As the cliché goes, it
toring and controlling PDA use, which re- isn t the size the counts... it is how you use
quires a more complex prevention/ it that matters.
Seth Fogie is the VP for Airscanner.com, a mobile device security company, where he is responsible for
the product testing, research and development. Seth is also a regular speaker at conferences such as
BlackHat and Defcon, and has authored numerous articles and books related to information security,
the latest which is Aggressive Network Self Defense from Syngress.
8th Information Security Conference (ISC'05)
21 September-23 September 2005 - Singapore
http://isc05.i2r.a-star.edu.sg/
The 4th International Workshop for Applied PKI (IWAP'05)

21 September-23 September 2005 - Singapore
http://iwap05.i2r.a-star.edu.sg
IT Security World 2005 Conference & Expo

26 September-1 October 2005 - Hyatt Regency San Francisco, USA
http://www.misti.com/
HealthSec 2005 Conference & Expo

28 September-30 September 2005 - Hyatt Regency San Francisco, USA
http://www.misti.com/virtprogHS05/program.asp
RSA Conference Europe 2005

17 October-19 October 2005 - Austria Center, Vienna, Austria
http://2005.rsaconference.com/europe
CNIS 2005: IASTED International Conference on Communication, Network and

Information Security
14 November-16 November 2005 - Phoenix, USA
http://www.iasted.org/conferences/2005/phoenix/cnis.htm
Asiacrypt 2005
1 December-4 December 2005 - Chenna, Madras
http://www.iacr.org/conferences/asiacrypt2005/
3rd International IEEE Security in Storage Workshop

13 December-13 December 2005 - Golden Gate Holiday Inn, San Francisco, USA
http://www.ieeeia.org/sisw/2005
RSA Conference 2006

13 February-17 February 2006 - McEnery Convention Center, San Jose, CA, USA
http://2005.rsaconference.com/us/C4P06/
Recent versions of the popular port scanner Nmap can detect the
type and version of services running on a network. This is illustrated
in example 1 below:
Example 1. Example Nmap version scan
>nmap -sV 127.0.0.1

Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2003-07-05 17:12 EDT
Interesting ports on localhost (127.0.0.1):
(The 1658 ports scanned but not shown below are in state: closed)
PORT STATE SERVICE VERSION
22/tcp open ssh OpenSSH 3.8.1p1 (protocol 2.0)
Nmap run completed -- 1 IP address (1 host up) scanned in 1.104 seconds
This scan is implemented as a series of probes will be attempted if the protocol and the port
and responses in the file nmap-service-probes. ranges in the file match. If a response matching a
probe is found, processing stops. If a soft match
This file defines the probes that will be sent to the occurs (whereby a service is recognized, but not
service to elicit some response, as well as a series its type or version), follow-on probes will be
of regular expressions against which to match limited to relevant ones.
responses to determine which services are
running and, where possible, their versions. • If no match is found, each probe in the nmap-
service-probes file will be tried, regardless of
At a high level, the version-scanning methodology the ports on which the service usually runs. This
follows this process: will be limited where a soft match has already
occurred.
• If the port is a TCP port, connect to it and listen.
This is called the NULL probe. Many services will
return a banner on connection. If a match is made,
• If SSL was found, Nmap will connect using SSL
(if available) to run the version-detection process
processing stops. again.
• If no match is given, or if the protocol is UDP,

probes defined in the nmap-service-probes file
If a service responds to a probe sent during this You can use this, together with the version and
process, but Nmap does not recognize the service information, to include a signature that
response, Nmap prints a fingerprint for the recognizes this service in the nmap-service-
service that you can use to report the signature to
probes file in the future.
the Nmap developers, as shown in example 2.
Example 2. Nmap unrecognized service
>nmap -sV -p 4738 127.0.0.1

Starting nmap 3.50 ( http://www.insecure.org/nmap/ ) at 2003-07-05 17:39 EDT
Interesting ports on localhost (127.0.0.1):
PORT STATE SERVICE VERSION
4738/tcp open unknown
1 service unrecognized despite returning data. If you know the service/version, please
submit the following fingerprint at http://www.insecure.org/cgi-bin/servicefp-
submit.cgi :
SF-Port4738-TCP:V=3.50%D=7/5%Time=40E9CA80%P=i686-pc-linux-gnu%r(NULL,59,"
SF:Login\x20with\x20USER\x20<name>\x20followed\x20by\x20PASS\x20<password>
SF:\x20or\x20ANON\r\nCheck\x20privileges\x20with\x20PRIVS\r\n")%r(GenericL
SF:ines,59,"Login\x20with\x20USER\x20<name>\x20followed\x20by\x20PASS\x20<
SF:password>\x20or\x20ANON\r\nCheck\x20privileges\x20with\x20PRIVS\r\n")%r
SF:(GetRequest,59,"Login\x20with\x20USER\x20<name>\x20followed\x20by\x20PA
SF:SS\x20<password>\x20or\x20ANON\r\nCheck\x20privileges\x20with\x20PRIVS\
SF:r\n")%r(HTTPOptions,59,"Login\x20with\x20USER\x20<name>\x20followed\x20
SF:by\x20PASS\x20<password>\x20or\x20ANON\r\nCheck\x20privileges\x20with\x
<cut>
Nmap run completed -- 1 IP address (1 host up) scanned in 75.504 seconds
At this point we have several options: • Create a working match and/or probe
statement for your own use. You might choose
• Submit the signature to the URL provided and this option if your environment contains custom-
wait for the next version of Nmap. If responses written software running proprietary services or
were received from the probes sent, and the protocols. In this case it is necessary to know how
service is something that could be expected to be to write the probes and matches to detect these
running on someone else s environment, this proprietary services running on the environment
might be the best choice. being tested.
• Create a working match and/or probe Regardless of which option you choose, it is very
statement, and submit that to Fyodor at useful to know how to write your own probe and
fyodor@insecure.org. match signatures.
For services that require a custom probe and can The nmap-service-probes File
be expected to be found in another environment,
this might be the best choice. The keywords contained in the nmap-service-
probes file are listed in Table 1.
Table 1. nmap-service-probes keywords
Keyword Format
Probe Probe <protocol> <probe name> <probe string>
match match <service> <pattern> [version info]
softmatch softmatch <service> <pattern>
ports ports <portlist>
Table 1. nmap-service-probes keywords (continued)
Keyword Format
sslports sslports <portlist>
Totalwaitms totalwaitms <milliseconds>
Probes
A probe entry consists of the values shown in Table 2 below:
Parameter Description
Protocol TCP or UDP.
Probe name Name of the probe (human-readable).
Probe string String starting with a q, then a delimiter that will start and end the string sent. The
string can consist of printable characters, as well as quoted unprintable characters
and control characters in standard C or Perl notation.
Here are some example probe strings:
Probe TCP NULL q||

Send nothing, waiting the amount of time specified in totalwaitms.
Probe TCP GenericLines q|\r\n\r\n|

Send carriage return, newline, carriage return, newline.
Probe UDP DNSStatusRequest q|\0\0\x10\0\0\0\0\0\0\0\0\0|

Send the binary string 0x00 0x00 0x10 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00 0x00.
Matches
A match entry consists of the values defined in Table 3 below:
Service Name of the service the pattern matches.
Pattern A Perl-compatible regular expression to match the expected response for this
service. This is of the format m/regex/opts.
Version info A field specifying additional version information. This is of the format v/product
name/version/info/. This can contain variables matched from the matching
pattern, such as $1, $2, where the matching pattern contains ( ) matches. Any or
all entries can be empty.
Nmap uses the Perl Compatible Regular Perl regular expressions are documented at
Expressions (libpcre) library for evaluating www.perldoc.com/perl5.8.0/pod/perlre.html
regular expressions.
Here are some example match strings:
match ssh m/^SSH-([.\d]+)-OpenSSH[_-](\S+)/ v/OpenSSH/$2/protocol $1/

Match strings such as SSH-1.5-OpenSSH-3.4p1, reading the version string (3.4p1) and protocol (1.5) into
the $2 and $1 variables, respectively.
match ftp m/^220[- ].*FTP server \(Version (wu-[-.\w]+)/s v/WU-FTPD/$1//

Match strings such as 220 FTP server (Version wu-2.6.0) and extract the version
wu-2.6.0.
match mysql m/^.\0\0\0\n(4\.[-.\w]+)\0...\0/s v/MySQL/$1//

Match the version of MySQL 4.x from the binary response.
Soft matches
A soft match occurs when a service can be identified, but no additional information can be derived. A soft-
match entry consists of the values defined in Table 4 below:
Service Name of the service the pattern matches.
Pattern A Perl-compatible regular expression to match the expected response for this
service. This is of the format m/regex/opts.
Here are some example soft-match strings: sslports
•server.*\r\n/i
softmatch ftp m/^220[- ].*ftp
sslports is a comma-separated list of ports, as
well as port ranges (e.g., 55522‒55525) on which
• softmatch imap m/^\* OK [-.\w,:+
]+imap[-.\w,:+ ]+\r\n$/i
the service will commonly run over SSL. This is
used to ensure that probing is done efficiently,
and therefore the sslports entry should follow
ports the Probe and ports entries in nmap-service-
probes.
ports is a comma-separated list of ports, as well
as port ranges (e.g., 35067‒35090) on which the
totalwaitms
service will commonly run. This is used to ensure
that probing is done efficiently, and therefore the
totalwaitms is used to specify the timeout for a
ports entry should follow the Probe entry in
Probe. It is not needed unless the service you are
nmap-service-probes.
probing does not respond immediately. If it is
used, it should follow the Probe entry.
Excerpted from Network Security Tools by Nitesh Dhanjani and Justin Clarke (ISBN: 0-596-00794-9).
Copyright 2005, O'Reilly Media, Inc. www.oreilly.com All rights reserved.
The enterprise environment, like any large collection of individual
roles and responsibilities, is based on a hierarchical structure that
has pretty much gone unchanged since the first corporation opened
it s doors.
There is the CEO, there may be a President their reputations. The minute all hell
- although often the CEO and the President breaks loose in the papers, people are
are one in the same ‒ and then there is a pointing fingers. Conspiracy theories
coterie of high level positions that are or abound - if you re an executive with the
aren t there depending on the structure of words Security or Information in your
the company and their target market. title, you re basically responsible for just
about everything as far as the media and
At any given time you can have a CFO, a most of the industry is concerned.
CTO, a COO and a CIO. Add security to that
in the form of a CSO or, in more specific After every major security breach comes
cases a CISO, and that s a lot of salary, an eventual corporate disclosure and these
expertise and ego to keep track of. The job disclosures fuel endless speculation about
of keeping them all in line usually falls to who is at fault.
the Board of Directors and on some level,
the shareholders, but the people that make Perception can be a wonderful thing when
up the board, and the majority taken into context with reality.
shareholders have decision making powers
that defy easy explanation. Rich Baich, author of Winning As a CISO ,
is the Managing Director of
The blurred line between a security PricewaterhouseCooper s Security and
executive s role and their executive Data Management Practice in North
responsibility has been the recent focus of Carolina. He was the CISO of ChoicePoint
numerous high profile breaches that during the apex of that company s most
involved the downfall of corporations and challenging security situation.
A living bull s eye for the venomous press both private industry and government
and media, he calmly navigated his way discover protective measures and
through hearsay, conjecture and finger solutions whether through technology or
pointing to arrive at a life-changing career process changes for a wide range of
decision. No longer comfortable with his critical infrastructure protection needs.
vision being out of alignment with his
reality, Rich, like many other security What was interesting about Rich [Baich ]
executives before and after him, realized being the target of negative press is that it
that he could make a bigger contribution really caused a lot of CSO s to pause. It s
to security in the industry by leaving the always kind of been an assumption that
top of the food chain. In an effort to make non-traditional security events such as the
an impact, effect results and see the fruits one at ChoicePoint, is the crisis response
of their labor realized, it s a decision more and incident response role that we play
high level security executives are making today, and it s one that we should be
nowadays. playing. It made me wonder how I would I
pre-empt those hard to define events. I felt
Mike Assante, CSO of American Electric that I should talk to the CEO and say, you
Power and a former U.S. Navy intelligence are depending on me to handle these
officer will be leaving his executive title types of events right? A lot of us stopped
behind at the end of July. In his new and asked ourselves those questions
capacity, he ll be taking on a broader because of Rich s situation. It made a lot of
leadership role that will allow him to help us think, says Assante.
So who decides what a CSO and CISO should be doing with their time if
not keeping the company s information secure?
As an active duty Cryptographer for the keeping the company s information

U.S. Navy, Baich is accustomed to secure? Who writes the job description?
dissecting impossible puzzles and making Ironically, I think the way the job
order out of chaos. True to his analytical description has evolved is that either the
nature, his is a viewpoint based on CIO or the executive recruiters are asked
practicality, When it comes to a major to define it, at least as far as what
security breach, I don t think it s a matter functionality the CISO has. It s challenging
of who s at fault because you really need because it s such an evolving role.
to look at how people mitigate risk today. Everyone knows what people do in sales,
everyone knows what the job of marketing
When you look at the role of the CISO, or is, most people know what the job of the
any upper level security executive and how CIO is, but the tough part is that there s
that role is evolving, you need to take into not a generally accepted job description
account their job description, for the CISO, at least not that I m aware of.
empowerment and budget. It s It s defined differently just about
questionable that the role should be everywhere, says Baich.
reporting up under the CIO because the
CIO s job is IT uptime and security is part It becomes apparent that those in the role
of uptime but unfortunately the CIO has to of CISO and CSO are challenged by the
make some very hard choices at times and ambiguities surrounding their role. Highly
managing risk isn t necessarily something educated, they are often current or one
that they re compensated for, Baich time practitioners of complex security
explains. disciplines. They are hands on executives
who are actively immersed in various
So who decides what a CSO and CISO forms of security. They have high ideals
should be doing with their time if not and work best when they re able to analyze
and predict, recommend and implement.
However perfect for the jobs they re been questions that I m now prepared to ask
hired to do, they face a difficult obstacle. because the role of the CSO is in a
Each has a direction they should be going, pioneering stage relative to how
and each has constraints on where they re companies treat it. I think there s a lot of
allowed to go. misunderstanding on both sides. In some
cases, when somebody takes the role of
As a CSO, you should get a broad CSO they make assumptions. They think,
definition of your role up front, which is Hey, I m here to provide leadership across
something I m going to do if I ever walk the spectrum, and unfortunately those
into another CSO position. The role needs assumptions don t pan out to be true when
to have a much higher report-in, maybe to an event takes place, explains Assante.
the CEO or CFO. These are the types of
I believe that the appropriate role for a defining organizational issues when we
CISO - and it depends on different should be worried about fixing the security
organizations in different industries ‒ is incident, I push back heavily on that
one in which operational security is opinion and say that it s tough to fix things
evolving. People are starting to see that it s if you don t have the right reporting
a business function. If it s a business structure and the right budget line to get it
function then it should report to a done, adds Baich.
business leader. What s a business leader?
My interpretation is a COO or the President It begs to be asked whether this role is
of the company. To help the future leaders really necessary within an organization that
step into a security executive role it s already has a CTO or a CIO. It brings into
important to understand that this is not a question whether this person is just a
technology issue. Technology is only 10% figurehead for a fully functioning IT group
of it. Reporting under the CTO is not the that may lack executive pomp and
right thing as that person is responsible presence.
for technology. The CIO is responsible for
information operations. Well what is When broken down to the sum of its parts,
security and what is risk? It should be you can take or leave the title but the role
viewed as mitigation of operational risk. itself is critical to the overall success of
Although a lot of people will say that a lot the enterprise security architecture.
of time and press is being wasted on
Baich says, I want to make it clear that I to coordinate what happens across the
don t necessarily think that there needs to organization and the business units to
be a CISO, but there needs to be one make sure the company could respond
senior executive understanding security, and quickly recover to get systems back
whether you call that a CISO, a CSO, a on line. That was a well-defined thing.
Chief Risk Officer or an Operational Risk When people become CSO s it s very clear
Officer, it really needs to be more clearly that they ll lead in the defined area.
defined in the industry. I do believe that Companies don t respond to dynamic
the integration of the services that fall environments well because they re always
under that person s title needs to lagging behind. When you look at security
functionally report in through the business risks - and I believe that s a very dynamic
leader and not a non-business entity. environment - companies have a hard time
saying Yeah that s a security risk too and
The need for a CSO/CISO may be greater therefore you should be the one driving
than the role itself. To understand the role, that. Operationally, outside of the
it needs to be adequately defined and this traditional security events, I believe the
depends on whether an organization is CSO and CISO s responsibilities are very ill
inclined to be proactive or reactive when it defined.
comes to security risk.
Some companies are choosing to do away
Assante explains, After talking to several with the role altogether. This mindset
CSO s, I got the sense that we re all in the strips away the singular security executive
same boat because the operational and spreads the defined duties amongst
responsibilities of the CSO or CISO are other functional groups. Dispersion often
really ambiguous when it starts to deviate causes dilution. What happens when these
outside of normal security events. These functional groups are unable to form a
positions were created in response to unified opinion of what is and isn t a risk to
reoccurring security events that are the company? Who underwrites the overall
having an impact on companies, especially security process? Who makes
in the CISO space. recommendations based on risk
assessment, monitors the changing
These re-occurrences were definable, we threatscape, and meets with the business
were able to draw a circle around malicious leaders to discuss security objectives? In a
code attacks, major virus attacks, DOS situation where the security of the
attacks, and companies decided they company is dispersed, how can everyone
needed someone to take a leadership role keep track of what the other is doing?
The need for a CSO/CISO may be greater than the role itself.
Even though he s left his title in the past, loss of data. You need a team that thinks
Baich believes that it s critical to have such along the lines of the adversaries. That s
a role, especially within large, multi-national how you get better at security. You can
organizations, A company has a implement a methodology, the ISO
responsibility to protect their employees. standards, SAT 70 s and adhere to the
There are things like work place violence, current and future laws, but in the end
background checks on employees and what you want is individuals that spend
every company has computers so that their time looking at trends, understanding
creates access control requirements. Any what criminals and potential adversaries
company of any size is going to have an are doing. This will allow the organization
internet presence so there needs to be the ability to be proactive in mitigating
network security, policies, a process for future trends. You ll be more prepared
dealing with customers who might utilize than if you didn t have anyone in this post
the company information in a way that doing the lookout.
causes embarrassment in the media or
Increasingly we see the effects of a aside. But still, that s reactive. We find
reactive security plan. Savvy criminals ourselves in an odd kind of place.
harvesting hundreds of thousands of
accounts for valuable information, At the end of the day, who is really
companies whose internal employees have responsible for security?
been selling them out, thwarting traditional
security methods by virtue of being an I never really saw myself as a security
insider. Security is a never-ending race of executive, I see myself as a business
threat and response and no technology is executive responsible for security risk. In
going to solve every problem within the that sense, I want to understand all the
organization. Keeping on top of current business processes and I want to be able
threats and being prepared for future to contribute positive value to the
threats is a constant challenge. organizations by being much more
proactive. At the end of the day it is not
With security threats on the constant rise, my job to make risk decisions. It s the
it would be easy to assume that all business leader s job to decide on
companies are behind the notion that acceptable or unacceptable risk.
security is a priority. The fact is that
priority is directly tied to budget in all too If someone thinks something is an
many circumstances. Critical security acceptable, then our job s over. If
decisions often compete with disparate something does materialize after the fact,
organizational needs for funding. The then we re called upon to be purely
theme of budgetary constraint comes up reactive and take care of it. If someone
time and again but where is all the money looks at a risk that we ve identified and
going? Offers Assante, Realistically a lot defined and they decide it s unacceptable,
of CSO s have authority around a defined then my job is to help identify protective
budget such as keeping our firewalls measures or options or maybe even re-
updated or installing IDS and things like engineer a business process so it would be
that. Those are well-defined buckets and less vulnerable to risk. That s all fine, but
the CISO or the CSO has the ability to ultimately it is the business unit leader,
spend their budget as necessary. When whether it s an operating unit VP or the
you start getting into assessing risk CEO, to make the acceptable risk decision.
proactively, whether assets or business I always thought that as an executive, you
processes, that s an area that s not really didn t want me looking at yesterday s risk
funded. and restating the obvious, my job as
someone senior in the organization is to
There isn t a flexible amount set aside for look ahead and align where the company is
managing security, the money is there to going with how I think the threatscape will
manage ongoing security operations costs be changing, notes Assante.
for protective measures that are currently
in your arsenal, whether you have a sensor You know you re winning in the role of
architecture for IDS or a guard force. That CSO/CISO if you have employees sending
money maintains those and slowly attachments to the IT department saying I
enhances those if necessary. When you don t know who this is from or what to do
look at the broad definition of risk, it s with it. That s creating a corporate culture
calling for different protective measures but that cultural shift is a very difficult
and that s a whole new area that we don t thing for an organization to understand
have a budget for. The only time we get and invest in. I really hope that the industry
that kind of budget is when the will take a hard look at this and find the
government steps in and makes a appropriate place for a leader that is
requirement that says, You will do this , empowered to make a difference in a
and then all of the sudden the money is set security executive role, ends Baich.
Melisa LaBancz-Bleasdale is a San Francisco area communications consultant and strategist specializing in the
security industry. Her focus is on emerging and innovative security technology, current events and market
concerns. Visit www.superheated.com to find out more about Melisa.
TaoSecurity Blog
http://taosecurity.blogspot.com
This blog, run by Richard Bejtlich is full of useful information about many security topics including
forensics, incident response and network security monitoring. Bejtlich is the author of "The Tao of
Network Security Monitoring: Beyond Intrusion Detection" and contributing author to a few other books.
This blog is recommended reading for anyone looking for thoughts on specific problems.
Schneier on Security
http://www.schneier.com/blog
If you're looking for a great resource that covers general security information, this is definitely worth
bookmarking. The blog, as you may have guessed from the title, is run by Bruce Schneier, an
internationally renowned security expert. He is the author of "Applied Cryptography", "Secrets and Lies"
and "Beyond Fear". Schneier also publishes a free monthly newsletter that you may be interested in,
Crypto-Gram, with over 100,000 readers.
Martin McKeay's Network Security Blog

http://www.mckeay.net/secure
Another excellent blog comes from the mind of Martin McKeay, a network security professional. Packed
with interesting insights into the world of computer security it delivers relevant information with some
very good comments. What differs this blog from others is that also people with less technical knowledge
can get some good pointers. A good example of that is the short but to-the-point "Security Primer for the
non-technical" (http://www.mckeay.net/secure/archives/000013.html).
Security Awareness for Ma, Pa and the Corporate Clueless

http://securityawareness.blogspot.com
As the authors say themselves: "This blog gives computer security tips and tricks to government,
corporations and home users." One of the people that contribute to this blog is Winn Schwartau, author of
several computer security books and a leading expert on information security, infrastructure protection
and electronic privacy. What you can find in this blog is posts covering all aspects of computer security
and geared towards that beginner to intermediate audience.
When you are immersed in IT security (or IT in general for that
matter), things hardly look simple. This is especially true for
perimeter security gateway solutions targeting the enterprise
market.
Answers here are rarely simple, and one such question from a colleague who's
technologies are fragmented into separate become only recently involved with IT
solutions requiring more money and security - it goes something like this: "Why
administration - despite marketing can't you put a box inline with network
brochures claiming the opposite. New traffic in order to transparently protect
threats lead to new security technologies from all kinds of network based threats?"
which in turn lead to increased It's a simple question that deserves an
administrative overhead and spending, answer.
while integration with existing
infrastructure remains only a wish. The answer could be a new generation of
firewall technology called Unified Threat
For example, firewalls are used for access Management (UTM). The term was
control, gateway antivirus for virus apparently coined by IDC (http://
protection, intrusion detection for various tinyurl.com/eyqn2) and has recently
network and DoS attacks, URL filtering to become an often recurring buzzword in IT
filter unwanted web content, anti-spam to security.
reduce junk mail, and so on. Often the
solutions are located on different boxes or In a nutshell, UTM appliances unify firewall,
appliances and sometimes require network gateway antivirus, and intrusion detection
topology change. In addition, they usually and prevention capabilities into a single
have their own separate management platform to protect from common network
consoles, the result being separate threats. The idea is to put all the
maintenance and administration, especially functionality on a box (hardware unit) and
if different vendors are involved. insert it into the existing traffic flow
without tinkering too much with the
Perhaps it is because of this confusion infrastructure in place. When you look at it,
that I'm caught by surprise when it seems the most natural and simple thing
confronted with simple questions. I heard to do ‒ the elegant solution.
UTM and network based threats separate the public network from the
internal segments, create a DMZ, and so
The history of IT security closely follows on. Of course, the traditional firewall is now
the evolution of network-based threats. In a mature technology. Its features typically
fact, IT security has followed an include packet and stateful inspection,
evolutionary path whereby each new threat DHCP, NAT, PAT, PPPoE, etc.
would trigger a countermeasure. As

threats have indeed multiplied in the past The appearance of network layer attacks,
decade or so, so have the corresponding such as IP spoofing, SYN flood, Ping of
countermeasures, that is, technologies Death and other related DoS attacks, led to
designed to address them. A sample list of the next development: network intrusion
those technologies would include: detection and prevention systems (IDS/

IPS). These systems would check IP
packets against signatures of known
• packet filtering and stateful inspection
attacks or traffic anomalies. Today,
firewalls,
specialized IDS/IPS appliances are still
• Intrusion Detection (IDS) and signature-
offered in some cases, but are now largely
based Intrusion Prevention Systems with
deep packet inspection, an integrated part of firewall solutions.
• user authentication,
Another technology that's become an
• IPsec VPN,
industry standard is IPsec based VPN,
• clientless SSL VPN,
used for both branch office and for mobile
• gateway antivirus for mail and web
user encrypted connectivity. Transfer of
traffic,
confidential corporate data across the
• anti-spam and e-mail content filtering,
public network certainly posed a severe
• URL filtering (web access content
threat. And so, almost from its inception,
filtering).
VPN support had become a standard
Once upon a time, things were much feature of firewall appliances.
simpler. Firewall was virtually the only

technology you use to solve perimeter Firewall and IPS technologies operate on
access problems: limit accessible services, the network layer.
THE HISTORY OF IT SECURITY CLOSELY FOLLOWS THE EVOLUTION OF

NETWORK-BASED THREATS
However, the major proliferation of new flow and inserting specialized application
threats in the last several years has been proxies ‒ for example for HTTP or SMTP
concentrated largely on the application traffic. Of course, since full traffic
layer of the protocol stack (also known as scanning on the application level is much
OSI Layer 7 ‒ see Figure 2). These new more resource intensive than simple layer
threats are using most popular application 3 analysis done by traditional firewalls,
protocols such as SMTP (e-mail), HTTP gateway content scanning for a particular
(web), Instant Messaging and others as protocol would have to be assigned to
vectors to spread and infect systems, separate machines (or appliances).
degrade computer performance, steal Precisely because of the performance
sensitive data, consume network resources bottlenecks and throughput issues,
or simply reduce employee productivity. application level scanning has seen slow
Examples of these threats include e-mail integration with other network security
worms, application specific worms technologies.
targeting vulnerable systems, spam, However, thanks to Moore's law and the
phishing attacks, inappropriate web related advances in processing power,
content and spyware. The standard way to latest market developments indicate all the
solve this new class of problems is to mentioned technologies are now being
introduce gateway AV protection and integrated into a single hardware platform:
content scanning by breaking the traffic UTM (see Figure 1).
Figure 1
How does UTM work? Interconnecton model, better known as the

OSI Reference model. The TCP/IP protocol
The best way to understand how the whole suite roughly resembles this theoretical
thing works is to look at the Open Systems model, as shown in Figure 2.
Figure 2
Traditional firewall defences work on the Let's suppose a connection has passed all
Internet layer, or OSI Layer 3. That's where the layer 3 filters. In order to do full
packet filtering, stateful inspection and application level scanning, traffic has to be
basic intrusion detection takes place. proxied. It means packets associated with
Essentially, Layer 3 scanning means this connection are terminated, collected
analysis of IP packet headers only, without and then assembled into application level
looking into packet contents ‒ this is why objects (for ex. an attachment or web
it's not too much resource intensive. page).
But, as has been noted, most recent This involves data duplication into a
threats exploit weaknesses not on the memory or disk buffer and only then
network layer, but up the protocol stack to scanning for malicious content. If the
the Application layer, commonly referred resulting action is to deliver the content,
to as OSI layer 7. Application protocols the appliance deconstructs the application
such as HTTP or SMTP are the most objects and rebuilds the original packets
common vectors for threats such as which are then proxied to the destination
viruses, worms, spyware, application level host inside the protected network. The
vulnerability exploits, spam e-mail, result of this process is transparent traffic
unwanted content, and so on. interception and in-depth scanning.
However, application layer scanning is an It is easy to see why performance drops

entirely different process than simple dramatically and latency increases when
Layer 3 filtering. Layer 7 threats such as attempting to do even simple application
an e-mail worm are often spread across layer filtering. To compensate, one needs
many thousands of ip packets. What is high-end hardware and optimised
needed is reconstruction of packets into operating system environment, and this is
application level objects. The whole something UTM appliances are based on.
process is roughly illustrated in Figure 3.
Figure 3
The Industry advanced proxy security scanning,
antivirus, anti-spam (from Cloudmark),
The growing UTM market is currently URL filtering (Smartfilter), IDS/IPS and
dominated by a number of different IPsec VPN. Thanks to its advanced proxy
vendors, each coming from a different inspection, Sidewinder has a reputation of
background and core business. In addition, a very stable and reliable firewall
new vendors are entering the market appliance.
continually. What follows is a brief

summary of key participants in the UTM Symantec is best known for its best-of-
market. breed antivirus technology, although it has

significantly expanded its portfolio making
Fortinet is a relative newcomer to IT the company a one-stop shop for IT
security arena. The company was founded security solutions. Through Brightmail
by the former NetScreen CEO in 2000 with acquisition in May 2004, Symantec has
a UTM vision almost from the very start also integrated superior spam filtering into
(they claim to have the largest market its product line.
share in this respect). Since mid 2002,

Fortinet has been delivering its core Symantec offers UTM functionality via the
product: FortiGate antivirus firewall. This Symantec Gateway Security 5400 series
appliance also offers VPN, IPS, content which targets the enterprise market. The
filtering and anti-spam services, fitting it solution integrates full inspection firewall
into the UTM class. As expected, a wide technology, protocol anomaly based
range of models is offered ranging from intrusion prevention and intrusion
SOHO&SMB users (FortiGate 60 or 100) to detection engines, antivirus protection,
large enterprises and service providers URL-based content filtering, anti-spam,
(FortiGate 1000-5000 high-end and IPsec VPN. Although Symantec offers
appliances). similar appliances for the SMB market

(Gateway Security 300 series), they have
Internet Security Systems (ISS) is well reduced functionality in terms of content
known for its expertise in intrusion filtering and anti-spam.
detection/prevention and vulnerability

assessment. ISS is managing X-Force, the Other UTM vendors include SonicWall,
leading security research and development ServGate, NetASQ (mostly on the European
team responsible for a major part of new market) and of course Cisco, which
vulnerability discoveries. X-Force research recently entered the market with its Cisco
results in security advisories on high-risk ASA 5500 Series Adaptive Security
threats and immediate product updates to Appliances.
protect against the latest threats and

vulnerabilities. No doubt there will be other interesting
developments as the market matures in
ISS has expanded its firewall and advanced the near future - including strategic
IPS/IDS systems with application level alliances between various specialized
inspection including antivirus, web content vendors, or even mergers and takeovers.
filtering, anti-spam, vulnerability detection,

and so on ‒ the end result being an Final remarks
integrated security UTM appliance called
Proventia. It currently ships in three basic The convergence of gateway security
variants: M10 for small businesses and solutions into a single unified appliance is
remote offices, M30 for branch office certainly a positive step.
locations and medium-sized businesses,
and finally M50 targeting large enterprises. However, there are still some drawbacks to
overcome.
Secure Computing is specialized in building
secure application-level proxies and UTM vendors can hardly provide "best-of-
firewalls. Its core product is the Sidewinder breed" solutions for all the technologies
G2 firewall appliance which includes involved (antivirus, anti-spam, IPS, etc.).
When using separate solutions from consult a recent test by Secure Enterprise
different vendors, one can select the best Magazine (http://tinyurl.com/bqapw).
product for the particular problem. Performance is another major concern. As
However, when implementing a single UTM mentioned earlier, application level filtering has
vendor, there is no other way but to accept put substantial load on processing hardware
the quality (for better or worse) of the and the result is both reduced throughput and
integrated products in the single device. increased latency. Although this can be offset
It will require some time before UTM grows by deploying in clustered scenarios, the
into a solution that's able to seamlessly associated costs of the UTM could rise
integrate with the existing infrastructure significantly. However, based on anticipated
and provide the same range of features market developments as well as on increasing
currently implemented in specialized hardware capabilities, the benefits will
products focused on a particular threat ultimately compensate for all the drawbacks in
class. the very near future. And so here's why UTM
delivers:
In addition, it is difficult to make a fair • traditionally separated technologies are
assessment and comparative analysis of all unified on a single box;
the UTM vendors and products precisely • less administration overhead with only one
because so many technologies are management system to worry about;
involved. To test them all against • transparent inline deployment with no
throughput, antivirus detection, topology and/or routing changes;
vulnerability exploit detection, content • centralized logging of all gateway security
filtering, logging and reporting capabilities events.
would require extensive resources. This is
probably the reason why there are not UTM may not be the silver bullet of IT security,
many comparative tests available for the but it certainly is a better way to solve
general public. However, the reader may perimeter security than the currently
fragmented security technologies.
Robert Buljevic is a security consultant working for Mack IT (www.mack.hr), a best-of-breed security solutions
distributor in Croatia.
WINDOWS - Tor
http://www.net-security.org/software.php?id=253
Tor is a toolset for a wide range of organizations and people that want to improve their safety and
security on the Internet. Using Tor can help you anonymize web browsing and publishing, instant
messaging, IRC, SSH, and other applications that use the TCP protocol. Tor also provides a platform on
which developers can build new applications with built-in anonymity, safety, and privacy features.
LINUX - Shorewall
Shorewall is a high-level tool for configuring Netfilter. You describe your firewall/gateway requirements
using entries in a set of configuration files. Shorewall reads those configuration files and with the help of
the iptables utility, Shorewall configures Netfilter to match your requirements.
MAC OS X - JellyfiSSH
JellyfiSSH is a simple bookmark manager for connecting to *NIX boxes like BSD/Linux etc via Telnet or
SSH 1 or 2. You can set preferences for each bookmark including the terminal colours, fonts, window size,
transparency and default login.
POCKET PC - Airscanner Mobile Firewall

Airscanner Mobile Firewall is a low-level, bi-directional, packet filtering firewall that examines all incoming
and outgoing traffic to ensure it is permitted based on access control lists that are selected from a set of
predefined filters, or from filters manually created by a user. The firewall parses packets as they come in
(or go out) on the wire and matches the data against a ruleset of ports or IP addresses, URLs, etc.
If you want your software title included in the HNS Software Database e-mail us at software@net-security.org
As web application security gets more attention, it's rare these days
to meet someone in the Information Security world who hasn't heard
of SQL Injection. Unfortunately, not everyone who has simply heard
of it or understands the basic premise of it really understands it to
the point they should.
What s worse is that often times the risk is An example of a vulnerable query would
assumed to be limited to the data used on be this one:
the website. In reality, the risk of SQL
Injection can be quite extreme, and goes sSql = "select ErrorMessage from
well beyond the data to the database ErrorMessages where ErrorCode = "
& Request("ErrorCode")
server itself ‒ and in some cases even
beyond. You can fight complacency in an This query has two portions to it - the
organization by demonstrating the true static portion which never changes
risk. In this article, Matthew Fisher will walk (marked in orange), and the portion that
you through the basics of SQL injection in changes based on the error code passed
detail, and then move on to researching to the page in the URL which is marked in
and demonstrating the true potential to blue. Since we see the ASP Request object
SQL Injection. right in the query, we know that it s using
the information sent from the browser
Beginner s SQL Injection without validating it first. If the query
simply used a variable for the ErrorCode
SQL Injection is perhaps the most that could not be presumed, since the
dangerous vulnerability in the world of validation could have been performed
web application security. It takes before that variable was used in the query.
advantage of a mistake that s easy for a
novice web programmer to make, is often When the page that contains this query is
extremely exploitable, and is quite executed, the actual query executed
common. SQL Injection relies on three against the database will vary depending
factors: on the input received from the browser.
a) a dynamic query, meaning one that For instance, with this request:
changes based on input from the client.
b) a concatenated string query versus a http://127.0.0.1/stats/
ShowError.asp?ErrorCode=2
parameritized query.
c) poor or non-existent validation of the
input from the client used in the query.
The database query then becomes: lies. The query simple changes according
to whatever is in the browser. That s not
"select ErrorMessage from much of a problem for valid input (such as
ErrorMessages where ErrorCode = 2" 1 , 2 , or 3 ) but it s a serious problem
with invalid input. By throwing garbage
If the ErrorCode in the URL were changed
into the url we can see how the query
to 3, then the query would accordingly
handles it. Here we enter a few basic
change to become ... where ErrorCode
reserved SQL characters or keywords and
=3 . And that is exactly where the problem
see the result:
The character entered, a simple single- programmer s query. In some rare cases,
quote ( ) is used by SQL to denote you may actually even get pieces of the
strings, so it expects them in pairs. The complete back-end query presented to
resulting ODBC error tells us quite a bit. you.
First of all, the mere existence of the Now that we know the application isn t
ODBC error tells us that the programmer validating it s input very well, it s simply a
did not validate against the single quote measure of determining what is and isn t
(which is a very important character in validate. We could try testing individual
SQL Injection). Instead, it simply appended characters and keywords, or we can
it to the end of the query and ran it simply go for an attack and see if it makes
against the database. When the database it through. Attacking integers with SQL
complained about the query, the web Injection is by far the easiest. Since the
application didn t even handle the application is expecting a number ‒ and
exception but merely printed the results to not characters ‒ the web page isn t going
the screen. In essence, the ErrorCode to wrap the input with single quotes.
parameter is now a two-way pipe to the
database server. This means that we don t have to try to
escape out of the single quotes with out
Of course, the information the ODBC error injection ; we can simply piggyback our
presents is quite helpful as well, telling you query on top of the programmers with a
instantly the make of database server UNION attack. The word UNION is reserved
being used, and giving clues to the for SQL use.
It s a special keyword that tells the the string properly and closing it properly
database that you re going to give it two ‒ an issue further aggravated by things
separate queries and you want it to like MAGIC_QUOTES (don t rely purely on
combine ‒ or union ‒ the two recordsets magic quotes though! Do your own input
back into one. It essentially lets us directly validation!) There are other situations that
piggy-back our query on top of the web make it even more complex ‒for instance,
programmers like this: the browser input going into the middle of
the queries, etc. The more complex the
http://127.0.0.1/stats/ underlying SQL query is, the more complex
ShowError.asp?ErrorCode=2 union the injection. The point of this article,
select name from sysobjects
however, isn t to teach you everything
Remember that the vulnerable query just there is to know about performing a SQL
takes whatever is in the ErrorCode Injection attack; it s to raise your
parameter and slaps it onto the query. awareness of the risk.
Thus in this example, the query actually
executed against the database becomes: The True Risk of SQL Injection
select ErrorMessage from While almost every demo of SQL Injection

ErrorMessages where ErrorCode = 2 you ll see shows selecting data from the
union select name from sysobjects
database ‒ which is indeed scary enough ‒
The database runs the two separate the truth of the matter is that SQL
queries and returns one recordset, and Injection is actually much scarier than that.
with a little luck the results are printed to
the screen. In our example page, the script Microsoft SQL Servers uses Transact-SQL,
writes the complete recordset back all at which is a remarkably robust language,
once. You can even see the appropriate and is made even more functional with the
error message that corresponds to addition of system stored procedures and
ErrorCode 2 in it: extended stored procedures. Data
Manipulation Language ‒ which is
composed of commands like SELECT and
INSERT - are a mere fraction of what s
actually available to a DBA. The SQL
language also contained an entire genre of
commands called Data Definition
Language which manage the objects in the
database (such as tables, columns, etc.)
DDL is used to create and manage the
objects, and DML is used to populate the
objects. In fact, a really good DBA will
create, load, and manage their database
entirely through SQL scripts if they want.
The capabilities of SQL go beyond that
though; there are Functions, System
Stored Procedures, Extended Stored
Procedures, Statements and Enhanced
What essentially happened is that while the Statements, and more. The bottom line is
ErrorCode input was only supposed to be that a DBA can almost completely manage
a parameter to a query, it ended up then entire database server from t-sql
modifying the base query itself. scripts, and if they can, then so can
anyone who can perform SQL Injection.
A UNION attack against an integer is
perhaps the simplest SQL Injection attack Researching SQL Injection
there is. If the input were a string, the
attack becomes more complex because There are several resources available to
now we have to deal with escaping out of learn the capabilities of Transact-SQL.
Of course, there are plenty of books you Some of The Possibilities
can buy, but there s also plenty of
documentation that comes with SQL itself. Just in the prior examples we see great
Books online has a large reference section promise as to the fun that can be had with
on the T-SQL language along with the SQL Injection... Not many folks realize that
various functions and procedures shipped. you can actually manipulate the Windows
registry through SQL statements. Once
you start researching the capabilities,
you ll be amazed at what you can do with
SQL Injection.
For instance, the security section of SQL

Books Online describes the variable USER,
which returns the user executing the
command. This makes a great way to
identify your access level on the database.
Too many sites simply setup a DSN with
full SA access for the web application to
use, meaning that the web application ‒
and thus your injections ‒ run as the
The reference section is conveniently database owner. Selecting the USER
broken down into categories such as variable tells you exactly who your
Security. injections are on the site:
You can also just query for system stored

procedures and extended stored
procedures, since they re maintained in
sysobjects. Use wildcards to make your
queries more effective, like this search for
registry related procedures which returns
a list of procedures for manipulating the
registry (Just the top 10 are shown to
keep the screenshot manageable).
Of course DBO is simply the role that the

account is logged into ‒ it s not the actual
login ID itself. If you want to see the actual
login id, in fact all the login ids for the
server, you can select them from the
SysXLogins table located in the master
database. Since it s doubtful that the web
application itself defaults to the master
database (well, at least it s hopeful that it
doesn t ) you ll need to specify the master
database in your query by prefacing the
table name with master.. and the site
politely returns all the user logins to the
database server. The password hashes are
also displayed in this table although they
are binary. Of course, you can also just
fish for the connection string in the
registry or text files; more often than not
the userid and password will be stored in keywords used for SQL Injection. If it were
plain text. injected into a string (versus an integer
value) than one would have to do the usual
escaping, but when injected into an integer
it s remarkably stealthy (and short! Which
makes it easy to use even when the script
checks the length of the input). As it s
name implies, it quickly and quietly shuts
down the database. Of course, shutting
down the database is only quasi-evil. If you
really feel malicious you could use the DDL
DROP command instead, which will remove
the database from the server: ;drop
database production_database. As an
added bonus if will physically delete it
from the operating system s file system as
well.
If you d like to add your own login to the

One area of SQL that s particularly fascinating is
database or database server, you can do
the ability to force a MS-SQL database to query
with with SP_ADDLOGIN. With this system
another database. This can be done in several
stored procedure, you get to define the
manners:
username, the password, and even the
default database and language!
1. Pre-Defining a Linked Database with all
necessary connection info. In this case, the
ErrorCode=1;
connection is defined once in the server, then any
exec%20sp_addlogin%20’systemadmini
strator’%20,%20’mypassword’,’maste actions using that connection simply reference it.
r’ There is also additional functionality available
when using a defined Linked Database than when
using other techniques.
2. Using Ad-Hoc Names. The OPENROWSET and

OPENDATASOURCE command accept full
connection settings in the query itself and can be
used for ad-hoc queries of remote databases. As
their name implies, they re intended for ad-hoc
use only, hence the need to define the full
connection. Each one is able to work with a variety
of network provides, which include providers for
MS-SQL database, providers for JET (to subquery
Notice that since stored procedures are Access databases), Excel and more, and each
executed, instead of performing a UNION provider accepts it s connection string in different
here we simply finish off the script s ways.
hardcoded query with a semicolon and we
don t get any feedback from the site. To The website connectionstrings.com does a
confirm that the userid addition was fantastic job of showing different possible
successful, however, we simply query connection strings for multiple database
sysxlogins again. servers, providers and network types.
Each network type will work for different
You can also shutdown a database with scenarios ‒ the most powerful, however is
the SHUTDOWN command: ;shutdown ; the Win32 TCP/IP library; this allows the
The shutdown command isn t even a creation of an ad-hoc connection to a
query, so it doesn t have to be preceded remote database. The possibilities for
by a UNION, a SELECT, or any of the other abusing this are endless, ranging from
commonly known (and validated) dumping the entire injected database to a
remote database, to ports canning the port scan from the injected database
back end network. While the database simply by specifying the IP and port to
could be enumerated and dumped directly scan and examining the resulting query.
through the injection and resulting web The following injection tells the database
responses, this could potentially generate to attempt a connection to 192.168.0.1 on
lots of suspicious inbound traffic. This port 80:
inbound traffic could potentially be
reduced by dumping the database through http://127.0.0.1/stats/
an ad-hoc query to a hacker s own ShowError.asp?
ErrorCode=1UNION%20select%20*%20fr
database. This could create lots more
om%20OPENROWSET('SQLoledb','uid=sa
outbound traffic, but the odds are that the ;pwd=;Network=DBMSSOCN;
victim s egress filtering and monitoring is Address=192.168.0.1,80;
not as strong an their ingress monitoring. timeout=5','select blah from blah)
Additionally, ad-hoc names can be used to which results in this error message
displayed in the web page:
Attempting the same injected query, but known to be closed on this system, we get
now specifying port 22222, which is the following error message:
The fact that two different error messages your data could be exposed, it s quite
are returned makes it trivial to thus script possible that the complete database
out the injected port scans. server itself is owned and further network
attacks will be facilitated. Defending
Summary against SQL Injection is easy with
parameterized queries and good input
SQL Injection is a well known attack, and validation. Unfortunately, it takes a while
the general IT community is quickly for word to get out and practices to
becoming aware of the potential risk to improve ‒ look at how long buffer overflow
their data. Few truly understand how attacks have been known! By
dangerous it is, however, and some have demonstrating just how malicious SQL
even argued with me that they don t need Injection can really be, hopefully your
to worry about SQL Injection if they don t clients or your own organization will
store any private data. While at a minimum respond to this threat more aggressively.
Matthew Fisher is a Senior Security Engineer for SPI Dynamics, the expert in Web application security
assessment and testing. He has held multiple certifications and has spoken on the topic of Web application
security at numerous conferences for the Department of Defense, civilian Federal agencies, as well as the
commercial sector.
As the Internet has grown in popularity so too have threats against
computer users; making it critical for individuals and companies to
employ effective security strategies to protect their critical
information. Microsoft created the Microsoft Security Response
Centre (MSRC) to investigate, fix and learn about security
vulnerabilities and to help keep customers protected from malicious
attacks.
The MSRC is comprised of individuals, more than 218 million copies have been
teams and entire groups around Microsoft; distributed worldwide. This was an impor-
all dedicated to analysing, developing and tant security milestone for us. Many peo-
delivering quality security updates, tools ple put a lot of effort into this service pack
and prescriptive guidance to customers to and features like the firewall being on by
help protect customers from security default and the hardening changes made
threats. to Internet Explorer are already paying off
and helping customers become more se-
The last 12 months have been a particu- cure.
larly busy time for the MSRC, and, upon
reflection, there are two activities that In Service Pack 1 for Windows Server
stand out to me. These were the releases 2003, the great features and security en-
of two major operating system service hancements I mention above for Windows
packs: Windows XP Service Pack 2 and XP SP2 were also incorporated into this
Windows Server 2003 Service Pack 1. product, along with many other changes.
Windows XP SP2 was released in August We're particularly excited about the Secu-
2004, and we are very pleased with the rity Configuration Wizard feature, which
results so far. One of the key goals around reduces the attack surface by querying
this release was to get enhanced security users about the role their servers fill and
features for Windows XP into the hands of then stopping all services and blocking
consumers and enterprises, and so far ports that are not needed.
There is very significant work going on ments included in the code for the benefit
behind the scenes in the development cy- of customers. It's a huge step forward for
cle of current and all future software re- us to have this now as a formal process
leases coming from Microsoft. Now, cer- for our software. So far, we have used the
tain categories of software released from SDL on Windows Server 2003, SQL Server
Microsoft now must go through the Secu- 2000 SP3, and Microsoft Exchange Server
rity Development Lifecycle process which SP3. Windows Server 2003 was the first
aims to provide customers with high qual- operating released at Microsoft that im-
ity software that is meticulously engi- plemented large portions of the SDL, and
neered and rigorously tested to help with- compared to Windows 2000, it had 63
stand malicious attack. We've published a percent fewer vulnerabilities in the first
lengthy whitepaper about this which is year.
available at
msdn.microsoft.com/library/default.asp?u While these developments cover signifi-
rl=/library/en-us/dnsecure/html/sdl.asp. cant activity on the product development
Essentially the SDL is a mandatory process side at Microsoft as a whole, the Microsoft
that certain categories of Microsoft soft- Security Response Center has also made
ware must go through before it is released available a number of free tools and spe-
publicly. It helps us make sure that the cial guidance that can help customers be-
software coming from Microsoft today has come more secure.
the latest security engineering advance-
Customers have told us that they want able the Advanced Notification Program to
more prescriptive and timely guidance on help IT professionals plan their resources
security issues and Microsoft has re- appropriately for deploying security up-
sponded to that feedback by continuously dates. Three business days before the bul-
improving the security communications we letins are released, general information is
deliver to customers. provided about the maximum number and
severity of the bulletins. We've also en-
This spring, we announced a pilot of a new abled a Security Notification Service to
offering, Microsoft Security Advisories, alert customers to new bulletins and advi-
which aim to provide guidance and infor- sories as well as an RSS feed and MSN
mation about security related software Messenger Alerts for security bulletins.
changes or software updates. Microsoft
Security Advisories, a supplement to the The MSRC also hosts monthly technical
Microsoft Security Bulletins, address secu- webcasts to offer customers additional
rity changes that may not require a secu- support and guidance when deploying se-
rity bulletin but that may still impact cus- curity updates and a regular Security360
tomers' overall security. webcasts to make prescriptive security
guidance, education and training available
In addition to the Microsoft Security Advi- to customers.
sories, Microsoft has recently made avail-
One of my favorite new things we've In addition, Microsoft has come to offer
launched this year is the MSRC blog which customers a consistent and integrated set
provides insight directly from those work- of new technologies that reduce the com-
ing in the MSRC on recent security related plexity and help customers better manage
news, announcements, activities and the update process for Microsoft soft-
threat issues. This is a great way to get to ware.
know those folks that are working behind
the scenes night and day to help protect In June we announced the immediate
customers. You can read all about at availability of Windows Server Update
blogs.technet.com/msrc/default.aspx. Services (WSUS) and Microsoft Update
(MU). WSUS is the update management
Another new tool released this year is the component of Windows Server that en-
Malicious Software Removal Tool. This tool ables mid-sized and enterprise companies
is updated each month to remove the to more easily assess, control and auto-
most common malware threats that may mate the deployment of Microsoft soft-
be present on a user's machine. To be ware updates. MU is a new service offered
clear, this tool is not meant to be a substi- at no charge that gives customers every-
tute for good anti-virus software. How- thing they get through Windows Update
ever, it can help customers get back on (WU), plus high priority updates for more
their feet if they have been affected by recent versions of Office and other Micro-
any of the threats the tool is designed to soft applications. It's a one-stop destina-
remove. We have had a good response to tion for updates that help make your com-
this so far and look forward to continuing puter more secure, up-to-date, and per-
to update it each month to help custom- forming at its best.
ers.
ANOTHER NEW TOOL RELEASED THIS YEAR IS THE MALICIOUS

SOFTWARE REMOVAL TOOL. THIS TOOL IS UPDATED EACH MONTH TO
REMOVE THE MOST COMMON MALWARE THREATS THAT MAY BE
PRESENT ON A USER'S MACHINE.
Only recently in July, we released the Mi- The next 12 months will be as busy as
crosoft Baseline Security Analyzer (MBSA) these last 12 months have been. The secu-
2.0 which helps improve the security man- rity of our customers' computers and net-
agement process by detecting common works will remain a top priority for Micro-
security misconfigurations and missing soft, and Microsoft remains committed to
security updates on your computer sys- building software and services that will
tems. help better protect our customers and the
industry. It may never be possible to com-
We also released the SMS 2003 Inventory pletely "cure" the security problem, but
Tool (SMS). This tool enables the detection Microsoft and the MSRC is hard at work
and deployment of the latest security up- every single day, working in conjunction
dates, update rollups and service packs with the industry, with law enforcement,
from Microsoft; improved patch manage- and with experts in government, academia
ment through a more comprehensive and and the private sector around the world to
more widely-supported detection technol- make the impact of malicious hackers as
ogy; broader detection support for more manageable as humanly possible. By build-
Microsoft products; and consistent prod- ing trust in computing our technology can
uct support across multiple detection be experienced in the way it was intended:
technologies including parity with Auto- to help customers accomplish what they
matic Updates. need and want to do.
Stephen Toulouse is the security program manager of the Microsoft Security Response Centre (MSRC).
Michal Zalewski is a 24 years old computer enthusiast rather well-
known among his InfoSec peers for finding a couple of noteworthy
vulnerabilities, releasing several interesting research papers, and
coding some small UNIX utilities for security researchers and
system administrators. His hobbies include robotics, photography
and mathematics.
You have been active when it comes to My public activity in the security field is
vulnerability research. What process do purely a result of a hobby; publishing ma-
you go through when searching for a bug? terial of course helps with InfoSec em-
Is it a planned activity where you search ployment - it provides essential training
for something precise following certain and good credentials - but I'm luckily not in
rules or is the discovery accidental while a position where I have to force myself to
you're using the software in question? find problems just to gain recognition. As
such, I often pursue issues that are subtle,
Zalewski: A bit of both. There are formal new and unique, and require unconven-
rules you can follow to perform a security tional approaches.
audit of an application for a customer, but
still, many vulnerabilities disclosed by re- There's been a heated debate going on for
searchers, including some most interest- years around the full disclosure of vulner-
ing, prominent and unique ones, are found abilities. What do you see as the pros and
because someone was bored, experi- cons when it comes to full disclosure? Is
mented in random ways with a particular the disclosure being handled properly?
application (or aimlessly browsed through
the source code), and had some luck. Limited- or non-disclosure policies are al-
As they say, greatest discoveries are not most exclusively advocated by circles that
announced by "eureka!" but "hmm... that's benefit from withholding information from
funny..." :-) customers - vendors who are usually
negatively impacted by vulnerability- You are the author of "Silence On The
related PR buzz, and companies or indi- Wire". Many agree that the book contains
viduals who make money or gain status by uncommon computer security challenges
having advance knowledge of problems not present in other titles. You have been
(such as commercial security software dubbed the security expert that filled a
vendors or solution providers). gap in the security field. How do you feel
about that?
Secrecy never seemed to stop determined
researchers with malicious intent from re- I'm glad that the book was welcomed quite
verse engineering patches or obtaining warmly by critics and other readers. I
leaked details from the "trusted" sources; thought I might have something to add to
it does, however, affect customer's ability the status quo, and that was the driving
to detect attacks, test susceptibility of his force behind the book. I'm far from believ-
systems, or implement workarounds. Fur- ing that SotW was revolutionary or brilliant,
thermore, it limits vendor's accountability though. It has its shortcomings, and is just
for a failure to address problems in a a book, after all :-)
timely manner (and multi-billion dollar
companies like Microsoft or Oracle are In "Silence On The Wire" you note that
known for sometimes taking months or computer security for you is not a single
years to fix trivial problems unless a con- problem but an exercise in seeing the en-
siderable public pressure mounts). tire ecosystem and understanding its
every component. What advice do you
I don't think there's much argument going have for the aspiring security professional
on between informed customers with past that may be bound by formal education
experience in dealing with mainstream and certifications? What can they do to
vendors, and bona fide researchers - open effectively expand their knowledge?
disclosure, like democracy, is bad, but we
have no better options. Just explore and learn on your own, plain
and simple. Infosec knowledge devaluates
You've developed several tools over the and becomes obsolete alarmingly fast. You
years. The most popular to date is cer- need to understand the fundamentals and
tainly p0f, a versatile passive OS finger- think creatively to stay on top. Otherwise,
printing tool. What features do you plan to regardless of certifications, you'd merely
add to p0f in the future? stay afloat :-)
I focus on features that are requested by I'm not denouncing formal education or
users; as such, I cannot really tell in ad- certifications, though. Random exploration
vance what is going to appear in next ver- and self-teaching has its pitfalls: you are
sion, other than mentioning small im- likely to focus on what you enjoy, and be
provements such as better database inte- ignorant of other problems; when you fo-
gration or support for more usage scenar- cus on interesting problems only, you
ios. might lack the ability to pay attention to
mundane details, lack the patience, lack
P0f would most certainly be a good start- the business skills.
ing point to develop a fully-fledged net-
work mapper (correlate data from various Based on what you know at the moment,
passive fingerprinting mechanisms, map do you expect more computer security
out network topology, record and accumu- awareness and better defense mecha-
late data about commonly established nisms in the future, or are the years to
connections; produce a detailed visual come only about to bring more problems?
analysis of the network) - but that's a long
shot. I'm always expecting the worst :-)
The photo used with this interview was made by Michal Zalewski. You can find out more about him by visiting
lcamtuf.coredump.cx.
OpenSSH is supplied with Macintosh OS X and runs much like it
does for other Unix-like operating systems.
The primary differences and distinguishing fea- Using the OpenSSH Server
tures are:
Before you can use sshd on Mac OS X, you ll need

• Some extra setup before the OpenSSH server,
to enable the server and possibly open up the
sshd, can be accessed by the outside world
Mac s firewall.
• The software, which is a modified version of

In addition, you ll want to know about some con-
OpenSSH maintained by Apple
figuration differences as compared to most other
OpenSSH installations.
• Some important differences in the way sshd is
configured by default, such as invocation and
Kerberos support Enabling the Server
Using the SSH Clients SSH server startup is controlled from the Sharing
pane in System Preferences, under Services, as in
The usual OpenSSH clients, ssh, scp, and sftp, Figure 1.
work normally without any extra effort on your

part: To enable sshd, select Remote Login and click the
Start button.
# Log into server.example.com as user

smith Opening the Firewall
$ ssh -l smith server.example.com
# Copy myfile from your local machine to By default, the Mac OS X personal firewall will
server.example.com block SSH connections from the outside world. If
$ scp myfile server.example.com: you have this firewall enabled, you must manually
# Run an interactive file-copy session permit SSH traffic through it. This is done from
with sftp the Sharing pane in System Preferences, under
$ sftp server.example.com Firewall, as in Figure 2.
Figure 1. Enabling the SSH server in System Preferences
Figure 2. Opening a firewall hole for SSH in System Preferences
Control by xinetd Kerberos Support
In most Unix-like operating systems, the OpenSSH The OS X OpenSSH build has protocol 2 Kerberos
server runs as a daemon, listening for SSH con- support for both user and server authentication,
nections. On Mac OS X, however, sshd is con- following the major Internet-Drafts on these
trolled by the superserver daemon, xinetd. (draft-ietf-secsh-gsskex and draft-ietf-
[5.3.3.2] Whenever an SSH client attempts to con- galb-secsh-gssapi). It implements user authen-
tact sshd on TCP port 22, xinetd notices the at- tication via the gssapi and external-keyx meth-
tempt and invokes a single instance of sshd (spe- ods; it does not yet have the improved gssapi-
cifically, sshd -i) to serve that connection. with-mic method. In case a Kerberos-secured
key exchange has been used for server authenti-
The xinetd configuration file for sshd is cation, the external-keyx method allows the us-
/etc/xinetd.d/ssh: erauth protocol to refer back to the previous
# /etc/xinetd.d/ssh: Kerberos exchange for user authentication, skip-

service ssh ping an unnecessary extra authentication phase.
{
disable = no This Kerberos support is also fully DNS-enabled,
socket_type = stream meaning it will find Kerberos authentication serv-
wait = no ers from information in the DNS if it is available. In
user = root a network of compatible and correctly configured
server = /usr/libexec/sshd-keygen-wrapper
Kerberos and OpenSSH servers, no extra configu-
server_args = -i
groups = yes ration is needed for a plain OS X host newly at-
flags = REUSE IPv6 tached to the network to use Kerberos for secure,
session_create = yes single-signon client SSH connections. All that is
}
required is to run:
Note the use of the wrapper script sshd-keygen-

$ kinit user@REALM
wrapper: it will generate new host keys if they are Please enter the password for user@REALM:
missing, as after a fresh OS install. ********
$ ssh user@host
Server Configuration Details Place the following lines into /etc/krb5.conf to

relieve the user from having to specify the realm̶
On Mac OS X, the serverwide configuration files and if the Kerberos principal and OS X account
are found in the /etc directory instead of the usernames are the same, then a simple kinit will
more common /etc/ssh: for example, the suffice:
serverwide configuration file is /etc/
sshd_config rather than /etc/ssh/ [libdefaults]
default_realm = REALM
sshd_config.
Instead of the command-line utility kinit, you can
The SSH software is a modified version of use the OS X GUI Kerberos utility:
OpenSSH maintained by Apple; they backport se- /System/Library/CoreServices/Kerberos.app
curity fixes to it whenever required.
Excerpted from SSH, The Secure Shell: The Definitive Guide, Second Edition by Daniel J. Barrett, Robert G.
Byrnes and Richard E. Silverman (ISBN: 0-596-00895-3). Copyright 2005, O'Reilly Media, Inc. www.oreilly.com
All rights reserved.
The International
Platform for Information
Security Professionals!
Your opportunity to meet and network with
world class experts, corporate leaders,
Conference & Exhibition policy makers and security professionals
28 Sept - 1 Oct 2005 Trade Exhibition

Putra World Trade Centre, A diverse showcase of security technologies
Kuala Lumpur and latest products by more than 60
companies, including MSC Trustgate, Info
Trek, IMS Asia, NTA-Monitor, Symantec
Corporation, Advancenet Technology, Scan
Associates, e-Lock Corporation, Computer
“Building e-Trust for Associates and more!
Listen to free Product Presentations and
National Competitiveness” build business network
www.esecuremalaysia.org.my
Conference
A comprehensive 6-track conference focusing
Concurrent events on security technologies, CERT and incident
response, network & application security,
information security management
Renowned speakers from U.S.A., Japan, and
leading corporations in Asia!
Free talks on 'Positive Use of the Internet'
covering topics such as online safety guide-
lines, parenting the net generation, cyber
crime, chat rooms, and more
MyCrypt 2005
An international Conference on Crytology
(MyCrypt 2005) presenting 19 best papers on
Cryptology by researchers from Germany,
USA, Switzerland, France, Belgium, Norway,
Japan, Taiwan, Korea, Hong Kong, Australia,
Enquiries Canada and Malaysia
Exhibition : Ms Karen Dass
Tel: 03-7727 2828 • Fax: 03-7727 2566
Email: exhibition@esecuremalaysia.org.my And More! Free product presentations
and Conference Free Tracks – Open to
Conference : Ms Andrea Samuel
Tel: 03-7727 0619 • Fax: 03-7727 0614 the Public!
Email: conference@esecuremalaysia.org.my
Jointly-Organised by Supporting Organisations Education Affiliate MyCrypt Co-organisers
Ministry of Energy,
Ministry of Science,
Water & Communications
Technology & Innovation Malaysian Communications &
Malaysia
Malaysia Multimedia Commission
Gold Sponsors Silver Sponsors Lanyard Sponsor Official Online Media Partners Media Partners
Computer forensic investigations usually involve the recovery of
data from mundane data storage devices such as hard drives, but
often involve recovery from less common devices such as magnetic
tapes.
Regardless of the media, the information recov- Integrity Validation Process

ered cannot be considered forensically sound un-
less the media is left unchanged by the recovery In theory, validating a backup tape is identical to
method. Validating that the media remains un- validating a single file. The process involves using
modified is usually handled by some sort of a one-way hashing function such as MD5 or SHA-1
checksum verification process. to calculate a fixed-length checksum of file.
This article describes a method for verifying that The hash generated is intrinsically sensitive to
a magnetic backup tape remains unchanged after minute changes, such that changing a single char-
a data extraction. acter in a multi-megabyte text file will result in a
completely different checksum. Thus, by creating
The Scenario a fingerprint checksum of the backup tape before
the restoration process begins and another after
Data needed to be extracted from several users the restoration process is complete, the two can
Exchange mailboxes as part of a fraud investiga- be compared to see if the tape data has been al-
tion. The mailbox data was to be extracted from tered. If the checksums are the same, then the
restores of the Exchange data stored on archived data on the tape remained unchanged, but if the
monthly backup tapes created with ArcServe. checksums are different, then the data on the
tape may has been altered and may be tainted for
The actual restore and recovery methods are be- forensic use.
yond the scope of this article, which is limited to
describing a method for integrity validation of the How is the validation process changed if the item
backup tapes. The data extracted from the tapes under inspection is not simply a single file, but in-
may be used in a court of law, and as such there stead a whole device, such as a hard drive or
needs to be a way to validate that the data on the magnetic tape?
tapes remains unchanged after extraction, such
that the extraction process could be repeated Under Linux, these devices are represented as
with identical results. single files, and can be treated as such to some
degree.
For example, using the md5sum and dd commands be read in a random fashion, such that any ad-
against the /dev/hdd device would calculate the dress on the disk can be read at any given time.
MD5 checksum of the entire /dev/hdd hard disk.
In its simplest form, the command might look like: However, tapes must be read sequentially from
the beginning of the tape to the end of the tape.
dd if=/dev/hdd | md5sum The caveat of this is that the dd command will

only read data until if reaches and end-of-file
The dd command is used to collect raw data from (EOF) marker.
the /dev/hdd device (until the end of the device is
reached), which is then piped to the md5sum A tape consists of a variable number of data
command for checksum calculation. If any data on "chunks", each of which ends with an EOF marker.
the disk were to change, repeating the process Thus, without modification, the dd command will
would yield a different checksum. Unfortunately, only read the first chunk of data on the tape,
when working with a tape device, the process is which is typically only the tape header.
not as simple.
Validating that the header remains unchanged af-
Complications from Tape Devices ter the extraction process is useless because it
says nothing about the data on the remaining
99+% of the tape.
Data is read from tape devices differently than it
is read from hard disks. With a hard disk, data can
Just because it isn t possible to validate the entire tape in a single pass,
doesn t mean that the entire tape can t be validated.
Work-Around Solution Validating the Validation Process It-

self
Just because it isn t possible to validate the entire
tape in a single pass, doesn t mean that the entire What s the assurance that the validation process
tape can t be validated. itself doesn t alter any data on the tape? The only
way to handle this is with a two-pass process.
One way to work-around this problem is view the
tape as a collection of chunks. If each chunk can If the data is unchanged during the validation
be validated, then the entire tape can be validated. process, then the checksums of each chunk
The mt (magnetic tape) command will help in posi- should match for each pass. If they do, then we
tioning the tape at the appropriate chunk. can be reasonably certain that our validation
process isn t altering any of the data on the tape.
If the chunks are to be validated programmati-
cally, then there must be a way to identify the to- A secondary validation process can be obtained
tal number of chunks contained on the tape in or- by utilizing the number of records read out by the
der to identify the end of the tape. dd command. Although the md5sum validation
routines are more than adequate, the nature of
Unfortunately, there doesn t seem to be an easy forensics work makes it desirable to have multiple
way to handle this at the onset, so another work- validation checks. In this case, should the number
around is required such that if the dd command of records read out per chunk change between
reports an error, the end of the tape has likely passes, this would be noted in the script output,
been reached, so the program will need to check which would flag the validation as a failure. Note
on the fly if the next chunk is the end of the tape. that this is simply a backup check process, as the
If it is, the pass is complete, but if not the tape md5sum collections would undoubtedly be differ-
needs to wind back to that start of that chunk, ent if the number of records read by dd changed
again using the mt command. between passes.
Collecting the Results adapter and tape drive in the system). This script
successfully validates DLT tapes written by
Because there could be dozens of chunks of data ArcServe NT and has not been tested against
on each tape, it would be undesirable to hand- other media types or backup sessions. When run,
validate each of these for two passes. As a short- the output of the overall verification is displayed
cut solution, the checksum of each chunk of data at the terminal and an archive is created in the
could be stored in a file and a super-checksum current directory which holds the output and all
can be made of this file, which would be represen- intermediary files. For a 40 GB tape, the verifica-
tative of a checksum of the entire tape. The tion process takes approximately 6 hrs on a PIII-
super-checksum created this way is an abstrac- 600.
tion and not a true checksum of the entire tape,

but fulfills the same purpose with a manageable The practical implementation example was only
size. tested against DLT tapes containing Exchange

data created by ArcServe. While it should be
equally effective against other data and media, it
Practical Implementation has not been tested for such purposes.
A reference script, tapeverify.sh, written as a bash The output created is a compressed tar file lo-
shell script is included at the end of this article. cated in the current directory. The contents of the
This script was developed to handle the Exchange archive are as follows where [pid] indicates the
recovery scenario described before. It was devel- process ID of the script and [pass] indicates which
oped on Knoppix (which easily identified the SCSI pass (1 or 2) to which the item corresponds:
• tapedata.[pid].[pass].records - The results of the records out from dd

• tapedata.[pid].[pass].md5sum - The results of the md5sums from each chunk
• tapedata.[pid].[pass].log - The logged output of all commands during execution with timestamps
• tapedata.[pid].verified - The final results comparing the records out and md5sums for each pass
Upon completion, the program displays the contents of tapedata.[pid].verified, which looks like the follow-
ing:
##### Individual MD5 Verification #####

99be51e3f2be8936a9bf9f64308f34b0 /tmp/tapedata.23981.1.md5sum
99be51e3f2be8936a9bf9f64308f34b0 /tmp/tapedata.23981.2.md5sum
##### Individual Record Count Verification #####
f3d2db40509ed0e0e4bc513bdcc4026a /tmp/tapedata.23981.1.records
f3d2db40509ed0e0e4bc513bdcc4026a /tmp/tapedata.23981.2.records
So long as each pair matches, the tape is vali- checksum is used to validate the media before
dated. The same process can be used to re- and after the data extraction procedure to ensure
validate the tape after a data extraction process, the media has not been modified. However, stan-
i.e. restoring the data on the tape to a system. If dard verification techniques do not lend well to
the post-restore validation matches the pre- magnetic tapes, and different techniques are re-
restore validation, then the tape can safely be said quired for the validation process.
to have been unchanged by the restore process.
This article covered a process in which a tape is
Summary separated into an arbitrary number of chunks and
each chunk is independently validated.
Computer forensics investigations are somewhat

useless if the process of investigation changes the The reference script, tapeverify.sh, is included on
original evidence media. Typically, a hashing the following page.
William Lynch is Senior Consultant for Computer Task Group s Information Securty Services Practice.
#!/bin/bash
# This is a poor man's tape data verification script
# Written 20050511 by FWL (bill.lynch@ctg.com)
#
# BSD License Follows
#
# Copyright (c) 2005, William Lynch, CTG
# All rights reserved.
#
# Redistribution and use in source and binary forms, with or without modification,
# are permitted provided that the following conditions are met:
#
# * Redistributions of source code must retain the above copyright notice, this list
# of conditions and the following disclaimer.
# * Redistributions in binary form must reproduce the above copyright notice, this
# list of conditions and the following disclaimer in the documentation and/or
# other materials provided with the distribution.
# * Neither the name of Computer Task Group (CTG) nor the names of its contributors
# may be used to endorse or promote products derived from this software without
# specific prior written permission.
#
# THIS SOFTWARE IS PROVIDED BY THE COPYRIGHT HOLDERS AND CONTRIBUTORS "AS IS" AND
# ANY EXPRESS OR IMPLIED WARRANTIES, INCLUDING, BUT NOT LIMITED TO, THE IMPLIED
# WARRANTIES OF MERCHANTABILITY AND FITNESS FOR A PARTICULAR PURPOSE ARE DISCLAIMED.
# IN NO EVENT SHALL THE COPYRIGHT OWNER OR CONTRIBUTORS BE LIABLE FOR ANY DIRECT,
# INDIRECT, INCIDENTAL, SPECIAL, EXEMPLARY, OR CONSEQUENTIAL DAMAGES (INCLUDING, BUT
# NOT LIMITED TO, PROCUREMENT OF SUBSTITUTE GOODS OR SERVICES; LOSS OF USE, DATA, OR
# PROFITS; OR BUSINESS INTERRUPTION) HOWEVER CAUSED AND ON ANY THEORY OF LIABILITY,
# WHETHER IN CONTRACT, STRICT LIABILITY, OR TORT (INCLUDING NEGLIGENCE OR OTHERWISE)
# ARISING IN ANY WAY OUT OF THE USE OF THIS SOFTWARE, EVEN IF ADVISED OF THE POSSIBILITY
# OF SUCH DAMAGE.
#
# This script was created against DLT tapes holding data written by
# Arcserve NT. I cannot speak to its viability against other media or
# data, though I suspect it would work.
# Loop through the tape twice calculating the MD5 sums of each recordset
for i in `seq 1 2`; do
echo "Beginning Pass $i at `date`"
# Write a header for the logfile

echo "##### Tape Verification Logfile Pass $i ####" > /tmp/tapedata.$$.$i.log
# Prepare the tape and display the tape details

mt -f /dev/nst0 rewind >> /tmp/tapedata.$$.$i.log 2>&1
mt -f /dev/nst0 status >> /tmp/tapedata.$$.$i.log 2>&1
# Initialize variables
ENDTAPE=0
# Process the MD5 sums of each backup session
while [ $ENDTAPE -ne 1 ]; do
# Timestamp
date >> /tmp/tapedata.$$.$i.log 2>&1
# Collect and calculate the MD5 sum of this backup session

dd if=/dev/nst0 bs=64k 2>> /tmp/tapedata.$$.$i.log | md5sum >> /tmp/tapedata.$$.$i.log
# Display the tape address

mt -f /dev/nst0 tell >> /tmp/tapedata.$$.$i.log 2>&1
LOCATION=`mt -f /dev/nst0 tell | awk '{ print $3 }' | awk -F. '{ print $1 }'`
# Check to see if we are at the end of the tape

dd if=/dev/nst0 bs=64k count=1 > /dev/null 2>&1
ENDTAPE=$?
# Return to the last location

mt -f /dev/nst0 seek $LOCATION
done
# Extract the MD5 sums

echo "##### Individual MD5 Extracts ####" > /tmp/tapedata.$$.$i.md5sum
grep '\-$' /tmp/tapedata.$$.$i.log | sort -u >> /tmp/tapedata.$$.$i.md5sum
# Extract the record count

echo "##### Individual Record Log ####" > /tmp/tapedata.$$.$i.records
grep 'records out' /tmp/tapedata.$$.$i.log | sort -u >> /tmp/tapedata.$$.$i.records
done
# Rewind the tape

mt -f /dev/nst0 rewind > /dev/null 2>&1
# Calculate the final MD5 sums

echo "##### Individual MD5 Verification #####" > /tmp/tapedata.$$.verified
md5sum /tmp/tapedata.$$.1.md5sum >> /tmp/tapedata.$$.verified
md5sum /tmp/tapedata.$$.2.md5sum >> /tmp/tapedata.$$.verified
echo "##### Individual Record Count Verification #####" >> /tmp/tapedata.$$.verified
md5sum /tmp/tapedata.$$.1.records >> /tmp/tapedata.$$.verified
md5sum /tmp/tapedata.$$.2.records >> /tmp/tapedata.$$.verified
# Display the results to the console

clear
echo "##### Tape Verification Results #####"
cat /tmp/tapedata.$$.verified
# Package up all the working files

OLDDIR=`pwd`
cd /tmp
for i in `seq 1 2`; do
echo "tapedata.$$.$i.records" >> /tmp/tapedata.$$.tarfiles
echo "tapedata.$$.$i.md5sum" >> /tmp/tapedata.$$.tarfiles
echo "tapedata.$$.$i.log" >> /tmp/tapedata.$$.tarfiles
done
echo "tapedata.$$.verified" >> /tmp/tapedata.$$.tarfiles
tar cvzf $OLDDIR/tapedata.$$.tar.gz -T /tmp/tapedata.$$.tarfiles > /dev/null
rm `cat /tmp/tapedata.$$.tarfiles`
rm /tmp/tapedata.$$.tarfiles
cd $OLDDIR
exit 0

Insecure Mag 3

Uploaded by

Document Information

Copyright

Available Formats

Share this document

Share or Embed Document

Sharing Options

Did you find this document useful?

Is this content inappropriate?

Copyright:

Available Formats

Insecure Mag 3

Uploaded by

Copyright:

Available Formats

A lot has happened in the security world in the past 2 months since the last issue of (IN)SECURE was

The editorial team:

Visit the magazine website at www.insecuremag.com

(IN)SECURE Magazine contacts

Feedback and contributions: editors@insecuremag.com

Advertising and marketing: marketing@insecuremag.com

Copyright HNS Consulting Ltd. 2005.

Acunetix released Acunetix Web Vulnerability Scanner: a tool to automati-

SmoothWall Launches School Guardian

Criston Releases Precision 5.2

CyberGuard Corporation announced a new all-in-one, centrally managed desktop

Trend Micro Offers Three New Anti-Spyware Solutions

BeCrypt Launches Disk Protect 3.0

BeCrypt, the leading UK encryption security company, has unveiled version

DISK Protect is easy to install using standard network deployment tools.

Cost Of Sarbanes-Oxley Compliance Is At The Expense Of Other Security

A new report published by the Information Security

path to security breaches for each character of a person s name. If

1 Time to Live on the Network , Avantgarde, www.avantgarde.com/xxxxttln.pdf

tive in mind, such as access to confidential of the discovery/attack life-cycle.

2 Common Vulnerabilities and Exposures , MITRE Corporation, cve.mitre.org

Security Patches ‒ Protecting tion. Intrusion prevention technologies and

4 The Twenty Most Critical Internet Security Vulnerabilities , www.sans.org/top20

In summary, security attacks on networks

By combining a couple of facts about Richard Bejtlich, such as being one of

In "Tao of Network Security Monitoring" Bejtlich provides a wealth of informa-

SSH, The Secure Shell : The Definitive Guide, Second Edition

Windows Server 2003 Security: A Technical Reference

Essential Mac OS X Panther Server Administration

Cybercrime: Incident Response & Digital Forensics is published by Information

Network Security Tools

Home Networking Simplified

I was very surprised when I took a glimpse at "Home Networking Simplified".

The point is this: attacking a PDA is not as easy as attacking a

Autorun cated SD Atari game card. This card could

ture. As designed by Microsoft, if a file

int WINAPI WinMain(HINSTANCE hInstance, HINSTANCE hPrevInstance,

Listing 1: The Hard Reset Code

If you happen to download an executable, or perhaps insert a

URL Obfuscation PIE Domain Object Model

http://www.paypal.com&login.ran web server. Once the page loads, the con-

Figure 1: Using XFS to Alter Web Content

The following lists the registry settings we

The PC world has long been wary about

used by attackers for many years. How- keyboard

ever, when it comes to the Pocket PC, not o CLSID: 42429667-ae04-

much thought is given to the possibility of 11d0-a4f8-00aa00a749b9

a logger that can capture all your key- (set 1 to 0)

board is completely different. by keylogger.dll

The law enforcement community has started to notice PDA s

Disassembling Binaries To get inside the binary files on a Pocket

Figure 2: Visible FTP Server Icon

BL ShowWindow to MOV R0, R0 (Vir-

The point of these two examples is that Denial of Service

Bluetooth attacks have long been making

targeted for the cell phone, not the PDA.

stalled by the vendor/OS maker. device. Generally, this can be accomplished

messages to a Bluetooth enabled PDA or sible to find non-discoverable devices via a

such as bluejackq.com where you can addresses used by Bluetooth devices.

learn more about this issue.

Since Bluetooth is only protected by a 4-digit pin number, it is

Wi-Fi Issues Buffer Overflow Attacks

PDA Attack Tool While Windows Mobile based sniffers gen-

against other computer users. tcpdump. Figure 4 is a screen shot of a