In Through The Out Door

dpreformer sends word that President Bush signed a classified directive Jan. 8 (it only came to light this week) putting all cyber-defense and counter-offensive activity for government networks under the aegis of the National Security Agency. Previously, federal agencies had disparate intrusion and attack monitoring programs. The directive does not address private-sector networks and systems. While some lawmakers and civil-rights advocates are unhappy with expanding the NSA’s role domestically, one alternative that was considered and rejected — putting Homeland Security in charge — might have been worse. “A proposal last year by the White House Homeland Security Council to put the Department of Homeland Security in charge of the initiative was resisted by national security agencies on the grounds that the department, established in 2003, lacked the necessary expertise and authority. The tug-of-war lasted weeks and was resolved only recently, several sources said.”

[From Classified Cyber-Security Directive Puts NSA In Charge]

Not only are privacy and security not at odds with one another, but in a networked, database-driven world, they’re virtually identical. Here’s why Real ID will make a hash of both.

[From Analysis: Metcalfe's Law + Real ID = more crime, less safety]

After blogging about the need to use and maintain an anti-virus solution for your OS X systems, an anonymous reply questioning the need to use security tools at all on OS X systems gave me pause. You do not need me to link to the numerous articles flying around the internets that report on how one reason switchers are flocking to OS X is because of the lack of prevalence of malware. Folks are tired of viruses, worms, trojans, etc. hammering their systems. They are even more harrowed by having to maintain vigilance over their anti-virus programs, hoping they are not too far out of sync with the current “DAT”. However, switching to run OS X to avoid running anti-virus programs may not be the wisest choice.

To answer the “do we really need security tools for OS X?” question in a slightly different way than you’ve seen from many technology pundits, I’d like to turn your attention to utility called rkhunter or “rootkit hunter”. As most TAB readers should know by now, OS X has it’s origins in Unix (the “darwin” base comes from FreeBSD), and most folks believe *nix variants (linux, FreeBSD, Solaris, etc) to be extremely secure, free of the problems that plague those sad, sad Windows users. If you fall into that camp, please take a moment and browse the Secunia FreeBSD 5.x artchives. Secunia reports show over 91 vulnerabilities, with critical ones impacting core services such as file sharing and remote access. This should not be surprising since Unix systems have been favorite targets for hackers as they provide such a powerful base to launch further exploits. One of the more gnarly hacks is the installation of a rootkit – a program that can take surreptitious control of your system. And, guess what: your Mac OS X workstation/server is susceptible to rootkits just like any other Unix system, even with Leopeard’s enhanced security features. How can you fight something you can’t even see? You need a tool to help. Modern anti-virus products can and usually do cover rootkits, but the rkhunter tool may cover additional rootkits and may update rootkit signatures more frequently than a traditional vendor.

I wouldn’t recommend trying to get rkhunter installed on your Mac since it will require some enhanced Terminal-fu. Thankfully, Christian Hornung understood the need for such a tool and built a wrapper for it called (surprisingly enough), OS X Rootkit Hunter [dmg], complete with installer. After installing the package, navigate to Applications->OSXrkhnter and run the “Rootkit Hunter” app.

It’s good practice to update the rootkit database (similar to a virus engine DAT update) before each scan since there may be new rootkit signatures from new or altered exploits. When you start the scan, you will see a password dialog – just as you would with any operation that requires additional privileges to run – since OS X Rootkit Hunter needs to look in places your normal account user account cannot. You will also see Terminal windows displaying a running report of what rkhunter has or has not found (since this front-end does not free you from all the gory details of what lies beneath Aqua).

While you can download and run OS X Rootkit Hunter, I would strongly suggest that less technical users obtain one of the commercially available malware scanners since the output from OS X Rootkit Hunter can be a bit daunting. The presence and history of this tool should be enough justification for the need to run security software on your systems.

[From Why Mac Security Matters: OS X Rootkit Hunter]

BoingBoing is reporting that the FBI may be burying the existence of a document that proves US officials stole nuclear secrets for eventual sale to Pakistan and Saudi Arabia. “One of the documents relating to the case was marked 203A-WF-210023. Last week, however, the FBI responded to a freedom of information request for a file of exactly the same number by claiming that it did not exist. But The Sunday Times has obtained a document signed by an FBI official showing the existence of the file. Edmonds believes the crucial file is being deliberately covered up by the FBI because its contents are explosive. She accuses the agency of an ‘outright lie.’”[From FBI Burying Doc Showing US Officials Stole Nuclear Secrets?]

Boing Boing’s Gadgets editor Joel Johnson was asked to appear on The Hugh Thompson Show, an AT&T-produced program that airs on the AT&T Tech Channel. Johnson was obviously supposed to speak about gadgets, but instead used his allotted time questioning AT&T’s plans to implement piracy filters across their network, which the show’s producers apparently didn’t appreciate.

As you can see from the video, the crew ended up scrubbing the interview about half-way through. Figuring that might happen, I asked my steely-nerved friend Richard Blakeley to tape the first take. I wanted to make sure that we had a record of the event, primarily to ensure that AT&T would have no reason to try to bury the interview entirely the same reason I am running this clip now, while discussion about what to do with my segment in post-production is surely underway.

In a second take gadgets are discussed, but network neutrality and AT&T’s relationship with the NSA become fodder for conversation.
read comment(s) [From Will AT&T Filter Discussion Of Their Filters? - Boing Boing gadget blogger questions practice on AT&T-produced show]

Updated version of Mujahideen Secrets encryption software issued by al-Qaida-linked group touted as communications tool for militants. [From Jihadi software promises secure Web contacts]

BobB passed us a link to a NetworkWorld article, exploring the ongoing realization in business circles of the dangers online criminals pose. The piece raises the possibility that criminal elements are gaining access to US research labs in an effort to ferret out corporate and governmental information. One institute referred to in the article states: “Economic espionage will be increasingly common as nation-states use cyber theft of data to gain economic advantage in multinational deals. The attack of choice involves targeted spear phishing with attachments, using well-researched social engineering methods to make the victim believe that an attachment comes from a trusted source.” We just recently discussed possible hacker involvement in several municipal blackouts.

Read more of this story at Slashdot.

[From Online Crime Seen as Growing Threat to Business, Politics]

Google to Host Terabytes of Open-Source Scientific Data — Sources at Google have disclosed that the humble domain, http://research.google.com, will soon provide a home for terabytes of open-source scientific datasets. The storage will be free to scientists and access to the data will be free for all.

Link: http://blog.wired.com/wiredscience/2008/01/google-to…

[From Google to Host Terabytes of Open-Source Scientific Data (Wired)]

US Government challenges encryption keys ruling [From US Government challenges encryption keys ruling]

New Storm worm wave sweeping the internet [From New Storm worm wave sweeping the internet]

Along with the standard spiels about exit rows and seat belts, flight attendents of the future might add this to their repetoires: “The captain has requested that all passengers close their browsers until he regains control of the aircraft.” Recently the AP reported on a possible unintended consequence of offering Internet access to all passengers on Boeing’s 787 Dreamliner. Here’s an except: Before Boeing Co.’s new 787 jetliner gets the green light to fly passengers, the aircraft maker will have to prove that offering Internet access in the cabin won’t leave the flight controls vulnerable to hackers and hijackers. Boeing claims it has engineered safeguards to shut out unauthorized users, but some security analysts worry navigation and communications systems could be vulnerable. “The odds of this being perfect are zero,” said Bruce Schneier, chief technology officer at the security services firm BT Counterpane. “It’s possible Boeing can make their connection to the Internet secure. If they do, it will be the first time in mankind anyone’s done that.” But Boeing spokeswoman Lori Gunter said 787′s aviation electronics “are not connected in any way to the Internet.” Boeing has designed the 787 to allow airlines to offer passengers more in-flight…

[From Hacking the Dreamliner?]

Cyber attacks on critical infrastructure targets. On Wednesday the Central Intelligence Agency (CIA) told an international gathering of government officials, engineers and security managers from electric, water, oil & gas and other critical industry asset owners that the CIA has information that cyber intrusions into utilities was responsible for at least three blackouts and then followed up with extortion demands. The CIA went on to say they suspect, but cannot confirm, that some of these attackers had the benefit of inside knowledge. The very next day the Federal Energy Regulatory Commission (FERC) approved eight mandatory cyber security standards that extend to all entities connected to the nation’s power grid. The following are the eight areas addressed by these standards: 1. Critical cyber asset identification 2. Security management controls 3. Personnel and training 4. Electronic security perimeters 5. Physical security of critical cyber assets 6. System security management 7. Incident reporting and response planning 8. Recovery plans for critical cyber assets These eight standards were created to increase the security of our CIP and reduce the risk of a successful attack. Disruption of a county’s critical infrastructure would have significant direct and indirect damages. Most of these damages would be…

[From More Cyber War Gouge]

The disclosure was made at a New Orleans security conference Friday attended by international government officials, engineers, and security managers. [From CIA Admits Cyberattacks Blacked Out Cities]

PolishLinux.org has an unconventional review of SLAX 6. RC6 which focuses on exploring the nature of LiveCDs and the power of technologies like mounting devices, SquashFS and Union File System in regards to SLAX LiveCD distribution. [From SLAX 6.0: How does it work? ]

Are you using SSH in the best way possible? Have you configured it to be as limited and secure as possible? The goal of this document is to kick in the new year with some best practices for SSH: why you should use them, how to set them up, and how to verify that they are in place. All of the examples below assume that you are using EnGarde Secure Linux but any modern Linux distribution will do just fine since, as far as I know, everybody ships OpenSSH.

[From SSH: Best Practices ]

As the Internet grows in size and bandwidth, routers must search through larger and larger routing tables faster and faster. Not an impossible task, but probably an expensive one in the future unless we come up with a different approach to Internet routing.

Read More…

[From Internet routing shows growing pains—again]

Spychief Mike McConnell is drafting a plan to protect America’s cyberspace that will raise privacy issues and make the current debate over surveillance law look like “a walk in the park,” McConnell tells The New Yorker in the issue set to hit newsstands Monday. “This is going to be a goat rope on the Hill. My prediction is that we’re going to screw around with this until something horrendous happens.”

The first stop is a little utility called opensnoop. Leopard ships with something called DTrace that gives developers and administrators the ability to take a peek at what all running code is doing in a flexible and dynamic way. Giving DTrace the coverage it deserves is beyond a simple blog post, but there are some smaller utilities – like opensnoop – that take advantage of the power of DTrace, but on a more targeted scale which are worthy of a minor exposition.The main purpose of the opensnoop utility is to provide a report of file opens as they occur. Curious as to what really happens when Safari opens a web page? Want to see what files are accessed from that latest program you downloaded? You can find the answers with opensnoop.

[From Hidden Gems In Leopard: OpenSnoop]

[From Hackers Unleash Insidious Crimeware Attack]

Significant security flaws in the Transportation Security Administration’s traveler redress web site exposed thousands of travelers to the risk of identity theft. Alanis might call it ironic, but we call it sad and unacceptable.

Read More…

[From TSA security flaws exposed users to risk of identity theft]