security

Modern piracy on the high seas

business, history, law, security / /

From Charles Glass’ “The New Piracy: Charles Glass on the High Seas” (London Review of Books: 18 December 2003):

Ninety-five per cent of the world’s cargo travels by sea. Without the merchant marine, the free market would collapse and take Wall Street’s dream of a global economy with it. Yet no one, apart from ship owners, their crews and insurers, appears to notice that pirates are assaulting ships at a rate unprecedented since the glorious days when pirates were ‘privateers’ protected by their national governments. The 18th and 19th-century sponsors of piracy included England, Holland, France, Spain and the United States. In comparison, the famed Barbary corsairs of North Africa were an irritant. Raiding rivals’ merchant vessels went out of fashion after the Napoleonic Wars, and piracy was outlawed in the 1856 Declaration of Paris (never signed by the US). Since the end of the Cold War, it has been making a comeback. Various estimates are given of its cost to international trade. The figure quoted most often is the Asia Foundation’s $16 billion per annum lost in cargo, ships and rising insurance premiums.

The International Maritime Bureau (IMB), which collects statistics on piracy for ship owners, reports that five years ago pirates attacked 106 ships. Last year they attacked 370. This year looks worse still.

…

In waters where piracy flourished in the past, the tradition embodied in figures such as Captain Kidd has persisted: off the Ganges delta in Bangladesh, in the Java and South China Seas, off the Horn of Africa and in the Caribbean. Three conditions appear necessary: a tradition of piracy; political instability; and rich targets – Spanish galleons for Drake, oil tankers for his descendants. A fourth helps to explain the ease with which it happens: ‘The maritime environment,’ Gunaratna said, ‘is the least policed in the world today.’

The IMB has not been able to persuade the international community or the more powerful maritime states to take serious action. The Bureau’s director, Captain Pottengal Mukundan, believes there is nothing crews can do to protect themselves. National maritime laws are not enforced beyond national boundaries – which is to say, over more than half the earth’s surface. Beyond territorial waters, there are no laws, no police and no jurisdiction. Many countries lack the will or the resources to police even their own waters. The IMB advises all ships against putting in anywhere near states like Somalia, for instance, where there is a near certainty of attack. … Piracy is a high-profit, low-risk activity.

The IMB urges crews to take more precautions, but owners can’t afford every recommended improvement: satellite-tracking devices, closed circuit cameras, electric fencing and security officers on every ship. Owners and trade unions discourage the arming of merchant ships in the belief that firearms will put crews’ lives at greater risk. Only the Russians and the Israelis are known to keep weapons aboard. Competition in the shipping business forces owners to minimise expenditure on crews as on everything else. A commission of inquiry into the 1989 Exxon Valdez spill that nearly destroyed the Alaskan coast reported that ‘tankers in the 1950s carried a crew of 40 to 42 to manage about 6.3 million gallons of oil . . . the Exxon Valdez carried a crew of 19 to transport 53 million gallons of oil.’ [Quoted in Dangerous Waters: Modern Piracy and Terror on the High Seas by John Burnett] With the automation of many shipboard tasks, vessels today carry even fewer seamen than they did when the Exxon Valdez ran aground. That means fewer eyes to monitor the horizon and the decks for intruders.

…

Air and land transport routes have come under tighter scrutiny since 11 September 2001, but improvements to maritime security are few. An oil tanker can carry a load that is far, far more explosive than any civil aircraft. And most piracy, including the seizure of oil tankers, takes place near countries with powerful Islamist movements – Indonesia, Malaysia, the Philippines, Yemen and Somalia. Lloyd’s List reported on 4 November that Indonesia is ‘the global black spot’ with 87 attacks in the first nine months of this year – ‘the number of attacks in the Malacca Straits leaped from 11 in 2002 to 24 this year.’ Indonesia, which consists of two thousand islands, is the world’s most populous Muslim country. It has experienced decades of repression by a kleptocratic military, communal violence and the degradation of a once vibrant economy. Radical Islamists have made it the focus of their activity and recruitment in Asia.

Modern piracy on the high seas Read More »

A cheap, easy way to obfuscate license plates

security / /

From Victor Bogado da Silva Lins’ letter in Bruce Schneier’s Crypto-Gram (15 May 2004):

You mentioned in your last crypto-gram newsletter about a cover that makes a license plate impossible to read from certain angles. Brazilian people have thought in another low-tech solution for the same “problem”, they simply tie some ribbons to the plate or the car itself; when the car is running (speeding) the ribbons fly and get in front of the plate making it difficult to read the plate.

A cheap, easy way to obfuscate license plates Read More »

World distance reading WiFi and RFID

security, technology / /

From Bruce Schneier’s “Crypto-Gram” (15 August 2005):

At DefCon earlier this month, a group was able to set up an unamplified 802.11 network at a distance of 124.9 miles.

http://www.enterpriseitplanet.com/networking/news/…

http://pasadena.net/shootout05/

Even more important, the world record for communicating with a passive RFID device was set at 69 feet. Remember that the next time someone tells you that it’s impossible to read RFID identity cards at a distance.

http://www.makezine.com/blog/archive/2005/07/…

Whenever you hear a manufacturer talk about a distance limitation for any wireless technology — wireless LANs, RFID, Bluetooth, anything — assume he’s wrong. If he’s not wrong today, he will be in a couple of years. Assume that someone who spends some money and effort building more sensitive technology can do much better, and that it will take less money and effort over the years. Technology always gets better; it never gets worse. If something is difficult and expensive now, it will get easier and cheaper in the future.

World distance reading WiFi and RFID Read More »

Chinese attacks on government and business networks

business, security / /

From Foreign Policy‘s interview with Richard A. Clarke, “Seven Questions: Richard Clarke on the Next Cyber Pearl Harbor” (April 2008):

I think the Chinese government has been behind many, many attacks—penetrations. “Attacks” sounds like they’re destroying something. They’re penetrations; they’re unauthorized penetrations. And what they are trying to do is espionage. They’re engaged in massive espionage, not only in the U.S. government, in the U.S. private sector as well, but also around the world. The British security service, MI5, sent a note to the 300 largest corporations in England a few months ago, telling them that the Chinese government had probably penetrated their networks.

…

What’s happening every day is that all of our information is being stolen. So, we pay billions of dollars for research and development, both in the government and the private sector, for engineering, for pharmaceuticals, for bioengineering, genetic stuff—all sorts of proprietary, valuable information that is the result of spending a lot of money on R&D—and all that information gets stolen for one one-thousandth of the cost that it took to develop it.

…

I’m also concerned about penetrations of U.S. research-and-development firms, everything from pharmaceuticals to genetics to aerospace engineering—all the things we have to sell in our knowledge-based economy. We are a post-industrial, knowledge-based society. That’s what we sell to the world. If other people can steal it readily, then we won’t have much of a margin.

Chinese attacks on government and business networks Read More »

The NSA’s cryptographic backdoor

security / /

From Bruce Schneier’s “The Strange Story of Dual_EC_DRBG” (Crypto-Gram: 15 November 2007):

This year, the U.S. government released a new official standard for random number generators, which will likely be followed by software and hardware developers around the world. Called NIST Special Publication 800-90, the 130-page document contains four different approved techniques, called DRBGs, or “Deterministic Random Bit Generators.” All four are based on existing cryptographic primitives. One is based on hash functions, one on HMAC, one on block ciphers, and one on elliptic curves. It’s smart cryptographic design to use only a few well-trusted cryptographic primitives, so building a random number generator out of existing parts is a good thing.

But one of those generators — the one based on elliptic curves — is not like the others. Called Dual_EC_DRBG, not only is it a mouthful to say, it’s also three orders of magnitude slower than its peers. It’s in the standard only because it’s been championed by the NSA, which first proposed it years ago in a related standardization project at the American National Standards Institute.

…

Problems with Dual_EC_DBRG were first described in early 2006. The math is complicated, but the general point is that the random numbers it produces have a small bias. The problem isn’t large enough to make the algorithm unusable — and Appendix E of the NIST standard describes an optional workaround to avoid the issue — but it’s cause for concern. Cryptographers are a conservative bunch; we don’t like to use algorithms that have even a whiff of a problem.

But today there’s an even bigger stink brewing around Dual_EC_DRBG. In an informal presentation at the CRYPTO 2007 conference this past August, Dan Shumow and Niels Ferguson showed that the algorithm contains a weakness that can only be described as a backdoor.

…

What Shumow and Ferguson showed is that these numbers have a relationship with a second, secret set of numbers that can act as a kind of skeleton key. If you know the secret numbers, you can predict the output of the random number generator after collecting just 32 bytes of its output. To put that in real terms, you only need to monitor one TLS internet encryption connection in order to crack the security of that protocol. If you know the secret numbers, you can completely break any instantiation of Dual_EC_DRBG.

…

My recommendation, if you’re in need of a random number generator, is not to use Dual_EC_DRBG under any circumstances. If you have to use something in SP 800-90, use CTR_DRBG or Hash_DRBG. Or Fortuna or Yarrow, for that matter.

The NSA’s cryptographic backdoor Read More »

Graveyard shifts and torpedo coffins

commonplace book, history, science, security / /

From Atul Gawande’s “Final Cut: Medical arrogance and the decline of the autopsy” (The New Yorker: 19 March 2001):

… in the nineteenth century … [some doctors] waited until burial and then robbed the graves, either personally or through accomplices, an activity that continued into the twentieth century. To deter such autopsies, some families would post nighttime guards at the grave site – hence the term “graveyard shift.” Others placed heavey stones on the coffins. In 1878, one company in Columbus, Ohio, even sold “torpedo cofins,” equipped with pipe bombs designed to blow up if they were tampered with.

Graveyard shifts and torpedo coffins Read More »

Bots on campus!

education, security / /

From Lisa Vaas’ “Are Campuses Flooded with Zombified Student PCs?” (eWeek: 22 October 2007):

Rather, bot herders have sophisticated technology in place that can detect how fast a bot’s connection is. If that connection changes over time – if, say, a student is poking around at her parent’s house with dial-up all summer and then comes back to school and the campus network’s zippy broadband – the herder detects the increased bandwidth, and that zombie PC suddenly becomes a much more useful tool for sending spam or engaging in other nefarious activities, as pointed out by SecureWorks Director of Development Wayne Haber …

“The more significant factor is to take a machine that was the only system, or one of two to three, on a home network, and to move it to an environment of hundreds or thousands of machines on a network in different states of being patched and of running security software,” [Craig Schmugar, threat research manager for McAfee’s Avert Labs] said. “The new students coming in, there’s a greater chance of having new computers, and those might not have firewalls. It’s a more diverse network environment, with a greater opportunity for machines to be attacked. Maybe not successfully, but at least there’s more traffic thrown at machines.”

Another helpful thing about campuses, of course, is that they have loads of systems left on around the clock in their labs. Universities also have the added stickiness of trying to administer security policies for a constantly shifting population, with visiting scholars coming and going and a variable range of access rights necessary for staff and students.

Bots on campus! Read More »

How to open a physicist’s briefcase

security, technology / /

From John D. Barrow and John K. Webb’s "Inconstant Constants: Do the inner workings of nature change with time?" (Scientific American: 23 May 2005):

One ratio of particular interest combines the velocity of light, c, the electric charge on a single electron, e, Planck’s constant, h, and the so-called vacuum permittivity, 0. This famous quantity … called the fine-structure constant, was first introduced in 1916 by Arnold Sommerfeld, a pioneer in applying the theory of quantum mechanics to electromagnetism. It quantifies the relativistic (c) and quantum (h) qualities of electromagnetic (e) interactions involving charged particles in empty space (0). Measured to be equal to 1/137.03599976, or approximately 1/137, has endowed the number 137 with a legendary status among physicists (it usually opens the combination locks on their briefcases).

How to open a physicist’s briefcase Read More »

How to delete stuck files on Amazon’s S3

security, tech help, technology / /

I use Amazon’s S3 (Simple Storage Service) to back up files, and I also use OmniGraffle, a diagramming program, on my Mac. This is a letter I sent to OmniGraffle recently that explains a problem with the interaction of OmniGraffle and S3.

Start letter:

OmniGraffle (OG) is a great app, but it has a serious, showstopping incompatability with Amazon’s S3 (Simple Storage Service).

S3 is an online backup service run by Amazon. Lots & lots of people use it, with more moving to it all the time. You can find out more about S3 here:

http://en.wikipedia.org/wiki/Amazon_S3

I created some documents in OmniGraffle and uploaded them to S3. When I tried to perform another backup, the command-line S3 app I was using crashed. I tried another. Crashed. I tried Interarchy, a GUI app, but while it appeared to work, in reality it simply silently failed. After much trial and error, I finally determined that it was a particular file generated by OG that was causing the problems. But I had no idea how to fix things.

After searching on the Amazon S3 forums, it turns out others are experiencing the exact same problem. I found two entries discussing how an invisible character in the name of the Icon file located in a .graffle folder was causing the crash. Here are those two entries:

http://developer.amazonwebservices.com/connect/thread.jspa?messageID=63273

http://developer.amazonwebservices.com/connect/thread.jspa?messageID=45488

Eventually, after over an hour of trying various combinations with the help of a friend, I was able to delete the offending file using this command.

./s3cmd.rb -v delete “granneclientele:clientele/images/omnigraffle/audacity-toolbar-tools.graffle/Icon”$’\r’

I show that command to you not because I expect you’ll understand it, but because it demonstrates that this is a bear of a problem that many of your customers will be unable to solve on their own. As more of your customers use S3, they’re going to run into this issue.

I understand this all may sound confusing, so please do not hesitate to call or email me for further details.

/End letter

An OmniGraffle support person wrote me back, saying that this issue had been fixed in version 4.2 of the software.

How to delete stuck files on Amazon’s S3 Read More »

Notes on getting into well-guarded events using social engineering

security, writing ideas / /

From Bruce Schneier’s “How to Crash the Oscars” (7 March 2006):

If you want to crash the glitziest party of all, the Oscars, here’s a tip from a professional: Show up at the theater, dressed as a chef carrying a live lobster, looking really concerned. …

“The most important technique is confidence,” he said. “Part of it is being dressed the part, looking the part, and acting the part and then lying to get in the door.”

The biggest hole in the elaborate Oscars security plan, Mamlet said, is that while everyone from stagehands to reporters have to wear official credentials, the celebrities and movie executives attending the event do not.

“If you really act like a celebrity, the security guards will worry that they will get into trouble for not recognizing you,” Mamlet said.

From Bruce Schneier’s “Social Engineering Notes” (15 May 2007):

This is a fantastic story of a major prank pulled off at the Super Bowl this year. Basically, five people smuggled more than a quarter of a ton of material into Dolphin Stadium in order to display their secret message on TV.

Given all the security, it’s amazing how easy it was for them to become part of the security perimeter with all that random stuff. But to those of us who follow this thing, it shouldn’t be. His observations are spot on:

1. Wear a suit.
2. Wear a Bluetooth headset.
3. Pretend to be talking loudly to someone on the other line.
4. Carry a clipboard.
5. Be white.

Notes on getting into well-guarded events using social engineering Read More »

Out now: Microsoft Vista for IT Security Professionals

business, personal, security, technology / /

Microsoft Vista for IT Security Professionals is designed for the professional system administrators who need to securely deploy Microsoft Vista in their networks. Readers will not only learn about the new security features of Vista, but they will learn how to safely integrate Vista with their existing wired and wireless network infrastructure and safely deploy with their existing applications and databases. The book begins with a discussion of Microsoft’s Trustworthy Computing Initiative and Vista’s development cycle, which was like none other in Microsoft’s history. Expert authors will separate the hype from the reality of Vista’s preparedness to withstand the 24 x 7 attacks it will face from malicious attackers as the world’s #1 desktop operating system. The book has a companion CD which contains hundreds of working scripts and utilities to help administrators secure their environments.

This book is written for intermediate to advanced System administrators managing Microsoft networks who are deploying Microsoft’s new flagship desktop operating system: Vista. This book is appropriate for system administrators managing small networks of fewer than 10 machines up to enterprise-class networks with tens of thousands of systems. This book is also appropriate for readers preparing for the Microsoft exam MCDST 70-620.

I contributed two appendices to this book:

  • Appendix A: Microsoft Vista: The International Community
  • Appendix B: Changes to the Vista EULA

Appendix A, “Microsoft Vista: The International Community”, was about Microsoft’s legal troubles in Europe and Asia, and the changes the company had to make to Vista to accommodate those governments. Appendix B, “Changes to the Vista EULA”, explained that the EULA in Vista is even worse than that found in XP, which was worse than any previous EULA. In other words, Vista has a problematic EULA that users need to know about before they buy the OS.

Read excerpts: Front Matter (350 KB PDF) and Chapter 1: Microsoft Vista: An Overview (760 KB PDF). You can flip through the entire book, although you’re limited to the total number of pages you can view (but it’s a pretty high number, like 50 or so).

Out now: Microsoft Vista for IT Security Professionals Read More »

3 problems with electronic voting

law, politics, security, tech in changing society, technology / /

From Avi Rubin’s “Voting: Low-Tech Is the Answer” (Business Week: 30 October 2006):

Unfortunately, there are three problems with electronic voting that have nothing to do with whether or not the system works as intended. They are transparency, recovery, and audit. …

Electronic voting is not transparent – it is not even translucent. There is no way to observe the counting of the votes publicly, and you can’t even tell if the votes are being recorded correctly. …

Now, what do we do if something goes very wrong during the election? What happens if the equipment fails or there is a power outage?

Let’s compare electronic voting machines to paper ballots. If an e-voting machine crashes, it is possible that the memory cards containing the votes could be corrupted. Something as unexpected as someone spilling coffee on the machine could cause it to fail.

There are dozens of ways one could imagine that an electronic voting machine could be rendered a paperweight. Imagine, for example, a widespread power outage on Election Day. How do you continue the election? What can you do to recover votes already cast? …

I don’t feel very good about the only copies of all of the votes in a precinct existing in electronic form on flash memory cards. … If we have paper ballots and the power goes out, we can get some flashlights and continue voting.

Electronic voting is vulnerable to all sorts of problems, many of which cannot be anticipated. For example, in Maryland’s September primary, voting systems were delivered to the precincts in Montgomery County without the smart cards needed to activate the votes. As a result, the polls opened hours late, and thousands of voters were affected.

There was no quick and easy recovery mechanism. It is true that the problem was due to human error, but that does not change the fact that there was no way to recover. Paper ballot systems are much less fragile and can withstand many of the unexpected problems that might arise on Election Day. …

Finally, and I believe most seriously, there is no way to independently audit a fully electronic voting system. While it is true that many of the machines keep multiple copies of the votes, these copies are not independent. If the machines are rigged, or if they suffer from unknown software bugs …, the election results might not reflect the votes that were cast, despite all of the copies of the votes being identical.

On the other hand, electronic counting of paper ballots can be audited by manually counting the paper and comparing the results to the electronic tally. It is imperative, in fact, that every software-based system be audited in a manner that is independent from the data that are the subject of the audit.

3 problems with electronic voting Read More »

Microsoft executive sets self up for hubristic fall

security, technology / /

From Scott M. Fulton, III’s “Allchin Suggests Vista Won’t Need Antivirus” (BetaNews: 9 November 2006):

During a telephone conference with reporters yesterday, outgoing Microsoft co-president Jim Allchin, while touting the new security features of Windows Vista, which was released to manufacturing yesterday, told a reporter that the system’s new lockdown features are so capable and thorough that he was comfortable with his own seven-year-old son using Vista without antivirus software installed.

Microsoft executive sets self up for hubristic fall Read More »

Take over a computer network with an iPod or USB stick

business, security, tech in changing society, technology / /

From Bruce Schneier’s “Hacking Computers Over USB” (Crypto-Gram: 15 June 2005):

From CSO Magazine:

“Plug an iPod or USB stick into a PC running Windows and the device can literally take over the machine and search for confidential documents, copy them back to the iPod or USB’s internal storage, and hide them as “deleted” files. Alternatively, the device can simply plant spyware, or even compromise the operating system. Two features that make this possible are the Windows AutoRun facility and the ability of peripherals to use something called direct memory access (DMA). The first attack vector you can and should plug; the second vector is the result of a design flaw that’s likely to be with us for many years to come.” …

Recently I’ve been seeing more and more written about this attack. The Spring 2006 issue of 2600 Magazine, for example, contains a short article called “iPod Sneakiness” (unfortunately, not online). The author suggests that you can innocently ask someone at an Internet cafe if you can plug your iPod into his computer to power it up — and then steal his passwords and critical files.

And about someone used this trick in a penetration test:

“We figured we would try something different by baiting the same employees that were on high alert. We gathered all the worthless vendor giveaway thumb drives collected over the years and imprinted them with our own special piece of software. I had one of my guys write a Trojan that, when run, would collect passwords, logins and machine-specific information from the user’s computer, and then email the findings back to us.

“The next hurdle we had was getting the USB drives in the hands of the credit union’s internal users. I made my way to the credit union at about 6 a.m. to make sure no employees saw us. I then proceeded to scatter the drives in the parking lot, smoking areas, and other areas employees frequented.

“Once I seeded the USB drives, I decided to grab some coffee and watch the employees show up for work. Surveillance of the facility was worth the time involved. It was really amusing to watch the reaction of the employees who found a USB drive. You know they plugged them into their computers the minute they got to their desks.

“I immediately called my guy that wrote the Trojan and asked if anything was received at his end. Slowly but surely info was being mailed back to him. I would have loved to be on the inside of the building watching as people started plugging the USB drives in, scouring through the planted image files, then unknowingly running our piece of software.”

Take over a computer network with an iPod or USB stick Read More »

Russian bot herders behind massive increase in spam

business, security, tech in changing society, technology / /

From Ryan Naraine’s “‘Pump-and-Dump’ Spam Surge Linked to Russian Bot Herders” (eWeek: 16 November 2006):

The recent surge in e-mail spam hawking penny stocks and penis enlargement pills is the handiwork of Russian hackers running a botnet powered by tens of thousands of hijacked computers.

Internet security researchers and law enforcement authorities have traced the operation to a well-organized hacking gang controlling a 70,000-strong peer-to-peer botnet seeded with the SpamThru Trojan. …

For starters, the Trojan comes with its own anti-virus scanner – a pirated copy of Kaspersky’s security software – that removes competing malware files from the hijacked machine. Once a Windows machine is infected, it becomes a peer in a peer-to-peer botnet controlled by a central server. If the control server is disabled by botnet hunters, the spammer simply has to control a single peer to retain control of all the bots and send instructions on the location of a new control server.

The bots are segmented into different server ports, determined by the variant of the Trojan installed, and further segmented into peer groups of no more than 512 bots. This allows the hackers to keep the overhead involved in exchanging information about other peers to a minimum, Stewart explained.

… the attackers are meticulous about keeping statistics on bot infections around the world.

For example, the SpamThru controller keeps statistics on the country of origin of all bots in the botnet. In all, computers in 166 countries are part of the botnet, with the United States accounting for more than half of the infections.

The botnet stats tracker even logs the version of Windows the infected client is running, down to the service pack level. One chart commandeered by Stewart showed that Windows XP SP2 … machines dominate the makeup of the botnet, a clear sign that the latest version of Microsoft’s operating system is falling prey to attacks.

Another sign of the complexity of the operation, Stewart found, was a database hacking component that signaled the ability of the spammers to target its pump-and-dump scams to victims most likely to be associated with stock trading.

Stewart said about 20 small investment and financial news sites have been breached for the express purpose of downloading user databases with e-mail addresses matched to names and other site registration data. On the bot herder’s control server, Stewart found a MySQL database dump of e-mail addresses associated with an online shop. …

The SpamThru spammer also controls lists of millions of e-mail addresses harvested from the hard drives of computers already in the botnet. …

“It’s a very enterprising operation and it’s interesting that they’re only doing pump-and-dump and penis enlargement spam. That’s probably because those are the most lucrative,” he added.

Even the spam messages come with a unique component. The messages are both text- and image-based and a lot of effort has been put into evading spam filters. For example, each SpamThru client works as its own spam engine, downloading a template containing the spam and random phrases to use as hash-busters, random “from” names, and a list of several hundred e-mail addresses to send to.

Stewart discovered that the image files in the templates are modified with every e-mail message sent, allowing the spammer to change the width and height. The image-based spam also includes random pixels at the bottom, specifically to defeat anti-spam technologies that reject mail based on a static image.

All SpamThru bots – the botnet controls about 73,000 infected clients – are also capable of using a list of proxy servers maintained by the controller to evade blacklisting of the bot IP addresses by anti-spam services. Stewart said this allows the Trojan to act as a “massive distributed engine for sending spam,” without the cost of maintaining static servers.

With a botnet of this size, the group is theoretically capable of sending a billion spam e-mails in a single day.

Russian bot herders behind massive increase in spam Read More »

Bad passwords for SSH

security, technology / /

From Christian Seifert’s “Analyzing malicious SSH login attempts” (SecurityFocus: 11 September 2006):

First, we analyzed the login names that were used on the login attempts. During the sample period, there were 2741 unique account names ranging from common first names, system account names, and common accounts to short alphabetical strings captured by the system logger. Of those, the 15 account names used most often are shown in Table 1. This table shows accounts that usually exist on a system (root, mysql), accounts that are likely to exist on a system (guest, test), as well as common first names (paul). Then Figure 1 shows the distribution of valid and invalid account names that were used.

Account Name Number of login attempts
root 1049
admin 97
test 87
guest 40
mysql 31
info 30
oracle 27
postgres 27
testing 27
webmaster 27
paul 25
web 24
user 23
tester 22
pgsql 21

Table 1. Top 15 account names among 2741 attempts.

Next, we looked at the passwords used in the login attempts. The attackers tried a range of passwords with most of the account names. In total during our analysis, they attempted to access 2741 different accounts and used 3649 different passwords. Not all passwords were used with all accounts. The passwords ranged from account names, account names with number sequences, number sequences, and keyboard sequences (like ‘qwerty’). There were a few more complex passwords used with seemingly random letter and number sequences or common substitution passwords (like r00t or c@t@lin).

Table 2 shows the top 15 passwords used in malicious login attempts.

Password Number of login attempts
123456 331
Password 106
Admin 47
Test 46
111111 36
12345 34
administrator 28
Linux 23
Root 22
test123 22
1234 21
123 20
Mysql 19
Apache 18
Master 18

Table 2. Top 15 passwords attempted.

Bad passwords for SSH Read More »

My reply to those “You sent a virus to me!” emails

security, tech in changing society, technology / /

On Saturday 17 April 2004, I received the following email from someone I didn’t know:

> Hello,
>
> I am not sure who you are but our security detected a Netsky virus in an
> email that you sent. Whether a personal message or a spam, please make
> attention to the fact that you are spreading viruses and have your systems
> checked. Also, when a virus is detected the message does not get through so
> we have no idea who you are or the nature of your message.

My reply

I really wouldn’t bother sending these messages out, or you will find yourself with a full-time job.

Virtually every modern virus spoofs the sender of the email address of the sender. In other words, the virus scans the infected computer for email addresses, and then picks one for the TO field and one for the FROM field. Someone that has both of our email addresses on their computer is infected, and the virus chose your email address for TO and my email address for FROM. That is the extent of it. Unfortunately, we have no way to knowing who really is infected, so emailing the person who appears to have sent the email is a complete waste of your time.

Finally, I could not be infected, as I do not use Windows. I use Linux, which is impervious to the glut of viruses and worms that infect Microsoft’s poorly-coded operating system.

My reply to those “You sent a virus to me!” emails Read More »

Maintaining control in a subdued country

commonplace book, history, law, politics / /

From Louis Menard’s “From the Ashes: A new history of Europe since 1945” (The New Yorker [28 November 2005]: 168):

[Tony Judt, author of Postwar: A History of Europe Since 1945] notes that France, a country with a population of some forty million, was administered by fifteen hundred Nazis, plus six thousand Germen policemen. A skeleton team sufficed in the Netherlands as well.

Maintaining control in a subdued country Read More »

Imagining a future of warring balloons

art, history, language & literature, science, security, tech in changing society, technology / /

From Tom Reiss’s “Imagining the Worst: How a literary genre anticipated the modern world” (The New Yorker [28 November 2005]: 108):

… the first mini-boom in invasion fiction began in the seventeen-eighties, when the French developed the hot-air balloon. Soon, French poems and plays were depicting hot-air-propelled flying armies destined for England, and an American poem from 1784 warned, “At sea let the British their neighbors defy– / The French shall have frigates to traverse the sky. … If the English should venture to sea with their fleet, / A host of balloons in a trice they shall meet.” A German story published in 1810, and set in the twenty-first century, describes human populations living in deep underground shelters, with shops and churches, while balloon warfare between Europeans and invading Asian armies rages in the skies above.

Imagining a future of warring balloons Read More »

The escape of Mr. Flitcraft

commonplace book, language & literature, security / /

From Claudia Roth Pierpont’s “Tough Guy: The mystery of Dashiell Hammett” (The New Yorker [11 February 2002]: 70):

There is one section of “The Maltese Falcon” that could not be filmed, and for many readers it is the most important story Hammett ever told. A dreamlike interruption in events, it is a parable that Spade relates to Brigid about a man called Flitcraft, dutiful husband and father of two, who was nearly hit by a falling beam while walking to lunch one day. Instead of going back to work, Flitcraft disappeared. “He went like that,” Spade says, in what may be Hammett’s most unexpected and beautiful phrase, “like a fist when you open your hand.” His narrow escape had taught this sane and orderly man that life is neither orderly nor sane, that all our human patterns are merely imposed, and he went away in order to fall in step with life. He was not unkind; the love he bore his family “was not of the sort that would make absence painful,” and he left plenty of money behind. He travelled for a while, Spade relates, but he ended up living in a city near the one he’d fled, selling cars and playing golf, with a second wife hardly different from the first. The moral: one can attempt to adjust one’s life to falling beams but will readjust as soon as the shock wears off.

The escape of Mr. Flitcraft Read More »