CISSP - should you get it?

CISSP^® certification is a globally recognized standard of achievement that confirms an individual's knowledge in the field of information security. CISSPs are information assurance professionals who define the architecture, design, management and/or controls that assure the security of business environments. It was the first certification in the field of information security to meet the stringent requirements of ISO/IEC Standard 17024.

CISSPs often hold job functions including:

security consultant security manager IT director/manager security auditor security architect

security analyst security systems engineer chief information securityofficer director of security network architect

 

 

The above snippet it Courtesy https://www.isc2.org/cissp/default.aspx

 

Now, to get it or not to get it is the question. And if you get it, is it worth it or not? While there are many web references for and against it, Presenter Timmay delivered a provocative session entitled "Why You Should Not Get a CISSP". His slide presentation (PDF) packs a whallop.  Despite a strong opinion against it, if you decide go for it, here's a good Guide to obtaining the certification and maintaining it.

 

In my opinion, CISSP would be a good starting point to get an overview of the various facets of security in an organisation including physical security. If you approach it from the point of view of gaining knowledge, salary rise or career growth would become secondary.



Windows 8 - Will it succeed?

When i created this blog, i wanted to focus on security. In that sense, this one post is going to be off topic. We all know the future is mobile. Smart-phones, tablets, tablets doubling up as notebooks and smart-phones doubling up as tablets. These new gadgets are selling like pancakes. Apple and Google together make up a major share of this market. Microsoft was somewhat left behind. Surface is their attempt to try and dig into this booming market. Windows 8 is their software eco system for Surface. The unique selling point of Windows 8 is in its Metro UI with its tile interface. Its all fine until here except that Microsoft decided to take the same Metro UI in Windows 8 best suited for phones & tablets (in my opinion) to its notebooks and desktops. Introducing simplicity in user experience is one thing. But, changing the user experience altogether is a totally different thing. As they say, If it ain't broke, don't fix it. Apple's Mac OS X is a good example of this.Here's a pictorial representation of the transition from Cheetah that came in 2001 to Lion thats out now in 2012.

On the other hand, here's the transition from Windows 2000 to Windows 8 that'll supposedly come out in October 2012.

Can you see the radical change in Windows 8? 

A live experience of this change is best demonstrated in this video of a 66 year old granny trying Windows 8.

Microsoft is trying hard to make Windows 8 easily acceptable by doing some of the following:

• Offering upgrades for as little as 15$ compared to previous cost of 100$ or more
• Reducing the SKUs to 3 which earlier would have been 6 or more.
• Support for ARM chips while earlier only x86/64 chips were supported  

But, it remains to be seen whether Windows 8 will go the way of Windows Vista or be a success.

Bug Bounty Programs - big cash for bugs!

Alex Miller, a 12-year-old tech wiz from San Jose received a check in the post for $3,000 from Mozilla. It was a reward for tracking down a critical security flaw in the Firefox web browser. 25-year-old Aaron Portnoy has been tracking down bugs since he was barely into his teens. He first realised it could be a potentially lucrative career when tax collectors from the American Internal Revenue Service came calling, wondering how he had made $60,000. Aaron was not even 20 at the time. Sergey Glazunov was paid $60,000 for finding a security flaw in Chrome Browser on a fully patched Windows 7 system.
These are just some high profile examples of individuals who got the limelight from the press. But, i think you get the point. Finding security holes in widely used software is financially rewarding these days. If you want to participate in some of these programs, here are the details.

Google
Rewards for qualifying bugs range from $100 to $20,000. The following table outlines the usual rewards for the anticipated classes of bugs:

	accounts.google.com	Other highly sensitive services [1]	Normal Google applications	Non-integrated acquisitions and other lower priority sites [2]
Remote code execution	$20,000	$20,000	$20,000	$5,000
SQL injection or equivalent	$10,000	$10,000	$10,000	$5,000
Significant authentication bypass or information leak	$10,000	$5,000	$1,337	$500
Typical XSS	$3,133.7	$1,337	$500	$100
XSRF, XSSI, and other common web flaws	$500 - $3,133.7 (depending on impact)	$500 - $1,337 (depending on impact)	$500	$100

[1] This category includes products such as Google Search (https://www.google.com) Google Wallet (https://wallet.google.com), Google Mail (https://mail.google.com), Google Code Hosting (code.google.com), and Google Play (https://play.google.com).

[2] Note that acquisitions qualify for a reward only after the initial 6 month blackout period has elapsed.

Mozilla
The bounty for valid critical client security bugs will be $3000 (US) cash reward and a Mozilla T-shirt. The bounty will be awarded for critical and high severity security bugs that meet the following criteria:
Security bug is present in the most recent supported, beta or release candidate version of Firefox, Thunderbird, Firefox Mobile, or in Mozilla services which could compromise users of those products, as released by Mozilla Corporation or Mozilla Messaging.

PayPal
Paypal is a new entrant to this field. They have not disclosed any details about the extent of reward. But, the obvious mode of payment is through PayPal.


Facebook
Facebook has fixed a typical bounty to be $500 which maybe increased for specific bugs. Any exploit that could compromise the integrity of Facebook user data, or circumvent the privacy protections of Facebook user data.

ZDI
This is the Zero Day Initiative from TippingPoint software which was acquired by Hewlett-Packard. This is unique in that bugs for third-party software are accepted. As a member of the ZDI program, you earn points each time a vulnerability submission is purchased. Points are treated in a manner similar to airline frequent flyer miles - points accrue each year on a dollar-for-dollar basis based on the total amount paid for vulnerability submissions by the researcher during that calendar year. For instance, if the Zero Day Initiative buys your vulnerability for $5,000, then you receive 5,000 points for that submission. For all of calendar year 2008, if you received 37,000 points, then for calendar year 2009 you will be considered to have ZDI Gold status. The following are the various levels of ZDI Reward membership:

Some lesser known ones:

Barracuda
The bounty starts at $500 for qualifying bugs. The following security products by Barracuda Networks:

• Barracuda Spam & Virus Firewall
• Barracuda Web Filter
• Barracuda Web Application Firewall
• Barracuda NG Firewall

The panel may reward up to $3,133.7 for particularly severe bugs. You may opt to donate your bounty to a charity. Additionally, we will credit your work as a bug/vulnerability reporter if you desire. Only the first report of a bug qualifies. (Why $3,133.7? The number pays homage to “eleet”. This is used by some in the security community as slang for elite and is sometimes referred to as 31337.)

Piwik
The bounty for valid critical security bugs is a $500 (US) cash reward. The bounty for non-critical bugs is $200 (US), paid via Paypal. The bounty will be awarded for security bugs that meet the following criteria:

• Security bug must be original and previously unreported
• Security bug is present in the most recent supported or release candidate version of Piwik
• If two or more people report the bug together the reward will be divided among them

Ghostscript
Artifex software rewards folks who find bugs in their proprietary interpreter for postscript language and for PDF. Accepted fixes for bugs at P1 and P2 pay a bounty of US$1000 each. Bugs at lower priority pay US$500 per bug.

Hex-Rays
Hex-Rays will pay a 3000 USD bounty for certain security bugs in their proprietary IDA or Decompiler applications. What security bugs will be considered:

• Security bugs must be original and previously unreported and not fixed yet.
• Security bugs with high or critical impact are eligible (remote code execution, privilege escalation, etc).
• Security bugs must be in the Hex-Rays code (not in third party/contributed code). In some cases we may take responsibility for third-party code as well.
• Security bugs must be present in the latest public release of IDA/Decompiler.

Bromium Microvisor - is it the future of security?

Simon Crosby, the founder of the Xen hypervisor announced today about his latest venture called Bromium at a conference. Is it a co-incidence that the name rhymes with the Chromium project from Google? Well, the commonalities are sandboxing and security. While the Chromium project has tried to implement a browser and an O.S based on a browser interface, Bromium will try to implement a layer under the O.S which can run a browser or for that matter any other application.

Virtualization has evolved from being a buzzword to a widely accepted and implemented technology in recent times. VMWare was one of the pioneers of software virtualization. Then, Intel came out with its hardware virtualization concept which resulted in hardware based hypervisors. The purpose of hypervisors is to try and create multiple virtual machines running independent O.Ses on the same physical machine. But, a microvisor differs from this in that it can virtualize applications. Since, sandboxing is at the heart of this implementation, it would mean each of the virtualized applications would be mutually exclusive. Concept-wise, this is very futuristic. If its implemented and accepted by the industry, we might be at the beginning of a new era in application and software security. But, it remains to be seen whether the hype of microvisor lives up to its word.

Bromium's products are built using the Bromium Microvisor. It is a tool that can create lightweight virtual machines, called micro-vms. As many as 150 micro-vms can be created on a typical desktop system with 4GB of memory, it is claimed. The entire tool is about 10,000 lines of code. 

To understand the implementation of a micro-vm better, here's a snippet from the whitepaper.

When a micro-VM is created its access to these system resources is restricted according to a set of simple, task and trust-level related resource policies. Whenever the protected task attempts to access any restricted system resource the virtualization hardware forces a CPU VM_EXIT, suspending execution of the task and giving control of the CPU to the Microvisor to arbitrate access using the resource policies for the task.When a micro-VM executes, its (VT-managed) memory map contains a representation of Windows and the necessary DLLs required for execution, plus the task state. Access to OS services is restricted by the resource policies, and any changes that the task makes to OS memory or the golden file system is “Copy-on-Write” (CoW). Thus, if the task is compromised by malware that modifies the Windows kernel or white-listed DLLs, it will only succeed in modifying a local copy, and not the IT provisioned, golden Windows.Each micro-VM is presented a with a narrowed view of the file system that contains only the files it needs – an implementation of the principle of “least privilege” - with CoW semantics. If malware modifies a file, the Microvisor will ensure that it only modifies a copy of the file. Any files modified or saved by a micro-VM are stored efficiently as block-deltas against the original file, which remains unchanged until the micro-VM exits (the user closes a window, or the task terminates). At this point the Microvisor discards the task’s memory image and uses a persistence policy for the task to save relevant task files (if any), and to decide whether to persist any new files. Any persisted files are securely tagged with the trust level of the micro-VM, and all access to untrusted files must be made from within another micro-VM.

iOS Security - Scratching the surface!

Apple Inc. recently published details about iOS security. Its interesting to note that the first iPhone was released in July 2007. iPhone hackers claimed to have pwned iOS within a few days of of the official release.

Here's a high level architectural diagram of iOS representing the different layers of iOS from the pdf.

Source: Apple

What caught my interest was the fact that the entire file system is encrypted. Yes, FDE (Full Disk Encryption) as it called is implemented in iOS. FDE can be complex, performance hungry and a pain to configure at times. Configuration wise, Apple took away the pain by turning it ON by default on your iPhone. Performance wise, the engine to handle encryption, Crypto Engine in the hardware on the iOS thereby reducing the operational overhead. Here's an excerpt describing the implementation: Every iOS device has a dedicated AES 256 crypto engine built into the DMA path between the flash storage and main system memory, making file encryption highly efficient. Along with the AES engine, SHA-1 is implemented in hardware, further reducing cryptographic operation overhead. Security wise, the root certificate for encryption is fused into the processor during manufacture. This would mean if you were to replace the memory chips from one device to another, the files would be inaccessible.

The other point of interest to me was App Code signing. Here's an excerpt that aptly describes this feature: To ensure that all apps come from a known and approved source and have not been tampered with, iOS requires that all executable code be signed using an Apple-issued certificate. Apps provided with the device, like Mail and Safari, are signed by Apple. Third-party apps must also be validated and signed using an Apple-issued certificate. Mandatory code signing extends the concept of chain of trust from the OS to apps, and prevents third-party apps from loading unsigned code resources or using self- modifying code.

Till date, there have been no known instances of malware on the iOS. An exception to this was Ikee, an iPhone worm which stole financially sensitive information from infected iPhones. But, it only ever spread on a iOS which was jailbroken.

SkyWiper or Flame - A complex piece of malware!

The news is out on mainstream media about a new malware called Skywiper or Flame. Its possible that this threat has been in the wild for many years now per analysts. However, the number of incidents of infection have been limited to a few hundreds and mostly concentrated in Middle East per the telescopic view below.

Source: Kaspersky

Detailed analysis by CrySys Lab suggests a semblance to Duqu. Its evident from the table below.

Source: CrySys

The complexity of this threat surpasses that of any of the previous targeted threats. Some of its unique features include recording voice conversations, communicating via BlueTooth with nearby devices etc. A list of its capabilities is detailed per McAfee here:

- Scanning network resources
- Stealing information as specified
- Communicate to C&C Servers over SSH and HTTPS protocols
- Detect the presence of over 100 security products (AV, Anti-Spyware, FW, etc)
- Both kernel and user mode logic is used
- Complex internal functionality utilizing Windows APC calls and and threads start manipulation, and code injections to key processes
- It loads as part of Winlogon.exe then injects to Explorer and Services
- Conceals its present as ~ named temp files, just like Stuxnet and Duqu
- Capable of attacking new systems over USB Flash Memory and local network (slowly spreads)
- Creates screen captures
- Records voice conversations
- Runs on Windows XP, Windows Vista and Windows 7 systems
- Contains known exploits, such as the Print Spooler and lnk exploit found in Stuxnet
- Uses SQLite Database to store collected information
- Uses custom DB for attack modules (This is very unusual, but shows the modularity and extendibility of the malware)
- Often located on nearby systems: a local network for both C&C and target infection cases
- Utilizes PE encrypted resources

Exponential growth of Android - A challenge for security

Android from Google is the leading smartphone platform in the U.S today. The last report from ComScore claims 1 in 2 smartphone users are running Android. It powers about 250 million devices and is only growing at an exponential pace what with more than 700,000 activations per day. But, Android is a mix of more than a dozen different versions. Note that each of these versions supports different API levels to further complicate matters. This fragmentation is evident from the Version tracker below.

Source: ComScore

Source: Android

Does it mean each of these versions of Android is supported actively? Its debatable as this is what is quoted on the android developer faq page.

Android is a mobile platform that is released as open source and available for free use by anybody. This means that there are many Android-based products available to consumers, and most of them are created without the knowledge or participation of the Android Open Source Project. Like the maintainers of other open source projects, we cannot build and release patches for the entire ecosystem of products using Android. Instead, we will work diligently to find and fix flaws as quickly as possible and to distribute those fixes to the manufacturers of the products through the open source project.

The key phrase is "we cannot build and release patches for the entire ecosystem of products using Android."  This poses a risk in my opinion. Security threats on Android can only proliferate in this scenario. In fact, the MobileThreatReport from F-Secure claims the number of unique malware on Android has more than quadrupled in the last year.

Source: ZDNet