Christopher Herot's Weblog

HTML5 - Be Afraid?

The New York Times ran an article this week, New Web Code Draws Concern Over Privacy Risks, that warns of the "privacy risks" that are "integral part of the Web language that will soon power the Internet: HTML 5." It talks about "supercookies" and Samy Kamkar's Evercookie, but as often happens in the pulp press, provides few specifics, or even a link to Kamkar's site.

As it turns out, Slashdot and ars technica covered this a month ago, and it turns out the problem is not new to HTML5. While most people know that cookies can be used to store data that persists across browser sessions, and many know how to find the browser button that deletes them, there are many more places that a clever Web developer can stash data, including hiding them inside cached images. Flash has long had local shared objects which you can see using Adobe's settings panel. The latter is actually a Flash application that runs when you visit the Web site, so it's a little spooky despite the reassurance that "The list of websites above is stored on your computer only."

HTML5 compounds the issue by adding half a dozen new places where information can be stored, but the real problem is that a clever Javascript or Flash program can store information in multiple places and if you don't delete them all at once, use the one place you forgot to reconstruct the cookie, hence "Evercookie."

Future browsers will probably provide better tools for displaying and deleting information from these locations, but I doubt people will use them. Just try deleting all your cookies today and see how tedious is it to re-enter all your usernames and preferences at each web site you visit. Once Web sites start relying on local SQL storage the fun really begins.

 

CarShark

When I first heard about Experimental Security Analysis of a Modern Automobile, a paper in which researchers at the University of Washington and UCSD explored the what someone could do to the computers in your car I wasn't worried. It sounded like another one of those theoretical analyses in which the threat is predicated on the attacker somehow getting into your car and attaching something to the CANbus internal network.  Then I read the paper.  Gulp!

It turns out that not only is the CANbus not all that secure (16 bit static keys), and the security standards not all that consistently followed, but there are multiple vectors through which bad stuff can be introduced. For instance, aftermarket audio systems are attached directly to the CANbus, and a repair shops diagnostic equipment connects to it through the federally-mandated OBD-II connector. While there are supposed to be restrictions on re-flashing the memory of the car's on-board computers, the researchers found that was fairly easy to do, and even managed to reprogram the cars telematics module (e.g. OnStar) to act as a router between the low speed network where the radio is attached and the high-speed network that operates the engine and the brakes.

Using the reprogrammed module and a laptop connected to the OBD-II connector, they took a car out onto an abandoned airfield and showed how, while the car was moving at speed, they could stop the engine, selectively operate the brakes on any combination of wheels, or disable the brakes altogether.

So make sure you know where that after-market radio has been, hope your mechanic was careful how he downloaded updates to his diagnostics equipment, and hope there aren't stack-overflow bugs in the telematics, Bluetooth or remote locking modules.

Zombie Invasion!

According to WCAX News, someone hacked a trailer-mounted dynamic message sign in Colchester, Vermont to warn motorists to turn back or face an impending zombie invasion. To add insult to injury, the hackers protected their message with a password, requiring the construction company to turn the sign around until they could consult the manufacturer to get the master password.

While some of these signs can be programmed remotely, according to news reports, this instance was a case of someone leaving the key in the lock at the site.  According to the literature from many of the manufacturers of these signs, they can be programmed by plugging in a laptop, perhaps with proprietary software.  One wonders if that means it could be the work of a current or previous construction or highway employee, but it does point out how much we depend on some combination of security through obscurity and most people's innate goodness.

There was no word of whether the sign was previously dormant or had been warning of some other hazard, but authorities are not laughing, saying the hackers could face charges, including "making a false report."

This incident follows similar reports from Austin, Texas, Collinsville, Illinois, and Lubbock, Texas. Let's hope the National Transportation Communications for Intelligent Transportation System Protocol (NTCIP) that networks the increasingly common permanent signs is more secure, or we will be seeing a lot more of these.

Skype Surveillance Uncovered in China

Yesterday, Nart Villeneuve of the Citizen Lab at the University of Toronto published a report Breaching Trust: An analysis of surveillance and security practices on China’s TOM-Skype platform which documents how the Chinese version of Skype has been modified to intercept messages and log them at a central server.

According Villeneuve's FAQ, users in China who go to Skype.com are redirected to the TOM-Skype, a joint venture of Skype and TOM Online which is a Chinese wireless provider.  Villeneuve installed the software and discovered that every time he type a swearword the software made an http connection to a TOM Skype Server.  He followed the URL and found a poorly secured server that contained encrypted copies of Skype text messages.  He also found a file containing the encryption key and with a few lines of Python he could see the plaintext messages.  By looking at the text files he concluded that in addition to swearwords, the software intercepted messages containing controversial topics such as "Falun", "earthquake", and "democracy."

Skype at first attempted to dodge the issue, acknowledging the sloppy security on the web site but remaining silent on the monitoring issue itself.  According the the Wall Street Journal blog, Skype's initial statement was:

In China, Tom Online is the majority partner in a joint venture that brings Internet communications to Chinese citizens. The software developed and distributed by Tom utilizes Skype functionality, and Tom implements their protocols to meet the rules and regulation of China government authorities.

The idea that the Chinese [government] might be monitoring communications in and out of the country shouldn’t surprise anyone, and in fact, it happens regularly with most forms of communication such as emails, traditional phone calls, and chats between people within China and between people communicating to people in China from other countries.

Nevertheless, we were very concerned to hear about the apparent security issue which made it possible for people to view chat information among mainly Tom users, and we are pleased that, once we informed Tom about it, that they were able to fix the flaw.

Perhaps realizing the problem might affect their business outside of China, they later revised their statement to read:

In 2006, Skype publicly disclosed that Tom operated a text filter that blocked certain words on chat messages but that it did not compromise Tom customers’ privacy. Last night, we learned that this practice was changed without our knowledge or consent and we are extremely concerned. We deeply apologize for the breach of privacy on Tom’s servers in China and we are urgently addressing this situation with Tom.
We confirm our strong belief that Skype to Skype communications, enabled by our peer to peer architecture and strong encryption, remain the most secure form of publicly available communications today.

Corporate IT managers and privacy advocates have long been concerned about the privacy and security of Skype.  While Skype does encrypt its communications, it has not documented the proprietary protocols it uses.  Furthermore, while the Skype clients theoretically communicate peer-to-peer, they get around NATs by routing communications through "super-nodes" which are usually other users' PCs and could be anywhere in the world.  Essentially, users need to trust in Skype's engineering competence and its respect for the user's privacy.  The situation in China (and elsewhere) illustrates that this trust may need to be tempered by the knowledge that Skype is serving multiple masters.

BGP Hijacking Vulnerability

Just when you thought it was safe to go outside...

Wired and Slashdot reported yesterday on The Internet's Biggest Security Hole.  This time it was a long-known problem with Border Gateway Protocol (BGP) which was given a new twist by Alex Pilosov and Tony "Xam" Kapela at the most recent DEFCON.

BGP, as you will recall, is the protocol that ties together the different networks making up the Internet.  While Senator Ted Stevens (R-Alaska) famously described the Internet as a "Series of Tubes" he wasn't that far off.  The reason it's called the Internet is because it is made up of a series of interconnected networks.  These networks, referred to as Autonomous Systems (AS) have numbers (ASNs) and provide connectivity to a set of computers that are assigned a range of IP addresses. While both the ASNs and IP addresses are assigned by an official organization (ARIN in the US), the actual mapping between the two is done by a network owner using BGP to "advertise" to other networks what range of such addresses it contains.  Usually network owners are ISPs and large corporations, but we had our own AS at Convoq and used BGP so that our servers could be connected to the Internet via multiple, redundant links.  The problem is that since all such network owners are considered trustworthy, there is no widely used mechansim for verifying the validity of the advertisements.  Anyone can claim to own any range of addresses and cause the rest of the Internet to send it traffic intended for those addresses.  This happened last February when the government of Pakistan attempted to prevent its citizens from viewing a YouTube video by advertising a route for YouTube that led to a black hole.  While they probably intended that route to apply only within Pakistan it was automatically redistributed throughout the Internet and took YouTube off the air worldwide.

Something as dramatic as making a web site globabally unavailable is usually noticed and repaired fairly quickly, but what Pilosov and Kapela discovered was a way to take the traffic one purloined and then forward it on, unnoticed, to its legitimate destination, perhaps copying or moidfying it in the process.  They outlined a fix but as it will take a lot of effort and computing power to implement, most likely nothing will happen until there is a major attack and ensuing scandal.  In the meantime, it is wise to do as people in high-security government positions are taught to do, which is regard all your communications as being open unless proven otherwise.

Is the MBTA's Fare Card System Really This Weak?

MIT undergrads Zack Anderson, RJ Ryan, and Alessandro Chiesa got an A for their class project in Computer and Network Security (6.857) taught by Ron Rivest (The R in RSA), but that was only the beginning of the story.  When they decided to present their analysis of the security of Boston's transit system, the MBTA, to the annual DEFCON computer security conference the MBTA involved the FBI and got a temporary restraining order in Federal Court (1:08-cv-11364-GAO Massachusetts Bay Transportation Authority v. Anderson et al).  A federal judge eventually sided with the students, but not until some serious First Amendment issues were raised and both the EFF and ACLU got involved.

The story followed the familiar arc wherein researchers discover a vulnerability and the organization whose security is shown to be weak takes them to court to prevent the information from becoming more widely disseminated.  Indeed the company that provided the system to the MBTA and other transit systems, NXP, sued unsuccessfully in a Dutch court to prevent its weaknesses from being exposed.  The generally accepted protocol is for the researcher to notify the affected company and give them time to fix the problem before publishing, but this is a controversial area as vendors are often slow to fix problems and the lack of disclosure provides a false sense of security and a window during which less scrupulous people may discover the same flaw and exploit it.  In the end it comes down to whether there is a greater threat from criminals who independently discover the flaw or "script kiddies" who just follow a recipe provided by an obliging researcher.  The MBTA apparently feared the latter, and the MIT students didn't help matters by publicizing their talk with an announcement promising "free subway rides for life."  From an examination of the documents it appears that the students planned to withold some key information at DEFCON but were prepared to help the MBTA until the agency complicated matters by taking them to court.  Now that the judge has rejected the MBTA's novel argument that the student's disclosure would violate the Federal Computer Fraud and Abuse Act (18 U.S.C. §1030) and lifted the temporary restraining order, the parties can get together and fix the problem.

According to the student's presentation, the MBTA has its work cut out for it.  The magnetic strip on the paper Charlie Ticket, contains the stored value which is protected by a simple checksum instead of a cryptographic key.  Using simple equipment available on eBay anyone can make a clone of a ticket or increase its value.  The RFID Charlie Card is more sophisticated but is protected by a flawed encryption algorithm and a short 48 bit key.  The MIT students showed how the algorithm is susceptible to a brute-force attack by currently available cheap parallel processing.  Since these vulnerabilities were previously known, and the MBTA claims to have added additional security measures of their own, the legal skirmishing may have been a clumsy attempt to find out if the students have discovered something really new.  From the MBTA's estimate that it will take five months to fix the problem, apparently they have.

Phishing

My father recently got his own email account and is still in that halcyon period before all the spammers have captured his email address.  Thus he was concerned when he got an email that appeared to be from PayPal warning him that his account had been compromised.  Never mind that he doesn't have a PayPal account, or that my PhD mother (who's been on the Internet since it was invented) told him to delete it.  He had to check with his son who has the graduate degree in computer science.  It turns out that he's hardly alone.  A paper in the 2006 CHI conference revealed that in a sample of 22 university students, good phishing sites fooled 90% of the participants.  (thanks to danah boyd for the link.)  It turns out that a quarter of them ignored all the security features in the browser chrome, such as the cute little padlock.  A full 15 out of 22 clicked through the SSL bad-certificate warning without hesitation.  Many relied on how sophisticated the site looked, similar to the way people used to evaluate the legitimacy of a business card or letterhead back in the day before everyone had word processing and laser printers.  The most effective strategy turned out to be taking a skeptical attitude about the email linking to the web site, although this could be fooled by an attacker who data-mined a social network to find plausible looking senders to spoof.

One technique that was promising for a brief moment was the PassMark (now RSA) SiteKey used by Bank of America.  This mechanism asks the user to select a distinctive image which will be displayed at login time.  Since this is a shared secret, and is displayed prominently in the content area, the user can use it to verify that he or she is connected to the real site.  The bank tried to prevent a man-in-the-middle attack by using some heuristics such as IP address to see if the request is coming from a known source.  If not, it first presents a challenge question.  Doug Ross points out that a phishing "false storefront" site could still pass this challenge question on to the user and then send the answer to the bank.  Ross suggests that the bank site display an "anti-fraud checklist" which should display such items as the users location (derived from the IP address) and some innocuous shared secret such as the most recent check number.  If these items were displayed as an image and the format was randomly changed, it would be difficult for the bad guys to screen scrape and pretend to be a legitimate user.

All of this will probably seem like to much trouble for the bank and the user alike, at least until such time as the occurrence of a well-publicized and large scale phishing attack.  In the meantime, any email that attempts to directly transact business should be viewed with extreme suspicion.

TJX Breach May Have Been an Inside Job

According to its recently filed 10-K, the security breach at The TJX Companies, Inc. that resulted in the compromise of customers' credit card data last year may have been an inside job.  For the most part, the credit card numbers were encrypted, but according to the company "we believe that the Intruder had access to the     decryption tool for the encryption software utilized by TJX."  The report does not go into further detail, but there is speculation in the press that the intruder also had access to the keys.  The 10-K, which contains the most information that the company has released to date, states that the company discovered suspicious software and data files on several of their systems in December, 2006, and that this intrusion may have started in July 2005.  Fortunately, the databases in question did not contain the customers' PINs or verification codes.  For the most part, the records did not contain other identifying information such as names and addresses, except for some transactions such merchandise returns  without receipts.  Given the volume of transactions, this still amounted to 451,000 individuals.

W32.pipeline worm strikes AIM

A sneaky new worm has appeared on the scene.  The attack starts as an instant message from a friend asking "Hey would it be ok if I upload a picture of you to my blog?"  The text is actually a link which downloads a file and installs itself on the hapless user's machine.  There's been a lot about it in the press today, but the best account is on blog.spywareguide.com.