Conficker Update Part Deuce
UPDATE 11 Jun 2009: Locally hosted bdtools removal tools (availabe at downadup.org for single computers and network. Cheers =D
Our favorite worm got an update 8 April according to Network World. Read more here…
And of course, at downadup.org.
Key-Genius Leverages Yubikey to Secure Web-Logins
So I was listening to another Security Now podcast and heard about a promising new authentication technology designed by Yubico that generates asynchronous one time passwords with a simple push of a button. The device can authenticate against the maker’s servers or your own. The device itself registers as a USB keyboard and is therefore compatible with most computers. The device costs less than $25 each, with discounts for bulk purchases.
Key Genius is a product that leverages the Yubikey to provide a more secure platform for logging into websites. It recently won an award in the Yubiking competition, in partnership with Security Now. The site stores site-specific passwords in an encrypted database, and using a browser extension, replies to valid Yubikey passwords by automatically inserting the correct password for the site. Usernames are not stored by Key Genius at all, so it’s up to the user to supply them to the website in question. This is actually a good thing, as compromise of the Key Genius database cannot in of itself bely a user’s logon credentials. This is a neat product that not only enhances convenience, but does so in a secure manner.
Conficker Update
Update: An excellent resource list is available at the Internet Storm Center.
The headline at dailymail.co.uk read “April Fool’s Day computer virus is activated… but fails to cause internet chaos.”
I guess the rumors were unfounded. However, it’s important to note that the virus is still rampant and speculation on the potential uses of such a huge botnet are as well. Some surmise that it might be used to DDOS the crap out of some poor server(s). It might also be used to crack passwords or encryption. Check out http://downadup.org to read more and for removal tools. It’s also a good idea to prepare your network for the potentiality of attack. Don’t be a soft target.
Here’s a couple (read non-comprehensive) ideas on how to not be a soft target:
- Backup, backup, backup
- Have systems ready to leap into action if necessary, and keep at least one form of backup offline in case of worst-case scenarios.
- If you don’t already have a backup strategy in place, it’s time to implement one.
- Control access to your critical services
- Enforce strong passwords – or better yet, employ multi-factor authentication. PPP is a strong candidate for the thrifty.
- Audit your users – does that guy who quit last year still have an active user account? Do your non-administrative users have access to critical servers?
- Use fail2ban or iptables to detect and drop password-guessing attacks – even with 10 million + IP’s to choose from, it’s not easy to crack a password/one-time password combination when you only get 3 tries per IP.
- Watch your traffic (not really a botnet vulnerability, but good practice in general):
- Control your legacy services – seriously, it’s time to retire telnet and other services that transmit passwords in cleartext.
- https > http – especially when it comes to passwords. Don’t allow users the ability to transmit passwords over http.
- etc…
I’ve hardly compiled a comprehensive list, and I welcome comments for other good practices, but the most important takeaway is to be cognizant of your security stance. Don’t make it easy for the bad guys.
Shoulder Surfing by Laserlight
Here’s the first sentence from the source document:
Using equipment costing about $80, researchers from Inverse Path were able to point a laser on the reflective surface of a laptop between 50 feet and 100 feet away and determine what letters were typed.
The gist of the article is that researchers were able to determine key sequences by analyzing the sound waves produced by each key as subjects type. The researchers have also managed to isolate EMI transferred through the power grid to identify keystrokes. Most folks need not worry about directed attacks of this nature, but if you’ve got a secret somebody wants badly, watch your back… and your windows.
Note: Thanks to _dilan for the link!
WebHostingTalk Hacked Hardcore but Still Online
This week, WebHostingTalk suffered a major compromise and “the offsite backup, the onsite backup and the operational data were destroyed by the attacker.” Read the companies thread about the event here.
This isn’t a news blog. I’m not so plugged in that I can write about things as they happen. That’s not my impetus. My impetus is to publish articles about ideas that I believe are sound principles when planning your systems architecture. One such principle is not betting the house on a single technology, and WHT was a prime example of the benefits of such planning. After suffering an attack like that, WHT is online and serving traffic. How? They had DVD backups. Try erasing that. Yes, they’ve only managed to restore up to October 2008, and that was likely a result of corrupted media or backup operator error, but their site isn’t down. It’s an arduous process, writing to permanent media. And it’s an arduous process restoring from it. But in a last-ditch scenario like this, it served WHT well. And it proves my point. Crossing architectural boundaries when backing up data is a necessity, and that means keeping at least one form of backup offline.
Would your business be able to take a hit like WHT’s and keep its doors open?
