Category Archives: Security

Wow, this is kind of a big hole: Palm OS Treo Find Feature Information Disclosure Vulnerability. Basically, if you set a password on your Treo, the Find function still works even when the device is locked. (See the details here.) In defense of Palm, the exploit requires physical access, so if your phone is always with you the risk is fairly low. However, according to Symantec, Palm was notified of the exploit and has decided not to fix it. -1 for them.

Great news– Security Analysis, the first part of the Data Encryption Toolkit for Mobile PCs, just went live.The overall Data Encryption Toolkit is a set of tools and guidance to help people secure the data on their laptops using Windows Vista with BitLocker and the Encrypting File System (EFS) in Windows XP and Windows Vista. Look for more pieces of the DET coming soon, as soon as we finish writing them 🙂

Windows Vista’s new BitLocker encryption technology is a two-edged sword. On the one hand, it offers excellent protection because it encrypts the entire OS volume with AES-256. On the other hand, if you lose the volume master key (VMK), you’re screwed– there’s no way for you to unlock and recover data from the volume.

To make this less of a danger, Microsoft allows you to create a recovery password that you can use to decrypt the disk. More precisely, the technical overview says:

In BitLocker, recovery consists of decrypting a copy of the volume master key blob that has been encrypted with a recovery key stored on a pluggable USB flash drive or with a cryptographic key derived from a recovery password. The TPM is not involved in any recovery scenarios, so recovery is possible if the TPM fails boot component validation, malfunctions, or disappears.

However, you still have to be very, very careful not to lose the recovery password! Vista includes the ability to back up the recovery password to Active Directory, but Microsoft hasn’t released the public details of exactly how to do this… until today, that is. The new BitLocker AD Guide describes how to enable AD backup of BitLocker recovery information (including the TPM owner password and the BitLocker recovery password for each protected volume).

You’ll need to extend your AD schema to enable this recovery mode. Don’t use the schema extension files on the Vista product DVD to do this. They don’t contain the correct schema properties. Instead, use the schema extension included with the AD Guide itself.

I’ve gotten several inquiries about how we selected the products we tested in the anti-phishing technology evaluation. That’s a fair question; some companies are unhappy that they were included, and some that they weren’t.

When we defined the parameters for the testing, we selected the vendors that had either browser-based toolbar add-ons or built-in anti-phishing technology in the browser as of May 2006 and that (in our opinion or by market data) had a significant usage presence. There are dozens of products that meet the first test, but not that many that meet the second. We picked the top 8 based on our understanding of actual usage and deployment. I didn’t want to include payware products because the original objective was for us to help Microsoft understand how well IE 7 worked compared to its biggest competitors– and in this market segment, payware products are at a disadvantage.

Would we have preferred to test all the products? Sure. The team at Carnegie Mellon that did a similar study (with a smaller list of products and a smaller set of URLs) said the same thing. However, we had to draw the line somewhere. When we redo the tests, we’ll probably change the product mix around; I’d expect to see Firefox 2.0 included, and maybe some of the commercial products.

To address Symantec’s complaint, I’d make two points. First, Norton Confidential wasn’t announced until June, so how could we have included it? You’re making the Firefox argument. We only tested products that were publicly available at the start of our time period; we excluded Norton Internet Security 2006 because it was commercial (and I suspect that if we’d tested the 2006 version, we’d be hearing that we should’ve tested the 2007 version instead. Sic transit gloria annual releases…)

Second, it’s pretty worthless to have a blog but not allow comments or trackbacks. That’s not a blog, it’s a monologue. Whatever you think of the quality of Microsoft’s products (including IE), you have to admit that they have aggressively embraced blogging as a way to communicate directly with customers– something I’d like to see more security companies emulate.

Update: fixed the link to McAfee’s SiteAdvisor blog.

Technorati Tags: 3sharp, phishing

Big day for 3Sharp— we just released “Gone Phishing“, the first public study to compare the effectiveness of anti-phishing technologies for Windows. I alluded to it in an earlier post. The study is the topic of today’s podcast installment. As a bonus, this episode features music and even embedded URLs (at least for the iPod-compatible AAC version).

MP3 version | AAC version

Reuters has an interesting story today on how phishers are cranking up their attempts to steal your money– and your identity. Symantec released a study today claiming an 81% increase in the number of unique phishing message sent out in the first half of 2006 vs the second half of 2005– not a huge surprise to anyone who has an e-mail account.The story is particularly timely, though, given that 3Sharp will be making a phishing-related announcement later this week; I’ll have more to say later in the week.

Kerry Thompson just posted a solid article exploring the pros and cons of getting a CISSP (Certified Information Systems Security Professional) certification. The CISSP curriculum is demanding, that’s for sure; Thompson presents some good arguments both pro and con. (His final take: if you want more money, get an MCSE or CCNA :))

Continue reading →

All sorts of folks are calling for restrictions on camera phones. Some propose legislative remedies, while others just want the phones banned from their facilities.

Continue reading →

Ed posted comparing IBM and Microsoft’s security update records. He missed a few important details, though that’s understandable given that he’s not a security dude. Just to set the record straight, though, I wanted to point out something that security folks learn pretty quickly: simplistic comparisons that claim that “vendor X has better security than vendor Y based on patches” are worthless. Any time you see one, there are some hard questions you should be asking.

First, what products are included? We don’t know what criteria McAfee used to make their pretty graphs. Did they include Office updates? Updates for Windows 2000 before it went EOL? Windows Media Player? Who knows? Reputable researchers and vendors will always include their source data; if you don’t see it, you should be wary.

Second, what basis of comparison is being used? Most broad-based comparisons of vendors are flawed because they mix dissimilar items, usually applications and OSes. You can say “Microsoft had to issue more patches than IBM”, but that’s meaningless unless you’re talking about specific products. A more interesting question would be to ask something like “Who had more patches to install: an Exchange 2003 admin on Windows 2003, or a Lotus Domino 6.5 admin on RHEL?” Well, according to Secunia, the numbers break down like this:

• 8 patches for Exchange 2003 + 100 patches for Windows Server 2003 Standard, versus
• 22 patches for Domino 6.5 + 212 patches for Red Hat Enterprise Server 4

All of a sudden the comparison doesn’t favor IBM quite so much! A more proper comparison might leave the operating system out of it (after all, there are more Notes seats on Windows than on Linux), but even then there’s still room for argument: Secunia doesn’t break down Domino R6 vs 6.5, so the vuln count of 22 may include some items that aren’t relevant.

Third, counting patches alone leaves out some important dimensions. It’s like counting the money in your wallet by counting bills and ignoring denominations– would you rather have 10 $1 bills or 1 $100? Other factors to evaluate include the severity of the vulnerability and how long between its emergence (or disclosure) before the vendor gets a patch out– the so-called “days of risk” model.

Fourth, not all vendors tell the truth. More kindly, not all vendors tell the whole truth and nothing but. For example, IBM doesn’t include severity ratings on its security page, so you can’t judge the severity of a reported vuln unless you’re already pretty knowledgeable. Oracle is flat-out dishonest in some of its security patch release notes. When you’re comparing vendor security, you should include the nature, frequency, and accuracy of their security-related disclosures and communications.