Security Hype

 

 Security Hype 9.2-Listener Feedback and Security Questions Voicemail line 1-866-527-6606 [33:34m]: Play Now | Play in Popup | Download (1044)

A listener calls out Bob’s 2008 prediction for a massive Mac trojan horse. Which didn’t happen…or did we just miss it by a hair? What happened?!? Why isn’t it the end of the world as the Mac fans know it? Also, Account Security Questions…aka “Know Your Customer” (KYC). Is this the best we security practitioners can do to protect people’s most important online information?

 

 Security Hype 9.1-MD5 and SSL-A Public CA's perspective - Voicemail line 1-866-527-6606 [24:11m]: Play Now | Play in Popup | Download (1267)

You’ve read about the attacks against MD5/SSL, but what did the public CAs do? Ignore the hype and hear from a real CA what this attack meant and what lessons you can take away for future crypto vulnerabilities.

Bill and Bob discuss the hype behind “Internet Security is TOTALLY BROKEN now!” and “SSL IS DEAD!” We talk to Dr. Rolf Lindemann from TC TrustCenter to hear how one public CA handled this incident. One lesson learned: when a crypto algorithm is first announced to be weak, you should plan WHEN you will migrate away from it. Waiting until a practical attack is announced (if it IS announced) is not a safe strategy.

(Apologies for the poor sound quality; we had a lot of problems with our remote recording capability which we are addressing. Rolf had to call in via a different method in the final bit of the show.)

Links discussed in the show:

Researcher’s website

Chaos Computer Club video

Other links that describe the attack:

TechRepublic

ArsTechnica

More good research:

2004: MD5 first discovered to be vulnerable (someday)

 

 Enhanced Podcast [21:00m]: Play Now | Play in Popup | Download (1161)

Bill and Bob briefly discuss the notion of whitelist: is this a feature you need to buy or should you it come with the OS?

 

 Security Hype 8.3-Security In the News - Voicemail line 1-866-527-6606 [14:50m]: Play Now | Play in Popup | Download (2060)

In this episode, Bill and Bob debunk recent articles on computer security.   

• Gambling site brought to its knees by ‘unstoppable’ botnet -http://software.silicon.com/security/0,39024655,39170296,00.htm?r=11
• Computer Users Expect More Mac Attacks -http://www.informationweek.com/security/showArticle.jhtml?articleID=206504189
• Cyberthieves go phishing to rob banks -http://www.cnn.com/2008/TECH/02/12/cyber.thieves/index.html?eref=rss_topstories
• State of the Malware Nation - http://blog.johnath.com/index.php/2008/02/26/state-of-the-malware-nation/

See you at RSA 2008. And special thanks to Lee Anne for helping us out with this episode! If you have comments or suggestions for the show, share them by calling 1-866-527-6606 or emailing us at comments@securityhype.com.   

 

 Security Hype 8.2-Industry Predictions for 2008 - Voicemail line 1-866-527-6606 [22:00m]: Play Now | Play in Popup | Download (1970)

Bill and Bob discuss what other people think are the information security trends for 2008.

Paul Kocher’s theory is that you don’t “win” at security, the best you can hope for is to be able to keep playing: a “stalemate” mentality versus a “checkmate” mentality. That’s a great theory, but Bill’s trying to figure out how we declare “success” in the computer and information security space. For instance, by what measure can we declare that we’ve done a better job in 2007 than in 2006?

What do YOU think will rock the security world in 2008?

Links discussed or referenced in the show:

• Data breach statistics: The number of records stolen per second has increased from 1.7 to 5.1 between 2006 and 2007: http://etiolated.org/statistics
• A good statistical writeup:  http://www.privacyrights.org/ar/DataBreaches2006-Analysis.htm
• Data breaches are on the decline (what does THAT mean?): http://etiolated.org/
• Symantec 2008 predictions:
  • Decentralized bot nets {Bill: that’s already been done!}
  • popular websites spreading malware; especially social network sites
  • Mobile phones (move to where the users are)
  • Virtual worlds (Did 2nd life already jump the shark?)
  • Election/political hacks, phishing, DoS {Check out the security cartoon interview from episode 7.10}
• Ed Felten:
  • From the site’s comments: A new kind of botnet will come into existence (or at least, be discovered), without a visible control channel. It will be designed to be autonomous and evolve slowly. Stealthy, many variants will remain below the radar of bot hunters. {Bill: doesn’t that already exist?}
  • A Facebook application will cause a big privacy to-do.
  • {Bill: I think a ad-related version of this will happen.}

 

 Security Hype 8.1-Our 2008 Predictions - Voicemail line 1-866-527-6606 [12:22m]: Play Now | Play in Popup | Download (1705)

Show Notes for 8.1:

1. Shout-outs to:
   1. Thank you to the mysterious and powerful Bill @ Apple for technical assistance
   2. Thank you to Wil Becker (http://ironwil.net/blog/) for adding us to his blogroll - THANKS!
2. Bob’s sarcastic predictions:
   1. Microsoft will claim that Vista will be the most secure OS EVAR!
   2. Virtualization will prove to be a new shiny toy for malware authors. Or at least someone will demonstrate something cool to the press.
   3. Reasonably sane people will start taking themselves “off the grid”. Social networking sites will continue to leak private information, and the benefits of social nets will be lower than the costs for some people.
   4. Sarbanes and Oxley will win the Nobel Peace Prize.
   5. 2008 will be the year of PKI!
3. Bill’s predictions:
   1. People will become desensitized to PII breaches, news overage will wane, people will get blasé about it
   2. Macs OS X will see its first really solid malware attack that will be a wake-up call to Mac users to finally check (enable!, for Tiger) their firewalls and install AV scanning software. Free = ClamXav
      1. Will it force Leopard upgrades? If hackers are smart, their attack will be Leopard compatible.
   3. Overly greedy, warring botnet factions will fight each other and briefly take out parts of the Internet in collateral damage
      1. site:phishing toolkits with backdoors
   4. IPv6 will start to gain traction and we’ll start seeing IPv6 hacks (finally), which is probably an inevitable phase for any technology to become ubiquitous.
   5. The corp security industry (cutbacks, less to spend) will be focused on maintaining compliance, moving away from “risk management” and “ROI”. Watch for more marketing messages in that vain.
   6. No massive attack on cell phone networks or SCADA. (And would we ever find out?)
   7. Malware served via ads, serve up malware (related to legit web site defacement)
      1. Ad distribution become decentralized, democratized, less trustworthy

Have predictions of your own? Post them below or call the studio voice mail line!

 

 Security Hype 7.12-Vista UAC a year later, MiTM attacks at the office, Crypto Key Size Recommendations, Macs under attack - Voicemail line 1-866-527-6606 [29:55m]: Play Now | Play in Popup | Download (2899)

How paranoid are you? keylength.com

What RSA keysizes are you using at your company? What is your guidance? Are you sticking with RSA or moving to ECC?
Macs are under attack (include link to new trojan house): http://machinist.salon.com/blog/2007/11/02/mac_trojan/

eweek article link

full disclosure versus responsible disclosure (link to resp. disclosure RFC)

mac versus windows updates: Windows does a better job because it auto installs, does it auto reboot? Macs will go weeks/months with patches pending and won’t auto reboot. Does Leopard fix this? Do you actually need to *reboot*

 

 Listener feedback, network_monitering, new FireFox3 security - Voicemail line 1-866-527-6606 [38:49m]: Play Now | Play in Popup | Download (2278)

Bill and Bob address listener feedback on SiteKey and the security distinction between signature versus encryption. Bill’s Paypal securitykey arrived, and he reviews the activation process and tries it out for few days. Despite the fact that it won’t protect against phishing attacks, find out why he ended up deactivating it on his ebay account afterall.

Bob’s worried about his Internet security when staying at a hotel. How can you be certain that no one’s snooping on your traffic? Do you have any suggestions? Bob’s also wondering how can you tell if his employer is monitoring his personal traffic while at work? A question for the listeners: Does your company’s VPN enforce split tunneling or not? We’ll cover the results in an upcoming episode.

Finally, here about upcoming changes to FireFox 3’s security libraries. New crypto routines and security UI in FireFox!?!

What do you want us to cover in upcoming episodes? Send your show suggestions and feedback to comments@SecurityHype.com. And if you like this show (and even if you don’t), we’d be honored if you would submit a review in iTunes.

Thank you for listening!

 

 Security Hype 7.10-SecurityCartoon.com - Voicemail line 1-866-527-6606 [32:00m]: Play Now | Play in Popup | Download (2151)

Bill and Bob interview Dr. Markus Jakobsson and Dr. Sukamol Srikwan, creators of SecurityCartoon.com. It’s not your ordinary comic strip: Over a year of research when into this innovative and friendly information security educational methodology. Learn the background on this effective security countermeasure and why everyone — especially information security professionals — need to pay attention to this teaching method.

Please send your feedback and other show ideas to comments@SecurityHype.com or call our toll-free voice mail line at 1-866-527-6606

Thanks for listening!

Other links mentioned in this episode:

• Markus Jakobsson: Associate Professor of Informatics and Associate Associate Professor of Cognitive Science
• Sukamol Srikwan Jakobsson: Research Associate / Staff Scientist; The Center for Genomics and Bioinformatics
• October is National Cyber Security Awareness Month - learn how to stay safe on the Internet!
• Messin’ with Texas, Deriving Mother’s Maiden Names Using Public Records
• Cartoon showing phishing and URL obfuscation
• www.SecurityCartoon.info - Whitepaper and study behind the cartoon.

Cartoons embedded in this podcast were reproduced with permission. Please visit www.SecurityCartoon.com for more material.

 

 How Netscape tried to keep ahead of the hackers [10:37m]: Play Now | Play in Popup | Download (1975)

Bill and Bob invite Bob Relyea back to reminisce on Netscape’s early challenges to keep “strong crypto” out of the hands on “non US Domestic” persons, as declared by US Export Restrictions laws. The race was one! You’ll hear what Netscape crypto engineers did to try to stay ahead of the hackers, and the level of effort the hackers used to circumvent them.  This is the classic “cat and mouse” game. Check out the old Fortify effort, which has been frozen circa 2000 when Netscape released version 4.73 that included 128-bit crypto to everyone.

Paul Kocher did a great job at explaining the real challenge faced by security developers: Why companies want to make this a “Stalemate” problem instead of a “Checkmate” one. (PDF Link)

Send your show suggestions and feedback to comments@SecurityHype.com or call the studio line at 1-866-527-6606.

 

 Security Hype 7.8-Bob Relyea AACS Part 2: Practical implications of key compromises [16:00m]: Play Now | Play in Popup | Download (2246)

Bill and Bob wrap up their interview with Bob Relyea who describes the practical implications to the AACS key compromise.

Bill recounts the story of the satellite pirates who were locked out by DirecTV in the middle of the Superbowl, sometimes called “Black Sunday”. DirecTV had been slowly downloading a pirate detection and lockout routine, byte by byte, over the course of a few weeks. When activated, this routine disabled the hacked cards. So anti-pirate measures can be quite affective, at least in the short term.

We ask Bob Relyea a number of questions about the AACS crack, and whether or not it’s a big deal. Is AACS really better than the old CSS system? We explore the issue of using well-known crypto standards, and if the content protection people learned from their CSS mistakes. We also talk about what steps we might see the studios take.

Here’s a good Wired article: http://blog.wired.com/gadgets/2007/02/the_new_hddvdbl.html

There are loads of other sites on the web. Search for “09 F9 11 02 9D 74 E3 5B D8 41 56 C5 63 56 88 C0” or “09 F9 key”.

Send your show suggestions and feedback to comments@SecurityHype.com or call the studio line at 1-866-527-6606.

Thank you for listening!

 

 Security_Hype_7.7-RSA_Key_Compromise_and_AACS_key_management_details: Play Now | Play in Popup | Download (2063)

Bob Relyea, a PKI and cryptographic engineer, joins Bill and Bob to discuss the recent RSA and AACS key compromises in depth.

In the news, we’ve been reading about how researchers have been able to factor a very large number which is 307 digits long. Bob Relyea helps us understand if these results help spell doom for 1024-bit RSA or if it’s a non-event. Are there implications for Diffie-Hellman and DSA as well?

We’ve also been reading about AACS, a new DVD content protection scheme aimed at preventing piracy of the new high-definition DVDs. One of the AACS keys was found and posted on the web, including on Digg. Digg management removed the key, triggering a user revolt at Digg. A summary posted on BoingBoing nicely describes the event and Digg’s decision to side with its users, risking legal action by the DVD industry.

Bob Relyea helps us understand what AACS really is, how it works, and how it attempts to address the security flaws the previous standard. Bob will help us understand whether or not a key compromise like the one highlighted on Digg represents a real problem for the motion picture industry.

If you like the show, please go to iTunes and add your reviews to our podcast. If you have suggestions for show topics or have comments on this episode please send your feedback to comments@SecurityHype.com

Thanks for listening!