Cable cut slows down the communications

Three cables under the Mediterranean Sea which link Europe to West Asia have been damaged, causing partial slowdown in India’s Internet and telecom traffic.

Experts said outsourcing traffic and Internet speed were affected yesterday. However, most BPO firms and individual Internet connections are working at normal speed today.

Most of India’s Net traffic is routed through the US and consequently the Pacific link is more important for India than the Mediterranean link, they said.

An IPLC is a point-to-point private line used by an organisation to communicate among its offices across the world.

“Today being a Saturday, we may not feel the full impact of the cuts. Moreover, given the global slowdown, most companies themselves are working fewer hours, and, hence, the impact may be lower,” said Rajesh Chharia, the president of the Internet Service Providers Association of India.

Repair teams are on the job and have diverted most of the traffic through the US, but if the three undersea cables, Sea Me We 4 (SMW-4), Sea Me We 3 (SMW-3) and FLAG, are not completely restored by the weekend, companies could face problems next week.

Internet traffic “from Mumbai to London has now been re-routed via Hong Kong which may lead to congestion and increased latency on this route”, Reliance said in an e-mailed “traffic disruption update”. A Reliance spokesperson added: “Most services are working normally now.” The company said it would publish another update on its website tomorrow.

SMW-3 and SMW-4 are owned by groups of phone companies, including Bharti Airtel, while FLAG is owned by Reliance Globalcom — part of the Anil Ambani-owned Reliance Communications.

The causes of the cut — located in the Mediterranean between Sicily and Tunisia on sections linking Sicily to Egypt — remain unclear.

Chharia expressed surprise at “the regularity with which these cuts have been happening”. Earlier this year, SMW4 and FLAG were damaged near Alexandria off the coast of Egypt.

In 2006, an earthquake with its epicentre near Taiwan had severed several undersea cables.

Submarine cables are laid beneath the sea to carry telephone and Internet traffic. They can be broken or damaged by fishing trawlers, anchoring, undersea avalanches and even shark bites.

Microsoft to release the patch for the IE vulnerability

A FLAW has emerged in Microsoft’s Internet Explorer web browser software which allows hackers to steal information from people’s PCs if they visit certain websites.

Computer security experts only became aware of the issue when websites cropped up that were exploiting the flaw to steal user accounts for online gaming, which can then be sold on. Security problems such as this, which are discovered by hackers before the makers of the software, are known as “zero day exploits”.

Chinese websites were initially compromised but last night Brian Honan of the Irish Reporting and Information Security Service, said that about 10,000 sites had been infected worldwide.

Microsoft yesterday issued a statement advising its customers to “follow simple safety guidelines”, including ensuring their software is fully updated and that they have current security software installed and switched on. It advised consumers worried about how to protect their PC to read the advice at www.microsoft.com/protect.

Last night Microsoft announced it would release an update today which it is believed will address the problem.

Microsoft’s investigation has shown the attacks are targeting customers using Internet Explorer 7, but it said the vulnerability affects all versions of Internet Explorer.

Some security experts advised people to switch to a different web browser, such as Mozilla Firefox or Apple’s Safari, until a solution for the problem was developed by Microsoft. Irish security experts suggested this was not an option for most internet users.

“If people were to change their browser every time a vulnerability was discovered they would be constantly changing,” said Colm McDonnell, a security expert with Deloitte. He advised people to change their Internet Explorer security settings to High until they install the patch which is being issued.

Microsoft to release the patch for the IE vulnerability

A FLAW has emerged in Microsoft’s Internet Explorer web browser software which allows hackers to steal information from people’s PCs if they visit certain websites.

Computer security experts only became aware of the issue when websites cropped up that were exploiting the flaw to steal user accounts for online gaming, which can then be sold on. Security problems such as this, which are discovered by hackers before the makers of the software, are known as “zero day exploits”.

Chinese websites were initially compromised but last night Brian Honan of the Irish Reporting and Information Security Service, said that about 10,000 sites had been infected worldwide.

Microsoft yesterday issued a statement advising its customers to “follow simple safety guidelines”, including ensuring their software is fully updated and that they have current security software installed and switched on. It advised consumers worried about how to protect their PC to read the advice at www.microsoft.com/protect.

Last night Microsoft announced it would release an update today which it is believed will address the problem.

Microsoft’s investigation has shown the attacks are targeting customers using Internet Explorer 7, but it said the vulnerability affects all versions of Internet Explorer.

Some security experts advised people to switch to a different web browser, such as Mozilla Firefox or Apple’s Safari, until a solution for the problem was developed by Microsoft. Irish security experts suggested this was not an option for most internet users.

“If people were to change their browser every time a vulnerability was discovered they would be constantly changing,” said Colm McDonnell, a security expert with Deloitte. He advised people to change their Internet Explorer security settings to High until they install the patch which is being issued.

The Payment Card Process

When a payment happens using a payment card (debit/credit) a verification process happens at the background which will decide whether to approve or reject the transacation. When a customer pays for products or services with a credit card, the card information is recorded—either by manual entry, a card imprinter, point-of-sale (POS) terminal, or virtual terminal—and then verified so that the merchant can receive payment for the transaction.

This process involves the following parties:

• Cardholder: the owner of the card used to make a purchase
• Merchant: the business accepting credit card payments for products or services sold to the cardholder
• Acquirer: the financial institution or other organization that provides card processing services to the merchant
• Card association: a network such as VISA® or MasterCard® (and others) that acts as a gateway between the acquirer and issuer for authorizing and funding transactions
• Issuer: the financial institution or other organization that issued the credit card to the cardholder

The flow of information and money between these parties—always through the card associations—is known as the interchange, and it consists of a few steps:

1. Authorization: The cardholder pays for the purchase and the merchant submits the transaction to the acquirer. The acquirer verifies with the issuer—almost instantly—that the card number and transaction amount are both valid, and then processes the transaction for the cardholder.
2. Batching: After the transaction is authorized it is then stored in a batch, which the merchant sends to the acquirer later to receive payment (usually at the end of the day).
3. Clearing and settlement: The acquirer sends the transactions in the batch through the card association, which debits the issuers for payment and credits the acquirer. In effect, the issuers pay the acquirer for the transactions.
4. Funding: Once the acquirer has been paid, the merchant receives payment. The amount the merchant receives is equal to the transaction amount minus the discount rate, which is the fee the merchant pays the acquirer for processing the transaction.

The above text is extracted from the Bank of America website and the URL is given below.

http://www.bankofamerica.com/small_business/merchant_card_processing/index.cfm?template=card_processing_basics#cardprocessing

PCI DSS History

PCI DSS originally began as five different security programs by five different card companies:

• Visa Card Information Security Program (CISP)
• MasterCard Site Data Protection
• American Express Data Security Operating Policy
• Discover Information and Compliance
• JCB Data Security Program

Each of these companies intended to create an additional level of protection to customers, hence ensuring that merchants meet minimum levels of security when they store, process and transmit cardholder data. The Payment Card Industry Security Standards Council was formed, and on the 15 December 2004, these companies aligned their individual policies and created Payment Card Industry Data Security Standard (PCI-DSS) version 1.0.

In September 2006 , the PCI standard was updated to version 1.1 to provide clarification and minor revisions to version 1.0. In October 2008, the PCI DSS version 1.2 is released and provided clarity on some of the debated requirements.

VISA and MasterCard plays a key role in promoting and enforcing the PCI DSS across the industry.

• MasterCard is responsible for certifying products and companies capable of fulfilling the Scanning requirements
  • These are often referred to as SDP Certified products and/or companies
• Visa is responsible for training and certifying companies and individuals capable of fulfilling the Onsite Audit
  requirements
  • Such companies are called QSAs (Qualified Security Assessors) and the individuals are called QSAPs (Qualified Security Assessor Personnel)
• The other PCI organisations are contributors to the standards

New draft security documents from NIST

NIST has recently published 4 draft security guides for public comment

DRAFT Guide to Bluetooth Security

Guide to Bluetooth Security, describes the security capabilities of Bluetooth technologies and gives recommendations to organizations employing Bluetooth technologies on securing them effectively

Guidelines on Firewalls and Firewall Policy

Guidelines on Firewalls and Firewall Policy, provides recommendations on developing firewall policies and on selecting, configuring, testing, deploying, and managing firewalls. The publication covers a number of firewall technologies, including packet filtering, stateful inspection, application-proxy gateways, host-based, and personal firewalls

DRAFT Guidelines on Cell Phone and PDA Security

Guidelines on Cell Phone and PDA Security, is available for public comment. It provides an overview of cell phone and personal digital assistant (PDA) devices in use today and offers insights for making informed information technology security decisions regarding their treatment

More details can be found at the NIST site..

http://csrc.nist.gov/publications/PubsDrafts.html

Drive-By Pharming

Sid Stamm, Zulfikar Ramzan, and Markus Jakobsson have identified a clever, and potentially devastating, attack against home/wireless routers.

How does the attack works?

1. Attacker creates a webpage with containing the malicious Javascript code.
2. Victim visits the page
3. The code makes a login attempts into the users home broadband router and then attempts to change its DNS server settings to point to an attacker-controlled DNS server
4. Once the user’s machine receives the updated DNS settings from the router (after the machine is rebooted) future DNS requests are made to and resolved by the attacker’s DNS server.
5. Now the attacker basically owns the victim’s web connection.

The main condition for the attack to be successful is that the attacker can guess the router password. This is surprisingly easy, since home routers come with a default password that is uniform and often never changed.

They’ve written proof of concept code that can successfully carry out the steps of the attack on Linksys, D-Link, and NETGEAR home routers. If users change their home broadband router passwords to something difficult to guess, they are safe from this attack.

Additional details can be found here. There’s also a paper on the attack.

Note that the attack does not require the user to download any malicious software; simply viewing a web page with the malicious JavaScript code is enough.

Kick start Informaiton Security

This article is going to focus on an overall information security management system. This is in line with industry best practices like ISO27001, COBIT, SSE-CMM and legislative requirements like HIPAA, SAS70 etc. To help organizations in kick starting the information security practices, I have developed the following checklist.

POLICY: I would love to work in this area, if I have a given a chance. This is the place where you are defining the practices. A policy reflects the management’s intention towards achieving information security and every policy has to be approved by an authority in a approving capacity. Policies shall include Information Security Policy and Acceptable Use Policy. In addition to policies you should develop the standards and operating procedures. Finally, you need to have the Roles and responsibilities defined to ensure that the policies and procedures are enforced by the responsible users.

USER ACKNOWLEDGEMENT: Now you have policies and procedures. This need to be understood by the employees, this can be achieved by training, and you need to take a proof of the same. A written, nowadays electronic, acknowledgement of their understanding and acceptance of the infosec policies need to be obtained. If you have third parties (Contractors, vendors etc..) accessing your information, the acknowledgement is applicable for them also.

CONFIDENTIALITY AGREEMENTS: OK, now its time to include legal clauses to your business in securing the information. Execute signed confidentiality agreements before disclosing any sensitive or proprietary information to outside users. It is a good practice to have NDA with the employees (recent surveys shows that internal threat materializes faster than outside threat)

PHYSICAL SECURITY: Protect you physical infrastructure. Identify the physical entry points to the organization and ensure that only authorised users are entering to the premises. Protect you paper documents those are spread across your table, printer and close you shelves before you leave the place. Lock/logoff your computers when unattended.

PROTECTION AGAINST MALICIOUS SOFTWARE: Deploy antivirus software across the enterprise. Hmmm… OK I would say plan a process/system to protect your information systems from malicious software attacks. The reason why I said the word “process” is that you have to regularly update the virus definitions files to sharpen your cop against the newly released viruses.

SOFTWARE PATCHES: You shall plan for a Patch Management system by which you can ensure that all the systems are patched with the latest security updates (please test the patches before deploying)

NETWORK SECURITY: Document your network perimeter (just like you have done with the physical perimeter). All connections connecting to your external networks should be documented, authorized by the management (Network Manager or above), and shall be protected by firewalls, IDS. (Think about the desktops with modems connected). Establish VPNs for extranet communication. Define an incident reponse plan and TEST it.

REMOTE ACCESS: Develop best practices for establishing remote access connectivity. Again, think about modems

PASSWORDS: Very very key in establishing a security framework. More on passwords is my next blog please wait till then .

DATA SECURITY: Ensure that only authenticated and authorized users have access to the data.

AUDITS: Audit everything related to Information Security. Do vulnerability assessments on your computers and network devices. Audit the process and policy flows. Audit for illegal software’s. Yes, you have to do the auditing regularly so best approach is to prepare a audit plan and allocate a audit committee.

BUSINESS CONTINUITY PLAN: Ensure that you have business continuity. Identify key business objects (people, process, material, place, etc…) Document a plan for continuing the business operation in case of an emergency. That shall include data backup and restore procedures, alternate facilities, replacement resources, etc…

Who sets Security as a Strategic initiative

The answer to this question is simple, like all other corporate initiatives, it needs to be set by the management. Who decides the core value of the company, core culture of the company and /or the other strategic decisions? It is ideal to have the same person or the role to announce security has core value in the company.

Information Security and Microsoft

Let us take the case with Microsoft. Bill Gates wrote a letter to the entire organization to address the security concerns. His letter not only discusses about the importance of security as a strategic imitative, but also provides a roadmap to ensure the Microsoft products secure.

Support from executive offices will convey the message of importance for Information Security in the company. It will also convey the message that, Information Security cannot be achieved without the cooperation of everyone in the company.

Microsoft sets the slogan “Secure by Design, Secure by development and Secure by deployment”. There is one more aspect to be understood, Secure by assessing the requirement.

Not every company will have the same view about information security, but all companies will agree on a common point that information security is critical to their success in today’s business. In today’s global village companies should understand the power of information and the ways to protect the information as the core asset of the company.

It is not an easy task to protect the information and being a secure company, it will take resources by means of people, process, technology and money. Engage/develop an information security model which will ensure continual improvement, so that you can keep your protection above the industry standard. It is good to be at par with the industry benchmark, but it is better to be on the upper side of the benchmark line.

Information Security – A Strategic move

In today’s business Information Security has a greater importance as part of the Risk Management strategy. There are many efforts are taking place across the world and many Information Security programs are evolving as a result of this. These programs address security not only as a technical component, but also a Management practice. Business is growing faster and it requires integrating security with business. This leads to developing programs which can strategically protect the business information and assets This series of articles will focus on the requirement of addressing security as a strategic decision and tries to address the concerns of the Business owner and the security professionals. Within these articles, you will find information from the regulations like Sarbanes Oxley, HIPAA, FISMA, PCI Data Security etc… and standards like BS7799/ISO27001, COBIT, ITIL, and ISM3 etc. This series aims at bringing together the interest of business owners and security professionals. This series also aims at identifying the business problems and potentials solutions for them.

Many companies have initiated their Information Security program; these initiates are mainly through the information technology organization and hence it will remain a part of the IT organizations. Some other companies are trying to identify the right reporting structure.

Another group of companies believes that, the protection of Information Asset is a core business function and has strategic Information Security programs. For them, Information Security is part of their corporate strategy and is not an additional or add-on task. In such organizations, Information Protection is the responsibility of every employee. It is built into the culture of those organizations. In such organizations information protection is not something addition to their work, it is their work. Not for 8 hours, but 24 hours a day.

Universal Browser PDF XSS vulnerability

Everyday application security is facing new threats and it challenges the business users. The latest is in the form of XSS attacks; where an application serving PDF files are vulnerable to these attacks.

Attackers simply have to add an anchor containing a script, e.g. add #blah=javascript:alert(document.cookie); to ANY URL that ends in .pdf (or streams a PDF). The browser hands off the anchor to the Adobe reader plug-in, and the script then runs in the victim’s browser.

The Universal PDF XSS issue was discovered by Stefano Di Paola and Giorgio Fedon and it was presented on 23C3 security conference. This vulnerability obviously affects the Adobe Acrobat Reader which is a widely used software among business, non-business organizations and individuals. By abusing Acrobat’s open parameter features well protected sites become vulnerable to Cross-site scripting attacks if they host PDF documents. This is pretty bad and unless you update your reader or change the way your browser handles PDF documents, you may get hacked quite badly. This issue is very serious.

This vulnerability can be exploited by using the URL in the following fashion

http://path/file.pdf#blah=javascript: yourcode

It is very clear that any malicious user can write the required code for malicious activity. Can hijack sessionID and thereby the user identity or execute code from another location and thus redirect a user to a phishing site and a lot more…

Some examples

Try it on your windows OS

file:///C:/Program%20Files/Adobe/Acrobat%207.0/Resource/ENUtxt.pdf# blah=javascript:try%20{var%20req%20=%20new%20XMLHttpRequest();req.open(%22GET%22,%20%22file:///C:/WINDOWS/system32/drivers/etc/hosts%22,%20null);req.send(null);%20alert(req.responseText)%20}%20catch%20(e)%20{console.dir(e)};

Does this ring any bell?? Doesn’t it crazy? Minor modifications in the JavaScript will reveal the directory browsing, or copying of files from your system…

Another one for directory listing

file:///C:/Program%20Files/Adobe/Acrobat%207.0/Resource/ENUtxt.pdf# blah=javascript:try%20{var%20req%20=%20new%20XMLHttpRequest();req.open(%22GET%22,%20%22file:///C:/%22,%20null);req.send(null);%20alert(req.responseText)%20}%20catch%20(e)%20{console.dir(e)};

OK, now lets go more details from the fun part of the vulnerability.

PDF being widely used, it is important to understand that most of the applications in the internet have this vulnerability. This makes the situation a lot worse because If you happen to be on a malicious site or you click a malicious link, attackers can simultaneously compromise several of your WEB accounts that are currently open/authenticated.

Note the point that, this attack will be effective only if you/victim click on the url.

Now lets see what hackers/crackers/(you name it) do to make use of this vulnerability?

Being an intelligent user, chances are less you click on a suspicious link. However attackers can make use of sneak techniques to force you somehow, by changing the file extension of the PDF document to .mp3 or .mov or even .html. It looks less suspicious, but still when pulled from the server the content will be served as application/pdf:

For example:

A slight modification in the htaccess file of http://currentdomain/

#.htaccess

RewriteEngine On

RewriteRule *.(jpg|png|css|mp3|mov|avi)$ http://otherdomain/abc.pdf

When a user clicks on the following url

http://currentdomain/whatever.mp3#something= javascript:malicious_code

the code will be executed on http://otherdomain and not in the currentdomain. The user has fallen into the trap.

Now you have tiny URL.

One can embed the malicious URL in a tiny URL and send the tiny URL to the victims. This will make the user less suspicious about the URL and has more possibility of clicking on the link.

Using tinyurl you can have

http://currentdomain/whatever.mp3#something= javascript:malicious_code

become

http://tinyurl.com/——Another option is to have the exploit link opening automatically without user action. This can be performed by embedding the link in a site, normally malicious site. When a user visits such sites, the exploit page will automatically opened by using iframes.

his vulnerability will be a solid tool for phishing attackers and they can use this cleaverly to gather personal information and identity thefts.

What are the fixes?

Do not click any url which is not familiar and/or which is not from a trusted source. Always type the URL and then guide through the site links.
Upgrade your Adobe Acrobat reader to version 8
Upgrade the browsers using vendor released patches