submitted by:
n8

It seems that nothing can stop the google juggernaut from observing, tracking and serving up custom ads to every facet of our lives. After indexing the web to provide search, we got a preview of what they were up to... zeitgeist is a voyeuristic look into what the planet wants to know about, and a little tease of the data mining capabilities to come. Unsatisfied with that, google found ways to index other things, usenet, news, shopping, email, Blogs, RSS, your desktop, IM, the entire world, where will it end? (Yes, I have heard about their bid to kill craigslist, and all the other things that are in the news, so please don't say "did you hear about fill_in_the_blank_with_the_next_idea_for_world_domination_from_google").

The other day I read this article over at /. and it seems that google may be entertaining a foray into television. It sounds plausible, as "convergence" happens, I think the lines will begin to blur between phone, Internet, Cable, radio and media in general. I think convergence is a good thing, why should I pay $75 a month for cell service, $50 for a landline, $50 for cable modem, another $75 for TV, $13 for satellite radio etc. etc. If I could pay one carrier for all of those services and get a nice discount, that would be cool right? What if that carrier was google? They are buying up lots of dark fiber to build a network, they have plenty of cash (currently trading in the $380's per share) they are looking into new mediums to sell their advertising (print ads anyone?). Why not TV, why not VOIP? Would you be willing to sell your soul, 'er I mean receive a discount on VOIP service if you had to endure a 15 second ad before you got dial tone? How about watching a 5 minute infomercial on how to get 'rock-hard-abs' that you couldn't 30 second skip through every time you turned on your TV?

I for one dislike advertising. I feel bombarded by it every day. I walked through Times Square in NYC last week. No, I didn't like it. I bet most of you reading this feel the same way. It seems to be a necessary evil that we are all forced to endure unless we want to pay premium prices. Think HBO vs. NBC. We pay a premium price for ad-free media. Google makes all of their money from ads. The (perceived) problem is that they don't own ALL media (yet). Yes, they own search. Yes they own free mail. They own a satellite. They are making a play to own RSS. Why is that? So they can sell more ads. How long will it be before they own a TV station?

When is the last time you looked at their privacy policy? You have never read it you lazy sod. Most people wouldn't bother. Ever been curious enough to look at the "non-personal" information that google desktop collects when you enable "Advanced Features" and sends back to the Ministry of Love I mean.. the corporate offices?

# posted by N8 @ 9:27 AM 2 comments

higB

Dilbert "Maybe we should first start with password protecting the website? Or fixing our expired SSL certificate?"

The problem with these lists is when security vendors twist and mold them into their products. Then all the other vendors have to follow suit because their customers use stupid things like this when building their competitive matrixes. The icing on the cake is when an organization such as Visa/Mastercard/Amex cements it by putting stuff like this into their PCI compliance check list. Stop the madness!

# posted by higB @ 11:14 AM 12 comments

submitted by:
n8

With all the hype surrounding AJAX lately, I have been snooping around
to try to read up on this fun, exciting, revolutionary, web 2.0, rich
web application, blah, blah, bleh, buzzword, buzzword-enabled, turnkey,
technology.

Seriously, there is a lot of hype surrounding AJAX recently, and there
ins't much talk about the security implications of it.  I recently had
the opportunity to test a AJAX-ish web mail application.  I was
impressed with the features that could be achieved in a web application.
 Drag and Drop, right click, not having to refresh the entire page
every time you clicked on everything, etc.

Under the covers, it looked awfully familiar, with one obvious
difference.  Lots and lots of POSTs.  The POST requests had nothing
particularly noteworthy in them, the same things you would find in any
other application, Session management stuff, unique identifiers,
messageIDs, actions, etc.  Normal POST  parameter stuff.

Aside from the extensive use of XML and Javascript, this application
felt like most others, so it must be vulnerable to the same stuff as
every other web app right?  Yup.

In this case, the developers did a pretty good job of validating user
input, so if you stuffed in an odd character here, an apostrophe there,
and a script tag for good measure, you got some generic XML parse error.
Being "asynchronous" meant the end user never had to suffer through all
the error messages, but they were there.  Once I figured out that I
needed to be more selective in fuzzing parameters, I began to see some
more interesting errors.

The moral of the story is that there ins't anything terribly exciting or
noteworthy specific to AJAX apps from a security perspective.  Rather
the same old rules still apply.  Good user input validation, strong
session management, authorization check etc. still need to be done.  Go
read the OWASP top 10 if you dont know what Im talking about.

I have no doubt that some of these new AJAX apps will fail
spectacularly.  It wont be any new or revolutionary exploit method, but
the same thing that web developers continue to get wrong time after
time.  It might be creative use of Javascript to achieve hero status, or
failure to properly validate the XML schema allowing some new and
interesting functionality in the application...  stay tuned,  it should
be fun.  Testing web apps for a living has taught me one thing.

Give a man enough rope, and they will end up 6 inches short.  'er hang
themselves or something.

# posted by N8 @ 8:39 AM 0 comments

I will spare you all of the acronyms and regulations that they are working on. Bottom line is that they are sorta re-doing the Rainbow Books. Which worked so well the last time. But this time they are trying to "work with private industry" to understand what's going on.

It's like your step dad trying to talk all cool to you. It's all awkward and you sit there staring at your bedroom door wishing he'd leave so you can go back to playing Rescue Raiders on your Apple //e. Finally you yell out "YOU'RE NOT MY DAD TODD!!!"

Well, here are the feds again trying to get private industry to give them products that are secure and don't come with a backdoor that lets Beijing take a peek.

See, this is all part of DHS trying to wrap its arms around the US's "Critical Infrastructure". Power plans, FDIC facilities, chemical plants, transportation, telecommunications, etc. That's the quick list. NIPC under the FBI tried to do this once. Click on that link. Kinda funny. Maybe DHS is different. They use different letters.

Didn't work. As it turns out, it's hard as hell for the feds to get the private sector to do things. Unless you slap a little SOX or other standards action on them, they won't budge. The private sector is too busy making money to care.

So that's my first issue with the initiative to secure cyberspace. Didn't work before, won't work again. Government will probably follow the standards with tunnel vision while the rest of the private sector (which comprises a great deal of critical infrastructure) will ignore them and continue to be exposed to risk.

My second issue with DHS's plan is that even if you had secure code and strong standards, the feds will just screw up the implementation. No offense to any readers but the federal government has a very hard time attracting, using, and retaining quality security people. People either get fed up with all the BS or they can get paid somewhere else. So what if write code that can't be overflowed. Big deal, just find an admin that works 10-4 and abuse a mis-configuration of the "trusted" software. Those of you who perform security assessments know what I am talking about. Sure you use buffer overflows when pen-testing. But a lot of your findings are mis-configurations.

Government contractors aren't much better. I have a lot of friends who do .gov contract work and they have horror stories about co-workers who deal with security at government agencies. It's scary.

Software is getting more complex. Writing better software that can't be directly abused (buffer overflows) is a great start. Might knock down some worms or something. But even a well-engineered aircraft that is very safe can crash if the pilot forgets to operate it properly.

Some of the questions from the crowd weren't so hot either. A few people who were feds were asking about application security scanners like they had never heard of them until 60 Minutes did a piece on it. Holy hell people. Government people need to get out of their echo chamber and look around. Banks figured this years ago and now test their web applications. If only there was a web of interconnected computer systems that allowed for the open exchange of information. And only if there was a free, easy to use tool that could search this information and return highly accurate results.

Highlights of the meeting include talking to our good friend Richard Bejtlich from Tao Security. Richard is such a nice down to earth guy who totally get's what we're talking about. Nate and I felt like he was the only one in the room that got it.

So the ISSA meeting tonight was good just so I can be reminded that this industry isn't going anywhere. They also had some awesome cookies and punch.

# posted by Trevor @ 10:25 PM 2 comments