Star Trek Security Lessons

Of course the new Star Trek movie contains much advanced and fantastic technology, but even in the 23rd Century security can either save or doom the day. From Kirk hacking into the infamous Kobayashi Maru test at Starfleet Academy to Chekov’s botched voice authentication attempt, check out these spoilers lessons from aboard the Enterprise.

Computerworld’s Ira Winkler “Sizes up security in Star Trek”.

Early on, James Kirk becomes the only cadet to successfully pass the infamous Kobayashi Maru test at Starfleet Academy. He does so by hacking academy systems to change the test. Lesson: The biggest threat to university computers is the student body. At the very least, there should have been proper access controls to prevent Kirk from accessing the test files.

The Enterprise voice-recognition system cannot understand Chekov's thick Russian accent when he is trying to authenticate himself. Lesson: Take a look at your own authentication systems. In a situation more dire than the one Chekov faced, flawed authentication could result in disaster. And you don't want a system like the Enterprise's, which requires you to speak the password in front of everyone.

And one of our personal favorites.

I even see a lesson in the best line of the movie. A Romulan, holding Kirk up by his neck and gloating over his helplessness, asks him what he is trying to say. Kirk's response: "I have your gun." Then he shoots him. Lesson: You need to completely stop a computer hacker or other adversary before you begin celebrating.

<< Blog Home
Mocana Website >>

Conficker Infects Critical Medical Devices

The Conficker worm didn't just hit PCs -- it also infected several hundred critical medical devices, a security expert said in a panel at the RSA security conference. Right now it's unclear how the devices, which control things like heart monitors and MRI machines, got infected. But it underlines the need to secure medical systems with embedded firewalls and anti-malware software like Mocana's NanoDefender™.

The computers are older machines running Windows NT and Windows 2000 in a local area network that was not supposed to have access to the Internet, however, the network was connected to one that has direct Internet access and so they were infected, he [Marcus Sachs, director of the SANS Internet Storm Center and a former White House cybersecurity official] recently told CNET news.

The situation illustrates the dangers of connecting critical networks, like in hospitals and in SCADA (Supervisory Control and Data Acquisition) systems used by utilities and other critical infrastructure providers, with networks connected to the Internet, he said during the panel "Securing Critical Infrastructures: Infrastructure Exposed."

"We're seeing a huge uptick in probing for SCADA systems," said Jerry Dixon, director of analysis and vice president of government relations at research firm Team Cymru. For years, the SCADA systems were separated from the public networks, but that's not the case anymore, he said.

While PCs do remain the primary targets, hackers and malware-writers are increasingly setting their sites on non-PC SCADA devices attached to the network. In other words, as PC security mechanisms have become more sophisticated, non-PC SCADA devices are becoming the more attractive, comparatively "soft" targets -- an easier way into the host network, thereby threatening our critical national infrastructure.

Download this FREE Whitepaper that dives further into why SCADA devices are under fire and what you can do about it.


<< Blog Home
Mocana Website >>

Spies Hack into US Electricity Grid

While motivations remain unclear, US intelligence officials recently discovered that cyberspies from China and Russia have penetrated the U.S. electrical grid. No damage was done, but authorities found software tools that were left behind that could be used to destroy infrastructure components during a crises or war, according to a recent Wall Street Journal article.

The sophistication of the U.S. intrusions -- which extend beyond electric to other key infrastructure systems -- suggests that China and Russia are mainly responsible, according to intelligence officials and cybersecurity specialists. While terrorist groups could develop the ability to penetrate U.S. infrastructure, they don't appear to have yet mounted attacks, these officials say.

It is nearly impossible to know whether or not an attack is government-sponsored because of the difficulty in tracking true identities in cyberspace. U.S. officials said investigators have followed electronic trails of stolen data to China and Russia.

Russian and Chinese officials have denied any wrongdoing.

How does this relate to the Obama administration’s cybersecurity review?

<< Blog Home
Mocana Website >>

Reinfected BIOS with every Reboot

It’s been theory, now it’s real. In a talk at last month’s CanSecWest conference two security researchers demonstrated methods for infecting the BIOS with persistent code that survive reboots and reflashing attempts. The best part?

...the method worked on a Windows machine, a PC running OpenBSD and another running VMware Player.

"It was very easy. We can put the code wherever we want," said [Alfredo] Ortega. "We're not using a vulnerability in any way. I'm not sure if you understand the impact of this. We can reinfect the BIOS every time it reboots."

The “real” best part? Mocana’s NanoBoot is the cure.

Blog Home >
Mocana Website >

Smart Grid, Smarter Hackers

Researchers have discovered several security vulnerabilities in Smart Grid, a digitally based system designed to give customers and power companies better control over their electricity use. These flaws could allow hackers to access the network and cut power via the network. With more than 2 million devices in play and 17 million more planned for release in the coming years, the potential ramifications are devastating.

CNN recently reported that

IOActive, a professional security services firm, determined that an attacker with $500 of equipment and materials and a background in electronics and software engineering could "take command and control of the [advanced meter infrastructure] allowing for the en masse manipulation of service to homes and businesses."

Experts said that once in the system, a hacker could gain control of thousands, even millions, of meters and shut them off simultaneously. A hacker also might be able to dramatically increase or decrease the demand for power, disrupting the load balance on the local power grid and causing a blackout. These experts said such a localized power outage would cascade to other parts of the grid, expanding the blackout. No one knows how big it could get.

Blog Home >
Mocana Website >

Consumer (and Hacker) Friendly

Apple iPhone 3.0 will be released later this summer with some 100 innovative new features. With the ability to send photos and contacts via MMS; cut, copy and paste between applications; and access to corporate apps through browsers, it just keeps getting better for iPhone users -- and more attractive to iPhone hackers. And what about as it relates to the Enterprise?

It is likely that Apple iPhones will be compelling devices to access corporate applications due to advances in performance, storage, displays and user interfaces. The convenience of being always connected means that users will be able to access the business wherever and whenever they want.

IT should look for security capabilities such as using the Apple iPhone as a two factor authenticator while establishing an SSL VPN connection to the corporate network. The Apple iPhone is a clever device, and with 13.7 million produced in 2008, it is a device that IT security teams need to understand.

Check out a few of the specific features that are causing security concerns.

Learn more about how Mocana's Enterprise Applications Solution is helping companies approach three fundamental security challenges: Identity, Information Security and Application Security.

Blog Home >
Mocana Website >

SCADA Under Fire... Again.

Paris-based Areva is warning its industrial customers to upgrade a key part of its energy management software after it discovered security bugs which could allow power plants to be hijacked. The technology is a type of supervisory control and data acquisition (SCADA) software used in power plants... According to the security advisory from CERT, the software bugs allow attackers to gain access to the privileges of the e-terrahabitate account or administrator account and execute commands or cause the system to crash.

Read the article.

Netbook Web Surfers Beware

Primarily designed for browsing the Internet or checking e-mail, this low-cost alternative may be fertile ground for hackers and viruses.

Price tags as low as $300 mean that netbooks often lack such standard gear as firewalls and other anti-virus software typically found in other computers, leaving them highly vulnerable to attacks.

Netbook pioneer Asustek believes its models already include built-in security features and other options that are sufficient for the typical user, said Samson Hu, who runs the company’s netbook operations.

Some experts say netbooks' inability to run effective security could crimp future growth, scaring away lucrative corporate users who regularly deal with sensitive data.

Read the article.

Mocana's Device Security Framework is perfect for securing netbooks.

Hints from Mocana Engineering

I read somewhere I need calendar time for security. Why? Do I need a special calendar time chip support?

It depends on the security product whether you need a calendar time -- some protocols such as 802.11i or IPsec do not require calendar time. Any protocol or security product which uses certificates should use NTP to check certificate expiration: SSL, SSH, IKE, PKCS#7, etc. NTP == network time protocol. No special hardware is required to run an NTP client with the right software. Note: if you need an NTP client, Mocana can help you.

Do You Know Where Your Phone is?

Turns out most people don’t, at least not on a consistent basis, which is a huge liability when it comes to keeping information secure.

“Johannes Ullrich, chief research officer for the SANS Institute, a security research organization, says the biggest threat for cell phone users is leaving their devices behind somewhere, or losing them. And perhaps putting too much data on the device.”

Too much data?

"The information stored on a phone should be limited to information that is required while on the move," he said. "Some phones allow the user to store spreadsheets and other office documents. If any passwords are stored on the phone, they should be encrypted."

As smartphones grow in popularity, so too does interest by thieves, not necessarily for the devices but for the information they hold.

With WiFi, Bluetooth and even your local cab company, find out more tips on how to keep your phone safe and secure.

The Five Coolest Hacks of 2008

These attacks are illegal, they're wrong... but you've got to give the guys points for ingenuity and resourcefulness. Check out the most innovative and imaginative hacks of 2008 as ranked by security site DarkReading.com.

We've selected five of the coolest hacks we covered here at Dark Reading in 2008 -- unusual and sometimes off-the-wall vulnerabilities that were exposed and exploited this past year by researchers who, driven by their curiosity and imagination, had some fun (possibly at your expense), but all for the ultimate purpose of making daily life more secure.

1. Highway to Hell: the electronic toll system hack
2. Psyche-cracking
3. iPhone as a hacking tool
4. Permanent denial-of-service
5. "Gecko" and the building system hack

Read full story.

Researcher Creates 'Write Once, Run Anywhere' Cisco Hijacks

Dan Goodin reports:

A researcher has discovered a way to reliably exploit a known security vulnerability in a wide class of Cisco System routers, a finding that for the first time allows attackers to hijack millions of devices with a single piece of code.

The discovery by Felix "FX" Lindner of Recurity Labs in Berlin brings the write-once-run-anywhere approach of software development to the dark art of compromising routers that form the core of the internet.

"What FX has shown, conclusively, is that when something comes out that can potentially compromise your router, you have to get on it as you would get on a remote vuln, for, say, your domain controllers or database servers," said Dan Kaminsky, a fellow researcher. "Router infrastructure has been conclusively proven to be as generically vulnerable as commodity operating systems."

According to the post, Kaminsky further notes that the:

bigger problem is streamlining the IOS patching process to lessen the very real risk that a single fix will bring down machines that form the cornerstone of enterprise networks everywhere.

Read full story.

Big Holes Discovered in Bluetooth

"Bluetooth 2.1, with all of its promises of great security, is made up of multiple protocols" that can be bypassed, said Andrew Lindell, chief cryptographer for Aladdin Knowledge Systems, at the CSI 2008 Security Reconsidered conference. For example, passkeys can easily be intercepted and read, taking only 20 computations for an attacker to figure out the password, which was not the case with the previous version of Bluetooth, Lindell said. Read about other glaring security flaws that let an attacker stage simple man-in-the-middle hacks.

Nokia and the Internet of Things

Nokia and its partners are developing a smart home platform that will enable any mobile device equipped with a Web browser to serve as the remote control for household security, monitoring and energy-management systems. With open APIs and protocols, plans call for "any device with a browser" to connect to the Nokia Home Control Center remotely or locally. Ultimately, intentions are to develop technologies to cover safety and security, energy savings, wellness, real-estate management and building technologies, and home automation.

How Much Do You Really Know About (SSH) Security?

This informative article explains how to approach an actual integration of SSH into embedded and mobile devices, while answering some key SSH configuration questions. Regardless of whether you're a "Newbie, Intermediate or Expert" security type, learn how to make informed technical decisions about communications modes, encryption ciphers, and authentication methods.

Read the article >
Buy the O'Reilly book at amazon.com >