RSA: Who is the doctor's doctor?

[caption id="attachment_150" align="alignnone" width="348" caption="Some solid security logic."][/caption]

It's pretty clear at this point that there's a trending of attacks focused on security solution providers. The most recent victim in the post-HBGary landscape is RSA.

A lot of people seem to be talking about what they believe actually happened during the breach. The company has yet to officially comment on the details of the incident and seems to be wordsmithing any communication to the outside world pretty heavily. While I'm sure the technical facts will be interesting, and that they will make their way around the rumor mill eventually, I'd like to talk instead about something that I feel is more important - due and reciprocal care.

The medical industry seems to have this concept pretty well wrapped up. If you ask a psychologist, "who listens to your problems?" they will tell you that their psychologist does. This is because it is considered unprofessional, and in some cases a violation of ethics code to self-diagnose, self-prescribe, and self-medicate. Of course, this begs the question of who treats the psychologist that treated the first psychologist? Well, another psychologist of course. So, theoretically, as long as there are at least 3 physicians in the world who practice psychology, this model will continue to function, and we won't end up with a bunch of mentally disturbed psychologists.

I doubt anyone on the professional services end of the information security industry would argue that there's a shortage of proprietors offering security assessment and remediation. So then why do things like the RSA incident happen? It's because nobody is examining the physician. In fact, I'd be willing to bet that if you took a sample set of posture assessments from top 10 information security product and service vendors, the results of what's already left the building would be staggering. Further, most people close to the steam will tell you that things have not changed dramatically from the days when the entire Solaris source tree was essentially public domain in the hacker underground, and Larry Ellison's personal passwords were in a t-file.

Why? It's simple. Just because your company's primary business is security does not mean that you possess said security. What it does mean, however is that the risk you take is not only limited your standard business risk, but that your reputation is predicated on your ability to protect own your assets in the same manner that you would help the customer protect theirs.

So that you don't think we're calling the kettle black, we have in fact engaged an outside advisor to look at the company footprint, assess security, and make recommendations for remediation. If you're a security vendor, shouldn't you?

The Final Word on Hiring Hackers.

I'm addressing this about 6 months too late, but there was an extremely repetitive, relatively ignorant article that was written by M. E. Kabay which rehashes the topic of whether or not you should hire hackers for what seems to be the hundredth time. There are additional comments on Brad Johnson's blog here:  http://systemexperts.blogspot.com/2009/10/hiring-hackers-please-dont-by-brad.html

The only people who argue against hiring hackers are people who are riding their coat tails, or trying to create controversy that simply isn't there. Put simply, the information security industry was -created- by the very  hackers that the article suggests you shouldn't trust. The concept of compliance regimes, security standards, controls, and technologies like firewalls, IDS/IPS, DLP, etc... wouldn't exist without the need for security, and the need for security is addressed by these companies... right... the ones created by hackers.

In fact, suggesting that you shouldn't ever hire a hacker to work on your security project is analogous to suggesting that a doctor who has performed exploratory surgery on a patient with success is somehow less qualified to address your ailment.

Chris and Al,  both of whom I have seen own various parts of our nation's infrastructure first hand, are two of the most respected early security technology executives in the industry. Maybe you've heard of their companies: Secure Networks, and ISS.  Sorry guys, you're outed. It's been like 20 years, so I'm pretty sure you're safe from a statutes perspective. Point being that hackers are the primary people who are responsible for you having an industry to work in.

Its just funny to me that people are still having this conversation, because the argument that no one should hire hackers is silly. If you want to buy a product or have a service executed that even remotely involves security, you WILL be hiring a hacker, and you don't really have a choice in the matter. If you end up with zero hacker involvement, you may want to review the efficacy of the product or service you just bought.

OWASP Hacking Dojo - Sushi, Sake, Security

San Diego OWASP is having a FREE sushi, sake, and hacking workshop on January 27th at 6:00pm. Hope to see you all there.

Cloud Security is the New Hoverboard

You might not remember the whole thing about hoverboards and the "behind the scenes" footage from Back to the Future -  Part II, but I do. There was this producer or director or some other sort of executive in charge of the movie, and he calmly explained that the hoverboard in the movie was in fact real. He then went on to explain in elaborate detail how it would soon be available in stores all over the US.

Not a hint of sarcasm, no jesting facial expressions. This guy was dead serious.

I know this because I was 14 at the time, and I swore that I would have one for my birthday. My buddy Eric was even hinting that he thought his mom had picked one up and stashed it away for Christmas already, fearing that they would sell out.

Well, as i'm sure you've already guessed, the joke's on Eric and I, because there is no hoverboard. Never has been... probably never will be.

This is why I want to talk to you about "cloud security." Now, I'm not implying that you're 14 and gullible, but there are actual people out there who believe in this thing, and if you're one of them, then you might also start examining why you started adding "ph" to everything that formerly started with an "f" in infosec, right about the same time everyone else did. Actual hackers stopped doing this in the early 90s. The industry started doing it in about 2003.

Scientifically speaking, there's no way that cloud security can exist, because it has a dependency on "the cloud," which I have yet to locate.

Do you know why the cloud cannot exist? because for something to be relevant nomenclature in technology, it needs to be something that has a net positive or negative effect on either most companies or most consumers. The cloud doesn't matter, and I can prove it. Do this:

1. The name of your company is ______(A)________.

2. You currently rely on "the cloud" and the security of the cloud for _____B_____, ______C______, and _____D______.

3. The market space you are in is ________E_______.

4. A security technology that is cloud specific is: _______F________.

4. Assemble the following sentence:

Since i've been at ______A______, our ________B________ , ________C_______, and ______D_______ have enabled the company to  improve bottom line, increase productivity, and set an example in the _______E_______ industry, showing that obviously, we're still a market leader, and that cloud computing has changed the way we do business, forever. Also, I try to stay childlike by perpetuating my belief in the existence of ______F_______.

First Data and RSA to Provide Tokenized Card Processing

As you know, I pretty much constantly complain that noone ever does anything to inherently make better the state of data security when it comes to credit cards. The brands are always blame shifting, and merchants get left holding the liability bag and paying for everything.

Well, I'm not going to suggest that First Data has solved all of these problems, but what I will say is that I think they've put a stake in the ground with this new service.  Their new, "Secure Transaction Management" service utilizes RSA's tokenization technology on the endpoints to minimize the usage of credit card data throughout the enterprise. Partnering with RSA on this product gives some credence to it. Merchants aren't inclined to trust a payment processor who makes claims about the security of a technology unless a trusted 3rd party gets involved and makes it so.

This obviously isn't  my Utopian solution. I think card data needs to be public key exchange based, starting on the card. I realize that this makes me some sort of fringe lunatic thinker.  However, given that wholesale changes at Visa aren't likely, First Data's STM seems like a pretty good idea.

The only concerning part of the press release was this:

"The service uses First Data infrastructure by storing credit card data in secure servers for future retrieval by the merchant if necessary, while returning tokens to the merchant for use in their systems, Capellas said."

There's still a certain amount of faith that this product places in the merchant to determine what is "necessary." People like to store things that they're not supposed to, and making the data available to them practically guarantees that they'll find a way to use it inappropriately.

That said, this is the first time I've seen a payment processor take an active roll in providing a product which has a security provision layer as a core part of the offering. Nice work guys.

One piece of advice:

keep an eye on those "secure servers" that store data for "future retrieval."

Social Engineering Implications - Improper Logo Usage!

Whenever we do a pentest that has a social engineering phase in it, an important part of the test is to consider all of the parties involved, the vector of attack, and the potential outcome of the attack. By doing this, you

only add the necessary amount of risk to the business required in order to demonstrate the vulnerability.

Either that, or you trigger an emergency alert scenario that goes out to all credit unions on behalf of the NCUA.

This happened during a penetration test being run by a company called "Microsolved" which was being conducted for a specific credit union.

This is a pretty clear example of how a poorly planned social engineering scenario can backfire, and falsely alert thousands of people to a scenario that doesn't exist, wasting potentially millions of dollars in prep time and execution of incident response plans for an incident that didn't exist.

Don't get me wrong, mock scenarios are great for testing plans. They are however, not that great when they

exercise plans of companies who are not involved in the penetration test.

Furthermore, the guy at the bank who was responsible for the pentest apparently went on vacation while the test was occurring:

"But, on the day the package was received, the person responsible for the test was out of the office. So the employee who received the suspicious letter, which bore a NCUA logo and the bogus signature of former Chairman Michael Fryzel, reported it to the NCUA fraud hot line."

The other part of this story that I found fascinating is the NCUA's response to all of this, which pretty clearly had little to no executive involvement, and wasn't reviewed by anyone with responsibility for security or compliance. They say, and I quote:

“Credit unions are not authorized to create facsimile documents bearing NCUA logos or signatures, or to improperly represent communications from NCUA, even during the legitimate conduct of business, such as a computer security assessment."

Seriously? The federally sponsored organization that supervises federal credit union activity is more concerned with....improper logo usage than they are with the implication that they were tricked into sending out alert letters to nearly 8000 companies.

I guess I'd better take this Kellog's sticker off my sniper rifle. They might get the wrong idea about me being a cereal killer.

Cardsystems (PaybyTouch) Suing Their QSA - Savvis

In a move that everyone seems to think is paramount, but in actuality was truly inevitable, a QSAC is being sued over delivering a compliant ROC to an entity that was compromised.

The only surprising part is that its Cardsystems. Right... the one you kept hearing about over and over, about 5 years ago. The Cardsystems board was forced to sell thecompany to PayByTouch Processing as a result of Visa  taking the company off of VisaNet post-breach. I know this case all too well. I'm the one who did the follow up assessments post acquisition.

From the wired article:

"Visa executive told an audience earlier this month that the companies were not compliant, though auditors certified they were. “No compromised entity has yet been found to be in compliance with [the standards] at the time of the breach,” she said."

I love how Visa and the SSC keep sticking to their guns on this one even though everyone knows its a bag of BS. I even call it a bag of BS on the interview I did with exotic liability. Why is it BS? Because anyone canwalk into any merchant or service provider, compliant or not, and find 1000 little nuances that probably don't matter and use them interpretively to MAKE the merchant not compliant.

The bottom line here is that Cardsystems is going to drop this case. Why? Because they don't have one!

First of all, QSACs and QSAs have NO legal or contractual obligation to provide an accurate report. They have a moral responsibility to do the right thing. Big whoop. Secondly, I know for a fact that none of the people who were working at Savvis and were on this project are still there, and good luck rounding them all up. Thirdly - Cardsystems as a corporation is nothing more than a shell at this point. I'm guessing that the judge will see right through this feeble attempt at a cash grab for what it is... completely lame corporate behavior with no merit.

On top of all that - why would you wait 5 years to suddenly decide that you need to lay blame for your own crappy security infrastucture work on an auditing firm who's job it was to evaluate it for a 3rd party? Seriously, get a mirror. I've seen your network. Even in its repaired, remediated state, its not all that much to write home about.

Cardsystems - This suit is a joke. You're not going to win. Try to fade out of the media limelight slowly so that noone notices how lame you are. By the way - nice job laying off all the people who fixed your security problems as soon as the heat was off (Hi Kurt, Hi Joe). That was a really classy move.

Savvis - Bummer fellas. I guess the good news is that your company is bigger than theirs, so you'll win the standoff if that's what it comes down to.