The Myth of Patch Management

From an old video recording of a security session held at Technet:

http://www.microsoft.com/emea/spotlight/sessionh.aspx?videoid=991

“The Air Force had an environment where they standardized , based on a limited number of server build and client build using images and vhd files.. and then they allow them to make another decision. They did a risk assessment of patch delays and came to the following conclusion...

If we delay installation of a patch because we have to test it, then there is a time window between patch download date and install date, of when their machines are vulnerable to attack…

and their risk assessment concluded, that getting attacked in that time window, is much more likely than immediately installing the patch and see if an application breaks. That was their risk assessment. So they have done what I have been begging people to do for years. They have turned their patch management over to Microsoft (outsourced it to us). When we issue a patch, they install it right away.”

- Steve Riley, Former Senior Security Strategist - Microsoft Trustworthy Computing

Book author of "Protect Your Windows Network, from Perimeter to Data"

However, there is one point I would disagree with the Air Force. Newly released operating system service packs and IE versions must be tested in a business environments first regardless how small or large the business is, and if there is a testing team or not. At the same time, I do not recommend delaying installing those updates. I have seen security experts who test the new service pack updates even for their home environment.

Note: Steve Riley is now with Amazon Cloud Computing. He can be found here: http://stvrly.wordpress.com/

Barnes & Noble Sucks! The Rogue Online Bookstore.

A very close friend of mine was ordering books online and I asked him to order 2 books (a business book and a windows security book) with him since I couldnt find them in the bookstores in my region. He noticed that the shipping options at Barnes & Noble were very attractive compared to other major online stores. In addition we had a discount coupon. So he decided to try it out and little we did know that the experience we were about to get was extremely horrible.

During the order the discount coupon was accepted and clearly indicated that $xx was successfully deducted from our total purchase. Everything seems great and placed our order. A day later we received a notification that our order is being shipped. The next day, my friend received an unexpected email from B&N and that's where several problems started to appear.

He received a no-reply email that one books in the order has been canceled without any justification:

We apologize, but despite our efforts, we weren't able to fulfill some or all of the items in your order, as noted below. These items have been canceled from your order.

We apologize for any inconvenience this has caused and look forward to your next visit to Come back and visit anytime at http://www.bn.com.

I am not sure why they canceled the shipment of one of the books. I doubt it is availability issues, since all the books we ordered clearly indicated on their website that they are in stock. Anyhow, when my friend reviewed his paypal account, he found that the new B&N transaction charged far more than the total order details on B&N site. There was a clear inconsistency between what they charged for and what they display in thier total purchase details.
We decided to do some calculations and found that the price difference equals to all the discounts that he was entitled to including the members discount. Nevertheless, my friend contacted them to clarify with them why an item was canceled and why they charged more than the B&N account indicates. Four business days has passed and they have not responded. My friend will call them tomorrow morning to straighten things with them. At worst case, we will likely cancel all purchases with them.

In summary, B&N sucks because:
1. They cancel items in the order without justification or warning
2. They charge more than the total shipment price that they display to you on their website and via email without notification or consent
3. They show that your discount coupons are in use, but once they cancel one of the items without your consent, all your discounts will go as well without your notice.
4. They do not respond to 'customer care' emails.

Personally, I will stick to Amazon as I have been always been doing, despite their pricy international shipment options. I have purchased over a $1000 worth of books from Amazon, and I am completely satisfied with their excellent and transparent service.

Beware of Fake Alerts and Antiviruses When Google Searching the recent Chile Earthquake

Symantec issued a security response in a blog posting yesterday stating the following:

A massive earthquake struck near the Chilean city of Concepcion in the early hours of the morning of February 27th, 2010. The quake measuring 8.8 on the Richter scale was considerably stronger than the one that recently caused widespread destruction on the island of Haiti. Fortunately, despite the size of this latest quake, so far there has been few reported casualties. The quake occurred near the coast and tsumani warnings were issued for many countries bordering on the Pacific ocean. Unfortunately as with any major news event, miscreants are not slow to pounce when such opportunities arise to further their aims.

Search engine results returned for terms such as “Chile Earthquake” are being poisoned to lead users to rogue antivirus web sites.

.....

http://www.symantec.com/connect/blogs/massive-earthquake-chile-leads-surge-rogue-antivirus

For further investigation and curiosity, I changed the keywords a little and to my surprise the rogue antivirus webpages are appearing on the first google search page.

Any combination of keywords such as tsunami, santiago, chile, earthquake, pictures, etc. would display poisoned search results on google. Many of the results appear to be compromised legitimate websites. A small sample of such websites include the following (enter at your own risk):

The Dangers of Iframe

This is old news but something worth blogging about.

An estimated 5.8 million pages belonging to 640,000 websites were infected with code designed to launch malware attacks on visitors, according to a report released Tuesday.
...
An estimated 54.8 percent of the attacks observed by Dasient involved malicious javascript that was injected into compromised sites. iFrames that silently redirected users to malicious sites came in second at 37.1. Dasient has cataloged more than 72,000 unique malware infections involving websites.

Full article from the Register: Mass web infections spike to 6 million pages

Also:

The number of legitimate Websites being hacked to host malware has hit startling highs in recent days, new figures from MessageLabs have revealed.
Data taken from the days between May 4 and 8 showed that 84.6 percent of Websites blocked by the company for hosting malicious content were 'well-established' domains that have been around for a year or more.

Full article from PCWorld: Most Attacks Come from Legit but Hijacked Sites

Iframe attacks, being a largescale threat is relatively new. In the past, we used to tell people to surf the internet safely by not to searching or browsing suspicious websites, porn, cracks, free music/lyrics/movies, gambling, etc.. Then came along safe search add-ons such as mywot and siteadvisor which would greatly help people avoid questionable and unsafe sites. However, the threat webscape today has changed as the bad guys are moving into different tactics. With the appearance of iframe attacks, the borderline that distinguishes black and white sites might no longer be useful. The problem is that the sites that we completely trust can be vector of getting our computers infected. Browser security software such web access protection (used by antiviruses and firewalls) and reputation rating in these cases will no longer work here. It will protect user from being infected from black sites, but not from the white sites. Also, there is no way to tell if a legitimate site contains an iframe unless we look at its page source, since iframes may oftenly not change the sites appearance or functionality.

In my opinion the only way to be protected from a trusted site that happens to have a malicious iframe is disabling iframes altogether.
For details on how to disable iframes on Internet Explorer, please see:
http://antivirus.about.com/od/securitytips/ht/ieiframe.htm

How to tell if an unknown file is a legitimate or a malware file

This article is intended mainly for HJT helpers and trainees. Prior knowledge and expertise of the windows OS is required. None of the steps below are 100% accurate. You will need to use multiple steps in this guide order to be able to end up with a confident conclusion.

Step 1. there are 4 rules of thumb in which you can immediately know within seconds that the unknown file is a malware file:

1) The name of the file or folder is randomly generated or makes absolutely no sense. These type of files would typically display zero results in search engines.

Ex: c:\p0sdn8flqy.exe

2) The malware uses a name that is similar to the name of a legitimate file (commonly windows file) within the same folder.

Ex: legitimate = c:\windows\system32\lsass.exe

malware = C"\windows\system32\lsasss.exe

3) The malware uses the exact name of a legitimate file, commonly a windows file but in another folder.

Ex: legitimate = C:\windows\explorer.exe

malware = c:\windows\system32\explorer.exe

4) The malware uses a name that are commonly only used by malware. Ex. startup file names with controversial words somewhere within its name, the names of celebrities, the use of non-alphanumeric characters, or white spaces.

Ex: c:\windows\system32\crack.dll

Step 2.

Virmansec Event Success!

Elhamdulilah, the presentation I gave on conficker at the Microsoft Innovation Center, Riyadh was a success.

The presentation can be downloaded from here:
http://staff.kfupm.edu.sa/coe/shafei/downadup.zip

The powerpoint slides is mostly pictures and it may not be of much benefit to those who havent attended. However, a lot of the technical information has already been mentioned here this blog. The presentation style was inspired by the best presentation gurus such as:
- bio/intro and overall structure as by Garr Reynolds
- slides and graphics as by Dick Hardt and Seth Godin
- speaking freely as by Guy Kawasaki
- walking freely as by Steve Riley

Running the powerpoint will be a bit heavy on a windows OS. had to optimize my operating system in order for it to run smoothly on a projector with completely no lag. This is what I have done to have a lag-free presentation:
1. Disabled all real-time protection tools including firewall. (assuming you are not connected to the internet)
2. Disabled automatic updates
3. Disabled Task Scheduler via services mmc
4. Disabled screensaver, and all power saving options.
5. Disabled wireless connection and all related processes. (left bluetooth on for my bluetooth mouse/pointer)
6. Disabled all unneccessary processes. In my task manager I had a total of 28 processes left running on an XP machine. I preferred not to disable other OS processes because I had to run a demo on the same machine.

Conficker Presentation at Riyadh

God willing, I will be doing a presentation at the Microsoft Innovation Center on fighting the Conficker worm. This a highly technical presentation mainly targeted towards enterprise environments. The presentation includes live demos on infected machines. Microsoft Corporation (MSFT), Virmansec and R-Tech will be sponsoring the event.
The presentation covers all possible techniques in detecting and removing conficker for enterprises.

Attendance and registration is for free. Snacks and refreshments are also for free. If you are in Riyadh, please take the time to read and register for the event here:
http://www.eventbrite.com/event/472252520

Advanced knowledge about windows NT operating systems and active directory is a must.

Server 2008 RMS Installation Problem

I spent a few days trying to implement a simulation environment to test windows Rights Management Services and some third-party plugins on a server 2008 native. Every time I attempt to install RMS 2008 I was confronted with the following error message:

Error: Attempt to configure Active Directory Rights Management Server failed. An error was encountered while trying to provision AD RMS. Remove and re-install AD RMS to attempt provisioning again.

Despite uninstall/reinstalling the RMS service several times and verifying all the pre-requisites the error message still popped-up. I have followed every single line mentioned in the microsoft guide but yet the error re-appeared. There were absolutely no log files or events to explain the acause of the error. Also I couldnt find any solution on the internet that worked.
Almost giving up, my partner and I resorted to an unexpected solution..... changing the AD domain name.
RMS 2008 seemed to distaste single lettered domain names such as A.com and B.com that we initially tried to use. This was a bit strange since RMS 2003 worked fine using these same test domain names.

So after the changing the domain name to demo.com seemed to work with us in getting rid of the mysterious error message.

With courtesy of Samer Alotaiby.

3,200 Reported Account Hijacking on Facebook,Twitter

If you're on Facebook, Twitter or any other social networking site, you could be the next victim.
That's because more cyberthieves are targeting increasingly popular social networking sites that provide a gold mine of personal information, according to the FBI. Since 2006, nearly 3,200 account hijacking cases have been reported to the Internet Crime Complaint Center, a partnership between the FBI, the National White Collar Crime Center and the Bureau of Justice Assistance

Continue reading:
http://edition.cnn.com/2009/CRIME/10/19/social.networking.crimes/index.html?iref=mpstoryview

From the article:

How to protect yourself against social media scams:
- Change your passwords frequently
- Adjust Web site privacy settings
- Be selective when adding friends
- Limit access to your profile to contacts you trust
- Disable options such as photo sharing
- Be careful what you click on
- Familiarize yourself with the security and privacy settings
- Learn how to report a compromised account
- Use security software that updates automatically

(Information provided by FBI and Internet security experts)

New Variant of Total Security Locks up Applications on Infected PC's

A new variant of scareware has been detected that not only inundates
users with exhortations to purchase phony antivirus software called
"Total Security 2009," but that also locks users out of nearly all
applications until they purchase the disreputable product. Once their
PCs are infected with the malware, the only program users can open is
Internet Explorer, so they can navigate to the site and make a purchase.

More:
http://blogs.usatoday.com/technologylive/2009/10/new-twist-on-scareware-locks-up-your-pc.html
http://www.pcworld.com/article/173765/a_rogue_demands_a_ransom.html