Having just returned from Blackhat I have a wealth of topics that time permitting I may articulate under the arrogant notion that random people on the internet have some interest in my thoughts. Pertinent to this post is the ever popular habbit of PCI bashing at security conventions. Having thought of this, I think in some ways PCI is incredibly effective – wait, don’t go, just hear me out. Yeah, the PCI assessment process has a lot of shadiness, with various security service providers assessing areas where they have a vested interest in selling products. And yes, it’s fairly questionable that card data would actually be secure even if all of the controls were followed (your are in compliance until you have a breach, and then you are not), or that the card data wouldn’t be secure even if the controls weren’t followed (many ways to do things after all). And yes, there is a question as to whether said control list is updated often enough, or in the same breadth, too often. While we are on the topic there is criticism that the assessment process is pass/fail, rather than a graded rating that is publicized, and on and on. Mostly people think PCI is a giant pain in the ass.

That, by the way, is where I directly see the utility. PCI compliance really is a huge pain in the ass for a company – nobody actually wants to bother. And because of that companies large and small are getting out of the business of needing to be PCI compliant. They are offloading to a 3rd party processor to handle all of the card transaction stuff – essentially the paypal merchant model at scales much larger than mom and pop websites. While at some distant point in the future there is a worry about sufficient payment processors to offer competitive pricing (just like right now the huge market penetration of the actual credit card companies allows for some fairly predatory pricing), for the time being it is a great trend to see a consolidation of payment processing to fewer vendors. Rather than 1 million online vendors getting every security protection right I have a lot more confidence that a couple dozen vendors whose focus is on delivering that sort of service securely.

Put another way, for as evil as the big three credit agencies are (and one of them is responsible for some incredibly sketchy mortgage and student loan advertising scams), would you rather have those three agencies, or would you rather have thousands of companies creating independent credit databases of all your info for their individual use? While I question the big three I would much rather it was just them than every furniture store, car dealership, mortgage broker, bank, appliance company, etc. trying to secure their own versions of the databases. In the same way I think it much preferable to have only a couple companies securing card data – because it is really inconvinient to have to call my bank to cancel charges and wait the 7-10 days for a new card because some random website had their card database hijacked (and my bank probably finds eating those charges pretty inconvinient as well).

- Joshbw

Mozilla has expanded their Plugin Check page to cover more than just firefox, now including Chrome, Safari, Opera, and to a limited extent, IE. This is an awesome good citizenship concension, so bravo Mozilla. I think it is a great step to building awareness about keeping plugins up to date, especially as they are getting to be a much more common attack vector than the browser itself.

That said, the other large hurdle is the actual process of updating that many vendors have. To be polite, Adobe’s updating software has quite a bit of room to improve. I went to install a photoshop update earlier today and it required me to shut down all office apps, all web browsers, and all open explorer windows. Acrobat is only slightly less anal. And yet, I can run Microsoft Update in the background and install updates specifically for those applications without having to shut them down (the system does ask to reboot, but I can just wait until the end of the day to do that). When an updater requires that a person basically stop using their computer until it is done people are not going to update. I don’t want to have to stop everything I am working on, pause my work and my train of thought, because Adobe has issued an update, and I suspect most users are the same. Until that changes, people are going to put off updating and Mozilla is going to have a hard time getting above that 60% up to date mark that they have currently reached.

As an aside, FileZilla, when I am prompted for an update literally every time I run your application your patch release process is broken.

~ Joshbw

Microsoft has made a little game of threat modeling, with details here. The idea is that by printing particular scenarios on cards and creating a competition to figure out how each scenario can be applied to an application model a development team will be reasonably effective at finding threats (I would add that if you put in some prize people will be extra competitive). Having looked through the deck they do a good job of enumerating common scenarios for each stride element – it isn’t exhaustive, but it covers a good deal of ground and should provide good guidance to product staff that are not accustomed to thinking about attack scenarios. It’s a clever way to approach threat modeling with folks that are probably not well versed in it.

That said, a couple comments -
• The “Instructions 2″ Elevation of Privilege Variants offer some suggestions I think should be in the core rules, specifically that each player can “riff” off of a card played by another by suggesting additional ways a threat could be applied and get an additional point for each new valid scenario. As soon as I watched the video in the link above explaining the game the first flaw in the game I thought of was that only one person is really considering how a given threat might be applicable. Anything they miss won’t be necessarily documented. By allowing other players to get points by also considering a threat and contributing possible attack scenarios it increases the potential analytical coverage of the application.

• Like the more mundane threat modeling process the diagram of the application is incredibly important. A diagram that doesn’t model all of the data flows is going to cause people to miss threats. A diagram that is too high level, or abstracts crucial details (for example a series of components collapsed into one entity, and as a result hides a trust boundry), is going to be a handicap. A diagram too detailed, that shows unnecessary elements, is also going to be a handicap because it presents more information than humans are good at tackling at any given point. The application diagram is the most critical part of the threat modeling process and whether you use the game or the recent threat modeling tool (which is so much better than the first gen tool I used at MS that pulled in DREAD, risk trees, etc) or have a hack session on a whiteboard, if you don’t draw a good application diagram you are going to miss threats. What I would love to see MS do is release training videos specifically trying to provide guidance on the creation of data flow diagrams.

• and yet again I am disappointed by Microsoft not trying to leverage their multiple platforms in some semblence of synergy. Just when WinMo 7 looked to finally tie the xbox, zune, and phone together, when it looked like MS finally got it, they go and do a stunt like this. Paper cards when you have the best online multiplayer system in the world Microsoft? Really? This should really be a free download on xbox live arcade, with achievements and avatar prizes. Adam, if you are reading this, drop me an email. I can put you in contact with some folks in xbox – my old manager works there now, as does his old manager. You can get this done.

Anyway, for those of you looking to get threat modeling in your organization (and you should – it is the best methodology I have found for doing design level security analysis) this is a good starting point. Apple, now that you have hired Window Snyder and may finally be taking security seriously, you might want to check this game out, even if Microsoft made it. It is released under a creative commons license, so you could even make it into an iPad game if that is what it takes to get you to finally threat model Quicktime.

~ Joshbw

Couple random thoughts, observations, stuff:

Last night my wife wanted to pay her Sprint bill – she didn’t want to get up and go down stairs to grab her purse and credit card so she asked me for mine and I just tossed her my wallet without thinking. Rather than grabbing my dedicated credit card out she grabbed my debit card, which wouldn’t have been my preference (easier to dispute credit credit card charges if necessary). I was prepared to start answering the various interrogation questions necessary for a card purchase, since the CVV code is intentionally missing from all of my cards (no need to make it extra easy for a would be pickpocket), and was sort of suprised that she didn’t need any information other than the card number. It turns out Sprint uses the STAR network with debit card transactions and all it needs is the credit card number – how is that a good thing? Credit cards are already great theft targets since you only need a couple pieces of information to charge them – I don’t think reducing the amount of information is wise. In Sprint’s defense, only a moron would place a charge with a stolen card on their own account, but in terms of industry trends I can say that offering debit transactions with just a card number is one that I feel should continue.

Unrelated to that, the vast majority of blog spam that gets trapped by the filters at the moment is related to amoxicillin ads – what the hell? Can someone explain the psychology behind that to me? First, amoxicillin is an antibiotic – typically something you are using because you went to the doctor, found out you have an infection, and want medicine sooner rather than later; it is also something you only take for a short period (what, 5 days or something like that) and don’t renew – how is that a good candidate for mail order? On top of that its about the cheapest antibiotic known to man – it isn’t like Walgreens is charging $50 for it after insurance. Last time I needed to pay for amoxicillin it couldn’t have been more than $5. Are people really looking to knock that price down even further? What makes it good chum for spam fodder?

Well, those are my deep thoughts for the day, cheers,
~ Joshbw

There is an interesting writeup on the Reddit blog about the particular vulnerability that lead to their exploitation. In general it is a reasonably informative writeup that delves into their mistake and I wish all security flaws recieved such an informative writeup (You occassionally see Michael Howard delve into details on a Microsoft vulnerability, but it is hardly the norm).

That said, there is a bit of silliness in one of their quotes:

As a matter of fact, these bugs were only exploitable because we are open source. The worm author had to scour the source of our output filter to find these holes. We cannot hide behind security though obscurity, and we like it that way. We also rely on our users reporting security bugs in a responsible manner.

There are a lot of reasons to choose the OSS model and extol its virtues, but it is craziness to PREFER that malicious users have access to the source code and thus have an easier time finding flaws; its a trade off of the OSS model for sure, and you can’t have the good without the bad, but I think largely it isn’t unfair to say that folks would be happier if only well intentioned individuals had access to the source code (save for Stallman, but he also believes a person should be more proud of contributing to the Linux kernel than raising kids so I think we can religate him to fringe nutjob). One could argue that it puts added pressure to fix even seemingly small issues because of public scrutiny or other such philosophies but at the end of the day that statement ultimately amounts to Reddit prefering the greater risk. That is not to say that the benefits don’t outweigh the risks for a particular company and a particular business model but from a standpoint of avoiding the exploitation of vulnerabilities security controls + obscurity is better than just security controls. The less an attacker can know about you the better you are; you can’t *rely* on them being ignorant of you but at the same time it is always better to try and keep them in the dark.

Obscurity alone does not ensure security, hence the various statements about security through obscurity being a fallacy, but it does have security utility (and indeed necessity at times – your encryption is only secure so long as your key is obscure). Obscurity raises cost for an attacker, all other factors being equal, since it increases effort to remove the obscurity. If two sites seem to have strong input and output controls and I want to break into either of them, I will choose the one with open source code because it will take me far less time examining code for flaws than trying esoteric attacks in the hope one sticks (and similarly increase the chances of tripping any IDS or IPS solution deployed). Thus being closed source in that regard has benefits. Indeed, if Reddit had been closed source the likelihood of this vulnerability being exploited would be far lower; the code would still be vulnerable but the cost to find that vulnerability is such that the attacker would probably spend their time elsewhere.

In the end obscurity doesn’t ensure security but it does reduce risk. Risk is the product of likelihood and impact, and obscurity does decrease the likelihood – it doesn’t reduce it to 0, but it does decrease it. That’s why most Pen Testers will write up any unneccessary disclosure of information, even if it is just server tokens, because it is BETTER to be obscure than not from a risk stand point.

And just to be a bit snarky, if Reddit really didn’t believe in Security through Obscurity they would favor Full Disclosure over Responsible Disclosure. The latter hopes to obscure the details of a vulnerability until it can be fixed while the former has no obscurity to speak of. Of course it also means the chances of a maelevolent party exploiting the vulnerability increases but that was pretty much the point of my post anyway.

~ Joshbw