Posts in Infosec Education
Page Content
Securing wireless networks is far too difficult
This story at the NYT web site (registration might be required -- it seems kind of random to me) about the prevalence of "piggybacking" on open wireless networks. Most of the article deals with the theft of bandwidth, although there are a couple quotes from David Cole of Symantec about other dangers of people getting into your LAN and accessing the Internet through it. Something that really struck me, though, was the following section about a woman who approached a man with a laptop camped outside her condo building:
When Ms. Ramirez asked the man what he was doing, he said he was stealing a wireless Internet connection because he did not have one at home. She was amused but later had an unsettling thought: "Oh my God. He could be stealing my signal." Yet some six months later, Ms. Ramirez still has not secured her network.There are two problems highlighted here, I think:
- We haven't done enough to make it clear why encrypting your wireless network is important.
- More importantly, wireless routers need to be secure out of the box. Users will not change their behavior unless the barrier for wireless network security is lowered as far as possible, and that includes shipping routers with:
- WPA encryption enabled
- a unique shared key
- a unique router admin password (the fact that millions of routers ship with the same default admin password is embarassing)
- a unique SSID
- SSID broadcast disabled
Password Security: What Users Know and What They Actually Do
As a web developer, Usability News from the Software Usability Research Lab at Wichita State is one of my favorite sites. Design for web apps can seem pretty arbitrary, but UN presents hard numbers to identify best practices, which comes in handy when you're trying to explain to your boss why the search box shouldn't be stuck at the bottom of the page (not that this has ever happened at CERIAS, mind you).
The Feb 2006 issue has lots of good bits, but particularly interesting from an infosec perspective are the results of a study on the gulf between what online users know about good password practice, and what they practice.
"It would seem to be a logical assumption that the practices and behaviors users engage in would be related to what they think they should do in order to create secure passwords. This does not seem to be the case as participants in the current study were able to identify many of the recommended practices, despite the fact that they did not use the practices themselves."Some interesting points from the study:
- More than half of users do not vary the complexity of passwords depending on the nature of the data it protects
- More than half of users never change passwords if the system does not force them to do so. Nearly 3/4 of the users stated that they should change their passwords every 3 to 6 months, though
- Half of users believe they should use "special" characters in their passwords (like "&" and "$"), but only 5% do so
Mambo worm highlights security problems in web app dev
Christopher Kunz reports on the existence of another web app worm, this time exploiting in the widely used Mambo portal/CMS system. Like the Santy worm that attacked phpBB, Elxbot identifies vulnerable installs via Google, but goes way beyond simple site defacement.
Jeff Moore discusses this as a good example of why web apps need better installation/update systems. He's absolutely right. Wordpress, one of the most popular open-source web apps, has a fairly decent installer, but is a nightmare to upgrade. The developers don't even release "upgrades" per se, but give users some minimal instructions on what files to overwrite and what to skip. Even though the XML-RPC vulnerability that hit Wordpress and many other PHP-based apps a few months ago was patched immediately, it seems likely that there are large numbers of Wordpress users that are unaware of the problem and have not installed (it's difficult to find sources for stats on this, though).
Beyond that, this underlines the need for both educating developers on secure coding practices, and developing freely available tools to help developers audit their applications. This is particularly important for the open-source web applications that drive a large portion (a majority?) of dynamic web sites. An Information Week article from a couple weeks ago that discusses how malicious coders are now targeting applications (including web apps) quotes Howard Schmidt:
In an e-mail, Howard Schmidt, a noted cyber-security expert and former CSO for both Microsoft and eBay, said the SANS report highlights the utility of hardening the presentation and application layers as a means to reduce cyber security events. "The first stop on the way to fix this is through secure coding and better QA of development processes, penetration testing on compiled code as well as vulnerability testing of integrated deployed applications via Web front ends," he wrote.Hopefully more people will start to realize this before the problem gets worse.


