Aconiac Security Group Blog
The official Aconiac company blog
Welcome to the Aconiac Security Group Blog
This blog includes company news, company statements, tutorials, guides and much more. So please add this blog to your RSS reader and let us help you to become better security professionals.
Disclaimer: The views of individual bloggers may not be the views of Aconiac as a whole.
2
I recently came across this article which talks about an ongoing trial concerning a “hack” in 2008.
Now this “hack” is made especially interesting by the fact that the victim was the, at the time, 2008 Republican vice presidential candidate Sarah Palin. Now you may have noticed I write “hack” instead of hack or security break-in, and the reason for this is actually quite simple: It really wasn’t a hacker attack!
What this kid (David C. Kernell) did, was that he simply used the “Forgot your password?” feature on Yahoo Mail to guess his way in to change Sarah Palins password and gain access to her mails. In the end, he actually gained access by using publicly available information and subsequently reacted by bragging on a discussion board while posting pictures of Sarah Palins e-mails. That’s not hacking! What he did was, at best, correctly estimating Sarah Palin’s knowledge of proper password policy.
Now what would an appropriate reaction be to such an incident? He’s clearly a reckless idiot, so some action should probably be made. Yet, at the same time, he showed Sarah Palin knows very little about basic security, thereby making a quite powerful (and perhaps needed) political point. If she can’t even secure her e-mail against amateurs, how is she going to secure the nation against ruthless psychopaths?
But basically, no matter what the appropriate reaction was, the prosecutors and Sarah Palin went with, for all intents and purposes, ending this person’s life! They went to court and tried to get him convicted for crimes with a combined punishment of up to 21 years and 250000$ in fines. All for guessing a password!
Until now he’s been convicted of felony destruction of records to hamper a federal investigation and of a misdemeanor charge that he unlawfully accessed a protected computer. He was however acquitted of a federal wire fraud charge. What level of punishment he’ll end up getting is hard to guess at, at the moment. But almost no matter what kind of punishment he gets, there’s a high likelihood it’ll be grave overkill.
Let’s face it: This 22 year old man is a moron – he did something enormously stupid. Not so much because he showed a grave lack of security understanding from the possible future vice president, but because he didn’t inform her, or her people, and didn’t give them sufficient time to correct the issue before sending it to the proper media channels. All in all he should have been a lot smarter! But that being said: What harm did this person really do?
Now, I’m all for punishing criminals and putting dangerous people behind bars. However a person like this isn’t really dangerous, he’s just not well-mannered. Had there been a proper, legal and well-documented process for reporting security issues in systems or procedures, then he would most likely have used these to get what he wanted: To show Sarah Palin knew little about security! Bare in mind, almost all IT-security professionals have learned primarily by doing – as in, they’ve tested their methods in more or less moral ways. Personally, I’ve always tried to keep to the moral part, however many others have been somewhat morally challenged – yet are now enormously talented and hard working. In fact, some of the best security professionals I’ve met are former “criminal” hackers to some degree.
So what’s my point with all this? Well basically: A young man/woman who “hacks” into a system and flaunts about it, is a person who lacks a place to be. We have full-fledged university degrees for biochemists, computer scientists, lawyers, politicians, engineers etc., yet we don’t have one for a hacker? We even educate police and military in the tactics of their enemies and how the enemy operates – even to the degree that certain soldiers have to act like the enemy in training in order to simulate combat. Yet we still don’t have any equivalent program to educate military hackers or security experts, even though we know for a fact that hacking has been used to attack a country’s infrastructure.
My five cents here is that David C. Kernell shouldn’t be prosecuted to the fullest extent of the law. He should get a slap on the wrist for handling it stupidly and for publishing/reading the content of Sarah Palin’s e-mails, and should then be thanked for showing the problem and put into a training program for IT and Security somewhere in the US. Even though this “hack” was enormously simple, he might still have some talent that could be used for so much good, instead of just throwing a 22 year old kid in jail and wasting his life.
We’re in a very problematic place in our society if showing the government aren’t doing some task well enough, results in oneself being imprisoned for the majority of one’s adult life.
Such a society is quite surely insecure!
As we have stated several times before (New OWASP guide: Secure Application Development on Facebook and Ruby on Rails Security Guide) OWASP, The Open Web Application Security Project, is a great organization tasked with providing comprehensive security knowledge for companies, individuals, organizations and developers.
This week they came out with a new finished OWASP Project: The Top 10 Security Threats of 2010.
The project website is located here and the full 22 page report can be found here: OWASP Top 10 for 2010 (pdf)
Basically what this is, is a break down of the most severe security issues in web applications for the year 2010. What’s especially scary about it is however, that these 10 security issues have stayed largely unchanged since the Top 10 of 2007. In fact only two issues have been replaced on the list, making the OWASP top 10 security threats of 2010 (the new ones are bold):
- Injection
- Cross-Site Scripting (XSS)
- Broken Authentication and Session Management
- Insecure Direct Object References
- Cross-Site Request Forgery (CSRF)
- Security Misconfiguration
- Insecure Cryptographic Storage
- Failure to Restrict URL Access
- Insufficient Transport Layer Protection
- Unvalidated Redirects and Forwards
What this shows us is that despite the efforts of OWASP, Aconiac and similar organizations, the security field has stayed largely unchanged and developers are still making the same mistakes in their designs and code. It might very well not be entirely possible to change this fact in general, even given 10 years from now.
But while companies in general may be making these mistakes, you don’t have to! The OWASP report includes several pages describing the security issues in detail, including an analysis of the risk it imposes on your business and what impact a breach might result in. We encourage you to download and read the entire 22 page PDF and make it mandatory reading for every developer and designer in your organization.
NOTE: This news item was originally posted on December 30, 2008
2008 will soon be over and a new and exciting year lies in front of us. 2008 was an interesting year for computer security. We saw, once again, escalating threats towards companies from almost all fronts. Especially the leaks of unencrypted data in England, the automated SQL injection mass-attacks and the attacks on social network services were some of the big public problems in 2008.
But then how will 2009 be? Now, it’s obviously very hard to predict the future in such a dynamic world, however we have made an effort to come up with our ideas for what might be, the 10 biggest security threats in 2009:
- Weak economy
The economic crisis, which right now is devastating many businesses all over the world, will most likely result in companies having to cut down on expenses. In these kinds of expense cuts, typically what gets cut first is the administrative expenses like e.g. computer security and preventive measures. We can therefore expect to see an increase in the amount of security issues in software and systems developed in 2009.
- Lack of education
One of the greatest threats towards security in a company is and will always be education. This has been, in our minds, the biggest issue in 2008 and actually have always been the biggest issue. Users of IT solutions do not understand the security problems in such a way, that they can effectively protect themselves. We will therefore, once again this year, probably see an increase in successful hacker attacks – attacks that largely could be prevented by increased education.
- Mobile devices
Employees are becoming more and more mobile as each day passes. One of the big things that really got a boost in 2008 was mobile broadband. This technology specifically, can lead to employees beginning to do their jobs outside of the company’s secure parameters. A trend that could ultimately lead to catastrophic data leakage, that is if it is not prevented by good policies and encryption.
- Outsourcing
Due to the economic crisis, a lot of companies will probably begin to outsource certain tasks to cheaper labor in other countries. This act however has a lot of serious security implications, since the company now no longer has control of how its data is handled. It is therefore extremely important, that companies make a proper security policy with their outsourcing partner and that this policy is actually followed.
- Espionage
The time when hackers were just small kids in a basement is, by far, over. Today several indications are showing that hacking has, in several cases, been used by e.g. China to attack government institutions in the USA. This type of attack, which for the record can have catastrophic consequences, will likely escalate in 2009, where we will see even more examples of this form of Internet warfare.
- Anonymity/Privacy
While nations all over the world are using more and more censorship and surveillance, many freedom-loving employees will begin to work harder to secure their privacy and the right to free speech. This will probably manifest itself in an increased use of software to break blocking mechanisms and hide information about the user. With this increased usage, it will become much harder for companies to identify malicious users, since it will now not only be the criminals who are attempting to hide from identification.
- Apple’s Mac OS X
While viruses and spyware are everyday fears of Windows users, Apple’s Mac OS X has up until now avoided most problems. They’ve actually avoided it so well, that many Mac users are now, mistakenly, believing Mac OS X can not be infected with malicious software, like e.g. a virus. Apple had a record high sale of Macs in 2008 and as their market share increases, so will the number of attacks on the platform increase. Sooner or later it will therefore become a security risk to have an unprotected Mac OS X on the company network and companies should therefore implement effective security policies for Mac users.
- Insecure websites
A lot of companies and government institutions still have websites with several security issues of varying types. With the increasing economic crisis and the likewise increasing amount of computer criminals, it is very likely many more companies will be attacked from the web this year. Even many more than earlier years.
- SMS Scams (SMiShing)
With the expanded use of SMSs for almost any thinkable communication, criminals will soon begin to notice the possibilities in the use of SMS to scam individuals and companies. Most do not know, that it is extremely easy to fake an SMS so that it seems as if the SMS is from “Mom” or “The Boss”. This makes it easy for criminals to scam people into wiring funds or giving out passwords.
- Social networks
Social networks are not as big of a threat as some security companies would have you believe, however there are several dangers you should take seriously as a company owner. Like e.g. in 2008 there were several attempts at spreading viruses through Facebook and especially MSN Messenger is often a target for computer criminals. All of these attacks can however generally be avoided with simple education of one’s employees. We don’t recommended blocking the access to social networks for your employees, even though we know certain companies do this today.
Back to top
