Denim Group, Ltd.

Social Networking Security Slide Deck Online

By Dan Cornell

John Dickson gave a presentation on the security implications of social networking to a group of CSOs last week.  The slide deck is now online at SlideShare:

Social Networks and Security: What Your Teenager Likely Won't Tell You

View more documents from Denim Group.

John's main point is that CSOs need to approach social networking as a business issue rather than a security issue if they want to maximize their ability to influence policy and implementation.

--Dan
dan _at_ denimgroup.com
@danielcornell

Automatic Vulnerability Injection and Al Qaeda

By Dan Cornell

A couple days ago I was catching up on a couple of the security blogs I follow and two of the posts I read gave me an idea.

The first post I read was from Jeff Bardin at the CSO Online blog.  It offers some analysis of the Mujahedeen Secrets 2 software that was recently released by al Qaeda to help facilitate secure communications between Islamic fundamentalist/terrorist types.  This is basically a toolkit for doing encryption and steganography with Arabic help files and the target audience is terrorist cells who have a desire for secure communications.  Jeff Bardin, an ex-NSA analyst, has some interesting observations on the increasing technical sophistication of Al Qaeda.

The second post I read was from the Veracode blog.  It was a post from November that looked at techniques for automatically injecting vulnerabilities into an application.  In the base case this could be done by replacing safer calls to strncpy() with unsafe calls like strcpy() and would basically be the opposite of what products like Fortify Defender try to do.

That got me to thinking - if I were at CIA or NSA (and I wanted to take time off from running Facebook, LinkedIn and all those other SoCIAl networking sites) it would be handy for me to have some technology that would take an application binary such as the Mujahedeen Secrets toolkit and inject a bunch of vulnerabilities.  Then I could post that updated binary to my favorite Islamist/terrorist message board and wait for folks to start using it.

Obviously the vulnerabilities to be injected would have to be thought out and crafted so that they would actually be useful in disrupting and intercepting communications and accomplishing other intelligence goals.  But the cool thing about this would be that the base-level technology would probably work much the same as the source code or binary analysis being done now to find security defects.  Instead of finding dataflows that take tainted source data and send it to a sink without running it through a cleaning function, the software could identify those cleaning functions and replace them with NOOPs.  Now my question is: would it be easier to create a tool that would automatically patch up security defects?  Or to create a tool that would automatically inject security defects?  I'll leave that as an exercise for the reader...

--Dan
dan _at_ denimgroup.com

(Photo is another I took in Costa Rica while on a zipline tour through the jungle)

Social Networking Sites as an Attack Vector

By Dan Cornell

I saw this article over on AccountingWeb about how social networking sites are increasingly becoming vectors for identity theft and other attacks.  Echoing something we have discussed on this blog before, they noted that having a lot of information about yourself online has drawbacks - specifically allowing identity thieves (and CIA) to collect it in support of their identity theft attempts.  Also, social networking sites can host links to malware.

In the article they mention one attack where clicking on a MySpace friend request results in a pop up windows that is supposed to look like a Windows Update window.  I was particularly amused by McAfee's somewhat silly suggestion "One way to guard against such attacks is to minimize your browser. If the dialogue box disappears, it is probably an impostor."  Now that is some useful, general purpose online security advice!  If we can't teach people to look for lock icons when the browser is talking over HTTPS, I don't think we'll be able to train them to make decisions based on which windows minimize at various times.

If you recall, more attacks on and via social networking sites was one of my Top 5 predictions for 2008.  Barely a week after that post we're already seeing some confirmation.  Making predictions is easy!

--Dan
dan _at_ denimgroup.com