Increase Security Through Open Source (essay)

The disputes about Open and Closed Sources Software existed for a long time and I believe that they will exist also for a long-long time. Open Source Software has a lot of fans, whereas the amount of other side's fan is not less or even bigger.  
As mentioned in the article "Increase Security Through Open Source" the access to the source code can benefit not only the users, but hackers also. I sincerely believe that it is much better to have the same opportunity as the hackers have, than rely only on patches produced by closed source software developers. 
Also I think that people really improve the software through access to the source code. Everyone wants to use the software with comfortable and reliable GUI, that's why people try to improve and bring something good into Open Source Software.

Increase Security Through Open Source

Similarities and differences between close and open sources in a security perspective
	Open Source	Close Source
Independent Assessment	User can assess the system freely. The defender by using open source can assess, inspect, modify, and redistribute the system that will be used to defend. In my opinion, that is one of the main points of the article.	User is not allow to assess the system prior to using in order to find out system's vulnerabilities and risks.
Patches Availability	Because of the fact that open source is access by thousands of users, including qualify developers, patches for vulnerabilities would be produce quiet fast. Open source enables users to find bugs, and to patch any bugs themselves, making open source more secure than close source instantly.	When a vulnerability is found, independent sources usually take a considerable amount of time before producing a patch to fix it. Allowing attacks to happen
Access to source	Both hackers and user have access to the source. Hackers benefit from this since they can access tons of information, making it easy to find system's vulnerabilities. It gives an unfair advantage to attackers from security defenders.	Access to code is not allow, thus minimizing information that may aid a hacker to launch an attack to the system. This is not always the case since hackers could indeed with time find system's vulnerabilities with the use of debuggers and disassembles.
Secure involvement of developers	Open sources allow a widely range of developers to work on the source. This is a good thing since thousands of users could rapidly pinpoint a vulnerability. However, this could easily lead to a system backdoor, a source by hackers posing a trustworthy contribution. In contrast with close source, this approach is more secure.	Only private developers are involved in close source systems. This has advantages and disadvantages. The advantage is that the source will not be widespread, making attacker's jobs more difficult. The disadvantage is that when developers realize vulnerabilities, the process of producing a patch is slow.
Quality Control	Since this source is viewed by everyone, high standards are enforce to developers. It is human nature to do things well when expose to everyone.	Poor project management and quality control
Comunication between users	Since this is an open source system, basically, you are your own customer and are responsible on maintaining the system. For this reason, there is a large amount of help between users as forums for instance.	Customer service and communication between users is limited in close source systems

Slax Linux

Slax Linux is one of the most popular Linux distribution. Surfing the Internet we can find thousands of answers why people use the Slax. Some of them use it because their PC has insufficient memory and other resources; and because of that they cannot start Windows OS. Meanwhile, another people like the size of Slax and its ability to be installed on USB Flash Stick.


Among the many benefits of using this distribution I chose Slax because of its flexibility. Before downloading the distribution we can pick up the necessary modules. For example we can create our own Slax by choosing from different security, graphics, office, multimedia and even the games modules. Slax gives us the opportunity to assemble the distribution for Information Security by using more than 70 different security utilities and programs. So. we can pick up and include into the Slax such programs as WireShark, Netcat and other sniffers, crackers and helpers. 


Another benefit of using Slax is its frequent updates, for example, last version of the Slax was created in August, 2009,  which is very good indicator, especially if we compare it to other Linux distribution. 


To sum up, I chose the Slax Linux because its small size, flexibility in modules and huge assortment of programs.

Probe Targets Archives’ Handling of Data on 70 Million Vets

Everyone knows that sensitive data needs more attention and car, but sometimes people forget about this. So happened in October, 2009 when RAID massive with about 70 millions records of sensitive information was given to vendor to be fixed. The owner of data told that  this is not a problem because  the contractors signed privacy promises in their contracts.
 I believe that even the privacy promises were signed, the data had to be encrypted according to accepted standards. As another variant, the data could be degaussed using degausser Mag EraSURE™ .
Anyway this case shows that special care should be taken when you work with important and sensitive information.

Link to the original article: http://www.wired.com/threatlevel/2009/10/probe-targets-archives-handling-of-data-on-70-million-vets/
About Mag EraSURE™ : http://www.fujitsu.com/downloads/COMP/fcpa/degaussers/magerasure-drivesavers_wp.pdf

Live CD Distributions Survey

  There are many different types of Linux Live CDs intended for different purpose. In this article I will compare BlackTrack, Nubuntu, Ubuntu and Slax Live CD  and try to explain their purpose.

The first and probably one of the most important attribute of each Live CD is distribution’s size. The leader between mentioned above Live CDs is Slax whose size is only 200 Mb. It means that Slax Live CD can be deployed on computer with insufficient resources.  The BlackTrack, in turn, rests on 1.2 Gb, whereas Nubuntu and Ubuntu use only 650 Mb.

  It is not a secret that all users pick the Live CDs up in accordance with their personal requirements. Some of them need a stable system which does not take a lot of computer’s resources and  loading in a second, when others want the distribution with good Graphic User Interface (GUI) and full software package. The four considering CDs can be divided into two groups:  the BlackTrack and Nubuntu focused on the information security, while Ubuntu and Slax intended as desktop system with whole bunch of software for day to day using (text editors, graphic editors, etc).  Accordingly,   an audience using these distributions is diverse. BlackTrack and Nubuntu are most used by professionals who interested in information security, penetration testing, computer forensic and IT audit. Ubuntu and Slax CDs are popular among users which need an operating system without any additional or unnecessary software.

Another important feature of any distribution is update frequency. Slax Live CD is updated quite often, due to the changes in software, fixing the bugs and upgrading the Slax’ modules.  The release of Nubuntu is, probably, the oldest one. The last version was created in 2008. The Ubuntu and BlackTrack  have versions created in 2009.

  Speaking about available support, the champion between mentioned above distributions is Ubuntu. There are thousands forums, articles, books and training dedicated to different user groups.  The second place is taken by Slax Live CD with available forums and documentation. The  BlackTrack and Nubuntu are not famous because of their support. For instance, you can’t find good documentation for Nubuntu distribution even on the Live CD’s web site, all that you can get is other users support.

Name of distribution	GUI	Available software	User’s Support	Update frequency	Size of distribution
BlackTrack	Comfortable	Good for InfoSec	Poor	Good	1.3 Gb
Nubuntu	Poor	Not bad, but a lot of old version software	Bad	Bad	650 Mb
Ubuntu	Comfortable	Excellent, but lacking of special software	Excellent	Good	650 Mb
Slax	Comfortable	Excelent, but lacking of special software	Good	Good	200 Mb

  To sum up, the best, in my opinion, distribution for information security is BlackTrack, whereas Ubuntu is a good one for installing and using as a desktop. The Slax is perfect as mobile OS due to its size.

New Attacks on WPA - Move Calmly Toward the Exits

On September the information about attack against the WPA was shown in the Internet.  Deeping into the history we can recall that TKIP (Temporary Key Integrity Protocol) also known as WPA (WiFi Protected Access) was intended to replace WEP.  At this time the WEP was cracked and new wireless security mechanism was needed.   By truth, the WPA has never been intended as a long-term security solution, but only as an interim. Although CCMP is a better security solution for Wi-Fi, it requires additional on-board electronics to allow intensive processing to occur without degradation of the data transfer rates, that’s why WPA and even WEP are still used nowadays. Anyway, the most interest part of the attack on WPA is that intruder can use known vulnerabilities.  According to the published information, attacks are not intended to recover the encryption keys or to reveal the private data contained within TKIP protected frames, they focus on known weaknesses in the Michael integrity check algorithm, which could enable an attacker to insert customized test packets into a LAN from the wireless side in order to probe for traditional wired-side vulnerabilities.  The mentioned above attack has clearly shown the importance of “big step” from WEP and WPA to CCMP.  Hopefully, all technical matters will be resolved soon and using the CCMP instead of TKIP or WEP will become common practice.

Original article:
http://www.cwnp.com/community/articles/new_attacks_on_wpa_-_move_calmly_toward_the_exits.html

Recommended Security Controls for Federal Information Systems and Organizations (NIST 800-53 Revision 3)

The purpose of this publication is to give guidelines for selecting and specifying controls for IS and to help achieve more secure information systems and effective management within federal government. Security controls described in this publication are organized into seventeen families.  Each family contains security controls related to the security functionality of the family. A two-character identifier is assigned to uniquely identify each security control family.

TABLE 1: SECURITY CONTROL CLASSES, FAMILIES, AND IDENTIFIERS

IDENTIFIER	FAMILY	CLASS
AC	Access Control	Technical
AT	Awareness and Training	Operational
AU	Audit and Accountability	Technical
CA	Security Assessment and Authorization	Management
CM	Configuration Management	Operational
CP	Contingency Planning	Operational
IA	Identification and Authentication	Technical
IR	Incident Response	Operational
MA	Maintenance	Operational
MP	Media Protection	Operational
PE	Physical and Environmental Protection	Operational
PL	Planning	Management
PS	Personnel Security	Operational
RA	Risk Assessment	Management
SA	System and Services Acquisition	Management
SC	System and Communications Protection	Technical
SI	System and Information Integrity	Operational
PM	Program Management	Management

 To identify each security control, a numeric identifier is appended to the family identifier to indicate the number of the control within the family.

This publication also provides the description of the selecting and specifying security controls for an IS.  The selection and specification of these controls for an information system is accomplished as part of an organization-wide information security program for the management of risk.

 Also, in NIST 800-53 we can find the specific activities in the Risk Management Framework:

 

Moreover, there is described security selection process in this publication, which can be shown as:

Denial of Service attacks

According to the article “Security Problems with the Internet Architecture” , there are many types of different Internet attacks and Denial of Service (DoS) and Distributed DoS (DDoS) are probably the most popular of them. While surfing the Internet we can find many sources with detailed description of these attacks.

Why are they so popular? DoS attacks do not need any technical skills for hackers. Take as an example the article “Online Attack Silences Twitter for Much of Day” (http://www.nytimes.com/ 2009/08/07/ technology/ internet/07twitter.html). Attackers overwhelmed a Web site by sending it a huge amount of junk requests. According to the analysts, this web service disruption was not caused by computers in botnet. Rather, millions of people received spam email with links to Twitter, and clicking on these links users overwhelmed the Internet site by sending too many requests for access.

I believe that mentioned above article about Twitter is relevant because it clearly shows two Internet attacks. The first one happened when users received spam letters, and in this moment mail servers were overwhelmed and bandwidth capability was decreased by millions usefulness emails. The second attack with junk requests led to the Twitter unavailability during some hours.

Weak Password Brings ‘Happiness’ to Twitter Hacker

An example of importance of NIST Special Edition (SP) 800-14 can be a case with Twitter, when this service was hacked by 18 years old man, who used an automated password –guesser on users’ accounts. This would not happen if Twitter’s administrators confined a number of rapid-fire log-in attempts.  The hacker could used the password –guesser only because Twitter allowed unlimited number of log in efforts. “Weak Password Brings ‘Happiness’ to Twitter Hacker”   (http://www.wired.com/threatlevel/2009/01/professed-twitt/ ).  NIST (SP) 800-14 clearly says about necessity of limitation of log-on attempts (3.11.2 Authentication (3.11 Identification and Authentication)).  The fault rests not only on Twitter, but also with users who used easy to guess passwords. The software the hacker used pick up the passwords from a special dictionary, and if users would create complicated passwords, they would not come to harm.