Fraud and Identity Theft are not "Hacking"

[H]ard|OCP: Hacker gets record 13-year sentence for hacking.

Originally a haven for hardware hackers looking for advice on extreme overclocking, system cooling, gaming, and case modifications, you'd figure [H]ard|OCP would "get it", wouldn't you? At least one front page contributor doesn't.

I'm not one of the hopefuls that really thinks society will ever ditch its stigma against "the H word" but this story strikes several nerves for me, and continuing to sensationalize "hacking" like this is only part of it.

Max Butler (now known as Max Vision) got a whopper of a sentence, but it wasn't for "hacking," it was for multiple counts of wire fraud, identity theft, and transfer of stolen identity data. While Max undoubtedly had the mindset of a hacker for most of his life, his ethics (I'll get to that in a moment) made him a criminal. Although he was obviously brilliant and capable as a hacker, Max abused his skills to become a carder, a con man, and a low-life, deceptive criminal. Those are the things that got him into trouble. Criminals with little technical skill get busted for the same things.

More disturbing, though, is how Max came to the center of this vast arena of identity theft. With a troubled past, he emerged as a skilled security consultant with a bit of a naughty streak -- a habit that would get him thrown into the slammer (for computer fraud) after breaching government and military networks with a clever tool that would patch a well-known hole while leaving a back-door for him to use later. This is the kind disruptive mischief that used to be associated with "cyber criminals" years ago, putting him in the same arena as Robert Morris, Adrian "The Homeless Hacker" Lamo , and MafiaBoy, to an extent.

During this 18-month stay in the pokey, he would befriend the hardened career criminals who would eventually conspire with him to create genuine financial havoc, on par with the destructive forces of those responsible for the TJX and Heartland breaches.

What do I make of it? I'm not entirely sure. It's hard telling if Max Vision would have found collaborators outside of prison and ended up on the same path, or whether prison life genuinely corrupted him. I do know, however, that no one gets arrested for "hacking."

Previously.

Oh noes! Google Buzz FUD!

Silicon Valley Insider came up with this wonderful sensationalist FUD piece: WARNING: Google Buzz has a huge privacy flaw!

Please.

They recommend shutting off Buzz completely, or un-following your automagically-generated "friends" that Google "chose" for you (i.e. other Google Profiles that you exchange e-mail, Google Reader, or GTalk with). This isn't really a Buzz issue at all, though. It's been a "problem" since Google Profiles came out, it's just a lot more intuitive to see who people interact with in Google Buzz, since it's built into GMail directly now.

UPDATE: It looks like contact sharing *IS* enabled only once you sign up for Buzz. So, shame on Google? If you don't sign up for Buzz, these options won't even show up (and neither will your contacts on your Google Profile) - Thanks, Genesiswave, for pointing this out.

Or, you could think rationally, and simply un-check the option to make public the list of people you interact with. Imagine that?

So, take a deep breath, log in to some google service, then click this link to edit your profile if you're really that worried. Again, this option is only displayed once you opted in to Google Buzz.

Now, the followers/following links are only visible to myself. I verified this through Google Buzz and by looking at my profile page from a different google account.

IT Security Certifications: Path to payday, or just a farce?

Network World claims that security certifications are worth their cost while other certificates aren't holding their value so well.

I'm going to use Network World against themselves. You see, they also put Security Specialist/Ethical Hacker at the top of the list of the 10 best IT jobs right now.

By all metrics, IT Security careers are on the rise. Qualified pros are in demand and the pay is up. Since the majority of people who have these certificates are working in an "on the up-swing" industry, that alone could explain the reason that people who hold these certs are getting raises when non-security certs don't seem to be paying off.

Note: I don't have any certificates nor degrees, and I've had several great interviews and a few job offers already in under a month of job hunting. Some of these even listed degrees or certificates in the "Required" or "Strongly desired" category of the job postings, but it didn't keep me from getting in front of a hiring manager. It's worth mentioning that WHO you know -- your network -- is often just as important if not more so than what you know or what pieces of paper you hold.

I might take an employer up on their offer to train me and pay for certification, but I haven't seen much solid proof that you need the certificates if you have the experience, the passion, and the references to back up your skills.

What's your take? Good for getting to the top of the applicant pile from HR? Good for landing you that dream job? Good for getting a raise once you're already in the industry? Or is it just a piece of paper?

Juxtaposition - Subscription-walls

A new paper on Johnny's "I Hack Stuff" blog requires a subscription. Meanwhile, Sensepost is abandoning their "Regwall" for research papers.

I feel the same way about news paywalls, really. They don't force people to pay, nor do they keep people from getting the news. They just make sure they don't get the news from YOU.

By the way, I threw together a Google Reader "Bundle" of my favorite security feeds. If you use Google Reader (and let's face it, why WOULDN'T you?!) you can easily import these. Beware: it's over 200 RSS feeds, and can get awfully noisy at times.

Wrapping insecure web apps with Apache

When dealing with a web service which for one reason or another cannot or should not be allowed on the web. Apache has several wonderful modules which allows the services to be wrapped and behave like a web app should (working SSL certificates, forced encryption, authentication ...)

In this article I will discuss and show some examples on how to create an authenticated reverse proxy with mod_authnz, mod_proxy,mod_rewrite and mod_security.

-=-=-=-=-=-=-=-ToC-=-=-=-=-=-=-=-
1. Prerequisites
2. Installation of Apache
3. Configuration of Apache
4. Configuration of mod_rewrite
5. Configuration of mod_proxy
6. Configuration of mod_authnz(optional)
7. Configuration of mod_security
8. Summary
9. Informative Resources
-=-=-=-=-=-=-=--=-=-=-=-=-=-=-=-=-
1. Prerequisites

In this example you will need:

• Ubuntu Linux
• LDAP compatible server with valid SSL certificate
  
• Apache2
• Wildcard ssl certificate or valid certificates for each service published
• Apache mod_rewrite
• Apache mod_proxy
• Apache mod_authnz
• Apache mod_security
  

2. Installation of Apache
Install Apache2 by any of your favorite package managers or at the prompt:

sudo apt-get install apache2

3. Configuration of Apache
Then create a new config file for each of your new relays.
Inside of the virtual host tag:

UseCanonicalName Off
LogFormat "%V %h %l %u %t \"%r\" %s %b" vcommon
#incase you have a self signed certificate on the ldap server
LDAPVerifyServerCert off
SSLEngine On
SSLCertificateFile /etc/apache2/ssl/generic/example.com.crt
SSLCertificateKeyFile /etc/apache2/ssl/generic/example.com.key
Servername weirdone_wrapped.example.com
CustomLog /var/log/apache2/access_log.relay-weird.vhost vcommon

4. Configuration of mod_rewrite
(mod-rewrite is included with apache2)
To enable mod_rewrite:

a2enmod rewrite

Then add the following virtual host entry to redirect http traffic:

RewriteEngine On

#Force HTTPS
RewriteCond %{HTTPS} !=on
RewriteRule ^(.*) https://%{SERVER_NAME}/$1 [R,L]

5. Configuration of mod_proxy
First install additional mod_proxy:

sudo apt-get install libapache2-mod-proxy-html

Then enable the modules:

a2enmod proxy proxy_connect proxy_html proxy_http

Insert the proxy section and commands into the SSL (port 443) vhost section:

Order deny,allow ProxyPreserveHost On ProxyPass / http://weirdapp.example.com:50281/ ProxyPassReverse / http://weirdapp.example.com:50281/

6. Configuration of mod_authnz(optional)
First install mod_authnz:

apt-get install libapache2-mod-authnz-external

Then insert the following into the proxy block for ldap authentication of the connection:

AuthType Basic AuthBasicProvider ldap
AuthName "Please authenticate your connection using your network login."
#Some Ldap servers will reject un-encrypted simple authentication, plus this is
#just a good idea any way.
AuthLDAPURL "ldaps://1.2.3.4/?cn" SSL
AuthzLDAPAuthoritative on
AuthLDAPBindDN cn=authbot,ou=users,o=org
AuthLDAPBindPassword password
AuthLDAPRemoteUserAttribute uid
AuthLDAPRemoteUserIsDN on
AuthLDAPGroupAttributeIsDN on
AuthLDAPGroupAttribute member
Require ldap-group cn=Staff,ou=groups,o=org
Satisfy All

7. Configuration of mod_security
First install mod_security:

apt-get install libapache-mod-security

Then enable it:

a2enmod mod-security

Mod_security is fairly tricky, I am using a default configuration but I am only logging errors and not preventing them. Configuration beyond this is outside the scope of this article.

Edit /etc/apache2/mods-available/mod_security.conf and use the configuration example in
"/usr/share/doc/mod-security-common/examples/" as a template.

If it proves to be too restrictive, you can switch the part which says:

SecRuleEngine On

to

SecRuleEngine DetectionOnly

8. Summary
So, after this is installed, Apache will listen to a static IP then relay a a website to the end user over SSL after authenticating the connection with an LDAP server. And if anything fishy happens it will be logged/(or blocked) with mod-security.

This is not a 100% silver bullet solution. Apache http authentication is generally a bad idea, especially over an unencrypted session. In this example it is partially mitigated with mod_rewrite but at this time Apache does not natively support any modern authentication technologies with hooks for LDAP or any other authentication service. If you have the opportunity to prevent the need to do this then make it so.

The best way is to do it right the first time and write into your web application (or specify in the RFQ) the correct security measures.

9. Informative Resources

Breach Security "Mod Security home page". (Accessed April 2009)
http://www.modsecurity.org

The Apache Software foundation. "Apache webserver website". (accessed Jan 2010)
http://httpd.apache.org/

See also :
Asmodian X's Securing php web applications:
http://www.h-i-r.net/2009/05/securing-php-web-applications.html

Ax0n's OAMP (Apache, Mysql, PHP on OpenBSD) Article:
http://www.h-i-r.net/2008/12/sysadmin-sunday-amp-on-openbsd-44.html

Asmodian X's Name based hosting mini-howto:
http://www.h-i-r.net/2008/10/sysadmin-sunday-apache-name-based.html

Asmodian X's Workbench - Suhosin :
http://www.h-i-r.net/2008/12/asmodians-workbench-suhosin-hardened.html

Via Adrian Lamo's Twitpic...

Challenge/Response in real life. No, it's not photoshopped.

Guest post: Fonera Power-Over-Ethernet

Editor's notes:
This technique should be useful for short runs of ethernet (6' or less) and to power pretty much anything that needs 5VDC and doesn't require a lot of current. I've seen USB ports provide up to one amp of current, though it's usually advised to keep it under 500mW. If you have a dual-USB Power/Data cord like the ones that come with external 2.5" hard drives, I'd advise using that to help get more power to the Fon, but there are several people running USB power directly to the Fon, and it seems to work fine. This is the first time I've seen a POE injector/splitter used in combination with USB before. Pretty clever.

This is a guest post by cyb3rassasin, a student in the midwest that's interested in security technologies. You can follow him on Twitter.


Okay, so I’m sitting in the coffee shop with my LaFonera router in front of me, and my netbook on my lap. I look at my fon just sitting there with its 4 AA battery pack, pondering how else I could power this little guy. A battery pack is bulky, and I don’t really want to have to carry a wall wart with me everywhere I go.

So the options that come to mind are usb power, battery pack, and power over ethernet. The first two aren’t bad ideas but I was kinda looking for something a little more compact and cleaner. I decided to look at some PoE injectors/splitters because they’re inexpensive and compact.


The only problem I could forsee is again I’d have to carry a wall wart around with me. Then I thought why not cut the power adapter off the injector and replace it with a usb plug. It would be simple, clean, and I’d only have to have one cable running to the fon. The Fon can run from 5VDC just fine.

I decided to pick up a set of PoE cables from Passive PoE. I grabbed a usb cable from an old phone that I had, I chopped the end off and stripped all the wires. I then cut the power plug off of the injector and stripped the two wires. ( note: the copper is ground and the red is positive)


Now, don’t make the same mistake I did: put the heatshrink on the injector before soldering the usb plug and the injector together. I soldered up the connections, wrapped each individual connection in electrical tape, and heatshrunk it.




Before testing this with my fon, I thought it would be a good idea to make sure I got the polarity correct. I plugged the injector into my netbook, hooked up an ethernet cable, and then attached the splitter. I took a multi-meter and to the splitter and sure enough, I had the polarity right. Center pin: positive 5VDC, outer barrel: negative

Now it’s time to take a leap of faith and plug in my fon, and woot! It works!


So now I successfully have a compact way to power my fon via usb and PoE. I’ve found one downside to this, it drains my netbook battery faster than if I would use a battery pack. Other than that this is an effective alternative way to power the fon.



cyb3rassasin also showed me the Open-Mesh mini router, which seems to be nearly identical to the original Fon2100 shown here. Since the Fon2100 is no longer available new from the manufacturer, and the newer hardware isn't as friendly for things like Jasager/Karma, it's nice to know there is still a comparable piece of gear out there to take its place in our hackpacks. Long live evil wifi! Here are some photos he sent us, comparing the Open-Mesh and the Fon2100.