Internet Explorer vulnerability

UPDATED: A lot of people have been asking me about this in the last two days and I thought I'd summarise my observations here. Please leave a comment if you think I've got something wrong or I haven't answered a particular question.

The Issue

It seems that Microsoft have had a bug in Internet Explorer 5.01 (released in November 1999) that exists right up to the latest beta of IE 8. Essentially, someone can write a web page that references a non-existent page element causing an error within IE that allows code to be run on the local machine as if it were the current user of the machine. Usually this would manifest itself by using IE to download a piece of code from a 3^rd website and silently install it, compromising the PC. (Before anyone comments that I've over simplified the problem, I have no intention to get into invalid pointer dereferencing in DHTML arrays in this blog.)

This only affects Internet Explorer – not Firefox, Safari, Opera or Chrome (although I'm still a bit sceptical about the patching regime for Chrome at the moment and am hesitant to recommend it).

Impact

Because the vulnerability essentially means that an attacker can install anything they like on your machine, anything could have been happened. I don't mean to panic people, but I honestly don't have any idea how much information or how many machines have been compromised in this way since the vulnerability was discovered.

Let's get the issue into perspective. We know that at least 10,000 websites have been compromised and, if visited with a vulnerable web browser, will infect your PC. However, given that there are approximately 110.1 million websites being operated, with a total of 550 billion web pages on the Internet, the proportion of the total affected is small.

It's also fairly safe to say that most of the "big" sites like the BBC, Microsoft, Yahoo, Google, Blogspot and other sites that have big operations behind them will very quickly find compromises in their sites and fix them – they can't afford the publicity. Those sites being compromised are the smaller sites, being hosted in a chicken shed at the end of the garden.

I'm definitely not saying this isn't an issue – it is a huge problem. However, equally, I'm not saying we should all run for the hills.

What is happening and what can I do?

Microsoft have stated that they've brought forward a patch for this problem to 1pm EST. This will hopefully solve the problem. There are a few things that you can do, in addition to patching your machine by visiting the Microsoft Update Centre. IMPORTANT: if you're using a PC supported by LSE, or any other organisation, and it's on the corporate/work network, patching should be done automatically, as it is at LSE. There is a big difference between running a personal computer and having a reliable network with several thousand on at the same time on a corporate network. Please don't change the configuration of a work PC. If in doubt, contact your support team (at LSE, these can be found here).

If using your own PC, consider the following:

• Ensure your anti-virus product is up-to-date
  
• Make sure you have a properly configured firewall on your PC
  
• Consider using a different web browser
  
• Patch regularly
  
• Only visit web sites you trust
  
• Change your passwords regularly
  
• Don't use the same password for every website
  

It's also important to note that this whole sorry episode could well be repeated next week, with another vulnerability, or in a different browser. Please be sensible when surfing the web.

I'd welcome any feedback.

UPDATED (18.55, 17/12/2008): Microsoft have released an update page. See: http://support.microsoft.com/?kbid=960714

The Twelve Scams of Christmas

I know I'm a bit late getting to this topic (Philip Virgo got there first) but I think it's worth blogging about this, too. Here is the only (?) Christmas carol to be adapted for information security:

The Twelve Scams of Christmas

Twelve Phishers phishing
Eleven Spammers spamming
Ten Bots a' herding
Nine Virus writers coding
Eight Snoopers snooping
Seven Worms a' spreading
Six Crackers cracking
Five Tro-jan Horses
Four Logic bombs
Three Software patches
Two Denials of Service
And a hacker at your back door!

Credits go to Philip Virgo, Margaret Smith (plus the other ISAF members) and the countless members of IT Services at LSE who had to endure this being actually sung to the music of "Twelve Days of Christmas".

The links go to GetSafeOnline. For more information, see the links on the right. I'll blog on each topic over the next few days.

The Anatomy of a Phishing Scam

We've been suffering from a plethora of phishing scams over the last few weeks at LSE. To put this into context, Messagelabs stop in excess of 250,000 spam e-mails from arriving at our mailboxes every week, which represents 25% of the total (1,108,000). So, when one does get through, it is a bit unusual. In the main, these don't cause a lot of disruption as most people are conditioned to ignore them. However, there's always someone who does reply and the IT department spends quite a bit of time clearing up the aftermath.

So, here is my one top tip to not getting caught:

Never, ever send your password to anyone by e-mail.

It's quite simple. No-one should ever ask you to disclose your password by e-mail and you should never, under any circumstances, give it to anyone.

What happens if you do

Here at LSE, we have a set of Conditions of Use for IT Facilities which clearly state that you shouldn't do this. Most organisations with an information security policy say the same thing. Generally, you can expect your account to be suspended as a minimum.

However, that's not all. Scammers will use the details that they have gained to abuse the account they have access to steal information and, most likely, send spam out from the account. This means that the account gets blacklisted. Which is a pain.

Phishing for Bank Details

This is obviously a subset of a much wider attempt to con people into handing out personal detail, either directly or trying to convince them that they are on a legitimate site. Many people have received e-mails, purportedly from their bank, asking them to log in by clicking a link in the e-mail and filling in all of their authentication information.

There is a simple way to avoid being duped by one of these e-mails. Never click on the links in the e-mail: always go directly to your bank by manually typing their website address in the address box of your browser.

Browser defences

On top of this, many web browsers now (or will soon) incorporate anti-phishing tools. For example, Mozilla Firefox has a feature that, if turned on, automatically blocks access to known phishing site.

If in doubt, don't click. And another tip: don't reply to these scam e-mails with some sarcastic comment: it only confirms your address and you'll end up getting more spam.

Encryption issues

Many people ask me about the issues surrounding encrypted devices and whether they can (or should) encrypt data. So, to clear up any confusion, here's my take on this issue.

First point: Encrypting data, especially on removable devices, is a good idea

Given recent events relating to the loss of sensitive data (like, the loss of nursery data on a USB stick, Government user IDs stolen from a parked car, the banks losing customer data, Number 10 staff losing their Blackberry's in China… This list is endless), it is blindingly obvious that some form of protection for data while not stored in a physically secure environment is needed. The losses actually reported are dwarfed by those that companies elect not to report. There is a great debate going on about whether companies should be compelled to report these sort of breaches under Data Protection legislation, as currently most organisations don't have to.

In addition, individuals should ensure that their own data is adequately secured. It's not just companies that have this problem. How many people store their passwords to their online banking on their laptops and then carry them around with them all over the place? And, given that most operating systems have built in encryption capabilities these days (Microsoft Windows XP and Vista do, as does Mac OS X), people should really consider turning these on.

Second point: There are lots of different applications for encryption

There's device encryption, full disk encryption, e-mail encryption, SSL encryption for websites and other types of traffic, VPNs… Plenty of different applications for very different purposes. And managing this becomes a bit of headache…

Third point: In an organisation, it's not that simple…

Having said all of the above, it would easy (but wrong) to assume that it's very simple to implement encryption in an organisation. It isn't. There are three choices: 1. Implement stand alone encryption for everyone who needs it, using a variety of different standards and without the capability to access these in the event of a disclosure requirement; 2. Implement an integrated encryption service, managing people's keys centrally (or at least having an administrative key for access in the event of a disclosure requirement), or; 3. Take the risk and don't do anything.

The trouble with option 1 is that the organisation is liable for everything that gets sent or stored from or on its systems. In the event that a request to disclose some information stored in an encrypted file or e-mail is made by the authorities, it is essential that, given the right safeguards, an organisation can access that data. If everything is set up in a standalone fashion, this becomes difficult.

Option 2, therefore, looks much more attractive, but it does come at a cost, both in terms of infrastructure and management. Many organisations opt for option 1, but ensure that each user of encryption software sign a disclosure agreement that warrants their co-operation in the event the organisation is requested for data held in a system that they, themselves, control.

Finally, option 3. I would not recommend going down this route. The Information Commissioner seems to be blowing hot and cold over the absolute requirement for device encryption, but it looks likely that principle 7 of the Data Protection Act 1998 will be breached if laptops and other personal data aren't encrypted.

Fourth point: Travelling with encrypted files

This may come as a bit of a surprise, but different countries have wildly different laws about encryption, so it is essential that people check out what the legislation is in the country that they are travelling to, in case they are accused of espionage activities (I'm not kidding!). For a comprehensive overview, the University of Tilburg, in the Netherlands, is hosting a page on the Wassenaar Arrangement. This details how different countries license the export and import of different levels of military materials. To quote:

"The Wassenaar Arrangement controls the export of weapons and of dual-use goods, that is, goods that can be used both for a military and for a civil purpose; cryptography is such a dual-use good."

As an example, I've picked Russia. It states: "A license is required for the importation of encryption facilities manufactured abroad. The export of cryptography is subjected to a tightened state control. Importers and exporters need licenses by the Ministry of Trade."

I am not a lawyer, and I suggest getting legal advice rather than ever relying on something you've read in a blog.

More information:

Surfing Safer: Advice on choosing encryption products

Laptop encryption in Russia, China

20 Years of Worms, Viruses, Trojans…..

It may come as a bit of a surprise that the first piece of malware to use the Internet to spread was released into the wild in 1988. The "Morris Worm" was written by Robert Tappan Morris, then a student at Cornell University in the US and who, embarrassingly, was the son of Robert Morris, the former Chief Scientist at the US's National Security Agency (NSA). His worm infected roughly 10% of all systems connected to the Internet at that time (bearing in mind that in 1988, the Internet had a grand total of 60,000 connections; today, this figure lies somewhere around 1.1 billion) and still holds the record for the largest percentage infection of the Internet.

Why is this relevant?

The explosion in the numbers of devices connected to the Internet has resulted in an explosion in the number of programs designed to compromise the devices connected to it. Ever since people started using the Internet, others have been trying to subvert them. It's an ongoing battle and anti-virus companies have been making large sums of money by trying to protect people from them. Sophos recently reported that they are receiving 20,000 new samples of malware every single day. And it's not the traditional e-mail attachment, promising titillating pictures of the latest B-list celeb, either; in the same report, Sophos say that they see over 16,000 new website infections every day. This means that simply by looking at a website, often from a genuine and reputable company, a machine can be infected without any interaction from the user.

It's not about fame anymore

In the good old days of virus writing, authors would write something that would throw up messages, immediately telling the user of the machine that they were infected. Some examples can be found on F-Secure's virus screenshot archive. These days, however, the whole malware space has become much darker. Viruses, worms and Trojans no longer advertise their presence but rather attempt to lurk on a users PC without their knowledge, quietly subverting the machine.

Why the shift in MO? Simple: Money.

These days, most malware is written to infect machines in order to take control of them. These "zombie" machines are then part of a "botnet", controlled by a "bot herder", who sells time on his/her botnet to the highest bidder. Essentially, these zombie machines can be used to do anything. The faster the machine and faster the Internet connection, the better. They can be used to launch "Distributed Denial of Service" attacks, where vast amounts of junk data are thrown at a particular company or website, with the intention of taking them off the net as part of an extortion exercise, or for the storage of porn. Far worse is the ability for paedophiles to store their collections on the infected PCs of unsuspecting users, allowing them to keep distance between themselves and their images.

Storm

The largest of these botnets that has been found to date is known as "Storm". According to some sources, up to 50,000,000 devices are zombies were part of Storm in September 2007. It has been reported that the bot herders running Storm were making profits of $9,600 daily, with spam being the main revenue generator.

What can I do?

Really, it comes down to ensuring your anti-virus is up to date (and this includes Mac and Linux users! I'll come on to why in another posting), ensuring your firewall is enabled and patch, patch, patch! I have been made aware of a free tool to tell you which programs installed on your PC need patching, and not just those written by Microsoft. Potentially any vulnerable component could be used to crack open the machine and zombiefy it. I really recommend downloading this application and updating those things it finds.

Social Networking Risks – Facebook and others

With the rise and rise of social networking sites, everyone is getting online and publishing more stuff about their own lives. But not everyone is fully aware of the risks that they run by putting so much information about themselves online.

The Internet never forgets

Many people don't realise that when something gets published, it is very hard to take it off the Internet. Consider this when publishing photos from the last time you had an all-night, booze-fuelled party. A number of sites offer historical archives of the web. Google offers up cached versions of web pages in its results. Historical data has caused all sorts of problems a number of companies, most recently United Airlines. Other stories keep resurfacing. The BBC and Microsoft have an ongoing issue with a story written in 2001 about Hotmail considering charging users for its e-mail service. The story (from 2006) is here.

Employers will search the web for you

Many employers will now search the web for any information they can find out about you before you get offered a job and, in some cases, will take issue with things that you post online while working for them. Here are some examples:

Policeman loses job opportunity because of his Facebook profile

Waterstones employee loses job because of blog comments

Australian man found lying about sickness through Facebook

Virgin and BA staff sacked for Facebook site criticising customers and their respective companies

And if you think you can simply delete your Facebook profile, think again. It is seemingly very difficult to actually erase yourself. While deactivating your account is simple enough, actually getting Facebook to delete your details is much harder. This has been the subject of concern by the Information Commissioner and he discusses it on this BBC page.

Watch out for the actions of others

If you do post something on your profile beware what others may do with that information. There has been a tragic case recently of a woman who was murdered by her husband, simply because she had changed her relationship status on her profile.

It's not all bad

There are ways that you can limit the risks you run by using social networking sites:

Always think about what you upload: consider what that picture of you on the drunken night out might look like to a future employer.

Don't post everything about yourself: a date of birth is essential for an identity thief – do you really need it on your profile?

Check the privacy settings: most sites, like Facebook, allow you to restrict who has access to what information.

Search online every so often to see what's published about you: it's always a good idea to see what information is available about you online.

Don't install every Facebook app: some have been found to be malicious

Only invite friends that you know: if you don't know them in person, think hard before accepting that friend request. They may be impersonating someone else.

There are sites that can help. Sophos do a really good guide to Facebook settings, there's an online video about MySpace privacy settings from SafetyClicks, and Bebo themselves have published an online safety guide.

But these settings will not protect you if you're either blogging directly, have your own website or use another service. Fundamentally, the question you have to ask yourself is: should this information be online at all.

Mobile Security – iPhones and more

Mobile devices have long been the bane of the lives of those responsible for information security. They're transitory devices, never really attached to any company infrastructure and yet hold vast amounts of corporate data. While some have tried to establish some sort of control over these devices, most people, in my experience, have decided to ignore the problem, hoping that people will implement the security controls that they have built in. It has now been demonstrated that, with the news that the PIN on Apple's iPhone can be bypassed with three button presses (http://forums.macrumors.com/showthread.php?t=551617) , this is hardly a viable way to manage these sorts of devices.

The reason that this is even a problem is the ever increasing functionality on these devices. There was a time (many moons ago) when the only data that could be extracted from a phone was the phonebook and the odd text message. Now, many phones have VPN clients, access to corporate e-mail, the web and a whole host of data. And what is a phone these days, anyway? When does it stop being a phone and actually becomes more akin to a laptop? Take a Blackberry. It works as a mobile phone, yes, but it's primary function is as a lightweight version of a laptop, having access to e-mail and storing sensitive information.

You'd think that those used to dealing with sensitive information day-to-day would be more aware of the risks of losing these devices, but apparently not: http://www.telegraph.co.uk/news/newstopics/politics/labour/2437340/Downing-Street-aide-in-Chinese-honeytrap-sting.html.

So what should we do? As individuals, we need to recognise the value of our devices, over and above that of the hardware itself. Information has value. How many of us store our entire contacts list on our phone? What would we do if that got lost? Is there any information on there that could make me or any of my contacts vulnerable to identity theft?

Think about the following:

• Always use whatever security features come with the phone, be it a PIN or whatever. It might seem a bit pointless given the above, but Apple will fix this. And there is a work around (which is strongly advised for all Apple iPhone users).
  
• Don't store people's birthdays and full addresses in your phone. Someone's date of birth is an important piece of information to an identity thief.
  
• Delete data that is sensitive. PINs, credit card numbers, passwords, they shouldn't be there.
  
• Back up your data. Make sure that you do it regularly so that if your device does get stolen, it's fairly straightforward to get back to where you were.
  
• Delete those old text messages. Or at least back them up, too.
  

If you do lose your phone, it would be worth contacting those people that you have got extended details for and let them know.

Companies have a number of options. I'll cover these in a later post.