In my last post (just a few minutes ago) I mentioned that it's the Month of Apple Bugs. Logging onto a local security user's group website that I'm member of: TASK, a fellow geek (opensrc) posted an article on the forum pointing out that Landon Fuller is attempting to patch the each of the Apple vulnerabilities each day after they come out using Application Enhancer.
Kudos to Landon - sounds like a great guy.
And thanks to opensrc for the posting on TASK.
Thursday, January 4, 2007
So long Superman... Vista will save the world
I've read a lot of articles recently like this one, often quoting (mis-representing?) some very respectable sources such as SANS and Postini. They imply that Vista will somehow magically fix all the security woes that MS has been undergoing and that the internet will be a magically safer place. I'm sorry people, but that's just a pipedream!
Is Vista more secure than previous OSes - for sure. Will it "change the threat landscape" - hell no!
Look, I'm not going to quote any real statistics - mainly because I can't be bothered to look them up, but there are still Win95, Win98, WinME, NT4, Win2000, Win2003, old Linux & Unix boxes that have never been maintained (or not adequately from a security perspective) - and let's not forget that this month is the Month of Apple Bugs.
Let's say, just for arguments sake, that everyone who could afford the whopping $239USD pricetag on Vista, ran out to buy it and installed it on their probably-not-fast-enough-to-really-run-Vista machine. Let's further assume, as is probably reasonable, that a whole bunch of people will also install a pirated copy of this same OS. This would mean that we'd get what...maybe 40-50 percent of the Windows workstations out there converted to Vista? And that, my friends, is in a perfect world where everyone who could do so ran out and got a copy.
This scenario would have some (short term, I think) impact on the number of available machines to infect/take-over, but that doesn't make the Internet a safer place. If you take the analogy of the Internet being like New York city, where there are a lot of wonderful places to visit, and a lot of dark corner where bad people lurk, then this would be akin to installing flood-lights in 40-50% of the New York city alleyways. Does it make New York safer? No. In fact, it means some areas are worse off than they ever were because it forces the bad-guys to congregate (and there's strength in numbers). Same holds true for the Internet.
For the Internet, this probably translates into meaning that primarily 1st-world countries, who can afford the software and/or hardware upgrade, will be "safer"; while poorer countries will be the congregation points for Internet bad-guys.
But it can still be argued that this pushes all of our problems to areas that we can more heavily monitor. In theory, this is true.
Are there any plans to do this monitoring? No. Does "monitoring" this activity make us any safer? No. Can we stop people in these places from sending data to us? Not in our new global economy.
And don't think for a second that Vista is without holes. When XP came out, it took a few months for the first 0Day exploit to hit - and the same will be true for Vista. In fact, we'll never truely know when the first 0Day for Vista comes out because the bad guys are a lot more about stealth these days than ever. So, while we're carefully watching these "dark areas" of the Internet, the domestic security space will slowly revert back to the same state it's in today.
I'm not slagging MS here, you'll note I mentioned several other OSes above - but MS is simply the most prevalent and, as a result of prevalence, the most frequently targetted.
My suggestion to those reading this blog: don't upgrade you personal PC to Vista because of security. If you like some of the features (like multimedia) that Vista offers, go for it. Otherwise, stay with XP (or find someone who has purchased Vista and get their XP license from them). It will probably run faster on your machine anyway.
Whichever one you do, here are 6 easy things to make sure you're not easy-pickings for the bad guys:
1. Make sure to patch aggressively - enable automatic updates for all software (and operating systems) that have the option.
2. Make sure you have a good AV that hasn't expired and update it at least weekly (I update dialy).
3. Enable a personal firewall (hardware-based routers are good too) and disallow all inbound traffic unless you really know what you're doing.
4. Install buffer-overflow protection software (eEye has a free personal edition of Blink)
5. If you're going to spend money, spend it on a good anti-spyware software - some of them even have buffer overflow protection software, and personal firewall built in.
6. Make sure to auto-update (or subscribe to mailing lists) for all the above (yes, I know this was point #1, but it's worth re-iterating).
If you have the know-how, also make sure to subscribe to vendor patch notices for all internet-enabled software (and browser tie-ins) including multimedia software (QuickTime, iTunes, DivX, WinAmp, etc..), Adobe Acrobat, your mail reader, browser, Peer2Peer software, etc. Again, auto-update is your friend if it's built-in.
This won't make you indestructible, but it's "secure enough" for most people and makes you a harder target. Bad guys usually go after the low-handing fruit.
rG0d
Is Vista more secure than previous OSes - for sure. Will it "change the threat landscape" - hell no!
Look, I'm not going to quote any real statistics - mainly because I can't be bothered to look them up, but there are still Win95, Win98, WinME, NT4, Win2000, Win2003, old Linux & Unix boxes that have never been maintained (or not adequately from a security perspective) - and let's not forget that this month is the Month of Apple Bugs.
Let's say, just for arguments sake, that everyone who could afford the whopping $239USD pricetag on Vista, ran out to buy it and installed it on their probably-not-fast-enough-to-really-run-Vista machine. Let's further assume, as is probably reasonable, that a whole bunch of people will also install a pirated copy of this same OS. This would mean that we'd get what...maybe 40-50 percent of the Windows workstations out there converted to Vista? And that, my friends, is in a perfect world where everyone who could do so ran out and got a copy.
This scenario would have some (short term, I think) impact on the number of available machines to infect/take-over, but that doesn't make the Internet a safer place. If you take the analogy of the Internet being like New York city, where there are a lot of wonderful places to visit, and a lot of dark corner where bad people lurk, then this would be akin to installing flood-lights in 40-50% of the New York city alleyways. Does it make New York safer? No. In fact, it means some areas are worse off than they ever were because it forces the bad-guys to congregate (and there's strength in numbers). Same holds true for the Internet.
For the Internet, this probably translates into meaning that primarily 1st-world countries, who can afford the software and/or hardware upgrade, will be "safer"; while poorer countries will be the congregation points for Internet bad-guys.
But it can still be argued that this pushes all of our problems to areas that we can more heavily monitor. In theory, this is true.
Are there any plans to do this monitoring? No. Does "monitoring" this activity make us any safer? No. Can we stop people in these places from sending data to us? Not in our new global economy.
And don't think for a second that Vista is without holes. When XP came out, it took a few months for the first 0Day exploit to hit - and the same will be true for Vista. In fact, we'll never truely know when the first 0Day for Vista comes out because the bad guys are a lot more about stealth these days than ever. So, while we're carefully watching these "dark areas" of the Internet, the domestic security space will slowly revert back to the same state it's in today.
I'm not slagging MS here, you'll note I mentioned several other OSes above - but MS is simply the most prevalent and, as a result of prevalence, the most frequently targetted.
My suggestion to those reading this blog: don't upgrade you personal PC to Vista because of security. If you like some of the features (like multimedia) that Vista offers, go for it. Otherwise, stay with XP (or find someone who has purchased Vista and get their XP license from them). It will probably run faster on your machine anyway.
Whichever one you do, here are 6 easy things to make sure you're not easy-pickings for the bad guys:
1. Make sure to patch aggressively - enable automatic updates for all software (and operating systems) that have the option.
2. Make sure you have a good AV that hasn't expired and update it at least weekly (I update dialy).
3. Enable a personal firewall (hardware-based routers are good too) and disallow all inbound traffic unless you really know what you're doing.
4. Install buffer-overflow protection software (eEye has a free personal edition of Blink)
5. If you're going to spend money, spend it on a good anti-spyware software - some of them even have buffer overflow protection software, and personal firewall built in.
6. Make sure to auto-update (or subscribe to mailing lists) for all the above (yes, I know this was point #1, but it's worth re-iterating).
If you have the know-how, also make sure to subscribe to vendor patch notices for all internet-enabled software (and browser tie-ins) including multimedia software (QuickTime, iTunes, DivX, WinAmp, etc..), Adobe Acrobat, your mail reader, browser, Peer2Peer software, etc. Again, auto-update is your friend if it's built-in.
This won't make you indestructible, but it's "secure enough" for most people and makes you a harder target. Bad guys usually go after the low-handing fruit.
rG0d
Wednesday, January 3, 2007
Gotta start somewhere
They say starting something new is always difficult - and surprisingly, I've put off creating my own blog for a long while. Not sure why that is: I'm not a shy person, I don't really care if people disagree with me or don't like what I have to say, and I'm certainly not afraid of my own opinion.
So today, being a nice, slow day at work :) I decided to finally step up and do what several of my friends, most notably Sleb, have been saying I should do.
I work in a corporate environment with 70,000+ staff, so I tend to write and get TONS of e-mail. As a result, I typically heavily edit things that I type up because they can get forwarded to a lot of people (including externally). So, I think the first thing I'm going to do, is NOT do much editing of the blog - I don't want my ideas watered down - I want them to come out however they come out, and if I have to deal with a few flames or just say "I was wrong" later, or "oops, didn't mean it the way it sounded", I'm cool with that.
Thinking about what to write about on my first blog wasn't easy (okay, not rocket science, but I want it to be something meaningful), so I thought I'd use it to just brain-dump some of the ideas I'm hoping to use for future blogs.
1. First and foremost I'm a GEEK at heart (I've got the coffee mug, shirts, and certification to prove it), so you'll see a lot of posting on my chosen profession - security. In particular, I'm a Windows geek. Yeah, I know what some of you out there are thinking - isn't everyone! Sure, ther'es lots of them, but in the Windows Security space, I really know my shit (light patting on the back).
2. Learning Linux - yep, the Windows geek goes Linus :) I've always prided myself on being able to learn anything (though I really don't enjoy doing any deep-down programming), so why not move over to the penguin side...
3. My pet IT projects - log management and analysis. In particular, my little project is how to do this for FREE (or as close to it as possible), so I'll post tid-bits as I run across them, and probably a list of favorite links.
4. Woodworking (maybe). Everyone needs a hobby and my woodshop is mine. After a few years of collecting tools and renovating the house, the house is almost done and I've had more time to really get into the shop, so I might (occasionally) run down that path.
5. The wife and kids: the wife is XX years old (yeah, like I'll make the stupid mistake of saying her age) and the kids are an 11 (soon to be 12) year old boy and 3 year old girl. I also have a dog and a cat, so life is VERY full (sometimes too full - but I'm sure we all experience that from time-to-time).
6. Random thoughts and side-bar rants.
For those of you who know me, let me know if you think there's something I seem particularly wound-up about, and I'll take a stab at blogging it.
So today, being a nice, slow day at work :) I decided to finally step up and do what several of my friends, most notably Sleb, have been saying I should do.
I work in a corporate environment with 70,000+ staff, so I tend to write and get TONS of e-mail. As a result, I typically heavily edit things that I type up because they can get forwarded to a lot of people (including externally). So, I think the first thing I'm going to do, is NOT do much editing of the blog - I don't want my ideas watered down - I want them to come out however they come out, and if I have to deal with a few flames or just say "I was wrong" later, or "oops, didn't mean it the way it sounded", I'm cool with that.
Thinking about what to write about on my first blog wasn't easy (okay, not rocket science, but I want it to be something meaningful), so I thought I'd use it to just brain-dump some of the ideas I'm hoping to use for future blogs.
1. First and foremost I'm a GEEK at heart (I've got the coffee mug, shirts, and certification to prove it), so you'll see a lot of posting on my chosen profession - security. In particular, I'm a Windows geek. Yeah, I know what some of you out there are thinking - isn't everyone! Sure, ther'es lots of them, but in the Windows Security space, I really know my shit (light patting on the back).
2. Learning Linux - yep, the Windows geek goes Linus :) I've always prided myself on being able to learn anything (though I really don't enjoy doing any deep-down programming), so why not move over to the penguin side...
3. My pet IT projects - log management and analysis. In particular, my little project is how to do this for FREE (or as close to it as possible), so I'll post tid-bits as I run across them, and probably a list of favorite links.
4. Woodworking (maybe). Everyone needs a hobby and my woodshop is mine. After a few years of collecting tools and renovating the house, the house is almost done and I've had more time to really get into the shop, so I might (occasionally) run down that path.
5. The wife and kids: the wife is XX years old (yeah, like I'll make the stupid mistake of saying her age) and the kids are an 11 (soon to be 12) year old boy and 3 year old girl. I also have a dog and a cat, so life is VERY full (sometimes too full - but I'm sure we all experience that from time-to-time).
6. Random thoughts and side-bar rants.
For those of you who know me, let me know if you think there's something I seem particularly wound-up about, and I'll take a stab at blogging it.
Subscribe to:
Posts (Atom)
