UPnP - It was always a bad idea!

UPnP is a protocol that allows a router to listen out for requests to open ports and to make other configurations changes from a client machine WITHIN the LAN. It was popularized a decade ago by Microsoft with the original XBox. If you want to have a game that you're playing with others (who are all sat behind their own NAT routers) then the game has to have a way of opening a port on the router and mapping to the games console. That's what Universal Plug & Play achieves and once it was known that you needed it for XBox gaming no router manufacturer is going to not include it and have it set on by default. For years I've told people to disable it and go to the trouble of opening the required ports manually; Here's how you do it for XBox Live! It seems like a bit of malware on your LAN could have a field day opening up dangerous ports (think Windows filesharing etc) and all the benefit of having a NAT firewall has vanished; you're exposed to the Internet and nobody wants that! 

Anyhow - it turn out that some routers have UPnP enabled on their Internet-facing port! That's right; you send the correctly formed UDP-discovery packet at the Internet side of the router and along with being able to open ports you can query the router for lots of details about itself, allowing you to better tailor your attack for other known vulnerabilities of that specific model. HD Moore (of Metasploit fame) has had a cluster of machines probing the public Internet to see how many public-facing IP addresses had UPnP enabled and it turns out around 2% of hosts respond to WAN-borne UDP discovery packets. He repeated his scan weekly for six months and those eighty-one million routers remained reasonably constant. His blog post makes great reading and is here. 

In case your wondering if your router is vulnerable you can find a list of effected models here, and you'd be surprised how many big-name manufacturers are there. I suppose not many people ever bother to patch their router and so a lot of this code is probably a decade old. I encourage you to get a Linux-based router and load it up with DD-WRT or one of the other many good open-source router firmwares (I use DD-WRT but have used Tomato in the past). It goes without saying they are not vulnerable and they add so much functionality that you'll kick yourself for not using them sooner. 

Steve Gibson did an excellent Security Now! podcast on the matter last week; 

Steve has also extended his Shields Up!! router test to check for the vulnerability.

Speeding up HTTP

The big overhead with protocols that run on top of TCP/IP is the number of connections they open. A modern web page has many different kind of assets (HTML, scripts, Java, GIFs, JPEGs, etc etc) from many places (the primary domain, adservers, Google+ buttons etc etc) such that when you load the front page of facebook.com you may well have opened and closed a thousand TCP connections to a dozen servers. It's amazing that it works at all, but when you consider that each connection had to not only do the three-way TCP handshake, but it also had to run TCP flow-control starting slowly and ramping up packet rate until it started to drop packets and then dropping back. When Mr Burners-Lee wrote his original http server in the early nineties there is no way he could have anticipated how the web would grow.

It seems there are several approaches to optimising this - for the past ten years there have been various attempts to re-define TCP; MUX, SMUX, and SST protocols were valiant efforts that died on the vine because they essentially break how the infrastructure works. Whatever comes after http has to work over all the same IP v.4 routers, switches and proxies. In the last year I've become aware of two projects that work and don't require funky routers etc.

1. Amazon Silk - this is embodied in the browser that comes on the colour Kindle. Essentially it is a mega-proxy that not only collects all the assets for the page but re-renders pictures etc for the smaller screen and sends the whole lot in a stream. So one connection allows the whole pre-rendered page to arrive with the assets from Double-Click and Google (and any other third-party elements in the page) pre-collected for you by Amazon. It runs of their EC2 platform and does depend on them providing the service.
2. SPDY is a Google-sponsored project that doesn't replace http but optimises it. By employing pipelining (i.e. keeping a TCP connection open for all the assets from one domain), compressing headers and marking those headers that don't change so they don't need to be re-sent it speeds up the browser by around three-fold. Further speed increases come if the web-server is able to collect the third-party assets and deliver them over the same pipeline.

As ever Steve Gibson has covered these very comprehensively in Security Now! - SN320 for Silk and SN343 for SPDY.

Security and the Diginotar debacle

You might have been following the trouble that the Dutch SSL-certificate issuing firm Diginotar have been suffering recently. It transpires that Iranian hackers have got into their system and have spent several months issuing themselves wildcard certs for well known domains, most notably *.google.com - it essentially means these ne'er-do-wells can sign certificates that look like they have come from Google and your browser would be none the wiser. In fact it's not that severe unless you've been the victim of another attack;

• Man-in-the-middle attack - you might be in a coffee shop where someone has managed to poison the ARP-table in the router and inserted themselves into your wireless comms. If they served up the fraudulent cert they could make any domain (especially there own server) look like you were securely connected to.
• DNS-poisoning attack - as highlighted by Dan Kaminsky a couple of years ago it is possible to for elderly versions of BIND and more contemporary versions of IIS to incorrectly serve up DNS look-ups. Once this is in place the fraudulent cert on the same server would have you believing you had a secure connection.
• Corporate decrypting proxies; many corporations install their own certificate on all client machines and essentially do a man-in-the-middle SSL intercept. Your traffic to Amazon.com is encrypted, but it goes via the proxy where it is momentarily decrypted for your boss to look at! If a corporate proxy was compromised dodgy SSL certificates could have you believing you had an encrypted connection to Amazon.

All of this raises issues with SSL - when I first started using an SSL browser (Netscape Navigator v.2 IIRC in '95!) there were around seven or eight trusted issuing CAs. Now there are hundreds (including the Hong Kong Post Office!) and it comes as no surprise that some of them get compromised sometimes. What I don't understand is why browsers don't keep a record of the CA associated with domains and when they see a change (particularly if a cert had time to run) inform the user? There is a plugin I use for Firefox called "Certificate Patrol" that does just that and it's easy to use and unobtrusive.
Now then - the whole Diginotar story started three months ago and they didn't spill the beans until last week; security is never served by secrecy. Also - it took Apple far to long to patch Safari. I think if you're concerned about network security then avoid Safari on OS-X.

Bitcoin

Unlike other digital currencies, Bitcoin avoids central authorities and issuers. Bitcoin uses a distributed database spread across nodes of a peer-to-peer network to journal transactions, and uses digital signatures and proof-of-work to provide basic security functions, such as ensuring that bitcoins can be spent only once per owner and only by the person who owns them.

My introduction to Bitcoin was via Steve Gibson's "Security Now" podcast; (check out episode 287 here). Along with the Wikipedia article my interest was peaked. Bitcoin seems to be a real, credible digital currency that is cryptographically secure. However - a currency needs to appeal to more than engineers and the economists are up in arms about it - read the very entertaining exchange here.

For the moment Bitcoins are trading for 1 BTC: 20$

Stuxnet

I've been following the Stuxnet worm in the technical press and it is fair to say that this is probably the world's first weaponised computer worm. In a very real sense this is cyberwar.
From Bruce Schneier's excellent blog;

Stuxnet was expensive to create. Estimates are that it took 8 to 10 people six months to write. There's also the lab setup--surely any organization that goes to all this trouble would test the thing before releasing it--and the intelligence gathering to know exactly how to target it. Additionally, zero-day exploits are valuable. They're hard to find, and they can only be used once. Whoever wrote Stuxnet was willing to spend a lot of money to ensure that whatever job it was intended to do would be done.

Symantec's report is very thorough but somewhat long!
The best expose on the whole subject is Steve Gibson's podcast on the subject;

http://media.grc.com/sn/sn-291.mp3

Internet security - when should you pay?

People often ask me about what security software I use. I'm of the opinion that you want solutions you don't have to think too much about. OpenDNS fits that bill entirely but here are some other thoughts;

1. Firewall - ten years ago before Windows XP and when your broadband connection was probably via a USB modem (and you had an internet-facing, routable IP address) it made a lot of sense to have a software firewall - Zone Alarm or somesuch. Since XP SP2 (when the Windows firewall is on by default) and hardware NAT routers there is no good reason to spend money on yet another firewall. Your NAT router acts as a very effective hardware firewall because any packets that aren't a direct response from outgoing connections (from one of the machines on your network) are ignored. You could quite happily run Windows (or Mac or Linux) behind a NAT router with no firewall.


2. Web filtering software - Cybersitter etc. You may well want to filter your incoming traffic but having a piece of software on every machine is not the way to do it. By far the best solution is to use a DNS filter - every DNS lookup that your router sends out goes not to your ISP's server but to OpenDNS who (based on their database and your settings) will return null DNS entries for sites you might not want accessed. I've been using it for a year and it's excellent - nothing needs to be done to new machines as the router has the IP addresses for OpenDNS in it's settings. OpenDNS also blocks all known phishing and malware sites and since they have a worldwide userbase of tens of thousands they are more likely to block new threats before you try and go to them.


3. Web filtering pt.2 - NoScript is an excellent plugin for Firefox that stops active content from running on pages. It's a bit of a pain when you first install it as you're constantly clicking on the settings icon and allowing a domain (BBC iPlayer isn't much use without Flash!). But after a while you get used to it an the sites you visit often where you need active content soon outnumber those that you visit occasionally (and you may not want them to run JavaScript, Flash, ActiveX etc - common vectors of infection).


4. Antivirus - Microsoft Security Essentials sneaked out earlier this year with little fanfare but has been getting excellent crits with detection scores near the top of the test tables. Definitely better than Norton, Panda, and AVG. It integrates well with XP through Windows 7 and I found it to be very unobtrusive. It's what I'm using on all my Windows machines.
5. Spybot etc AntiMalware - Windows now has the Malicious Software Removal tool - MRT.exe (you can run it from Start>Run whenever you like). It updates itself silently on patch Tuesday and is as effective as anything else at removing malware. It's free and unless you've deselected it from Windows update any machine running Win 2K or later has it.
   

So there it is - not paying for security, far from being the cheapskate option is, I think, the best policy. Have you sat down to use a machine that had a full-up Norton or McAfee install and realised how cumbersome and slow this computer (which five years ago would have been considered workstation-class) now is. The firewall is fighting the Windows firewall, the antivirus is popping up reminders to renew the subscription ('cause you only got 90 days with Dell!) and you can't access files on your server for some reason.

The dirty little secret the anti-virus industry never mention is that once your machine has been compromised they can't be sure they've rid you of whatever nastiness crawled in. Root Kits and other techniques mean it is nigh on impossible to ever trust a PC that has been virus infected. You need to reformat the hard drive and re-install Windows. It's not hard and you'll find your machines feels like new again as you will have lost the detritus that Windows picks up along the way.

Hard Drive Reliability

I love the Security Now! podcast - episode eighty-one this week was a corker. Leo and Steve discuss the distressing results and implications of two recent very large population studies (more than 100,000 drives each) of hard drive field failures. Google and Carnegie Mellon University (CMU) both conducted and submitted studies for the recent 5th USENIX conference on File and Storage Technologies.
Since I have a modest amount of experience with hard drive reliability I thought I'd drop Steve the following;

For the last twenty years I've been working in broadcast engineering and the track of my career has mirrored the uptake of commodity computers over bespoke television equipment.
I had a couple of points - one interesting and one informative that I thought you might enjoy;

• In the mid-nineties the whole industry was switching over from editing video-tape to cutting shows on workstations. Consequently large and fast hard-drives were needed and Micropolis (now out of business) was one of the manufacturers of choice for most TV facilities. They'd launched a nine gig model (big full-height 5 1/4¨ device!) that the company I was working for was buying in number - even at $2,500 a pop they were thought to be good value! After about six months a number of these drives started to fail. The manufacturer had given us a SCSI utility to see which sectors had failed and it appeared to be the same ones on each drive. In a couple of cases we did a low-level format of the drives (which mapped out the bad sectors) and continued to use them. Those drives then showed problems and when analysed their sectors were clearly failing in very similar patterns. In the end the representative from Micropolis told us that in the case of that series of drives the lubricant they used would leak from the spindle-bearings and spread out across the platters, getting progressively more spread from the centre of the disk.


• The company I currently work for specialises in editing systems, particularly for film and high-definition television. In the case of HD the data rate off of the videotape is either 1.48 or 3 gigabits per second (unlike the domestic HDV format that manages to compress the video to a paltry 18 megabits per second!). In the case of film (either from a digital film camera or telecine film scanner) the data rate can be much higher. The upshot of all this is that the stand-alone storage systems and SANs (storage area networks) have to stripe many drives together to achieve the required through-put. We are very used to having ten or more drives with data striped across them and the dirty little secret we shy away from is that the mean-time between failure of a ten-way drive set is only one tenth of a typical drive. Consequently our tech-support department is always trying to resurrect dead fibre-channel drives. We tell (or even try and bully) customers into keeping backups but with many terabytes of data it is a hard thing to enforce. This is why mixed striped/mirrored drive sets are becoming popular. Anyhow - one of the things I have found to be useful in temporarily reviving a dead drive (and I've done it maybe a dozen times) is to freeze a disk. It might sound crazy but it you consider that the most common reason for mechanical failure in a drive is the bearings becoming loose and the drive spinning eccentrically you can see the reason. The cold temperature tightens everything up as it shrinks and (temporarily) allows the thing to work at specification. The only option is to clone the drive and then throw the suspect one away.