America creates legislation against Chinese espionage

A recent bill signed by President Obama, the Consolidated and Further Continuing Appropriations Act of 2013, states that certain federal agencies must first vet hardware and equipment being purchased from China to verify that it isn't compromised. Here's a blurb from the bill:

"Associated risk of cyber espionage or sabotage associated with the acquisition of systems, including any risk associated with such system being produced, manufactured or assembled by one or more entities that are owned, directed or subsidized by the People's Republic of China.” 

The Chinese pose a significant risk to the United States, or anyone else they're doing business with for that matter, by selling sabotaged equipment laden with code used to steal data or open backdoors to the potential trojanized hardware. This malicious malfunction of hardware becomes almost undetectable to the laymen operating the equipment.

I wrote about this concern a few years ago in a blog post regarding network card based rootkits that allow attackers to compromise a machine without the operating system being aware of the attacks. Over the summer we saw hardware based espionage concerns brought up against the networking and telecommunications hardware company Huawei and it doesn't come as a surprise to anyone that this is a Chinese based company. I think we have a trend here.

Overall, I'm happy we've seen the United States taking a stance against the Chinese in the cyber realm. They're still the elephant in the room, but at least we're no longer scared to point at it. With this new legislation and the brave research performed by Mandiant on nation state sponsored cyber espionage, I feel we're at least pointed in the right direction against the Chinese. They've been caught red handed and exposed for what they are (thieves) and we need to keep the pressure on them.

 [Slow golf clap to America]
 

An In-Depth Look at DDoS – Part 2: Considerations to Improve Your DDoS Defense

Okay so if you’ve read Part 1 of this blog series, you now know what DDoS is (and if you don't, you're on the wrong site!). Now what? Well now we start the phase of defending against these attacks. The first thing you need to look at is your infrastructure and determine what tools you currently have in your toolbox that might be able to defend against it.

• Do you have an IPS with DDoS signatures enabled?
• Is your router/firewall configured with rate limiting?
• Should you consider blocking certain countries on your edge?
• And many more…

There are many things that can be done with existing network equipment to protect against network layer attacks. If you know that your equipment can barely handle the current production load then being hit with a small DDoS is going to tip you over.

From an application layer perspective, know where you weak points are. How many connections can you database hold without dying? Do you have the opportunity to failover or cluster websites, DNS, etc to push the load of traffic to other sites or distribute the traffic to where you want it?

Knowing what you currently have in your arsenal can really come in handy when you’re attacked later. Also, there are on site or premise devices that are strictly there to protect your network and applications against DDoS attacks. These are looking at the traffic coming into your network and will start mitigating once bad traffic is identified. The problem here is what happens when the load is too much for that system, the routers or your internet connection? I’m glad you asked.
Some options to consider:

1. Partner with Your ISP - Once you’ve done your due diligence on verifying what you own internally, it might be time to understand how third parties can extend this protection. If you can’t handle a DDoS with your current infrastructure it’s very important to reach out for help. One of the ways of doing this is partnering with your ISP and attempting to get assistance upstream from them.  Since these attacks have to come over their network they sometimes have the capability to block certain IP addresses from ever hitting your network. This can become like playing whack-a-mole if it’s based solely off IP address, but it’s something to keep in your back pocket.
2. Examine CDN Services - If you’re a large company and are using CDNs (Content Distribution Networks) to help get your site out to the world more quickly and efficiently, it might be worth taking a look at services they offer. Since these services are meant to return any traffic sent to them, many times they have the ability to absorb simple DDoS attacks by design, but they don’t cover everything.

Read the rest of my article for www.algosec.com here: http://blog.algosec.com/2013/03/an-in-depth-look-at-ddos-part-2-considerations-to-improve-your-ddos-defense-.html

An In-Depth Look at DDoS – Part 1: Motives, Methods and Tools

Recently we’ve seen the renewed interest of DDoS methods and tools splash the front pages of major newspapers and news sites throughout the world. Just in the past week a hacktivist group is calling for more DDoS attacks on US banks.

The ability to harness and command internet traffic towards a company or organization for the attacker’s sole purpose of limiting the access to a resource is cheap, easy and very stealthy. It’s become the tool of trade for many activists and hackers alike and can be absolutely devastating if you’re in the crosshairs of a skilled attacker with the power of the internet flooding behind him.

Before we get into defending a DDoS attack lets discuss a few motives that might provoke an attacker into launching an attack towards someone.

• The “Cyber Sit In” - Whereas, in the past activists would show up at a location to demonstrate their dislike for an organization, all they have to do now is sit at a keyboard and launch an attack from the comfort of their mom’s basement. This is the side of DDoS that’s used to show the unhappiness one group has towards anothers ideology.

• Site for Ransom - On the flip side another motive is being driven completely by money. Now we’re seeing situations where one group knocks a competitor offline, and then holds the site hostage for a ransom. This can especially be harmful when conducted during a busy time of the year. These attackers see an opportunity to make money and are trying to get a piece of the pie.

Every organization has a limit, and with enough firepower behind them, the attacker will find that limit. Attackers have at their disposal free DDoS tools to download and have the capability to direct large quantities of traffic towards a victim with finite resources – all it takes a lot of the time is pointing and clicking towards a target IP/domain. Many of these tools can also be scripted to launch traffic towards a site on a scheduled basis and to change tactics to keep the victim guessing.

There are many ways that have been proposed to defend against DDoS attacks, but there is no silver bullet when it comes to this beast. Like all things in security you need to rely on layers of protection. To get a better understanding of DDoS attacks and ways to protect yourself against them you need to understand that there are several types of DDoS attacks that can be conducted numerous different ways – and depending on the layer being attacked different systems might not realize it.

• Application Layer Attack - When you have an application layer attack the bad guys are hitting your applications and use different methods and tools such as HTTP GET/PUT Floods, DNS saturation, etc.. Remember, the attacker’s main goal is to disrupt service and they don’t care how they do it. Many application layer attacks are successful with very limited bandwidth and are aimed at bringing down your database, application, etc. At this point if an attacker can overwhelm database connections on a website, FTP server, DNS, etc. the service is down and you can’t serve it to legitimate customers (It’s like an old fashioned sit in).

• Network Layer Attack – Network layer attacks  aim to saturate your systems or network so that either the internet circuit or networking equipment can no longer handle the load being requested -  this is synonymous with being punched in the face repeatedly until calling “Uncle”. Methods and tools used in this type of attack are ICMP Floods, Half Open Syn Floods, etc.

• Hybrid Attack - When application and network layer attacks are combined, these evil creatures become something called a hybrid attack (an ugly, rabid DDoS love child). Now when you have attackers switching attacks or using both attack types at the same time (AKA Hybrid Attack), things will get interesting. 

Click here to read the rest of my article for algosec.com here: http://blog.algosec.com/2013/03/an-in-depth-look-at-ddos-part-1-motives-methods-and-tools.html

Bring Your Own Device/Disaster

Anyone following information security over the past 3 years has heard the nasty four letter acronym of BYOD or Bring Your Own Device. This phenomenon has taken shape as the consumerization of IT has made its way to the enterprise. With tablets and smartphones exploding in popularity over the past couple of years it’s no wonder that employees want to start using the hardware (and the apps that run on them).

With a growing workforce of college grads that consider these devices an extension of their being, trying to take a smartphone from them would be like cutting off one of their hands. The two major concerns that security pro’s must deal with are:

• What can we do to protect our data?
• How do we protect our network against these personal devices?

The first question on “What can we do to protect our data?” is more complicated than one might think. There are many vendors offering MDM (Mobile Device Management) that really like to pull the wool over your eyes and a few that are downright awesome. There are many features within these systems that allow you to do some pretty fancy things, but from a security point of view I’m really worried about my data. For example, when you’re sent an e-mail and you open on your device (tablet/smartphone) where can you forward that data? If someone has files on their smartphone with confidential company data on it, and I leave the company with that phone, can you really be sure that this person didn’t just walk out with your customers’ credit card numbers, sensitive information regarding mergers and acquisitions, competitive intelligence, etc.? Yup, that just happened.

Sensitive company data is walking around in your employee’s pants… unprotected. Is this data encrypted while it’s on your tablet or is it floating around in sites like dropbox.com waiting to be scooped up, stolen, or accidently released into the wrong hands?

Check out the rest of the article here: http://blog.algosec.com/2013/02/bring-your-own-devicedisaster.html

Back in Time and Back to the Future: Looking at the Evolution of the Firewall

As we’ve entered a New Year and we look back at the events of the past year, I thought it would be interesting to examine the firewall from its beginning and how it’s evolved. We’ll review the transformation of the firewall and how multiple services have been bundled into today’s modern NGFW, as well as a few trends of where the firewall may be going in the future.  So let’s all pile into my DeLorean and take a trip through time.

Old School

After pushing the dial back to the early 1990’s we find the firewall a much more primitive piece of technology that’s really only just a proxy. We say, just a proxy, but back in the day this was a sophisticated piece of technology. The proxies of this early time were normally pushed to the perimeter of a network and used to, wait for it, yup….proxy traffic to resources within the internal network. It was here that traffic could be filtered and shaped to certain resources. There were also packet filters that could be run on servers that inspected traffic coming into the network. Here’s where you’d create security policies, in effect rudimentary rulebases that did packet filtering based off the 5-Tuple attributes of TCP\IP -Source IP, Source Port, Destination IP, Destination Port, Destination Protocol (We’ll talk more about tuples later). 

As security needs and capabilities began to expand within the network and firewalls performing stateful inspection were first commercially available, the firewall started its march into the enterprise as staple of network security…

UTM becomes the Latest Buzzword

Today we’re seeing more than just stateful packet inspection on our firewalls. We’re seeing years of evolution from multiple vendors pushing services into what we call a firewall today. We saw the evolution of firewalls a few years back when everyone and their mother were coming out with UTM devices and trying to make the firewall more than a one trick pony. These UTM devices gave you the ability to create SSL VPNs, Anti-virus, IPS, firewalls, etc. – all in one appliance -  a long way from our initial proxies we saw just a few years prior. These are still available today, but the evolution of the firewall doesn’t stop here!!

Don't like cliff hangers? Click here to read the rest of the article: http://blog.algosec.com/2013/01/evolution-of-the-firewall.html

Merry Christmas and Happy New Year