Steve Goodbarn

ICANN enters a new era of Internet governance

ICANN, The Internet Corporation for Assigned Names and Numbers, is the governing body of the Domain Name System (DNS) which is the database of the Internet. ICANN was created by the US Government in 1998 to move governance over the Internet from the US Department of Commerce (DOC) to a private sector, worldwide body that was not dominated by the United Nations, or any other corrupt and politically deadlocked organization, or by elements who did not embrace freedom.

ICANN has been operating under an agreement with the DOC since its inception. Today is the last day of this agreement. To reassure the world that ICANN will remain true to it's mission, ICANN today issued an 11 point Affirmation of Its Commitments (see the video on ICANN's site).

This is a positive and inevitable development as the Internet is a worldwide infrastructure vital to communications everywhere. There needs to be a universal sense of ownership and accountability and not a feeling that it is an extension of the US Government. At the same time no one wants ICANN to become dysfunctional as is the case with many international organizations. ICANN has real functions that affect all of us directly and indirectly.

The Affirmation is a common sense assurance that ICANN will remain true to its mission.

ICANN's evolution is a big development but one that will probably fly under the radar of business and consumer news groups.

Malware industry grows in a down economy

Larry Walsh at Secure Channel reported last week on a 400% increase in ID stealing malware in 2008, according to McAfee Avert Labs. Why the increase? Malware is easy to write, fraudulent web sites and bank accounts are easy to set up, and email and Internet sites are not authenticated using DNSSEC. It is therefore inevitable that crime involving malware is becoming ever more institutionalized. This is an industry with potentially huge profits and even governments are getting into the game.

What is happening today is a movement from high-publicity web attacks to numerous low-profile scams designed to steal cash from business, public and private schools, not for profit groups, and individuals.

How do they do it? CNN Money.com elaborates in Cybercrime: A Secret Underground Economy.

Brian Krebs at the Washington Post had a great article on this last Thursday, see "Money Mule" Recruitment Network Exposed. This "Mule" was involved in stealing $117,000 from the Sanford school district in Colorado:

The Sanford mule -- who spoke on the condition of anonymity out of fear of reprisals by the hacked company and perhaps by the hackers themselves -- said the Scope Group approached her via e-mail, saying it had found her resume on Careerbuilder.com, and would she be interested in a work-at-home job acting as a "financial manager"? Having worked as a payroll manager in a previous job, the mule said she thought it was a perfect fit. Besides, she said, she'd been out of work since March.

The mule said that after responding to the initial recruitment e-mail, she was directed to create a profile at the Web site www.scope-group.cn. She was then asked to provide a large amount of personal and financial data, including her name, address, Social Security number, bank account and routing numbers, as well as a scanned copy of her drivers license. During the enrollment, she was prompted several times to make sure that her bank would allow her to withdraw up to at least $10,000 a day.

When she initially received a $9,815 transfer from Sanford School District's account, her managers sent her a notice through the scope-group.cn site that the funds had been deposited into her bank account (see screen in the article). According to the task notice sent to her through her Scope Group account, the money was transferred with the notation "Conejos School District 6J," one of the schools in the Sanford School District (for more on that attack, see Cyber Crooks Target Public and Private Schools).

Work at home offers are all over the place today and many people less honest than this woman would be willing to go along with such scams. It's a pretty simple operation once account access is obtained. With so many people in dire financial straights around the world we will be seeing more thefts of this nature.

Cybersecurity - the Wild, Wild West?

CIO Today had an article yesterday entitled "Cybersecurity Today: The Wild Wild West". It's worth a read. Do you think you are safe by having the latest anti-virus deployed? The article notes:

"To demonstrate how vulnerable networks can be, a team of Northrop Grumman engineers purchased a brand new computer with the latest security software and linked it to the Internet. Within four hours, a hacker had "pinged" or probed the system. Within a week, a "rootkit" -- a form of malicious software -- had been installed on its hard drive. Within two weeks, the computer was enslaved by servers that were traced to Canada, Singapore and another unidentified location, and used to attack a computer in Poland.

This happens because there is a large gap between the time a vulnerability is discovered and the release of a software patch to protect a system, says McKnight of Northrop Grumman. In many cases, it takes vendors weeks and even months to provide a patch, which may not even work."

We all know about the collapse of perimeter defenses and the fact that patching is always one step behind the bad guys. This is a very comprehensive article yet what it completely ignores is the need for internet-wide authentication. All of the solutions noted in the article are very expensive and won't solve the fundamental problems they highlight.

This morning I participated in an educational webcast on DNSSEC implementation sponsored by PIR, The Public Interest Registry. PIR and their technology provider, Afilias, run the .org domain. They are way ahead of everyone in the US (.gov excepted) on DNSSEC adoption. Their approach is methodical. They signed the .org zone in June and are carrying out a trial roll out to a small number of organizations withing .org. Full deployment availability to their constituents will take place early in 2010.

This type of preparation and action will make a real difference cost effectively for Internet users. There are over 15 million records (web sites) within the .org domain. Hospitals, charitable and civic organizations provide essential services and face increasing financial pressures. The Internet provides one of the most cost effective methods for communications. Low cost DNSSEC is the essential foundation for putting medical records on-line and many other applications that will have a huge positive impact on our lives. We won't get there with expensive filtering, encryption, and intrusion detection systems.

Cybersecurity will continue to be the wild, wild west until more organizations follow the lead of PIR with DNSSEC deployment.

Clampi trojan targets business banking on-line: The solution is authentication

First reported on September 11 by Brian Krebs of the Washington Post (a great column I've listed on my blogroll - read it regularly and you might just shut down your PC) the Clampi virus is spreading worldwide.

This virus is a trojan that sits on users' Windows PC and logs passwords and user IDs when one of roughly 4,500 banks or financial institutions is accessed. The passwords are then sent to one of a number of servers and an army of "mules" is then used to access these accounts and make multiple transfers out of the country. The focus of the virus is on business and not-for-profit organizations that do not have the same legal protections as consumers for this type of fraud. Quite a number of businesses and school districts have been victimized by Clampi. 

The standard protection from this type of virus is to keep your anti-virus software current, avoid opening email attachments, avoid suspicious web sites, be careful using chat software like Yahoo messenger or Skype, etc. In other words: be diligent, be inconvenienced, and be scared.

An even better idea would be to authenticate email, authenticate the counter party on chat sites, require banks to authenticate your PC when your account is accessed, and of course authenticate web sites. All of this would be horribly expensive without DNSSEC. But with DNSSEC it could happen almost automatically. And automatically is what users want and should expect.

Litigation from victims of these scams is picking up. That is probably what is needed to get effective authentication deployed.

DNSSEC compliance for .gov sites is 100 days away

The U.S. Federal Government has taken a lead on DNSSEC implementation by signing the .gov domain this past winter (.GOV DNSSEC Information) and by requiring Federal Agencies under .gov to implement DNS Security Extensions (DNSSEC) for external (public) sites by 5pm Eastern time December 31, 2009 (see OMB Memorandum from the White House).

That is 100 days out from today.

A quick review of SecSpider shows 40-odd DNS zones under .gov are in production, including several state and city zones not covered by the mandate such as Idaho, Vermont, Boston and Chicago.

But missing from the list are Homeland Security (DHS.gov), US-CERT (the United States Computer Emergency Readiness Team), and Whitehouse.gov. (Note to these agencies: Please call me - we do DNSSEC and have deployed in many US Government sites in 3 to 5 days.)

Manual deployment and operation of DNSSEC, including training, documentation, implementing procedures for key rollover, and testing can be done in under 2 months by trained and dedicated personnel. However, most implementations take 3-6 months or more. Finding DNSSEC-knowledgeable people who can be fully dedicated to implementation and who can remain to continue the many ongoing operational requirements is difficult.

The penalty for messing up DNSSEC can mean a site disappears from the Internet. It's a lot to risk if your site is critical to a department or agency's mission. Automation solves these issues.

Let's hope there is a great leap in adoption over the next quarter so the US Government can meet their own adoption requirements in 2009.

SANS Security Report highlights web site vulnerabilites and unpatched client-side software

Last week the SANS Institute published a report of The Top Cyber Security Risks. The report highlights two top priorities. There first priority is for users to apply patches on a timely basis:

"Waves of targeted email attacks, often called spear phishing, are exploiting client-side vulnerabilities in commonly used programs such as Adobe PDF Reader, QuickTime, Adobe Flash and Microsoft Office. This is currently the primary initial infection vector used to compromise computers that have Internet access. Those same client-side vulnerabilities are exploited by attackers when users visit infected web sites.(See Priority Two below for how they compromise the web sites). Because the visitors feel safe downloading documents from the trusted sites, they are easily fooled into opening documents and music and video that exploit client-side vulnerabilities. Some exploits do not even require the user to open documents. Simply accessing an infected website is all that is needed to compromise the client software. The victims' infected computers are then used to propagate the infection and compromise other internal computers and sensitive servers incorrectly thought to be protected from unauthorized access by external entities. In many cases, the ultimate goal of the attacker is to steal data from the target organizations and also to install back doors through which the attackers can return for further exploitation."

The second priority is vulnerable Internet-facing web sites:

"Attacks against web applications constitute more than 60% of the total attack attempts observed on the Internet. These vulnerabilities are being exploited widely to convert trusted web sites into malicious websites serving content that contains client-side exploits. Web application vulnerabilities such as SQL injection and Cross-Site Scripting flaws in open-source as well as custom-built applications account for more than 80% of the vulnerabilities being discovered. Despite the enormous number of attacks and despite widespread publicity about these vulnerabilities, most web site owners fail to scan effectively for the common flaws and become unwitting tools used by criminals to infect the visitors that trusted those sites to provide a safe web experience."

These two vulnerability points seem obvious to me and it is no surprise that the report lists them as the top priorities for cyber security.

Given the opening statement above that "...targeted email ... is the primary initial infection source...", it is odd to me that the report completely overlooks the need for strong Internet-based security and authentication, beginning with DNSSEC. After all, such email attacks would not be feasible if email was authenticated. It is a no-brainer and would save the additional cost and brain damage of trying to manage the thousands of new attack variants appearing each day.

Further, DNSSEC would authenticate web sites and one would hope that such sites would be more diligent about site maintenance to ensure they were free of malware. DNSSEC itself imposes a maintenance discipline on web site administration due to the need to roll over signing keys.

In any case the report is interesting reading and a little scary when one considers the volume and sophistication of the attacks.

Patch Tuesday and more bugs

Another in the never-ending series of security patches: Microsoft Fixes Critical Windows Vulnerabilities in Patch Tuesday Updates. Make sure you are set to receive automated updates if you use the Windows operating system. This week's patch Tuesday was a big one.

But that's not all. These patches do not address another critical bug found in Vista, Windows Server 2008 and Windows 7.  This remotely exploitable vulnerability could result in a blue screen of death. Here is Microsoft's comment on the bug.

There is also an exploit in the wild for an un-patched vulnerability in Microsoft IIS, their web server.

But before jumping all over Microsoft for insecure code, consider Apple’s Snow Leopard Is Less Secure Than Windows. It's just that Microsoft is in more hackers' sights.

Microsoft has the unenviable task of being like the walls enclosing a medieval town (your PC). They offer some protection but the real problem is that the entire world outside the wall (the Internet) has limited security and no authentication. The ongoing adoption of DNSSEC will enable these "walls" to be a lot more effective by authenticating web sites and enabling email authentication. It will make SSL and VPN tunneling truly trustworthy.

It puzzles me why Microsoft is essentially a non-factor in the DNSSEC community considering what a positive impact adoption will have on their bottom line.

A DNSSEC hiccup - automation is critical

As most of you reading this blog know, DNSSEC stops cache poisoning. It's a required first step in making the internet a trusted platform for communications. The .org blog had a good post the other day on what An Authenticated Internet would do for us. The .org domain is using DNSSEC and is in the process of rolling this out to the more than 15 million sites under this domain.

The Puerto Rico domain, or .pr, was one of the first to adopt DNSSEC. They experienced a hiccup this past week as they rolled over their DNSSEC keys. In simple terms for DNSSEC operations, as new key signing keys are generated there is a short period of time when both new and old signing keys are used for validation. During this period the new keys must be sent to a validation service (in this case ISC's DLV) before the old keys are removed. If the new keys are not updated with the validation service then responses to DNS queries to the site are treated as bogus. It appears in this case that .pr forgot to update the new key with the validation service. A bad, bad, result as you can imagine.

This situation is a major reason why DNSSEC adoption has been feared and treated as not-ready-for-prime-time. The solution? DNSSEC requires complete automation of all functions so human error is at an absolute minimum. It is difficult to have the process discipline to carry out DNSSEC operations continuously even if the expertise and redundant human resources are at hand. Employee turnover, other pressing matters (like security patches), illness, weather, and other human factors make this extremely risky, even for the best run organizations. For mission critical operations it's unthinkable.

That is why the Department of Homeland Security engaged my company, Secure64, to develop an automated software appliance to enable DNSSEC implementation. Without automation there is a substantial risk of human error and no one to blame. Human error is mitigated with an automated solution. It doesn't quite make DNSSEC implementation a "no-brainer" but it's about as close as you can get and takes as little as a day to implement.   

The world should not fear DNSSEC implementation. It can be done simply, quickly, and with minimal cost.

.edu to adopt DNSSEC

Educause, which manages the .edu domain, VeriSign (their service provider), and the Department of Commerce announced today that the .edu domain will adopt DNS security extensions, or DNSSEC, by the end of March 2010. This leverages the signing of the root zone which is expected by the end of 2009.

See Security of .edu Internet Domain to Increase.

The EDU domain is used by colleges and universities as well as many school districts. DNSSEC will enable authentication for the EDU domains. Colleges and school districts increasing use the web for administration and teaching and they are also struggling to meet requirements for reporting illegal file sharing and other mischief from their users.

The EDU domain will join .org and .gov as the largest top level domians to adopt DNSSEC so far.

Progress to a safer, more efficient Internet!

Government Computer News: New threats emerge from once-trusted protocols and services

William Jackson of GCN published an article last week, New threats emerge from once-trusted protocols and services, that captures emerging risks in DNS and SSL.

A companion article, Invasion of the botnets: Cyberattacks on the rise, highlights the enormous increase in botnets and malware over the past year:

“Malware is at the highest point we’ve ever seen it,” said Dave Marcus, director of security research at McAfee Avert Labs. “2008 was the biggest year so far. The first half of 2009 has eclipsed all of 2008,” with 8,000 new variants appearing each day. “It’s easier to create new malware than ever before.”

Symantec reports similar activity. The company created 1.6 million new threat signatures in 2008, or about one new signature every 20 seconds. It has created 2 million signatures in the first half of this year, or about one every eight seconds.

The situation is getting worse, not better. With DNSSEC we close the immediate problems with DNS and SSL and we go a long way in closing attack vectors such as email and web site redirection.