White House’s Cyber Security Official Retiring

The White House’s cybersecurity coordinator said Thursday that he is stepping down at the end of this month after a 2 1 / 2-year tenure in which the administration has increased its focus on cyber issues but struggled to reach agreement with lawmakers on the best way to protect the nation’s key computer networks from attack.

Howard Schmidt, who oversaw the creation of the White House’s first legislative proposal on Cyber Security, said he is retiring to spend more time with his family and to pursue teaching in the cyber field.

Reference:

Pre-Boxed Crap

The computer security problems in our country can be easily repaired and monitored. The problem is there are no industry standards for the software we are putting out there, no one is being held accountable, even the automotive industry is finally being held to several safety standards to protect the customers who purchased their vehicles. The way I look at it is we are again, "closing the barn door, after the horse ran away". It costs companies, corporations and individuals mega bucks to fix the software problems after a security incident has happened. Now what would be wrong with security testing the product before it leaves the building??? hmmmm...

...BUTCH

There’s a gap today in requirements. We can quite easily build security into in-house and off-shore developed applications by integrating commonly known requirements. 

For example:

1. We can require that developers not maintain integral state data on the client to defend against parameter manipulation. 
2. We can require that session ids are always sent over SSL. 
3. We can both require and check for these things before an app is deployed, so that the only thing left for crash testing are mistakes that slipped through the cracks, complex domain specific security flaws, and novel / unique security issues that haven’t been defined yet.

We as an industry have spoken at great lengths about security in the SDLC but we’ve only paid marginal attention to secure requirements. It’s time to move on from crash testing.

Ninety Percent of HTTPS Websites Insecure

Recently the most popular websites using secure online transactions (Online stores, banks, communication sites, etc.) were tested for security and most did not fare very well.

Of the approximately 200,000 HTTPS SSL encrypted websites tested, only about 10% are properly secured according to the Trustworthy Internet Movement (TIM).

Also, about 75% of the sites are still vulnerable to a BEAST attack:

Why Security Through Obscurity Still Does Not Work

Utah Department of Health officials say the breach, which they suspect involved East European hackers, exposed information about an estimated 780,000 adults and children. That information included 280,000 Social Security numbers.

Recently I provided Howard Anderson at HealthInfosecurity.com with some of my thoughts about the recent Utah Department of Health breach of the files of 900,000 individuals, and counting.

He included some of my thoughts in his blog post, along with thoughts from others. I wanted to provide my full reply here, along with some expanded thoughts.

As background, for those of you who may not have heard of this hack yet, in a nutshell:
The data breach occurred on March 30. A configuration error occurred at the password authentication level. This allowed hacker(s), located in Eastern Europe, to obtain files containing sensitive information by circumventing the Utah Department of Technology Services’ (DTS’s) security system. 

The files were stored on a server that contained Medicaid information at DTS.

Reference:

Future Security Basics

This incident points out the need for organizations, of all sizes and in all industries, to do the following to help prevent the same type of breach as that within the Utah DTS:

1. Have well documented systems and applications procedures and supporting standards in place that are consistently followed
2. Provide training and ongoing awareness for the procedures and standards
3. Log changes consistently, and have teams responsible for reviewing the logs, and maintaining the logs for an appropriate period of time
4. Perform ongoing audits to catch such configuration errors
5. Have a change control process in place to help keep the mistakes of individuals from being put into production
6. Use intrusion detection systems (IDSs) and intrusion prevention systems (IPSs) to identify inappropriate access as soon as possible
7. Create and maintain well documented breach detection and response plans
8. Establish breach response teams and provide them with periodic training and ongoing awareness communications
9. Engage independent third parties to perform periodic vulnerability scans and penetration tests
10. Encrypt sensitive data, in transit and as rest in all storage locations. As this incident demonstrates, even if a sensitive file is located on a network behind a firewall, the bad guys may possibly still be able to get to it.

Reference:

Chinese Hackers Took Control of NASA Satellite for 11 Minutes

Hacking is becoming a growing problem on Earth. It may seem strange to mention Earth, as there’s not much to hack outside of our planet’s atmosphere unless you count satellites. Even then, how feasible would it be to gain access to the systems running such devices?

Well, China not only has people working on such things, it has been discovered they actually managed to take control of two NASA satellites for more than 11 minutes.

Reference:

2012 dubbed 'Year of the Smartphone Hacker'

Smartphone users are at risk of banking Trojans, spyware and infected apps and don't even realize it, say security experts who predict 2012 will be the "Year of the Smartphone Hacker."

Reference:

Security Professionals Aren’t Immune from Dumbass Moves

Spammers and fraudsters often wiggle into our lives through “social engineering,” pretending to be someone that we think we know.

What are some of the security tricks you’ve fallen for? Fess up in the comments below.
It’s one of the oldest tricks in the book and yet it’s so effective. Guess that’s why it keeps resurfacing. We’ve all seen the bad guys dish out a range of schemes over the years, from using nefarious links embedded in an email to, more recently, social media phishing attacks using these same lethal links in Facebook messages and Tweets.

Reference:

Hackers Steal $90,000 in Bitcoins

Bitcoin exchange site Bitcoinica suspended its operations on Friday after hackers managed to steal 18,547 bitcoins -- valued at about US $90,000 from its online wallet.

The user database probably was compromised as well, Bitcoinica's administrators said in an announcement posted on the site's home page. The information stored in the database included usernames, email addresses and account histories Account passwords were encrypted in a way that makes it extremely unlikely for them to be cracked, the Bitcoinica team said. However, to be on the safe side, the team advised users to change their passwords on other websites where they might have used them.

10 SQL Injection Tools

10 SQL Injection Tools For Database Pwnage


Black hat hackers and pen testers alike use these tools to dump data, perform privilege escalations, and effectively take over sensitive databases


BSQL Hacker 
Developed by Portcullis Labs, BSQL Hacker is an automated SQL injection framework that facilitates blind SQL injection, time-based blind SQL injection, deep blind SQL injection and error based SQL injection attacks. Attacks can be automated against Oracle and MySQL databases, with power to automatically extract all database data and schemas.


The Mole 
An open source tool, The Mole can bypass some IPS/IDS systems using generic filters. It is able to detect and exploit injections using only a vulnerable URL and a valid string on the site using union or Boolean query techniques. The command line tool offers support for attacks against MySQL, SQL Server, Postgres and Oracle databases.


Pangolin 
Produced by the same firm that wrote the JSky tool, NOSEC, Pangolin is a thorough SQL injection testing tool with a user-friendly GUI and a wide base of support for just about every database on the market. Primarily used by the white hat community as a comprehensive pen test tool, Pangolin offers its users the capability to create a comprehensive database management system fingerprint, to enumerate users, dump table and column information and run the users' own SQL statements.


Sqlmap 
A self-proclaimed automatic SQL injection and database takeover tool, the open source sqlmap tool sports the ability to attack via five different SQL injection techniques or directly if the user has DBMS credentials, IP address, port and database name. It can enumerate users and password hashes, with inline support to crack them with a dictionary-based attack and supports privilege escalation through Metasploit's getsystem command. It offers the ability to dump database tables and for MySQL, PostgreSQL or SQL server to download and upload any file and execute arbitrary code.


Havij 
A popular tool used by black hats worldwide, Havij was developed by Iranian coders who named it for the Farsi word for carrort, a moniker that doubles as slang for the male appendage. With a simple GUI, Havij brags about a success rate of 95 percent at injecting vulnerable targets on MySQL, Oracle, PostgreSQL, MS Access and Sybase databases. In addition to being able perform a back-end fingerprint, retrieve usernames and password hashes, dump tables and columns, fetch data and run SQL statements on vulnerable systems, it can also access the underlying file system and execute commands on the operating system.


Enema SQLi 
Unlike many automated tools designed for users with less than abundant technical knowledge, Enema isn't autohacking software, according to its developer, "mastermind." As mastermind says, "This is dynamic tool for people, who knows what to do." Grammatical issues notwithstanding, the tool gives users the ability to customize queries and use plugins to automate attacks against SQL Server and MySQL databases, using error-based, Union-based and blind time-based injection attacks.


Sqlninja 
Sqlninja's developer, icesurfer, puts it best explaining his creation, "Take a few new SQL Injection tricks, add a couple of remote shots in the registry to disable Data Execution Prevention, mix with a little Perl that automatically generates a debug script, put all this in a shaker with a Metasploit wrapper, shake well and you have just one of the attack modules of sqlninja!" Targeted against SQL Server environments, the tool offers database fingerprint, privilege escalation, and all the tools necessary to gain remote access of a database vulnerable to injection attacks.


sqlsus 
An open source MySQL injection and takeover tool, sqlsus runs with a command line interface and lets users inject their own SQL queries, download files from the attached Web server, crawl the website for writable directories, clone databases and upload and control backdoors.


Safe3 SQL Injector 
Widely known as one of the easiest to use SQL injection automation tools circulating the Internet, Safe3 SI offers a set of features that enable automatic detection and exploitation of SQL injection flaws and eventual database server takeover. The tool recognizes the database type and finds the best method of SQL injection, with support for blind, error-based UNION query and force guess injection techniques. It supports MySQL, Oracle, PostgreSQL, SQL Server, Access, SQLite, Firebird, Sybase and SAP MaxDB, with ability to read, list and write any file when the DBMS is MySQL or SQL Server and support for arbitrary command execution for SQL Server and Oracle DBMS.


SQL Poizon 
A SQL injection scanner/hunter tool, SQL Poizon takes advantage of search engine "dorks" to trawl the Internet for sites with SQL injection vulnerabilities. The tool has a built-in browser and injection builder to carry out and check the impact of an injection. It's simple GUI provides an easy interface to carry out an attack without a deep technical knowledge base.


Reference: