Aren’t spammers subtle?

Posted on by

Not having managed a blog with such a public profile before, I’m intrigued by the behaviour of those wanting to spam the comments field.

The blog is set up so that individuals from within the group can post using their Oxford credentials. Others can post comments, but the first time they comment, the comment must be moderated.

Some try posting their adverts for herbal remedies right away. Those are easy to spot and throw away.

There are several, though, who have posted comments like “I like this blog. You make good points.” I assume that the aim of these is that they are likely to get approved by a semi-vigilant moderator because then the commenter becomes a trusted poster.  Presumably, the advertising spam would follow thereafter.

I remark on this

  • (a) because other members of the group may moderate comments, and should be on the lookout for this ‘trojan’ behaviour;
  • (b) because it points to a greater degree of tenacity on the part of the spammers than I would have realised existed;
  • (c) because it seems a particularly hard problem to solve, CAPTCHAs notwithstanding.

webinos secure storage: a cross-platform dilemma.

Posted on by

Encrypted storage for sensitive data and credentials is an obvious requirement for any system with pretences towards being secure. As part of the webinos project, we have been thinking about solutions to this problem which work across multiple platforms.

As a brief recap: the webinos project aims to design and deliver an open source web runtime for four types of device: smartphones, media centres, PCs and in-car computers.  It will provide a set of standard JavaScript APIs for accessing device features from web applications, as well as synchronising data and providing a “seamless” end user experience.  We’re working on it with over 20 other companies and are primarily researching the security and privacy aspects of the system.  More details are available on our website: http://www.cs.ox.ac.uk/projects/webinos/

In webinos we think we have (at least) the following data to protect:

Continue reading →

revisiting email retention

Posted on by

I have an archive copy of just about every email I’ve sent or received since about 1996, and certainly haven’t deleted an email since 1998 – not even the spam.  Many people know this – and many colleagues do something similar.

I suppose I have two reasons for doing this:

  • trawling the archives is occasionally useful (for finding information, or confirming what someone said, or being reminded what I said); because just about all of my work is eventually mediated (in and out) by email, the mailbox archive plays the role of a professional journal.
  • the process of filing and deciding what to retain and what to delete is insanely time-consuming, and easily costs more than the now insanely cheap cost of disc storage and associated backups.
This approach actually extends beyond email – I haven’t really deleted a file in a decade or so.

Lost Treasures

Posted on by

Some say computer science rediscovers old ideas every twenty years or so. Justin mentioned it last week in the context of explicit vs implicit information flows. I was reminded again today when I saw a call for papers from IEEE Security & Privacy titled ‘Lost Treasures of Computer Security & Privacy’ [http://www.computer.org/portal/web/computingnow/spcfp6] for a special issue next year. The list of topics the editors seek makes for fascinating reading, but I wish to note a different, practical reason.

When tracking down a reference a few months ago, I ran into an example of what librarians call a ‘black hole’ or ‘dark age’: periods of history inaccessible due to changing technology. The document I was looking for contains hearings before the U.S. Senate Select Committee on Small Business, 85th Congress, in 1957. But when I went to that room in the regional depository library, all I found were pieces of shelving on the floor. The microform collection is being digitised and decades of microfilm are ‘temporarily unavailable’, where temporary may mean upwards of a year or more.

What other instances of forgotten lore have you personally encountered?

secure boot gone viral

Posted on by

After the spread of some information, and some mis-information, the story of secure boot in Windows 8, achieved through security features of UFEI has gone viral.  Linux forums all over the web are suddenly full of activists angry about some evil corporation wanting to deprive them of free software.  The aforementioned company has issued a long blog post by way of clarification.

The issue

In brief, the point is that there are plans to replace the BIOS – the main body of firmware which sets up a PC to be ready to run an operating system.  A key task of the BIOS in most systems is to start the boot loader program (or ‘pre-OS environment’), which in turn loads the operating system and gets it running.  This process is prone to attack: if someone can run an alternative boot loader (or reconfigure it, or launch a different operating system), they can either steal all the data on your disk, or they can launch something which looks just like your operating system, but is subverted to send copies of all your secrets – such as everything you type – to the bad guys. Continue reading →

How not to look like a spearphishing attack

Posted on by

This is not a protip on how to make your spearphishing attacks more effective.

Today I received an email on my work account. It happens to be at a large defence contractor, and that’s relevant. Because spear phishing attacks are a primary threat in my environment, and they look just like this:

From: [redacted] SPAWARSYSCEN-ATLANTIC, 987654 [[redacted]@navy.mil]
To:
From:
Subject: EXTERNAL: Intelligence Advisor
Attachment: Newsletter_1.docx
 
All,
 
Attached is our latest Newsletter.  Please review.
 
r/
[name redacted]
ASSO/Security Specialist
SSC-Atlantic SSO
[telephone redacted]
[fax redacted]
https://iweb.spawar.navy.mil/depts/[redacted]
For Official Use Only - Privacy Sensitive - Any misuse or unauthorized disclosure may result in both civil or criminal penalties.

A few things stand out in that email: the empty To: and Cc: fields, the extremely generic filename of the attachment, the fact that the attachment is, or at least appears to be, a Word document; and in the body of the message, the odd capitalisation of ‘Newsletter’, the imperative phrase ‘Please review.’

I took the precaution of examining the mail headers in detail.  Thanks, Microsoft, for making that difficult to do.  The Received: header chain looked reassuring; it came from the expected place.  Interestingly, I only now noticed that the email was digitally signed.  The icon is so tiny I overlooked it.  Thank you, Microsoft, again for hiding that piece of important information from me.

I was still wary about the attachment, though.  After a suitable period of contemplation, I clicked on it.  The expected warning message from the OS appeared: “you should not open files received from unknown senders”.  Why show me that warning message when it knows that the message is digitally signed?  Instead of saying it’s from an unknown sender, why not show me the certificate path of the digital signature?  My future career prospects flashing before my eyes, I hesitated.  Instead of opening the attachment at once, I decided to try scanning it first with my computer’s anti-virus programme.

And promptly received a demand for the Administrator password—which I don’t have—because apparently that’s not something users are allowed to do.

So my question for the community is, how can this problem be solved?  Crippling suspicion can’t be good for the efficiency of organisations.

P.S. It was not a spear-phishing attack.  I had a nice conversation with the sender later and we comiserated over the state of trust on the internet.

 

seeking evidence

Posted on by

Conventional wisdom says:

  1. Security through obscurity doesn’t work.  You may hide your needle in a haystack, but it’s likely to come back and stick into you (or someone who will sue you) when you least want it to.  Much better to lock your needle in a safe.
  2. You shouldn’t roll your own controls: whether crypto, or software, or architectures, or procedures.  The wisdom of the crowd is great, and the vendor can afford better security expertise than your own project can, because the vendor can amortise the cost over a much broader base than you can ever manage.

And yet, when I want to protect an asset against a fairly run-of-the-mill set of threats, it’s very far from clear to me whether that asset will  be safer if I protect it with COTS products or if I build my own, perhaps quirky and not necessarily wonderful, product.

audit in the 21st century

Posted on by

One of the big annoyances in my working life is the procedure for claiming expenses.  Our University seems eager to retain processes which would have made sense in the first half of the 20th century, which involve a large – and increasing – volume of paper.

One of the problems with this is that as a method of holding people to account, it’s very poor.  The big items of expenditure are conference registration fees, airfares, and hotel bills.  In many cases, the receipt for each of these reaches me by email.  The process of claiming the money involves printing out those emails (PDFs, whatever), and stapling them to a claim form.  If the cost is in foreign currency, I also (bizarrely) have to nominate  an exchange rate, and print out a page from somewhere like www.xe.com to prove that that rate existed at some nearby point in time.

Of course, any of those evidences could trivially be falsified. Continue reading →

cloud failure modalities

Posted on by

There’s a tale of woe getting some airtime on the interwebs from an angst-ridden New York undergraduate (reading between the lines) who has somehow had an entire, quite substantial, google account deleted. The post’s contention is (or includes) the idea that deleting such a profile is tantamount to deleting one’s life, I think. The facts of the case are murky – I’d link to some Google+ discussions, but I can’t find a way to do that – but regardless of this particular young person’s predicament, the story highlights some bigger questions about trusting cloud services. Continue reading →