The Ashimmy Blog

The road to perdition is paved with good intentions

So Captain Privacy, my friend Martin McKeay has reacted with the expected outrage over the disclosure that a school district in Pennsylvania had installed “spying” software (not spyware mind you, spying software) on some school issued laptops. I won’t bore us all with a recap of what the Lower Merion School District did. You can read the summaries of it here and here, if you  have not already heard the facts.

Let me start off by saying using the spying software for any thing other than the legitimate use of tracking down a stolen or lost laptop is wrong! If anyone were to do that, especially without notice to an innocent party, let alone a minor, they are guilty of abuse of power.

But before we go off and castrate the school officials involved and as Martin says those “. . . who instigated and ran this program need to lose their jobs; they obviously don’t have enough of a moral compass to understand the difference between right and wrong and have no right to be working with children and teaching the next generation.”

The people who thought of installing this software may not even be the people who used it. It was a perfectly reasonable assumption they made in any event. In case the laptops were stolen or lost, wouldn’t it be great to be able to find out where they are. 

The idea of “spying” on kids when the laptops weren’t stolen was probably just not given a lot of thought. As one of the first school districts to give out laptops to all the children, there was no “book” for them to follow. They were kind of making it up as they went.

Yes this program left open the possibility of abuse in the wrong hands. We would think that school officials would be sensitive to the rights and privacy of minors. We also trust police officers not to violate the rights of the criminals. We trust soldiers not to torture POWs. Sometimes that trust is misplaced. Sometimes people disappoint us when we have trusted them.

The thing about this case though is that much of Martin’s hand wringing is over what could have happened. Only one incident of what did happen. Do we now live in the world of the “Minority Report”, where the thought police are going to prosecute people over their thoughts or worse yet over “what could have happened”.

As much as I don’t want to give up my privacy, I don’t want any thought police or prosecutions over what could have been.  Martin and the mob has jumped to worst case scenarios without knowing who these people are, what safeguards may have been in place or anything else.

At the end of the day, anti-theft measures for school owned property is a good thing. This program did not seem to have the proper checks and balances in place to prevent any potential abuse which might have, but did not necessarily occur.

Other school districts should learn from it, but should not be dissuaded from handing out laptops to kids or installing anti-theft technology. I am glad Martin’s kids don’t need to take any computers home. But I assure you that there are millions of kids in the country who do!

Related articles by Zemanta

• Spying defies belief (computerworld.com)
• Laptop-Spying School District Superintendent Covers Ass By Claiming Security Feature [Privacy] (gizmodo.com)
• School backs off on laptop spying policy in wake of lawsuit (arstechnica.com)
• School: Webcams used only on missing laptops (msnbc.msn.com)
• School Watches Kids on WebCams (momblognetwork.com)
• Pa. School: Webcams Used Only on Missing Laptops (abcnews.go.com)
• School district: Spy Webcams activated 42 times (news.cnet.com)
• US school accused of web spying (news.bbc.co.uk)
• The Pennsylvania School Spycam Story Grows More Complicated (abovethelaw.com)
• FBI said to be probing Pa. webcam case (msnbc.msn.com)
• School allegedly uses students' laptop webcam for espionage, lawsuit ensues (engadget.com)
• Hey Teachers, Leave Them Kids Alone! (trueslant.com)
• Pa. school: Webcams used only on missing laptops (seattletimes.nwsource.com)

InfoSec Institute buys Intense School assets

This blog has become something of a clearinghouse regarding Vigilar’s going out of business and the Intense School tragedy.  I am happy to report some good news today.

Jack Koziol of the InfoSec Institute wrote me to report that InfoSec Institute has purchased the assets of the Intense School. A notice on the Vigilar site is up confirming this as well.

Jack assures me and the notice on site verifies that most of the Intense School teachers have been retained as well as the courseware and other methods, assets and IP of the Intense School.

This is certainly a happy ending to a crappy story for many of the students and teachers at Intense School.  InfoSec Institute has a great reputation.  Here is wishing them luck in continuing some of the great training that Intense School provided.

I would be interested to hear from students of the old/new program as to what their experience is.

Related articles by Zemanta

• Message from Barry on Intense School (ashimmy.com)
• Are the Vigilar / Intense School instructors getting paid? (ashimmy.com)
• Looks like Vigilar is toast (ashimmy.com)
• Even more on Vigilar and Intense School (ashimmy.com)

Rogue software support from Software-HQ certified by Trustwave

In a recent podcast with Mitchell, he and I were bemoaning the fact that it is just so hard for non-technical users to not get gamed or scammed on line. One of the type of scams I hate the most is the rogue AV and rogue security software scam. What a kick in the butt. Using fake security software to infect a computer.

Tonight I came across another type of rogue software I want to call out. What made this one worse is that Trustwave is certifying these folks. What these people are doing is wrong, Trustwave giving them a seal of approval is worse though. Did anyone at Trustwave even check this out? Come on now, I would expect more from Trustwave!

It all started when I realized that my Windows 7 install did not have Windows Media Player. I did a search for Windows Media Player in Bing (BTW, Google didn’t have this link, I checked later). The first link in Bing, which is I guess a paid link was for a site that advertises Windows Media Player 11. The blurb says download Windows Media Player 11 – 100% guaranteed. I clicked the link and went to a domain at http://mediaplayer.11-now.com/. It had a very Microsoft look and feel, though it did have a disclaimer down at the bottom. There are two big click to download buttons and I did. Instead of download though I was taken to a page for an order sign up.

Turns out they want me to pay 19.95 for the year or 12.95 a year for 3 years. For this they are going to give me:

Technical Support When You Need It

Awesome "Up to date" Flash Tutorials

Unlimited Software Downloads

Complete Downloads

Never Pay a Download Fee

Instant Access After You Sign-up

Access to the Hottest Software

This service is run by a company called Software-HQ and their domain is http://www.software-hq.net.  They claim to have all of the hottest software for you to download. Programs like Winzip, Paintshop Pro, Ifran and more. All shareware programs that you can download anywhere on the net. If you buy these programs and register them, the makers of the program offer you support. So what exactly is software-hq giving? Ice cubes in winter that’s what! They are going to let me have unlimted software downloads, that are complete and the latest versions? Right after I pay them they will give me instant access to these hard to find programs? Stop! Stop! Stop! This is ridiculous.

Think of some of your relatives who might be duped by this and turn over the 20 bucks. Do you think they are getting value? I don’t think so, I think it is just another rat hole on the Internet that needs the light of day shined on it.

Trustwave what are you doing certifying this? Would you certify a ham sandwich? Where is the quality control here? You are a security company supposedly, you should know better!

Its a mad, mad, mad world

Regardless of whether you think the  Aurora/Google/China incident was a simple hack or the most sophisticated thing since the cotton gin, I think it is going to mark a historical demarcation line. From this point forward the PA (post-aurora) era will have governments, corporations and individuals the world over recognizing that the new battleground is a cyber zone.  This is a lesson that the folks in the US Department of Defense have recognized for a long time. While we were busy every year yelling about FISMA and so forth, the people on the front lines of this cyber cold war have been trying to stay afloat against a sustained assault on our networks that has been going on for years. They are not perfect, but the fact that a genuine disaster has not occurred as a result is no small testament to their diligence, hard work and intelligence.

Whether you take the position that Rich Mogull has laid out in his firestarter post on APT, namely that this is espionage and not warfare and we just need to deal with it or the NY Times approach that the Google/Aurora incident was part of the ongoing digital warfare that is underway, is I think irrelevant. When I boil it down, it is only a matter of degree. Espionage is an act of war, punishable by death. You can have cold wars and hot wars and then there are simmering wars. This new war is of a different type of war, but the stakes are no less dear. It is for control of the world. 

We are in the 2nd decade of a new century. There are many countries who think that it is their manifest destiny to become the "America" of the 21st century. This war, like many before it is for economic dominance. This makes private corporations that are economic powerhouses targets. Don't think for a second that we here in the US are not gearing up for this type of war either.

For me the real issue is that the game and the rules have changed here. We have not yet come to terms with how this game should be played or even what the rules should be. We are still a cold war generation. Our rulers learned the game during the cold war rule set. We yearn for a deterrent that will put the brakes on an adversary going beyond what we deem to be the line.

In the good old cold war we had MAD. Mutually assured destruction was what we could bank on. The Soviet Union  didn’t want to end the world anymore than we did. We and they knew that if we allowed things to go to far, there was no turning back. So we could have our little “hot wars” in Korea, Vietnam, Afghanistan without pushing either side too far. Only the Cuban missile crises really brought us to the brink.

Of course we let our surrogates fight the fight the world over. We supported them with weapons, money and training. So did the other side. There were lots of little skirmishes that did not directly have our troops involved, but were part of the game nonetheless. The bottom line is that there was an understanding of what would be tolerated and what would not be tolerated. The prodding and probing was as ritualistic as anything from the feudal societies of the middle ages.

In cyber warfare (sorry Rich it qualifies as warfare. The stakes are as high in terms of human life and resources as any other war. Especially when we are talking about critical infrastructure) there needs to be a tacit understanding of what will be tolerated and defended versus what goes to far. We need to decide what are the repercussions for going to far.

Having Google pull out of China is one remedy, but if one nation or faction or entity violates the rules of the game, the consequences need more bite. They should be ostracized by all the others. It should be made clear that the cost of undertaking such action, far outweigh the benefits. Whether the Aurora incident was with the knowledge of the Chinese government or not, the message has to be to “take care of your own”. They are responsible.

I don’t have the hard and fast answers as to what those consequences should be. But we need to set the rules now. Right now it truly is a Mad, Mad, Mad World. The game has changed. The players are making up new rules as they go. You can’t play a game without rules. That become anarchy. But the balance will be restored, it always does. We just need to make sure the rules are understood by all parties and that it is better to play by the rules than outside of them.

Related articles by Zemanta

• US National Security Policy And Nuclear Weapons: Perspectives on the Nuclear Posture Review (dailykos.com)

Is this the smoking gun for Aurora?

So it seems some researchers from Zscaler have found the Aurora malware resident on a Chinese government website.  Anyone going to the site would be infected by the same thing that Google, Adobe and others a few weeks ago. Up until now though it was suspected the attacks were Chinese based, whether or not the Chinese government was involved or tacitly approved of the hackers actions was a very touchy subject.

Byron Acohido over at USA Today broke this story. You would need root access to put this on the server according to Achohido.  So how did it get on the Chinese governments server? Good question.  I will be doing a full blown follow up to this whole matter tonight, so stay tuned. But for now, is this the smoking gun?

Related articles by Zemanta

• Evidence Weakens That China Did the Recent Cyberattacks (tech.slashdot.org)
• Alleged Employee Role in Google Attack Highlights the Importance of Computer Security Education (mwd.com)
• Security researcher IDs China link in Google hack (sfgate.com)
• VeriSign says Chinese government was behind cyberattack on Google (downloadsquad.com)

It's about the jobs stupid

One of my favorite authors, commentators and people is Thomas Friedman. I just think he is so dialed in to what is going on in the world. He not only points out what is wrong, which many of us can do, but he suggests ways to fix it. Why he is not in public office or part of the administration is beyond me.

Anyway he has a great Op-Ed piece up in the Times today.  He urges President Obama to learn the lessons of Massachusetts and correct the mistakes of the past year. Return to the working with the people, not Harry Reid and Nancy Pelosi. He urges a program to create real permanent jobs. He says we need to make this year the “year of innovatoin” and the year of “Start up America”. 

He says it better than I ever could, so just head over and read it. But I agree with him 100%!

Round up the usual bloodsuckers

You have to love it when general interest type business publications delve into security. BusinessWeek has an article up telling us that all of the Google/China stuff bodes well for the security industry. They specifically site Symantec, McAfee and Checkpoint as being poised to profit from everyone else’s misfortune.

The evidence they use are the recent stock prices of Symantec, McAfee and Checkpoints. They also talk about Mike Carpenter, who heads up McAfee’s public sector sales. Mike says since the Google/China news broke he is really busy.

OK here is my ashimmy analysis on this:

1. I think most technology stocks have seen a decent jump over the last few months. The rising tide lifts all boats including these coffin-ridden vampire ships. Yes there might be a short term jolt from the Google affair (like the Dreyfuss affair. Extra points if you know what that is), but I don’t think long term it will be a big effect.

2. Mike Carpenter has been saying he is in meetings day and night for years. Mike and his public sector sales team at McAfee do a great job of convincing the government that ePO everywhere is somehow a successful security strategy. Then Mike spends most of his time in meetings explaining that they will integrate one day with 3rd party apps, why HBSS can or can’t do whatever you want it too and why to really get the value you have to buy even more McAfee software. I don’t think Mike’s schedule has anything to do with the state of the security market.

3. These kinds of articles make the whole security industry seem like a bunch of blood suckers. We wait around for doom and gloom to befall potential customers, before we swoop in and suck them dry for bigger profits. I know vampires are cool these days, especially with younger girls, but is this really the image we want portrayed of our industry? I don’t.

4. I agree with Brent Thill of UBS from the BusinessWeek article. He says security stocks do better during the downtimes then they do in the economic recoveries.

So, yes the Cyberwar is on. The truth of the matter is that it has been on for years. Just not everyone knew it. We as an industry rather than being seen as shadowy creatures of the night should be out front leading the fight. I would rather be the GI Joe of the Cyberwar, than the vampire of the security gold rush.

Related articles by Zemanta

• France and Germany warn users not to use Internet Explorer (seattlepi.com)
• IE 0-Day Flaw Used In Chinese Attack (tech.slashdot.org)
• Three lessons for businesses from the Google attack (computerworld.com)
• Symantec, McAfee, Checkpoint Await Spending Surge (businessweek.com)

In the cloud what's old is new again

I saw an article on C/Net tonight that caused me to have a deja vu moment. Dave Rosenberg wrote about IBM grabbing the largest cloud deployment to date. IBM will host for Panasonic at first up to 100k Lotus Notes live users “in the cloud” and moving up to 300k. Hosting Lotus Notes in the cloud. Wow, cutting edge! My CISO Group partner Parker Yates, will get a kick out of this one too.

It was just about 10 years ago that Parker and I were at Interliant. We had just gone public a few months before and neither of us knew that we were staring into the precipice of the dot com bubble bursting. Interliant was a pioneer in what was called ASP – application service provider for you kids out there. Our bread and butter hosted app?  Lotus Notes on Lotus Domino servers. Domino R5 was the hot stuff then. We were a major partner with IBM and probably the largest hosted Notes provider in the world.

Reading Dave’s article about what IBM was offering in this record shattering cloud deployment, I went to the wayback machine and had a look where Interliant was then. Here is what we were offering right before 9/11:

Customers access Notes mail and applications on Domino servers that reside at an Interliant data center. Users' Notes clients (or Web browser) access servers at Interliant over the Internet or via a direct connection such as Frame Relay. In addition to mail and application servers, customers' Internet Gateway (SMTP) and "hub" servers all reside at Interliant, thus fully leveraging Interliant's world class facilities.

Sounds pretty cloud like to me. What about you? Frame relay? Pretty cool, huh? I know, I know, you are saying, what about the security? How can you have a cloud without security?

Well here is an excerpt from the managed security solution listed on the same web site:

Our INIT SECURITY solutions are based on best-in-class firewall and Virtual Private Network (VPN) technologies, coupled with qualified security architecture design as well as monitoring and management services. INIT SECURITY solutions leverage state-of-the-art security products from industry leaders, such as Check Point^TM, Nokia^®, and other major vendors. We analyze your security requirements, and tailor a secure hosted solution, available 24x7.

We take away the overhead — you don’t need to buy the software and hardware, or manage the devices. This service-based, hosted approach accelerates your speed to functionality, and allows you to sidestep e-vulnerability concerns.

INIT Managed Firewall Service

This service provides full security consultation, configuration, and on-going maintenance and management of a client’s specific security requirements as they relate to a hosted environment. The service includes set up and installation, monitoring and management, logging and reporting, policy management, firewall updates, as well as quarterly performance audits and policy review.

INIT Remote Managed Firewall Service

This service enables customers to outsource the design, implementation, monitoring, management and maintenance of their on-site firewall hardware and software to professionally certified Interliant security engineers. INIT Remote MFS adds industrial-strength professional services to protect against malicious intruders and potential hackers. The offering includes an initial security assessment, design, implementation, 24x7 monitoring and management, logging and reporting, policy management, firewall updates, as well as quarterly performance audits and tuning.

Key advantages include:

Peace of Mind: INIT SECURITY solutions shield your organization from the anxiety of network and Internet vulnerability — our experts work 24x7 to ensure that your applications and data are always protected                 

Tailored, Best-in-Class: INIT SECURITY experts evaluate your environment to understand where and how you are vulnerable. This means analyzing your business practices and IT infrastructure. We leverage best-in-class technologies from security leaders to protect your environment, and design security solutions to provide tailored support and peace of mind                  

Relevance: INIT SECURITY experts rapidly update and reconfigure your security solution to address emerging threats and changes in your business operations                   
Simplicity: INIT SECURITY solutions allow your organization to sidestep IT complexity — such as deployment and management of your security solution                   
Reduced Cost of Ownership: INIT SECURITY solutions offer hosted access to best-in-class security solutions. You don’t have to extend funds to buy, install, and update the technologies                   
Investment Protection: INIT SECURITY solutions allow you to choose the best solutions today, without worrying about their ability to address tomorrow’s threats. We migrate your solution to harness state-of-the-art security technology. You’re never saddled with obsolete infrastructure

Interliant recognizes the business challenges in today’s competitive global environment — we’ll take total responsibility for your IT requirements, liberating you to focus on your core business.

Guys this was 10 years ago. It could just as easily be on today’s web sites.  Pretty weird right? Are you having a deja vu? So how the hell did we go bankrupt? Maybe we were just up in the cloud before it was cool?

Saying goodbye to the old and looking forward to the new

So I am not going to bore any of you with my retrospect on what the biggest stories of the year or the decade were. For that matter, I am not going to play Nostradamus and make any predictions about what the next big things are for this coming year.

Like many of you, I don’t think history will treat 2009 kindly. It will go down as a tough year for many of us. I think the whole 00’s decade will go down as something of a bummer actually.

I was watching a Robin Williams special on HBO the other day and he said something about the nation waking up from a 10 year daze and asking what happened, what the fu@#k went on.

I have my own personal experiences of course. Professionally I put almost 9 years into building a company based upon a dream and vision that I shared with some friends. At the end of the day I came to realize that dream was not going to be realized in the matter I thought. However, it was not a waste of time at all. I learned so much, met so many and grew so much wiser. As corny as it sounds for me the really important part was the journey, not the destination.

On the family and personal side of things this decade has seen me become a parent. I have watched my two boys grow from little gurgling infants to young boys. I am looking forward to spending even more time with them and marveling at the young men they will become. It is a constant effort to try and lead them in the right direction. A balancing act of applying enough direction to show them the way, but laying back enough to let them find it on their own.

Yes the world at large has experienced some hard times these past years. My hope is that I personally, all of you, and the entire human race will grow and learn from our experiences of the past.

I am more optimistic then ever about the future. I will be announcing my new professional adventure in the next few weeks. I think it is going to allow me to achieve the goals I have set for myself. They are very different than the goals I had a decade ago. But I think they will allow me to achieve peace and happiness.

And that is my wish to you for the new year and new decade. May you achieve peace and happiness by whatever metric you measure that by.

Where is TJX hacker ring member going to get 171.5m?

One of Albert Gonzalez, the TJX hacker’s cohorts was sentenced last week in court in Boston for his part in the big hack according to this article in Wired and Dan Kaplan’s report in SC Magazine.

Stephan Watt, 25 years old, was allegedly a close personal friend and confidant of ring leader Albert Gonzalez who is awaiting sentencing while undergoing psychiatric evaluation to determine if he is competent.  Poor Watt was supposedly just a bit player in the scheme, though he did write the sniffer program that was used to get the credit card information.  He supposedly did not receive any money directly from the crime. I don’t really believe that BTW.

Watt was sentenced to two years in prison and 3 years of supervised release. Plus he was ordered by the court to pay back $171.5 million dollars in restitution for his part in the hacking scheme of the decade, if not the century.

Watt’s lawyer had asked for a no-jail time sentence, claiming there client was just a minor accomplice in the grand scheme (pun intended) of things. He was motivated by friendship and intellectual curiosity, not greed according to his attorney. He had a bright future working at Morgan Stanley, Qualys and some other companies.

In the meantime he was living in an apartment that his Mom paid for. Isn’t that just grand. The big time member of the most notorious hacker ring ever living in a place his mommy bought him. 

So I was thinking if Watt has to stay in the place his mom bought him and he did not make real money out of this scheme, where is he coming up with $171.5m?  That ain’t exactly chicken scratch. 

In reading more about Watt it seems he is in great physical shape and is 7 feet tall. There is the answer! Who else besides hackers have access to that kind of money?  Professional ballplayers. A 7 foot white guy. He should be able to get a gig as a basketball player pretty easily.  He probably can’t jump, but hey he is 7ft. With what they pay pro basketball players, he actually has a shot at paying that court ordered restitution off.

His Mom should pack him off with some basketball sneakers when he goes to serve his sentence. He should practice everyday for the next two years. When he comes out he can join some of the other delinquents who currently play in the NBA. He might even teach them how to hack into each others twitter accounts and stuff.

Related articles by Zemanta

• Document Details Help TJX Hacker Gave Prosecutors (wired.com)
• Inmate gets 18 months for hacking prison computer (computerworld.com)
• Bank Card Hacker 'Will Never Commit Any Crime Again' (wired.com)