Security Adviser | Roger A. Grimes » January 2008

January 25, 2008 | Comments: (0)

Control user installs of software

TAGS: User behavior

Learn how to verify the status of applications and data without wresting all control over what users put on their hard drives

I've written many times over the years, including as recently as last week, that letting users execute and install their own software will always allow viruses, worms, and Trojans to be successfully installed. Traditionally, I've recommended that users not have admin or root access, that they let system administrators choose what software is allowed and what is blocked. But this recommendation breaks down for several reasons.

First, it doesn't cross over to home computers. Most home users are end-users and system administrators, all in one, even though they're the ones most likely to install malware. Businesses, in general, are less likely to run malware than the average home user because businesses enforce computer security, deploy anti-malware programs, and so on.

Second, I can't think of a single end-user who likes to have someone else decide what they can and can't run and install. I've probably had more hate mail and comments on this than on anything else (other than when I foolishly insult Mac or Linux users). If end-users want to install the latest Windows Media Player codec to watch the newest Paris Hilton waste-of-AV-time video, why not? Who cares if the codec is a Trojan that wants to steal their identity, right? Freedom comes with a cost! I've even had respected InfoWorld colleagues take me to task on this point.

An expert solution
One solution is not to have someone more knowledgeable about nasty software decide whether a particular program or downloaded content is malicious, but to automate the process. I'm not just talking anti-virus programs, which look at only binary signature comparisons and sometimes use heuristics to detect specific behaviors. I mean client-side software examining the program's or content's entire binary (think: cryptographic hash) and making an intelligent, informed decision before the content is executed or loaded.

Several personal firewalls, including ZoneAlarm, will check to see if a local program requesting outgoing network access is normally approved by other users. This is closer to what we need, but it covers only network access and around 100,000 applications. It doesn't prevent local execution, but that's to be expected for a firewall product.

SignaCert, which I've reviewed before, is developing a global file hash database, through which it hopes to catalog every executable file in existence. SignaCert excels at scanning computers to find known and unknown programs, and it's in possibly the best position to contribute to (or lead) the greater vision.

The greater vision
The greater vision is that all computers run a client-side program, potentially embedded in the operating system, that measures the cryptographic hash of all programs and content being downloaded to the computer. Before the program is run or the content loaded, the hash is sent to a global database on the Internet for analysis. The database has a list of programs and content, as well as their related cryptography hashes. Additionally, each registered program has been ranked by security professionals as to the program's security, privacy, and operational methodology. There can be several main categories, each with varying levels of trust, that developers work with. Think of it as kind of like Common Criteria, but with a broader scope.

The idea is that the global database can act as each end-user's personal security advisor and recommend a go or no-go decision. A simple end-user message might say, "This program has been found to collect personal identifiable information, redirect Internet browser searches to paid locations, make potentially malicious modifications to your computer system, and send collected information over outbound network connections to multiple servers. Its legitimate intent cannot be confirmed. Most users have chosen not to install."

Another program, having the exact same behavior, might come from a trusted vendor and be recommended for installation. But at least the end-user would know that the program modifies their system in readily transparent ways. This might encourage legitimate vendors from slipping in "phone home" features without making users aware of why they're doing it.

Media content can be verified not to have known backdoors, malicious scripting, or other unexpected consequences. By default, unregistered programs and content would not run, or they would be subjected to additional scrutiny and controls (for example, sandboxing). Many programs are digitally signed today, but users still don't know what they do.

It is unrealistic for most end-users to be as knowledgeable as a 20-year computer security expert. So doesn't it make sense for us to help innocent end-users, who just want to do their jobs and have a little fun with their computers, make informed decisions?

Because ultimately, we don't want to stop end-users from installing and running any programs they want -- just the bad ones.

Posted by Roger Grimes on January 25, 2008 03:20 PM

January 18, 2008 | Comments: (0)

Internet security: What will work

TAGS: Internet Security

Here's a radical plan for making the Internet safe for every legitimate user

In the first column of this year, I discussed computer security outlook and hopes for 2008. I forecast more of the same that we saw in 2007: more spam, more malware, more bad guys basically owning the Internet and our connected computers. I don't see any trends or new leaders with significant power to change the status quo.

That doesn't mean there aren't solutions. Last year, in several columns, I detailed one of the ways that a more secure Internet might be forged in the future. It's my vision. And the more I think about it, it's the only way I can see the Internet becoming significantly more secure. All other plans that I've come across break down under scrutiny or seem to rely on us becoming accustomed to a significant amount of computer crime. The other plans might reduce computer crime, but only temporarily and by a small amount.

I'm far from a computer genius, but I have convinced myself, and a few others, that my plan is right and everyone else's plan is wrong. Boy, I love having my own column.

The perfect plan
Here's my plan in a nutshell: All computer devices, users, and transactions must be authenticated by default.

That's it.

Why do malicious hackers hack? Because we can't catch them. Until we put in place default mechanisms to ensure that most criminals are identified and caught (instead of the current tiny minority now apprehended), hacking will continue unabated.

Instead, we must make all computers, users, and their network communications authenticated and identifiable by default. We start by making hardware impervious to hardware hacks. If someone hacks the hardware, it will refuse to boot. Personally, I don't want to stop hardware mods to iPhones and Xboxes. I just want to stop malicious hackers from modifying participating hardware in such a way that it bypasses all the other mechanisms I propose. Like in the OSI model, if you compromise a lower layer, you can't trust the upper layers.

After verifying a hardware device's boot sequence, the firmware/software portion of the boot process would be verified and accomplished. Each device would have a unique hardware ID that specifically identifies the device and cannot be spoofed.

The user is authenticated using two-factor (or more) or biometric identifiers. Network administrators where the computing device originates, whether on a corporate network, an ISP, or a telco switch, would be held accountable for correctly authenticating the users on their networks.

All OSes and programs would be authenticated and approved before running. If the executable or supporting file isn't approved, it doesn't load into memory. If you allow users to install everything they want without some sort of security approval, then you will never stop bad things or bad people from abusing computers. I'll discuss this more in next week's column.

Because approved users can still do bad things using approved programs, it's essential that network packets be authenticated from source to destination, and traceable back to their originating point. This will prevent a user from creating malware and sending it to another location, or prevent a malicious user from using another innocent user's computer to do the same. In my Internet world, if the bad guy "borrowed" someone else's computer, we'd always be able to trace the perpetrator back to their lair.

Routers and networks that carry our information from point A to point B would also be authenticated and their unique identities added to each passed packet. It wouldn't be as slow as you think -- network devices are working at electric speeds (the speed of light minus minor, unavoidable impedances). Tacking on a unique, authenticable identifier will not add that much overhead.

The downside
Unfortunately, my brilliant idea (probably already thought of by a hundred other great minds decades ago) requires a complete rebuild of every involved component: hardware, software, and user logons. The good thing is that most of the technology and smarts to make it happen already exist. A tweak here or there is all that is needed...well, that and universal cooperation and planning.

Because we like to do things in evolution vs. revolution, my model proposes "rings of trust," where differing levels of trust can be defined by each participating party. Users and computers not up on the latest computer security checks will be assigned a lower level of trust and have to go through additional (traditional) layers of security checks (anti-virus, anti-spam, and so on). Traffic arriving from users and computers with higher levels of trust will go directly to their intended destination.

Yes, even this system will be hacked, but it will fix the discovered problem, and all malicious exploits of that vulnerability are prevented at once. This beats our current game of "whack-a-mole" security defense.

If you don't like my plan, stay with the current status quo or make up your own plan. Stay on your version of the Internet and compute away. I'm hoping that someone powerful enough, a consortium of enough interested people and companies, comes together to make my vision a reality. Dare to dream.

And if you can make up a better solution, the world should beat a path to your door. Until then I'll just continue to believe my solution is the only one.

Posted by Roger Grimes on January 18, 2008 03:31 PM

January 11, 2008 | Comments: (0)

Security design: Why UAC will not work

TAGS: Malware

Pinning all your end-point security hopes on UAC assumes that criminals are not as smart as they really are

It's security's dirty little secret: Not having your users logged in as root or administrator will not stop malware.

There is a huge public security thrust to ensure that users are not constantly logged on with highly privileged access. In Microsoft Windows, this means not being logged in as a member of the administrators group or any of the other 17 groups with admin-like privileges (for example, Power Users). In Unix/Linux/BSD, this means not being logged in as root or bin or whatever else is close. In the AS/400, it means not being logged in as Qsysop or Qsecofr. For mainframes, it might mean superuser, terminal 0, or another user label indicating special privileges.

Unfortunately, the concept of least privilege is more a popular mantra than a rule in most environments. This is especially true at home, but it's nearly as bad at work. If you want to find someone logged in as administrator or root all the time, point your finger in the general direction of network security folks: "Do as I say, not as I do."

Microsoft is trying to encourage users and developers to go least privilege by introducing UAC (User Account Control) in Windows Vista, and the Unix/Linux/BSD folks have being trying for a decade longer with Switch User (SU).

No panacea
The problem is that even if no one ever logged in as a superuser, it wouldn't make a dent in the ability of malware writers to do bad things to us and our computers.

It would stop a lot of the current malware, but only because they are designed (like a lot of today's legitimate software) to expect the user running it to be logged on as privileged. And in most cases, this is a good assumption. Most users are logged in using privileged accounts, but malware doesn't need privileged access to do bad things.

Even today, there are hundreds of malware programs that can do all the nasty things they want: modify your computer, steal your identity, whatever, without ever needing admin or root access.

Forget for the moment remote buffer overflows, social engineering, phishing, and all the other sorts of maliciousness that don't care about your logon credentials; malware doesn't need to modify your system files to cause problems.

On location
It's always been a mystery to me why Windows malware tries so hard to modify files or place itself in the System32 directory. Most people say it's because the malware wants to modify the Windows OS, and that's true. But the System32 directory location isn't needed. I've been keeping a table of all the ways and places that Windows malware can locate itself to cause damage, and I have more than 130 entries. My Linux/Unix/BSD list is much smaller, but contains a few dozen locations. Many of the listings on both documents do not require admin or root access to manipulate.

For example, most Windows malware modifies the HKey\Local_Machine\Software\Microsoft\Windows\Run registry key, but I have dozens of other keys that can be modified to launch just as easily. For instance, malware can use the user's own registry profile keys instead. Users always have Full Control to their own profile's auto-run registry keys, and they are checked (and the listed programs launched) by the computer after executing code in the machine's startup areas.

Let me be more explicit: There is nothing that malware can do today that can't be done without privileged access. I'm not talking about the way they can modify the system, but the intended result of the modification. Malicious hackers may not be able to modify System32 or sbin, but they can still intercept your identity and steal all your money, without modifying your operating system or (in the case of memory-resident-only malware) a single file.

Next steps
Just to be clear: Not having admin or root access does limit the possibilities for malware writers. They can't take their pick of all the current low-hanging fruit, but there are still plenty of ways to hack a user's computer without privileged access, and that's the pity. For years and years, we've been saying that users need nonprivileged accounts to do most of their work. We say this as if it is the Holy Grail of computer security -- as if it will end all malware as we know it today. But ultimately, this one change won't amount to a hill of beans. Malware writers will learn what it takes to do all the things they need to do without requiring admin access. They have many malware programs they can study today, and certainly, they will develop many new methods in the future.

Stopping malware isn't as easy as not being logged in as a nonadmin. For a real, long-term solution, see next week's column.

Posted by Roger Grimes on January 11, 2008 03:41 PM

January 04, 2008 | Comments: (0)

Security predictions for 2008

TAGS: Future Security

A recap of 2007 and what to expect in the coming 12 months

At the beginning of each year I like to talk about what did or didn't happen during the past year, and what to expect in the coming year. Unlike past years, I'll try not to get too emotionally ramped up on all the failures.

First, the good news
Overall, compliance laws (and years of bad press) finally forced most organizations to encrypt more data and laptops by default. Chances are these days that if a thief steals a laptop it will be password protected and its data encrypted. More developers are utilizing SDL (secure design lifecycle) in their programming, taking into account from the beginning the malicious risks posed to and by their applications. Overall, exploits aren't down significantly, but they are in the software where SDL is used. In addition, more organizations are using stronger password policies and two-factor authentication. All of these trends are good.

Now, the bad news
Sadly, the overall computer security picture hasn't changed much. The Internet is still a very dangerous place to compute. Malware, adware, and spam still make up a very large portion of Internet traffic. Professional criminals control millions of computers turning our futuristic superhighway into the wild, wild, west. Personally, nearly every PC I investigate is filled with worms, spyware, and adware. Antivirus software continues to be embarrassingly inaccurate against the newly created malware churned out each day. Distributed Denial of Service attacks still go on unabated and are very hard to defend against.

We still aren't catching many criminals. Sure, there are headlines about a few people here and there getting arrested, but apparently those being caught aren't making a dent in the real problem. It's like the war on drugs in the United States: We've spent billions of dollars over three decades and drugs are still just as plentiful as when we began the war. In both cases we don't seem to change course even though the current strategy isn't working.

There were no promising wide-scope, technological advances in the computer security arena to give me hope that next year will be any better. There are no leaders or groups with significant power stepping up to lead us into a more secure future. The malware writers and criminals are all smiling into the new year and sleeping well.

The future
Predicting the future of malware is actually pretty easy. All you have to do is look at the increasing trends and figure out what technologies and platforms will be hot in the next year or so. Hackers hack what is hot.

If Apple computers gain market share as I'm sure they will do in 2008, then you can expect more Mac malware. Mac malware is showing up in greater numbers, and Apple already has its hands full patching and re-patching the Mac OS, Quicktime, and other related software. Apple patched more than 200 vulnerabilities in 2007. If history is a good judge of future behavior, then Apple will suffer through a few widespread exploits in 2008.

Windows Vista will continue to be attacked and exploited. In 2007, the number of publicly known exploits of Vista was down compared to those of XP (as predicted by many observers), but the numbers weren't down significantly enough to make anyone feel like they could compute in relative safety. It will be nice if the number of Microsoft Office-related exploits goes down. 2006 and 2007 were banner years for Microsoft Office exploits. [Disclosure: I work full-time for Microsoft]. Because of SDL, I expect exploits in XP, Vista, and Office to go down in 2008.

Of course, no matter how secure an operating system is, most exploits will continue to rely on socially engineering users to install things they otherwise shouldn't. As I covered in several previous columns, client-side attackers make up more than 90 percent of all malicious compromises. I don't see that changing: User behavior is tough to alter.

Last year I predicted a decrease in malware spread using e-mail vectors and an increase in exploits using Web sites. The only real surprise was the sheer number of completely innocent, commercial Web sites used to spread malware.

Application-side vulnerabilities will continue to grow. Quicktime, RealPlayer, Flash, and Windows Media Player all had significant exploits this year, and the numbers are still trending upward. Exploits will continue to target VoIP (Skype and the like) and social portals (YouTube, Facebook, Myspace, and others), as rootkit Trojans continue to grow in prevalence.

Will 2008 finally be the Year of the Massive Cell Phone Exploit? The popularity of the iPhone would almost dictate that it will be, but if that was the case I would have expected a major iPod exploit by now. Every year dozens of computer security prognosticators predict a cell phone virus will panic the world. But we’ve been predicting that since 1999 when a widespread Trojan hit Japan's DoCoMo cell phone network. I'm not holding my breath. It will happen when cell phones become more popular than computers for online banking and commercial transactions. (And that will happen -- I just don't think it will be this year).

So, expect more of the same next year. I don't see any paradigm shifts. Computer security vendors aren’t likely to make you significantly safer, and what the criminals are already doing is working quite well for them, so there's no need for them to shift tactics.

Posted by Roger Grimes on January 4, 2008 03:49 PM