If a Stranger Offers You Sweeties...

Common wisdom tells us to distrust strangers, but as you already know, common knowledge rarely applies to information security.

I have recently visited a couple of web sites with some astonishment due to their requests for very sensitive information from their users. The first one is the very well known FaceBook site, that I heard of from several Leo Laporte's podcats. The second is a not so well known but increasingly popular instant messaging service site called eBuddy, that allows you to use several IM platforms (MSN, Yahoo, AIM, GTalk, and MySpace) from the web.

In the first case, when creating an account, FaceBook asks you for your email password to be able to import your contacts and add them to your friends list. It is able to handle several email providers such as Hotmail, Gmail, or Yahoo. I do believe that FaceBook has some real business and that their site is not meant to gather naive user passwords. At least, they allow you to skip this step and add your friends manually. However, I would like to know how many people with no real previous knowledge about the company (other than "somebody told me that is cool!" or even "somebody invited me") has provided them with their email and password.

In the second case, there is no benefit from visiting eBuddy if you don't type your IM user and password. Don't ask me if it works well after that, because there is no chance that I give them that info. But, although I understand that there is no other way to provide that service (at least currently, maybe OpenID and the Identity providers will solve this issues in the near future) than obtaining the usernames and passwords, I leave those advanced services for the brave users that dare to give their usernames and passwords to strangers with the hope that they won't be stored and or used for any other purpose. A very similar case is the service provided by ShapeService to use Skype from the iPhone, that requires you to provide them with your Skype account and password.

So my advice is clear. Please, think twice before you type your user and/or password in any website other than the one they are meant for.

You Are the Best Firewall

A few weeks ago, while walking with the family enjoying the summer sunset, I saw the following poster in the street:


The poster slogan says: "You Are the Best Firewall". The sunny Spain is well known for its hot and dry summer, specially far from the coast. During the summer period one of the major threats against our nature are... FIRES!! Therefore, Madrid's government has launched an awareness campaign to prevent thousand of green forests hectares from being burned; a very valuable asset for us and future generations.

First time I saw the poster I thought: "... an infosec awareness campaign in the town? (sorry, security obsession)" :) The parallelism between both worlds is amazing. It is not new that during the last three years, the information security threats and attack vectors have changed from the common firewall-protected scenario against scans looking for vulnerable services, to the current user-focused attacks where the user actions help to compromise systems. Therefore:

You are the best firewall!!

The best way of dealing with this type of threats is through user awareness, trying to minimize the unintentional user actions that lead to a system compromise, or to a forest to get on fire. This awareness poster is fabulous: it has a short, straight and simple slogan that directly involves the user (KISS principle), it provides the phone number you need to call in case you make out a fire (incident response: what to do and who to contact if you detect an intrusion), and list the most important things you DO NOT have to do (real-world examples and guidance).

This is obviously related with our previous 3wplayer post, and corroborated by a recently deployed server, running on port TCP/443 on a SOHO environment (xDSL Internet line). I carefully monitor all the traffic from and to this system, and after five days it still has not received a single SYN packet! This low scanning rate was not the one we had three years ago.

If there is no big change in the current security and malware business, my prediction is that in a few years we will get similar general government campaigns focused on protecting your information and computer at home from being compromised and fall victim of a botnet, phising and trojan-backdoor attacks, identity theft, etc., in the same way we had campaigns to reduce fires and traffic accidents nowadays. An ounce of prevention is worth a pound of cure. Remember... You, your friends, family, relatives, neighbors, etc... are the best firewalls!!

Asking for help again

While we still wonder which is the latest vulnerability in our operating systems that can allow the attackers to own them, some real hackers are trying easier ways to obtain access to the John Doe's systems. And there is no easier method than asking for help through social engineering. When the target himself installs the malicious software into his system, it is very likely that the results are excellent for the attacker.

This method has been used several times before, sometimes using infected versions of legit software and sometimes with the bare malicious software (and some promise of a better life attached to it). The later method (more or less) is the one used by the 3wplayer.

Although some information is available, today only 3 out of the 32 anti-virus engines (F-Secure, Ikarus & Rising) available through VirusTotal are able to detect malware in the latest version of 3wplayer (3wPlayer-1.5.0.0-setup-0601.exe). However, for the security concerned, it is quite suspicious the way it tries to get users to install the software.

I have received several reports of people downloading contents from P2P networks that when trying to play the downloaded avi with "impossibly cool" content, they only get a short message claiming that the file cannot be played with media player and that it needs 3wplayer that is available through their website (not included here to avoid stupid mistakes).

While I don't support the share of copyrighted content, I still believe that people should be aware that most media players are able to extend their format support by using the required codecs, and that it is quite unusual to try to compete against the most popular mediaplayers without selling (or even giving for free) some product to encode content in their format, so people are able to create enough content to really push the demand for the player.

Have a safe P2P experience!