Developing Security

Top 10 signs you are a Security Twit

Earlier this year I joined Twitter to interact with fellow security minded people. Zack Lanier (@quine) maintains a list of Security Twitter users (or Twits) over at security-twits.com. If you want to keep pace with the security community, it's a great list of potential users to follow. But I would be remiss if I didn't warn you, we can be an eccentric bunch.

As a tribute to my fellow Twits, I put out a top ten list of signs you are indeed a Security Twit. This started as a stream of tweets, but I was encouraged to reprint it here. I've added explanations for readers not 'living on twitter'.

10. You start a Twitter war over the validity of self assessment questionnaires (actually happened, but I'll protect the names of the guilty)
9. You are surprised when people tell you Jack Daniel(s) is also an adult beverage (Jack Daniel is the much loved Curmudgeon of the security community)
8. You prep your liver for RSA months ahead of time
7. You have made sentences entirely of acronyms
6. You do or consider doing p90x (it's a workout program spreading rampantly like a virus, started by  Chris Hoff)
5. You have strong opinions about PCI-DSS but haven't read it
4. You can name multiple security tools named after bodily functions
3. You have podcasted drunk (it's amazing how alcohol and security mix)
2. You shun the Gregorian calendar, instead you base time on days to Black Hat/Defcon

And the number one sign you are a Security Twit...

1. You have drunk a Hoffacino

Number 5 is definitely me (@justin_foster) :)

Extending VMsafe beyond ESX for Resilient Desktop Security

VMware VMsafe is a security technology for virtualized environments that can help to protect virtual infrastructures in ways not previously possible with physical machines. It has a lot of promise, but why limit VMsafe to ESX? Why not support similar hypervisor security APIs in a virtualization layer for workstations, laptops and mobile devices too? While this may sound extreme, I assure you there is good reason.

It's easiest to explain what I mean by illustrating one of VMsafe's capabilities, network introspection. Until recently there were only two vantage points to perform network introspection (host-based and physical appliances). With the advent of virtualization and VMsafe the landscape has changed. Now you have the following locations to perform packet filtration, deep packet inspection, network monitoring and more:

- Host-Based (NDIS/TDI/WPF)
- vNIC hook with tunnel to Virtual Appliance (e.g. VMsafe)
- vSwitch (e.g. Nexus 1000v)
- vSwitch bridging to Virtual Appliance (e.g. vShield Zones)
- Physical Network

I've listed these options in order of proximity to the application stack, or workload performed by the end-point. The distance from the application stack is an important factor. The further you are away, the less you see (for example node to node traffic on an internal network), yet the closer you are the more opportunity there is to subvert the introspection. It's a balance of visibility and resiliency.

If we look at network introspection as a problem where both the source and destination are untrusted environments, where is the most advantageous view point?

Locating network introspection on the host gives the highest degree of correlation with the actual workload. For instance a firewall can determine if packets should be passed based on the user or process. Unfortunately, host-based also happens to be the location most vulnerable to subversion. Malware routinely shuts down host-based controls, and drivers higher up the TCP stack can be blind to malware talking on raw sockets. It's also not uncommon for user agents to be disabled (temporarily of course). After all, when something goes wrong blame the [INSERT SECURITY PRODUCT NAME HERE].

Move one level outside the host to the new set of options provided by the virtualization layer, and you have a more complete and insulated view of the network traffic (at least until virtualization attacks are mainstream). When filtering at the vNIC or vSwitch level, the vantage point is similar to that of a network based physical appliance, with the exception that you have certainty as to the destination VM and can apply specific policies.

As we move further onto the network, policies are much harder to custom tailor to specific hosts. Physical network appliances rely on switch port, or the IP/MAC of the Ethernet frame if they need to perform specific filtration, neither of which can be guaranteed to be attached to the expected instance on the other end. End-point vendors and the Jericho Forum have been highlighting the ineffectiveness of perimeter security in an increasingly mobile world for years.

Imagine a spy on the tail of a notorious dictator who is driving to a meeting with potential buyers for some spare plutonium. If the spy gets too close they may call off the deal or worse, turn and attack. If he gets too far away he risks loosing them and seeing that all important hand-off of the merchandise. He needs to follow the car at just the right distance.

Network Introspection in the hypervisor (either the vSwitch or a vNIC hook) is a compromise between physical network and host-based that, while imperfect provides a resilient way to apply tight policies. We have this today in vSphere 4, but ESX and ESXi only run on specific hardware and are not suited to workstations, laptops and mobile devices.

VMware View provides a virtualization solution suitable for workstations and laptops. It provides for desktop consolidation, faster provisioning, and desktops independent of the device. On the hardware you install a client similar to a bootstrapper, where your desktop may then run on a server or be checked out locally to let you roam. When the desktop is running in the data center, it's protected by the various physical appliances, 3rd party vSwitches and virtual appliances. When the VM is checked out onto the laptop for roaming you lose this protection.

Base virtualization layers for all devices are coming. What I would like to see is VMsafe-like Security APIs built into virtualization solutions for user computing. When security is deployed at this layer it becomes resilient to end-users with administrator privileges and malware.

Take for example a firewall. Inside the OS it is vulnerable to alteration of the ACLs, subversion by unfiltered frame types, or being disabled by administrators or malware. Removed from this layer it becomes impervious to attempts to disable or bypass protection.

No doubt, there would be complications rolling out VMsafe-like APIs for this type of environment (especially if you extend the inspection abilities to memory, CPU and disk). For one, there would have to be a way to address this layer in order to update software or profiles. Running virtual appliances wouldn't be acceptable under the resources available on these devices so the entire security stack would have to be executed in the hypervisor layer. It would also require specialized support for hardware such as wireless cards.

I challenge VMware, Citrix or Microsoft to introduce a common technique for running security agents outside of the virtual machine where the policy and even the security software could be carried with the VM (in a OVF or similar). Extend this support to a wide range of physical hardware and delivery models (including IaaS) and we could have VMs of any nature (desktop or server) runnable in a wide variety of environments with closely coupled, but isolated security in tow.

I (HEART) OSSEC

Originally posted on the OSSEC Blog

In the open source world some projects have taken on beloved status by their loyal user base. OSSEC is one of them, and for good reason.

For those of you unfamiliar, OSSEC (pronounced Oh-Sec) is an Open Source Host-based Intrusion Detection System. It performs log analysis, file integrity checking, policy monitoring, rootkit detection, real-time alerting and active response.

Over a year and a half ago I was tasked to review OSSEC as a potential acquisition for Third Brigade. I was of course, sufficiently impressed with OSSEC's capabilities, but I was surprised at the level of respect it had developed in the community. I was curious as to why OSSEC had such a solid reputation.

Recently I have gotten to know the man who literally wrote the book on OSSEC, Andrew Hay. Andrew is a well respected figure in the security community and has authored several security texts in addition to his daily blogs. He thinks, "The key drivers to the product are 1) the cost, 2) the ease to deploy, and 3) the community wrapped around it".

It's true, like other popular open source security projects (like Snort), OSSEC has a strong community. Its members get involved by contributing to the wiki, communicating on the mailing-list, and discussing OSSEC on Twitter (where Andrew tries to get anyone who mentions OSSEC to buy his book).

I asked Wim Remes, who recently posted OSSEC in a Nutshell on his blog, and he said OSSEC succeeds because "it's cross-platform, it's free (the software is ... not the implementation), it's giga-flexible, it does what it promises to do". 'Giga-flexible', I like that word. I'll have to trademark it before Wim does! :) These sentiments are shared by many who have given OSSEC a try.

The acclaim for OSSEC extends to the press as well. In '07 LinuxWorld named OSSEC the #1 Open Source Security Tool. They explained, "The OSSEC HIDS project has been gaining widespread use and is quickly being deployed within organizations around the world as a method of protecting systems at the host level after attacks have made it past network defenses". Recently ZDnet also covered OSSEC saying, "Danen singles out OSSEC as a solid, cross-platform tool for intrusion detection". The OSSEC website has a large list of awards and reviews.

Clearly OSSEC is a solid, cross-platform piece of software at an unbeatable price, but it takes more than that to build a loyal following.

I think the real reason for OSSEC's success is its creator Daniel Cid, and his roots. The seeds for OSSEC were planted back when Daniel was a security engineer. He found that in his job he lacked information about the hosts he was protecting and started writing scripts that would give him a better picture of the state of the network. Because Daniel came from an operations background rather than a pure development background, he writes software to solve real problems he actually faced.

Still, it takes more than a problem solver. When I first met Daniel he was working a full time job, OSSEC was a side project. It was clear that he really cared about the project and supporting OSSEC users event if it meant many grueling nights and weekends. Users would send him new log samples to deal with and on his own time Daniel would dissect the logs, create decoders and rank the security relevant events. Daniel answers every email, deals with every bug, and considers every enhancement request. It doesn't hurt that he's a genuinely nice guy too!

So OSSEC's real popularity comes from the fact that it does what users want it to do. That sounds like an incredibly obvious attribute which all software should strive for, but it's much more attainable when it's developed by someone who has been there and listens to feedback. This is something to keep in mind for all of the commercial software developers out there, like myself.

We need to walk a mile in the shoes of the end-user and listen when they have feedback.

Because of the positive experiences using OSSEC it continues to grow in popularity. Largely through word of mouth, OSSEC has grown to over 10,000 downloads a month!

Have you tried OSSEC? Maybe you'll find that you'll (HEART) OSSEC too.

Are hackers partially schizophrenic?

I think a significant portion of hackers lie somewhere in the schizophrenic spectrum. Oddly this is good for them, and bad news for us.

Over the course of evolution, genetic anomalies have emerged that walk a fine line between being productive and being dangerous. For instance, mild versions of cystic fibrosis can protect against cholera by preventing the dehydration of the lungs. People in certain regions defend against malaria with sickle-cell anemia, and its generally believed those with Tay-Sachs disease have a natural defense against tuberculosis.

These traits continue to be bred into successive generations because the mild versions carry an adaptive value and don't impact the lifespan or breading abilities of the carrier. The result however, is that a percentage of the descendants develop full blown versions of the disorders with all of the disastrous consequences. Mother nature it seems, is willing to take this risk.

Schizophrenia presents on a wide spectrum, with a less severe version known as schizotypal personality. Schizotypal personality (also known as Schizotypal disorder) is characterized by the need for social isolation, odd behavior and thinking, and often unconventional beliefs. Unlike those diagnosed with schizophrenia, people with schizotypal personality can lead very full and productive lives. The negative effects are so vague they are mostly undiagnosed and untreated. Moreover, like the other disorders mentioned there can be advantages to having a schizotypal personality.

In a lecture by Joel Sapolsky he explains that the family members of people with schizophrenia have a higher rate of schizotypal disorder. Normally this presents itself in their gravitation towards solo occupations (lighthouse keeper, movie projectionist, etc). In cases where the unconventional beliefs and perceptual experiences are the stronger trait he draws a connection to religious or spiritual leaders. He points out that some behaviors one could consider psychologically suspect (like talking to a burning bush) can be acceptable and transformative in the right context.

I see a strong correlation between the behaviors of someone with schizotypal personality and a hacker. Certainly I'm not suggesting schizotypal disorder is a trait required for hackers. Like any other subculture the reasons people are drawn in can be widely influenced by environment. But there is a correlation between the diagnostic criteria and the typical profile of a hacker.

Schizotypal personality is characterized by five or more of the following (From Wikipedia):

1. Ideas of reference (excluding delusions of reference)
2. Odd beliefs or magical thinking that influences behavior and is inconsistent with subcultural norms (e.g., superstitions, bizarre fantasies or preoccupations)
3. Unusual perceptual experiences, including bodily illusions
4. Odd thinking and speech (e.g., vague, circumstantial, metaphorical, overelaborate, or stereotyped)
5. Suspiciousness or paranoid ideation
6. Inappropriate or constricted affect
7. Behavior or appearance that is odd, eccentric, or peculiar
8. Lack of close friends or confidants other than first-degree relatives
9. Social anxiety that tends to be associated with paranoid fears rather than negative judgments about self

Can you think of a serious hacker who doesn't exhibit five or more of these traits?

If you look at the terminology of hackers there is evidence of meta-magical thinking (especially references to mythical creatures). There also tends to be a strong affinity for escapism in science fiction and fantasy. Hackers usually seek isolation, preferring to peer only in cyberspace. When they do gather, such as at Defcon, you can't help but notice that the audience personifies the odd, eccentric and peculiar. Hackers tend to be unfairly categorized as having poor communication skills, perhaps it's just a byproduct of the way their minds work. Some hackers have a hyper-inflated sense their own importance, perhaps this is ideas of reference rather than ego. Most of the symptoms fit the stereotype.

But the point of this article is that partial genetic traits like this can be an enormous source of strength. They use the ability for unconventional thinking to innovate new ways to do things. For ethical hackers this results in creative techniques to expose vulnerabilities. For the black hat hacker this results in innovative new ways to pwn users and systems. I would argue that without these genetic traits there would be far less exotic malware like polymorphic viruses, self defending worms and tamper proof obfuscation. The powers of thought combined with the tendency towards isolation would also correlate well with the ability of the black hats to stay ahead of defenses (producing variants faster than we can keep up).

Before anyone gets offended by this suggestion, please know that I am certainly not a biologist or psychologist, nor do I have statistical data to back this up. Like attempts to related ADD to hackers in the past, this is merely an unprovable observation.

What I do know is that the enemy is formidable, bringing the full force of their intellects to bear. As security professionals we may be defending against more than an army of hackers, we may be defending against their genes.