Network Threats

First they have to find you?

FORMER TRUTHS:

An attack can’t get to your PC if it doesn’t know where/who you are.

A user has to take some action to allow an attack to proceed.

A Windows PC will ask permission before allowing the addition of software.

First they have to find you?

NEW THREAT LEVEL:

An attack can find it’s way to your PC by meandering through several networks until it has ‘touched’ every available PC.

A PC can be infected, affected, or controlled without having been compromised by a user’s action (or inaction).

Windows PCs can be controlled, damaged, monitored, weakened or abused without a user’s knowledge.

Like termites, they sneak…

Email is still a favorite inward route

Users should watch for unexpected attachments.

A ‘healthy paranoia’ is prudent when reviewing incoming email that is not part of an ongoing (existing) message thread.

Since the ‘from’ address field is often compromised, it is no longer enough to simply avoid email from unknown senders.

Antivirus software should be scanning at both the client and server levels.

Email is still a favorite inward route (cont’d)

Disabling HTML rendering (not even possible in some email clients) is the only way to stay safe from many types of attacks.

Many ‘social engineering’ ploys try to get a user to follow a hyperlink to an attack waiting outside the network.

Much ‘SPAM’ (unsolicited commercial advertising by email) is often an attempt at ‘reconnaissance’ to evaluate your PC or network before an attack.

How to Fight Spam Strategically By Gary A. Bolles, CIO Insight December 2, 2003 “ Paul Judge, CTO of antispam vendor CipherTrust Inc., says spam comprises up to 61 percent of all in-bound corporate e-mail. “ Antispam service provider Brightmail Inc. claims that out of the 70 billion messages it processes every month for the 300 million users in its worldwide network, over 50 percent are spam. “ The country's biggest e-mail provider, America Online, claims it stops an average of more than 1.5 billion spam messages a day, spiking at times to more than 2.5 billion. “ Says Michelle Boggess, electronic data security coordinator for Pensacola, Fla.-based Baptist Health Care, a $743 million not-for-profit: ‘Some of our users were getting spammed so heavily that they were spending large amounts of their own time picking through e-mail. The deluge creates a huge drain on worker productivity.’”

Opt-out of SPAM?

There is no legitimate opt-out registry that all SPAM-generators look at, or are legally bound by.

The ‘National Antispam Registry.com’ is a scam!

If a company is within the United States borders, they can be prosecuted -- so those still sending SPAM are usually ‘unreachable’.

There is no world-wide organization or governing body that oversees the internet. If the US government can’t shut down a SPAMmer, there is no larger entity to appeal to.

What measures can be taken?

Block SPAM?

SPAM-generators regularly change commonly-blocked criteria to slip past slow-to-react human administrators.

Millions of messages can be sent out from a particular server address (i.e.: ‘mail.adserver.net’), and just minutes later, another batch can be sent out from the same computer using completely different information (i.e.: ‘smtp.promotionsusa.com’).

While corporate America scrambles to block an originating address, that one instantly becomes obsolete and the attacks continue.

What measures can be taken?

Filter SPAM?

Certain key phrases can be filtered out at the server level, to cut down on how much illegitimate mail actually gets through to users’ inboxes.

“ Make money fast!”

“ Enlarge your … without surgery!”

“ Hide porn from your boss!”

“ Bad Credit? No Credit? No Problem!”

Filtering for complex phrases slows delivery dramatically; filtering single words causes very little impact on email server performance.

Trapping email by single-word filters (‘rich’, ‘credit’, ‘enlarge’) keeps many legitimate messages from getting through (called ‘false positives’).

Instant Messaging use is increasing, as is it’s abuse as a transport for attacks

Unlike with email, most companies aren’t able to filter IM traffic for virus, SPAM, and other malevolent attacks.

Users who don’t lock down their IM software to accept traffic only from those already in their ‘buddy lists’ can be the targets of social engineering, hostile attachments, or harassment.

IM Spam Expected to Triple March 28, 2004 By Robyn Greenspan “ The annoying unwanted messages that overflow inboxes are now also spreading onto desktops in the form of SPIM — spam over instant messaging (IM). The Radicati Group estimates that SPIM will account for roughly 5 percent of instant messages traversing public networks (consumer and corporate) by the end of 2004, tripling from 400 million messages in 2003 to 1.2 billion .” “ Pornographic messages make up the majority of SPIM at 70 percent, followed by ‘get rich’ schemes at 12 percent, product sales at 9 percent, and loans or finance messages at 5 percent, according to Radicati's research. Nearly all (90 percent) of SPIM messages are short one-line sentences followed by a URL, such as, ‘Hello, check out my Web cam at www.xxx.com.’ ” “ Increased awareness will help to alleviate the problem and Radicati recommends that users not click on unknown links that appear during an instant messaging session, and that businesses should refrain from publishing IM names in corporate directories.”

Recent worms (self-propagating hostile applications) need only to be connected to a network with other unprotected PCs to spread.

Most networks are designed only to keep data protected from those not authorized to access it. This foundational short-sightedness doesn’t protect PCs; just information.

As more people add broadband internet connections in their homes, and public WiFi (wireless internet access) becomes more common, the reach of available highways for worms grows .

Anatomy of a Worm

Once a single PC on your network has been infected, any other PCs on the same segment of that network (that have the same vulnerability) are ‘found’ and infected as well. No user interaction is necessary.

INFECTED OK OK OK OK OK OK OK OK OK

Compromised PCs are a threat to all

DOS (Denial of Service) attacks are often waged on larger targets by hijacking thousands of desktop PCs which are then directed to aim a crippling barrage of requests at a server when triggered remotely by a command or when a predetermined time is reached.

Many recent viruses are engineered to include their own SMTP server, so the desktop does not require access to an email server to propogate to all email addresses collected from text files on that same PC.

Social engineering relies on the fact the majority of users don’t have the time or patience to learn all that would be necessary to see through many attacks.

This fact will never change -- because few people spend most of their day staying current on security issues (unless they happen to be an IT professional).

Training users to be all-knowing & sufficiently paranoid has failed .

It’s time for a new plan.

Complexity = Compromise

Software vendors have competed largely on the number of features they can cram into each new release and upgrade.

Users have come to expect a high level of complexity in software applications; they feel that it is the price necessary for the availability of large feature-sets.

It has become impossibly difficult to keep systems compatible, stable, or even running at all due to the incredible number of relationships and dependencies that are built into software systems.

Bug fixes and security patches are so common and so complex themselves that administrators have difficulty keeping track of which ones should be installed in their respective environments.

Simplicity = Stability

Software vendors will continue to add to feature-bloat until customers vote with their dollars.

Most corporate users don’t use more than 20% of what’s available in Microsoft Word. Consider choosing a simpler word processor, and you’ll save money while decreasing your risk of infection by macro viruses.

Install only the software you know will be used. Follow the 70/30 rule: applications that are used 70% of the time may have an impact on how the system is configured; less-used applications are considered expendable unless they don’t impact other software in any way.

Apply all bug fixes and security updates within several days of their release. If this is unrealistic in your environment, switch operating systems or management tools so you can.

Apps = Ability?

Document Standards

RTF, PDF, TXT are the only universally-acceptable formats. Don’t let applications run your business.

Most companies choose the Microsoft Office suite only because of it’s ‘critical mass’ in the business application market. Otherwise, it’s overkill for most users.

Even Microsoft’s ‘enhanced’ version of RTF brings with it the same insecurities and privacy concerns of Microsoft Word. A macro-infested Word document can be disguised as an RTF file and Word will still execute the code on any Windows PC.

HTML-formatted documents can contain threats and dirty code that can dissolve a document’s usefulness after several generations.

Take Control of Your Apps

Document Standards (cont’d)

Find out what document formats your industry can use (read, print, copy, insert…).

Remove applications that cause your business contacts to strain harder at security, user training, and cost just for the sake of being compatible with your documentation.

Provide users with adequate training so that they can get 100% usefulness out of ‘lite’ apps, vs. the 20% they might experience with industrial-strength counterparts.

Email is Not a Transport