Passwords For Nothing

Time to get the creative juices flowing for this years EDUCAUSE Security Professionals Conference.

The following is to the tune of "Money for Nothing" by Dire Straights.  I like to image Knopfler riffing through the whole thing.

---

Passwords For Nothing

I want my, I want my IRC.
I want my, I want my IRC.
I want my, I want my IRC.
I want my, I want my IRC.

Now, look at that CISO, that's the way you do it.
You play the hax up that were on TV.
That ain't working. (Nothin's gonna do it!)
They get your passwords for nothing, get your creds for free.

No, that ain't working.  AV just won't do it.
Lemme tell you, them guys ain't dumb.
Maybe get a password through a phishy message.
Maybe get a shell with injection.

We got to install UTM software.
Custom snort sigs: deliver me-e-e-e!
We got to move these bad IP packets
We got to install crappy AVeeeee!

The little malware with the logger and the screen caps?
Yeah, buddy, that's on your phone.
The little malware's got an IRC bot.
The little malware is a pesky drone.

We got to install UTM software.
Custom snort sigs: deliver me-e-e-e!
We got to move these bad IP packets
We got to install crappy AVeeeee!

We got to install UTM software.
Custom snort sigs: deliver me-e-e-e!
We got to move these bad IP packets
We got to install crappy AVeeeee!

I shoulda learned to code things in python.
I shoulda learned to code in C.
Look at that backdoor, he's got it, sitting in the web dir, man.
This hacker's no fun.

And what's up where? What's all that? Some cloud-based service?
It looks to be designed by a chimpanzee.
No, that ain't kosher.
That's the way you do it:
If you want all your data given out for free.

We got to install UTM software
Custom snort sigs: deliver me-e-e-e!
We got to move these bad IP packets
We got to install some crappy AVeeeee!

Now, listen here.
Now, that ain't workin'.  Awareness just won't do it.
Your playin' catch-up with an APT.
That ain't workin'!  A vendor just won't do it.
Passwords for nothing, get your creds for free.

Passwords for nothing, and you creds for free.
Passwords for nothing, and you creds for free.
Passwords for nothing, and you creds for free.
Passwords for nothing, and you creds for free.

I want my, I want my IRC.
I want my, I want my IRC.
I want my, I want my IRC.
I want my, I want my IRC.

On The Wire, I Can See

So much is there, right before our little nosy eyes when we have a sniffer and the will to use it.

---

On The Wire, I Can See

On the wire, I can see
Traffic not destined for me.
In the air, sans SSL,
I enjoy your little show and tell.
In the middle of your session,
I sniff the bits of your connection.
On my screen I see your porn
And private conversations borne
On wings of packets insecure,
While on your end you are so sure,
In ignorance of my leet skills,
While you bank and pay your bills.
With greedy eyes I thank you for
The warning boxes that you ignore.
Until you get all VPNed,
I'll see the stuff you get and send.

These Are a Few of Our Favorite Things

It's been busy lately, but we're having fun, right?

ETA: Compare and contrast with the previous "Favorite Things" by Brad Judy.

---

These Are a Few of Our Favorite Things

Denial of service and passwords worth guessing.
Phishing complainers and route map addressing.
Tuning our IDS until it sings.
These are a few of our favorite things.

Outdated software and websites attacking.
Hackers who troll us on pastebin while snacking.
Campus-wide firewall: all that it brings.
These are a few of our favorite things.

Authentication that uses two-factor.
Assessing risks from networking a tractor.
Cutting your lawn over IPSEC strings?
These are a few of our favorite things.

On the WiFi!
In the colo!
No budget? So sad.
I simply rely on my luck so that I don't feel so bad!

PCI, HIPAA, and FISMA is knocking.
NIST helps to make all your systems more rockin'.
Coping with madness the auditor flings.
These are a few of our favorite things.

PII scanning and AV a-lookin'.
P2P fileshares with movies a-bookin'.
Use of our logins by criminal rings.
These are a few of our favorite things.

Expiring passwords with lots of complex'ty.
Filtering spam chunks with images sexy.
Websites that bounce like they're all made of springs.
These are a few of our favorite things.

On the WiFi!
In the colo!
No budget? So sad.
I simply rely on my luck so that I don't feel so bad!

POODLE

POODLE.  The word invokes fear and loathing across the world.  Without the clarification between "standard" and "miniature", the mind defaults to the diminutive version: yappy, insanely groomed, full of hate, and probably growling from a debutant's purse.  If the POODLE vulnerability were "standard", you would know it is to be respected and admired: a hunter, a protector, a guide with curly hair.

This POODLE is on the yappy end, but it is anything but miniature.

---

POODLE

From the middle, I can see

The passwords that might fly by me.

Though you think encryption's hot

I still can take all the things you've got.

Trim me down howe're you like.

I'll watch for cookies, then I'll strike.

My nose will sniff the traffic there

While you're distracted by my hair.

A POODLE knows just how to dig

To compromise your server rig.

SSL ain't all the rage;

It certainly has shown its age.

So lest you mandate TLS,

I'll keep on walking without rest.

No leash, no collar keeps me down.

No hope I'll end up in a pound.

You Come From Ports Ephemeral

Team Cymru is a great source of information regarding Internet security.  One example they offer is a find summary of ephemeral source port selection strategies for modern OSes.  It's handy if you are crafting some IDS rules or want to understand what you're seeing in your sniffer.

And it feeds the muse in weird and wonderful ways.

---

You Come From Ports Ephemeral

In darkest aether, packets flow.
It's to IP address they go.
But when they reach their final place,
So many choices, they must face.

Deep within the packet's heart
It lists its goal, it lists its start.
It knows which port to which to bind,
And just what port it left behind.

You come from ports ephemeral,
And most ignore this numeral,
But hackers know your history,
And solve the OS mystery.

Foolishly ignore the past,
You'll find you're losing info fast.
So much can be learned from all these
Port selection strategies.

You come from ports ephemeral,
And most ignore this numeral,
But if you're tuning IDS
This makes you better than the rest.

It's not only the port of call,
Destination isn't all.
Get to know where things began:
There'll be more value from your span.

You come from ports ephemeral,
And most ignore this numeral,
But hackers know your history,
And solve the OS mystery.

Dragonfly

Symantec published a report about some state-sponsored hacking of industrial control systems (ICS) in many countries, including the US.  They identified the group that did this by the name "Dragonfly".

---

Dragonfly

I'm a wicked Dragonfly.  You ain't never gonna learn.
When you think you found me, huh, I'll make a hairpin turn.
I'll zoom around your networks with intent to sabotage,
Sting you and be hiding out in perfect camouflage.

I am a master hacker, and I'm working for a state.
Before you ever find me, boy, it gonna be too late.
I'm trained in writin' malware, and I know your ICS.
Industrial control: it is the world that I know best.
I know about your BACNet, and your HMIs are mine.
I'll keep them running smoothly, and you'll think that you are fine.

But soon the time is comin' when I'll tear your systems down:
No lights, no steam, no coolin',
Don't think that I am foolin',
Might leave your furnace droolin',
Heck, I might blow up your town.

I'm a wicked Dragonfly, and I'm dartin' right and left.
I hacked your favorite website with some skills that you'd find deft.
You came and took a sippy from my evil waterhole.
I snuck on in to bite you, and I gobbled you up whole.

I took a look around with a sneaky little RAT.
I learned about your network as I poked at this and that.
I guess you never found out that an air gap is your friend,
You'll hold on to that error, right up to the very end.

I'm a wicked Dragonfly, and I'm dartin' left and right.
When your turbines start to screamin' it will be a scary sight.
I hope you have some candles and some chopped up firewood.
Your power grid is flimsy, soon to be all messed up good.

After Six Weeks

After Six Weeks

After six weeks
Of welcoming my new daughter into the world,
        (Enjoying the blissful blessing of formal family leave,)
Ignoring the HIPAA violations at the hospital,
Trying not to observe the inefficient placement of security cameras during diaper runs,
Or balancing birth announcements and baby updates with my desire to lead a private life,
I return to my office and find:

My fingers still remember my password, even after changing countless diapers;
Our weekly staff meeting is unchanged in either place, time, agenda, or cynicism;
My coffee pot still offers eager and trusted assistance;
Pastebin still displays our passwords for the world to see;
Spam subject lines continue to evolve
        (bowels and parasites joining viagra and loans);
Bots are still phoning home
        (the cries from our computers admitting defeat);
Wordpress is still getting hacked while PHP looks on mutely;
Staff are still falling for phishing;
Students are still sharing illegally;
Professors are still typing in WordPerfect;
Sysadmins still resent us;
Webdevs still ignore us.

I return to the work,
Swimming in the winds of challenge and changeability,
Building rickety roofs to keep out the rough weather,
Watching the clouds to predict what the day will bring,
Hoping the heat won't wither my muscle
And the cold won't paralyze my bones.
I remind myself that we play the long game
        (Yes, the game went on without me)
And the rules are still the same,
Playing out despite my absence,
But if I focus on the game,
So long as I keep playing to win,
I can eventually rest each night,
       (After the baby has calmed herself and embraced a milky torpor,)
Knowing my work is heading somewhere
Through the storm.

SPC 2014 - Good Morning

Good morning, SPC-goers!  I hope last night was good for you.  Many of us found ourselves at the bars, talking, planning, and dreaming.

---

Glasses dance
From table to mouth to table
Riding the conversation's
Ebb
and
flow,
Networking while talking networking,
or policies,
or war stories,
or master plans,

Or planting the seeds for new plans
Deep in the soil of conversation
Watered by a rain
Of bar drinks
and laughter
and song.

SPC 2014 - The Cloud, some more

Joel Rosenblatt from Columbia is giving a great talk on sensitive data in the cloud along with CloudLock.  My thoughts, slightly less minimalistic than my last Cloud post.

---

The Cloud is Really Great

We gave our data names, we gave the data places.
But when we gave out access, it began all kinds of races.

The users needed info, they pulled it from the store.
And then we were surprised to find it running out the door.

They brought it to the Cloud and the services within.
They posted it it Google Docs and shared it on LinkedIn.

Dropbox was their favorite for sharing with their friends
Or maybe they just put it there for sinister of ends.

We asked them not to do it; we pleaded and we begged.
It didn't make us popular; it was like getting egged.

So we're looking now for policy and maybe DLP,
Or many we'll encrypt it all; I hope we keep the key!

But horses, they have left the barn; it may just be too late.
We cringe whenever users say, "The Cloud is really great!"

______________

Within wispy gauze,
Floating silently above,
There is turbulence.

The acorn planted
Last autumn by a squirrel.
New roots crack sidewalk.

SPC 2014 - Cloud

Cloud, Cloud, PII, Cloud, Cloud.
Cloud, Users, Cloud, Control, Cloud.
Cloud, Cloud, Cloud, Cloud.  Cloud.