Miscellaneous Security

Reading time: 3 – 4 minutes

Photo: B.G. Lewandowski

Why did you just click that link? Most likely you have came to this site by clicking a link from another site. Why did you do that? Did you trust the person who sent you the link? Did you click a link from Twitter, Facebook, or an email someone sent you?

When you click a link, you are telling your browser, “I trust this person.” However, this is not the way we use the Internet. We click on links all the time. We click on links from “untrusted” sources. We click links from people we don’t know and we even click on URL’s that have been modified. On Twitter, a person is much more inclined to click the shortened link http://bit.ly/5hXRW then they are to click http://somewherebank.com/transfer.jsp?amount=1000&to_account=56777564. Even though the shortened link could redirect to the somwherebank.com site.

But, why would someone trick you into clicking a cleverly disguised link? The site that you are redirected to may seem harmless. It could also be extremely malicious.

What happens if this page, (the one you are currently viewing), was filled with Cross-Site Request Forgery (CSRF) links? This web page could be setup with all types of malicious intent. However, you didn’t know that when clicking the link. Now, it is too late.

If this site did have Cross-Site Requests, I could do things such as:

• Change the password on your Facebook account
• Transfer the money from your on-line bank account to another account
• Enact trades from a financial institution such as E*Trade

The sites that I exploit would have to be vulnerable to CSRF. But researchers, such as Mike Bailey and Russ McRee, are constantly finding CSRF vulnerabilities in web applications.

An example of how clicking links from untrusted sources is never good was demonstrated in Billy Rios and Nitesh Dhanjani, Bad Sushi talk. In their presentation they described sending phishers a word document stating their account numbers were inside. They sent this email to 25 known phishers. 10 of the phishers opened the word document and were presented with this. In addition, there was another link that said, “Actually, my account information is here.” 3 of the 10 clicked on that link. Even the phishers click links they shouldn’t.

What should be done? Who knows. It is human nature to trust people and we can’t get things done if every time someone sends us a link we open up a VMware image to view a link. So continue using the Internet the way you have been and remember, “These aren’t the droids your looking for.”

Reading time: 1 – 2 minutes

Photo: crowolf

FUD is becoming a very common acronym to hear in security circles. The acronym FUD has been popping up on Blog postings, emails, tweets, and at security conferences.

FUD is an acronym that stands for Fear, Uncertainty, and Doubt. The phrase describes marketing schemes that are focused on using Fear, Uncertainty, and Doubt to sell a product. Good example of FUD are sensational headlines such as, “Conficker Now Instructed to Steal” or more famously, “Hackers Can Turn your Home Computer into a Bomb!”

With FUD campaigns the marketer is attempting to use FUD to sell something. This marketed item could be a “security” product or FUD can be used to create a buzz around the “item at hand.”

One quick way to identify FUD is spotting a headline or article that is greatly sensationalized, has a lot of speculation, or makes gross generalizations. The other critical factor in FUD is there is a lack of information in the article. FUD articles clearly point out the problem, but fail to point out how the author arrived at this conclusion.

Fear, Uncertainty, and Doubt pray on human emotions and marketing campaigns that exploit this will not be going away any time soon.

Reading time: 3 – 4 minutes

Photo: escapedtowisconsin

Social networking applications are among the most popular websites that are used on the Internet. Facebook.com and myspace.com are both in the top 20 most visited pages on the Internet. According to Alexa, 17% of global Internet users visit facebook.com on a daily basis.

How can attackers use the abundant amounts of information that is available on these websites to aid in their attacks?

One method is by analyzing a victims social network using network analysis.

Network analysis is a way to infer information from the social connections that someone makes. An attacker could use a social applications data set to:

• identify positive and negative relationships
• identify their victims mood
• identify individuals that are most influential in a group

By assigning people and organizations to nodes and linking nodes based on relationships, attackers can begin to infer information from these social graphs.

Who is the Most Influential?
It is beneficial for an attacker to know who is the most influential person in their victim’s social network. Constructing a malicious instant message or email that requires user intervention (think Reflective Cross-Site Scripting) will have a higher success rate, if it is sent from the victim’s most influential friend.

In order to analyze the victim’s social network from an influential perspective, the attacker begins by constructing a graph with the victim in the center and each of the victim’s friends as node off of the victim.

In this example, Sam is the attacker’s target. Sam has five friends, Alice, Bart, Charlie, Dave, and Ed. This would create a star graph that would look like this.

The next step is for the attacker to analyze the connections between Sam’s friends. The attacker identifies that Alice communicates with Bart on a regular basis, so a link is made between Alice and Bart.

It is also easier for the attacker to understand who is the most influential by assigning a value to each vertex. Alice and Bart’s vertex would change from 0 to 1, since they know one of Sam’s friends. In this example, we have made the vertex larger and assigned it a number. Once the social network is analyzed the attacker will have a graph similar to this.

Since Ed knows 3 of Sam’s friends, it can be inferred that Ed is the most influential in Sam’s network. If an attacker wanted to send a malicious instant message or email to Sam, the attacker would have the highest rate of success if the malicious message was from Ed.

This is a simple example. In reality, social networks are vastly more complicated. However, with the use of certain API’s an attacker could use network analysis to his benefit.