Information Security HeadQuarters

How to use Windows 7 system restore to fix system stability issues

Mark Kelly — Tue, 15 May 2012 23:52:36 +0000

I grew up on the Windows operating system and through the years have learned how to easily navigate in it and do everything I need to do. I know many people absolutely hate Windows and Microsoft but I am not one of those people. I have had mostly good experiences with Windows through the years and am comfortable with its operating framework and need to update security patches on a monthly (or more frequent basis).

That does not mean I am stuck in the dark ages refusing to use new technology. I have an iphone and an ipad and also love those devices but when I had to buy a personal machine for a side business I work on I chose an economical Gateway laptop running Windows 7. Priced at less than $400 I am not sure it is possible to get more value for such a usable machine. I have been using this machine regularly for about 9 months now with no problems until late April when I experienced my first big problem with the machine.

Out of nowhere the machine became extremely sluggish and would not even load the operating system after putting in my initial password. Even though I am extremely cautious I was worried that I became infected with some type of malware and that my machine was compromised. I could not even find out at first because the machine basically wouldn’t load so I had to resort to plan B starting it in safe mode.

I was able to get the machine to load via safe mode and then ran some security scans which did not pick up any signs of malicious behavior (I ran Microsoft Security Essentials and Spybot S&D). Like a good operational/security person I then checked my event logs and realized several patches went in recently so I lept to the conclusion that one of these patches must be responsible for the horrific state of my system. Time to do my first ever Windows 7 system restore on this machine.

The Windows 7 system restore functionality is a great way to rollback your machine to a previously known “good state”. System restore is marketed by Microsoft as a convenient way to undo system changes to your computer without affecting your personal files, such as e?mail, documents, or photos. Basically, a way to back out patches and other system level changes without losing your personal data.

I had configured my system to have many different restore points so the key question for me was which restore point to revert back to. At first I tried the nearest restore point one day out with no success, the machine was still unusable. After spending about an hour experimenting I decided to rollback 3 days and got a workable stable version of my system going again. Even after the OS was stable again my Firefox browser never regained stability so I had to uninstall and then reinstall it to get it working effectively again.

Total time spent troubleshooting my problem ~ 1.45 min

Probable root cause – Microsoft or firefox related patch (I did not isolate the exact source only going by details of required rollback mentioned above)

Summary of actions taken for my Windows 7 system restore

1. Utilized Windows 7 system restore functionality by going to Start > All Programs > Accessories > System Tools > System Restore (make sure you set frequent restore points so you have this available to you)

2. You may need to experiment with your restore back date until you find the point where your system is again stable.

3. Restore your system to that point and run your antivirus scan and Spybot Search & Destroy to validate that a security compromise did not cause your problem.

It takes some effort but you can do this yourself and save yourself some money if this happens to you.

How long until Apple iOS needs its own patch Super Tuesday?

Mark Kelly — Mon, 14 May 2012 16:16:26 +0000

Are you Apple fans ready for some digital heresy? Apple iOS is as vulnerable to security problems as any other software, even as vulnerable as gasp Microsoft. We have witnessed this evolve from occasional updates to regular iOS updates and news of active attacks in the wild. If there was any doubt it is official Apple devices need the same security measures as any other device.

None of this should come as surprise to anyone. One of the unpleasant realities of being the big dog in town is that you become an attractive target to hackers. Apple devices started as a consumer hit but that success has led to a clamor for equivalent devices in the enterprise. Top level executives love these devices and have adopted them in masses along with the regular rank in file company employee. Would be attackers now realize that Apple devices are the future and compromising them can lead to a treasure trove of corporate intellectual property.

So will Apple adopt the equivalent of a regular monthly patching window the equivalent of Microsoft’s infamous “Super Tuesday” patch window? I would bet big money on it and the reason is enterprise adoption. Most enterprise IT departments have not been on the forefront of bringing Apple mobile devices into the fold and are now quickly playing catch up.

Playing security catchup for them with Apple devices means:

Refining policies to enable Apple mobility devices
Educating users on security requirements on Apple devices such as patching and safe device usage tips
Reminding users that physical security and safe browsing security measures apply on mobile devices
Evaluating and implementing iOS enterprise security tools to help control devices that contain sensitive corporate information

Enterprise IT will also pressure Apple to release iOS updates at a consistent time of the month because it helps with planning and user education. It is a lot easier to schedule, implement and communicate security updates when a fixed release date is established and can be planned around. Then again Apple has never had a reputation of pandering to corporate IT departments so the call for consistent patch release dates may go unanswered.

Bold and not so bold predictions:

Within next 6 months a major security incident will involve the iOS and be responsible for a big intellectual property loss.

Within one year Apple will establish a fixed monthly patch window date

How should you secure your webcam?

Mark Kelly — Wed, 09 May 2012 00:52:55 +0000

Webcam security is probably something you have never given much thought to. You might have a friend that physically tapes their web cam and think that they are being a bit paranoid, but are they really? Criminals will do anything to make a buck and if they can do that via a webcam do you have any doubt that they would? I read this recent posting on quora that got me thinking about that very question.

It is well established that operating systems and applications of all types are insecure due to the complexity of code and lack of proper security reviews throughout the development and release process. Simply put any vulnerability at the operating system or application layer that grants sufficient privilege to the attacker could lead to the compromise of your web cam. So the possibility definitely exists that someone could compromise your webcam. But to paraphrase a poster on quora what would a hacker gain by doing that? Let’s examine the potential threats

Why would a hacker want to hack a webcam?

Here are just a few possibilities this list is not meant to be exhaustive but just to show you that there is plenty of motivation and potential financial gain by doing so.

To gain access to pictures that can be used for blackmail or financial gain. How much would someone potential pay to keep embarrassing photos out of the public domain? I imagine this could become quite a source of revenue especially if someone in the public eye was the victim of this type of attack. Granted that this is called blackmail and has serious potential legal repercussions but so does hacking and that did not stop the hacker up to this point.
For information to know what is happening in a given location covered by the webcam. This factor comes into play more when a webcam is setup to provide security for a high value location but could also be relevant if a home is particularly pricey or a prime target for physical theft. This one may be of a bit more of a stretch vs. option #1 but is definitely within the realm of possibilities.
To terrorize the person on the other end of the webcam. Lets face it there are some sick and twisted individuals in the world who just like instilling fear in others and causing pain. Imagine the damage they can do if they control your webcam and you have not implemented any kind of security controls over your webcam.

So what can you do to protect yourself from these webcam security threats?

Suddenly, the person using dark black tape to block their webcam when it is not in use does not seem so paranoid now that we know the evil doers have potential incentive to hack your webcam. I believe a physical security method is the preferred way to deal with this threat especially if you participate in sensitive activities with your webcam. Tape that does not allow the camera to be utilize is a good control here but it is only as effective as your regular usage of it. You must do this every time your webcam is not in use to have effective security.

Another effective method to control webcam security risks is to have a portable web cam vs. a built in one so you can unplug the usb port when it is not in use. If you do not have a built in camera this is the best security option you can employ but once again it is only as effective as your ability to do this every time it is not in use.

There are other important measures you need to take such as keeping your operating systems, internet browsers and other applications like Adobe flash up to date with the most recent versions. This will help minimize the likelihood of your machine being vulnerable to attackers. Minimizing your use of a webcam to situations that would not leave you embarrassed and open to potential blackmail is another important mitigation step that will help protect you even if someone manages to compromise your webcam.

Who would of thought a webcam could have so many security implications?

Is WordPress 3.3.2 tied to the MAC OS X security issues?

Mark Kelly — Sat, 21 Apr 2012 02:08:01 +0000

Blogging platform king WordPress has gone quite a long time without an update, until today that is. When I logged into my blogs I noticed that WordPress update 3.3.2 was awaiting my installation. I have read via SANS that compromised WordPress sites were the major attack vector for this high profile MAC attacks. Putting two and two together it makes quite a lot of sense that there is a new WordPress update to install to mitigate discovered issues with the platform.

Upon review of the update it contains fixes for several cross site scripting vulnerabilities as wells as a limited privilege escalation vulnerability. I decided to break with my normal policy of installing WordPress updates after 2-3 weeks stability and experimented with applying the patch right away. My test site worked with no problem so I applied it to my other two sites and no issues were experienced across the board.

It feels like it is only a matter of time until iOS gets hit big time and iPhone and iPad users learn that they are not isolated from the security issues that have faces Windows users for over a decade. With popularity comes scrutiny.

Best information security blogs run by universities

Mark Kelly — Sat, 07 Jan 2012 00:22:41 +0000

Information security is an important topic for both businesses and individuals. It is nice to see many leading Colleges and Universities stepping up to the information security challenge and launching blogs and using social media tools to help educate students and faculty about the importance of information security. Information security groups at colleges and universities have a challenging job getting the word out and driving information security compliance since students are often prone to engaging in risky online behavior that leads to an increased likelihood of information security incidents.

Best edu information security blogs & social media presence

Indiana University – IU is running a well designed blog that looks like something you would see from a saavy expensively run 3rd party site. The information security news is regularly updated and it appears that IU has a pretty big team working on this effort because many of the posts are by different individuals. Kudos to the team for the excellent work on information security and from a quick scan it appears personal information protection is a big component of the overall awareness effort.

Missouri State Information Security Blog – Charla Berry is doing an excellent job helping keep the Missouri State community aware of information security threats and how they can stay protected. Recent posts feature awareness tips about holiday scams and keeping online financial information secure.

Georgetown Information Security Blog -Nicole Kegler has been a longtime blogger on information security the site’s index is listed back to March 2010. My favorite post is the one warning that Macs are not immune to information security problems since many people make this statement in error. With the ever increasing popularity of Apple devices you can expect reported information security problems in Apple devices to grow this year.

Rochester Institute of Technology - RIT has an excellent page for information security education but what really make them stand out is their use of Facebook to spread the information security gospel using social media tools. They have over 5300 Facebook page likes, a lot of awareness material and discussions going online so be sure to give their page a visit.

Kansas State University -Information Security program is run by Harvard Townsend and the school has an excellent overall online information security presence but they run a blog dedicated to information security threats which I have linked to that talks about common problems like spam, malware, and phishing attempts.

University of Connecticut – Mick DiGrazia has done a nice job with this information security blog that dates back to June 2010. I assume he will be back with a vengeance for the Spring semester.

The Ohio State University - I had to include the “The” since I always hear it on sports name/university roll calls plus it is listed that way on the site. The site contains a nice RSS feed highlighting information security awareness messages that students and faculty should be aware of. In addition, it looks like the institution has embraced encryption tools like PGP for faculty so that is a good sign that the information security program has been able to work effectively and get faculty support.

Stanford School of Medicine Information Security Blog – Site hasn’t had a recent post but previously published excellent awareness reminders around common scams and other pertinent information security information. Hopefully this recognition will help provide incentive to post more updates in the future.

If you run or know of other edu blogs that I should index please send me an email or reply below.

Best information security news and email feeds

Mark Kelly — Thu, 05 Jan 2012 11:40:08 +0000

Here are the information security news feeds/email subscriptions I subscribe to in order to stay current with the latest in information security news. Drop me a line if you have others that you follow that should be added to the list. I am including details about average number of posts per week when they are available because I know it is easy to get swamped in reading material and understanding frequency of publishing vs. value you get from it is important so you can efficiently use your time.

RSS subscriptions

SANS Newsbites – SANS is my go to resource for information security related news and training.
All of the US-CERT feeds – I view the US CERT organization as a leading authority along with SANS and subscribe to all of their feeds most of them average less than 1 per week which is manageable.
NIST.ORG – Network Information Security & Technology News organization is a leading authority on all things information security.
Help Net Security – Excellent source with concise articles detailing the latest in information security threats, tools, and news.
Krebs on Security – Nice in depth security investigations especially around the underground criminal market in information security assets.
Darkreading Weblog – Good source for staying on top of the latest security compromises and exploits. Averages 20 posts per week
Infoworld Security Blog – Covers a variety of diverse and useful information security topics. Averages 1 post per week
Experian Data Breach Blog – Provides info around data breaches and things you can do to help stay secure. Averages 1.2 posts per week
SearchSecurity: Threat Monitor – Good summary of current information security threats in the wild. Averages .2 posts per week
SearchSecurity: Security Wire Daily News – Feed for general information security information around a variety of topics. Averages 3.5 posts per week
Qualys Newsletter – Security feed put out by Vendor Qualys I use it to get a vendor’s take on vulnerabilities and vulnerability management best practices. Averages .7 posts per week
Eeye Security Blog – Eeye Digital Security’s blog for keeping track of their information security ideas and news. Averages 1.6 posts per week.
SC Magazine Cybercrime Corner – Another source for staying on top of cybercrime news. Averages 2 posts per week.

Email newsletters

SANS Security Awareness Newsletter – Nice monthly newsletter that can be used for internal information security awareness campaigns.
SANS @RISK Newsletter – Weekly newsletter that summarizes the top 3-8 vulnerabilities that currently matter most and how to mitigate the risk from them.
Security Focus Mailing lists – I subscribe to a few of the many different mailing lists they offer including Web Application Security and Penetration Testing. I used to subscribe to the popular BUGTRAQ but opted out due to the volume.
Slashdot newsletter – Useful cutting edge information security stuff here but I get the summary newsletter because the general RSS feed is very busy and difficult to stay on top of.
Microsoft Monthly Newsletter – Nice email newsletter for those of you using and trying to secure Microsoft products
Apple security mailing list – For you Apple fans to keep on top of security issues (yes security things happen on Apple devices too, and expect it to expand in the future)

Are you protecting your most important information assets?

Mark Kelly — Tue, 20 Dec 2011 23:49:41 +0000

Information security sometimes feels like a never ending challenge. There are a thousand different things that need to be done from patching systems to educating employees and any one hole can mean big problems. Smart companies have realized the impossibility of securing every asset and have changed the theatre of the information security battlefield.

Effective information security management is no longer about trying to stop every little problem that can go wrong that is an impossible task with failure guaranteed. Leading businesses are now focused on securing the intellectual property and operations that are most critical to their competitive advantage. This new approach is more advanced than previous information security approaches that attempted to throw information security controls against the wall in hopes that enough stuck to keep bad things from happening.

What are the advantages to approaching information security based on a critical asset protection model?

Helps focus your information security investment towards protecting the most important assets that matter.
Makes information security more manageable and makes realistic assumptions vs. assuming you can protect everything.
Allows you to be more specific about your information security objectives vs. operating in a more abstract manner.
Increases security oversight over important assets/business processes and enables customized monitoring specific to those resources

What are the challenges in implementing a risk based critical asset information security model?

Initially many organizations will struggle with answering the question about which assets are truly critical.
Requires a more collaborative model of information security with deeper level of engagement needed with key business partners. Many information security organization struggle with understanding which assets are truly critical because there is an insufficient understanding of how the business really works.
Requires a change in mindset from trying to secure the perimeter and keep the bad guys out to assuming they are already inside and layering your controls to focus efforts on protecting critical assets. This is not to say that firewalls and other perimeter based control mechanisms are obsolete only that they have proven ineffective as the primary mechanism of protecting an organizations critical intellectual property.
New security tools will be needed to help protect down to the data layer and assist in blocking advanced threats.

If your information security organization is still operating with a secure the perimeter mentality as your primary focus you risk becoming obsolete. More is expected of an information security organization in our knowledge based economy. You are expected to understand the business at a sufficient level to know what intellectual property and business processes are critical to ongoing success of your company. This requires deeper business knowledge and business relationships to help validate that you are focusing on the right things.

WordPress website error site reverting to old version

Mark Kelly — Thu, 08 Dec 2011 00:50:59 +0000

I have been noticing an intermittent problem with this website over the last 6 months or so where the site was reverting to a very old version of the site that showed my old design log and only old posts. At first I thought I had a cache problem on my pc and attempted to flush my local dns hoping that would resolve the issue. The problem manifested itself across multiple machines so I quickly realized that was not the solution but did not seek a more permanent fix since the problem was very intermittent in nature and I have been extremely busy (not a good excuse). When the problem reoccurred today I had finally had enough and logged a ticket with my web hosting support company to work on a permanent resolution.

Problem: Website for this site was having a problem and was reverting to an old version of the site (with an old logo design) and only showing posts as of 1/2012 and older.

Impact: Site design looked dated and visitors were not seeing the improved design/layout of the site or the new material posted on the site. I also suspect this hurt the site from a search engine perspective and lost traffic due to the site appearing old due to lack of new content.

Actions taken to attempt resolution: Thought problem was DNS related so flushed my local dns cache but realized something broader was going on when problem was found across multiple machines. Attempted to research problem using google search engine but most guidance was regarding webmaster tools related options and did not seem applicable. After failing to find a satisfactory fix I logged a support ticket with my webhosting provider.

Root Cause: I had to provide my webhosting technical assistance people admin access to the site and specify what database was used by the site. I created a unique temporary account/password for them and they completed the analysis and resolution very quickly. The root cause of my problem was found to be a corrupted WordPress table and once this table was repaired using the PhpMyAdmin tool the site is now displaying as it should be.

Lessons learned: Do not wait extended periods of time to deal with a problem. I could have had this issue resolved much sooner if I would have taken immediate action and logged a support ticket. The lunarpages support team was very helpful and quickly solved this issue once I provided them the needed access and confirmed the database id.

Information Security Implications: As mentioned above I had to provide site admin credentials to the technical support team to troubleshoot the problem. I followed the following security best practices during the interaction:

Had a full backup of my site before the work began
Created a unique temporary admin account just for this purpose
Deleted the account as soon as my support ticket was closed out successfully

This turned out to be a pretty good operational/security case study so I thought it would be useful to document and share.

How to fix a security certificate error while browsing the internet

Mark Kelly — Sun, 04 Dec 2011 22:21:54 +0000

The last week or two the pc only used by the kids had been having problems with a security certificate error when they were trying to browse the internet. The browsing eventually got where it needed to go but only after extra clicks of accepting the risks of going to a potentially bad site and adding an exception in the browser. The problem was happening with both Internet Explorer and Firefox browsers so I assumed that a virus was causing the problem.

I performed some basic antivirus scans using the free AVG antivirus software installed on the machine as well as Spybot Search and Destroy. Nothing overly incriminating was found by either scan only the expected low/mid risk cookies always found. I was a bit surprised at this result so started looking for some other alternatives of what could be wrong.

After a bit of research I was able to find a documented case that closely matched my situation. The suggested advice was to check the date on my pc because if the machine is dated in the past with an incorrect date this has been known to cause a problem with internet security certificates. Sure enough the machine had been reset to the original date of when it was purchased and the issue went away after the date was corrected.

Quick Summary:

Problem: Common area machine was generating security certificate errors/warnings while browsing the internet with multiple different browsers (firefox, Internet Explorer etc..)

Solution: Check the date on the machine and make sure it is at the current calendar day. The pc had somehow been reset to default settings and was dated back to 2007 which was the source of the problem.

iPhone 4s security accessories

Mark Kelly — Thu, 13 Oct 2011 16:04:11 +0000

Orders for the iPhone 4s are smoking hot and the volume is only going to ramp up between now and the Christmas season. With a new phone comes the need for new accessories to make your phone more attractive and keep it in good working order. Protective security cases and screen films are essential to help keep your iPhone 4s from suffering damage due to an accident.

iPhone 4s Cases – By choosing a case for your iPhone 4s you can help protect your smart phone from drops, scratches and other wear and tear related issues. Cases are must have accessories to help secure your iPhones and avoid costly repairs.

Boost Protective Case – Attractive black protective case is comfortable to the hand and lightweight which are important features to ensure you will continue to use it day in and day out. This case also provides extended battery benefits so it is one of the higher end cases available for your iPhone 4s.

splash VAPOR Slim-Fit Flex Case – This case is made of soft silicone which helps offer protection while keeping the weight in check. Fits nice and has been noted as high quality in the reviews and lists at a nice price of $14.95.

QuickFlipCase for iPhone 4/4S – Case is highly rated on Amazon.com and noted as a good value for the money. Has a useful belt clip that will give you the look of an Old Western gunfighter if you draw your iPhone 4s quickly from your belt. I’m your huckleberry..

OtterBox Commuter Series Hybrid Case – The normal OtterBox cases were noted as being a bit bulky but the Commuter Series is free from that problem and comes in a variety of colors unlike some of the other cases. I am partial to the white/black model which is linked.

Elago slim fit case – This case is priced at the very low end of the spectrum but offers solid value and extra protection for the price. Many of the reviewers were impressed with the slimness of the case and how it felt natural in their pockets.

Tuneband for iPhone 4/4s -Offers front and back device protection and the unique feature of an arm strap for runners and other people who want to take the iPhone 4s on the extreme go. Available in black, pink, purple, red, and glow in the dark.

iPhone 4s Screen films/protection – To help reduce glare, smudging and lower risk of scratch for your iPhone 4s display.

Halo Screen Protector Film – High quality low cost films are a good option to protect your phone screen and keep the smudging/glare problems to a minimum. $5.95 for 6 films is not a bad deal at all.

splash Masque Clear Screen Protector – 5 pack of films is very affordable and has had mainly good reviews noting its easy bubble free installation and good fit.

AcaseView Screen Protector Film – Another quality film option this one comes in a pack of 6 for $7.25.

iPhone 4s car mounts – Helps securely mount your device in your car to function as a gps or for other hands free use (please be safe and obey local laws). Remember phones can become projectiles in sudden stops or accidents so it is important to securely mount them and keep them off your seats.

Kensington SoundWave Sound Amplifying Mount – Higher end then the one recommended below and my top choice for a reasonably cost mount.

Kensington Quick release car mount – Kensington is a trusted name in the security lock/mounting industry and this mount is highly rated from those who have purchased it.

Black Ultra Durable Compact Car Mount – Not yet rated due to newness

Motorcycle Handlebar Mount – For motorcycle enthusiasts this product is relatively knew but an intriguing option (be safe on the bikes please)

Happy and secure iPhone 4s’ing!