The Virtual Vault

Achieve website security through distributed isolation

Hacker...cracker...cyber-attacker. As these criminals become more sophisticated so must your efforts to thwart them. One defense strategy, known as distributed isolation, disperses the attack surface of a computer system into isolated pieces. This strategy effectively divides system functionality and data in a way that makes it nearly impossible for an attacker to join them back together.

Two-factor authentication works in a similar way. Under this authentication method, a user needs two things to access the system; something you know (i.e. username and password) and something you have (i.e. authentication token or cell phone). Without both, an untrusted user cannot log into the system.

The first tactic in this strategy is to separate passwords from other data in your database. Large corporations typically keep passwords in an LDAP database and website data in a relational database. In this scenario, if the relational database is compromised the passwords in the LDAP database would be safe. Mashup APIs like RPX abstract out the nuances of provider specific authentication and allow your website users to authenticate with their existing identities from Facebook, Google, Yahoo!, Twitter, MySpace, AOL, Windows LiveID or other OpenID providers. This simple strategy would have prevented the type of security breach that occurred at RockYou.com where 32 million email addresses and passwords were exposed.

The next tactic is to separate encryption keys from encrypted data. Encryption keys should not be stored in the same database that contains encrypted data, especially when using symmetric-key encryption. Ideally, a random encryption key is generated for each encrypted item from a data set stored in the file system or in the cloud. This way, not only would an attacker need to compromise your database they also need to compromise your file system or cloud data storage infrastructure in order to decrypt the data.

The final tactic is to separate highly confidential data from less private data. Similar to the previous tactic highly confidential data should not be stored in the same database as less private data. The confidential data should be encrypted, then serialized in some manner and stored in a separate data set.

For example, let’s assume that I have a brokerage account that stores highly confidential beneficiary information for an expensive asset. Access to this information is protected by RPX. It uses myOpenID as the OpenID provider, which in turn uses my cell phone for two-factor authentication through CallVerifId™. After logging in, I choose to assign a new beneficiary to this asset. When I submit the information, the beneficiary information is serialized as XML, randomly encrypted from a set of keys stored in the file system, and stored in the Amazon S3 cloud infrastructure as a bin file with a generated Globally Unique Identifier as the file name.

In order to access this information an attacker would need to compromise the data in either one of two ways: 1) Use my cell phone, OpenID url, and OpenID password to login as me, or 2) Compromise the website file system, the relational database, and the Amazon S3 cloud infrastructure...then reverse engineer the website code to determine how to fit all the pieces back together.

As you can see from this example, a properly implemented distributed isolation defense strategy makes it nearly impossible for an attacker to compromise your data. Let’s hope your service provider agrees!

James Bell

Leaving home? Don’t tweet about it!

Common sense tells you not to advertise the fact that you're not at home. Surprisingly, everyday thousands of people advertise this very fact on Twitter. A new website appropriately named PleaseRobMe.com shows tweets that specifically contain keywords such as "not at home" and "on vacation".

How dangerous is this? Just for fun, I closely examined one of the tweets. It was from a young entrepreneur in Salem, OR advertising the fact that he had just settled down at the local Starbucks. A couple of Google searches quickly revealed his iPhone number, websites, and various social media accounts. His website also uses foursquare.com, which gave me a map of his exact location.

One website, intelius.com, offered to sell me his full name, address, age, date of birth, home phone number, relative’s names, address history, average income, and home value for just $0.95...all of the information a burglar would just love to have. For criminals, it doesn’t get any easier than this!

James Bell

Lifestrand: A new digital afterlife service

Lifestrand is a new social utility for sharing memories about your departed loved ones. This new digital afterlife service brings together people for purposes of celebrating the lives of those no longer with us.

A memorial is created for the deceased consisting of free space to upload photos, post written memories, and publish timelines that refer to events in your loved one's life.

James Bell

Understanding file security

Lots of websites offer upload space for you to store files. A few even claim to store your files securely. Even fewer explain how exactly what secure means. A securely stored file must have at least three characteristics. It must be unreadable to unauthorized parties, it must be tamper resistant, and it must be available when needed.

Making a file unreadable to unauthorized parties requires encryption. The encryption algorithm used must be strong, such as 256-bit AES. The file must be encrypted while it is being moved (in-flight) between computers using SSL. More importantly, the file must remain encrypted while it is stored (at- rest).

Making a file tamper resistant requires taking a digital signature. This signature is created using a hash function, which is a mathematical procedure that converts a large amount of data (your file) into a small unique data value (your signature). This same procedure is used by criminal forensic specialists to ensure that digital evidence remains tamper free. A digital signature of your file should be taken immediately after it’s uploaded and again just before it’s downloaded. If the two signatures do not match, your file must not be downloaded.

Making sure your files are available when needed requires that a regular backup be taken. In most cases a periodic (i.e. weekly) backup may suffice. However, under high volume conditions this method may be inadequate. A more robust approach requires that data files be stored within an infrastructure that is both redundant and distributed. This means that multiple copies of data files (redundant) are stored in geographically separate locations (distributed). If a file is lost or destroyed in one location it is immediately available from another location.

Make sure that your service provider clearly states how your files are stored. If nothing is mentioned about these safety measures, it’s highly likely that no precautions are being taken. If your file is intercepted by a hacker, you may not get a second chance.

James Bell

Keyloggers pose biggest threat of identity theft

You may be shocked to learn how easy it is for another person to monitor everything that you are doing on your computer. Keystroke logging software (known as keyloggers) tracks your keystroke activity, typically in a concealed manner so that you are completely unaware of being monitored.

When a keylogger is installed on your computer with your knowledge (which is legal), it’s known as Internet Monitoring and Surveillance software. This is usually done by employers who monitor their employees computer usage or by parents trying to limit their children’s Internet activity.

When a keylogger is installed without your knowledge (which is illegal), it’s known as spyware. The keylogger is usually installed along with shareware or when your computer becomes infected by a Trojan.

By operating in stealth mode, you have no idea that this software is active on your computer. It completely compromises your privacy by transmitting your activity to others through your Internet connection. Even worse, most antivirus scanners fail to detect this type of intrusion. In fact, most scanners fail to detect 70% of keyloggers available on the market.

What can be done? Several software products, such as Identity Patrol and Spy Reveal, are currently available that exclusively focus on detecting keylogger activity. We highly recommend that your run this type of software in tandem with your antivirus scanner.

James Bell

Don’t get clickjacked

Clickjacking is a fiendishly clever way to hijack your website. This hacking technique overlays a legitimate web page with an invisible hacked web page. When you click a button, you unknowingly click the button on the invisible overlaid page.

The most famous example of this hack was the “Don’t click me” exploit of Twitter. Suddenly, Twitter was full of messages pointing to a website with a button that read “Don’t click me”. For a more detailed explanation, see Daniel Sandler’s blog article Twitter’s “Don’t Click” prank, explained.

To mitigate this problem web pages should contain a framekiller script that prevents framing of invisible web pages. However, this script can still be hacked on older browsers. If you are an Internet Explorer user, you should upgrade to Internet Explorer 8, which contains enhanced security features that directly address this problem. Firefox users should install the NoScript Firefox add-on to protect yourself against Clickjacking attacks.

James Bell

How is your data encrypted?

A virtual safe deposit box must provide the highest degree of safety to its users. Data stored on its servers must be encrypted. Data at rest is particularly sensitive to hackers, so it is vital to encrypt information stored in databases and file servers.

Encrypted data is only as good as its encryption algorithm. Recently, hackers have broken the 768-bit RSA algorithm, although the 1024-bit version is still safe (for now). With the increasing amount of computing power available to users, weaker encryption algorithms will become more susceptible to cracking by hackers.

AES/Rijndael is a strong encryption algorithm, which is highly resistant against brute force attacks, such as linear cryptanalysis and differential cryptanalysis. The US Government uses the AES algorithm to protect TOP SECRET information. A 128-bit AES encryption key is roughly equivalent to 2600-bit RSA key.

Before choosing a virtual safe deposit box provider make sure that you understand exactly how your information is stored. Your provider should employ a double encryption standard where data is encrypted in transmission ("in-flight") using SSL and in storage ("at-rest") using a 128-bit AES algorithm or better.

James Bell

Is your password in harm’s way?

A virtual safe deposit box is meant to hold your most precious information. So, it’s prudent to ask your service provider exactly how they store your information? In light of the recent security breach at RockYou.com, where 32 million passwords were exposed, your provider should, at the very least, publish a security policy clearly stating how information is stored.

Your provider should encrypt (hash) passwords that are stored in a database. Passwords can be further disguised through a technique called salting, where additional data is stored with the password prior to hashing. If the database is hacked, the passwords will be unreadable. Salting the passwords makes it far more difficult for a password cracker program to decipher your password.

A more secure approach would be to use OpenID or RPX for authentication. This way, passwords are stored off-site. Some OpenId providers, like MyOpenId, also offer SSL certificate sign in and two-factor authentication.

Additionally, your service provider should prevent their database from being hacked by guarding against SQL injection attacks. This security breach allows a hacker to enter database commands into an input box. If successful, this technique reveals details about the database, which allow the hacker to steal information. Input data should be sanitized using tools such as AntiXSS. Another defensive strategy is to query the database exclusively through stored procedures and disallow the use of Dynamic SQL.

Make sure to change your password often. If you suspect a security breach, change your password immediately and contact your service provider. Learn how to create strong passwords and avoid phishing attempts. Once your information is compromised, you will not get a second chance.

James Bell

Sources

RockYou Hacker: 30% of Sites Store Plain Text Passwords
by Jolie O'Dell

One Of The 32 Million With A RockYou Account? You May Want To Change All Your Passwords. Like Now.
by MG Siegler

RockYou Hack: From Bad To Worse
by Nik Cubrilovic

LBS technology to revolutionize home inventory services

Location Based Services (LBS) will soon provide powerful solutions that provide real-time tracking of personal property. Small inexpensive devices, known as S5 tags, periodically transmit their location through a rapid-response wide area network. Location information passes to a telemetry server, which in turn, is sent to an application through the Internet.

These tags incorporate the necessary electronics, battery compartment, antenna elements and external housings to allow the device to act as a self-contained transmitter. In addition to location information, a tag can also transmit other information, such as temperature, meter readings, running hours, fluid levels and more.

Battery life is estimated at 4 years and individual tags are priced at under $10. On-going service is about $1 per month per tag.

A tag can be inconspicuously attached to your personal property. If your property is lost or stolen, it’s location can be instantly determined, greatly reducing recovery time.

James Bell

Sources:
S5 Technology
S5 Wireless

S5 Tracking Chips Will Run for Four Years, Cost $2, Weigh Nothing
Gizmodo.com

Digital inheritance requires sound estate planning

Lately, a great deal of attention has been given to the digital afterlife, especially gaining access to the deceased’s email account. A digital asset, like any other asset, is subject to local laws concerning descent and distribution.

First of all, you need to determine if the digital asset is really an asset at all. You may be surprised to find that the Terms of Service (i.e. fine print that you agreed to before using the provider’s service) give you no ownership rights to your email.

Next, digital assets need to be clearly documented in your will or trust. If you don’t have any of these documents, you will most likely need a court order to access these assets. Never assume that naming a beneficiary with a third party beneficiary service will allow a digital asset to pass out of your estate. You could spend hundreds of dollars on this type of service only to find that it is not legally binding. Even worse, depending on local law, accessing an account without legal permission could constitute a criminal offense.

If passing on emails to loved ones after death is really important, you should probably use a secure email service which is committed to privacy and ownership rights of data that you generate. One such service, Privacy Harbor, requires that detailed account information be included in a legal document (such as a will or trust), as well as access rights for the beneficiary. Under normal circumstances, Privacy Harbor requires a court order to grant access to any email communication to anyone other than the account holder. In case of death, access is granted if Privacy Harbor is provided with the complete email address and password along with a copy of the account holder’s death certificate and legal document in which access rights were granted.

Be cautious when entering detailed account information into a will. When a will is admitted to probate court, it becomes public record and can be viewed by anyone desiring access. Store your passwords in a safe place, like your virtual safe deposit box, outside of your estate plan. Alternatively, a revocable living trust or pour-over will may be a more desirable place to document account information because these documents are designed to avoid the probate process and do not become part of the public record.

Make sure to contact a professional estate planner for exact details on your specific situation. If not, those precious emails could end up in the Trash folder.

James Bell