The Shock Rockers of the IT Security Industry

Shock Rock: borderline musical idiom. The performers usually play something relatively extreme as compared to the mainstream of the contemporary music. The main stimuli is visual, as shown in the various acts live performances (or “shows”). Usually, the music is not that good and most of these bands prove to be nothing more than a one trick pony. The amount of shocking acts in public permitted by law is deterministic, the genre is quite unpopular now as most of what is to be seen has been shown already back in the 80s. “How is this related to the IT Security industry?”, the astute reader might remark?

Today I had the dubious pleasure to use a port scanner made by a known security company. I will give no names but trust me you have heard this one and maybe bought a book from them or two. It is your typical win32 software, version X.Y, with X being much much greater to 1 (therefore, been revised and improved with every iteration. Running a portscan towards a firewalled VM, it reported filtered ports as open, while nmap was displaying them as closed or filtered. At first I thought that there was something wrong with my firewall configuration. Upon further investigation, when the tool was trying to make a simple connect() scan, reporting timed out ports (-j DENY) as open.

If you are familiar with Bruce Schneier, in his “Secrets and Lies” book, introduces the “snake oil” merchants. Unfortunately, even with a slightly more security educated IT community, frauds like them described in the book can often be encountered in the field. Like our pals from [CENSORED]. Hey guys, is it too much to ask that your connect() portscanner (with a version greater than 1, mind you) at least expects the presence of a firewall someplace? I am sure that quite a lot of pimping goes into your books, I would not know. I have bought one of your books back in 2001 something and it was a terrible waste of money and time. To cut a long story short, you have a bunch of clueless posers with a good PR department charging the hell outta their clients and presenting themselves as authorities within the IT security industry. Unfortunately, the shock rock effect of their material, the overestimation of how “them pesky hackers are out there to get YOU“, soon will wear off and those morons will be exposed for the frauds they are.

Greek spies plant rootkit in a phone exchange

via Techworld.com

A highly sophisticated spying operation that tapped into the mobile phones of Greece’s prime minister and other top government officials has highlighted weaknesses in telecommunications systems that still use decades-old computer code.

The spying case, where the calls of around 100 people using Vodafone’s network were secretly tapped, remains unsolved and is still being investigated. Also complicating the case are question marks over the suicide in March 2005 of a top engineer at Vodafone Group in Greece in charge of network planning.

A look into how the hack was accomplished has revealed an operation of breathtaking depth and success, according to an analysis on IEEE Spectrum Online, the website of the Institute of Electrical and Electronics Engineers.

The case includes the “first known rootkit that has been installed in an [phone] exchange,” said Diomidis Spinellis, an associate professor at the Athens University of Economics and Business, who wrote the report with Vassilis Prevelakis, an assistant professor of computer science at Drexel University in Philadelphia.

A rootkit is a special programme that buries itself deep into an OS for some malicious activity and is extremely difficult to detect.

The rootkit enabled a transaction log to be disabled and allow call monitoring on four switches made by Telefonaktiebolaget LM Ericsson within Vodafone’s equipment. The software enabled the hackers to monitor phone calls in the same way as law enforcement agencies would do, but without the normal required court order. The software allowed for a second, parallel voice stream to be sent to another phone for monitoring.

The intruders covered their tracks by installing patches on the system to route around logging mechanisms that would alert administrators that calls were being monitored. “It took guile and some serious programming chops to manipulate the lawful call-intercept functions in Vodafone’s mobile switching centres,” the authors wrote.

The secret operation was finally discovered around January 2005 when the hackers tried to update their software and interfered with the way text messages were forwarded, which generated an alert. Investigators found hackers had installed 6,500 lines of code, an extremely complex coding feat.

“The size of the code is not something that somebody could hack in a weekend,” Spinellis said. “It takes a lot of expertise and time to do that.”

The investigation, which included a Greek parliamentary inquiry, netted no suspects, partly because key data was lost or was destroyed by Vodafone, the authors wrote. It is not known if the hack was an inside job.

Vodafone may have been able to discover the scheme sooner through statistical call analysis that could have linked the calls of those being monitored, to calls to phones used to monitor the conversations, they wrote. Carriers already do that sort of analysis, but more for marketing than security reasons.

But the defense against rogue code, viruses and rootkits is complicated because of the way the telecom infrastructure has developed. “Complex interactions between subsystems and baroque coding styles (some of them remnants of programmes written 20 or 30 years ago) confound developers and auditors alike,” the report said.

A quick look at a recent deface and a rant about the job market

If anyone is watching the news, after the Greece Vs Turkey football match (Greece lost 1-4 !!), the official Greek football site was defaced by some allegedly turkish hackers. Defaced is a way to say the least, I cannot tell the exact size of damage performed but once a host is compromised, it is compromised. The site was supposedly taken down for ¨securing things¨. A week after the fact, it had glaring SQL injection holes, nowdays (after a quick scan I performed) the holes are still there, not accessible via a standard web browser but easily accessible enough using any web vulnerability detection and exploitation suite. I am not going to give away more details to protect the not-so-innocent.

Some people complain that in Greece it is hard to get a job doing IT Sec for a living. More often than not IT sec guy here means system administrator (the term ¨consultant¨ is reserved for middle level management). I do not pretend to be a skilled guy in the IT sec area, I know a few tricks of the trade and that´s it. I know some really talented guys and yet they do something completely different for a living. Why? Why leave a country´s infrastructure open to attack? (a quick scan at related turkish institutions provided a better overall security). Other countries pay to import minds and skillsets. Here, I guess, we export them abroad or force them to make a career change. Exceptions there are of course, but the overall outlook is kinda bleak. This is not only related to IT Security. GFX coding, audio engineering is definitely a no-go here from a career perspective.