Just a quick update to my earlier blog regarding the problems currently being faced by the University of Exeter. It seems the virus is exploiting known flaws in the Microsoft Vista and Microsoft Server 2008 platforms.

Zack Whittacker, who blogs for ZDNet, has a source inside the university here in Exeter. Apparently, the virus is mainly targeting Vista SP2 machines and the IT staff at the university are trying to use patch MS09-050 to reduce the attack surface.

It is understood that this virus has not been seen outside of the Exeter campus, but clearly demonstrates the disruption that a carefully crafted attack can cause.

There is a suggestion in Whittacker's blog that some critical patches had not been applied (using the Microsoft System Update Service).

We strongly believe that machines should regularly be checked to ensure that patches that should have been applied, actually have been applied. If the loop is not closed in this manner then these sorts of problems are eventually inevitable.

We are concerned that many SMEs, who often do not patch properly, may be at considerable risk if this virus escapes the Exeter campus.

In addition, I remain concerned about the zero-day virus threat. A virus that spreads quickly and easily such as this one, that exploits a flaw such as the one in Internet Explorer that saw Google hacked in China, with a drive-by infection capability on a site such as any of the international versions of Google would lead to huge economic disruption across the globe.

For starters, many people set Google as their home page, so in this apocalyptic scenario, they would be infected and spreading such a virus internally inside the organisational firewall without detection or defence the moment they went online...

The recent caution of a man in Redditch by West Mercia Police for "dishonestly obtaining electronic communications services with intent to avoid payment" raises some interesting questions.

According to the BBC News Web Site: "He attracted attention from neighbours in the early morning, as he had put up cardboard around his car windows but the light from his computer could be seen through the back window." This was clearly suspicious behaviour, but there are plenty of open wireless access points where their owners are quite happy for people to "borrow" their bandwidth since (I assume) they would hope to do likewise elsewhere themselves.

Indeed, this very notion of "scratch my back and I'll scratch yours" is one of the key underpinning elements of the early and non-commercial Internet, where connected organisations and individuals utilised each others equipment on a quid quo pro basis.

What concerns me and which raises an important issue is how do you know that a particular wireless hotspot is open for free access? In a residential area, it is not plausible to put up signs everywhere stating that Number 16's is free, but Number 17 will sue you...!!

Furthermore, a lot of existing Wifi-enabled equipment will enumerate and try to connect to any access point. Does that constitute an offence?

Commercial hotspots simply redirect all web accesses to a login screen until payment has been accepted. Other hotspots that are intended for private use only and that are properly configured will make it very difficult for anyone else to use (and certainly trying to would clearly be abusive behaviour).

The problem is poorly configured wireless access points. You cannot be sure whether you have the owner's permission to use their service.

One interesting idea is whether future wireless access points should have a simple web server that displays a "usage notice" and runs a "well-known" web service stating whether or not the access point is free for use. If this was enshrined in a standard then Wifi devices could assess whether they were connecting to a hotspot that they could freely use. This would probably also invoke a greater degree of protection from the Computer Misuse Act in the United Kingdom and similar acts in other jurisdictions.

Indeed, perhaps the web-service concept could be extended to other Internet services such as email. If Internet standards were established so that the "usage policy" service became well-known, then connecting devices could query whether their access or use of a particular service was acceptable or not. Failure to comply would then leave the owner of the device wide open to prosecution (although catching them might be difficult!)

At least the honest would know whether they were abusing a free resource or not...

I read recently that laptops are becoming more popular than ever and, based on sales, are likely to overtake the humble desktop in the nearing future in terms of units shipped.

Other than the fact the laptops tend to be much more expensive to run, I am increasingly concerned about how they really are often the "security backdoor" into the corporate network.

I've read several reports of concerns about classic middleman attacks in open wifi hotspots, such as those in most cafes, motorway service stations and airports. Are you really sure you've connected to the hotspot or a rogue unit being used to probe your PC?

Most desktop PCs are well protected in the corporate world behind sophisticated firewalls and advanced antivirus scanners that check pretty much everything that passes in and out of the organisation.

The laptop, in comparison, is unlikely to have such a sophisticated firewall and is unlikely to have had its antivirus system updated since leaving the office, which could well be weeks.

The idea of running a bogus hotspot near one that sees frequent use is probably an attractive proposition to a hacker. A machine that doesn't have a particularly sophisticated firewall and which has some of its critical defences lower than it should be is clearly an easier target.

It is probably even more desirable as a means of attacking the corporate network it belongs to. If the machine is compromised while out of the office, it will literally be a Trojan horse when it next docks back inside the corporate environment.

Alarmingly, experience suggests that many businesses do not take laptop security seriously, particularly when they only have the odd one or two for senior executives - precisely the people who are likely to carry important and confidential data on them.

Revell Research Systems most definitely recommends treating all corporate laptops with considerably more suspicion than your average PC!

I would just like to warn business people in the United Kingdom who might have recently completed a Self-Assessment Tax Return of a particularly ingenious (if not nasty) phishing scam.

Technically, it is not much as far as phishing scams go, but its timing and content might just lull some people into acting on it.

The email advises the recipient that HM Revenue and Customs have just completed their calculation of the recipient's tax return and notifies them that they have actually overpaid some tax.

The deadline for the submission of self-assessment tax returns is the 31st January, so such an email is at least plausible in February - and who would not be pleased to receive a tax rebate?

The email lures the victim to a repayment page, which asks for their account details, and I suspect that this is where their nightmares would really start if they did provide their details...

The actual email contains absolutely no information relating to the recipient, which should ring the alarm bells of those receiving them.

My comments on another (technically much nastier) phishing scam earlier this month about looking out for and including "shared interactions" in your emails apply here, so if you think you might have been lured, then you should read that blog entry too.

You have been warned!!

There is a particularly nasty phishing scam in circulation, which has been reported on by Tom Young of Computing (6th February 2007).

Apparently, the scam involves an email with a (fraudulent) link to an "as yet" un-named British bank. Most such links in this sort of scam email actually point to an address that is different to that of the bank's real web site. It may be very similar to the real thing, but nonetheless, it is different.

Although such links are often in text and frequently look like the real thing, most email clients will reveal the true target address of the link when the mouse is hovered over it.

This new scam manages to appear to be targeting the correct web site, even under close scrutiny, but actually redirects the user to a fraudulent site.

I would strongly advise people to always manually type in the address of web links received in unexpected emails that cannot be verified to have been sent by the sender, rather than just to glibly click on them.

I would also encourage email users who need to send unexpected emails (especially those with links or attachments) to colleagues to mention some form of "shared interaction" in the opening preamble of their emails.

The sort of thing I mean by "shared interaction" is a reference to an earlier email or meeting or some other event that both parties know about and would be difficult for someone else to forge.

Most scam emails are automated, so it would be nigh on impossible to include this sort of detail. In some respects, the traditional "Further to my letter of ..." type of opening to standard written correspondence is particularly useful in this context. It is natural and unobtrusive, but reassures the reader that the writer is who they say they are!

This morning's article on the BBC News website that 11 million customers of the Nationwide Building Society in the UK have had their identities put at risk is a reminder to businesses that laptop and PDA security should be high on their agendas.

A considerable amount of similar data is held on many organisations' laptops and PDAs across the country. Indeed, most laptops are only secured with a password and anyone familiar with the various cracking tools readily available on the Internet will know just how easy it is to gain access to such machines.

Very few firms actually consider encrypting data on their laptops to defend against exactly this sort of scenario, but doing so would mitigate the risk considerably.

Many firms are allowing and even encouraging their staff to carry PDAs (which I do believe is more than appropriate, being something of an advocate for them). However, I am often alarmed at just how few insist that they should even be minimally secured with a simple password and even more alarmed at the poor grasp of the security issues that those that carry them actually have. As a matter of course, PDAs carry names and addresses of individual contacts, which obviously is a data protection issue.

The problem is that it doesn't become an issue until a laptop or PDA is lost or stolen. It is then that the reality dawns about just how bad the situation could be, but by then the damage has already been done.

Although I doubt that the laptop's data was looked at in this case, with the laptop probably being reformatted and sold on by the thief as quickly as possible, it won't be long before criminals start considering the potential value of the data on stolen devices. I suspect we will start to see cases where companies are blackmailed and an accelerating trade in illegally obtained data. Indeed, I am prepared to predict that we will see laptops and PDAs stolen to order because the potential value of the personal banking details of 11 million people is considerably greater and apparently easier to obtain than other items that might traditionally be stolen in a domestic burglary (which according to the BBC was how the Nationwide's laptop was stolen).

It also occurs to me while writing this article that this builds on a theme that seems to be unintentionally developing in this blog concerning the general cavalier attitude that financial institutions seem to have towards their customer's security. (For instance, my article on Bank Fraud in July.) I note from the BBC's article that the Nationwide have taken three months getting around to telling their customers about the incident.

Another alarming factor about the Nationwide case is the sheer number of people that must be affected. 11 million people represents almost one in five of the UK population, which is very close to every household in the country being affected statistically speaking.

Furthermore, I find it staggering that the Nationwide actually allowed an employee to leave their offices with so much data. It would have been considerably more alarming if the data had contained authentication details such as PIN numbers and passwords...

The problem with data like this is that its just another file on the disk - something pretty insignificant to look at in Windows Explorer and easily forgotten about. My experience is that most people have considerable difficulty in remembering what files they do have on their disks, so I am a bit alarmed that this data might not have been the only important things stored on the Nationwide laptop.

One would imagine that banks and building societies take considerable care in securing their customers' data. Indeed, the same level of care that the government might take storing the details on each and everyone of us in the proposed national identity card database.

The casual ease with which this data fell into the wrong hands has important ramifications for us all...

Further to my blog yesterday about the VML Exploit in Internet Explorer, Microsoft have released overnight (UK time) an out-of-band patch. Early news of the release was reported by Microsoft's Craig Gehre on the Microsoft Security Response Center Blog.

Microsoft clearly consider this vulnerability to be serious, since they rarely issue patches outside the normal monthly cycle.

Microsoft are taking advantage of the need to release MS06-055 by re-releasing MS06-049, which apparently needs some alterations.

Sunbelt Software have recently (21st September 2006) discovered a serious flaw in Internet Explorer that potentially allows vulnerable machines to be completely compromised.

According to yesterday's BBC report, Microsoft are still considering whether the flaw is sufficiently serious to release a patch to remedy the flaw sooner than the next scheduled tranche of patches, due on Tuesday, 10th October 2006.

Worryingly, the flaw has already been exploited according to researchers at Sunbelt Software. They have visited web sites which implement the so-called VML Exploit that have downloaded large amounts of spyware and other malware to otherwise fully protected and patched machines.

Alex Eckleberry of Sunbelt Software mentions in his blog of 25th September 2006 that the firm has started to see spam emails (in the guise of Yahoo greetings cards) that lure victims to web sites with the exploit code. The Sunbelt Blog currently has a lot of information on this vulnerability. (The SecuriTeam Blog has a FAQ for those interested in some of the more technical aspects of the exploit.)

Thankfully, this doesn't get that close to our "zero-day scenario" in which a mass-mailed virus is automatically triggered on arrival in end-user's inboxs, exploiting unpatched flaws, but it is another timely reminder that known flaws are being actively exploited before official patches are made available.

We currently do not generally advise applying third party patches that are fast becoming the rage, simply because they could cause as much trouble as they are meant to prevent.

We would advise people to be particularly vigilant when handling email. We strongly advocate ensuring that end-users remain alert. It has often been human vigilance that has saved the day rather than automated protection.

If you would like further advice, please contact us.

There seems to be a growing interest in the media of ransomware. Ransomware is malware (viruses and the like) that encrypts the victim's data so that they can't access it. The perpetrator then offers a ransom to recover it for them.

My first thought was that this would not be a long-lived problem since the perpetrator will have to reveal sufficient detail about themselves to collect payment and I initially thought that this would clearly lead to their apprehension.

However, it did occur to me that if they did this from a country whose laws do not recognise the crime or where there was no extradition treaty, they might get away with it...

I was interested to read the BBC article highlighting the concerns of Professor Antonia Jones and her team at Cardiff University regarding the security of the HSBC Online Banking Web Site, particularly in light of my earlier blog entry.

It seems that Professor Jones believes that there are serious flaws in the way that HSBC's online customers access the bank's web facilities. These seem to centre around key logging (the recording of key strokes by either hardware or software tools). The problem with key logging is that the keystrokes are captured before they are encrypted as part of the secure connection between the user's web browser and the bank's web site. This means that user names and passwords are easily captured and can be relayed to the perpetrator.

Personally, I no longer use third party computers (except those where we are responsible for their security) to conduct any confidential transactions. The risks are simply too great and I would certainly not recommend anyone else doing so either.

According to the BBC, the bank says that the "problem does not pose a serious threat to its customers", although the Cardiff researchers suggest that anyone exploiting the flaw would gain access to an account within nine attempts.

I believe that a really useful administrative facility that should be built into Microsoft Windows is the ability to login as a user by using an administrator's credentials. 

System Administrators would often benefit from being able to log into a user's account to test the user's environment. Currently, this would either be done by either knowing the user's credentials or by resetting the password on the user's account to gain access. The former method works well for small business, but does have obvious security implications. The latter is a pain for the end-user when "strict" password procedures are in place governing their use of previous passwords and the like.

I envisage that an administrator faced with the CTRL-ALT-DEL dialogue should be able to press a button to extend the dialogue with an extra "Login As" textbox. They should then be able to provide their own username and password as well as the account name they are intending to login to. I would expect that this would require the administrator concerned to have been granted a "proxy right" and that its use would be written into the system's security event log.

This would then allow an administrator to use the account without any elevated privileges. It would also be useful if the administrator had the ability to login and opt out of group policies or to login to the account with their own administrative rights.

I remain concerned about the possibility of "taking out" a Microsoft Exchange server, especially one installed as part of Small Business Server.

I've just finished checking over a (small) client's server that had taken on board something like 27,000 emails over the weekend. These emails were sent to spurious addresses at the domain concerned. The server naturally responded by sending out a Non-Delivery Receipt (NDR) to the apparent sender. The problem is that the sender's email was forged. It seems apparent that these emails were sent with the specific intention of causing problems for the person whose email was forged. They (presumably) will also receive 27,000 emails via my client alone. Why do it? Because the attacker's identity is carefully masked from the perpetrator by the middleman (my client).

This is extremely dangerous to both the middleman and the victim if their respective servers run low on disk space, potentially causing their email systems to fail. This might be worse on a Small Business Server (where appropriate precautions have not been taken) because it is, by its very nature, the domain controller (DC) as well, potentially bringing down the internal network too.

This is the second such attack we have seen in the last seven days.

The spurious NDR problem seemed to be limited to virus replication mechanisms in the past, but now there seems to be a new and more dangerous trend emerging towards using the NDR process for denial of service (DoS) attacks.

A recent judgement in the United Kingdom (that I mention recently in an earlier blog entry) makes it clear that such attacks are not currently illegal under English Law. One of my current undergraduates, Sara Sheridan, touches on these issues in her recent blog entry.

There are some mechanisms that can be put in place to prevent systems being exploited like this. The most obvious is to switch the NDR response off on servers, but this seems to be an important part of the Internet email system (albeit most NDR receipts are difficult for end-users to interpret).

What we need is for major systems such as Microsoft Exchange to start shipping with logic that is able to identify such attacks and to suspend NDR responses to the purported sender while the emails are being received. One is surely enough for most human senders to get the message...!

According to a news article being carried by the BBC (http://news.bbc.co.uk/1/hi/technology/5041848.stm), a group of hacker have hit a web site operated by the Swedish police.

It seems that this was simply a denial of service attack, which swamped the machine with requests.

Unfortunately, denial of service (DoS) attacks seem to be becoming more prominent and I suspect we will soon need to be helping smaller clients ensure that their boundary devices are capable of withstanding such attacks.

I suspect it will also come as something of a shock to people when they learn how expensive some of these security devices are in comparison to "bog standard" equipment.