I am sure most of you will have read about last weeks security breach with Kaspersky Labs, the Russian AV vendor. Read more here.

So this has to raise the questions, who is securing the security vendors. Kaspersky say that no data was taken, although this is probably due to the ethical nature of the Romanian hackers, but no one really knows. The story goes that the hackers utilised Google queries to identify Kaspersky systems that were vulnerable to SQL injection, and I think this is really the problem here. We all know how excellent Google Hacking can be, and the power of the search engine queries available, and even though you might need some awesome Google-Fu for some searches, even the basics often yield excellent results.

What this re-emphasises is that if the hackers can resource themselves, and take the time to keep up with vulnerabilities, then organisations security teams should do the same.
So InfoSec professionals should be encourage to spend time keeping up to speed with vulnerabilities associated with their environment, as well as aquiring fundemental skills to carry out activities such as Google searches to understand the organisations risk factors.

Check out these 2 sites below for information on exploits, and patch releases as a first start.

• Milw0rm – Exploits, Vulnerabilities, Papers, Code, etc
• CPNI – Centre for the Protection of National Infrastructure (Patching Advisories)

A recent survey by Kroll Ontrack shows that over 90% of laptop hard disks they recieve for data retrieval are not encrypted.

I admit I dont really find this surprising, companies are not always really aware of the risk of data loss and theft, and especially with portable devices that are easily snatchable. Also with everything security related it can sometimes be difficult to convince the business of the Return On Investment.

Organisations should focus on the financial implications of data loss, the costs to inform their customer, brand damage, penalties to governing bodies and compliance implications.

With so many varying solutions available for partial and full disk encryption, now is an excellent time to consider technical solutions to significantly reduce the risk and exposure levels around data loss.

This may be news to some, but a repetition to those already in the know.
In the past there has been evidence to show how MD5 collision can lead to the abuse of signatures from a certicate of authority.

A post by Jürgen Schmidt covers some new tests by some rich hacker folks who have 200 PS3’s and use these to carry out some SSL MD5 hash collision attacks.

Excerpt –

Using a cluster of 200 Playstation 3 systems, it took the researchers two days to create two valid certificate requests with predetermined data fields that resulted in identical hash values. The researchers only modified the contents of unimportant fields, for example the Netscape comment extension. They got the RapidSSL Certification Authority to sign the first request, issued for a domain in their possession. Then they attached this digital signature to the second certificate that confirmed the identity of the fictitious “MD5 Collisions Inc.” Certification Authority. Since the second certificate’s hash value is identical to that of the signed original, no program can detect the forgery.

This approach is called a collision attack. Attackers can modify both the subsequently presented forged certificate and the pre-signature original, until two samples with the same hash value are produced.

This is all well and good and interesting, but what can you do about it? Well now there is a Firefox plugin aimed at helping to identify if the website you are visiting has suffered from this attack.

The Firefox extension that will alert you when visiting a potentially compromised site. The extension works a little magic in the background to determine if the SSL certificate you’re trusting to keep your transaction safe is one which could be dangerous, thus giving you a little added protection from the rough and ragged world of cybercrime.

You can download it here.