Where were the Senior Managers?

(Picture credit http://www.cokingcokers.com)
I read this a couple of weeks ago. It's an AP article regarding BP, which explains the reasons for a massive explosion at their Texas City plant. The blast killed 15 workers and injured more than 170. You can read the entire thing at your leisure, but here are some telling quotes.

..."Deeply disturbing" staff errors led to the oil refinery explosion and fire that killed 15 workers, and some employees could be dismissed as a result, plant operators said Tuesday... ..."The mistakes made during the startup of this unit were surprising and deeply disturbing"... ...Supervisors and hourly workers face discipline ranging from written reprimands to dismissal, Pillari said. He declined to say how many employees would be punished... ...The BP investigation determined that fluid level in a tower was 20 times higher than it should have been. Water or nitrogen in the tower when the unit was restarted may have caused a sudden increase in pressure that forced hydrocarbon liquid and vapor into the unit's stack. But investigators still don't know what ignited the resulting vapor cloud. Earlier theories have suggested that sparks from a running truck engine could have been to blame. Investigators found that supervisors seemed to be absent at times during the unit startup, and crews didn't know who was in charge. Also, any of six supervisors had a six-minute window in which they could have sounded an alarm to evacuate the area, but that alarm was never sounded, Pillari said. The decision, he said, denied other workers "the opportunity to get out of harm's way." ...

I've highlighted what I consider the key phrase. During the startup of an immensely expensive and dangerous refinery, wouldn't senior management have plenty of feet on the ground?

Sidebar: Ironically, Texas City was also the site of the worst industrial accident in U.S. history. A fire aboard a ship at the city's docks triggered an explosion that killed more than 550 people.

Supervisors were absent? Where were the refinery managers?

Crews didn't know who was in charge? Wha...? Where were the refinery managers?

Pinning this on supervisory and hourly personnel appears, at face value, to be the ultimate cop-out.

Senior management needs to define strict processes for an operation this complex and then audit those processes to ensure they are followed. This is a failure of senior management, plain and simple.

AP: BP: Personnel Failures Led to Texas Blast
 

Making Phishers Solve the Captcha Problem

The more I read about Bank of America's solution to the phishing problem, the more I believe it susceptible to man-in-the-middle (MIM) attacks. The Wall Street Journal today described their new system, called SiteKey, in a bit more detail. The BofA site describes it as well.

As I understand it, if you haven't signed into SiteKey before, you will get a randomly selected challenge question. Once you've answered the challenge successfully, a secure cookie is deposited on your PC. Subsequent authentications from that PC will force you to view a pre-selected image that will confirm you're signing into Bank of America, rather than a spammer's zombie machine in Chung Li, Taiwan.

Sidebar: isn't it odd that when you go the Bank of America site, you immediately note that the page is presented in cleartext ("http://"), not SSL ("https://). The first step to combat phishers is to provide an SSL connection... first time, every time. Customers need to get used to expecting a secure connection on every BofA page. Yes, their sign-in operation itself is secure. I just think it a tad bizarre that every page isn't secure as well. Just for the customer's peace of mind.

As far as I can tell, there's no way for SiteKey to distinguish a malicious, zombie PC from a user's virgin computer. The zombie PC could present a false BofA store-front to the victim and proxy login information from the user to the bank and any resulting pages and images from the bank to the victim.

Step 4 of the BofA SiteKey page even states the following:

If we don't recognize your computer: We will ask you one of your secret SiteKey Confirmation Questions. After you answer your question correctly, we will show you your SiteKey.

Sounds like it's completely susceptible to a man-in-the-middle: the classic phisher's false store-front.

I believe you've got to make phishers solve the captcha problem.

A Blogger Captcha

You know captchas: they're the odd-looking images representing stretched or melted alphanumeric text that can (presumably) be read by humans, but not malicious bots.

The example at right is the kind of captcha that Google's Gmail service employs. Mail services require strong captchas to prevent spambots from signing up for their free email services for mass-spam campaigns. We need more spam like GM needs more healthcare costs.

The challenge for systems like SiteKey is to create a captcha-like problem for phishers. I think I have the seeds of just such a solution. The idea is to make a man-in-the-middle attack bloody difficult.

Educating the users to expect an "anti-fraud" checklist on the sign-in page is obviously the first order of business. This can be achieved through a snail-mail campaign or equivalent PR effort. Once customers expect the anti-fraud checklist, the next action in the campaign is to:

Squeeze the man-in-the-middle

Force the man-in-the-middle (MIM) to present information specific to both the client and the server. After the user has entered a sign-in name, the anti-fraud checklist page depicted above, should appear.

The key element of the page is a GIF or JPEG image, dynamically created like a captcha, consisting of the three checklist items depicted at the top of this article.

The MIM gets squeezed by changing fonts

Why is this checklist so difficult for a MIM to present?

Checklist item 2: In a normal situation (with no MIM involved), the bank's server should be able to deduce the client's general location through IP-address geo-mapping.

For the MIM to present the correct location data, it will have to use an IP-address-to-geographic-location mapping algorithm and deduce it on its own.

Checklist item 3: The server has non-sensitive information about the customer (e.g., a check number that recently cleared) that can be presented on the page. This is called a "shared secret" that only the customer and the bank should know.

And for the MIM to retrieve a valid shared secret, it will have to screen-scrape the third line of the checklist from the image the bank has presented.

Captcha problem: Once the MIM has accomplished numbers two and three, it now has to somehow merge the images in a way that looks consistent. But the fonts are changing, the font sizes are changing, and the colors are changing. They're selected randomly.

Without some serious artificial intelligence, the MIM is trapped having to solve a classic captcha-style problem. And I, for one, thinks that's a hard road to hoe for the phishers.
 

Another Phish Tale

(Picture credit http://www.samsung.com)
I received another phishing email that purports to be from PayPal. Let's just make the blanket statement that you should spam filter anything that even mentions PayPal. Anyhow, the source of the message reads, in part:

Please follow the link below and login to your account<br> and renew your account information<p><b> <a target="_blank" href="http://211.189.88.200/~wcconst/www.paypal.com/us/cgi-bin/webscr=cmdxpt/cps/ clickthru2/Billing-Verification=CookieId=4801de10f2194572779a171135820269/" >https://www.paypal.com/cgi-bin/webscr?cmd=_login-run</a></b></p> <p>Sincerely,<br> Paypal customer department!</td>

A tracert of 211.189.88.200 yields:

9 110 ms 119 ms 113 ms unknown.Level3.net [63.215.71.10] 10 122 ms 114 ms 111 ms ge-2-0-0.0.cjr02.lax001.flagtel.com [62.216.140.77] 11 221 ms 229 ms 224 ms so-1-1-0.0.cjr04.tok002.flagtel.com [62.216.128.130] 12 261 ms 244 ms 244 ms so-0-3-0.0.ejr03.seo002.flagtel.com [62.216.128.18] 13 253 ms 248 ms 251 ms 62.216.147.82 14 249 ms 254 ms 259 ms user7.s148.samsung.co.kr [203.241.148.7] 15 244 ms 249 ms 244 ms 211.189.88.200

Hmmm... the user7 portion makes it almost appear that the next-to-last link in the chain is a typical workstation inside Samsung. Probably not the case, but interesting...
 

Mimicking is more persuasive

(Picture credit http://www.mmjp.or.jp)
Interesting results from a Stanford study. A computer-generated sales agent was programmed to mimic a human prospect's facial movements in a "conversation". Sales agents that mimicked the prospect's movements (with a four second delay) were considerably more successful than agents programmed with pre-recorded facial movements:

...Researchers at Stanford University's Virtual Human Interaction Lab strapped 69 student volunteers into an immersive, 3-D virtual-reality rig, where test subjects found themselves sitting across the table from a "digital agent" -- a computer-generated man or woman -- programmed to deliver a three-minute pitch advocating a notional university security policy requiring students to carry ID whenever they're on campus. The anthropomorphic cyberhuckster featured moving lips and blinking eyes on a head that nodded and swayed realistically. But unbeknownst to the test subjects, the head movements weren't random. In half the sessions, the computer was programmed to mimic the student's movements exactly, with a precise four-second delay; if a test subject tilted her head thoughtfully and looked up at a 15-degree angle, the computer would repeat the gesture four seconds later... ...The results, to be published in the August issue of the journal Psychological Science, were dramatic... The remaining students liked the mimicking agent more than the recorded agent, rating the former more friendly, interesting, honest and persuasive. They also paid better attention to the parroting presenter, looking away less often. Most significantly, they were more likely to come around to the mimicking agent's way of thinking on the issue of mandatory ID...

Wired: AI Seduces Stanford Students
 

The Israeli Trojan Horse Affair... and Ad Agencies

(Picture credit http://www.momentum-design-house.com)
The Israeli corporate espionage affair is spreading from firm to firm like wild-fire. An interesting aspect: ad agencies were reportedly infected with trojans, presumably to glean strategic marketing information on competitors.

A question for senior managers: do your ad agencies (or other partners) possess your company's strategic data? If so, your legal team should be writing infosec process into your contracts... and your infosec team should be performing due diligence on their systems.

...Tel Aviv Police District Fraud Unit investigators yesterday raided the offices of international calls carrier Bezeq International Ltd., and detained for questioning its VP marketing and a strategic researcher. The company is suspected of obtaining from private investigators business information of Golden Lines International Communication Services Ltd. by uploading a Trojan Horse into computers of ad agency Shalmor-Avnon-Amichay Young and Rubicam...

Car importer Jacob Shachar questioned in Trojan Horse affair
 

WSJ: "Nightline" needs an enemies list

(Picture credit http://as.wn.com)
The Wall Street Journal features an op-ed on Nightline's broadcast of the honor roll of American troops who died serving in the war on terror:

...Much energy has been spent on the debate over whether Saddam actually backed al Qaeda, or merely spent some of his billions purloined out of the United Nations Oil for Food relief program in supporting such folks as Palestinian suicide bombers and buying the kinds of conventional weapons used to kill the troops whose faces we just saw on "Nightline." The larger point is that nations export to our globalizing world whatever it is they specialize in. Saddam specialized in terror. His legacy includes a roster of Iraqi dead so vast that it would take weeks if not months to read the full list of names, if anybody even knew the list. That is the kind of rule, or grotesque misrule, he brought to the international table--corrosive to all, and dangerous even to the great American superpower. Which is why, after 17 failed U.N. resolutions, our troops had to go to Iraq. Second on the list of who killed our troops would be those who abetted Saddam's regime and continue to help his successors today. Topping that list would be the Baathist regime of Syria's dictator, Bashar Assad, and the totalitarian ayatollahs of Iran--backing what is too often called an "insurgency" and would better be termed a fight for the resumption of tyranny. Also on the list would be the corrupt and craven crew at the U.N., who hid the rebuilding of Saddam's resources, who preferred to give Saddam an 18th chance. It is important to understand that while the U.N.-approved investigation into Oil for Food, led by Paul Volcker, has focused narrowly on questions of whether anyone administering the program violated U.N. procedure, the deeper horror was the assurance of the U.N. that all was well--while Saddam skimmed billions... to buy weapons and restock the war chest [that] ...is very likely funding terror in Iraq today.... [T]wo unnamed high-ranking UN officials [are] alleged to have taken bribes from Saddam; this is a matter not only of venal and corrupt behavior among those entrusted with serving the public good, but of U.N. officials with blood on their hands... ...In thinking about the context for the past year's honor roll, however, I found there was another American president who also came to mind: Abraham Lincoln, who, as America struggled to shed its own evil of slavery, commemorated the dead at Gettysburg with a statement that holds true today. These Americans died "that government of the people, by the people, for the people, shall not perish from the earth."

Claudia Rosett: Never Forget - "Nightline" needs an enemies list
 

Corporate Espionage and Trojan Horses

Picture credit: http://www.emich.edu
Via Arik's blog, an excellent recap of the Israeli corporate espionage scandal.

* [Some] ...very prominent Israeli companies were infected by a trojan. Foreign companies may have been victims as well, but names of those were not provided. * The trojan was targeted specifically at those companies by the perpetrator, and more specifically at key people in those companies and PR companies working for those companies. * The trojan was targeted at Windows machines. * The attack vector was social engineering, using e-mail and CD-ROMs sent to the victims as ‘a business proposal’. * Data proliferated from some of the infected machines includes (but is not limited to) the ‘My Documents’ folder and screen captures. * The stolen data was sent to “FTP servers” both out and inside Israel. The protocol used for the actual transfer was not disclosed. * The trojan was never detected within the infiltrated companies until the police looked for it...

Saar Drimer also states, "...the police’s own computers were compromised by the very method they were investigating!"

Arik's blog: Trojan horses abound