Month: April 2005

Security Concerns for Migrations and Upgrades to Windows Active Directory

Posted on by admini

You need to decide how you will get from where you are now, possibly a Windows NT domain(s), to Windows 2000 or Server 2003 Active Directory domain(s). The pressure and work that goes along with moving from one network operating system to another network operating system can be intense. You will be required to make many decisions during your journey.

Will you have Windows 2000 or Windows Server 2003 domain controllers?
Will you run some of each type of domain controller?
What client operating system will you run for the IT staff, executives, and other employees?
How many Active Directory domains will you end up with?
How many Active Directory forests will you end up with?
How will you get from your Windows NT domains to Windows Active Directory domains?
What tools will you use to get to your Windows Active Directory domains?
Are there any security concerns that you need to consider during your move to Windows Active Directory?

It is this last question that is focus in this article. They discuss the primary options for going from Windows NT domains to Windows Active Directory domains. It then talks about each of the options, focusing on the different security considerations that you need to contemplate. When you are done reading this article, you should be able to pinpoint the key security considerations that you will face along your journey.

You have two primary options for moving from Windows NT domains to Windows 2000 or Server 2003 Active Directory domains. The second option is to perform a migration. A migration is more complex than an upgrade. With a migration, you will need to create your Active Directory domain(s) in conjunction with your Windows NT domain(s). This will require that you purchase additional hardware and server licenses.

The overall concept of the migration is to gradually move objects (user, group, and computer accounts) from Windows NT to Windows Active Directory.

An upgrade is much simpler in all aspects. With an upgrade you work with the existing Windows NT domain and domain controllers. You will take the Windows 2000 Server or Windows Server 2003 installation CD and place it in the Windows NT Primary Domain Controller. You follow the steps in the wizard and when the computer restarts, you have a Windows Active Directory domain. All of the objects that were once in the Windows NT domain have completely been retained and are immediately available in the Windows Active Directory domain.

If you choose to perform a migration, you most likely are consolidating multiple Windows NT domains into a few (hopefully one) Windows Active Directory domains. It is the method that is available for moving accounts from multiple domains into just a few domains. However, as you perform your migration, you will have unique security concerns that you need to consider during the process.

Here are some of the most prominent security concerns that you will run into.
As you migrate user accounts from NT to Active Directory, you will end up with duplicate user accounts, with one in each domain. Most tools will allow you to control the state of both of the accounts after the migration. There might be times when you want the source user account to be active, and other times when the target user account should be active.
Regardless of your decision, you need to be aware that there are two user accounts in two domains.

When you migrate a user account from NT to Active Directory, you need to consider how the new user account will continue to access resources that exist in the Windows NT domain. This new property is referred to as SIDHistory. During a migration, the primary objects that you will migrate include user, group, and computer accounts, as well as trusts. However, the other configurations that you once had in Windows NT are not transposed to the Active Directory domain. This includes the account policy settings, which include the password min age, max age, min length, and password complexity.

Derek Melber manages http://www.auditingwindows.com, the first dedicated Web site for Windows auditing and security.

http://www.windowsecurity.com/articles/Security-Concerns-Migrations-Upgrades-Windows-Active-Directory.html

Read more

Malware Evolution: January – March 2005

Posted on by admini

IM-Worms
Worms that propagate via Internet messaging services by sending URLs to all contacts in the local contact list. The URLs take incautious users to websites containing the body of the worm. This approach is also often used by email worms.

One of the most interesting developments in 2005 was the appearance of worms for instant messenger applications. Instant messenger applications have become very popular, but users rarely perceive them as potential infection vectors. The source code for some early IM-worms was also published on a number of virus writers’ sites, and most of the new worms are clearly based on this code. As P2P-worms were simple to create, and spread rapidly, several hundred families appeared, with numerous versions in each. Kaspersky Lab monitored P2P networks closely during the upsurge in P2P-worms and analysis showed that almost every second file in the Kazaa file-sharing network was a P2P-worm. Despite the fact that Internet messaging services allow file transfer, for some reason virus writers are not utilizing it as a method of infection, possibly because they find overly complex. The worm penetrates victim systems either by exploiting Internet Explorer vulnerabilities or simply by downloading and installing the malicious code. Monitoring incoming http traffic for malicious code (which should be part of any responsible security policy) will block those worms which penetrate via browser vulnerabilities.

Botnets
Initially, infected computers were linked via an IRC channel and received commands from the remote user via IRC, and this is still the most popular way of controlling botnets from a single central point and is used by the Agobot, Rbot and SdBot families, which are the most common malicious bots. Mydoom would open a single port in the range between 3127 and 3198 which gave anyone access to the infected system. The Internet was flooded with worms attempting to penetrate computers already infected by Mydoom. Virus writers also wrote scanners that allowed potential controllers to search computers for the Mydoom backdoor component: if the backdoor was detected, the new controller would drop and execute new malware on the infected machine. At the height of this outbreak, infected machines were passing from controller to controller several times a day. All of these infected machines are being actively used by cyber criminals as spamming platforms in order to make money. Botnets can also be used in DoS attacks and to spread new malware – such threats often lead site owners to pay cyber criminals not to attack their sites. Detection and prevention of botnets should be a priority for both the IT industry and end users, since the future of the Internet depends on coordinated action now.

Email Worms
2004 was distinguished by a number of major epidemics caused by email worms such as Mydoom, NetSky, Bagle and Zafi. However, late 2004 and early 2005 was free of such outbreaks, with nothing on the scale of even the mid-sized outbreaks of 2004.

Social engineering
I.e. techniques used by cybercriminals to trick end users into sharing confidential data, continues to evolve. According to data from the Anti-Phishing Working Group, in January 2005 phishers sent 12,845 unique phishing letters leading to 2,560 spoofed websites. The public fear of spyware has also been exploited by Adware writers and other cyber -fraudsters to penetrate victim machines.

No new critical Windows vulnerabilities
Isolated attacks notwithstanding, the fact that older versions of Windows do not have critical vulnerabilities, and the encouraging trend of more and more Windows XP users installing Service Pack 2 gives hope for the future. The current lack of worldwide outbreaks can be partially acounted for by two important factors: no new serious vulnerabilites in Windows and the migration of users to Windows XP with Service Pack 2.

On the other hand, security holes in Internet Explorer are responsible for a significant number of infections. Kaspersky Lab data shows that the MHTML URL Processing Vulnerability (CAN-2004-0380) is the loophole currently most frequently exploited by virus writers. This vulnerability makes it possible to hide executable files written in VBS or JS in CHM files (Microsoft Compiled Help) and post links to the infected files on the Internet. When an infected CHM file is opened, the hidden files are executed in the Local Internet Zone with current user rights.These scripts are usually Trojan Downloaders or Droppers that install other Trojans on the victim machines. However, this vulnerability is not new and Microsoft issued the MS04-013 patch for it over a year ago on April 13, 2004, meaning that users do have the ability to protect themselves against such attacks.

On-line games: a new arena
Contemporary cyber criminals don’t only steal banking and financial details. Games have achieved enormous popularity since their first appearance, and individual items and/or characters in various on-line games are sold for tens of thousands of dollars in on-line auctions. For instance, a virtual island from “Project Entropia” was sold, for $26,500, the largest amount spent at any one time in online-gaming history. In short, several billion dollars are currently invested in virtual worlds and role-playing games, a sum equivalent to the budget of a small country. Naturally, the presence of real money in on-line games hasn’t escaped the attention of cyber criminals.

The first cybercrime targeting on-line games was committed in early 2003, when Trojans designed to steal user account data to the Asian game Legend of Mir were detected. And two years on, there are more than 700 known malicious programs which target Legend of Mir. Detailed analysis of these programs shows that most of them originate in South Korea and China. The first Trojans attacking Lineage were detected by Kaspersky Lab virus analysts in October 2004; in less than six months the number of such malicious programs has grown to several hundred.

Among the most recent programs targeting online games is a family of Trojans designed to steal personal information from Gamania players. The first one was detected in February 2005 and since then there has been at least one new variant every week. Admnistrators immediately forward any viruses, scripts and Trojans attacking the game portals, and Kaspersky Lab ensures that updates protecting against such threats are released almost immediately.

Adware, spyware and viruses: is there a difference?
Adware and spyware are the IT buzzwords of the moment. Such programs may exhibit Trojan behaviour in how they install themselves, (for instance by exploiting browser vulnerabilities), or in how they behave once they are installed. With adware becoming increasingly inseparable from classic malware, dedicated anti-adware solutions will simply cease to provide adequate protection.

Mobile malware
The first malicious code targeting mobile phones (Cabir) was detected in the middle of June. We are now staring into the abyss: a Warhol Worm, which attacks all possible systems in the shortest possible time, is now a very real possiblity. The first attempt to create such a worm surfaced in March this year. Fortunately, ComWar, an MMS-worm, contained a number of errors and there was a significant time lag during propagation.

At the time of writing, no further Bluetooth-worms have been detected.

http://www.viruslist.com/en/analysis?pubid=162454316

Read more

IBM Stresses App Security

Posted on by admini

Anthony Nadalin, chief security architect for IBM’s Software Group, said IBM is looking to do more to address the issue of security throughout the application life cycle, starting during the requirements process and going straight through to modeling and deployment. “There is a lot of interest in companies building secure applications and how to guarantee that, so we’re looking at the notion of security in the application life cycle.”

Nadalin said IBM is considering enhancing its modeling capability to enable users to integrate security into the process.

The authentication becomes a policy issue, and “you wind up with a policy-driven model. It is nearly impossible to retrofit,” Murphy said.

http://www.eweek.com/article2/0,1759,1787115,00.asp?kc=EWRSS03119TX1K0000594

Read more

Expanded Wi-Fi certification brings confusion, says Gartner

Posted on by admini

As if Wi-Fi standards are not confusing enough, last week’s addition of four widely used Extensible Authentication Protocol (EAP) types by the Wi-Fi Alliance will make your head spin.

WPA certification will be more confusing than meaningful for enterprise decisions until at least 4Q05, when it becomes mandatory for vendors to pass ‘new’ WPA2 certification.

Additional confusion will undoubtedly result after Cisco and Microsoft likely introduce a new or enhanced EAP type in coming months which will require the Wi-Fi Alliance to conduct further interoperability testing, according to Gartner.

And the Wi-Fi Alliance is reserving the term “WPA3” for new IEEE 802.11 security features rather than for security testing extensions, further contributing to the confusion around WPA and WPA2 certification through at least the first half of next year.

Gartner says to simply select the authentication approach that best meets matches your business, IT and security processes, regardless of Wi-Fi certification.

http://blogs.zdnet.com/Research/index.php?p=152

Read more

VoIP is a threat to wireless security

Posted on by admini

“Security obviously cannot be ignored,” said Nick Jones, a research vice-president for Gartner, “but you can worry less — so long as you are willing to pay, for it security can be achieved.” Jones said that a variety of advances in areas such as encryption and virtual private networks — and better management strategies — were helping businesses secure their networks more effectively.

Jones, who gave a keynote speech at Gartner’s Wireless and Mobility Summit, said that mobile computing was becoming an increasingly important issue for IT bosses to consider. “Mobility is one of the top priorities for CIOs,” he said. “If you are a CIO, I hope you have a wireless strategy because your peers will have one.”

The Summit also heard that VoIP products such as Skype were likely to drive down mobile phone costs, as some companies are now encouraging staff to use VoIP for long-distance calls.

Jones, however, warned that VoIP services pose a threat to corporate security because they require some ports on the firewall to be left open, which can give hackers opportunities to penetrate a network.

http://www.silicon.com/research/specialreports/voip/0,3800004463,39129635,00.htm

Read more

How vulnerable is the ‘Net?

Posted on by admini

“It was an attempt to make a massive problem,” says KC Claffy, principal investigator at CAIDA. “They certainly made a blip on a graph.” But the Internet and its users got off easy. The barrage lasted only an hour, and no end users were affected. The attack did, however, serve as a wake-up call, as network operators and others have taken steps to better secure the Internet since then.

But some still question whether the Internet is susceptible to attack and needs more authoritative oversight. “If somebody was to do a real concerted, knowledgeable attack, it wouldn’t be very difficult to have a catastrophic impact on a huge component of commerce,” says Larry Jarvis, vice president of network engineering at Fidelity Investments. “It would be huge to the U.S. economy and to a lot of companies that now view the Internet as the equivalent to a dedicated circuit to all these entities.”

Clif Triplett, global technology information officer at General Motors, says he is worried mostly about router and host software bugs, as well as broadcast storms such as distributed DoS (DoS) attacks bringing down the ‘Net. “I’m highly concerned about it,” Triplett says. “If that network is a core piece of your business, I think you’re at a risk.”

Two-thirds of the 1,300 “technology leaders, scholars and analysts” surveyed recently by the Pew Internet & American Life Project said they “expect a major attack on the Internet or the U.S. power grid within the next 10 years.”

The 13 DNS root servers resolve Internet naming and addressing. If they were knocked out, Internet sites would become inaccessible. The servers repel distributed DoS attacks every day, operators say.

CAIDA research shows that up to 85% of the queries against the DNS servers are “bogus” or repeated from the same host.

The system has been bolstered since the 2002 attack, with root servers now consisting of 50 to 100 physically distributed, highly redundant boxes in 80 locations across 34 countries. In 2002, far fewer servers were located in 13 sites across four countries. This level of distribution and redundancy makes a complete shutdown of the DNS system unlikely, says Paul Mockapetris, chairman and chief scientist of IP address management vendor Nominum and the inventor of DNS.

The physical servers use Anycast, a routing technique that heightens resiliency by multiplying the number of servers with the same IP address and balancing the load across an army of geographically dispersed systems.

“If I was going to try and arrange a DNS 9/11, it’s a very bad target to try and attack because it’s so distributed – you’d have to take [the servers] out everywhere,” Mockapetris says. “If you took out one root server today, nobody would notice.”

But the more distributed a system is, the more difficult it is to defend, notes Stephen Cobb, an independent security consultant who was recently quoted in a Network World column stating a belief that the ‘Net can be brought down and kept down for 10 days or more.

“The reason it hasn’t gone down for days so far is that the people who know how to do it aren’t so inclined.” However, the good guys are inclined to implement security best practices, like those outlined in an IETF informational document on root server operation called RFC 2870, says Jose Nazario, security researcher and senior software engineer at Arbor Networks, which makes products carriers use to protect their networks from cyberattacks. Originally drafted in 2000, RFC 2870 has been extended over the past couple of years.

Cisco, the leading provider of Internet routers, regularly issues bug alerts. And BGP, which distributes routing information between networks on the Internet, is susceptible to IP address spoofing. “BGP peering has some security problems,” says Sam Hartman, area director for the IETF’s Security Area working group.

http://www.nwfusion.com/news/2005/041805-internet-security.html

Read more