Podcasts

On this week's show we're taking a look at the issue of failkit. Why is it that the very software designed to keep our networks secure is full of bugs?

A pen tester buddy of mine recently found an 0day XSS in a single sign on product... on ITS FRONT PAGE. Another friend found an auth bypass in a two-factor authentication management console. ON ITS FRONT PAGE.

It's impossible to find AV engines that don't come preloaded with a zillion format string vulnerabilities, and as you'll hear in this week's news, even Cisco's VPN solution is a nice way to actually own organisations. WTF.

Bug hunter extraordinaire, Azimuth Security's Mark Dowd, joins us after the news to chat about that. We'll also have a quick chat with Josh Corman, an analyst with 451 group in the USA and co-founder of the Rugged Software initiative.

Adam Boileau, as always, stops by for a check of the week's news headlines.

On this week's show we're chatting with HD Moore all about a recent decision by research house VUPEN to refuse to share their research into Chrome vulnerabilities with Google.

The French group likely sells 0days to governments, militaries and intelligence agencies to use on offensive operations -- so of course sharing its exploit information wouldn't make much sense for them. But what does this mean? Will we see any bugs in the open anymore? Or will they all go underground and be sold to governments?

This week's edition of the show is brought to you by NetWitness. Eddie Shwartz will be along after this week's feature interview to discuss the role of vendor marketing in making our situation worse. It's the job of marketing and salespeople to dazzle executives with bulldust -- but is it driving enterprise security investment in the best direction? Find out in this week's sponsor interview with Eddie Shwartz.

Adam Boileau stops by for a look at the week's news.

Microsoft was kind enough to sponsor our coverage of AusCERT's 2011 conference and as a part of that sponsorship arrangement we're doing these sponsored podcasts. We've already posted two interviews with Microsoft peeps about security issues, but we're posting this full talk as well.

Maarten Van Horenbeeck works in the Microsoft Security Response Center managing Microsoft's efforts to share information on security vulnerabilities with third party security software providers, government agencies and national CERT teams.

This talk is about how Microsoft applies ratings to its product vulnerabilities... there are a bunch of ratings systems out there... Maarten covers off some of these and discuss how MS boils down its own scores. I hope you enjoy this talk.

This is a full presentation by AusCERT's day three keynote speaker Ross Anderson.

Ross has kindly allowed us to podcast his entire talk.

Ross is professor of security engineering at Cambridge University, and author of the bestselling textbook "Security Engineering: A Guide to Building Dependable Distributed Systems". He was a pioneer of peer-to-peer systems, of hardware tamper-resistance, and of the economics of information security.

Ross will discuss the economics of information security in two contexts: frauds against payment networks, and the resilience of the Internet. The talk will draw on a recent major study Cambridge did on the resilience of the Internet.

Tony Oliver and the Pubcast crew interviewed me about the talk I did at ITWeb's Security Summit in South Africa the other week.

My talk was all about militarisation trends in the digital security field. I drew parallels between the Cold War and what's happening now. You can find it here.

Thanks to Tony and the rest of his gang for having me on their show. It's good to be on the other end of an interview every now and then!

You're about to hear one of the highlights of AusCERT's annual conference -- the speed debates! Not to be taken too seriously, the speed debate happens at the end of the con -- it's a chance to have a laugh and shed some lighter perspectives on the security discipline.

It's hosted by Australian broadcaster and journalist Adam Spencer. I hope you enjoy it.

This podcast is a complete presentation by APNIC's Geoff Huston.

According to the official synopsis: This presentation will outline the role of addresses and routing and the potential attack vectors, and will also report on the progress to establish a secure framework for addresses and their use in the Internet, highlighting the progress in establishing a secure routing environment for the Internet.

As regular RB listeners would know, we've followed APNIC's work and papers in this area and they have a habit of pushing out good stuff... so this should be a decent talk. Enjoy!

Microsoft was kind enough to sponsor our coverage of AusCERT's 2011 conference and as a part of that sponsorship arrangement we're doing these sponsored podcasts. They're general chats with Microsoft peeps about security issues.

And in this interview we're chatting with Microsoft Australia's Chief Security Advisor Stuart Strathdee about the affect the PSN network breach has had on large organisations' security outlook. As you'll hear, Stuart says a lot of security projects that had been on the back burner are now being brought forward.

Enjoy!

The publication of allegedly stolen, private photographs by Fairfax Online was eclipsed in stupidity only by the QLD Police Service's decision to seize the iPad of journalist Ben Grubb at the AusCERT conference on Tuesday.

Every time the coppers raid media organisations to seize computers and documents in order to track down, say, the source of an embarrassing political leak, it pisses me off something awful.

The lack of respect shown to the media and its sources by governments in this country, both state and federal, is pretty astonishing.

The Australian Federal Police (AFP) actually investigates public service leaks that harm nothing more than the incumbent's polling figures. It's ridiculous. A media that operates freely of this sort of intimidation is vital to maintaining a healthy democracy.

As for the Ben Grubb incident, it's my view that police should simply not have the powers at their disposal that enabled them to seize his iPad in connection with an investigation into the alleged theft of private photos from a Facebook account.

Background on that is here if you need it.

Despite the fact there's an argument brewing about whether QLD Police actually acted within the law in seizing Ben's gadget, the action, in my view, was categorically the wrong thing for the police to do.

Some of you out there on teh Twitters got up me yesterday over my failure to discuss the media freedom aspect of this whole AusCERT-gate thingamajig.

I didn't bother because the police were just acting like police. The whole thing was just so predictable. It's what happens in any jurisdiction that hasn't passed shield laws.

In this instance, it seems likely the intention of the officers in seizing the device was to obtain evidence to use against another individual. In fact, the coppers likely knew the evidence was on the iPad because Ben may have showed it to them himself! It's not explicitly stated in his piece, but you get the impression it's possible he pulled up some correspondence on his tablet.

It's likely that when they realised that a treasure-trove of evidence was likely stored on the iPad (correspondence between Ben and his source pertaining to a security conference presentation that may have crossed a few lines), they asked Ben to surrender it and he refused.

That's when they arrested him in a meeting room at AusCERT for a short time and seized his iPad.

The police claim they were within their rights to seize the iPad because it had allegedly stolen photos on it; tainted goods.

It's a clumsy argument, but it's a great example of coppers doing what coppers do -- taking the shortest path from A to B. Should they be allowed to do that? Absolutely not. Can you understand why they did? Absolutely!

It's also a bit difficult to defend Fairfax chose to publish allegedly stolen private photos. It gets REALLY difficult to defend Fairfax when you find out that the subject of the allegedly stolen photo contacted the editorial team and asked them to remove the private photo and they refused.

I know this because the subject of the photo told me.

It gets IMPOSSIBLE to defend Fairfax when we hear its justification for publishing the photos: It had legal advice that as the photos were published "on the Internet" they were fair game, regardless of whether they were posted to a private photo album on Facebook.

(NOTE: It's possible that the image in question was obtained by Fairfax via a Facebook Content Distribution Network URL that had been brute-forced during the research done during for Sunday's presentation. Technically that would mean the image was "on the Internet" and available without authentication, so probably fair game legally, but ethical questions remain.)

Legal advice aside, I'm amazed they didn't realise what 24-karat knobs they were being. Needlessly publishing private material is just a really shitty thing to do. One of the photos featured the subject and his young child. Sure, they blurred the child's face, but it was a private photo.

To keep the photos up there AFTER the subject and owner of the image copyright has asked you to remove it is tabloid asshattery at its most extreme. Sure, they cropped out the kid after an angry phone call, but they left the allegedly private picture identifying the subject up.

So are the laws that allowed the coppers to seize Ben's iPad daft? Yes. Were the coppers themselves acting like supreme dopes when they briefly detained Ben? Yes.

But really, if you had the ringside view I did when this whole thing played out, you'd find it a bit tough to muster up much sympathy for Fairfax and its now iPadless journalist Ben Grubb.

The nice side affect of the big hoo-ha is it's brought up a debate on press freedom in Australia. If anything, this whole episode will nudge proposed shield laws along quite nicely.

We need those shield laws to pass to prevent this sort of idiocy.

So to end with the same summary that accompanied yesterday's piece: Meh.

Well, hasn't this been an interesting AusCERT...

If you haven't heard by now, Fairfax IT journalist Ben Grubb was briefly detained by QLD police yesterday afternoon in connection to a BSides Australia security presentation delivered on Sunday.

The presentation, by Christian Heinrich, demonstrated a brute-force attack against Facebook's Content Distribution Network. I didn't see the presentation myself, but the long and short of it is the vulnerability demonstrated allows the attacker to obtain Facebook users' private photos.

So how did the police become involved?

Well it's no secret that Christian doesn't particularly enjoy the company of Chris Gatford, a security consultant who runs a small outfit called HackLabs.

I should point out right now that I, myself, don't particularly enjoy Christian's company. In the past he has been a very vocal critic of the Risky Business podcast and me in particular. I don't like him, and I'm fairly certain he doesn't like me.

Where the presentation became an issue for police is when Christian demonstrated the attack against Gatford's wife's Facebook account. He brute-forced some of her photos and displayed a photo of Chris with his young son to the BSides attendees.

I believe he may have blurred out the child's photo, but I haven't confirmed that.

Chris Gatford was livid.

Most of the journalists attending the conference were aware of the presentation but chose not to pursue it as a story. It looked like a case of rivalry between two guys who don't particularly like each other. The Facebook bug is a good one and I planned to mention it in the show, but the angle around the photos, in my view, just wasn't worth bringing to the world's attention.

Sydney Morning Herald online reporter Ben Grubb took a different view.

He published this story, along with the photo of Chris Gatford and his son.

The face of Chris's child was definitely blurred for publication, but I believe posting it was a poor decision on Fairfax's behalf. The Herald editors eventually cropped Gatford's child from the picture, then pulled the picture in its entirety later.

So why was Ben detained?

Well it seems he had been in communication with Heinrich in regard to the attack against Gatford's wife's Facebook account. It is my belief that Ben was detained and his iPad seized so the police could obtain evidence from the iPad in order to consider the preparation of a prosecution brief against Heinrich. This is just my suspicion -- I don't have any solid evidence at all to suggest that a prosecution brief is being prepared or that Heinrich has broken any laws.

If the police decide to pursue the matter, it's possible there could be some issues around unauthorised access to data. A solicitor also might have an opinion on whether cyber-bullying laws apply here -- using a carriage service provider to stalk, intimidate or harass -- that sort of thing. Those offences are taken quite seriously under Australian law. To be clear, at this point no one has suggested that Heinrich has used the Internet to stalk, intimidate or harass anyone.

The reason it was easy for the coppers to seize Ben's iPad is it may be possible for the police to argue he had committed an offence that's in some way equivalent to being in possession of stolen goods, the photos. I sincerely doubt he will be charged with anything, and it remains to see if a prosecution is brought against Christian. It may not be.

And that's pretty much it. Brian Hay of QLD police did a press conference this morning that I didn't bother attending. Of course this whole event is getting way more attention than it should.

It's also important to note that Heinrich's presentation was to BSides Australia, a pre-AusCERT event. It wasn't an AusCERT talk as has been reported.

I haven't approached anyone to ask them for a response to this post. It's just a summary of what I believe to be the case. I'm sick with a cold, jetlagged as hell, and frankly there's other work I'd rather be focussing on.

To sum up: Meh.