Defenders of the Cloud: Certificate of Cloud Security Knowledge (CCSK)

As Cloud Computing adoption rises, more and more experienced IT Security Professionals are suiting up for the challenge, upgrading their existing arsenal with new concepts and best practices in securing the various layers and components that makes up Cloud Computing.

Since I am in the IT Security and Cloud Computing industry, I am starting to notice the certification initials "CCSK" alongside their CISSP, CISA, CEH, Security+, PMP, ITIL and other noteworthy titles. This is a strong indication that IT Security Professionals do recognize the new challenges that Cloud Computing brings to the table.

The Certificate for Cloud Security Knowledge (CCSK) is pioneered by the Cloud Security Alliance (CSA) So far, the industry support for the first ever certificate in cloud security knowledge is showing accelerated growth garnering support and participation even from major companies.

As one of the members of the early adopters of the certification, the main reason why I want to be part of the initiative is to show my dedication and passion in the new technology and play my part in generating positive public perception on how individuals, small business and large enterprise can harness the power of the cloud without thinking of too many risks.

There is a gap that exists big between traditional Information Technology security concepts and Cloud Computing security concepts. The co-mingling of data from various customers in a centralized or shared server, is one of the major characteristics of Cloud Computing as defined by the National Institute of Science and Technology (NIST). This gap is what the Cloud Security Alliance aims to fill, by providing industry-standard best practices on how to adopt and implement Cloud Computing securely. Cloud Computing adoption is all about losing control in a gracious manner.

Learn more about the Cloud Security Alliance Certificate in Cloud Security Knowledge (CSA-CCSK) here:

Cloud Security Alliance

http://cloudsecurityalliance.org/

Other noteworthy links:

CloudAudit

http://cloudaudit.org/

NIST Cloud Computing Group

http://csrc.nist.gov/groups/SNS/cloud-computing/

RTP Packet inspection without hurting the quality of the voice

Nice, I would like to try this solution, deep packet inspection on RTP streams coming in (and out) of your enterprise network without degrading the quality of the voice:

Overview:

Attackers can spoof the firewall and SBC into determining that the RTP stream is safe to relay. Passing the attacks through the RTP stream is called Vunneling. The alternative is to inspect the RTP packets which can slow down the transmission and distorts the voice.

The Salare solution , vPurity software, relies on a number of techniques to solve the Vunneling problem. Network Behavior Analysis (NBA) is employed by Salare. The passive NBA technique is well known for producing many false positive and false negative alerts. Salare's Active NBA virtually eliminates false positives. This is accomplished by introducing stimulus events and observing the reaction or non-reaction This provides accurate and precise recognition of the traffic types passing through the network.

The Salare technique inserts distortion in the packet that destroys embedded data and executable transmissions; this distortion is not perceptible by the listener. The insertion does not impact the quality of the voice conversation.

Complete article and links here:
http://tinyurl.com/2gxrwv6

Making the Cloud Trustworthy

Yet another Cloud Security initiative, http://www.trusted-cloud.com/ is an initiative by pioneer computer networking company Novell.

"Mission Statement: To Promote Education, Research and Certification of Secure and Interoperable Identity in the Cloud

The Trusted Cloud Initiative will help cloud providers develop industry-recommended, secure and interoperable identity, access and compliance management configurations, and practices. We well develop reference models, education, certification criteria and a cloud provider self-certification toolset in 2010. This will be developed in a vendor-neutral manner, inclusive of all CSA members and affiliates who wish to participate."

Trusted Cloud focuses on the notion that eventually it will be us users and the industry itself, that will make the Cloud more secure and trustworthy. We need to start trusting the Cloud, we need to start educating users what to and what not to expect when they join the bandwagon of Cloud Computing, we need to reiterate to users that the Cloud is not the solution for the recession, and finally, we need to let them know that Cloud Computing services, may it be Software-as-a-Service (SaaS), Platform-as-A-Service (PaaS) and Infrastructure-as-a-Service (IaaS) is now a mature and capable platform that promotes business and IT objectives alignment. Trusting the Cloud is a win-win situation, but of course with a few caveats.

We just don't have the solid security framework yet to manage and implement effective IT controls. Which is what the guys at http://www.cloudaudit.org/ and http://cloudsecurityalliance.org/ is working on. It might be early, but I would like to thank these guys for driving the Cloud Computing community to the right path of security with a common sense in mind, and not completely reliant on well-known IT controls and "best practices" which does not really scale and apply well to Cloud Computing.

Onwards,
Ron

Jolicloud OS for pen tests works, at least for me

Yet another lightweight, built-for-the-web OS, Jolicloud OS works well with my pen testing ways, at least for me. Why does it work for me you ask?

It detects my netbook's native Wi-Fi card out of the box. And I love that feature alone.

After playing around with the standard apps that comes with it, the next logical step is for me to install my security apps, and being a Gnome-based Linux distro, this is super-easy to accomplish.

Fire up the Terminal app located at the Accessories menu and apt-get install away:

sudo apt-get install wireshark

sudo apt-get install zenmap

And to install Metasploit, you need a couple of things to do, which is beautifully covered step-by-step by this guide:

http://www.metasploit.com/redmine/projects/framework/wiki/Install_Ubuntu

Why not use BT4 instead? Installing a persistent BT4 is a little bit cumbersome for script kiddies like me. BT4 is awesome, everything is in there, but most of the time I will only use a couple of the tools there. For a sniffer learning the hacker ways like me, that will be Wireshark, NMAP and Metasploit. And I would like to thank Carlos "dark0perator" Perez for this excellent piece of advice he gave on a previous episode of the multi-awarded Podcast Pauldotcom.com Security Weekly. If you want to learn the craft, don't use an all-in-one distro. Download and install Ubuntu, and work your way there. This has been my mantra for the past two years.

If I were to market the hacker ways to the public, I would pre-package these tools on social-networking centric, lightweight OS like the Jolicloud. My security apps icons are right next to my Facebook, Gmail, and Pidgin IM app, and that adds a little bit of a cool factor and a political statement that we are indeed in the age of point and click hacking.

Play safe kidz.

Asterisk Dialstring Injections

It's like an SQL Injection attack, trying this one now on my VoIPSec lab. Time to fix those Asterisk cookbooks guys! - Ron

[from_sip]

exten => _X.,1,Dial(SIP/${EXTEN}@testsip)

He writes: “And if ${EXTEN} = “000@testsip&SIP/333” what turns out to happen then is similar to SQL injection   ”He is exactly right. Many VoIP protocols, including IAX2 and SIP, has a very large allowed character set in the dialed extension, a character set that allows characters that are used as separators to the dial() and the queue() applications, as well as within the dialstring that these applications send to the channel drivers in Asterisk. A user can change the dial options and dial something we should not be able to dial in your system. This article describes the issue in more detail and gives you some help on how to avoid this causing trouble in your Asterisk server.

complete technical details here:  http://www.voip-forum.com/?p=241&preview=true

CloudAudit A6 - The Audit, Assertion, Assessment, and Assurance API

CloudAudit and the Automated Audit, Assertion, Assessment, and Assurance API (A6)

The goal of CloudAudit (codename: A6) is to provide a common interface that allows cloud computing providers to automate the Audit, Assertion, Assessment, and Assurance (A6) of their infrastructure (IaaS), platform (PaaS), and application (SaaS) environments and allow authorized consumers of their services to do likewise via an open, extensible and secure interface and methodology.

CloudAudit is a volunteer cross-industry effort from the best minds and talent in Cloud, networking, security, audit, assurance and architecture backgrounds.

The CloudAudit/A6 Working group was officially launched in January 2010 and has the participation of many of the largest cloud computing providers, integrators and consultants. You can find out more about CloudAudit by visiting the Forums.

For someone involved in the Cloud Computing industry, information assurance and compliance, this is freakin' awesome! I would like to congratulate everyone involved, especially security guru and fellow-grappler Chris Hoff (Cisco) of rationalsurvivability.com

Find more about the A6 initiative at http://www.cloudaudit.org/ and please spread the word!

Thanks,

Ron

"New Moon" Movie Now Playing on Torrent Sites

Capitalizing on the Team Edward versus Team Jacob fever, a couple of New Moon.avi movie files are now appearing on well-known torrent sites. Of course its not the real thing, opening the actual .avi file redirects you to cleverly crafted website, www.microsoftmedicenter.com. Yes kids, look closely before you click:


Its mediacenter, minus the letter "a". Good job guys, but its an old trick, only works for kids and those who do not practice safe Internet use in the first place.

I found out about this from a friend who IM'ed me that I need to fix his laptop again because he caught a nasty virus or something for the Nth time this month. He told me the last thing he did was simply open an .avi movie file that redirected him to Microsoft's website and that's when thing started to act funky.

The problem is that this guy never listens. He downloads a lot. He refuses to pay for music and movies. Downloading illegal copies of media is hurting the industry. And nothing is free in this world, download a free new movie, get a free evil payload (virus, adwares, scarewares, etc.)

So I inspected his laptop and immediately browsed to the New Moon Movie folder. Everything looks legit, you can even do a quick scan of the .AVI file using Microsoft's Security Essentials and no alerts came out.

So off I go and I opened the movie and as expected my browser popped open and gets directed to www.microsoftmedicenter.com.

However, what I got was a Bandwidth Exceeded return error. Hopefully someone DDoS'ed his website for good, or it got taken down already, or this guy is indeed maxing out the allotted bandwidth for his website because his clever trick is working.

Bandwidth Limit Exceeded The server is temporarily unable to service your request due to the site owner reaching his/her bandwidth limit. Please try again later.

---

Apache/2.2.11 (Unix) mod_ssl/2.2.11 OpenSSL/0.9.8e-fips-rhel5 mod_python/3.3.1 Python/2.4.3 mod_bwlimited/1.4 PHP/5.2.6 Server at microsoftmedicenter.com Port 80

So I made my part as good Netizen of this world and decided to explore and learn more about this poorly-spelled website. First stop is a back trace to see where this guy is hosted:

Wow, Amsterdam, land of the free. If it is indeed hosted in that country. Let's try a whois test:

http://whois.domaintools.com/microsoftmedicenter.com

Here's what we know about microsoftmedicenter.com:

* "James Gonzaga" owns about 13 other domains View these domains >
* is a contact on the whois record of 3 domains
* 1 registrar has maintained records for this domain since 2009-05-14
* This domain has changed name servers 3 times over 0 year.
* Hosted on 4 IP addresses over 0 years.
* View 49 ownership records archived since 2009-05-16 .
* Wiki article on Microsoftmedicenter.com
* 193 other web sites are hosted on this server.

DomainTools for Windows®

Now you can access domain ownership records anytime, anywhere... right from your own desktop! Find out more >
Registrant:
James Gonzaga
Roxas Boulevard
Manila, NCR 2000
Philippines

Domain Name: MICROSOFTMEDICENTER.COM
Created on: 14-May-09
Expires on: 14-May-10
Last Updated on: 27-Oct-09

Administrative Contact:
Gonzaga, James
Roxas Boulevard
Manila, NCR 2000
Philippines
+63.9194341212 Fax --

Technical Contact:
Gonzaga, James
Roxas Boulevard
Manila, NCR 2000
Philippines
+63.9194341212 Fax --

Domain servers in listed order:
NS1.WATCHUNDERGRADS.COM
NS2.WATCHUNDERGRADS.COM

And the plot thickens! Domain name was registered to a fellow-Filipino residing in Manila? Who knows. Unless Domain Name registration requires a high-level of authentication and presentation of credentials, I doubt if there is even a James Gonzaga along Roxas Boulevard in Manila. I am going to try that listed Philippine number in some other time, who knows, maybe there is a real James Gonzaga prowling the streets of Manila.

If someone picks up, I will ask "Is this James? Can I pay in $$$ and distribute some of my stuff on your website and be part of my worldwide BOT NET operation?"

Evil grin. That's how easy bad guys do transaction with smart kids from developing countries. All they need to do is mention the word US Dollars.

Next stop is let's NMAP this baby, I don't care if he backtracks on my trace, I make sure I cover my tracks:

Hmm, a couple of filtered interested ports. Maybe next time.

Stay tuned.