|
|
Columnists |
< http://www.securityfocus.com/columnists/274 > |
 |
By Scott Granneman Nov 01 2004 02:15PM PT The art of faking out opponents in a clever, elegant, beautiful way is one that I find fascinating, and I cherish examples of that art. When looking through history for stories illustrating the deliberate use of distractions to obfuscate an intended purpose, I often return to World War II, which offers many such tales.The story of the allies' cracking of the German Enigma machine is one that everyone in security should know about. Used by the Germans, the Enigma machine was cracked by the allies using a variety of techniques. Math played its part, but so did subterfuge. Robert Morris, former chief scientist at the NSA (and father of the Morris Worm author), explained during a talk at Blackhat Briefings that the Americans noticed that German weather ships trawling in the North Atlantic used Enigma machines to send in weather reports every day. If the Allies could acquire those machines and their keys, it would be a major help in decrypting Enigma. Consquently, the Allies sank a couple of the ships in what seemed like a normal wartime action, but in reality salvage teams immediately went to work and recovered the Enigma machines and the required keys. The Germans never suspected what the real target of the attacks was, and the Allies had another tool to use in their war. Several incidents, famous only after the war, occured during the preparations for the liberation of Europe from the fascists. The Allies wanted to confuse the Nazis so that the actual locations of the landings -- the beaches of Normandy for D-day in 1944 and Sicily in the Mediterranean in 1943 -- would be secret as long as possible, so they developed several deceptions that were purposely designed to be "accidentally" picked up by Nazi operators, including:
A fake First Army Group, supposedly commanded by General George S. Patton, sent fake radio messages confirming that the Pas de Calais was going to be the epicenter of D-day. In addition, airfields were created that contained row upon row of papier-mache planes, designed to fool air surveillance. Operation Skye Radio traffic out of Scotland intentionally deceived the Germans into believing that the D-day attack was going to come out of northern Europe, in either Norway or Denmark. Operation Mincement (This one is my favorite) This brilliant plan involved dropping a dead man, wearing a life jacket and supposedly named "Major William Martin", into the ocean off the coast of Spain in April 1943. Chained to his wrist was a briefcase containing forged war plans about the upcoming invasion of Sardinia. Hitler fell for it completely, diverting Axis defenses to Sardinia and allowing the Allies much easier access to the island of Sicily, the real target. Reaching the point of epidemic I don't know about you, but I get at least one email every few days that is supposedly from CitiBank (currently used in 54% of phishing messages), or PayPal, or eBay, or Amazon, or SunTrust Bank (who the heck are they?), or or or or or ... the list goes on and on. The emails always mention that my account needs to be updated, or my credit card has been charged for some enormous purchase that I never made and I need to correct this, or that I need to verify some information the web site has on me. Whatever. The goal is always to get me to believe that a company I use for financial transactions -- and who therefore is trusted by me -- needs information, so that I submit personal data that can be used by criminals to further their own ends. These messages can look very, very real, as the image below, taken by blogging pioneer Dave Winer shows. Yes, he uses Outlook Express for some reason, and received this in his email: Keep in mind that phishing is not confined to email, but is also web-based as well. In fact, those emails wouldn't work without a corresponding web site, designed also to look as realistic as possible, containing forms for suckers to fill in. But there are also various tricks that can be played on unsuspecting web users that can get them in trouble. How big is that trouble? Enormous, and growing. According to a Gartner Group study from May of this year, at least 1.8 million consumers have been tricked by phishing attacks into revealing sensitive information -- and the majority of that 1.8 million occured within the year prior to that report. In just the last six months, phishing emails have increased by 4000%. On average, a consumer loses $1200 when his bank account is taken over, and the vast majority of such takeovers are from phishing. Think about those numbers for a second. 1.8 million people affected. 4000% increase. $1200 average loss per person. This is escalating into such a problem for banks that many of them are now refusing to protect their customers and, as The Boston Herald reports, are now choosing instead to "litigate, fight and force consumers to settle for lower amounts". If you were fooled through phishing, your bank very well may refuse to reimburse you. Most consumers know that if they get screwed using a credit card, they're only liable for $50. Not so with bank accounts, evidently. Some of you might think, as I did, that FDIC protections safeguard those of us who live in the U.S., at least up to $100,000 (which is far, far more coverage that this columnist needs!). Nope. Those only apply if the bank declares bankruptcy, not if an Eastern European cracker employed by the mob tricks me into revealing my PayPal password and then cleans out my bank account. Browser Problems So phishing is a large, serious, and growing, problem. That's bad. And then within the last few weeks we received even worse news: many of our favorite (and some not-so-favorite) web browsers were vulnerable to phishing using a particularly clever attack vector: the tabs that many of us have come to know, love, and depend upon. Secunia issued a security report detailing how most major web browsers with the tabbed browsing feature were vulnerable to two different vulnerabilities. First, the browsers. Recognize any you use?
Now, the vulnerabilities. One of them is pretty clever, and one of them, I think, is a bit overstated, but I'll explain that in a second.
In the usual open source tradition of fixing flaws quickly, Konqueror released a version of the browser that was patched against the vulnerabilities, and Firefox promised that it would be secured by the time 1.0 is released, sometime in the new few weeks. On the other hand, Netscape, now owned by AOL, and Avant never bothered to respond to Secunia when it contacted them. Guess I know which browsers to avoid. I'm not trying to discredit Secunia or these vulnerabilities. They are definitely problems that need to be fixed. It's just that there's a big difference between the almost torturous series of steps required to exploit users with these vulnerabilities as compared to the recent IE exploit that involved simply visiting your bank's web site. However, there are other phishing vulnerabilities out there, involving Google, for instance, that are far easier to fall for. Undoubtedly there are many, many others, involving weaknesses in the web sites and in the web browsers we all use every day, that will be discovered. We need to be aware of these openings because they remind us that phishing is not just a matter of receiving an email that's a doppelganger for a real one from a company we do business with, but also that phishing is increasingly going to use the vector of the browser itself as an opening for exploitation. And that, as security pros undoubtedly know in their bones, is going to be an even bigger problem than duplicitous emails. Scott Granneman is a senior consultant for Bryan Consulting Inc. in St. Louis. He specializes in Internet Services and developing Web applications for corporate, educational, and institutional clients. |
