SOURCE Boston Security Conference and Training 2012 Day 2 – Dan Geer Keynote, Android Modding and Cloud Security

Dan Geer’s fantastic Keynote Speech kicked off Day 2 of SOURCE Conference Boston this morning. The talk itself was heady and complex, something to keep up with. Notable talks also were Jeremey Westerman’s “Covering *aaS – Cloud Security Case Studies for SaaS, PaaS and IaaS”, and Dan Rosenberg’s “Android Modding for the Security Practitioner”.

“The internet will never be as free as it is this morning.” Dan Geer is one of the best, sharpest computing/network security speakers around. His talk descended from a high-level, lengthy, example-laden description of most every developed nation’s dependency on the internet: “Dependence with respect to the internet is transitive, dependence on television is not…We are at the point where it may no longer be possible to live your life without having a critical dependence on the Internet, even if you live at the end of a dirt road but still occasionally buy nails or gasoline.” And, he wound through multiple examples of failures in US systems to provide fallback options. He talked about his little local bank, whom he wrote a letter to close down the auto-created online account he wouldn’t use. They, as an exception, closed it down immediately. His 401k account administrator Fidelity Investments, on the other hand, would not accept customer instructions from him in writing. The company continues to send him mailed marketing content of all kinds in writing at the address from which he sends his letters. Their auditors apparently approve of Fidelity’s rejection of customer-initiated hand-written delivered communications, instead, accepting email/online chat messaging or instructions over the phone. This discussion made its way through systems design, unified field theory, and fault tolerance, eventually landing on key points that intrusion prevention is agreed not to be a workable model, instead, the elegance of “intrusion tolerance” must be built into systems, and countries and organizations that cannot build tolerance into their systems are not sustainable. Favorite quotes: “forget the banks, it is the internet that is too big to fail”, “Is there room for those who choose simply to not participate in the internet?”, “HTML5 is Turing complete. HTML4 is not”, and “Should we preserve a manual means? Preserving fallback is prudent if not essential.”

Jeremy Westerman’s “Covering *aaS – Cloud Security Case Studies…” presented several design cases for Universities and other organizations. The single most important point to learn from this talk is that API key management is unfortunately not handled with as much urgency and awareness as private SSL keys for large organizations. This API key, in the context of multiple, popular single sign-on (SSO) solutions in use at large universities, is the key to tens of thousands, if not hundreds of thousands, of email accounts. Similar API key schemes are implemented on IaaS solutions like the Xen supported Amazon EC2 environment and VMWare vCloud Teramark environments. Without appropriate awareness, developers are storing that key in improper locations like the hard drive of the sign-on machine, or the developers themselves are storing keys on their development system hard drives in non-obvious places, emailing/”dropboxing” them around to each other and then simply transferring the API keys to the production environment, instead of re-issuing production API keys. It is practically imperative that these keys are taken out of the hands of developers. These loose handling practices are bad news – viral code like Sality and other viral code and worms previously high in our prevention stats have maintained functionality to steal FTP and web admin account passwords in order to silently host malicious code, encrypted or otherwise, on legitimate web sites without the owner’s knowledge. In other words, developers have been effective and weak targets in the past for credential theft, enabling silent site compromise and malicious use. Most schools don’t want that – I remember one unfortunate notification at a small Arts college, where the web admin really didn’t want to believe that the encrypted blob of data hosted on his school’s web server was a viral payload updating other students’ infected systems, located there because his credentials were Sality-stolen after trying to run cracked software distributed over a P2P network. Anyway, it happens and it can be planned for and prevented.

Dan Rosenberg’s talk about “Android Modding for the Security Practitioner” hit the spot for technical Android discussion, clarifying rooting/modding techniques and the language around them plus the security implications of modding Android phones.

Interesting quotes included “carriers incentivize customers to see their phones as throwaway”, and just get the latest phone asap and sign a new multiyear contract. “Of the 10 vulnerabilities that I discovered and used for rooting on Android, 9 of them are related to “stupid” file permissioning not present in the stock Android code, but introduced by the manufacturers” and went on to present concrete examples of Motorola and Sony implementing bad permissions. “Benign root vulnerabilities are often patched much more quickly than real security bugs” that put the hundreds of millions of Android owners at risk.

Dan discussed some of the intricacies of the partition layout, bootloaders (both locked and unlocked), flashing protocols, and the file permissions model and related vulnerabilities and modding techniques. He finished the talk with a fantastic short list of security related suggestions for decision-makers: 1. It is impossible to evaluate “Android Security” without looking at the chipset and hardware manufacturer. 2. Use disk encryption if it is available to you! 3. Disable USB debugging on your phone. 4. Rooting is a double edged sword – you can enable patching (that the carriers fail to deliver), but you may enable more vulnerabilities.