Security Now 259

Security Now Episode 259

"Your Questions, Steve's Answers 97"Hosts: Leo Laporte and Steve Gibson Topic: Your Questions, Steve's Answers 97 Recorded: July 28, 2010 Published: July 29, 2010 Duration: 1:39:31 Transcript Previous episode – Next episode

Contents 1 Security Now 259: Your Questions, Steve's Answers 97 1.1 News & Errata 1.2 Spinrite Story 1.3 Questions & Answers 1.3.1 Question: [ 01 ] 1.3.2 Comment: [ 02 ] 1.3.3 Comment: [ 03 ] 1.3.4 Question: [ 04 ] 1.3.5 Question: [ 05 ] 1.3.6 Comment: [ 06 ] 1.3.7 Question: [ 07 ] 1.3.8 Question: [ 08 ] 1.3.9 Question: [ 09 ] 2 Sponsors 2.1 Carbonite 3 Production Information

Security Now 259: Your Questions, Steve's Answers 97

News & Errata

3:55 - 6:20

• A New York times article repeated what Steve said about Vitamin D in the podcast
• Steve wants to do another health related podcast again soon, Leo says in the middle of August

6:21 - 9:12

• Firefox, Seamonkey and Thunderbird have been updated
• v3.6.7 fixes 14 security holes 7 of which are critical

9:13 - 10:32

• iTunes had a remote code execution vulnerability
• It has now been fixed users need to update

10:33 - 11:45

• Google Chrome has been updated to v5.0.375.125
• 5 vulnerabilities were patched, 3 rated as "high"

11:46 - 22:19

• There are reports that WPA2 has been cracked
• The details will be revealed at black hat
• It is a problem that arises due to the fact we were attempting to put a encryption wrapper around Ethernet
• In WEP this wasn't a problem as everyone that was on a WEP node had the same key and a mistake was that the key was directly used to drive the encryption
• Which meant that everyone on the same WEP encrypted access point was using the same key and generating compatible key streams using RC4
• Which meant we were all part of one big LAN
• Because its radio everyone can see hear and talk to everyone else
• So there was no interclient privacy
• Under WEP when you accessed a access point that everyone was accessing you could see there traffic

• A golden rule of cryptography is you never reveal your key, you always use derivatives of the key
• When WPA was created the privacy of users of the same access point was increased
• So the master key that users use to access the network is never used to perform encryption
• It is used at the beginning in a negotiation handshake when the client is setting up a connection to a access point
• The problem with creating privacy is that Ethernet isn't private
• So the designers of the WPA protocol had a problem because they wanted to isolate individual users of the access point.
• But at the same time they had to support all the functionality of Ethernet because they had to be a transparent wrapper on top of Ethernet

• So they created a pair of keys per client called the PTK (pairwise transient key)
• "Pairwise" meaning it cryptographically protects your conversation to the access point.
• But then the problem was, how do you send something to everybody?
• So they had to have a Groupwise Transient Key called the GTK, which is inherently shared by everyone
• The guys who are going to be presenting at Black Hat figured out a way to take advantage of this groupwise transient key.
• And all we know about it is that they're using the fact that this allows broadcasts to spoof the MAC address of the access point, send a packet to another client on the WPA network, and get that client somehow to reveal its PTK, its private Pairwise Transient Key, which is specifically used for talking to the access point.
• But understand that what this means, and here's the point of all this, is this doesn't allow somebody roaming the street outside to access anything. What this is, is this is a breach of privacy among clients that are already authenticated on that WPA or WPA2 network

22:20 - 28:54

• @Captn_Caveman told Steve that Sophos, the well-known security company, had developed a free blocker for this very bad Windows shell LNK zero-day exploit
• Windows Shortcut Exploit Protection Tool is available here
• Worms have started to appear exploiting the .lnk vulnerability

28:55 - 29:50

• Someone sent Steve a screenshot though Twitter showing that Twitters SSL certificate had expired

29:51 - 30:44

• Safari has been updated to v5.0.1 and now has support for extensions

30:45 - 32:35

• Dell shipped motherboards that were infected
• They were replacements for the faulty ones that have been replacing recently

32:36 - 41:50

• The IANA made some news this week by reminding us again that the Internet is running out of IPv4 addresses
• IPv6 is the only real solution to this problem
• 16 of the 256 possible first bytes in the Internet address like 4.79.whatever have been set aside as being private and unroutable.
• Similarly, there were 16 other numbers, that first byte, that had still been reserved, never been allocated.
• And those are now, just now being divvied up, where Europe gets this many and Russia gets a couple and we get some.
• And the point of this is that based on the rate of consumption now, and the projected rate the general consensus is around this time next year, around July of 2011, we're out.
• Wikipedia has a good page on this
• IPv6 gives us 340 trillion trillion trillion possible IP addresses
• Google did a study in 2008 and found that only one percent of the Internet was ready for IPv6

41:51 - 44:26

• Episode 261 will be the start of the 6th year of Security Now

Spinrite Story

44:27 - 49:02 Bill Cox (Vancouver, Canada)

Spinrite fixed a broken computer

Questions & Answers

52:35 - 01:36:32

Question: [ 01 ]

52:35 - 57:50 Glenn Edward (Nottingham, MD)
Question: Do you think that hackers waited for Microsoft to stop supporting Windows XP SP2 before starting to exploit the .lnk vulnerability ?

Answer: This is actually the least crazy theory Steve has heard

Comment: [ 02 ]

57:51 - 01:03:03 Stephen Conway (Dublin, Ireland)
Listener Comment: I found a bug in LastPass where it was giving me the wrong password for a website but there customer service was great and got it fixed eventually

Steve's Comment: Its good that he kept telling LastPass there was a bug and got it fixed

Comment: [ 03 ]

01:03:04 - 01:09:16 Rodney Morton (Round Rock, Texas)
Listener Comment: I received a "site advisory" message from McAfee when saving the PDF version of the transcription for Episode 255

Steve's Comment: Its a false positive and this happens to Steve a few times a year. Steve also notes "the job that's being done is herculean on the part of antivirus."

Question: [ 04 ]

01:09:17 - 01:14:08 Bruce Harrison (Durban, South Africa)
Question: Now that Intel have added the AES instruction set to their chips going forward, does this mean that cracking AES just got easier for the bad guys?

Answer: Yes brute force attacks against AES are now also 4 - 8 times faster but it is still near impossible to crack if a strong key is used

Question: [ 05 ]

01:14:09 - 01:16:56 Lee Elliott (Columba, MO)
Question: Assuming that I'm not vulnerable to a sneaker net attack, would it adequately protect against the .lnk vulnerability if I do all my surfing on a Linux virtual machine?

Answer: Absolutely, doing your surfing in a Linux virtual machine is about the best thing I could imagine for protection

Comment: [ 06 ]

01:16:57 - 01:24:29 Nathan Hartley (Lansing, Michigan)
Listener Comment: OpenDNS filters for DNS Rebinding. If a DNS server returns a local IP for a website OpenDNS filter this result

Steve's Comment: This is really cool but this is not enabled by default

Question: [ 07 ]

01:24:30 - 01:27:41 Ray Garrett (Miami, Florida)
Question: How much damage the shell LNK exploit could really do as long as your UAC is turned on ?

Answer: Having malware run as a standard user is not a good idea, it could still find a way to do serious damage

Question: [ 08 ]

01:28:42 - 01:33:07 Paul (Ottawa, ON, Canada)
Question: It's all nice that LastPass folks explain how your passwords are encrypted and saved. But it's one thing to say this is how it's being done, another that it's actually being done that way. Is there a defined way to know for sure? I'm not saying that LastPass would be up to no good. But hypothetically speaking, let's say someone buys LastPass as a company, changes the code to the browser plug-ins that would allow them to get your login information. You'd think everything's okay. You'd get a notice that the plug-in needs updating to support new features or something. Isn't that a potential threat?

Secondly, if the plug-in uses SSL to communicate with LastPass, how can I check the certificate? Third, also in reference to some websites not allowing special characters in passwords, I'd question the use of such a website for the simple reason they may not be hashing your login credentials. If the password is hashed before it gets stored in a database, it wouldn't matter what characters are in it.

Answer: You can never be sure that LastPass is 100% trustworthy

Question: [ 09 ]

01:33:08 - 01:36:32 Robert Sylvester (Warwick, Road Island)
Question: Does Sandboxie prevent permanent problems with remote code execution via the LNK and PIF file vulnerability?

Answer: Steve doesn't think so

Sponsors

Carbonite

• Carbonite.com
• Offer Code: securitynow
• Carbonite #3
• Ad Times: 00:45-00:58 and 49:15-52:07

Production Information

• Edited by: Erik
• Notes:

This area is for use by TWiT staff only. Please do not add or edit any content within this section.