darn, rich mogull beat me to the publish button - that will teach me to put work and home repair first... i think i'm going to post what i had anyways, though, because mine isn't exactly the same and frankly when it comes to principles that i anticipate needing to hammer home repeatedly it's nice when i have them all in one place... also, actual incidents like yahoo mail serving malware and not cleaning up promptly sort of drive this point home better than xss vulnerabilities found on security vendors sites; i'm a security blogger and even i rarely visit security vendor sites so i don't imagine the average person does much either - yahoo mail, on the other hand gets LOTS of traffic from average folks... so here's what i had in my draft folder with the addition of some links i was waiting to find time to look up...
once upon a time there used to be this piece of advice about online security that said don't go to dodgy sites and you should be just fine... the principle behind it is that if you won't get compromised by malicious web content if you only ever run trustworthy web content and if you only ever got to trustworthy sites then trustworthy web content should be all your browser is exposed to...
internet explorer's security zone model has this very principle in mind, some sites are trustworthy and some aren't and those that aren't don't get to take advantage of as much rich web-based functionality as those that are...
even the mighty noscript firefox plugin depends on this basic premise to protect those firefox users who use noscript (in fact, adding a site to noscript's whitelist is in many ways the same as adding a site to ie's trusted sites zone - only easier, more convenient, and more intuitive)...
the principle makes sense and the advice (even in absence of the technologies that try to make it automatic) has been one of the more successful bits of security know-how at gaining widespread adoption... unfortunately the principle is falling apart because malicious web content is increasingly finding it's way on to what would otherwise be considered trustworthy sites... dancho danchev often informs his readers of instances of web sites being directly compromised to serve malware, and sandi hardmeier regularly informs her readers of instances of sites serving malware indirectly by virtue of malvertizements (malicious advertisements) infiltrating the 3rd party ad networks the site owners use...
when (as this zdnet article suggests) such compromises are up 400% over last year, and when affected sites include such well known internet properties as yahoo mail, cnn (among others), or the superbowl then it begs the question "is there any such thing as trusted sites anymore?" and the answer i think has to be either "no" or "not for much longer"...
now, of course the efficacy of the tools like noscript aren't quite as affected as a basic careful internet user would be since the tools can look at where the content is coming from rather than just what the current site is, but it really makes you wonder about those oh-so-clever users who go around not using any anti-malware software and thinking they're fine because they don't go to dodgy sites...
prudence alone isn't really enough anymore, you need good tools to help control what web content is allowed to run (i.e. some kind of whitelist like noscript), in what environment it runs (i.e. some kind of web sandbox whether it's multiple browsers/browser profiles, or sandboxing software like sandboxie, or even a full virtual machine like vmware), and to detect when something slips through the cracks (i.e. a scanner, preferably one that implements an lsp) to help prevent it from stealing data you enter and/or using your browsing session as a staging point for an attack on other things on your network (like your router) or the internet at large...
Showing posts with label safe hex. Show all posts
Showing posts with label safe hex. Show all posts
Thursday, June 12, 2008
Tuesday, April 29, 2008
some critical thinking on fake alerts for the user
tad heppner over at the mcafee avert blog had an interesting user-centric post about fake alerts pushing rogue anti-malware products... what interested me was that it presented some ideas that a user could theoretically apply (like safe hex) to determine whether a particular security alert is trustworthy or not, but i think he could have taken this further...
his suggestion of using responsible browsing practices is a little vague (and some fake alerts don't even make it obvious that they have anything to do with browsing in the first place), doing a bit of research on what you're being asked to install/buy is a good idea (though i suspect people won't have the presence of mind to do that when scare tactics of "you have a virus" are being used), and looking for secondary indications of infection is just a little too technical...
now, presence of mind when scare tactics are being used will always be a problem, but if a user can keep their head and not panic then this line of thought might come in handy: if the alert is warning you that you have something bad on your computer and then asking you to install/buy something then it stands to reason the alert didn't come from something you already installed/bought... now unless you intentionally went to a website that scans your system without needing an install that means that whatever is giving you an alert examined your system without your permission... i think we all intuitively understand that things shouldn't be searching through your files without your permission so that alone should signal to the user to stay away from it, whatever it is...
another good (and somewhat related) idea is to be familiar with what the security alerts from your actual security software looks like so that when a strange one pops up you'll be able to tell that it doesn't belong... downloading the eicar standard anti-malware test file should probably cause anti-virus software to pop up an alert so you can see what that alert is supposed to look like and how it's supposed to behave... that's not the only security software a user may have installed, mind you, but there aren't necessarily simple standard ways of triggering alerts from those other security products, and that's something someone might want to look into...
his suggestion of using responsible browsing practices is a little vague (and some fake alerts don't even make it obvious that they have anything to do with browsing in the first place), doing a bit of research on what you're being asked to install/buy is a good idea (though i suspect people won't have the presence of mind to do that when scare tactics of "you have a virus" are being used), and looking for secondary indications of infection is just a little too technical...
now, presence of mind when scare tactics are being used will always be a problem, but if a user can keep their head and not panic then this line of thought might come in handy: if the alert is warning you that you have something bad on your computer and then asking you to install/buy something then it stands to reason the alert didn't come from something you already installed/bought... now unless you intentionally went to a website that scans your system without needing an install that means that whatever is giving you an alert examined your system without your permission... i think we all intuitively understand that things shouldn't be searching through your files without your permission so that alone should signal to the user to stay away from it, whatever it is...
another good (and somewhat related) idea is to be familiar with what the security alerts from your actual security software looks like so that when a strange one pops up you'll be able to tell that it doesn't belong... downloading the eicar standard anti-malware test file should probably cause anti-virus software to pop up an alert so you can see what that alert is supposed to look like and how it's supposed to behave... that's not the only security software a user may have installed, mind you, but there aren't necessarily simple standard ways of triggering alerts from those other security products, and that's something someone might want to look into...
Thursday, May 17, 2007
understanding the malware threat of pirated software
recently both symantec and sophos have come out with statements to the effect that pirated software represents a security risk to users' computers and/or identities...
i haven't seen anyone crying FUD about sophos' claims (at least not this time, maybe next time) but mitchell ashley had some choice words about symantec's claims and, while i think i've expressed myself well enough in the comments to that post, the existence of that post and that sentiment makes me think some explanations need to be made more pronounced than they would otherwise be as simple comments...
the basic premise is that pirated software might damage users' machines or steal their identities... the way this would happen would be that the pirated copy of the software would have some malware type of functionality added to it or perhaps even be completely replaced with malware...
the question is, is that a credible threat and is there a good reason to mention it? if the answer to either of those is no then claims like those made by symantec really would qualify as FUD...
one of the oldest safe-hex tips was to only get software from trusted/official sources... this was to counter the major malware vectors of the day, which were warez (pirated software), bulletin board systems, and floppy disks... i personally have encountered a number of people over the years who ran into problems with malware precisely because they didn't follow this safe-hex principle and while floppy disks and bbses are all but extinct now, the warez scene is still around (otherwise we wouldn't be talking about software piracy) and so is still a viable malware vector... it's not an accidental malware vector either, as numerous virus writers and virus spreaders have in the past demonstrated how rich with computer using risk takers the warez scene is by targeting them and successfully spreading their malware... malware profiteers in today's commercial malware world would have to be short sighted indeed to pass up such fertile and proven ground...
of course, in the specific case being referred to by symantec, the users weren't getting their software from some warez site (at least not to their knowledge)... they weren't engaging in obviously risky behaviour, but rather they were purchasing the software from commercial pirates fraudulently posing as authorized resellers...
now you may think that the fact that they're commercial pirates that are in it for the money obviates the conventional warez-associated risks but let's look at that more closely... just because they're in it for the money doesn't mean they don't have other motives... in fact, if you were a malware profiteer trying to deploy bots (for example), why not devise a social engineering ploy that involved bundling the bots with seemingly legitimate software and enjoy the added bonus that you'd need to charge your victims money in order to make the legitimacy of the software believable?... additionally some of the employees of the commercial pirate organization may be disgruntled enough to tamper with the software or it may get contaminated accidentally - it's not like commercial pirates care about their falsified reputation enough to enable strict quality controls, if something goes wrong they can just blame the actual vendor... speaking of which, the software the commercial pirate is selling may not have come directly from that actual vendor but instead from a warez site with all the associated risks but none of the transparency about those risks that would allow the customer to gauge their risk exposure accurately...
so the threat seems plenty credible to me but still you might wonder whether it's worth it to mention the risk if there haven't been any actual reports of anything bad in the pirated software... if you're thinking like this then i can only tell you that you're thinking like a victim... in my experience victims usually think things are safe unless something specifically says they aren't... if you don't want to be a victim you need to turn that around and (as i'm sure robin bloor, marcus ranum, and many other anti-virus detractors/whitelist enthusiasts would suggest) start considering all software to be inherently untrustworthy by default unless given good reason to think otherwise...
i haven't seen anyone crying FUD about sophos' claims (at least not this time, maybe next time) but mitchell ashley had some choice words about symantec's claims and, while i think i've expressed myself well enough in the comments to that post, the existence of that post and that sentiment makes me think some explanations need to be made more pronounced than they would otherwise be as simple comments...
the basic premise is that pirated software might damage users' machines or steal their identities... the way this would happen would be that the pirated copy of the software would have some malware type of functionality added to it or perhaps even be completely replaced with malware...
the question is, is that a credible threat and is there a good reason to mention it? if the answer to either of those is no then claims like those made by symantec really would qualify as FUD...
one of the oldest safe-hex tips was to only get software from trusted/official sources... this was to counter the major malware vectors of the day, which were warez (pirated software), bulletin board systems, and floppy disks... i personally have encountered a number of people over the years who ran into problems with malware precisely because they didn't follow this safe-hex principle and while floppy disks and bbses are all but extinct now, the warez scene is still around (otherwise we wouldn't be talking about software piracy) and so is still a viable malware vector... it's not an accidental malware vector either, as numerous virus writers and virus spreaders have in the past demonstrated how rich with computer using risk takers the warez scene is by targeting them and successfully spreading their malware... malware profiteers in today's commercial malware world would have to be short sighted indeed to pass up such fertile and proven ground...
of course, in the specific case being referred to by symantec, the users weren't getting their software from some warez site (at least not to their knowledge)... they weren't engaging in obviously risky behaviour, but rather they were purchasing the software from commercial pirates fraudulently posing as authorized resellers...
now you may think that the fact that they're commercial pirates that are in it for the money obviates the conventional warez-associated risks but let's look at that more closely... just because they're in it for the money doesn't mean they don't have other motives... in fact, if you were a malware profiteer trying to deploy bots (for example), why not devise a social engineering ploy that involved bundling the bots with seemingly legitimate software and enjoy the added bonus that you'd need to charge your victims money in order to make the legitimacy of the software believable?... additionally some of the employees of the commercial pirate organization may be disgruntled enough to tamper with the software or it may get contaminated accidentally - it's not like commercial pirates care about their falsified reputation enough to enable strict quality controls, if something goes wrong they can just blame the actual vendor... speaking of which, the software the commercial pirate is selling may not have come directly from that actual vendor but instead from a warez site with all the associated risks but none of the transparency about those risks that would allow the customer to gauge their risk exposure accurately...
so the threat seems plenty credible to me but still you might wonder whether it's worth it to mention the risk if there haven't been any actual reports of anything bad in the pirated software... if you're thinking like this then i can only tell you that you're thinking like a victim... in my experience victims usually think things are safe unless something specifically says they aren't... if you don't want to be a victim you need to turn that around and (as i'm sure robin bloor, marcus ranum, and many other anti-virus detractors/whitelist enthusiasts would suggest) start considering all software to be inherently untrustworthy by default unless given good reason to think otherwise...
Friday, February 09, 2007
recognizing social engineering - part 1
randy has a timely post over on eset's threatblog about the likely event that anna nicole smith's death will be used by the black hats in a social engineering ploy... it's really a very classic example of how significant media events can be used to fool people into installing malware... as such i thought i'd take the opportunity to generalize a way of detecting some kinds of social engineering - not all kinds, mind you, this won't include HP's pretexting or anything like that, just a classic broad category that randy's hypothetical example falls into...
the sorts of emails that randy describes are those that would appeal to our idle curiosity - we don't care enough to go and look for the info or pictures but if those things come to us then our curiosity can be satisfied... at a fundamental level this boils down to the principle that if something seems to good to be true then it probably is... this is not to say that the death was a good thing, but having answers to questions you never asked (such as what are the details of a now dead celebrity) magically appear in your inbox without any effort on your part is just too good to be true...
emails promising racy pictures of anna kournikova are similarly too good to be true... then there are emails promising information about the recent storms in europe, also too good to be true... emails from microsoft with a critical security patch attached? too good to be true.... emails with the subject line i love you? well the romantic in me doesn't want to admit it but with no evidence to the contrary it's probably too good to be true too... all of these are examples that have been used to spread malware...
good things don't just turn up in your inbox without you asking for them or searching for them or otherwise putting in some kind of effort to get them... the world doesn't hand us our every whim on a silver platter - that's basically what would be going on if things we were even mildly curious about just (supposedly) showed up in our inboxes for no good reason... so next time you're looking through your unread messages (or anything else, for that matter) and you get that "hmmm - that looks interesting" feeling come over you, think about the too good to be true principle and ask yourself if the object of your interest qualifies... ("if the bait looks obvious, don't take it")
the sorts of emails that randy describes are those that would appeal to our idle curiosity - we don't care enough to go and look for the info or pictures but if those things come to us then our curiosity can be satisfied... at a fundamental level this boils down to the principle that if something seems to good to be true then it probably is... this is not to say that the death was a good thing, but having answers to questions you never asked (such as what are the details of a now dead celebrity) magically appear in your inbox without any effort on your part is just too good to be true...
emails promising racy pictures of anna kournikova are similarly too good to be true... then there are emails promising information about the recent storms in europe, also too good to be true... emails from microsoft with a critical security patch attached? too good to be true.... emails with the subject line i love you? well the romantic in me doesn't want to admit it but with no evidence to the contrary it's probably too good to be true too... all of these are examples that have been used to spread malware...
good things don't just turn up in your inbox without you asking for them or searching for them or otherwise putting in some kind of effort to get them... the world doesn't hand us our every whim on a silver platter - that's basically what would be going on if things we were even mildly curious about just (supposedly) showed up in our inboxes for no good reason... so next time you're looking through your unread messages (or anything else, for that matter) and you get that "hmmm - that looks interesting" feeling come over you, think about the too good to be true principle and ask yourself if the object of your interest qualifies... ("if the bait looks obvious, don't take it")
Monday, January 15, 2007
being cautious online
i found this interesting quote from rixstep by way of the security protocols blog:
if people just used the same care when putting things in their computer as they do when putting things in their mouths, their computers would be a lot safer...
my suggestion to everyone is this: avoid that which that you don't know you can trust, and if/when you discover you put your trust in something you shouldn't have then you need to adjust their expectations for the next time...
People regularly download software they cannot claim they trust and just run it with no thought for the consequences. Yes, it's 'only' a computer - but listen to them wail if something goes wrong. They're living in their rose (pink) coloured world and are totally unaware of the threats lurking outside in the dark.this is incredibly true and more people need to become aware of this... maybe not so much that they learn the exact extent of the threat that each online activity poses, but at least know that everything they click on online has the potential to download something onto their computer, that every time they download something to their computer it is fundamentally the same as putting it in their computer, and that everything they put in their computer (regardless of the source, because even microsoft has been known to inadvertently distribute malware in the past) has the potential to do bad (maybe even costly) things...
if people just used the same care when putting things in their computer as they do when putting things in their mouths, their computers would be a lot safer...
my suggestion to everyone is this: avoid that which that you don't know you can trust, and if/when you discover you put your trust in something you shouldn't have then you need to adjust their expectations for the next time...
Sunday, December 31, 2006
how to recognize phishing emails the easy way
perhaps you've seen this phishing iq test before... if not, that's ok - it's basically a bunch of examples of legitimate emails and phishing emails and you have to try and figure out which are which... the root concept is that there are these heuristics or rules of thumb that you can apply so as to determine whether a particular email is phishy just by looking at it...
the fact that browsers now come with anti-phishing technology built in that tries to identify a phishing site just by looking at the URL is strong evidence that those rules of thumb for detecting phishing emails are a failure but take the test and look at some of those rules at the end and see if you can determine why those rules aren't going to work... if you ask me, those rules are just too complex for the average person to remember or apply... add to that the fact that the characteristics of a legitimate email are possible in phishing emails (for example, ebay starts their emails to you with your ebay user name but anyone who has interacted with you on ebay knows that user name and thus has the information necessary to make a convincing fake ebay email)... finally take into account that legitimate emails often display phishy characteristics (both in the test, where only one of the emails was completely free of phishy characteristics, and in this real world example) and it becomes clear that not only are the rules complex but they're pretty much completely unreliable too...
after getting through that test, if you're like me you're probably saying to yourself "there must be an easier way"... so you can imagine how glad i am that i don't need to try to remember and follow those screwy rules... instead, i do something i touched on in my spam avoidance article - i use disposable email addresses... now, while the spam avoidance techniques actually apply to pretty much all forms of email annoyance (if the bad guys don't know your email address they can't send you bad email), i'm actually talking about more than just keeping my email address out of the hands of phishers, something that works even when your real email address is known to the bad guys... i use unique (a different one for each site) unguessable disposable email addresses provided by sneakemail.com and then when i get an email from ebay or paypal or my bank i check and make sure that it was sent to the right address for that organization...
here's how the magic works - let's say i create an address like mgbwklw02@sneakemail.com and give that address to ebay and no one else... the address is a secret that only ebay and myself know and no one else can guess so when i get an ebay email sent to that address i'll know that it was sent by ebay because they proved who they were by using a secret known only to ebay and myself... it's like knowing the secret passphrase or handshake to get into an exclusive club (or, more technically, it's like a shared secret authentication protocol)... alternatively, if i get an email supposedly from ebay but sent to some other email address i'll know it's fake because it was sent to some address that i never gave to ebay in the first place... if someone really, really wanted to send me a convincing fake ebay email they would have to either guess exactly the right email address to send to or guess the label i gave my ebay address (sneakemail.com allows you to label your disposable addresses and includes the that label in the From: field to help you determine which address the email was sent to) and try to forge a sneakemail.com header...
could using unique unguessable disposable email addresses for sites/organizations and ignoring emails sent to the wrong address for the site/organization in question qualify as an anti-phishing safe hex rule? i think so... although it requires a little more work up front (creating a new address each time you create an account somewhere), it's conceptually simpler than the multitude of rules currently being suggested and it's a lot more reliable too since it doesn't depend on questionable criteria such as how the email was composed...
the fact that browsers now come with anti-phishing technology built in that tries to identify a phishing site just by looking at the URL is strong evidence that those rules of thumb for detecting phishing emails are a failure but take the test and look at some of those rules at the end and see if you can determine why those rules aren't going to work... if you ask me, those rules are just too complex for the average person to remember or apply... add to that the fact that the characteristics of a legitimate email are possible in phishing emails (for example, ebay starts their emails to you with your ebay user name but anyone who has interacted with you on ebay knows that user name and thus has the information necessary to make a convincing fake ebay email)... finally take into account that legitimate emails often display phishy characteristics (both in the test, where only one of the emails was completely free of phishy characteristics, and in this real world example) and it becomes clear that not only are the rules complex but they're pretty much completely unreliable too...
after getting through that test, if you're like me you're probably saying to yourself "there must be an easier way"... so you can imagine how glad i am that i don't need to try to remember and follow those screwy rules... instead, i do something i touched on in my spam avoidance article - i use disposable email addresses... now, while the spam avoidance techniques actually apply to pretty much all forms of email annoyance (if the bad guys don't know your email address they can't send you bad email), i'm actually talking about more than just keeping my email address out of the hands of phishers, something that works even when your real email address is known to the bad guys... i use unique (a different one for each site) unguessable disposable email addresses provided by sneakemail.com and then when i get an email from ebay or paypal or my bank i check and make sure that it was sent to the right address for that organization...
here's how the magic works - let's say i create an address like mgbwklw02@sneakemail.com and give that address to ebay and no one else... the address is a secret that only ebay and myself know and no one else can guess so when i get an ebay email sent to that address i'll know that it was sent by ebay because they proved who they were by using a secret known only to ebay and myself... it's like knowing the secret passphrase or handshake to get into an exclusive club (or, more technically, it's like a shared secret authentication protocol)... alternatively, if i get an email supposedly from ebay but sent to some other email address i'll know it's fake because it was sent to some address that i never gave to ebay in the first place... if someone really, really wanted to send me a convincing fake ebay email they would have to either guess exactly the right email address to send to or guess the label i gave my ebay address (sneakemail.com allows you to label your disposable addresses and includes the that label in the From: field to help you determine which address the email was sent to) and try to forge a sneakemail.com header...
could using unique unguessable disposable email addresses for sites/organizations and ignoring emails sent to the wrong address for the site/organization in question qualify as an anti-phishing safe hex rule? i think so... although it requires a little more work up front (creating a new address each time you create an account somewhere), it's conceptually simpler than the multitude of rules currently being suggested and it's a lot more reliable too since it doesn't depend on questionable criteria such as how the email was composed...
Thursday, December 28, 2006
how to avoid email spam
typically, the life-cycle of email spam (in the most general sense) goes something like this:
most of the anti-spam technology that the average person is aware of works to deal with spam after it's been sent, effectively trying to address stage 3 in the spam life-cycle... you probably know this technology as spam filtering, either a black list where you record all the email addresses (or perhaps domains) from whom you don't want to receive email, a white list where you record all the email addresses from whom you do want to receive email, or some more advanced content-based spam filter such as the bayesian filtering... as most average people are at least vaguely familiar with spam filtering (even if only by way of noticing there's a junk mail folder in their webmail) they also know (or if not, should be made aware) that filtering isn't a perfect solution, that some legitimate mail can get flagged as spam and some spam may fool the filter into thinking it's legitimate mail... nothing is perfect, but as spam volume increases the number of spams that sneak through spam filters also increase, and nobody (except the spammers) want to see the amount of spam in our inboxes increase...
addressing stage 2, trying to stop the spam from getting sent or at least making it more difficult or costly, is something most average folks aren't aware of (or at least don't often think about) because it's not something they've been a part of for the most part... early on there was account termination for those caught spamming, then there were CAPTCHA tests to stop the spammers from creating very large numbers of accounts (which would otherwise make account termination a non-issue) from which to spam from... after that there was a crack down on open mail relays and ISPs started trying to block their subscribers from connecting to outside SMTP servers... now spammers use botnets designed for sending spam, effectively moving the burden of stopping spam out of the hands of centralized organizations like ISPs and into the hands of end users whose machines have been compromised and who are least likely to be able to deal with the problem or even be aware of it's existence... if you've never heard of this before, now you've got a brand new reason to prevent malware from compromising your computer - to help keep the spam problem in check...
avoiding spam
neither of these qualify as avoiding spam, however... in order to do that one must address spam at the earliest stage in it's life-cycle, one must stop the spammer from getting one's email address in the first place... think of your email address as being like your home phone number - it's confidential information that you don't hand out to every tom, dick, and harry you happen across...
keeping your real email address secret is probably not the most intuitive thing in the world, especially since so many things require you to give them an email address, but there are services and techniques that can help make it easier... there are also limits to how well the secret can be kept, but as an example i've managed to keep a webmail address i use daily completely spam free (there isn't even anything in the spam folder) for over 2 years simply by being careful and not giving out the address except to those i trust... one other caveat is that you can't make an email address secret if it wasn't a secret before... if your current address is receiving spam then the spammers already have your email address, the address has been compromised and there's nothing you can really do about that - you can't put the genie back in the bottle...
what you can do, with a fresh email address, is use disposable email addresses that forward to that real email address... a number of people are already familiar with the idea of a throw-away email address and often use hotmail or some other free webmail provider to make one but unfortunately that leaves you with no way to know who leaked your address to the spammers so when you need to change addresses (because the current throw-away address has gotten too spammy) you'll have no way to know which organizations to not give the new address to (never mind the fact that you'll have to give a new address to a bunch of organizations)... this is where true disposable email addresses come in - you need to use a different address for each site you give an address to (whether it's ebay, amazon, or your bank) so you can identify which one leaked the email address simply by looking at which email address got leaked and so that you only have to turn off that one address when it starts getting spammed rather than changing addresses and updating a potentially long list of sites with your new address... dedicated disposable email address services make creating multiple addresses easier (certainly easier than creating multiple throw-away email addresses where you have to answer a CAPTCHA test for each one) and managing multiple addresses (ie. turning off the ones that get spammy) easier as well...
different services provide addresses with different properties; some will forward the email sent to the disposable address on to your real address while others might maximize the ease and convenience of creating a new address by allowing you to create one without contacting the disposable email address provider first... beware the combination of these two properties (something spamgourmet.com does), however, because you invariably wind up giving out the information necessary for others to create new addresses that will forward to your real address and you don't want any tom, dick, or harry to be able to do that anymore than you want them to be able to email you directly... instead, use the created-on-the-fly addresses in cases where no sensitive information is going to be sent and/or in cases where you're likely only going to need to check for mail once (because most on-the-fly disposable email address services also don't require a login to check the email - mailinator.com and dodgeit.com work this way), and use forwarding addresses (such as those from sneakemail.com or mailnull.com) for everything else so that you get the benefit of picking up the mail in one place that only you (and your real email provider) have access to...
website feedback
now that takes care of sites that ask you for your email address, what about if you have a website or even a blog like this one? you want to be able to receive feedback from people without being deluged by spam but if you put an email address on the page then software that searches for email addresses on the web will find that address pretty quickly and it will soon be filled with spam... using disposable email addresses on their own doesn't solve this problem...
one thing people like to try is email address obfuscation - where the email address is manipulated in such a way that software that searches for email addresses can't easily recognize it as one... unfortunately this runs into competing requirements - in order to truly prevent software from collecting your email address for the spammer the email address has to not be machine readable, however people expect to be able to click on something and start typing their feedback and that functionality requires that the email address is machine readable... no email address obfuscation method can achieve both requirements so you generally either have to break expected functionality or accept that the email address isn't truly hidden...
a better solution is to use a contact form, specifically one that doesn't contain your email address in it's code... mailnull.com happens to offer this facility, it's what i'm currently using for this site at the time of writing, you can see what it looks like by clicking here... the only major drawback to using a web-based contact form is that people can't send you attachments but considering how troublesome attachments can be from a security standpoint, not providing a way for first time contacts to send them to you doesn't seem like all that big a deal... if you do encounter a scenario where it is a problem, the first time contact could use a file storage solution like dropload.com with their own disposable email address in the To: field and then paste the resulting URL into the web contact form...
additionally, if you not only have your own website but your own domain, you may want to turn off the default/catch all email functionality (where email sent to any non-existent address on that domain is 'caught' and collected for review and possible redirection to relevant parties)... so long as you are providing people with a clear way to directly contact the right individuals within your domain there should be no reason for anyone to send email to non-existent addresses on your domain or firing emails blindly at arbitrary addresses on your domain...
friends and family
as i mentioned before, there are limits to the extent to which you can keep your email address secret and a potentially very big hole in the strategy involves your trusted contacts (be they friends, family, or business contacts)... these are people you can't reasonably be expected to keep your email address a secret from and so may wind up being a source of email address leakage... what can you do?
pretty much what you can do boils down to treating their email addresses with the same care you would treat your own and teaching them to do the same for you (maybe even pointing them here)... that means that you shouldn't give their addresses to websites no matter how cool those websites might happen to be or how interesting you think your friends/family/contacts will find the site (even those greeting card websites that are so popular around the holidays) - instead you should give those sites one of your own disposable email addresses and then forward the resulting email to the person you wanted to share the site with, thus giving them exactly the same information you would have given them if you'd exposed their email address to the website but without actually exposing their email address to the website...
additionally, don't share people's email addresses with other people they don't know... if you're emailing people that don't know each other, put your own email address in the To: field and put the other email addresses in the Bcc: field so that they can't see each other's addresses... if you're forwarding something to people, make sure not to include any of the email addresses that it was previously sent to or from as forwarded emails otherwise tend to build up large numbers of email addresses on a large number of strangers machines - any one of which might get compromised by a piece of malware that harvests email addresses for spammers and other email miscreants and that's something you want to minimize where possible...
anti-spam safe hex
all these things effectively form a set of spam-related safe hex rules... summarized, they are:
- the spammer gets your email address
- the spammer sends you spam
- you receive and do your best to deal with that spam
most of the anti-spam technology that the average person is aware of works to deal with spam after it's been sent, effectively trying to address stage 3 in the spam life-cycle... you probably know this technology as spam filtering, either a black list where you record all the email addresses (or perhaps domains) from whom you don't want to receive email, a white list where you record all the email addresses from whom you do want to receive email, or some more advanced content-based spam filter such as the bayesian filtering... as most average people are at least vaguely familiar with spam filtering (even if only by way of noticing there's a junk mail folder in their webmail) they also know (or if not, should be made aware) that filtering isn't a perfect solution, that some legitimate mail can get flagged as spam and some spam may fool the filter into thinking it's legitimate mail... nothing is perfect, but as spam volume increases the number of spams that sneak through spam filters also increase, and nobody (except the spammers) want to see the amount of spam in our inboxes increase...
addressing stage 2, trying to stop the spam from getting sent or at least making it more difficult or costly, is something most average folks aren't aware of (or at least don't often think about) because it's not something they've been a part of for the most part... early on there was account termination for those caught spamming, then there were CAPTCHA tests to stop the spammers from creating very large numbers of accounts (which would otherwise make account termination a non-issue) from which to spam from... after that there was a crack down on open mail relays and ISPs started trying to block their subscribers from connecting to outside SMTP servers... now spammers use botnets designed for sending spam, effectively moving the burden of stopping spam out of the hands of centralized organizations like ISPs and into the hands of end users whose machines have been compromised and who are least likely to be able to deal with the problem or even be aware of it's existence... if you've never heard of this before, now you've got a brand new reason to prevent malware from compromising your computer - to help keep the spam problem in check...
avoiding spam
neither of these qualify as avoiding spam, however... in order to do that one must address spam at the earliest stage in it's life-cycle, one must stop the spammer from getting one's email address in the first place... think of your email address as being like your home phone number - it's confidential information that you don't hand out to every tom, dick, and harry you happen across...
keeping your real email address secret is probably not the most intuitive thing in the world, especially since so many things require you to give them an email address, but there are services and techniques that can help make it easier... there are also limits to how well the secret can be kept, but as an example i've managed to keep a webmail address i use daily completely spam free (there isn't even anything in the spam folder) for over 2 years simply by being careful and not giving out the address except to those i trust... one other caveat is that you can't make an email address secret if it wasn't a secret before... if your current address is receiving spam then the spammers already have your email address, the address has been compromised and there's nothing you can really do about that - you can't put the genie back in the bottle...
what you can do, with a fresh email address, is use disposable email addresses that forward to that real email address... a number of people are already familiar with the idea of a throw-away email address and often use hotmail or some other free webmail provider to make one but unfortunately that leaves you with no way to know who leaked your address to the spammers so when you need to change addresses (because the current throw-away address has gotten too spammy) you'll have no way to know which organizations to not give the new address to (never mind the fact that you'll have to give a new address to a bunch of organizations)... this is where true disposable email addresses come in - you need to use a different address for each site you give an address to (whether it's ebay, amazon, or your bank) so you can identify which one leaked the email address simply by looking at which email address got leaked and so that you only have to turn off that one address when it starts getting spammed rather than changing addresses and updating a potentially long list of sites with your new address... dedicated disposable email address services make creating multiple addresses easier (certainly easier than creating multiple throw-away email addresses where you have to answer a CAPTCHA test for each one) and managing multiple addresses (ie. turning off the ones that get spammy) easier as well...
different services provide addresses with different properties; some will forward the email sent to the disposable address on to your real address while others might maximize the ease and convenience of creating a new address by allowing you to create one without contacting the disposable email address provider first... beware the combination of these two properties (something spamgourmet.com does), however, because you invariably wind up giving out the information necessary for others to create new addresses that will forward to your real address and you don't want any tom, dick, or harry to be able to do that anymore than you want them to be able to email you directly... instead, use the created-on-the-fly addresses in cases where no sensitive information is going to be sent and/or in cases where you're likely only going to need to check for mail once (because most on-the-fly disposable email address services also don't require a login to check the email - mailinator.com and dodgeit.com work this way), and use forwarding addresses (such as those from sneakemail.com or mailnull.com) for everything else so that you get the benefit of picking up the mail in one place that only you (and your real email provider) have access to...
website feedback
now that takes care of sites that ask you for your email address, what about if you have a website or even a blog like this one? you want to be able to receive feedback from people without being deluged by spam but if you put an email address on the page then software that searches for email addresses on the web will find that address pretty quickly and it will soon be filled with spam... using disposable email addresses on their own doesn't solve this problem...
one thing people like to try is email address obfuscation - where the email address is manipulated in such a way that software that searches for email addresses can't easily recognize it as one... unfortunately this runs into competing requirements - in order to truly prevent software from collecting your email address for the spammer the email address has to not be machine readable, however people expect to be able to click on something and start typing their feedback and that functionality requires that the email address is machine readable... no email address obfuscation method can achieve both requirements so you generally either have to break expected functionality or accept that the email address isn't truly hidden...
a better solution is to use a contact form, specifically one that doesn't contain your email address in it's code... mailnull.com happens to offer this facility, it's what i'm currently using for this site at the time of writing, you can see what it looks like by clicking here... the only major drawback to using a web-based contact form is that people can't send you attachments but considering how troublesome attachments can be from a security standpoint, not providing a way for first time contacts to send them to you doesn't seem like all that big a deal... if you do encounter a scenario where it is a problem, the first time contact could use a file storage solution like dropload.com with their own disposable email address in the To: field and then paste the resulting URL into the web contact form...
additionally, if you not only have your own website but your own domain, you may want to turn off the default/catch all email functionality (where email sent to any non-existent address on that domain is 'caught' and collected for review and possible redirection to relevant parties)... so long as you are providing people with a clear way to directly contact the right individuals within your domain there should be no reason for anyone to send email to non-existent addresses on your domain or firing emails blindly at arbitrary addresses on your domain...
friends and family
as i mentioned before, there are limits to the extent to which you can keep your email address secret and a potentially very big hole in the strategy involves your trusted contacts (be they friends, family, or business contacts)... these are people you can't reasonably be expected to keep your email address a secret from and so may wind up being a source of email address leakage... what can you do?
pretty much what you can do boils down to treating their email addresses with the same care you would treat your own and teaching them to do the same for you (maybe even pointing them here)... that means that you shouldn't give their addresses to websites no matter how cool those websites might happen to be or how interesting you think your friends/family/contacts will find the site (even those greeting card websites that are so popular around the holidays) - instead you should give those sites one of your own disposable email addresses and then forward the resulting email to the person you wanted to share the site with, thus giving them exactly the same information you would have given them if you'd exposed their email address to the website but without actually exposing their email address to the website...
additionally, don't share people's email addresses with other people they don't know... if you're emailing people that don't know each other, put your own email address in the To: field and put the other email addresses in the Bcc: field so that they can't see each other's addresses... if you're forwarding something to people, make sure not to include any of the email addresses that it was previously sent to or from as forwarded emails otherwise tend to build up large numbers of email addresses on a large number of strangers machines - any one of which might get compromised by a piece of malware that harvests email addresses for spammers and other email miscreants and that's something you want to minimize where possible...
anti-spam safe hex
all these things effectively form a set of spam-related safe hex rules... summarized, they are:
- treat your email address like a secret
- use a different disposable email address for each website you give an address to (so that if you do get spam you can tell who to blame)
- use contact forms instead of email addresses on your website
- turn off the catch-all email functionality for any domain you might have
- don't give your friend's/family's/contact's email address to websites
- don't give your friend's/family's/contact's email to people they don't know
- try to teach your friends/family/contacts to show your email address the same care that you show theirs
Thursday, November 09, 2006
how to avoid codec roulette
does this sound familiar? you've gotten this video off the internet and when you try to play it you get informed that playing the video requires a codec you don't have...
this is actually a pretty old problem and the obvious solution most people hit on is find the codec and install it - and of course then you have to hope that it actually works and that it doesn't cause conflicts with other codecs or general system instability...
more recently a more insidious trend has emerged - the codec, rather than simply not getting along with other codecs or being poorly coded, is not a codec at all but is actually malware... this is a pretty clever form of social engineering because when a person makes a judgment about the safety of the whole thing it is at this point when they decide whether to try to watch the video in the first place and the judgment most will make will be that the video file is probably safe because video files generally are... at that point they become committed to watching the video even though the demand for the codec changes the entire safety equation - they pay no heed to whether or not the codec is safe, they just want to be able to look at this video they have in their hot little hands... you could almost think of it like a bait-and-switch scam...
these sorts of fake codecs have been getting a fair bit of attention by the security related press and a lot of people have been trying to address the problem by coming up with lists of bad codecs and the sites distributing them... many of these same people criticize the classic anti-virus model of enumerating bad things as being a broken model so i'm not sure why they think their own ad-hoc enumerations of badness are any better... at any rate, lists such as this fail to address a significant part of the socially engineered problem - once a person decides to watch the video they are much less likely to think about the safety of the codec they're subsequently asked to install in order to get at that content they are trying to watch...
another much more to the point way of addressing the problem is to just tell people don't install codecs... this advice would certainly work, but people who have videos they can't watch have an incentive to not listen to that kind of advice... it's not like you can tell people that the video is probably a fake because there are so many legitimate codecs out there that aren't installed on computers by default that legitimate videos asking for legitimate codecs is actually still a very probable scenario...
as an aside i'd like to admit something to you - i am a consumer of video content, i have been for quite a long time and i played codec roulette back in the day before codecs became a major malware attack vector... codec roulette pissed me off because it was so much work sometimes to find just the right codec... there was even a point where i tried re-encoding the videos so that i'd wind up with files that were all the same format, but even that required the codecs...
it turns out that a solution to the hassle of the old-school codec roulette works pretty good for the new malware enhanced version of codec roulette as well... the reason is because the solution to the hassle of codec roulette is to find a player that will play just about anything without ever having to find and install codecs... armed with such a player, supposed video that needs a codec you don't have becomes a much more suspicious scenario and so one that people are less likely to fall for...
for me, that media player was the vlc media player (which i supplemented with real alternative for realmedia files)... there may be others (in fact there probably are) that handle even more formats but i don't recall the last time i encountered a video i couldn't play right out of the box or even if i've encountered any such files since moving to this solution (even video downloaded from youtube, or mkv files which i'd never even heard of until i had one and found that yes vlc handles them too)... i have no idea how well vlc handles DRM contaminated video files but i don't need or want digital rights malware on my computer anyways...
so consider this a bit of safe-hex for video consumption... get a player that can play just about everything and then when a video you can't play comes along consider it suspicious by default and don't bother with it because it's probably not going to be good for your computer...
this is actually a pretty old problem and the obvious solution most people hit on is find the codec and install it - and of course then you have to hope that it actually works and that it doesn't cause conflicts with other codecs or general system instability...
more recently a more insidious trend has emerged - the codec, rather than simply not getting along with other codecs or being poorly coded, is not a codec at all but is actually malware... this is a pretty clever form of social engineering because when a person makes a judgment about the safety of the whole thing it is at this point when they decide whether to try to watch the video in the first place and the judgment most will make will be that the video file is probably safe because video files generally are... at that point they become committed to watching the video even though the demand for the codec changes the entire safety equation - they pay no heed to whether or not the codec is safe, they just want to be able to look at this video they have in their hot little hands... you could almost think of it like a bait-and-switch scam...
these sorts of fake codecs have been getting a fair bit of attention by the security related press and a lot of people have been trying to address the problem by coming up with lists of bad codecs and the sites distributing them... many of these same people criticize the classic anti-virus model of enumerating bad things as being a broken model so i'm not sure why they think their own ad-hoc enumerations of badness are any better... at any rate, lists such as this fail to address a significant part of the socially engineered problem - once a person decides to watch the video they are much less likely to think about the safety of the codec they're subsequently asked to install in order to get at that content they are trying to watch...
another much more to the point way of addressing the problem is to just tell people don't install codecs... this advice would certainly work, but people who have videos they can't watch have an incentive to not listen to that kind of advice... it's not like you can tell people that the video is probably a fake because there are so many legitimate codecs out there that aren't installed on computers by default that legitimate videos asking for legitimate codecs is actually still a very probable scenario...
as an aside i'd like to admit something to you - i am a consumer of video content, i have been for quite a long time and i played codec roulette back in the day before codecs became a major malware attack vector... codec roulette pissed me off because it was so much work sometimes to find just the right codec... there was even a point where i tried re-encoding the videos so that i'd wind up with files that were all the same format, but even that required the codecs...
it turns out that a solution to the hassle of the old-school codec roulette works pretty good for the new malware enhanced version of codec roulette as well... the reason is because the solution to the hassle of codec roulette is to find a player that will play just about anything without ever having to find and install codecs... armed with such a player, supposed video that needs a codec you don't have becomes a much more suspicious scenario and so one that people are less likely to fall for...
for me, that media player was the vlc media player (which i supplemented with real alternative for realmedia files)... there may be others (in fact there probably are) that handle even more formats but i don't recall the last time i encountered a video i couldn't play right out of the box or even if i've encountered any such files since moving to this solution (even video downloaded from youtube, or mkv files which i'd never even heard of until i had one and found that yes vlc handles them too)... i have no idea how well vlc handles DRM contaminated video files but i don't need or want digital rights malware on my computer anyways...
so consider this a bit of safe-hex for video consumption... get a player that can play just about everything and then when a video you can't play comes along consider it suspicious by default and don't bother with it because it's probably not going to be good for your computer...
Sunday, April 16, 2006
all virus prevention methods fail
i blogged some time ago about how all anti-virus products fail, noting that no anti-virus product can ever have perfect detection and that even if one did part of the reason for the failure is often that the user has been careless and not kept the product up to date or used the product incorrectly or simply exposed themselves to too much risk...
the implication was that through judicious computing practices (often referred to as safe hex) one could drastically reduce the risk of computer virus infection... while this is true, there is a dangerous oversimplification that can be made - safe hex does not (can not) reduce the risk to zero... it's something i tried to touch on before but i'll be more straightforward about it now...
no virus prevention method is 100% effective... no combination of virus prevention methods is 100% effective... they all fail... you can follow safe hex to the letter, you can do all the right things and still get a computer virus... the only sure way to avoid a computer virus is to not have a computer, or if you get one don't turn it on...
this may sound like doom and gloom but it's a reality of security in general - preventing bad things from happening is an ideal we strive for but we can't achieve it all the time, that's just not a realistic expectation... even if we were perfect (which we aren't) and followed the best prevention strategies out there (which we often don't) some of us would still get hit...
what that means is that prevention is only part of how one must address the problem... the other part is planning for your preventative measures to fail - figuring out how to detect when a failure has happened (ideally using some kind of known-clean environment) and how to recover from that failure (everything from removing the offending item to restoring from backups)... any anti-virus (or anti-malware for that matter) strategy is incomplete if it doesn't include these elements...
safe hex, for all it's benefits, does not deal with these things... safe hex is a set of best practices for prevention... detection of preventative failures is a much trickier proposition and recovery is as big (if not bigger) a topic on it's own as safe hex... the oversimplification of 'just follow safe hex and you'll be fine' or 'you got hit so you need to learn safe hex' is dangerous because it gives the impression that there's no need to plan for failure and so people don't... people are lazy, they won't plan for failure if they don't think they need to and the oversimplification makes people believe they don't need to... in this way, sometimes safe hex advice can create a false sense of security and thus can be a kind of snake oil...
safe hex is still a good thing, though... it's just not the whole answer... prevention, detection of preventative failures, and recovery from failure - you need to keep all three in mind when developing your anti-virus strategy...
the implication was that through judicious computing practices (often referred to as safe hex) one could drastically reduce the risk of computer virus infection... while this is true, there is a dangerous oversimplification that can be made - safe hex does not (can not) reduce the risk to zero... it's something i tried to touch on before but i'll be more straightforward about it now...
no virus prevention method is 100% effective... no combination of virus prevention methods is 100% effective... they all fail... you can follow safe hex to the letter, you can do all the right things and still get a computer virus... the only sure way to avoid a computer virus is to not have a computer, or if you get one don't turn it on...
this may sound like doom and gloom but it's a reality of security in general - preventing bad things from happening is an ideal we strive for but we can't achieve it all the time, that's just not a realistic expectation... even if we were perfect (which we aren't) and followed the best prevention strategies out there (which we often don't) some of us would still get hit...
what that means is that prevention is only part of how one must address the problem... the other part is planning for your preventative measures to fail - figuring out how to detect when a failure has happened (ideally using some kind of known-clean environment) and how to recover from that failure (everything from removing the offending item to restoring from backups)... any anti-virus (or anti-malware for that matter) strategy is incomplete if it doesn't include these elements...
safe hex, for all it's benefits, does not deal with these things... safe hex is a set of best practices for prevention... detection of preventative failures is a much trickier proposition and recovery is as big (if not bigger) a topic on it's own as safe hex... the oversimplification of 'just follow safe hex and you'll be fine' or 'you got hit so you need to learn safe hex' is dangerous because it gives the impression that there's no need to plan for failure and so people don't... people are lazy, they won't plan for failure if they don't think they need to and the oversimplification makes people believe they don't need to... in this way, sometimes safe hex advice can create a false sense of security and thus can be a kind of snake oil...
safe hex is still a good thing, though... it's just not the whole answer... prevention, detection of preventative failures, and recovery from failure - you need to keep all three in mind when developing your anti-virus strategy...
Subscribe to:
Posts (Atom)