HW 11(12)

To keep myself abreast of the latest developments, I rely on a variety of different vital Web sites featuring content from some of the most prolific information security experts on the Internet today. In this section, we'll discuss these sites, which I strongly recommend that you peruse on a frequent basis. I'm not throwing just any site on this list. These are the particular sites that I try to read on an ongoing basis. I cruise by many of these sites each and every day, just to get a feel for what's new in our industry. On the rare occasions when I go for three or four days without checking these sites, I feel a certain withdrawal, almost an alienation from our community. Perhaps I'm a security junkie, but it's been an addiction that has helped me in understanding the latest attacks and, more important, protecting my systems from the bad guys' latest moves.

For each site, I've listed the most current URL as of the time of this writing. However, in this book, you and I face a limitation of current paper technology. Once this book is printed and in your hand, I can't update the text, of course. In the future, we might be able to zap a wireless message to your book and magically change the text, but we're not there yet. Unlike the paper you are holding now, the Web itself is a relentlessly dynamic medium. Unfortunately, the owners of these Web sites do sometimes change their URLs or deploy other Web sites. Although I've chosen each site based on its usefulness and long-standing reputation for solid security information, some of these URLs will undoubtedly grow stale with time. Therefore, to help extend the usefulness of this section, I've included a list of key words for you to use in your favorite search engine to find these sites in the future. Given the high value of each of these sites, many mirrors exist and will continue to host their content, even if these URLs are altered or stop working. With the appropriate keywords, you'll still be able to find these sites and use their wisdom in understanding malware.

Packet Storm Security

Packet Storm is operated by a group of independent security researchers and interested hobbyists who maintain a vast archive of software and security advisories. From a malware perspective, this Web site includes specific directories loaded with various backdoors and RootKits. In particular, if you find UNIX RootKits to be interesting, you should definitely look at the packetstormsecurity.nl/UNIX/penetration/rootkits/ directory, which includes more than 50 different varieties of user-mode and kernel-mode RootKits.

Security Focus

and other areas of computer security.

Global Information Assurance Certification

Counterhack

Now that we've seen some resources you can use to help keep up with the malware threat, let's turn our attention to a big-picture view of malware. After I wrote each chapter of this book, I calmly pondered the overall implications of each type of malware, peacefully jotting down a few notes about the techniques we've discussed. Augmenting this tranquil approach to pondering malware, I also contemplate the evolving nature of the malware threat when I'm under fire, responding to computer attacks in real time. As I wrote this book, when one of my clients', friends', or my own machine got hacked, I would often frantically jot down acerbic notes in the heat of the moment about the nature of malware.

To compose these parting thoughts, I reviewed both my peaceful and frenzied notes to try and get a big-picture view of malware. As you might expect, I come away with two very different mindsets, and perhaps, as you've read this book, you do as well. One of these mindsets is the pessimists' view, whereas the other is much more optimistic. Let's start out with the pessimists' take on the future state of malware.

Parting Thoughts : Pessimist's Version

The problem's plain to see:

Too much technology.

Machines to save our lives.

Machines dehumanize!

The​ song "Mr. Roboto" from the album "Kilroy Was Here," by Styx, 1983

Perhaps you read some sections of this book with a certain sense of foreboding. You may have thought, "I can't keep up with malicious, polymorphic, worm-propagating, anti-forensic, kernel-mode, sniffing backdoors loaded into my BIOS! I give up. I'm going to move to the mountains and raise cows. I've never been hacked by a cow." If that's what you thought, I know exactly what you mean. As we've seen in chapter after chapter, bad guys are invading our systems, shoving malware into every possible nook and cranny that can hold executable code. Malware sneaks in via the Web, e-mail, application programs, operating systems, kernels, and someday maybe even into the BIOS and CPU microcode itself. When you really think about it,

malware is specifically designed to abuse the very flexibility and power that we use computers for in the first place.

We've unwittingly entered into a sad trade-offin​ exchange for powerful applications and underlying machines that can be quickly and easily altered with executable content, we've introduced the possibility of malware at all levels of our systems. In the computer revolution, we focused on extremely flexible general-purpose computers for their utility and economic value. Decades ago, only a scant few visionaries realized that malware-wielding attackers could use this very flexibility to undermine our systems from the inside. Due to all-too-common mistakes in implementation, the very flexibility of our machines has rendered them quite feeble.

Maybe this whole trade-off was a mistake. Perhaps we should have far more limited systems devoted to specific applications that resist executable content of all kinds. We could build systems with very specifically defined functions that attackers will have much greater difficulty exploiting. It might be amazing that we have a single box on our desks or in our travel bags that we use as a game console, library, jukebox, writer's tool, medical advisor, trusted financial planner, and storage device for our innermost personal secrets and desires. Amazement aside, however, perhaps these functions should be split into different systems, each with a lot less flexibility.

Yet we're heading in exactly the opposite direction. Instead of separating functions and limiting the flexibility of the machines we use, we're using the same underlying flexible technology that is so easily targeted by malware in a host of other electronic gizmos. As the computer revolution marches on, we're deploying stereos that can play MP3 audio files, or personal video recorders running a variation of Linux. We see cars with on-board computers for engine control and navigation, some of which use Windows. As an experiment, try walking through a hospital and counting the number of Windows and UNIX-based machines you can spot for running health-care services, helping doctors match patients to cures and even dispensing medicines. Furthermore, our militaries are increasingly relying on the same types of underlying machines for combat operations. Imagine the damage a worm could cause if it infected such hospital and military systems, to say nothing of your entertainment systems. Even though each of these systems is focused on a set of specific tasks, they all still use the same underlying technology from our desktops and servers: UNIX and Windows, along with TCP/IP networking and familiar lines of CPUs. Instead of limiting the options for malware, we've inadvertently invited it deeper into our lives.

Compounding the problem, many (or perhaps even most) organizations are plagued with inadequately trained system administrators who aren't sure how

to defend their machines properly or even check their systems for signs of attack. Often, information security budgets are thin, and busy system administrators have enough trouble keeping their machines functioning, let alone secure. Training and then trusting them to use the techniques we've discussed throughout this book will take valuable time and boosts in funding that we just don't have. A mediocre system administrator hardly stands a chance against a really good attacker. Heck, even a mediocre attacker who simply reuses malware written by others can cause immense damage.

The situation gets even worse when we consider end users. Even with a brilliant system administrator, a clueless user could easily infect a system with malware. By accidentally executing the wrong program, a user could unleash malware that grabs superuser privileges on a machine and inserts itself at a very fundamental level. A mistake on a critical server could jeopardize not only the single clueless user, but all other users who rely on that box. Taking all of these concerns together, in a lot of organizations, the deck just seems stacked against us. Maybe raising cows isn't such a bad idea after all.

Parting Thoughts: Optimist's Version

Unless someone like you

Cares a whole awful lot,

Nothing is going to get better.

It's not.

The​ Lorax, by Dr. Seuss, 1971

But don't despair! Cows have their problems, too. Although they cannot (yet!) be infected with computer malware, they do suffer from a variety of other ailments. In my opinion, raising cows isn't nearly as much fun as working with computers. I periodically stray into the pessimists' camp, but I am at my core an optimist when it comes to computer security and fighting malware. Sure, the bad guys are improving their malware at an alarming pace and taking aim at all kinds of computing systems, but we can (and must) work to stop them. I know it's a lot of work to keep up. I spend seemingly endless hours securing systems and responding to attacks. Maybe you do as well.

However, defending our machines against the vast majority of attacks is indeed feasible. We can't turn our back on the inherent flexibility of our systems, as massive components of our infrastructure and even portions of our economy depend on these features of already deployed systems. At the risk of mixing in

another barnyard metaphor, that horse has already left the barn. Instead, we need to carefully design and build our systems to be flexible and secure at the same time. If you think about all of the defenses we've discussed throughout this book, they come down to doing a thorough and professional job of administering and securing our systems.

Whenever I start to get discouraged, I think about it this way: We currently live in the golden age of information security. I strongly believe that, 20, 30, or 40 years from now, we will look back on these very days as the most exciting time of our professional lives. When we're old, toothless, and gray, sitting in our rocking chairs pondering the past, we'll think, "Wow what a ride!" It's true that the middle-2000s certainly are a lot of hard work for information security professionals. However, in exchange for our hard work, we get the excitement of learning new and fun technology, fighting bad guys, and protecting some of our society's most valued information. Perhaps we were even put here for a time such as this. With a concerted effort at deploying the defenses we've discussed throughout this book, we can make the world a better, more secure place.

Also, skilled security personnel will remain in high demand for the immediate future. Our society needs people like you and me to help protect the feeble infrastructure of our computer systems. You want security? How about job security! So, savor these thrilling times. In the future, it's quite possible that information security won't be nearly as exciting as it is right now.

In fact, I believe that we are, today, at a tipping point in the information security business. We'll likely look back and realize that this is the time that things started to radically improve from an information security perspective. Vendors have always paid lip service to security, but recently, they've started to integrate it much more carefully into their systems. Increasingly, security is not just marketing schtick. Vendors are starting to actually do what we've wanted for so long! Yes, the ball is just beginning to roll, and I'm very happy at some of the recent news.

Several computer manufacturers have announced that they will start shipping new systems with many high-risk features disabled. In the olden days (of just a year or two ago), a new, out-of-the-box workstation or server had all features turned on from scratch by the vendor without regard for security concerns. Vendors did this because such default-on features suppressed costly help desk calls from users asking about how to turn things on. However, these features also significantly compromised our security. Now, the marketplace is getting the message that security is more important than minimizing help desk calls, and vendors are reacting by shipping their systems with far more secure default settings than was common just a few years back.

In the end, over the next five or so years, I believe that we will start to see significant fruit from these endeavors, with machines that are less vulnerability-prone than in the past. It won't happen overnight, of course, but the momentum, driven by market demands, is moving in the right direction. Using the defenses we've discussed in this book, buttressed by these fundamental underlying changes in the computer security industry, I believe we'll increasingly be able to thwart the malware menace.