No matter how much layer of security you implement on a computer there always will be one area that is protected by a simple old access control, the memory.

You can have a complex password policy, dual factor authentication, full disk encryption, file encryption which could even be extended through the use of an Information Right Management solution, for that protected information to be accessed and manipulated it needs to be decrypted into memory.

The security of that data in memory then relies on memory access control and proper segregation, I am not sure we can talk about memory sandboxing but thats the same idea. The data will, of course, also rely on the physical security of the device it is hosted on.

Gaining administrator access on that device would therefore grant you access to the full memory.

This last point is of significance.

For IRM solutions, being an administrator on a device does not necessarily mean you also have access to the users IR...
>>[READ MORE]

Although it has been announced for quite some time that malware is growing on the mobile market, it is still not very visible.

That does not mean it isn’t already here or will be.

Below is an interesting article on a mobile developer who was contacted by a company that wanted to pay him some money as long as he included some of their “codes” into his popular game.
It was in fact, malware. It could directly call premium number without the user intervention or even eavesdrop on the microphone.
It has a happy ending as the developer decided against using that code and instead warn others. But for one good deed, how many have fallen or will fall for the money?

Websense Article on the White Hat Developer

Now the question is: Would this be possible on the iPhone with the Apps Store?

...
>>[READ MORE]

Below is a very good article describing the recent battle between the Anonymous Hacking group and the HBGary company.

In a nutshell, a security company, “HBGary”, who is also working for the US government was about to release what they think were the identity of a hacking group called “Anonymous” who conducted some high profile hacks against large organisations who were against the wikileaks website. The hacking group response was swift and brutal, they hacked the HBGary websites, defaced them, hacked into the owner’s email account and grabbed lot of user personal information from one of the company’s related website, rootkit.com

It provides a good example of the old adage “do what I say not what I do” but this time in the world of IT Security. Of course you can almost never get IT Security 100% right, but in that case it would seem some of the security weaknesses that were exploited should have never been...
>>[READ MORE]

I have recently attended a SANS Forensic course in London. It was the best training course I have ever been to, not only the content was really interesting and very well delivered but all the extra activities surrounding the training course were outstanding (presentations, challenges, social events, etc).

Forensic was new to me and I found the techniques taught as very good eye openers in two different ways:

–Forensic techniques can be applied to other area of IT security than just forensic investigations, such as malware analysis and DLP. The latter was a bit of a surprise to me, but by understanding some of the forensic techniques you can also understand how part of a DLP engine would work when searching for specific files on filesystems (at rest) and recognised/tagged when on the network (on the move). I will find it interesting to see if my new know...
>>[READ MORE]

Another attack on the iOS security has been published today and there are two recurring themes to the attacks I described in previous posts, namely: weaknesses with the Keychain and iOS encryption implementation.

But this time they have been used differently and seem to provide an attacker access to any passwords stored on an iOS device, even if it is passcode protected.
One main difference in this attack, is that the attacker would only requires the iOS devices and nothing else (as opposed to the relevant synced PC with previous attacks).

It also seems to prove Zdiarski’s concerns over the iOS encryption controls to be true.
The attack used some jailbreaking techniques to access the iOS device boot/ram, bypassing the passcode and using the OS to run a script to access the local keychain and all the passwords it may contain (email, VPN, web apps, etc)
It seems that the encrypted data is not linked to the user passcode, which means that if someone ca...
>>[READ MORE]

When reviewing security products you often find they have some sort of Standard Security Certifications which should garantee a certain level of security.
Some certifications ensure adequate security controls are in place for audits, operational models, physical security, cryptography modules, etc.

The benefit of those certifications is that it should save you times and money to ensure some security requirements are met, they can also be used in contrat binding security controls, i.e.: you must comply with ISO XXXX.

There is however a drawback, an increasing number of vendors now hide behind those certifications and thus provide very little details about their security controls.
Likewise, many companies do not look further than a certification name on a paper to pass its security requirement reviews.

This is where the problem lies, how many Security professionals actually know what having such certifications actually means? to what part of the vendorR...
>>[READ MORE]

I remember a time where access to the internet from the work place was only available from a couple of “Internet Stations” and where the Internal company network was just that, Internal with no external links! At that time, to get around those controls, one could set up dial up/ADSL lines under his desk and it was deemed as a risk to the Internal Network integrity from within the company’s premises. This was not widespread and required a specific intent to bypass the company’s network policy.

Then came Wi-Fi and hotspots started to flourish everywhere, often basic security was forgotten, such as not bridging it to the Internal Network or not enforcing adequate access controls. It was, and still is, deemed as a risk to the company’s network integrity. Although this is a more widespread practise there are controls in place and detection mechanisms to remediate the related security risks.

Both are examples of uncontrolled access to company res...
>>[READ MORE]

Regarding my previous post I wanted to mitigate some of the risks I was describing.
In a nutshell, it is bad, but not that bad! :)

Escrow keybag
There is indeed a forensic issue with the escrow keybag feature, but because it requires the attacker to have both the targeted mobile device and the computer used to sync it with, That attacker would first need to break the computer’s security to access its filesystem.

Because that computer is used to sync the mobile device, most of the information it contains is likely to be on the computer as well.
For example, email accounts are likely to have been setup both on the computer and the mobile device, office files are likely to have been created on the computer, etc.

Therefore gaining access to the computer’s filesystem is likely to already give you access to most of the mobile device’s data.
Having said that, there is no garantee it will always be the case and some i...
>>[READ MORE]