Voice of the DBA

Tag: security

  • Ransomware vs. AI

    Ransomware has been a growing and shrinking problem in the modern world. Every time I think that some new defenses and protections are preventing ransomware from being a problem, I see another issue. Recently, I saw Subway got hit with with an attack and a few friends have recently noted their companies were restoring systems after a portion of their network was locked down.

    With the advent of Rasnsomware-as-a-service, where criminals deploy software and then sell access to others, better detection and protection become more important. As with any software, criminal human operators will use the ransomware software in different ways. That means that we don’t necessarily have a simple threat that can be easily programmed against with anti-virus technology.

    Microsoft has been using AI technology to help them track and combat ransomware campaigns. Since there are similarities between how ransomware is used by different individuals and how it appears in systems, AI technology can be helpful here. There aren’t the same simple signatures on files that we’ve seen in the past with viruses, but rather more complex patterns. Humans might discover how ransomware appears in their environment with lots of knowledge on what their network ought to look like, but this pattern matching across many different networks and organizations is something that AI/ML might do quicker and at scale. Once successful, ransomware can be hard to recover from, so early detection is important.

    In the article, it seems that Microsoft is capturing lots of traffic and analyzing it for patterns, with multiple types of anomalous activity, and then aggregating this across devices to guess whether this is an attack or not. In some of their testing, they find the ability to stop an attack with only a few percent of assets getting encrypted. That’s not perfect, but better than finding 90% of your nodes are encrypted over morning coffee.

    I suspect this is just the latest escalation in cyber attacks and defenses. I’m sure that hackers will come up with new and novel ways to cause problems, but I do think that this is a place where AI, especially ML, technology can be useful to provide better security. I also think that database technology, especially graph queries, is particularly helpful here. I hope we learn more about how they are building protections as I think this is likely a great data analysis story.

    Once again, the database is critical to making software better because all of that data has to be stored and queried somewhere.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

  • Building CyberSecurity Skills with an Advent Challenge

    I’ve been working on the Advent of Cyber challenge this December. It’s more of a walkthrough of some puzzles than it is solving them yourself, but it has given me a brush up on some skills and helped me learn some basics of how people in charge of (or looking to break) security look at the world. Plus it’s been a little fun with a silly storyline each day.

    The first challenge starts with a chatbot and trying to social engineer answers out of it. This was interesting to me, even though it was likely (hopefully) not a representative example of how AIs would work in most systems. However, it got me to think more about how I pose questions to an AI and how I can grow my prompts. The neat thing about AI is that you don’t have to ask the perfect question and then re-ask the same question with more info to get an answer. The AI keeps context in a conversation, which is way more powerful than previous Q&A search systems.

    The second day was Python and Jupyter Notebook basics, which were a nice refresher for me on a couple of concepts, but not that interesting. However, the third day introduced some password-cracking tools, the fourth day added other ones, and a few subsequent days showed some software that is devious in how it can be used to penetrate security. Other challenges have me the chance to brush up on Linux and network skills I hadn’t used in a long time.

    The SQL Injection module (day 10) is well done, and I might recommend most developers go through that to see why their easy, convenient build-a-sql-string-to-execute code is an incredibly bad idea. It’s also why they can’t also use stored procedures as built-up batch commands. Use the stored procedure objects to execute with named parameters.

    The idea of using a little plot and story, with a simple challenge to teach some skills is a good one. I’ve been lucky in my career to be exposed to a lot of different technologies and ways of working with systems. I’ve set up bridges, routers, and firewalls. I’ve had to get network links and cables to work and talk with different protocols, including configuring T1 connections. I’ve built machines, dealt with different types of local and remote storage, and had to program and administer systems at all levels of the OSI model. Does anyone remember that?

    This was a fun break from work, doing a module or two every other day, remembering there are a lot of complexities to our systems outside the database, or outside the application software. It’s also reminded me of all the different ways that security can be breached.

    Take the challenge and learn some new skills. I think many of you will learn something and you might enjoy yourself along the journey.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

  • Breaking Biometrics

    In the movies, when someone needs to bypass some sort of fingerprint biometric system, they use tape to lift a fingerprint, or in the more gory films, cut off a body part. In any case, there have been a lot of attempts to replicate this in the real world. Sometimes these work, though the consensus is modern hardware isn’t as susceptible as older hardware. I don’t know if that’s true, but I did see an interesting look at the main three sensors used in most laptops.

    All the laptops had their authentication bypassed, though not with any fake biometric device, but rather with attacking the actual communications between the sensor and the OS. There’s a great report from two people who were asked by Microsoft to evaluate the security of the top three sensors. It’s a fascinating look at how the hardware and software of the OS are set up to provide secure authentication and how both can be fooled.

    Some of the problems are users not enabling features and some are that manufacturers aren’t understanding or implementing the secure protocols from Microsoft. I both get how this happens and I feel it’s not acceptable. Certainly someone might read a spec and not completely understand it, even across a team of people. However, for vendors, this can’t be something they don’t have researchers, pen testers, or some security professional examine. Hardware vendors spending money designing these devices ought to include the money for a few people to try and break the security before they are sold.

    At least for security features.

    I like the enhancements made with multi-factor authentication, and I appreciate biometrics as a convenient way to access things. At the same time, I want to be able to trust them. The efforts made by the researchers are pretty high, not something that someone in a coffee shop can do in 5 minutes while you go to the bathroom. At least, apart from the Surface. It appears that one can be quick.

    At the same time, if you lose your laptop, within hours someone can break past the biometrics with a man-in-the-middle attack. Even if you’ve encrypted the disk, your data can be accessed since this attack gets the OS to authenticate them.

    Security is tricky, but I don’t plan on disabling my fingerprint scanner. However, if I were carrying around data that was more important than the work I do now or data worth a lot of money, I don’t know I’d ever enable biometrics.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

  • TryHackMe Advent of Cyber

    I posted that I was thinking about the AdventOfCode this year, but wasn’t sure I’d spend the time. Someone then posted a link to the TryHackMe advent calendar.

    I decided to give it a try.

    There’s a fairly long (10min) video intro and then you sign up.

    Day 1

    One of the good things was that the video has some spoilers to help you solve the challenge. If you skipped the video, watch it now. Or try.

    There are three questions we need answered, and we then have to fool the AI/ML chatbot. The video shows how, but essentially you need an email address, a server room password and a project name.

    The interesting thing is this shows how a poorly secured and trained chatbot might disclose this information. For the email address, you just ask. For the password, you need to find an employee’s name and then tell the chatbot you’re that person and need the password. It seems silly, but I bet this works on some chatbots people have created with wizards or templates and not secured or limited the training data.

    The last one is interesting, you ask the machine to go into maintenance mode and you get the name of a project. Getting into the maintenance side of applications or mainframes used to be a way to attack them. Unfortunately, too many people didn’t secure many early systems and this was too easy.

    Day 2

    Day 2 is about using Jupyter notebooks. A good portion of the tutorial is helping you understand how notebooks work. Hopefully you’ve read my article on notebooks. If not, this helps you figure out how to use them. It also has a short tutorial on some python that you use to perform data analysis on a csv. While many of us might like to do this in SQL, the experience in python isn’t bad.

    This ends up helping you understand how to count, summarize, and group data in python.

    Day 3

    This day was interesting. Now we are learning about some security tools. In this case, we learn about hydra, which is a tool to brute force logins against a web page. This is a fantastic tutorial that should teach you that unlimited retries on a page without some timer is a bad idea. This should also help you understand that you need to track failed logins and do something about them, especially from weird IPs.

    Day 4

    Continuing on, we learn how to use cewl to create customized wordlists and then use those to brute force in a smarter way.

    Again, scary for a non-security person. These tools are likely good for security folks, but terrifying in that perhaps criminals use them every day.

    Summary

    The first few days of the challenge were interesting and it was neat to spend some time thinking about the world from a cybersecurity point of view.