You’ve heard the stories about people choosing terribly obvious passwords for their various computer accounts, such as “password” and “12345”, but what are the other ones? In his book, Perfect Passwords: Selection, Protection, Authentication, Mark Burnett compiled the most common easy-to-crack passwords, most of which are ordinary words or key sequences that are easy to type on a QWERTY keyboard. I’m amused by some of the pop culture-based passwords, such as “Rush2112”, “8675309” and the X-Files inspired “TrustNo1”.
Someone else — I don’t who who did it — decided to turn that list into the hand-lettered poster shown above. You can click it to see it at a larger size.
In addition to being a good list showing the sort of password you shouldn’t use, it’s also a great name generator. You could take two random items from the list to create new character names for a Metal Gear game (“Tomcat Eagle1” makes just about as much sense as “Solid Snake” or “Sniper Wolf”) or any three to come up with the name of your band or prison softball team (“Bigdick Magnum Juice”).
“Flintstones/Jetsons” is a term that Mark Mothersbaugh from Devo uses to describe technology solutions that are a combination of low- and high-tech. It’s probably an apt term for what the driver of the Renault in the photo above is doing to foil licence plate cameras. If the “Jetsons” part – the SQL injection attack comprising the text on the banner on the bumper – doesn’t work, the “Flintstones” approach of physically covering up the licence plate will.
SQL Injection-a-Rama
No quick tour of SQL injection is complete without mentioning this classic XKCD comic, Exploits of a Mom. If you’ve ever heard someone use the phrase “Little Bobby Tables” when talking about databases and security, here’s where it comes from:
Want a good introduction to SQL injection attacks? Start with SQL Injection Attacks by Example at Steve Friedl’s Unixwiz.net Tech Tips. It walks you through the steps of an SQL injection attack, where a cracker (note that I said “cracker” – there are hackers and crackers, and there’s a difference) uses a combination of deductive reasoning and unexpected, unsanitized input to get unintended results from the database.
I met Peter “Mudge” Zatko at the Cult of the Dead Cow’s hotel bungalow at DefCon 8, the 2000 edition of the notorious hacker conference. My coworker at OpenCola, Oxblood Ruffin, was a member of the the “cDc” and introduced me and the other OpenColans to him and the other nicknames in the group: “Sir Dystic”, “Dildog”, “Deth Veggie”, “Night Stalker”, “Grandmaster Ratte” and many other black-clad, charmingly oddball characters far more interesting than the characters in the movie Hackers. I think I learned more about security in the hour-long group conversation with him than I’ve learned from countless corporate security training videos and training courses. Later at the conference, the cDc would hand out more copies of Back Orifice 2000, a tool that would cause much heartburn to many people at the company where I now work.
Mudge was responsible for the early research into buffer overflow attacks and published one of the first papers on the topic. In 1998, he and others from L0pht Heavy Industries (a.k.a. “The L0pht”, a hacker think tank) testified before a Senate committee, saying that they could take the internet down in 30 minutes. L0pht was acquired by the security company @stake in 1999, and in 2000, the company where I worked, OpenCola, hired them to do some security consulting. He’s met with President Clinton to talk about DOS attacks and worked at BBN as a division scientist.
I’m curious to see what Mudge can do with government gear and a big budget. In the cnet article, he talks about actively responding to threats. "I don’t want people to be putting out virus signatures after a virus has come out," he says. "I want an active defense. I want to be at the sharp pointy end of the stick."
The 2009 edition of the RSA Conference, the biggest and best-known cryptography and information security conference, took place last month in San Francisco. Each year, the conference has a theme based on or relevant to crypto or infosec, and this year’s theme was Edgar Allen Poe (previous themes include the Navajo Code Talkers of World War II, the secrets of the Mayans, Mary Queen of Scots and Alan Turing).
The people behind the conference were kind enough to post video of the keynotes, which I found thanks to a pointer from TechNet’s Jeff Jones, author of the Jeff Jones Security Blog. You can click on the links below to watch the videos. Jeff strongly recommends that you do not miss the opening ceremony segment of the “Day 1 Keynotes” video, and I don’t have to tell you that you should catch the closing keynote, featuring Adam Savage and Jamie Hyneman of the popular nerd television series Mythbusters:
I caught the afternoon sessions of MeshU, the day of workshops that precedes the Mesh Conference. MeshU had three tracks – Design, Development and Management – and I chose to attend the sessions in the Development track.
Leigh Honeywell on Writing Secure Software
First up was HackLabTO cofounder Leigh Honeywell, (pictured on the right) whose presentation was titled Break It to Make It: Writing (More) Secure Software. She works at the MessageLabs subsidiary of Symantec, which makes security products for email systems, and before that, she worked as an independent security consultant. Simply put, security is both her job and her hobby.
Leigh provided an informative and entertaining summary of the most common security vulnerabilities in applications and the recommended best practices for writing secure apps. Here’s a photo of her slide showing OWASP’s ten principles that you should follow in order to write secure applications:
The ten principles are:
Minimize attack surface area
Establish secure defaults
Least privilege
Defense in depth
Fail securely
Don’t trust services
Separation of duties
Avoid security through obscurity
Keep security simple
Fix security issues correctly
She also covered what OWASP considers to be the current top ten vulnerabilities:
Cross-site scripting
Injection flaws
Malicious file execution
Insecure direct object references
Cross-site request forgeries
Information leakage / improper error handling
Broken authentication and improper error handling
Insecure cryptographic storage
Insecure communciations
Failure to restrict URL access
At the end of her presentation, Leigh listed a couple of books that she considered to be valuable security references. One of them was Writing Secure Code, Second Edition, written by Michael Howard and Steve Lipner and published by Microsoft Press.
This was a surprise to many people in the audience, the majority of whom were not building apps on Microsoft technologies and generally (and often mistakenly) think of the term “Microsoft” being synonymous with “insecure”. A number of people chatted with me after the presentation and it seemed like this was one of many things from Microsoft that caught them by surprise, along with other unexpected things including the MS-PL license, CodePlex and the Open Source Lab, the new emphasis on standards and interoperability…and hey, even taking on “unlikely” evangelists such as David Crow and me.
Pete’s presentation covered the options that developers have when building iPhone apps. For the curious, here’s the deck he used:
The one thing that he wanted you to take away from his presentation is, in his own words:
Consider iPhone web applications and side-stepping the iTunes Application Store (and their 30% gross cut) completely.
The one thing that I took away from the presentation (in addition to the one above) was that it’s not all smiles and sunshine in iPhone development land. Yes, the iPhone provides an excellent user experience and the App Store has been a hit with the customers and many developers. However, a good chunk of Pete’s presentation was about how some of the biggest obstacles for iPhone developers come from Apple itself; I’ve heard that there were similar grumblings at an iPhone developer meetup that took place later in the week. I think that there are some things that Windows Mobile developers (and the Windows Mobile team at Microsoft) can learn from these obstacles, and I’m going to write about them in a later article.
Chris explained that GitHub was an answer to a problem that he and his friends had: they were working on a number of open source projects, so many that managing them was “beginning to wear them down”. GitHub was created as a solution to that problem: it took care of the tedious parts of source code management so that they could focus on their code.
Although GitHub hosts a number of open source projects and uses Git, which is open source, it is not open source. Chris explained that managing an open source project takes up more time that he or the others on the team have. “Ironically,” he said, “starting GitHub has given me less time to work on open source.” After hinting at his dissatisfaction with the GNU General Public License, an audience member asked "Does the GPL cause you nightmares?"
“Yes,” he replied, after which he endorsed his preferred open source license. “MIT license all the way,” he said.
To promote GitHub, they took an approach that was closer in spirit to evangelism than standard marketing. “Companies still believe in old-school advertising, and they also think that what works offline works online,” he said. So they rely on the standard offline methods of promoting their wares: advertisements and marketing campaigns. In the online world, people trust their peers, so they opted for an approach that he called “guerilla marketing”: instead of spending money on ads, they spent money to hang out with developers, buy them beer and pizza and provide “a human face” to GitHub. He summed up the approach with a good one-liner: “Who knew that actually spending time with your customers would be good for business?" A great point, especially in today’s word-of-mouth-y, interconnected world.
ZDNet’s article on the report includes these graphs comparing the top 10 browser-based vulnerabilities on Windows XP and Windows Vista:
One question that comes to mind: is it because Vista is more secure, or because attacking XP is a better approach because it represents a larger base of targets? I certainly don’t know the answer.
Another question that naturally arises from this is: How do you solve the problem of vulnerabilities through third-party apps? I’m a firm believer in Bruce Schneier’s maxim, “security is a process, not a product,” and think that the best approach is a multi-pronged one. The prong for which I’m responsible is educating developers about application security, and as I find out more about the Windows platform and security, I’ll write about it here on Global Nerdy as well as in some of Microsoft’s developer-focused sites.
You’ve heard the stories about people choosing terribly obvious passwords for their various computer accounts, such as “password” and “12345”, but what are the other ones? In his book, Perfect Passwords: Selection, Protection, Authentication, Mark Burnett compiled the most common easy-to-crack passwords, most of which are ordinary words or key sequences that are easy to type on a QWERTY keyboard. I’m amused by some of the pop culture-based passwords, such as “Rush2112”, “8675309” and the X-Files inspired “TrustNo1”.
I met 
The final presentation of the afternoon, 
