Cloud computing

Data Security Podcast recently asked me to comment on the security issues in cloud computing - the result is here if you're interested. Nothing revolutionary of course, just best practice and my usual hatred of passwords :-)

More silver bullets?

With Infosec Europe approaching fast (22-24 April) my thoughts turned to the inevitable release of even more products, products, products. Everyone in IT loves gadgets, but is this really the future of information security? As penetration testers we spend a large proportion of our time trying to break into networks, with continued success unfortunately. However, when we analyse the reasons that networks remain vulnerable, we find that it's not about Zero Day exploits but rather mistakes that could have been avoided.

The same techniques I used to break into a Windows network in 1996 still work today, for example. Why? Because, despite manufacturers such as Microsoft and Oracle spending huge efforts to improve the security of their products, organisations still use stupid passwords, fail to understand security best practice and don't think outside of the box.

Just this week we again found Windows domain administrator accounts with pathetically weak passwords and business-critical infrastructure with default SNMP read/write strings. It took just just minutes to gain complete control of a global company's network with no prior knowledge at all. Every time we are asked to conduct a social engineering exercise - walking in the back door with the smokers, strolling past reception carrying a sandwich at lunchtime, or phoning the help desk and getting remote access - we find the same thing. No security awareness amongst staff at all.

So imagine my delight when five major clients all approached me to assist with staff awareness training this year. It seems that large organisations are finally getting to grips with the "human firewall" concept and realising that they need to invest in people, not just technology. Let's hope this trend continues!

Unprotected laptops

With so many staff working at home one or two days a week and everyone wanting connectivity from anywhere in the world, laptops have become very important tools. Pretty much every organisation now has a VPN to give staff remote access across the Internet, yet a tiny minority understand how much at risk they are from laptops. If an attacker were able to gain control of a lost or stolen laptop, they would have access to all the information stored on it plus the opportunity to connect to the corporate network via the VPN.

From time to time we are asked to test the security of a laptop build - perhaps the organisation is intending to migrate to a new version of Windows or has simply designed a new “build” - in any event we are asked to test the security of their standard laptop configuration.

Our first check is to see whether a BIOS password has been set. This poses a small hurdle to the would-be attacker, one that is usually overcome fairly simply by a bit of jiggery-pokery on the motherboard or by removing the hard disk and putting it in a another system. A hard-disk password is a different problem, which often requires specialist assistance, and is therefore considerably more effective. Unless that is, the hard disk password is the same as the BIOS password in which case the problem is solved. However we have yet to find a corporate laptop utilising either form of power-on password, probably because of the anticipated support costs of all those forgotten passwords!

Assuming that there are no BIOS passwords, all we need is a Windows username and password. Since we have physical access to the machine, that is very easy to achieve. Software such as Petter Nordahl-Hagen’s Offline NT Password and Registry Editor is free and available for download on the web. This software creates a bootable CD or floppy disk which can be used to reset the administrator’s password without ever starting Windows.

Once done, you reboot the laptop and login as Administrator with full access to everything, including any dial-up or VPN connections of course. However, if your laptop’s owner has used Microsoft’s encrypting file system (EFS) on XP, then you will not be able to recover those files, which could be very irritating!

An alternative approach is to use a program like NTFS Reader for DOS, which will allow you to make a copy of the Windows SAM file containing the usernames and passwords, again without running Windows. Once you have a copy of the SAM file, you can run a password cracking program to discover all the passwords on the laptop, and then logon with the Administrator’s legitimate credentials.

This is slightly more time consuming but leaves no evidence of tampering and preserves the EFS files intact. In case you are wondering, a sure-fire way to crack the passwords is to use rainbow tables with a tool such as Cain and Abel. The rainbow tables are pre-computed password hashes for almost every combination of letter, number and punctuation character for passwords up to 14 characters in length, making the job of finding the passwords just a matter of time. Although they are very large (many gigabytes in size) Windows rainbow tables are available for free download from the Internet or can be purchased online for delivery on a set of CDs or DVDs.

There is one simple solution to Unprotected Laptops: full disk encryption. This provides the laptop user with the facility to protect everything with one easily remembered passphrase (much simpler to manage and remember than a complex password) whilst providing the IT support people with a legitimate “backdoor” into the laptop if the user’s passphrase is forgotten or if the member of staff leaves the organisation under a cloud.

How not to choose a strong password

Microsoft have published a Password Checker which is intended to help determine your password strength as you type:

http://www.microsoft.com/protect/yourself/password/checker.mspx

Interestingly the passphrase "microsoft lm hashes are insecure" is rated as Weak, whilst "Passw0rd" (with a zero instead of an o) is rated as Strong.

Nearly everyone uses Microsoft Windows at work and at home (yes, I know you use a Mac, but you're special!). I would guess the majority of serious Windows users will be running W2K or XP. And all of these will be compatible with LAN Manager - a Microsoft operating system that most organisations stopped using decades ago! This appears to be part of Microsoft’s desire to be “backwards compatible” with older systems (although Vista is no longer LAN Manager compatible by default).

Why is this compatibility with LAN Manager important? Well, it comes down to how your password is encrypted and stored. By default, Windows passwords are encrypted using two different algorithms: the LM algorithm (to retain compatibility with LAN Manager) and the NTLM algorithm (which is cryptographically stronger). The encrypted password is called a hash - and both types of hash are stored on your computer. The first problem with the LM hash is that it is in fact composed of two 7-character hashes. So if you were to choose a 10-character password, it would effectively appear to be a 7-character password and a 3-character password, reducing the number of permutations significantly. The second problem is that the LM algorithm coverts upper and lower case characters to all upper case, thus reducing the number of permutations even further. Finally LM hashes use a smaller set of symbols than NTLM - you might see where this is going ...

You might imagine that even a 7-character password is very difficult to crack. Indeed, if we were to try guessing every possible 7-character password using an automated tool, it might take something like a month to work through all the permutations, by which time you may well have changed your password (although Elcomsoft seemed to have changed the rules on this recently). However, most people choose something far simpler - perhaps the name of their partner with a number appended or some other word commonly found in a dictionary. An attacker with the right software can try most words from the English dictionary, a large selection of proper nouns, and all of these with one or two numbers appended in just a few seconds or minutes.

The traditional response to this is to encourage users to use complex passwords containing random letters, numbers and symbols. Such passwords are impossible for the average person to remember, resulting in other serious problems such as passwords written on post-it notes or under the keyboard where even inexperienced attackers can find them.

There is a threat far more important than dictionary-based attacks, one that requires a serious response to the problem of LM hashes - rainbow tables. Putting it simply, rainbow tables are lists of pre-computed hashes for a selection of passwords, making the process of guessing a password very fast indeed. The downside of rainbow tables is size - the longer the password you are trying to guess, the larger the tables need to be. However, the rainbow tables for most combinations of upper case letters, numbers and symbols for a password up to 7-characters long are only 64 GB in size - quite easy to store on a portable hard disk or even a USB key. This means that it becomes feasible to “recover” the password from a LM hash in seconds, no matter how complex the original password.

For some time it has been possible to “switch off” the backwards compatibility in Windows, but most people don’t know that this is possible, or even that it’s important to do so. In any event, even an 8-character NTLM hash is vulnerable to a rainbow table attack, albeit a very large set of rainbow tables for the attacker to generate (or download) and use.

So what’s the solution? When Windows 2000 was launched, the maximum length of a Windows password was increased from 14 characters to 127. Of course, this remains true for Windows XP and Windows Server 2003. One interesting side effect is that a Windows password longer than 14 characters no longer has an LM hash and thus is invulnerable to any LM attacks. The other effect is surprising for many people - the password can in fact be seen as a passphrase and thus simple to remember! A passphrase such as “If I won the lottery I would buy a Ferrari” is very easy to remember and all but impossible to crack by any of today’s tools. So, providing that your PC is running Windows 2000 or XP or Vista, you are free to choose an easy-to-remember, effectively uncrackable password. Simple, eh?

If you've read this far, you may be wondering why Microsoft's Password Checker doesn't reflect this ... so am I.