December 2007 (PDF)

login_cover_0712.qxp:login covers 11/21/07 10:00 AM Page 1 DECEMBER 2007 VOLUME 32 NUMBER 6 OPINION Musings 2 RIK FARROW SECURITY Command and Control Structures in Malware: From Handler/Agent to P2P 8 DAVID DITTRICH AND SVEN DIETRICH THE USENIX MAGAZINE Analysis of the Storm and Nugache Trojans: P2P Is Here 18 SAM STOVER, DAVE DITTRICH, JOHN HERNANDEZ, AND SVEN DIETRICH What Virtualization Can Do for Security 28 TAL GARFINKEL AND ANDREW WARFIELD Your System Is Secure? Prove It! 35 GERNOT HEISER Exploiting Online Games: An Interview 39 GARY MCGRAW WITH RIK FARROW SYSADMIN IDS Signature Matching with iptables, SECURITY psad, and fwsnort 44 MIKE RASH COLUMNS Practical Perl Tools: Perl Meets Nmap and p0f 51 DAVID N. BLANK-EDELMAN iVoyeur: Mystical Flows 56 DAVID JOSEPHSEN Asterisk and LumenVox ASR 62 HEISON CHAK /dev/random 65 ROBERT G. FERRELL BOOK REVIEWS Book Reviews 67 ELIZABETH ZWICKY ET AL. USENIX NOTES 2008 Election of the USENIX Board of Directors 68 ELLIE YOUNG Thanks to Our Volunteers 71 ELLIE YOUNG USACO Update 71 ROB KOLSTAD CONFERENCE 16th USENIX Security Symposium 73 SUMMARIES 2007 USENIX/ACCURATE Electronic Voting Technology Workshop 96 First USENIX Workshop on Offensive Technologies 106 MetriCon 2.0 110 New Security Paradigms Workshop 115 The Advanced Computing Sytems Association login_cover_0712.qxp:login covers 11/21/07 10:00 AM Page 2 Upcoming Events 2008 LINUX STORAGE & FILESYSTEM WORKSHOP THE SIXTH INTERNATIONAL CONFERENCE ON Co-located with FAST ’08 MOBILE SYSTEMS, APPLICATIONS, AND SERVICES FEBRUARY 25–26, 2008, SAN JOSE, CA, USA (MOBISYS 2008) http://www.usenix.org/lsf08 Jointly sponsored by ACM SIGMOBILE and USENIX Submissions due: December 3, 2007 JUNE 10–13, 2008, BRECKENRIDGE, CO, USA http://www.sigmobile.org/mobisys/2008/ 6TH USENIX CONFERENCE ON FILE AND STORAGE Paper titles and abstracts due: November 26, 2007 TECHNOLOGIES (FAST ’08) Sponsored by USENIX in cooperation with ACM SIGOPS, IEEE 2008 USENIX ANNUAL TECHNICAL CONFERENCE Mass Storage Systems Technical Committee (MSSTC), and IEEE JUNE 22–27, 2008, BOSTON, MA, USA TCOS http://www.usenix.org/usenix08 FEBRUARY 26–29, 2008, SAN JOSE, CA, USA Paper submissions due: January 7, 2008 http://www.usenix.org/fast08 2008 USENIX/ACCURATE ELECTRONIC 2008 ACM INTERNATIONAL CONFERENCE ON VIR- VOTING TECHNOLOGY WORKSHOP (EVT ’08) TUAL EXECUTION ENVIRONMENTS (VEE ’08) Co-located with USENIX Security ’08 Sponsored by ACM SIGPLAN in cooperation with USENIX JULY 28–29, 2008, SAN JOSE, CA, USA MARCH 5–7, 2008, SEATTLE, WA, USA http://vee08.cs.tcd.ie 3RD USENIX WORKSHOP ON HOT TOPICS IN SECURITY (HOTSEC ’08) USABILITY, PSYCHOLOGY, AND SECURITY 2008 Co-located with USENIX Security ’08 Co-located with NSDI ’08 JULY 29, 2008, SAN JOSE, CA, USA APRIL 14, 2008, SAN FRANCISCO, CA, USA http://www.usenix.org/upsec08 17TH USENIX SECURITY SYM POSIUM Submissions due: January 18, 2008 JULY 28–AUGUST 1, 2008, SAN JOSE, CA, USA http://www.usenix.org/sec08 FIRST USENIX WORKSHOP ON LARGE-SCALE Paper submissions due: January 30, 2008 EXPLOITS AND EMERGENT THREATS (LEET ’08) Botnets, Spyware, Worms, and More 22ND LARGE INSTALLATION SYSTEM Co-located with NSDI ’08 ADMINISTRATION CONFERENCE (LISA ’08) APRIL 15, 2008, SAN FRANCISCO, CA, USA Sponsored by USENIX and SAGE http://www.usenix.org/leet08 NOVEMBER 9–14, 2008, SAN DIEGO, CA, USA Paper submissions due: February 11, 2008 8TH USENIX SYMPOSIUM ON OPERATING SYSTEMS 5TH USENIX SYMPOSIUM ON NETWORKED DESIGN AND IMPLEMENTATION SYSTEMS DESIGN AND IMPLEMENTATION (OSDI ’08) (NSDI ’08) Sponsored by USENIX in cooperation with ACM SIGOPS Sponsored by USENIX in cooperation with ACM SIGCOMM and ACM SIGOPS DECEMBER 8–10, 2008, SAN DIEGO, CA, USA APRIL 16–18, 2008, SAN FRANCISCO, CA, USA http://www.usenix.org/osdi08 Paper submissions due: May 8, 2008 http://www.usenix.org/nsdi08 For a complete list of all USENIX & USENIX co-sponsored events, see http://www.usenix.org/events. login_for_december_07.qxp:login Dec 07 Volume 33 11/21/07 10:48 AM Page 1 OPINION 2 Musings RIK FARROW SECURITY 8 Command and Control Structures in Malware: From Handler/Agent to P2P DAVID DITTRICH AND SVEN DIETRICH 18 Analysis of the Storm and Nugache Trojans: P2P Is Here contents SAM STOVER, DAVE DITTRICH, JOHN HERNANDEZ, AND SVEN DIETRICH 28 What Virtualization Can Do for Security TAL GARFINKEL AND ANDREW WARFIELD 35 Your System Is Secure? Prove It! GERNOT HEISER 39 Exploiting Online Games: An Interview GARY MCGRAW WITH RIK FARROW SYSADMIN SECURITY 44 IDS Signature Matching with iptables, psad, and fwsnort MIKE RASH COLUMNS 51 Practical Perl Tools: Perl Meets Nmap and p0f DAVID N. BLANK-EDELMAN 56 iVoyeur: Mystical Flows DAVID JOSEPHSEN VOL. 32, #6, DECEMBER 2007 62 Asterisk and LumenVox ASR EDITOR ;login: is the official HEISON CHAK Rik Farrow magazine of the 65 /dev/random [email protected] USENIX Association. ROBERT G. FERRELL MANAGING EDITOR ;login: (ISSN 1044-6397) is Jane-Ellen Long published bi-monthly by the BOOK REVIEWS [email protected] USENIX Association, 2560 COPY EDITOR Ninth Street, Suite 215, 67 Book Reviews David Couzens Berkeley, CA 94710. ELIZABETH ZWICKY ET AL. [email protected] $85 of each member’s annual PRODUCTION dues is for an annual sub- USENIX NOTES Casey Henderson scription to ;login:. Subscrip- Michele Nelson tions for nonmembers are 70 2008 Election of the USENIX Board of Directors $120 per year. ELLIE YOUNG TYPESETTER Star Type Periodicals postage paid at 71 Thanks to Our Volunteers [email protected] Berkeley, CA, and additional ELLIE YOUNG offices. USENIX ASSOCIATION 2560 Ninth Street, POSTMASTER: Send address 71 USACO Update Suite 215, Berkeley, changes to ;login:, ROB KOLSTAD California 94710 USENIX Association, Phone: (510) 528-8649 2560 Ninth Street, CONFERENCE REPORTS FAX: (510) 548-5738 Suite 215, Berkeley, http://www.usenix.org CA 94710. 73 16th USENIX Security Symposium http://www.sage.org ©2007 USENIX Association 96 2007 USENIX/ACCURATE Electronic Voting USENIX is a registered trade- Technology Workshop mark of the USENIX Associa- 106 First USENIX Workshop on Offensive tion. Many of the designations used by manufacturers Technologies and sellers to distinguish their 110 MetriCon 2.0 products are claimed as trademarks. USENIX acknowl- 115 New Security Paradigms Workshop edges all trademarks herein. Where those designations appear in this publication and USENIX is aware of a trade- mark claim, the designations have been printed in caps or initial caps. login_for_december_07.qxp:login Dec 07 Volume 33 11/21/07 10:48 AM Page 2 WELCOME TO THE NINTH SECURITY edition of ;login:. As one of the authors in RIK FARROW this issue mentions, the existence of a focus issue on security is evidence that security is still a concern. Of course, we all have plenty of first-hand experience, and evidence, that our computer security problems remain un- musings solved. At best, we have moved the goal- posts a bit and redesigned the playing field. [email protected] But our computer systems appear to be as insecure as ever. Not that there hasn’t been progress. Go back to the 1990s, when UNIX and Linux systems included exploitable services, running as root, out of the box. Over time, Linux in particular has improved in default security, a very good thing indeed (with BSDs way ahead in security by the late 1990s). And open source programs in general may not be bug-free, but their support teams can boast of being many times faster at releasing patches than most of their commercial counterparts. For reading that at least brings a smile to my face every time, I can recommend the Symantec Inter- net Security Report [1]. You might think me cynical (and you would be correct) when I write this, but the stats included in their executive summary are incredible. For example, the good ol’ USA is number one in a number of areas other than pollution, but Beijing is fast catching up. The U.S. boasts of more attack and malicious activity, phishing servers, and command and control systems, while being both the greatest source and the largest target of spam. Beijing, however, has more bot-infested computers than any other city in the world, and China has 29% of the world’s bots as well. So the Chinese have another interesting problem to deal with, beyond the pollution created by their rapidly expanding economy. The Symantec report is hardly a source of encour- aging news, but there are some bright spots. HP has exchanged places with Sun (or is it Java?) as the slowest vendor to release a patch to a vulnera- bility (112 days). Microsoft was the winner for having the most enterprise-level unpatched vulnerabilities for the first six months of 2007, un- changed from winning this contest in the last half of 2006. Okay, so I am still being really cynical. Apple does well in the report, with fewer reported vulnerabilities in Safari than IE or Mozilla but more than Opera. Apple can also boast of having the shortest time to patch browser bugs, beating 2 ;LOGIN: VOL. 32, NO. 6 login_for_december_07.qxp:login Dec 07 Volume 33 11/21/07 10:48 AM Page 3 out the Mozilla Foundation this time, with an average window of exposure of four days (Mozilla’s was only two days in the previous report). But speak- ing of Apple . Sour Apples By the time you read this, Apple’s “bricking” of unlocked iPhones will be old news. You will remember the flurry of hacking activities that followed the release of the iPhone in late June and the discovery that the iPhone (and iPod) actually run Mac OS X. Deeper inspection of the iPhone revealed that all applications run as root, evidence either that the iPhone was rushed to market or that Apple programmers are extremely lame.

Load more