Interview with Stefan Savage: On the Spam Payment Trail RIK FArrOW LISA ’11: Theme—“DevOps: New Challenges, Proven Values” THOMAS A. LIMONCELLI AND DOUG HUGHES Do Users Verify SSH Keys? PETER GUTMANN AUGUST 2011 VOL. 36, NO. 4 Conference Reports from HotOS XIII THE ADVANCED COMPUTING SYSTEMS ASSOCIATION THE ADVANCED COMPUTING SYSTEMS ASSOCIATION usenix_login_aug11_covers.indd 1 7.6.11 2:27 PM UPCOMING EVENTS 20th USENIX Security Symposium 23rd ACM Symposium on Operating Systems (USENIX Security ’11) Principles (SOSP 2011) August 8–12, 2011, San Francisco, CA, USA SPONSORED BY ACM SIGOPS IN COOPERATION WITH USENIX http://www.usenix.org/sec11 October 23–26, 2011, Cascais, Portugal http://sosp2011.gsd.inesc-id.pt Workshops co-located with USENIX Security ’11 include: ACM Symposium on Computer Human 2011 Electronic Voting Technology Workshop/ Interaction for Management of Information Workshop on Trustworthy Elections Technology (CHIMIT 2011) (EVT/WOTE ’11) SPONSORED BY ACM IN ASSOCIATION WITH USENIX SPONSORED BY USENIX, ACCURATE, AND IAVOSS December 4–5, 2011, Boston, MA August 8–9, 2011 http://chimit.acm.org/ http://www.usenix.org/evtwote11 25th Large Installation System Administration 4th Workshop on Cyber Security Conference (LISA ’11) Experimentation and Test (CSET ’11) SPONSORED BY USENIX IN COOPERATION WITH LOPSA AND SNIA August 8, 2011 December 4–9, 2011, Boston, MA, USA http://www.usenix.org/cset11 http://www.usenix.org/lisa11 USENIX Workshop on Free and Open Communications on the Internet (FOCI ’11) ACM/IFIP/USENIX 12th International August 8, 2011 Middleware Conference (Middleware 2011) http://www.usenix.org/foci11 SPONSORED BY ACM AND IFIP IN ASSOCIATION WITH USENIX 5th USENIX Workshop on Offensive December 12–16, 2011, Lisbon, Portugal Technologies (WOOT ’11) http://2011.middleware-conference.org/ August 8, 2011 http://www.usenix.org/woot11 10th USENIX Conference on File and Storage Technologies (FAST ’12) 2nd USENIX Workshop on Health Security and SPONSORED BY USENIX IN COOPERATION WITH ACM SIGOPS Privacy (HealthSec ’11) February 14–17, 2012, San Jose, CA August 9, 2011 http://www.usenix.org/fast12 http://www.usenix.org/healthsec11 Paper titles and abstracts due: September 20, 2011 6th USENIX Workshop on Hot Topics in Security (HotSec ’11) 9th USENIX Symposium on Networked Systems August 9, 2011 Design and Implementation (NSDI ’12) http://www.usenix.org/hotsec11 SPONSORED BY USENIX IN COOPERATION WITH ACM SIGCOMM AND ACM SIGOPS Sixth Workshop on Security Metrics April 25–27, 2012, San Jose, CA (MetriCon 6.0) http://www.usenix.org/nsdi12 August 9, 2011 Paper titles and abstracts due: September 27, 2011 http://www.securitymetrics.org/content/Wiki. jsp?page=Metricon6.0 FOR A COMPLETE LIST OF ALL USENIX AND USENIX CO-SPONSORED EVENTS, SEE HTTP://WWW.USENIX.ORG/EVENTS usenix_login_aug11_covers.indd 2 7.6.11 2:27 PM EDITOR Rik Farrow [email protected] MANAGING EDITOR Jane-Ellen Long [email protected] A UGUST 2011, VOL. 36, NO. 4 COPY EDITOR Steve Gilmartin [email protected] OPINION Musings R IK Farrow . 2. P RODUCTION Casey Henderson Sec URITY Jane-Ellen Long Jennifer Peterson Interview with Stefan Savage: On the Spam Payment Trail R IK Farrow . 7. Understanding Advanced Persistent Threats: A Case Study N ED MORAN . 21 TPY ESETTER Star Type Network Attack Collaboration: Sharing the Shell R APHAEL MUDGE . 27 [email protected] Do Users Verify SSH Keys? P ETER GUTMANN . 35 US ENIX ASSOCIATION P ROGRAMMING 2560 Ninth Street, Suite 215, Berkeley, California 94710 Mesos: Flexible Resource Sharing for the Cloud B ENJAMIN HINDMAN, ANDY Phone: (510) 528-8649 KONWINSKI, MATEI ZAHARIA, ALI GHODSI, ANTHONY D. JOSEPH, RANDY H. Katz, FAX: (510) 548-5738 SCOTT SHENKER, anD ION STOICA . 37 http://www.usenix.org SYSADMIN http://www.sage.org LISA ’11: Theme—“DevOps: New Challenges, Proven Values” Thomas A. LIMONCELLI ;login: is the official magazine of the USENIX Association. ;login: (ISSN 1044-6397) AND Doug HUGHES . 46 is published bi-monthly by the USENIX CLUO MNS Association, 2560 Ninth Street, Suite 215, Berkeley, CA 94710. Practical Perl Tools: Got My Mojolicious Working Da VID N. BLANK-EDELMAN 9 . 4 $90 of each member’s annual dues is for Galvin’s All Things Enterprise: The State of the Cloud P ETER BAER GALVIN . 56 a subscription to ;login:. Subscriptions for iVoyeur: Crom DaVE JOSEPHSEN . 59 nonmembers are $125 per year. Periodicals postage paid at Berkeley, CA, /dev/random R OBERT G. FERRELL . 64 and additional offices. BOOKS POSTMASTER: Send address changes to Book Reviews E LIZABETH ZWICKY, with RIK FARROW . 66 ;login:, USENIX Association, 2560 Ninth Street, Suite 215, Berkeley, CA 94710. CONFERENCES ©2011 USENIX Association 13th Workshop on Hot Topics in Operating Systems (HotOS XIII) . 69 USENIX is a registered trademark of the USENIX Association. Many of the designa- tions used by manufacturers and sellers to distinguish their products are claimed as trademarks. USENIX acknowledges all trademarks herein. Where those designa- tions appear in this publication and USENIX is aware of a trademark claim, the designa- tions have been printed in caps or initial caps. AUGUST_11_articles_updtdfile.indd 1 7.6.11 2:47 PM Musings R IK FARROWOpiniOn Rik is the Editor of ;login:. It feels like the ’90s all over again . No, I don’t mean the IPO of LinkedIn for a ridic- [email protected] ulous figure (16 times earnings) . Rather, it’s the rash of highly publicized security incidents, with Sony being the most recent—and the most frequent . LulzSec has bragged online that their “hack” was embarrassingly easy: a simple SQL injection [1] . The attacks on Sony’s networks worldwide have led to a flood of released data, including info on registered users and source code . The Sony attacks, and those on HBGary Federal and PBS o. rg, seem to have been done for political reasons . After a decade where computer attacks have been pri- marily focused on financial gain, this marks a rare turn toward vigilantism . What these attacks also reveal is the very porousness of network security . When the only way we would learn of attacks was after the California law on disclosure of personally identifying information forced an announcement, it wasn’t obvious just how often organizations were being broken into . Now it seems as if we are back in the era of unpatched Linux systems being taken over by automated attacks . But this time around, things are different . The Difference Much has changed between 1999 and 2011 . The publication of exploits has largely gone underground, as exploits are now sold on the black market both to govern- ments and to criminals . Attackers are no longer motivated by becoming famous (or infamous), with the recent exceptions of Anonymous and LulzSec . Instead, criminal organizations use exploits to take over Windows PCs for use in botnets, or steal databases loaded with credit card information . The monetization of exploits has long been under way . But some things have not changed at all .In 1999, only a fool would claim that their Internet-connected system was totally secure, and proof against all attacks . And that is just as true today . Only we behave as if it isn’t so . And instead of attacking Internet-facing *nix servers, today’s attackers can rely on a different technique, one that totally trashes any concept of having a “network perimeter ”. They can gain a foothold inside any network through the use of email and Windows PCs . The Google attack, announced over a year ago (January 2010 [2]), has just been repeated . I believe that similar attacks are behind the exploita- tions of RockYou (32 million passwords stolen), Gawker (300,000), and certainly of HBGary Federal . 2 ;login: Vol. 36, NO. 4 AUGUST_11_articles_updtdfile.indd 2 7.6.11 2:47 PM This type of targeted attack requires some research on the attacker’s part, to deter- mine the subject line and content for an email message likely to make it pass spam OpiniOn filters and be opened by the intended victim . You can read more about an example of this particular attack in Ned Moran’s article in this issue about the Advanced Persistent Threat . But it is not just APT that can take advantage of “spear phish- ing,” sending email containing exploits to targeted individuals . Anyone willing to spend enough time to understand the targeted organization, perhaps by using LinkedIn to uncover links between individuals that could be used to fashion an effective email message, could successfully breach a network today . The only effective defense against such attacks is either using the mail command- line program on a *nix system without X Window to read email or keeping all criti- cal assets on networks segregated from networks with GUI users . I don’t believe for one minute that people are going to go command-line anytime soon, so it looks like we need to consider the alternative approach . Assume the Worst Dominique Brezinski explained, in a private email, that he has had a lot of success with the following alternative approach (quoted with permission): It is my opinion that in any computing environment with a non-trivial population you must assume some client devices and some user accounts are compromised . There are a couple advantages to making this assumption: Your defensive strategy no longer makes a delineation between exter- nal and internal adversaries . It is only a single, easy hop from outside in . Just assume it happens . Tailor your defensive strategy around the insider problem . Whether you own the client device or not makes little difference . Dom’s first point echoes what I have already written: assume the worst—your net- work has already been compromised . Even if it hasn’t been (as unlikely as that is), assume it has . Then behave accordingly .