The SANS Institute sez: NSA Helping to Harden Operating Systems

--
I'm kind of surprised to read this blurb from the latest edition of the SANS NewsBites newsletter (Vol. 11 Num 92):

--NSA Helping to Harden Operating Systems

(November 7, 18 & 19, 2009)

In testimony before the Senate Subcommittee on Terrorism and Homeland Security, National Security Agency (NSA) information assurance director Richard Schaeffer said that his agency helped Microsoft harden Windows 7 and that it is also helping Apple, Sun Microsystems, and Red Hat with similar endeavors. The NSA's involvement in the development process has led to speculation that backdoors will be built into the software to allow communications monitoring and interception. The NSA refutes those claims and says it is helping develop security guidelines and checklists. Schaeffer also said that agencies can protect their systems against 80 percent of known cyber attacks by following three steps: implementing best security practices, configuring networks properly, and monitoring networks effectively.

http://www.theregister.co.uk/2009/11/19/nsa_enhanced_windows7_security/

http://www.computerworld.com/s/article/9141105/NSA_helped_with_Windows_7_development

http://www.h-online.com/security/news/item/NSA-helps-Apple-Sun-and-Red-Hat-harden-their-systems-863889.html

http://fcw.com/Articles/2009/11/17/NSA-3-steps--better-cybersecurity.aspx

[Editor's Note (Pescatore): Ah, conspiracy theories. NSA and other government agencies have been involved in developing "gold" configuration definitions for standard software and network hardware products for a long time, along with the IT industry. Hardening in this case means better configuration and minimization of unneeded services.]

You can subscribe to the SANS newsletters HERE.

My concern about this news:

If the NSA is so good at hardening operating system security, and good at protecting their systems from 80% of known cyber attacks, how come the US federal government computer system has been PWNed by China and other countries every year since 1998, including 2009?

Read THIS list from the Center for Strategic & International Studies and have a heart attack. Included on the list are:

February 2009 - US Federal Aviation Administration hacked.

March 2009 - US federal computer containing plans for the new presidential helicopter hacked.

April 2009 - The revelation that the US power grid had been hacked.

May 2009 - US Homeland Security Information Network hacked.

So where was the NSA during all this? And the NSA has what skills to offer Microsoft, Apple, Sun and Red Hat? Just asking.

More likely the NSA is supplying their experiences in security FAILure, such as sharing what hacking methods were successful against federal computers during their watch. Just saying.

You know I'm itching to point out that switching to a proven secure operating system is always helpful. For example, why are the feds still using Windows?! It boggles my mind. Windows is dead last on the list of secure operating systems. The top 3 are still:

- OpenBSD
- FreeBSD
- Mac OS X (which incorporates BSD Unix)

But I'm just some laymen guy with a few science degrees and some decades of computer experience who rants about the ridiculous state of computer security in my country.
(o_0)
--

The First Reported Mac BOTNET

--
Let me first share news from SANS Institute, then provide a brief perspective on the situation.

Below is a quote from SANS NewsBites Volume 1, Number 30, released last night. (I added some bolding for emphasis). You can sign up for the SANS newsletters HERE.

--Trojan in Pirated Mac Software Helped Create First Mac Botnet
(April 15, 2009)

Malware embedded in pirated versions of Apple's iWork and Adobe Photoshop CS4 for Mac that were available over a peer-to-peer network in January is responsible for what appears to be the first known Mac botnet. The zombie network attempted to launch a distributed denial-of-service (DDoS) attack against an unidentified website. The malware had spread to several thousand computers before it was identified.

http://www.cbc.ca/technology/story/2009/04/15/ibotnet-trojan.html

http://blogs.zdnet.com/security/?p=3157

[Editor's Note (Honan, Schultz): Looks like the Mac platform is an increasingly fruitful target for cyber criminals. ]

Indeed it has. "Several Thousand Computers." This is incredibly sad, but also inevitable.

While all the FUD mongers have a sadism party at our expense, (and they will), keep in mind that NONE of the current Mac malware is able in penetrate any Mac unless the user (often called the 'luser') deliberately installs a Trojan horse on their computer. This happens specifically because the user has been conned by what is called Social Engineering, or in this case, the luser is using pirating software that has had the Trojan carefully placed in the installer to go along for the ride. What do you call it when a dirty deed is done to someone pulling a dirty deed? How about 'Dishonor Among Thieves'. It is more like poetic justice, parasite chewing on parasite.

Anyway, Mac Botnets have arrived. What is done with them will be of interest. Typically these days they are used for money making schemes. Go read all the news about the Windows Conficker worm scare of April 1st and beyond. Once created via infection, a botnet can pull off just about anything you can do over the Internet except in mass numbers at one time.

OK! You're a luser and maybe you did something that could have gotten you infected. Now what?

What NOT to use:

ClamAV. Worthless for Macs. I've covered this disappointment several times.

MacScan. The botnet Trojans are out of its league. It's clunky unreliable software anyway.

Symantec Norton Whatever. I consistently get reports that Norton Anti-Virus continues to be one of the single most buggy and CPU hogging applications you can buy for Macintosh. Symantec also invented the anti-Mac security FUD campaign back in 2005. Save your money and your patience. Avoid. Run away. Just my opinion.

Freeware:

iAntiVirus from PC Tools. It can detect and remove all current Mac malware. You don't have to pay for the application unless you are a business or are running a large network. The paid version offers technical support. Note that it only runs on Leopard. I use it and find it to be very simple and unobtrusive.

Shareware / Commercial-ware:

Sophos Anti-Virus. It is designed for companies and networks of computers.

Intego VirusBarrier. I find them to be the best-in-class for single users. I'm disappointed at their disorganization as a company. But the program is top notch. Just be prepared to shell out money year after year. Bleh. Nonetheless, I own it, use it and like it.

I used to use Virex X, now called McAfee Virus Scan. But it got clunky. Many people downright hate it. I don't know why. These days it is designed for companies and networks, not single users. I would have shoveled McAfee into the grave along side Symantec for having FUDed the Mac. But oddly, their CEO ended up stating that the single best way to escape computer malware was to "buy a Mac." So they can't be entirely stupid over there.

There is other stuff around, but it makes me yawn. You can get a listing of it all at the download sites by searching for 'virus'.

DEFENSE!

If you are in charge of a home computer shared by others, or you are an IT manager, stop the luser users from installing Trojans by giving them Mac OS X accounts that Do Not Allow Program Installation! If a user wants a program installed, let them ask you to do it for them in YOUR account. Then give them access to the program.

But of course this means that YOU, the boss of the machines, have to be careful too. Always verify that what you install has specifically been tested somewhere. I always use the download sites like VersionTracker or MacUpdate. There are many others. Be sure that either the site itself has tested that version of the program and given it an OK, or that a lot of users have tested it and OKed it. Buy commercial-ware directly from the company, and make certain they are entirely, unquestionably reputable. Adobe.com = reliable. Jake's Super Deluxe Fly-By-Nite Site.com ≠ reliable. You get the idea.

And just to tick off the FUD mongers:

A) There is no such thing as a 'virus' for Mac OS X.
B) There is no such thing as a 'worm' for Mac OS X.
C) There is no such thing as illicit 'spyware' for Mac OS X. All Mac spyware is sold legally for the purpose of surveillance of network machines.
D) There is no such thing as 'security by obscurity' for Mac OS X. If you know how to do math, you can prove this for yourself. Go backwards in my blog if you want to read the gravestone I wrote for this mythological absurdity form of FUD.
E) As a Mac user you must keep computer security in mind. Follow the basic rules:

1. Make regular backups. This is the #1 Rule Of Computing.
2. Learn how to use your router's firewall and use it.
3. Learn how to use Mac OS X's built-in firewall and use it.
4. Always use password protected accounts. Make very sure your password is strong, obscure, unintuitive and plain old nasty. Be sure you remember it. Don't give anyone else access to it.

I've gone into greater detail about add-on measures in previous posts. The list above covers the essential basics.

And of course, don't ever pirate software. Now it's extra dangerous. If that gets you excited, welcome to the botnet.

:-Derek
--

Trojan OSX.RSPlug DNS Confusion Solution

-
Earlier in the year I posted an article questioning whether Apple had patched Mac OS X Server versions 4 and 5 to prevent the actions of Trojan OSX.RSPlug.A, which hijacks a Mac's DNS server settings in order to divert users to Phishing sites. Misinformation galore was available on the Internet, and of course there was no one in the Mac community I could find with any kind of clear discussion of the issue. If there were such folks around I would send you to them for better information than I can provide.

Thankfully this past week, during my investigation of Clamav's effectiveness against Mac malware, Adam Engst was kind enough to get me in touch with Rich Mogull. Rich provided me with a very helpful answer, quoted below:

Hi Derek,

Yes- that family of trojans makes DNS changes on your system, but not because of any vulnerability or problems with the OS X implementation of DNS. The trojan only works if you manually install it and enter you administrative password. It then changes settings just as you can do yourself under normal circumstances. On occasion, these trojans (and others) may be able to take advantage of other vulnerabilities on the Mac to make changes without an administrative password, or install itself automatically due to a browser weakness, but there are currently no known open vulnerabilities like these being used by bad guys. Right now, you still need to install it and manually enter your admin password- there's not much Apple can do to prevent that.

As a result, I chopped out my early Trojan OSX.RSPlug.A article and corrected a related sentence in my recent article "Update: The State Of Trojan OSX.RSPlug..." in order to remove my own confusion.

The confusion on the Internet regarding Apple Security Update 005 came from the fact that it repaired a very old DNS technology vulnerability. The fact that DNS was involved in both this vulnerability and the RSPlug Trojan was coincidental. I have never covered the DNS technology vulnerability here, called DNS cache poisoning, as it has not been of serious consequence to Mac users. If you are interested, coverage of the problem at the SANS Institute is adequate and provides references.
--