Love, as they say, is dangerous.

As mentioned previously (and in a Defcon debriefing post that I have yet to actually publish), I've been looking into malware analysis and reverse engineering lately. There is still so much to learn, but what humble little I have learned has whetted my appetite for something more hands-on.

By the way, I have finally discovered and fallen in love with Eldad Eilam's book, Reversing: Secrets of Reverse Engineering. Its collective 624 pages has a good balance of breadth and depth, and though I haven't finished it from cover-to-cover yet, I am already jumping the gun and recommending it to anyone interested in reversing. As the book has a good amount of assembly code, some background knowledge is advised, unless you're the type who likes to be inundated with information about things you can just barely understand, like doing 0 to 60 in 3 seconds flat.

At any rate, in my quest to look for something to analyze, I discovered that one easily accessible treasure trove of malware and fishy (phishy! sorry, that was punny) sites is my spam folder... which is where I found this one:



"I`m in hurry, but i still love you...?" Aw, I feel the warm fuzzies! Especially when said ecard (which has javascript code running in the background, so I don't recommend you going to this link unless you know what you're doing) looks something like this...



Humor aside, I am somewhat surprised by the sloppy effort of the attempt, especially when simple copy-pasting could have made it somewhat more convincing. This was obviously not a particularly brilliant example of social engineering technique, but it was entertaining nevertheless.

And your mother's maiden name?

I just got off the phone with one of my banks, calling because their website refused to let me login to my account (red flag thought #1: a supposed online banking system that won't let me log in? Perhaps they've been attacked and this is a phishing scheme... if so, it's too late for me now). If they have, in fact, been attacked, then anything on the site could have been changed, including their contact us for support phone number.

If I call a number on a potentially compromised website (or a number left in a voicemail from my supposed "bank", or one I received in the mail from someone claiming to be the First Thirtysecond Bank of That One Lake in Rural Wisconsin) -- how would I know whether I was actually talking to the bank? The first question they ask you is for your account number. Next, the date and amount of last deposit. Then, of course, the obligatory "mother's maiden name", location in which the account was opened, and other similar questions. All of this is meant to verify that I am who I say I am, which really isn't the concern here. All an attacker posing as the bank would need to do is say, "Yep, that's all correct. And Mr. Martin, for a limited time, since you're such a loyal customer, I've taken your identity. Please have a nice day."

The real issue here is, are they who I think they are? At no point is there ever an opportunity or means of verifying THEIR identity. Where did THEY grow up? What is THEIR blood type? Give me the last four of your social Mr. Bank representative, if that's even your real name....

Now it's obviously a bad idea (and impossible) for each customer to have a database of personal information about each bank representative from which to verify their identity, but there are a few little things we can do to mitigate some of the risk.

First, be sure to call a number that you are 100% certain is valid, (such as the one on the back of your bank card or statement), then have them transfer you to the correct department. You could also have them call you back at your number so you could at the least check against caller ID (likely to be unlisted though and easily faked). In addition, try some well placed lies to check whether they are actually validating your responses against something. For example, if they ask the date and amount of your last deposit, and you know it to be $100 on 3/13, respond with "I believe it was $75 on 3/16" - they should stop you and say that it is incorrect, then you say "Oh yes, I meant to deposit that but forgot, it was $100 on 3/13."

Lastly, and perhaps the best solution would require some policy changes on behalf of the bank, but I believe it would provide an excellent counter to this threat. The reverse security question is something that is already used in highly secure environments such as intelligence agencies or military special forces, but should really be adapted to anything that impacts privacy and identity protection. When the customer opens an account with the bank, they should be made to create a secret phrase for validation of the bank. Then, when a customer calls for support, the conversation would become: "This is The Bank, could you please verify your account number and mother's maiden name?" "That's correct, your secret phrase is the white swan flies at midnight. Could you now please verify the date and amount of your last deposit as well as your social security number?" Some places are starting to use this logic with images of the customer's choice, but this would obviously not apply to phone conversations. If my banks began to authenticate themselves to me like this, it would be much more difficult to beat, and certainly put my mind a little more at ease.

Be on the lookout for more on this topic from yours truly and Steven Jackson in the near future.

Week of Vista Bugs a poor April Fools Joke

If you are into the computer security information sphere, and I expect you are if you're reading this blog, then chances are you've heard the whole shouting match over the Week of Vista Bugs and it's following firestorm. The long and short of it: it's a hoax. Game over.

Now this was something vaguely suspected by many, but at the same time it was something everyone in the security community had to approach with at least a guarded curiosity. Most major sites mentioned it, at least in passing, even if with a mention of the fact that it could be less than legitimate. Sadly this was exactly what the social engineers (a term I use with more than a little disdain and I'm not fully sure they deserve even that high of praise) at TWOVB wanted, in an exercise they referred to as "hacking the media" on their revelation page. I'd to into more but I'm disgusted with the whole thing, so I'll let you read for yourself here:

The Week of Vista Bugs: The Truth

SANS Internet Storm Center: Week of Vista Bugs is a Hoax