Moved Posts

Mini Rant – Security that makes no sense…

In my line of work we encourage encrypted communications and securing sensitive data especially when it comes to PII.

However it’s increasingly common to see systems put into place that are obviously only there to mitigate litigation aspects should anything go wrong.

Take American Express for example:

An email from them asking you to send a copy of your passport/driving licence/etc… to confirm your identity suggests that you may reply via email however:

Please note that the internet can be insecure. You must use a secure encryption method when sending personal data and/or documentation to us via email to safeguard your personal data

Great… you encourage your customers to encrypt their personal data.

So I’ll just send over a truecrypt volume encrypted with twofish-aes-serpent shall I?

Or perhaps a PGP encrypted volume, whats your public key?

What about just an AES256 encrypted zip?

Okay so that’s point 1.

  • They’ve suggested that it is on the customers own head to protect their data. However they have not listed the accepted formats of encryption that they use.

So we’re assuming because they’ve not provided us with a public key they don’t want pgp or gpg encryption. They want something simple that doesn’t require too much infrastructure in place so we’ll go with the AES256 encrypted zip, which providing they have winzip/7zip/*ziprarace client means they can enter in a password and decrypt the contents.

Great, so how do I get the password to you?

AMEX are right, internet communication via email is all in the clear, so if someone was in the middle of my traffic (i’m on a corporate network, chances are they’re monitoring it at least so files could be logged or archived in an antivirus mail gateway for example) they could intercept the cleartext data and have my passport details.

So I encrypt it and send it via email, attacker or corporate network now only has an encrypted zip file.

How do AMEX suggest I send a password to them? I call their customer service desk, expecting them to give me a number to SMS it to or a voice service that instead reads me a password when I dial the number and enter my reference code?

Oh you just send it via email. I think you’re meant to send it all together

…I explain my concerns..

Erm, I’ve never been asked that before I guess I could give you another email address to send it to

Point 2:

  • Sending encrypted data along with the password in the same email is as good as sending cleartext data.
  • Sending encrypted data along with the password via the same mechanism is as good as sending cleartext data.

So despite all of AMEX’s good advice above “You must use a secure encryption method…” actually there is no way to use a secure encryption method to keep your data safe when dealing with them.

Extra Note:Along the same lines, as I mention above I regularly get asked to encrypt reports that are deemed commercially sensitive. So I email out the encrypted zip file, and they request that I SMS them the password.

2 minutes later, their blackberry chirps… twice*.

*Did you guess what just happened?

Their blackberry received both the encrypted zip and the plain text password. Loss/Theft of the blackberry once again could result in the loss of commercially sensitive data.

Moved Posts

NFTF: Useful urls for malware investigations

Figured I’d keep a copy of this on here for the next time I need to do malware investigation. – checks URL’s against lots of blacklists, emergingthreats, malwaredomainlist and zeustracker/etc… – Same as above but for IP addresses – Searches above databases and records logs of abuse claims. Useful as it can sometime give you extra URI’s for a host to comb your logs for. Also usefully gives you the date that its crawler last was able to pull down the malicious binary. – Provides an assessment according to the type of nastiness a domain or IP is associated with. – Provides a blacklist DNS entry head to the downloads page, open the text file version and CTRL-F to search. Will give reason for blocking (i.e. listed in along with the date. – Provides a listing of hosts and ip’s known to be associated with malware. – Provides snort rules configured to detect malicious traffic/hosts. – Advanced DNS lookups, links hosts to nameservers, can give aliases and associated subdomains as well as any shared hosts. – Basic network tools, whois, dns, traceroute, etc… useful for performing checks NOT from your own ip 🙂 – lists zeus C&C nodes – lists spyeye C&C nodes


Be careful if you use any of these tools on the affected network as often it will contain the hostname or IP you’re looking for in the request parameters which means they’ll flag you up as an infected laptop without looking at the actual URL you’re browsing to (happened to me previously).

*10/06/12 – Correction courtesy of Steven B: I originally had “” listed instead of, thanks for the heads up.

Moved Posts

NFTF: Alternative Data Streams – bits and pieces.

To those not familiar with the world of NTFS. It offers a feature known as Alternate Data Streams which can allow a user to create hidden content attached to a file.

Typically generated using echo or type it normally requires a command prompt to get to generate these files or view the files.

However an alternative method in XP and 2K/2K3 series of operating systems was to add data to the summary properties of a text document created in notepad as it turns out this data was held within an ADS associated with the original text file.

What happens if like me last week you find yourself on a system with a tight group policy forbidding command line access and an execution arbiter that worked from a whitelist of very very few programs?

You get creative.

I know:

type hideme.txt > public.txt:hideme.txt

will generate an ADS.

I also know that typing

notepad c:pathtopublic.txt:hideme.txt

will let me edit the contents of hideme.txt which would not ordinarily be accessible by any other means.

Unfortunately opening a file in notepad and throwing public.txt:hideme.txt as a filename within the save as box will not work as windows dislikes the colon.

But what else runs console commands?

Batch files – nope not in this case, execution arbiter stops batch files running.

What about shortcuts?

Bang on.

Right click “Create New -> Shortcut”

Enter in “notepad” without quotes as the target, and complete the wizard with defaults.

Right click the created shortcut change the target field to show

%windir%/system32/notepad.exe "c:pathtopublic.txt:hideme.txt"

Save the changes and double click the shortcut.

Pow! You’re now editing an ADS attached to the public.txt file that you had available earlier, ADS created and without additional tools you’re free to hide data away from an administrators prying eyes on a system that gave you no access to a command prompt, stopped you running Batch files and more…

What Next

So with that juicy thing done what else could I do? What about exporting sensitive company data? Maybe the customer contact list for a company or medical records or financial details?

Hmm okay so I’m going to have to get it off the system some how, but the company is smart and doesn’t allow the use of USB drives so I can’t use an NTFS formatted USB drive to export data (on non NTFS file systems the ADS is dropped as it’s not supported).

What about CD? Well I did say on non NTFS file systems the ADS disappears. It’s true for CDs ISO9660 and UDF formats don’t support alternate data streams so you’re stuck again.

Except, what if you change the file?

What if you zip it? then burn the zip?

Well sad to say using WINZIP v14+ and the default compressed folders function in windows, I believe you’re out of luck, both tools appeared to just drop the ADS content on the floor.

Using winrar however to create the zip… I’ve shown that it maintains the ADS across filesystems, now my test was using a local FAT32 formatted partition and an NTFS one, I didn’t actually burn it to CD-ROM so it may not be the case but it’s certainly looking promising.

If it is the case, having the ability to covertly export and import information using ADS suddenly becomes a big issue.

I plan on looking into it a bit more as it could have just been a series of flukes that worked for me but it w