Updates
I contribute to this page is occasionally, whenever there is news that might be of use, or of interest, to readers. Please consult the errata page for blunders and omissions.
Contents:
Windows XP SP2
Mozilla Firefox
Phishing
Ximian Evolution for Windows
Database Hell
A Risky 'Feature' in Mozilla
Data Hygiene Problems with Freenet
Last updated: 15 May 2005
Windows XP Service Pack 2 (SP2)
Many readers have asked if this major security update, released in August of 2004, affects or duplicates any of the system hardening procedures in the book. After testing SP2 thoroughly on clean installs of XP Home and XP Pro, I can say that it has no effect. It represents a significant step toward tightening the underlying Windows code, but, unfortunately, it involves no improvements in Windows' default system configurations. Virtually all of SP2's changes are "under the hood," so to speak, intended to mitigate problems such as stack and buffer overflows and the like.
SP2 does not prevent Windows from enabling the same vast collection of unnecessary and often insecure networking services and components by default; it does not address the myriad default configuration blunders and scripting vulnerabilities plauguing Internet Explorer and Outlook Express; it does not address Windows' long-term problems with data hygiene; and, while the native MS packet filter is finally enabled by default, it still lacks a capacity for egress filtering, which renders it as useless for detecting adware and spyware as its predecessor. A third-party packet filter capable of egress filtering is still a basic necessity for all Windows users.
Additionally, Windows Indexing Service, DCOM, Client for Microsoft Networks, File and Print Sharing, and the QoS Packet Scheduler are still installed and/or enabled by default. NetBIOS over TCP/IP is enabled, as are Remote Assistance and Remote Registry. Finally, user permissions remain a disaster, as SP2 still encourages the system owner to run their machine from the Administrator account. Sadly, there is not a single hardening procedure (detailed in Chapters 2 and 4) that SP2 has made unnecessary.
The Firefox Rebellion
Since the book's publication, Mozilla's Firefox Web browser and its Thunderbird e-mail client have become immensely popular alternatives to Microsoft's Internet Explorer and Outlook Express, following an embarrasing string of exploits against both, in defiance of SP2.
I would encourage intermediate and advanced Windows users to download Firefox and Thunderbird and evaluate them, but I would still urge security novices to install Mozilla in place of IE and OE, and follow the secure configuration procedures in the book. The Mozilla package features a Web browser, e-mail client, news reader, and IRC client, all with a consistent user interface. It's easy to secure by following the directions in the Introduction, and it has a look and feel that IE/OE and Netscape users will find easy to grasp.
The advantages of using Firefox and Thunderbird come from their relative simplicity. They require less disk space and system RAM than Mozilla, and are therefore faster and more responsive. Users already familiar with Mozilla should certainly try them and compare, while less experienced users should turn to the full Mozilla package for their first step away from Microsoft's browser and e-mail bugware.
Lately, Firefox's security benefits seem be getting hyped out of proportion, as this article by SecurityFocus reporter Rob Lemos makes clear. While it's true that open source software offers an inherent security advantage due to its transparency, it's also true that there is no such thing as a security panacea.
Phishing
"Phishing" is another of many illiterate hacking terms snapped up by the press that I'd hoped would die before the book began to ship. Unfortunately, it has stuck. Quite simply, phishing is the social engineering technique explained in Chapter 3 (p. 82-86), in which a trickster publishes a Web site designed to look like a popular commercial site. He then sends out a substantial quantity of spam telling potential victims that their account information needs to be updated, or that they have placed an order for services or merchandise, and providing a link to the scam site. If one is taken in by this, one's passwords and credit card information will be captured, and, obviously, abused. It's an old, familiar scam with a new, unfamiliar name.
Ximian Evolution for Windows
Ximian Evolution is a free, open-source groupware application -- essentially an Outlook clone that's fully MS-Exchange compatible and quite secure. This is fine for Linux users who want to run their existing versions of MS Word and Excel with Wine's Crossover Office, and replace MS Outlook with Evolution. Thus one can use, or replace, all of Microsoft's most popular office applications on a Linux platform, which removes the chief obstacle to migration from Windows.
Unfortunately, Evolution runs on Linux and UNIX only. As noted in the book, Mozilla Mail may be an excellent substitute for Microsoft's Outlook Express, but it can't replace Outlook. Many readers who intend to stay with Windows, while running safer, open-source applications on it, have contacted me asking if, or when, Evolution will be ported to Windows.
Early in 2005, Novell, which owns Ximian (and SuSE Linux), announced that it will develop a Windows port for Evolution, but offered no timetable for fishishing the job. So I can answer the "if" question: yes, but the "when" question remains anyone's guess. I'll post an update when Novell commits to a release schedule.
Database Hell
During an eight-week period between March and May 2005, it transpired that privacy invasion outfit ChoicePoint, payroll handler PayMaxx, Bank of America, media behemoth Time Warner, health care heavyweight San Jose Medical Group, data broker Lexis Nexis, clothier Ralph Lauren, California State University at Chico, Tufts University, Boston College, the University of California at Berkeley, and a large shoe retailer called DSW, all lost control of sensitive data concerning millions of victims. Credit card and other banking details, names, addresses, phone numbers, Social Security numbers, and dates of birth have fallen into the hands of potential identity thieves. While this is nothing new, there is an important observation here that's worth emphasizing: none of these cases involved online shopping or online banking.
Many people believe that they're safe from identity theft in the brick and mortar world. Nothing could be farther from the truth. The vast majority of incidents can be traced to skimming, dumpster diving, and just plain carelessness among those who "own" our personal data. As noted in Chapter 1, only a small fraction of such incidents result from online transactions. Every time you pay by check or use a debit or credit card, lease property, or apply for credit, financial services, or insurance, you lose control of extremely sensitive data. A merchant is at liberty to do anything he pleases with the information, and this includes selling it to a third party without your knowledge or permission, or entering it into a computerized database, possibly with lax access controls, and possibly even connected to the Internet.
Sadly, Congress has responded by increasing the penalties for identity theft, rather than by regulating access to, and use of, personal data by merchants, advertisers, and data miners. In other words, Congress is trying to deter ID thieves, but is doing nothing to alter industry practices, leaving individuals with no power to prevent ID theft.
Incredibly, the only person with absolutely no control over the collection, storage, security, and use of such sensitive information is its true owner. For this reason, it is literally impossible for an individual to protect himself from identity theft, and it will remain impossible until Congress sees fit to regulate the privacy invasion industry, putting individuals back in control of their own personal data, and requiring immediate public disclosure of all data security breaches. Fortunately, there are preliminary signs that this could happen in the future, as explained in this article covering recent hearings on ID theft by the Senate Judiciary Committee.
A Risky 'Feature' in Mozilla
The Mozilla browser now has a feature called link pre-fetching that could compromise one's online privacy or anonymity, especially when using services like Freenet. The option was not available at the time of publication and is not mentioned in the book. However, pre-fetched links can operate just like Web bugs (described on page 35 and defined in the glossary on page 296), putting your browser in touch with remote servers that you may not wish to contact, such as those operated by marketing outfits, spammers, script kiddies, etc. There is also a potential for cross-site scripting (XSS) attacks (page 36), and for Freenet users to announce themselves unwittingly to outside parties interested in identifying or logging the IP addresses of those viewing controversial material.
To disable this gimmick, use the Mozilla menu bar and choose: Edit ==> Preferences ==> Advanced ==> Cache ==> Link Prefetching, and clear the check box. (Be sure also to limit cookies and images to their originating Web sites, as explained on page xxxvi.)
Data Hygiene Problems with Freenet
I recently discovered that the Freenet Project anonymous P2P application is susceptible to a simple forensic attack, due to its caching behavior. Essentially, I found that it's trivial to determine whether cached data belongs to requests that your node has proxied, or to data that you personally have requested. Anyone with access can run a list of 'forbidden' Content Hash Keys (CHKs) against your cache, and, by observing the behavior, determine whether the files were proxied or deliberately fetched. I consider it a serious security issue, but it will not be fixed until version 0.7 is released, sometime in 2005, the developers hope. I would recommend not running Freenet until you've read this article, which explains the problem in detail.