The Digital Dilemma

I take these from various reports my staff compiles from varied sources.

Newfangled cookie attack steals/poisons website creds. A security researcher has discovered a weakness in a core browser protocol that compromises the security of Google, Facebook, and other websites by allowing an attacker to tamper with the cookies they set. The weakness stems from RFC 2965, which dictates that browsers must allow subdomains, such as www.google.com, to set and read cookies for their parent (google.com). The specification also states that if a cookie for a subdomain does not already exist, the browser should use the cookie belonging to the parent instead. The arrangement makes it possible for attackers to steal or even alter the cookies that websites use to authenticate their users. Attackers would first have to identify an XSS, or cross-site scripting, bug in some part of the site they are targeting. But because virtually any subdomain will suffice, the scenario is not unrealistic, two web security experts said. “Most websites actually will store session IDs in a cookie and that’s actually how they keep track of users throughout the use of their website,” said a senior researcher for Foreground Security who first documented the flaw at last month’s Toorcon hacker conference. “Using the same techniques to attack those cookies, I can really damage sessions and cause some problems.” The researcher’s paper goes on to demonstrate

how he used the technique to bypass a feature Google recently implemented to beef up security on Gmail and other properties. By exploiting a minor vulnerability in sites.google.com, he was able to falsify the contents of his global Google cookie. Google has since fixed the XSS hole in the subdomain. Source: http://www.theregister.co.uk/2009/11/04/website_cookie_stealing/

November 3, Data Center Knowledge – (Texas) Power Outage Affects Rackspace Cloud. Rackspace reports that parts of its Dallas data center lost power early today during testing of power distribution units (PDUs) during scheduled maintenance. This resulted in downtime for sites hosted on SliceHost and The Rackspace Cloud, including the leading tech blog TechCrunch, which ensured that the outage was widely noted on blogs and Twitter. The Dallas data center has experienced power problems before, including outages on June 29 and July 7 that prompted the Rackspace CEO to issue an apology to customers and provide a detailed explanation of the outage and the operations of the Dallas/Fort Worth facility. This morning’s problems started at about 12:30 a.m. central time. “We were testing phase rotation on a Power Distribution Unit (PDU) when a short occurred and caused us to lose the PDUs behind this Cluster,” Rackspace reported on its blog. “All power has been restored and devices are being brought back online. The PDUs were down for a total of about 5 minutes. We have aborted the maintenance for the remainder of the evening and will reschedule this for another date.” Althought the PDUs were offline for only 5 minutes, many customer sites were unavailable for a longer window. Most sites returned to service by 2 a.m., while several cloud servers continuing to experience problems until after 5 a.m., according to a timeline on the Cloud Servers status blog. The Rackspace DFW data center in Grapevine, Texas is the company’s largest facility, with 144,000 square feet of space. The facilty in Grapevine figured into a 2007 power outage that interrupted service for many prominent web sites. In that incident, a vehicle struck a power transformer, and public safety officials turned off both the facility’s power feeds during their emergency rescue operations. Source: http://www.datacenterknowledge.com/archives/2009/11/03/power-outage-affects-rackspace-cloud/

November 3, Network World – (International) Hackers exploit Google Wave’s popularity. Hackers are exploiting web users that were too late in signing up for Google Wave, says Symantec. According to the security firm, web users worldwide are being encouraged to download an application that claims to offer access to Google Wave – a new invite-only online tool for real-time communication and collaboration. However, the application is in fact malware, which allows hackers to potentially steal senstive personal data from your PC. A security analyst for Symantec said: “Cybercriminals have used Google Wave for the bait precisely because of current its popularity. Furthermore, using a trusted brand like this increases the chance of success for the attacker. Unfortunately, this technique is something fraudsters use all the time and internet users should be wary – if something appears too good to be true, then it usually is.” The security firm urged web users to be careful when clicking on links, only download software was from a reputable source and ensure your security software is up-to-date. Source: http://www.networkworld.com/news/2009/110309-hackers-exploit-google-waves.html?hpg1=bn

October 29, Computer World – (National) Amazon downplays reports of vulnerabilities in its EC2 cloud service. Amazon says it has taken steps to mitigate a security issue in its cloud computing infrastructure that was identified recently by researchers from MIT and the University of California at San Diego. The report described how attackers could search for, locate, and attack specific targets in Amazon’s Elastic Computer Cloud (EC2) because of certain underlying vulnerabilities in the infrastructure. Though the attack described in the report was conducted against Amazons infrastructure, the researchers concluded that similar targeted attacks could be carried out in other cloud services as well because the vulnerabilities were generic. In response, an Amazon spokeswoman said on October 28 that the report describes cloud cartography methods that could increase at attacker’s probability of launching a rogue virtual machine (VM) on the same physical server as another specific target VM. What remains unclear, however, is how exactly attackers would be able to use that presence on the same physical server to then attack the target VM, she told Computerworld via e-mail. The research paper itself described how potential attackers could use so-called “side-channel” attacks to try and steal information from a target VM. The researchers had argued that a VM sitting on the same physical server as a target VM, could monitor shared resources on the server to make highly educated inferences about the target VM. Source: http://www.infoworld.com/d/cloud-computing/amazon-downplays-reports-vulnerabilities-in-its-cloud-service-994

As more and more people get excited about Network Enabled Outsourcing, I am going to post cloud related issues and aggregate them with the cloudwatch TAG.  I encourage anyone who blogs to do the same.  I don’t think there is a central place that really looks at the custodial, legal, and availability related issues about outsourcing today.