Defeating Hackers and Malware With Disorder

Entropy — the measure of disorder or randomness — isn’t always desirable in the world of IT security. Kinda, sorta patching your IT systems sometimes, for example, would be a bad thing. At times, though, entropy can be a powerful tool, as in the case of well-chosen passwords that are difficult to crack. A fast-growing SIEM (security incident event managment) company called Vigilant is using entropy in an innovative way that warrants a closer look: Its anomaly-detection service identifies malicious threats based on entropy.

First, a quick primer: Entropy, often measured in bits, is the technical measurement of the randomness of the next piece of data in a string. If you see a sequence of letters with a clear pattern, such as “ABABABABA,” you would logically predict the next letter in the series will be B. Because the answer is fairly certain, the entropy would be 0. If you’re flipping a coin, the predicted outcome, heads or tails, is considered to be 1 bit of entropy. If a native English speaker is shown a sequence of standard English text and is asked to predict the next letter, he or she could guess it with great accuracy. English text is considered to have an entropy of 0.6 to 1.5 bits.

One more example: A truly random 8-character password, using every possible character on a standard keyboard, could have 52 bits of entropy. Unfortunately, most people use common words as part of their passwords, so most have only 18 bits of entropy. Thus, a password cracker doesn’t need to work through every permutation, just the most likely ones in the range of 2¹⁸, which is far easier than 2⁵². (Read Appendix A and Table A.1 of NIST Special Publication 800-63 for all the nerdy calculations and details.)

In the realm of IT security, antispam services have long used entropy and its link to anomaly detection to sniff out unwanted messages. If the service detects a single email account sending out messages to thousands of seemingly random and unconnected addresses, the provider will usually examine the message for other indicators that it’s spam. Entropy and its link in anomaly detection isn’t new, but Vigilant has extended it further to fighting malware.

Malware often generates random file names when writing Trojans to the system directory. When I perform light forensic analysis on a Windows machine, my first clue that it’s been compromised is one or more very strange-looking file names, such as vx3kjngq.exe or bb9[qamz.exe, in the Windows/System32 folder. Many malware programs use nonrandom names, but enough use randomly generated names that high-entropy filenames are a fairly good — if only rudimentary — indicator of something bad. (If you want to perform an experiment on your system, look for high-entropy file names in unexpected places, such as Windows/System32 or a root folder. Not every extremely weird name is a sign of maliciousness — but it’s a consistent characteristic.)

Vigilant has figured out that the average domain name has from 2.5 to 3.9 bits of entropy per byte. The company’s analysis algorithms flag DNS domains with more than 4.0 bits of entropy per byte; it also looks for less frequently occurring top-level domains, such as .biz and .info, with less entropy.

Vigilant’s services also looks for high-entropy file names and network connections to unexpected locations. But perhaps my favorite Vigilant check is for high entropy within HTTP content. Most HTTP content is close to the English language (or whatever native language is used) and should have low entropy. Encryption, on the other hand, has — or should have — high entropy. In fact, good crypto should have such high entropy that its encrypted ciphertext is indistinguishable from “noise.” Vigilant knows that advanced persistent threats often send out victims’ data in encrypted form using HTTP versus the normally expected encrypted HTTPS. If Vigilant’s service sees an outbound data stream using HTTP with high entropy, it raises a red flag.

Again, Vigilant isn’t the first company to use randomness in its anomaly detection, but it’s the first company of which I am aware that looks for, measures, and alerts of entropy characteristics. Sure, the company does all the traditional anomaly detection, but I like the fact that Vigilant uses mathematics and expected probabilities to add in another type of measurement.

Continue Reading»

HTTPS Everywhere Update: Now Reports Website Weaknesses

HTTPS Everywhere, a collaborative security project produced by The Tor Project and the Electronic Frontier Foundation (EFF), has been updated to identify security weaknesses in websites visited with Mozilla Firefox.

The new optional feature, called the “Decentralized SSL Observatory,” detects encryption weaknesses in websites and notifies users about said weaknesses. Such weaknesses can be used by hackers to snoop on users’ web activity or pose “man in the middle” attacks against the browser.

“In recent weeks, an unexpected weakness in the encryption used by many routers, firewalls and VPN devices made big news,” EFF Technology Projects Director Peter Eckersley said in a statement.

“The new version of HTTPS Everywhere for Firefox will let users know when they connect to a website or device that has a security problem–including weak key problems like the ones that were disclosed two weeks ago–giving people the information they need to protect themselves.”

The security flaw in network devices was discovered earlier this month by security researchers. They found that four out of every 1000 security keys generated for protecting webmail, online banking, and other sensitive net services provide no cryptographic security. It’s estimated that more than a million Internet sites use such technology to prevent eavesdropping.

The EFF also released a beta version of HTTPS Everywhere for Chrome.

Continue Reading»

Cisco Innovates to Provide More Nimble Network Security

At a special media event hosted by Cisco at the RSA Security conference in San Francisco this week, the company unveiled a new vision for network security. Cisco is deploying new security technologies adapted to meet the needs of an increasingly diverse and mobile network.

Between the BYOD trend, and the need to allow various partners, suppliers, contractors, and others to access the network in some limited capacity, businesses need finer control over access permissions. The problem is that most of the security tools available today do not provide enough control, so many organizations are being forced into a choice between security and productivity.

Cisco is providing tools that allow for productivity without compromising security.Speaking to the media, Chris Young, senior vice president for Cisco’s Security and Government group, explained that Cisco is equipped to meet the security needs of tomorrow by integrating security into the network fabric. Young also stressed that Cisco has a responsibility to incorporate security at the network level due to how much of the critical infrastructure of the nation is riding on Cisco equipment.

The devices used to connect and access information are more diverse, and the ways data is accessed and used may change, but one thing stays the same at the core: the network. Somehow or another, all of the information is still being passed over, on, and through network hardware.

Cisco’s own CSO, John Stewart, is also a Cisco customer in many respects, and needs tools to meet evolving security needs just like any other security admin. He said that what he needs from security tools is the ability to be highly nimble. He described scenarios where, whether the need is to allow an activity or device for a business need, or to block an activity or device for a security need, the overriding driver is to respond quickly. He needs security tools to be adaptable and agile.

To meet those needs, Cisco announced TrustSec 2.1 with some new features and functionality. New active scanning provides more accurate device identification to automatically determine what a device is so appropriate policies can be applied. Cisco also introduced new security group access technology features in its Identity Services Engine (ISE) platform that make it simpler to define and assign policies without having to exert so much manual effort to configure the network to enforce it.

In addition, Cisco unveiled a new line of ASA CX firewall appliances, which include the Cisco SecureX Framework for context-aware security. Cisco explained that many network security appliances can identify mobile or Web apps, but that often the controls are too blunt. For example, an organization may want to allow Facebook, but not FarmVille, or sharing video clips with friends.

Cisco is promising to provide very granular, context-sensitive control over what is acceptable. The ASA CX software provides visibility not just that iTunes is being used, but which devices are being used to connect to iTunes, and what types of content on iTunes is being accessed. Armed with that information policies can be built to block or allow activity at that level as well.

Instead of assigning access rights simply by group or even for an individual user, Cisco envisions granting access based on context and state. A user might have one set of access rights from the desktop PC at work, a different level of access when connecting over VPN from a home PC, and more limited rights when connecting from a smartphone or tablet over a public Wi-Fi network.

The demonstrations given by Cisco were impressive—but I always take such events with a grain of salt. How a product works in a managed scenario on stage, and how it works on your network in the real world are often too very different things. The new Cisco products are available starting today. Check them out and judge for yourself.

Continue Reading»

Samsung Series 7 Chronos: Pretty Without Breaking the Bank

If you’re looking to satisfy your craving for brushed-metal exteriors, look no further than the mesmerizing 14-inch Samsung Series 7 Chronos. The machine’s subtle minimalism and smooth curves may suggest a MacBook Pro wannabe, but it bears the comparison quite well.

The Series 7 Chronos is a very pretty machine. The cover, bezel, and wrist rest are adorned in gunmetal-gray brushed aluminum, and the keyboard deck and trackpad are free of unnecessary lines or buttons. Even the power button is stylish, with just the chrome-covered symbol raised up.

The system does have a couple of minor design flaws. First, the curved bottom of the computer is made of plastic, so there’s a thin line around the edge of the keyboard deck where the plastic meets the aluminum. And second, the backlit keyboard features two-tone keys with black tops and white edges, which allow for a lot of light to seep through. Another consideration: For a slim 14-inch machine, it’s surprisingly heavy (5.3 pounds with accessories), but on a positive note the entire machine feels rock-solid.

Our review model, priced at $1100, sports an Intel Core i5-2430M processor, 6GB of RAM, and a 750GB hard drive. It also comes with Bluetooth, a built-in webcam and microphone, and Wi-Fi, as well as switchable graphics (with a discrete AMD Radeon HD 6490M graphics card). Our test model ran the 64-bit version of Windows 7 Home Premium.

The Chronos’s performance was somewhat disappointing. In our WorldBench 6 benchmark test suite, the Chronos finished with a mark of 118, which is a few points lower than the average score posted by other all-purpose laptops we’ve tested recently–and several points lower than the 125 turned in by the much thinner Asus Zenbook UX31E. Chalk that up to the Chronos’s lack of a solid-state drive. The laptop’s battery life was a little better than average for its class, clocking in at around 6 hours.

Samsung arranged the Chronos’s ports in an array typical of a slim machine such as the MacBook Air or an Ultrabook, but of course the Chronos isn’t that slim. You get two USB ports (one 2.0 and one 3.0), an HDMI out, a mini DisplayPort, an ethernet port, a combination microphone/headphone jack, and a lock slot. Because the laptop curves underneath, the ethernet port is hinged to accommodate a full-size connector. Samsung also provides a four-in-one memory card reader, a slot-loading DVD-RW drive, and an included VGA adapter that plugs into the mini DisplayPort slot. For additional networking, the Chronos offers built-in Bluetooth 3.0 and Wi-Fi 802.11b/g/n.

The Chronos comes with a 14-inch matte LCD screen, with a native resolution of 1600 by 900. Matte screens do a nice job of reducing glare, but they often cause images to look less crisp and to have softer edges. Nevertheless, images on the Chronos’s screen looked sharp enough, and color representation was good, though a little oversaturated at times. The screen was sufficiently bright for comfortable use in direct sunlight. Unfortunately, Samsung turns the auto-brightness setting on by default, which I found annoying because the sensor is extremely sensitive. Unless you’re working in extremely consistent lighting the screen will flicker often as it alters its brightness level.

Video looked and sounded merely okay on the Chronos. In my multimedia tests, the laptop streamed HD video seamlessly but with occasional artifacts (blockiness) in the clips, especially during dark scenes. In PCWorld’s Far Cry 2 graphics tests, the Chronos managed an acceptable frame rate of 37.8 frames per second (at low quality and 1024-by-768-pixel resolution), and a less-than-ideal frame rate of 22.1 fps (at high quality and 1024-by-768-pixel resolution).

The Chronos’s speakers are adequate for basic multimedia consumption, but I wouldn’t recommend them for audiophiles or DJs (even dorm-room DJs). The audio was acceptable, but the speakers had little bass, a tinge of tinniness, and a slightly muffled quality. The speakers’ maximum volume is fairly low.

Overall, the Samsung Series 7 Chronos is a very attractive machine. Unfortunately, looks can take you only so far, in laptops and in life. The Chronos is larger, heavier, and a worse performer than some Ultrabooks, but it’s a great budget-friendly choice for Windows users who lust after MacBook Pros.

More Info

Continue Reading»

Lumzy for Web Design

When thinking up ideas for new software or websites, wireframes often come in handy because they let us iterate through ideas quickly, focusing on substance rather than style (which comes later). Lumzy is a Web-based wireframing tool that is offered for free, and can be used as a gentle introduction to the art of wireframing.

Lumzy offers a basic collection of UI controls for showing interface ideas, but lacks the polish of its commercial competitors.Lumzy’s layout is typical of wireframing tools with a Controls toolbar lining the left edge of the window, and a canvas. To create your mockup, drag interface elements from the toolbar onto the canvas, and then resize them and fill them with content. Much like commercial competitor Balsamiq, Lumzy includes a quick-search function letting you find the control you need without having to scroll through dozens of controls manually.

Beyond its attractive price, Lumzy distinguishes itself by emphasizing interactivity. Many wireframing tools let you link screens (so that clicking a sketched “button” leads to another screen), but that’s usually as far as they go. Balsamiq embraces this limitation on purpose, but Lumzy bucks the trend, offering more sophisticated interactivity features. For example, you can specify what happens when the user clicks a line in a list control: Lumzy can pop up an alert, show a page as a pop up, go to another page of the mock-up, etc.

Other parts of the application do not feel as well developed. Unlike Balsamiq, Lumzy does not offer “live guides” that elements snap to for easy alignment (it does include toolbar buttons for alignment, though). There is also no way to nudge elements around using the keyboard. Graphics are very basic, but that’s to be expected with a wireframing tool.

Offering a limited or focused feature set is fine, especially when it comes to a free product. But Lumzy also behaved unexpectedly at times, which is less understandable. When I clicked the Duplicate button to create a copy of an element, it worked right in the first time, creating a duplicate that was slightly offset from the original (so I could see it’s a copy). Further clicks duplicated the object without changing its position, making it seem like duplication isn’t working and creating a stack of identical objects. When testing Lumzy’s real-time collaborating capabilities, my colleague could see the initial view of the screen, and chat worked, but any changes they made were not reflected on my side (and vice versa).

Despite these technical glitches and shortcomings, Lumzy is serviceable for basic wireframing work. If you are still trying to decide if wireframing is for you, or if you have a specific and small-scale mockup you’d like to communicate, try Lumzy out. It won’t cost you anything, and if your design isn’t complex, it can get the job done.

Continue Reading»

Balsamiq Mockups for Desktop

We use software all the time, and so it only makes sense that we all have ideas about what it should look like and how it should work. Balsamiq Mockups ($79 for a single-user license; discounts available in volume packs) is a rapid wireframing tool. It lets designers, developers, and other stakeholders all take part in the design process of a new application or website.

Balsamiq comes with dozens of common UI controls for fleshing out interface ideas quickly.It is almost impossible to discuss Balsamiq (the product) without introducing Balsamiq (the company). Balsamiq was founded in March 2008 as a one-man company with a manifesto that starts with “focus, focus, focus.” Its founder, Peldi Guilizzoni, made a splash with unorthodox tactics such as sharing his revenue numbers early on (even when they were very low) and not taking any outside investment. The company experienced an impressive growth spurt, made over $4.5 million in the first thirty months of business, and now lists twelve employees on its website.

The website, as well as the application, feel decidedly familial. The application’s Help menu has an entry that reads “What should I make for dinner?” Clicking it takes you to a page on the company website where employees share cooking videos.

All of this serves to show that Balsamiq is an application with real character. This is important, because its basic functionality is similar to that of Java-based WireframeSketcher ($75) and Web-based tool Lumzy (free).

That is not to say it’s not good: Balsamiq is very good at what it does, which is letting you jot out interface ideas quickly and with minimum fuss. The application feels polished, and usually stays out of your way. It comes with dozens of widgets such as a search box, tabs, a browser window, and more. If you can’t find a widget you need, Balsamiq also offers Mockups To Go, a simple website with over a hundred widgets which you can download and use freely. There’s no search function, though, so prepare to rummage through the site category by category.

You can add widgets to the canvas using a quick-add tool: Just start typing “button,” and the tool instantly pops up several suggestions. Now just pick the one you want, hit Enter, and it appears on the canvas. You can either drag it into place, or add several widgets in rapid succession and then move them around to build the interface you need. Widgets that contain text support a simpleMarkdown-like syntax, so it’s easy to simulate hyperlinks and make text bold or italic.

When moving widgets around, smart guides appear, much like those used in Adobe Illustrator, CorelDRAW and other drawing applications. You can use these to align widgets effortlessly. Like many other wireframing tools, Balsamiq purposely uses a hand-drawn look, for a result that “no one is afraid to criticize” (because it doesn’t look like a polished mockup that took hours to make).

While Balsamiq doesn’t offer real-time collaboration, it does support change detection: You can share a Balsamiq file with a remote user using Dropbox, and the application will detect when the file changes and offer to reload it. This way you can both have the file open while you’re on the phone or Skype, and each can make changes in turn. Beware of conflicts, though: Make sure only one of you is editing at any given time.

If you are just starting out with wireframing tools, $75 may be a bit steep (especially given free alternatives such as Lumzy). But if you are already drawing interfaces and are looking for something with more oomph, you should at least take Balsamiq for a 7-day trial spin.

More info at PCWorld

Continue Reading»

How to Overclock Your Graphics Card

Overclocking your graphics card will increase performance and potentially stave off an expensive upgrade. We’ll show you how to do it.

Many PC gamers eagerly await the release of next-generation graphics cards, hoping that the new hardware will boost frame rates and enhance eye candy in the latest games. However, while a graphics card upgrade is almost always a good way to increase game performance or improve image quality, new cards tend to be expensive–and they aren’t always necessary.

Today, even midrange graphics cards are generally fast enough to pump out buttery-smooth frame rates in cutting-edge games at all but the highest resolutions. If your current graphics card is serving you well, and you’re just looking for a little something extra to increase performance, overclockingmay be the better way to go. And it will certainly be more affordable.

Why Overclock?

In its early days, overclocking may have been a black art reserved for the most hard-core computer geeks, but nowadays it’s about as easy as can be, and it’s usually safe too. Yes, overclocking a component can shorten its life span. But if you don’t push things too far, and if you keep temperatures under control, you have little reason to worry.

You’ll want to make sure that your system has adequate cooling and a power supply that’s sufficient for handling an overclocked card. Modern graphics cards typically have thermally controlled fans that will spin faster to better dissipate heat from the overclocked board. The card may become somewhat noisy as a result, but if the overclock remains stable and the graphics card’s cooler can keep up, you should be good to go.

Both AMD and Nvidia (the big two graphics-card makers) have built overclocking tools into their drivers. AMD’s are readily available (on supported cards) in the AMD Overdrive tab, listed in the Performance section of the company’s Catalyst Control Center software suite. Nvidia’s overclocking tools aren’t exposed by default in its GeForce drivers, but installing its System Tools utility will make them available. You’ll need to grab the Systems Tools utility from the Nvidia website; once you’ve installed the utility, frequency controls will be visible in the performance and tuning section of the GeForce driver.

Disregarding software/driver optimizations, game engine tweaks, and system interface speeds, the performance of a graphics card is typically determined by the compute speed and fillrate of its graphics processing unit, as well as by the amount of memory bandwidth its frame buffer memory affords. (The amount of frame buffer memory on the card can also come into play as resolutions and texture sizes increase, but that’s a discussion for a different article.) By increasing the frequencies of the GPU and the frame buffer memory on your graphics card, you can make them process and move more data, more quickly, increasing overall performance.

How to Overclock

Overclocking a graphics card is a fairly straightforward process. All you need is a working and properly configured graphics card, and a few of your favorite games or a benchmark like Futuremark 3DMark 11 to test stability. For the purposes of this article, we used a brand-new AMD Radeon HD 7950 installed in a high-end, Intel-powered test rig running Windows 7 Ultimate (64-bit).

Before you begin overclocking, install the latest drivers for your graphics card (and Nvidia’s System Tools if necessary), and play a few games to ensure that the system is stable. If all is working well, restart the system, open the graphics card’s control panel, and navigate to the overclocking or frequency control section; we used the Overdrive tab built into AMD’s drivers.

First, enable Overdrive by ticking the necessary box, and max out the power control settings to eliminate any power-related frequency restrictions. Next, increase the GPU frequency by moving the appropriate slider by a few MHz at a time, and apply the settings. Then, play a game or loop a benchmark to test stability.

For example, our Radeon HD 7950’s GPU was clocked at 800MHz by default. We started by moving the GPU clock settings slider in 10MHz increments, until our test system became unstable. That is, once we encountered any visual anomalies, or a game or the system crashed, we turned the GPU frequency back down by 10MHz and tested for stability again. Ultimately we settled on a stable GPU frequency of 1000MHz–an increase of 200MHz over stock.

With our peak GPU frequency known, we set it back to its default clock speed and then focused on the graphics card’s memory. By default, the Radeon HD 7950’s memory is clocked at 1250MHz. We used the same procedure of increasing the memory frequency by 10MHz at a time, testing stability each step of the way. In the end we achieved a stable memory frequency of 1500MHz.

We recommend overclocking the GPU and memory individually to isolate any instability that the tweaks may introduce to that particular component. Once you know the peak frequency for both, set the GPU and memory to those speeds simultaneously and test for stability once more. If all is well, enjoy your newfound performance. If not, back the frequencies down a bit further for both, and test the graphics card again. I must also point out that some graphics cards may remain stable while overclocked, but offer lower performance when running at higher frequencies due to thermal or power throttling. If your system remains stable but the performance degrades while you’re overclocking, reduce the GPU and memory frequencies until performance begins to scale properly.

The Result

To give you an idea as to how overclocking affects a Radeon HD 7950’s performance, we ran a handful of benchmarks on our card while it was configured a few different ways. First, we ran a set of benchmarks on the card while it was in its stock configuration. Then, we overclocked the GPU from 800MHz to 1000MHz and ran a second set of numbers. Next, we overclocked only the memory from 1250MHz to 1500MHz, and ran another set of tests. And finally, we retested the card with both its GPU and memory overclocked in concert.

Note that we performed all of the benchmark tests at a resolution of 1920 by 1200, with 4X MSAA enabled and all in-game graphical options set to their maximum values. We chose those relatively taxing settings to ensure that the graphics card–not another component, such as the CPU or RAM–was the performance bottleneck in our test system.

Our testing results, using a Radeon HD 7950. Results for FarCry 2, Lost Planet 2, and Alien vs. Predator are in frames per second.

As you can see in the chart above, with the Radeon HD 7950, overclocking the GPU had a larger impact on performance than overclocking the memory did. Boosting the GPU frequency by 25 percent resulted in performance increases of 6.96 percent to 8.95 percent in the applications we ran. Increasing the memory frequency by 20 percent also yielded better performance, but the improvements were much smaller, falling in the 1.39 percent to 3.91 percent range.

Note, however, that memory-bandwidth-starved graphics cards would benefit more than the Radeon HD 7950 did from memory overclocking. A stock Radeon HD 7950 already offers upwards of 240 GBps of memory bandwidth–much more than most lower-end cards supply–so adding a few more gigabytes per second didn’t help much. That said, overclocking the GPU and memory simultaneously yielded performance increases much larger than the sum of the two overclocks: With both the GPU and memory overclocked, the Radeon HD 7950’s performance increased by at least 20 percent across our tests.

The proportionally larger performance increases that result from overclocking the GPU and memory concurrently are the result of the GPU being more fully utilized. Increasing memory bandwidth while simultaneously overclocking the GPU allows data to pass to and from the GPU more quickly, which results in better resource utilization and in turn increases performance.

Going the Extra Mile

While you can gain plenty of additional performance simply by moving a few sliders in your graphics card’s driver control panels, third-party utilities such as MSI’s Afterburner give users the ability to take overclocks even further by introducing voltage tweaks into the equation. Without performing any cooling modifications, however, we advise against altering your graphics card’s voltages. Increasing the voltages may allow for even higher overclocks, but doing so will also drive up heat output and power consumption significantly, over and above the increases resulting from the higher frequencies alone.

Continue Reading»