Aerohive, Euclid partner on using Wi-Fi to decode shoppers' behavior 

Source: http://www.networkworld.com/news/2013/011513-aerohive-euclid-265838.html

Is it well designed and implemented? At first sight it is, but is it temper proof against malicious activities? I'm not that sure...

Copy/paste from the AeroHive Solution Brief

Every Wi-Fi radio sends out standard probe signals searching for a Wi-Fi access point (AP) to attach to. The Aerohive AP detects that probe, “anonymizes” the unique MAC address by using a cryptographic hash function (or “hash”) then encrypts the data for transport to the Euclid cloud platform for processing. From that point, Euclid advanced heuristics use several different factors – including signal strength, ping frequency, and proximity to other access points (if any) – to determine the phone’s approximate location including if it is inside or outside the retail store, and then employs proprietary algorithms to create the analytics information used by business operations.

The Aerohive Cloud Services Platform connects to the Euclid cloud through a secure JavaScript Object Notation (JSON) connection to retrieve and present the resultant analytic information in a simple screen in our HiveManager Online cloud application.

As Security practitioner I am always wondering whether an implementation hasn't any weaknesses that would allow for  malicious activities to take place. In this case my concerns would be that as this solution is not using RFID, but MAC addresses, what about someone sitting in front of my store and constantly forging MAC addresses? 

Examples of tools to change MAC:

• on GNU/Linux: macchanger, or even ifconfig...
• on MS Windows: etherchange (run from the command prompt, thus easy to script), 
• on MAC OS X: sudo ifconfig en0 Wi-Fi <New_MAC> (Lion) or sudo ifconfig en0 ether <New_MAC> if the former is not working.
• myself I would opt for scapy (src_mac and the like) and Python, but any ifconfig trick can be scripted.

The other concern is the business model. Statistics are sent to Amazon AWS Cloud services in a secure manner, fine with me... But in the case of a DOS (MAC forging and flood) the collected data becomes irrelevant, and the amount of useless data shall increases the cost of the solution (AWS services fees are rather complicated to understand I must admit). 

Are they any protection (counter)measures available against such issues? 

Threshold on the AP, or when data are mangled on the Amazon's side? 

What about sending inexistant MAC OUI ? Is the "input" sanitized? (maybe, see the above figure which states that "Data is processed, cleaned and stored securely"). 

Well, they are for sure more concerns, but these are just the ones that are on top of my head at time of writing...

Oh yes! A "funny" one... Imagine anon distributing a DDOS program that would intentionally send the exact same MAC address for a given period of time, then generate a new one or fetch it from a C&C server and do it all again and again. I guess the statistics will become just a nice piece of (well, you got the idea I presume).

I hope that I am all wrong with my assumptions. I really like the AeroHive technology... Actually, this is maybe why I am affected and therefore writing this post ;-)

 

 

The Scrap Value of a Hacked PC, Revisited

Interesting post that explain simply and visually to the sort of computer user who can’t begin to fathom why miscreants would want to hack into his PC. “I don’t bank online, I don’t store sensitive information on my machine! I only use it to check email. What could hackers possibly want with this hunk of junk?,” are all common refrains from this type of user.

http://krebsonsecurity.com/2012/10/the-scrap-value-of-a-hacked-pc-revisited/

Comparison of MDM Providers

A comparison among the various Mobile Device Management providers.

http://enterpriseios.com/wiki/Comparison_MDM_Providers

Vyatta: open source network operating system

Something I will play with, once I will have some time left...



Copy&paste from their Web site http://www.vyatta.org/:




"The free community Vyatta Core software(VC) is an award-winning open source network operating system providing advanced IPv4 and IPv6 routing, stateful firewalling, IPSec and SSL OpenVPN, and more. When you add Vyatta to a standard x86 hardware system, you can create an enterprise grade network appliance that easily scales from DSL to 10Gbps. Vyatta is also optimized to run in VMware, Citrix XenServer, Xen, KVM, and Hyper V, providing networking and security services to virtual machines and cloud computing environments."

Hotmail and Outlook Cookie Handling Vulnerability

Vulnerability allow attacker to Hijack Hotmail and Outlook accounts...

Read more on http://thehackernews.com/2012/12/hotmail-and-outlook-cookie-handling.html

SELinux Raises the Bar Against Intruders: An Introduction

SELinux: "This series will show what SELinux is and what it offers to each user."

I will watch this site for the next articles as I found the first one pretty interesting.

http://resources.infosecinstitute.com/selinux-bar-against-intruders-intro

Compressing PDF files

Adobe Acrobat allows for managing PDF files but it is a bit expensive if you are not using it on a regular basis.
MAC OS X allows for PDF files creation as well, e.g., via the "Print" menu and "Options" (PDF of course).
So what? Well... The issue is that - very often - a PDF file can be rather big in size when generated from within MAC OS X using the default and provided tools. Once sent via Email, message's size restrictions may apply (usually 10 MB) and your message may be bounced if the file is reaching this limit.
This can be particularly annoying when sending PDF attachments like work certificates, certifications and the like as it would upset the receiver who will have extra work to do to consolidate all the PDF files you sent. Furthermore, sending all the documents in a single email message is easier to fold and - if need be - to retrieve for the receiver.

A solution would be to create a ZIP archive with all the PDF documents and attach it to your email message. So far so good but the sum of all the ZIP'ed documents might well exceed the 10 MB limit, still... So, you must find a workaround and there is one that I like as it can be used not only for fixing this email's size limit but also saving some disk space on your hard drive: I am used to keep documents in PDF format for later reading or references but their resolution is rather high, as their size. Most of these documents will never be printed. I am therefore using this trick for these files.

MAC OS X "Quick Look" can compress PDF files. Lauch Quick Look against a PDF file. From the "File" menu, use "Export" but opt for the "Reduce File Size" Quartz filter option.

It is working but the quality is not that good, and sometime hardly readable.

The solution? Install additional Quartz Filters. An excellent set of free filters created by Jérome Colas http://jed.iconus.ch/wp-content/uploads/2010/01/jcolas_filters.zip (Jérome's filters were previously hosted on idisk but as this service has been closed, some people are offering the same archive for download: jed.iconus.ch is one of them, thanks a lot)

For Snow Leopard and older versions, extract the ZIP archive to the user's Library. Restart Quick Look to enable the new filters.

For Lion and above, extract it to System's Library into the PDF Service folder.


A quick recap of what the library folder is and why you might want to access it. Mac OS X actually has three different Library folders:

1. One located at the root of your hard drive
2. One located in a folder called System at the root of your hard drive
3. One located in every user’s home folder

To access the system's folder.
In the Finder use the "Go" menu  or simply press Command-Shift-G to bring up the Go to Folder dialog. To access the User Library, type in ~/Library and click Go. It is possible to type the path to any folder into this dialog. To access the System Library, type in /Library (without the ~).

Using the new Quartz Filters in Quick Look (Export menu)
Don't hesitate to experiment a bit first with a test PDF file...

Note that the Colorsync application can be used to create your own filters.