ICS Startup SafeMashups Forms MashSSL Alliance

The latest Institute for Cyber Security startup to go live, SafeMashups, Inc., has just announced the launch of the MashSSL alliance. Read the press release below:

MOUNTAIN VIEW, CA--(Marketwire - November 12, 2009) - A consortium of leading technology companies today announced the creation of the MashSSL Alliance, an organization dedicated to evangelizing the use of the MashSSL technology and specification. MashSSL is an innovative way to use the proven and trusted SSL protocol and trust infrastructure to solve the tricky and serious problem of trust establishment between web applications communicating through an end user at a browser. This is a hard problem as the web applications have to assume that the user in the middle could be a malicious hacker or a legitimate user with a malware infected browser.

The founding members of the Alliance include leading SSL certificate vendors Comodo, DigiCert, Entrust and VeriSign; leading providers of security technology and services Arcot, Cenzic, ChosenSecurity, Denim Group, OneHealthPort, QuoVadis, SafeMashups and Venafi; leading security research institutions Institute for Cyber Security, UTSA, MIT Kerberos Consortium and Secure Business Austria, and noted industry security experts.

"Having been both a vendor and security practitioner, what makes MashSSL such an innovative and elegant solution is the fact that it sits on top of SSL at the application layer and does not disrupt the existing ecosystem -- no new crypto protocols to analyze, no changes to the browser and no new types of credentials," said Lynn Terwoerds, Former Head of Security Architecture & Standards, Barclays GRCB, former Senior Security Strategist, Microsoft, and member of the Cloud Security Alliance. "The ability to significantly reduce the risk involved with online collaboration and transactions opens up a whole new realm of opportunities to both product developers and to security practitioners who need to live in a highly virtualized and cloud based world, where applications and data no longer reside in a single location."

"End users' Web experiences, be it in healthcare or any other vertical, are increasingly an aggregation of data and processing from cooperating Web applications that communicate wholly or partially through the user's browser," said Sue Merk, vice president of business development and product management at OneHealthPort, a coalition of health plans, physicians and hospitals that joined together to build a trusted community where business and clinical information could be shared securely. "Unfortunately, a malicious man-in-the-middle attack or a user infected with man-in-the-browser malware can easily subvert such communications. An open standard to solve this universal problem once, and not in a piece meal ad hoc fashion, has been a long time coming. That it is based on the trusted and familiar SSL certificate infrastructure is a bonus."

MashSSL, which was first developed by application authentication pioneer SafeMashups, has now become an open specification with an open source reference implementation, and is in the process of being standardized.

"Using different proprietary security methods and a multitude of quasi-trusted credentials to solve this fundamental problem is clearly inefficient and will lead to administrative errors which underlie many vulnerabilities," said Siddharth Bajaj, Principal in the Innovation Group at VeriSign and steering committee chair of both the MashSSL Alliance and W3C MashSSL XG. "MashSSL repurposes SSL to create a secure application layer pipe through which open protocols like OAuth, OpenID, OpenAJAX, etc., and proprietary applications like payment provider interfaces can flow in a more secure fashion while leveraging the already existing trust and credential infrastructure."

While MashSSL was originally developed for use with newer mashup technologies, it became rapidly apparent that the protocol can be used in any situation where two Web applications need to communicate through a user's browser, where the user may be malicious or the browser infected with malware. Consequently, the potential field of use for MashSSL is very broad, including potentially underlying identity federation protocols, payment button interfaces, etc.

The initial MashSSL specification and open source reference implementation have been made generally available at www.mashssl.org.

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

ICS Facilitating Inaugural ACM Conference on Data and Application Security and Privacy

The Institute for Cyber Security will be facilitating a conference for the SIGSAC in the Association of Computing Machinery in February 2011 in San Antonio, Texas. The conference, called the Conference on Data and Application Security and Privacy (Or CODASPY) will cover topics on cyber security, data privacy, access control, and other fields related to security.

See the announcement below, and at the the CODASPY site.

1st ACM Conference on Data and Application Security and Privacy

February 2011, San Antonio, Texas
Pending ACM Approval

Announcement: ACM SIGSAC announces the creation of a new annual ACM Conference on Data and Applications Security. The inaugural conference will be held in February 2011 in San Antonio, Texas (exact dates and hotel to be announced). With rapid global penetration of the Internet and smart phones and the resulting productivity and social gains, the world is becoming increasingly dependent on its cyber infrastructure. Criminals, spies and predators of all kinds have learnt to exploit this landscape much quicker than defenders have advanced in their technologies. Security and Privacy has become an essential concern of applications and systems throughout their lifecycle. Security concerns have rapidly moved up the software stack as the Internet and web have matured. The security, privacy, functionality, cost and usability tradeoffs necessary in any practical system can only be effectively achieved at the data and application layers. This new conference provides a dedicated venue for high-quality research in this arena, and seeks to foster a community with this focus in cyber security.

Scope: Data and the applications that manipulate data are the crucial assets in today's information age. With the increasing drive towards availability of data and services anytime anywhere, security and privacy risks have increased. Vast amounts of privacy-sensitive data are being collected today by organizations for a variety of reasons. Unauthorized disclosure, modification, usage or denial of access to these data and corresponding services may result in high human and financial costs. New applications such as social networking and social computing provide value by aggregating input from numerous individual users and/or the mobile devices they carry with them and computing new information of value to society and individuals. To achieve efficiency and effectiveness in traditional domains such as healthcare there is a drive to make these records electronic and highly available. The need for organizations and government agencies to share information effectively is underscored by rapid innovations in the business world that require close collaboration across traditional boundaries and the dramatic failure of old-style approaches to information protection in government agencies in keeping information too secret to connect the dots. Security and privacy in these and other arenas can be meaningfully achieved only in context of the application domain. Data and applications security and privacy has rapidly expanded as a research field with many important challenges to be addressed. The goal of the conference is to discuss novel exciting research topics in data and application security and privacy and to lay out directions for further research and development in this area. The conference seeks submissions from diverse communities, including corporate and academic researchers, open source projects, standardization bodies, governments, system and security administrators, software engineers and application domain experts.

Topics: Include but not limited to

• Application layer security policies
• Authorization /Access Control for Applications
• Authorization/Access Control for Databases
• Data dissemination controls
• Data forensics
• Enforcement layer security policies
• Privacy preserving techniques
• Private information retrieval
• Search on protected/encrypted data
• Secure auditing
• Secure collaboration
• Secure data provenance
• Secure electronic commerce
• Secure information sharing
• Secure knowledge management
• Secure multiparty computations
• Secure software development
• Securing data/apps on untrusted platforms
• Securing the semantic web
• Security and Privacy in GIS/Spatial Data
• Security and Privacy in Healthcare
• Security policies for databases
• Social computing security and privacy
• Social networking security and privacy
• Application, data and user trust metrics
• Web application security

General Chair: Ravi Sandhu, Institute for Cyber Security (ICS), University of Texas at San Antonio

Program Chair: Elisa Bertino, Center for Education and Research in Information Assurance and Security (CERIAS), Purdue U.

Local Arrangements Chair: Jeffrey Reich, Institute for Cyber Security (ICS), University of Texas at San Antonio

Program Committee: To be announced

Conference Web Site: www.codaspy.org

Important Dates: To be announced

Interested Volunteers: Contact Ravi Sandhu at ravi.sandhu@utsa.edu or Elisa Bertino at bertino@purdue.edu as appropriate

Erhan J. Kartaltepe, PMP
erhan.kartaltepe-at-utsa.edu

WASC 2008 Web Application Security Statistics

The Web Application Security Consortium (WASC) released its 2008 report on web application security statistics. Reminiscent of the OWASP Top 10, this discusses in detail data on over 12,000 web applications with over 97,000 detected vulnerabilities. Of note is that despite effort to reduce it, cross-site scripting and information leakage still account for the lion's share of web vulnerabilities.

Most startling from their report is the following:

"The analysis shows that more than 13%* of all reviewed sites can be compromised completely automatically. About 49% of web applications contain vulnerabilities of high risk level (Urgent and Critical) detected during automatic scanning."

The full report can be found here.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

ICS in the News: Ravi Sandhu Interviewed by CNN

Ravi Sandhu, executive director for the Institute for Cyber Security, was recently interviewed in an article by CNN on cyber security, privacy, and identity theft. From the article:

"Online attackers have information on millions of consumers," said Ravi Sandhu... "Still, even visiting a legitimate Web site has its share of risks, because online attackers may inject malicious content onto them by hacking them or placing advertisements that deliver malware."

For more on ICS's work on identity theft, cyber security and privacy, visit the ICS site.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Botnets Using Web 2.0 Sites as a Command and Control

In the last month, three botnet command-and-controls (C&Cs) have been spotted in the wild on Twitter and Google Groups. A botnet, perhaps better described as a "zombie network", is a distributed organization of programs that runs in the background of infiltrated computers (laptops, servers, cell phones, etc.) that performs tasks such as information stealing, email spamming, or other types of attacks. Usually these bots try to multiply, to remain hidden, and to scan for private data. Some are more sophisticated than others.

Usually, these bots operate on a peer-to-peer basis, but last month Arbor Networks found a botnet using a centralized C&C via Twitter and Jaiku. Once alerted, they each shut the offending account down, but just days later, a second one was found on Twitter. Meanwhile, just last week, Symantec uncovered a trojan using Google Groups as its C&C in a similar way.

Interestingly, these particular botnet C&Cs were very primitive. More stealthy approaches, such as using steganography to hide bot commands, are not as widely used (or worse, they are and haven't been discovered). With web 2.0 and social networking sites growing in popularity every day, look for more botmasters to abuse these sites in this way.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

MonoTouch: .NET Development for the iPhone

Today, Novell released MonoTouch, the Mono edition for Apple's iPhone and iPod Touch devices. According to the release, MonoTouch allows developers to:

• create C# and .NET based applications that run on the iPhone
• take advantage of the iPhone APIs
• reuse both code and libraries that have been built for .NET
• reuse existing .NET skills

According to Mono leader Miguel de Icaza, MonoTouch brings garbage collection, thread management, type safety, and web services to the iPhone. Sounds like a step in the right direction.

At the Institute for Cyber Security, we develop mobile applications in our incubator and research operations, and iPhone is one of the platforms we target. As we have discussed before, Apple's SDK allows for developers to use Objective-C, which is essentially the C language with message passing (a la Smalltalk) thrown in. While the language is relatively open and limited libraries exist for socket communication, cryptography, and general utility functions, Objective-C is still a lower-level language than C# or Java, although Apple provides an IDE to assist in the creation of applications.

Early on, Sun had wanted to port the its Java virtual machine (JVM) to the iPhone, and had planned to offer it for free at the Apple Store.From the iPhone SDK Agreement:

"3.3.2 — An Application may not itself install or launch other executable code by any means, including without limitation through the use of a plug-in architecture, calling other frameworks, other APIs or otherwise. No interpreted code may be downloaded or used in an Application except for code that is interpreted and run by Apple’s Documented APIs and built-in interpreter(s)."

Short of jailbreaking the device, a virtual machine, Java or otherwise, still isn't allowed on the iPhone. However, while a high-level language like Java would be welcome to the iPhone (Google's Android uses Java, for example), Sun has shown no interest thus far in bringing "J" without the "VM". And Java's largest competitor, Microsoft's .NET Framework, has never considered porting its .NET VM off of a Windows environment.

Mono, of course, has shown exactly that interest, and since MonoTouch uses "ahead-of-time" compiling (i.e., regular old compiling) to transform C# to binary code, it doesn't need a VM to run, giving developers a familiar, high-level language to code for.

Mono sells different versions of its product, but will offer a free evaluation copy later this week. It will be exciting to see how Apple and the development community react to MonoTouch!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Design for Startups: The Aesthetics of Web Apps in 6 Questions

Yesterday, ReadWriteWeb ran an article on a web aesthetics and how important that is for a startup. The article covers questions about trends, aesthetics importance, and meaning signals to users and investors. At the Institute for Cyber Security, we focus on the security and technology of the startups we accept into our incubator program, and facilitate website aesthetics with our graphic design partners. Many of these questions are on the minds of "stealth mode" startup CEOs, but is a great read for any web developer thinking about their website aesthetics. View the article at their site.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Speaking at the Malware 2009 Conference Next Month

Folks in Montreal who are interested in botnet security should plan to attend the Malware 2009 in October. There are a number of great speakers and experts in the field attending, which should be quite an experience.

Members from the Institute for Cyber Security will be presenting on "Analyzing DNS Activities of Bot Processes" during the conference from October 13 through October 14. The talk will cover botnets and bot processes at a high level, then discuss how to apply DNS monitoring to track their activities on a zombie machine, as well as some encouraging results.

Dates: Tuesday, October 13th through Wednesday, October 14th, 2009
Location: Delta Centre-Ville, Montreal, Quebec (888) 890-3222

For more details, go to the conference site.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Opera 10.0 Released

Opera 10 has just been released. Sure, other browsers have released new versions lately as well, but which of them also produced a trailer?

Many of the features introduced are not novel, although welcome nonetheless, adding to the browserscape as a whole. More about the new release can be found in their press release.

Image is Opera's branding for number 10. Much more appealing than its serif "O".

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Amazon Announces Third Annual Startup Challenge

At the Institute for Cyber Security, our Incubator focuses on helping security startups benefit from the expertise and resources of our technical staff. As a result, we're always interested in new ways to advance a startup's mission. And of course, ICS loves contests. So when Amazon announced its new AWS startup challenge, we thought it sounded great!

First prize is $50,000 plus other accouterments provideed by Amazon. More information on the contest, as well as a link to their rules, can be found at their contest site. Maybe after collecting your winnings, your startup can be the next great idea to emerge from the ICS Incubator!

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu