Tuesday, 18 November 2008

Leadership

Leadership is the art of convincing people that the state of the world is not chaos. Chaos is actually a good thing if guided. It creates change and hence growth. The leader takes and shapes chaos to create the illusion of order.

Why illusion?

Illusion or perception for the reason that order is a goal to strive for and not a destination in itself. Equilibrium, the state of order that most seek is in fact a form of stagnation. The leader leads through creative change, not in maintaining the status quo. The leader and the administrator are thus distinguished. The leader makes waves and alters the course of flow. The Administrator seeks to force an equilibrium. The issue is that it takes more effort to maintain the state of a system then it does to move it to a higher level.

Controlling chaos within accepted bounds is the realm of the leader. This is an skill based on two simple factors:

  • Professional Judgment, and
  • Boldness.
The true difficulty is that simple tasks are the most difficult.

Professional Judgment is purposeful. Boldness is based on calculated risk. Together these lead to a form of stewardship where an leader not only maintains a sound foundation but introduces growth.

What the administrator who seeks equilibrium forgets is that staying in one place is truly moving backwards. This requires that the leader forms obtainable goals and is decisive in this quest.

SQL Injection

SQL injection has three primary goals:

  1. Accessing information,
  2. Destroying data, and
  3. Modifying data.
The goal of the attacker and the likelihood of each will vary dependent on the composition of the organization running the database. The most common form of SQL injection is through the addition of the SQL command, “OR 1=1” to an input field. The addition of this clause to the last part of a query may make the query true.

For example, with a query such as:
“SELECT * FROM users WHERE username = ‘administrator’ and password = ‘password’

An attacker could attempt to add ‘OR ‘’ = ‘ changing the SQL statement to:
“SELECT * FROM users WHERE username = ‘administrator’ and password = ‘password‘OR ‘’ = ‘’

This could potentially allow the attacker to bypass the database authentication.

Monday, 17 November 2008

So you think that your wired keyboard is secure?

We like to state that wireless keyboards are not safe. However, what do you do when the alternative is also insecure. The ability to capture keystrokes through the EMR (Electromagnetic Radiation) monitoring of wired PS/2, universal serial bus and laptop keyboards has been demonstrated.

Martin Vuagnoux and Sylvain Pasini of Security and Cryptography Laboratory at Ecole Polytechnique Federale de Lausanne demonstrated capturing the keystrokes as they were entered into a standard keyboard. They used a large antenna about 20 to 30 feet away in an adjacent room. The method can be used more than 65 feet (20 metres) distant.

This is not new. Tempest hardening standards have been around for decades. It just seems we forget the old stuff...

The US Tempest standards include:

  • NATO SDIP-27 Level A (formerly AMSG 720B) and USA NSTISSAM Level I
  • NATO SDIP-27 Level B (formerly AMSG 788A) and USA NSTISSAM Level II
  • NATO SDIP-27 Level C (formerly AMSG 784) and USA NSTISSAM Level III
  • NATO SDIP-29 (formerly AMSG 719G)
  • AMSG 799B
  • "NATO Zoning Procedures"

For those who believe that this is an expensive and sophisticated attack, Wim van Eck successfully demonstrated an eavesdropping attack against a CRT monitor at a range of hundreds of metres. This was completed using a set of low end electronic gear costing $15 and a television set.

Van Eck phreaking was the result.