On October 23, 2008 I gave a talk at Netspeed 2008 titled Hackers in the Library. The talk was designed to build awareness regarding information security threats in libraries and to dispel the myth that “nobody would want to hack a library.”

In this presentation I tell many stories of actual security incidents that I have encountered in various libraries and punctuate these stories with reports from the media of similar events in libraries around the world.

The slides for the presentation are now available for download in MS Powerpoint (PPT) format. The slides include embedded notes covering the content of my speech and additional commentary and links. I have also included some questions and answers that have come up after the talk.

On Monday, November 19, 2007, David Litchfield will be releasing the Database Exposure Survey for 2007 on his databasesecurity.com website. According to CIO.com, Litchfield estimates that there are roughly 500,000 database servers on the Internet that are openly accessible (with no firewall protection).

I believe many sysadmins overlook database security believing that “no one knows its there so how could be attacked?” It’s a foolish notion. I think other admins believe that database servers are no vulnerable to attack in the same way that other services are. We hear about worms and trojans targeting desktop users, IM clients, and web applications, but less often we hear about buffer overflows in server applications. However, vulnerabilities in RDBMS services do occur, and often enough to make you worry. Remote code execution is a potential problem for any services that you can connect to directly.

Even if your database server is patched-up you have to worry about accounts on the database server. Do all your database users accounts have passwords? I have seen poor password selection on database accounts far too often. It makes my skin crawl actually. It’s hard to explain to programmers sometimes why password choice is important or sometimes even why passwords are necessary at all.

Many people believe that database servers are “behind the scenes” and inaccessible to Internet. Litchfield’s survey demonstrates how often that assumption is wrong.

Defense-in-depth applies to database security as much as any other network service:

• You need a firewall configured to deny access to your database server except to the few people that really need to connect.
• Ever account on your database should have a non-empty password and it should be a strong password.
• Accounts should have limited access to database. Read-only access should be your default. No account should have access to all your database unless necassary.
• You should monitor database access. Do you have logs showing which users logged in and when and from where?
• When put together, “limiting account access” and “monitoring” mean you should be able to tell who accessed which database from what application. Each web application should use a different account to access your databases (at the very minimum).
• Finally, you should have a process for auditing data integrity. Would you be able to tell if data in a database had been inserted or if data was invalid or inconsistent?

Nearly a year ago I bough a portable wifi router to take with me when I go to conferences etc. When I am in a hotel or at a friend’s house, it is very handy to use secure wifi instead of having to drag around a long ethernet cable to connect my laptop to the Internet. I bought a little Linksys WRT54GC “Compact Wireless-G Broadband Router” for that purpose.

I was disappointed when I could find no place to attach an external antenna. I have a couple of 7db antenna and a directional antenna that I can use the boast the range of wifi, but I couldn’t not find any place to plug it in. Well, the morning I was staring at my WRT54GC and noticed a weird plastic thing that looked out of place. After a few minutes of picking at it, I discovered a secret antenna socket underneath!

If you are looking at the lights on the front of the WRT54GC and holding it horizontally (laying it flat), the plastic cover for the antenna connector is on the right-hand side. If you pry up on the rounded edge of that plastic cover, it will open like a door, and reveal a connector that will pop out. It is a mini-BNC style connector.

Now you can attach the antenna of your choice!

I have posted a complete set of photos on flickr showing in more detail how to reveal the hidden antenna connector.

In my mind this makes the WRT54GC twice as value able as I thought it was. It was a good value for a good price, but now that I know I can put an antenna on it… its an absolute bargain!

During the RIPE 55 meeting in Amsterdam last week, a community statement was issued on the future of IPv4. Basically they say that we will run out of IP addresses in two to four years and we need IPv6.

To drive the point home, Gary Feldman performed a song titled “The Day the Routers Died” (sung like “bye bye american pie”).

You are probably used to seeing Internet addresses that look like these

http://www.paranoidagnostic.net/category/sysadmin
cloned.milkmen@paranoidagnostic.net

The first is called a URL and is used for web pages, and the second is an email address. While these addresses both look quite different and are used for different purposes they both contain something called a Domain Name (or DNS name). In this case the domain name is “paranoidagnostic.net”.

Domain names are used to organize Internet addresses in an orderly way and to delegate authority for the creation of Internet addresses.

Top-level Domains

Internet domain names are organized according to a hierarchy. Levels in the hierarchy are denoted by periods in the domain name. When you read a domain name from left to right, the left is the lowest level and the right is the top-most level of the hierarchy. The lower levels are referred to as subdomains of the higher level domains./p>

For example, the DNS name “www.paranoidagnostic.net” shows three levels of the hierarchy:

• net is called the top-level domain
• paranoidagnostic is a subdomain of net
• www is a subdomain of paranoidagnostic.net

The top-level domains (TLDs) are very important. There are only a limited number of top-level domains and they are controlled by various authorities around the world. There are generally three types of top-level domains: US-only, country specific, and generic.

US-only TLDs are only available to US institutions and are under tight control. For example, “mil” is only for the US military, “gov” is only for the US government, and “edu” is only for accredited US post-secondary institutions.

Country-specific TLDs have two letter codes that usually (but not always) correspond to international standard two-letter codes for those countries. For example, the TLD for Canada is “ca” and the TLD for the United Kingdom is “uk”.

generic TLDs are usually available to anyone in the world. “com”, “net”, “org”, “biz”, “info” and a growing list of others are in this category.

Who can have a domain? How do you get one?

TLDs are created by the Internet Corporation for Assigned Names and Numbers (ICANN). Regular organizations cannot have TLDs. Individual people or organizations can obtain subdomains of TLDs. ICANN assigns a separate authority to govern each TLD and those authorities set their own rules about who can and cannot have a subdomain.

For example, the “UK” TLD is governed by Nominet. Nominet administers all UK subdomains and sets rules for how they can be named. In the UK TLD commercial organizations are put in a further subdomain of “.co.uk” and educational institutions in “sch.uk”. For example, a phone company in the UK could get a domain of “myphonecompany.co.uk” but not “myphonecompany.uk” or “myphonecompany.sch.uk”. In the UK authority for some domains is delegated to an organization other than Nominet. For example, subdomains of “parliament.uk” have their own system of rules.

Contrast that with the “CA” TLD. “CA” is governed by an organization called the Canadian Internet Registry Authority (CIRA). It does not have a special subdomain for commercial organizations. A phone company in Canada could obtain “myphonecompany.ca” for a domain name. Similar to the UK TLD government subdomains are restricted. Only the Canadian Federal Government can obtain subdomains of “gc.ca”.

Some countries have turned over control of their TLDs to commercial companies that allow anyone in the world to use them. For example “TV”, “FM”, and “AD” are all country-specific TLDs that are administered by commercial organization that treat them like generic TLDs.

Finding TLD Authorities an Policies

It is often very helpful to know who governs a TLD and what their policies are. For example, if you find a website might appear to be for a institution in a specific country and have a subdomain that appears from that country. In the UK and Canada (”.ca”) you could be sure that any site that ends in “.parliament.uk” or “.gc.ca” are associated with the government. But a website in other subdomains may not be authentic. Each country has its own authority and own rules so verifying who is real and who is not can be challenging.

Fortunately, the Internet Assigned Numbers Authority (IANA) keeps a list of all of the TLD authorities. You can find the contact information, usually including website addresses, for every TLD on that list. You can then contact the listed authority to find out what their policies are.

Notes

Note: The Internet’s domain name system is referred to as DNS (Domain Name System) and defined by many RFCs (Internet standards).