http://www.eweek.com/article2/0,1759,1735655,00.asp By Libe Goad December 3, 2004 In mid-November, members of Sony's PlayStation Underground received the Holiday Demo Disk and discovered that after executing one of the game demos on the disc, their PS2 memory cards were completely erased. While that doesn't mean much to nongamers, anyone who has spent 40-plus hours building a character in a role-playing game or playing through a season of football - well, it's a huge boot in the trousers. The disc, sent via mail to PlayStation Underground members, was also set to be polybagged with several gaming magazines. The glitch was caught in time, so the bug didn't reach as many consumers as it might have. Ryan Bowling, public relations manager for Sony Computer Entertainment America, said Sony responded to the situation by sending out warning e-mails to PlayStation Underground subscribers telling them to remove their memory cards before playing the demo. "It is unfortunate that it happened," Bowling said, "and we're going to make sure it doesn't happen again." But what does this mean for the rest of us? There's more to the story than a handful of gamers losing their saved game files. The implications of such a glitch can be huge, especially as consumers start to set up networked computing systems in the home with routers, networks, servers, etc. Minus cubicles and a water cooler, it's the equivalent of a small enterprise network. Rick Fleming, chief technology officer at Digital Defense Inc, said that although most consumers don't realize it, game consoles are also like computers that run off of their own proprietary operating system. As a result, a bug in a demo CD, CD-ROM or DVD-ROM could affect the rest of a home network and has the potential to spread to an enterprise network through a VPN connection or other portable storage devices. "PlayStation and Xbox are being networked with home computers … so I can easily see how something like that would spread across a network," Fleming said. "Every time you connect to something else, there's another opportunity for something to go wrong." Trouble Inside the Firewall The idea that a removable disk can affect an entire networked system seems almost quaint, reserved for corporate spoofs such as "Office Space" where the protagonists use a program on a 3.5 floppy disk to steal money from the company. Now, the companies and consumers focus on outside threats, with the illusion that they're sitting pretty behind Internet firewalls and anti-virus programs. "It's like they'll leave the windows and sliding glass doors open," Fleming said. "Not the front door, though. It's vaulted shut." While there are few recent instances of companies sending out software with embedded viruses, it still happens on occasion. In 2002, Microsoft sent out a .Net developer disk infected with the Nimda virus, though Microsoft says it didn't actually spread to any machines. In the entertainment sector, AOL Time-Warner released a "Powerpuff Girls" DVD in 2001 that contained the peevish "FunLove" virus, which spread to users who played the disc on PC. In an earlier echo of the PlayStation Underground incident, MacAddict Magazine sent out a demo with a version of the Auto-Start virus. In most of these cases, the problems were easily fixed, but is still a signifier that seemingly innocent CDs sent out by reputable companies can contain malicious content. With the CD drives in virtually every machine, it's more common than ever for people to share information via optical media, Fleming said. Most people don't give a second thought to putting something like that in their machine. So, are these little glitches as banal as reports make them out to be? Maybe—though more conspiratorial analysts say these harmless bugs could turn into an entirely new threat that the security community is not ready to handle. "Most of the time when we see threats show up, it's a concept for how a Trojan or virus can be introduced," Fleming said. "When it's introduced, it's mostly very benign—erasing the flash memory on a PlayStation is not going to affect me personally—but what does concern me is that we have a whole new threat vector. People are going to take the concept and think, 'What's the next thing I can do?'" An Ounce of Prevention Not every security expert takes the same point of view, but they all agree that any networked user needs to take the same precautions, whether they're on a home or business network. John Pescatore, vice president of Internet Security at Gartner Inc., said home network security has a long way to go, since most major companies involved in home computing don't focus on that kind of security environment. "There's a funny thing going on," he said. "For many years, Microsoft built Windows with home users in mind, but in 2001-2002, they got religion and started doing more for enterprise security. They forgot about the home user who doesn't have an IT staff to take care of their problems. Pescatore also said there's been discussion in the industry about how to integrate security into consumer electronics. The problem is that companies still say anything harder to use slows down consumer adoption—so no one is willing to make security a priority in a consumer environment. "There's not a lot of incentive to say, 'My product is harder to use,'" Pescatore said. AOL has recently taken one of the first steps into helping consumers with security by offering McAfee VirusScan Online services for free. Businesses also can take a few notes from a home network invasion. Much like home users, Fleming said businesses keep a closer watch on outside threats and don't do enough to make sure that nothing is coming from within the company. "Computer institutions and the FBI have surveys that show around 60 percent of all security instances occur internally," Fleming said. "This is where a lot of companies don't get it. They do all of the testing on outside resources and don't monitor internally." Fleming strongly recommended that businesses create a strong security policy that's enforced through monitoring and training. People need to be aware of bringing in software and other devices from home. That includes things such as music CDs, which often store data other than the actual music tracks. "There has to be mandated vigilance in the enterprises," Fleming said. "It's got to be pounded into their heads to be careful." _________________________________________ Open Source Vulnerability Database (OSVDB) Everything is Vulnerable - http://www.osvdb.org/
This archive was generated by hypermail 2.1.3 : Mon Dec 06 2004 - 06:55:48 PST