W e b A p p

INTERVIEW

Interview with

Yury Chemerkin
Security Reseacher & Writer
Yury Chemerkin graduated from RSUH in 2010 (http://rggu.com/) on the BlackBerry diploma thesis. Currently in the postgraduate program at RSUH on the Cloud Security thesis. Experience in Reverse Engineering, Software Programming, Cyber & Mobile Security Research, Documentation, and as a contributing Security Writer. Also, researching Cloud Security and Social Privacy.

How did you get into security?

i was around 10 years old and do not exactly remember how it happened but there was this one time i came upon materials discussing reverse engineering, operation systems hacks, phreaking, etc. Most of them were not up-to-date considering that was 10 years ago but something in me just clicked like clogs of clockwork started turning. Some years past but the interest lingered on. Soon after i knew i had to start some practice around reverse engineering using old Microsoft versions such as Win95Se2 or Win98. it was a strong requirement for Softice and i found a good manual on how to use this software on Windows Xp Sp1. A bit later, i found ways to use virtualization tools like virtual Box but i still prefer to deal with real instances. First tutorials cover
10/2012(10) Page 62

http://pentestmag.com

W e b A p p

ideas on how to bypass implemented registration methods in any kind of software. it was a bit strange but it was easy to crack real programs using TheBat! rather than one of the so-called crackmes. Nowadays you wont see or hear that except on rare web sites such as WASM.RU and CRACKL@B. RU. While im researching how to find serial numbers or how to make a patch to bypass security, i also learned what a (dis-)assembler looks like. i studied several programming languages such as C++ Builder and pascal/Delphi because they have the most suitable Gui for easy developing and an ability to implement assembler instructions. Also, i studied cryptography (rSA, and other asymmetric scheme). i spent the first three years this way and then i continued to improve on my experience by getting involved in development of different areas: a security email infrastructure and rFiD systems. First, my experience grew around mobile developing on.Net and refactoring the existence systems and programming. Second, i developed some improvements around drivers having access to hybrid-hardware rFiD (mix Wi-Fi and serial ports like COM and uSB) to release final product. it was a commercial and academic product at the same time and belonged to our Technical and Engineering Security sub-department of rSuH. A lyrical digression, the russian State university for the Humanities (rSuH) is an educational institution that trains specialists in all areas of knowledge in the humanities and not only humanities. rSuH has an Institute for Information Sciences and Security Technologies (iiSSt). the first infosecurity faculty was founded in Moscow State institute of History and Archive Materials in 1985. As it was not related to any military training colleges, it was considered the faculty of specialized documents up to 1990. Nowadays it is an integrated part of the institute of information Sciences and Security technologies within the rSuH. the last 1.5 years towards the uni diploma, i had worked at several companies and i had experience in scumware, documentation, and presentation. Most known is the Kaspersky Lab that is a dynamically growing company that offers its employees a broad range of options for career development. i cannot say that in this company people come first because any much-heralded policy gives chance to everything to be known by everyone. Anyways, i gained wide experience in scumware research during several months in Kaspersky Lab only. i got missing valuables to reassemble my
10/2012(10)

vision about low-level security world. With second lyrical digression, i wanted to change my mobile device and this why i used BlackBerry as a very interesting platform. BlackBerry is a unique device, although you do not have enough control to make the right security policies if you are a BeS customer even. AWS (Amazon Web Service) is the best among of them because you can build your custom policy where each Api-method meets the policy restriction. For example, BlackBerry blocks any attempts to extract sensitive data from the buffer while the BlackBerry Wallet or password Keeper is running but you can just minimize these applications and data will be extracted successfully and easily! it was an idea from my report at the InfoSecurityRussia 2011 conference in Moscow where i was a Hakin9 representative. A similar idea moved to the forensics and was a key of infoSecurityrussia 2012. Now i am involved in legal defense (eu & ru) on the Cloud Security and BlackBerry rather than technical solutions for them. the last several years, i have worked on mobile social security, cloud security and compliance; mobile security and forensics; additionally developing solutions based on exploiting, not only OS vulnerabilities but also third-party products and solutions.

If security is so important, why are there so many vulnerabilities in popular products like Adobe?

unfortunately, compliance wins. it wins in banking, healthcare, and anywhere that a company is required to run semi-annual or annual penetration testing. Compliance is a minimal set of security requirements (if your application is non-compliant, it cannot be safely trusted and unlikely to be secure). therefore, the companies rarely care about security. they care about compliance. As we all know compliance does not equal security. Audit standards are worthless when you compare the requirements of security compliance to the common basic techniques and problems that hackers look for in applications. the basic requirements in compliance cannot cover the full range of potential security issues because there are just too many variations in applications. Compliance rarely talks about security even. Compliance regulations are frankly awful. penetration testing may not be the answer to security either. One example is that after a penetration test where many important security holes were found, a full detailed report may be
http://pentestmag.com

Page 63

W e b A p p

INTERVIEW
testing especially when email is not used on mobile devices. Many vendors are touting this as a new problem but they do that simply to promote and sell their products. professionals have been dealing with information security for 30-40 years that has led to the access of matrix model/control lists, public key cryptography, and more. For example, Kaspersky Labs often says that Android has many security issues but that Android has a great future. in other words, Android has a future because it is easier to build and implement security solutions for Android than for any other mobile device. Another example, mobile devices present a sandbox and other NeW SeCuritY SOLutiONS that do not work because the user has to store his data in shared folders accessed by any application (the sandbox protects only application data not user data). Not one of the users is ready to use certain applications to keep data in the sandboxs folders for only one reason- he will likely have a problem restoring and accessing the data later. exceptions to the rule exists, i am sure.

a bad idea because the company might not have enough money to fix all issues and therefore become discouraged. the company might have an initial interest to be pentested for the top 10 or 20 vulnerabilities, but because these vulnerabilities change each year, and the cost of constantly fixing the vulnerabilities once reported may be too much. the company may opt to have pentesting done less frequently. Most companies do not have the immense resources of Microsoft and cannot setup a frequent critical patching system they can only release vulnerability fixes during their regular release update cycle. You do not care about what the penetration tester reports on in this case, you are still vulnerable until the next annual release.

Despite the issues, are there enough pentesting services in Russia to handle the market demand?

Of course. russia houses several professional and customized pentesting services. However, when you look deeper at the specific services offered there are fewer options when you split the audit from penetration testing services. However, it is an interesting way to advertise advanced skills and a higher pay-rate if your penetration testers can break into SAp (Systems, Applications and products) this becomes a full range, more valuable service.

Is pentesting worth it?

What are the main areas covered by Russian custom pentesting services?

the basics are covered like pCs, networks, and web applications but when you move into much more recent technologies such as mobile, social engineering, cloud or similar, the pentesting services are much weaker. Cloud services are excluded because of the lack of experience. Audit standards are weak mainly because of the lack of knowledge of regulation outside of russia. i know only of one company who offers security and personal data compliance in the cloud while other pentesting companies prefer to dispute what is right or wrong. Social engineering testing is also excluded for the same reason while mobile pentesting services cannot be included because rarely do you see a privately implemented MDM (a mobile device management solution that combines datadriven mobile device management and application management with smartphone and tablet security) solutions. in the absence of MDM, mobile penetration testing looks like a uSB flash drive penetration
10/2012(10)

penetration testing is about someone legally trying to break into your system and help you then plug the security holes. penetration testers may be able to demonstrate that the companys security is awful. Sometimes the "consultant effect" takes place no one listens to employees but they will listen to the expensive consultant who comes in from the outside and says the same thing. the company should already have security designed and implemented. Moreover, when they perform specific functions they have to validate that they perform true to their design. penetration testing is a look into your infrastructure that was previously viewed as something that was unknown, huge, and complex. Nevertheless, the pentester reveals many previous unknown issues about potential backdoors or Wi-Fi weaknesses, infected pCs and mobiles, etc. it is a test that should be performed every week or month before and after implementation. therefore, it works only for compilation. if a company has a poor security design then patching may make sense only for compilation again not for improving and fixing security.
by PenTest Team

Page 64

http://pentestmag.com