Wednesday, May 31, 2006
"The U.S. State Department recently declared that due to national security concerns, it would restrict use of the 16,000 computers it purchased to nonclassified work. It had originally planned to use 900 of the machines on a network connecting U.S. embassies. Lenovo’s goal of becoming the “Sony of China” could be impeded by worries over its machines’ security, blocking its strategy to move out of its Asia stronghold and into the West by courting North American computer users and possibly listing on U.S. stock markets. That realization sparked outcry from officials of both the Chinese government and the computer company."
However, today's monocultural reality, and favorable trend towards diversity will have greater impact on the (in) security of the PCs. Moreover, the "manufactured in China" reality is a commonly shared myth, one that keeps getting debunked as well :
"Almost any PC you can name has Chinese content,” said Roger Kay, president of the research firm Endpoint Technologies Associates. He pointed to Intel semiconductors and Seagate hard drives made in China. He also noted that 80 percent of notebooks sold worldwide are manufactured in China."
Even if Lenovo dared to implement hardware backdoors, or ship the PCs rootkit ready, it could have successfully ruined its business future -- insider pressure is always an option, but what do you got besides speculation? Don't unload China Communist Party's load on this recently separated from IBM devision, they aren't in the most favorable position, still remain among the top players on the PC market, right next to the efficiency machine Dell, which as a matter of fact recently completed its second high-tech factory in China.
Healthy paranoia, or the George Orwell inside you? Comic page text generated at Gaxed.com
Tuesday, May 30, 2006
Recently announced, The Global Security Challenge seeks "..to help young startups succeed in the security field. Take advantage of this unique opportunity to get your ideas in front of investors, media, and government and industry leaders." And most importantly :
"We seek to uncover the creative capabilities of innovators in universities and infant companies that apply to public security needs. This includes software, hardware or other industrial solutions that help (a) protect people, critical infrastructure, facilities and data/electronic systems against terrorist or other criminal attacks and natural disasters or (b) help governments, businesses and communities defend against, cope with or recover from such incidents. Examples of Technologies We Seek:
- Mesh Networks
- Data Storage and Recovery
- Detection/ Sensors
- Search Software
- Cyber/Network Security
- Communications Interoperability & Reconstruction
- Biological/Chemical/Radiological Remediation
- Protective Equipment
- RFID, Asset Tracking & Container Security
I bet Europe's Top Private Security Companies revenues' exceed the limit of having less than £ 10 million in annual revenues, it's worth speculating on their participation. Do your homework, know your competitors better than they do themselves,work out your elevator pitch, and disrupt.
As far as acquisitions are concerned, SiteAdvisor is the fist recently acquired startup that comes to my mind with its $70M acquisition deal valuation. As it obviously goes beyond VC type of mentorship, to many this seemed as an overhyped deal. There's no price for being a pioneer, but a price on acquiring the position -- a stairway to heaven. Right now, a vertical security market segment is slowly developing, and it is my humble opinion that the company's pioneering position is poised for success. Another alternative to SiteAdvisor's safe search function is the recently launched Scandoo.com which actually integrates the results from Google and Yahoo -- I doubt users would that easily change their search preferences though.
Who's next to get acquired, or hopefully funded?
It's worth noting that Air Canada was actually aware of the security event, knew when it happened, and managed to trace it back to their competitors. Today's competitive intelligence does include unethical information gathering whether in-house, or "outsourced" practices, as DDoS for hire still make the headlines, compared to the many other still undetected insider leakages years ago. It's also impressive how Dumpster diving still remains a serious threat -- so make sure you shred your secrets!
Competition is always good for all parties involved. In another article on the topic, WebRoot's founder, a leading anti-spyware solutions provider, gave great comments about Microsoft's take over of the infosec market : "The taking of a second-best product in this space is akin to locking half the doors in your house," he said. "Vista will not solve the spyware problem. It may change the vector of attack, but it will not solve this problem. And I'll bet the company on it."
Microsoft really surprised me with their release of the Strider Honey Monkeys Crawler, as precisely the type of in-house research that would act as a main differention point of its solutions. The problem has never been the technology, they still have some of the brightest minds in the world working for them, but providing value and communicating the idea to the final customer. Security as a second priority isn't tolerated by customers, and Microsoft is last company that the end user associates with security. Obsessed with perfection, and still living in the product marketing concept world, is outdated thinking, the way pushing features based on "what the sample says" is not going to hold the front any longer. Customers beg to participate!
While for the time being Microsoft is rediscovering the Web, and working on Vista, money doesn't necessarily buy innovation, prone to make impact individuals do --ones heading to Mountain View, California where the real action is.
"Barclays Bank is issuing UK internet banking customers with anti-virus software, as part of attempts to reduce online identity theft. The bank has signed a deal with Finnish anti-virus firm F-Secure, which will provide software to the bank’s 1.6m UK internet banking customers. While other banks offer discounted anti-virus software deals to customers, Barclays is the first in the UK to give it away for free. ’Nearly two-thirds of home PCs don’t have active virus protection, and one in five is actually infected by a virus, placing people at risk from data theft, as well as damage to their computers,’ said Barnaby Davis, director of electronic banking at Barclays."
I find the idea a very good mostly because compared to other banks that try to reestablish the email communication with their customers, but starting from the basics, you can't do E-banking without generally acceptable security measure in place. And while an AV solution doesn't necessarily mean the customer wouldn't get attacked by other means, or that it would be actually active in the moment of the attack, this is a very smart to do. To take advantage of even more benefits, Barclays must actively communicate their contribution and unique differentiating point to their customers, in comparison with the other banks -- it's getting harder for companies to retain customers due to improved access to information, thus more informed decisions.
You can't just deal with the technological part of the problem, but avoid the human side in it, as education and awareness will result in less gullible, but more satisfied and longer retained customers. Phishing is today's efficient social engineering, and a bank's site shouldn't be assumed "secure" as on many occasions site-specific vulnerabilities improve the truthfulness of the scam itself. Forwarding the responsibility for secured access to the E-banking feature to final customers should be simultaneous with the bank auditing its web services. In the upcoming years, with the rise of mobile banking, I think we will inevitably start seeing more mobile phishing attempts. Ebay's PayPal is still a major player in online payments, on its way to dominate mobile payments too. The trend and potential of cross-platform malware is what both AV vendors and payment providers should keep in mind.
Sunday, May 28, 2006
"Beijing’s intelligence services continue to collect science and technology information to support the government’s goals, while Chinese industry gives priority to domestically manufactured products to meet its technology needs. The PLA maintains close ties with its Russian counterpart, but there is significant evidence that Beijing seeks to develop its own unique model for waging cyber warfare."
"The armed forces and technical universities have joined in an effort to create independent cyber R & D centers and train personnel in IT skills; and second, Tehran actively seeks to buy IT and military related technical assistance and training from both Russia and India."
"Russia’s armed forces, collaborating with experts in the IT sector and academic community, have developed a robust cyber warfare doctrine. The authors of Russia’s cyber warfare doctrine have disclosed discussions and debates concerning Moscow’s official policy. “Information weaponry,” i.e., weapons based on programming code, receives paramount attention in official cyber warfare doctrine."
Technology as the next Revolution in Military Affairs (RMA) was inevitable development, what's important to keep in mind is knowing who's up to what, what are the foundations of their military thinking, as well as who's copying attitude from who. Having the capacity to wage offensive and defense cyber warfare is getting more important, still, military thinkers of certain countries find network centric warfare or total renovation of C4I communications as the panacea when dealing with their about to get scraped conventional weaponry systems. Convergence represents countless opportunities for waging Cyber Warfare, offensive one as well, as I doubt there isn't a country working on defensive projects.
In a previous post Techno-Imperialism and the Effect of Cyberterrorism I also provided detailed overview of the concept and lots of real-life scenarios related to Cyberterrorism, an extension of Cyber warfare capabilities. It shouldn't come as a surprise to you, that a nation's military and intelligence personnel have, or seek to gain access to 0day security vulnerabilities, the currency of trade in today's E-society as well as recruiting local "renegades".
Undermining a nation's confidence in its own abilities, the public's perception of inevitable failure, sophisticated PSYOPS, "excluded middle" propaganda, it all comes down to who's a step ahead of the event by either predicting or intercepting its future occurrence. Information is not power, it's noise turning into Knowledge, one that becomes power -- if and when exercised.
Saturday, May 27, 2006
"Symantec warned its enterprise customers Thursday that an unpatched vulnerability in Windows 2000’s file sharing protocol has surfaced, with details of an exploit expected to show next month. According to the Cupertino, Calif. company’s alert, an exploit for the zero-day bug in Windows 2000’s SMB (Server Message Block) protocol has been created by Immunity Security, the makers of the CANVAS exploit-creation platform. By Immunity researcher Dave Aitel’s account, the exploit leverages a flaw in the operating system’s kernel that can be triggered through SMB, and will give an attacker full access to the PC. Aitel claimed Immunity will make the exploit public in June. "Immunity is considered to be a reliable source and we are of the opinion that this information should be treated as fact," read Symantec’s warning. "An official security update from Microsoft will likely not be in development until after June when the information is released."
Well, how can they fix in such a way, even though their "sophisticated", quality-obsessed patch management practices. When working with vulnerabilities, or updating yourself with the dailypack of new ones, don't live with the false feeling of their uniqueness, but try figuring out how to be a step ahead of the vulnerabilities management stage. If Microsoft requested from Immunity Security to look up for possible security vulnerabilities, gave them a deadline, and secured a commission in case a vulnerability is actually found, it would have perfectly fited in the scenario in a previous post "Shaping the Market for Security Vulnerabilities Through Exploit Derivatives" -- reporting a vulnerability, let's not mention web application vulnerability is for the brave these days. Moreover, "Economic Analysis of the Market for Software Vulnerability Disclosure" quotes Arora et al. on the same issue from a vendor's point of view :
"developing an economic model to study a vendor's decision of when to introduce its software and whether or not to patch vulnerabilities in its software. They compare the decision process of a social-welfare maximizing monopolistic vendot, to that of a profit-maximizing monopolistic vendor. Interestingly, they observe that the profit-maximizing vendor delivers a product that has fewer bugs, than a social-welfare maximizing vendor. Howver, the profit-maximizing vendor is less willing to patch its software than its social-welfare maximizing counterpart." - The Price of Restricting Vulnerability Publications is indeed getting higher.
Reactive, Proactive, or Adaptive - what's your current security strategy?
"Security plans intended to protect the Prime Minister from a terrorist attack during the Labour Party conference have been left in a hotel. The documents include a list of ways in which Mr Blair and members of his Cabinet could be killed as they attend the five-day conference at Manchester’s G-Mex Centre in September. Greater Manchester Police said that the dossier, found at the Midland Hotel, had been left by a member of hotel staff but insisted that the plans were not secret."
Every country has it's reputable think tanks, whether representing PhDs' with eyeglasses thick enough to have the sun burn their eyes, or plain simple analysts, worst case scenarios when protecting national leaders are among the top priorities. I think that even if the plans weren't secret, they reveal a lot of info on the security agency's thinking and hypotizing approach, still, no advantage could have been taken given the short timeframe -- thankfully.
From the article :
"Now, the White House’s top spymaster can cite national security to exempt businesses from reporting requirements President George W. Bush has bestowed on his intelligence czar, John Negroponte, broad authority, in the name of national security, to excuse publicly traded companies from their usual accounting and securities-disclosure obligations. Notice of the development came in a brief entry in the Federal Register, dated May 5, 2006, that was opaque to the untrained eye."
What the U.S government gets is stimulated to invest in homeland security publicly traded companies, given the benefits of the possible "exemption" and countless opportunities for profitable speculation. If the backdoor left gets used for purposes other than classifying some obvious defense contractors' accounting histories I wouldn't doubt seeing Coca Cola diversifying to take advantage of expanding the unaccountable R&D department. Moreover, today I came across to an independent research stating that classified and unaccountable military spending is at its peak.
It's fascinating to label something as top secret and let the world know about it 30 years later in order to lose the public effect of the discovery, still "excusing" companies to fuel growth would open up a great deal for corporate fraud schemes, but yes, investments too.
While North Korea is presumably hoping to improve the nation's dignity and reputation as scietifically sophisticated enough to be recognized, building nuclear weapons when the central statistical bureau releases reports of people dying out of starvation reminds of the best Cold War strategy game scenario I ever played. No real army for the regime, but sneaky partisans everywhere, no roads, no buildings, but nuclear bombs and cruise missiles in every city, as well as income distribution model based on the "model of leftovers", thus, riots and lack of any production capabilities. I remember watching a documentary where a soldier was trying to broadcast over the border, and of course, North Korea's jammers in action. Censoring news, obsessive self-regulation practices, total denial of problems, and keeping everyone in a twisted reality for as long as necessary is a daily practice -- still, there are capitalists trying to operate business ventures there.
What the international community could possibly do is not to lose touch with these people, and constantly "ping" their diplomacy while trying to achieve bargain deals -- the problem is that even Asian countries find North Korea a spooky place. Kim Jong-il is not a mad man, but a man looking for attention, give him some without having him "envision" a conventional weaponry phrase in his country's history.
Tuesday, May 23, 2006
The Baby Business explains how parents willing to pay to make their kids "better" are actually fueling growth in the market itself. What's a "better" kid anyway? One that's smart, beautiful, that thinks like an Ivy League freshman when its 10 years old -- is it thinking or theoritizing? -- a math genious with a second life of a marketer?
Or intelligent, passionate about something eventually becoming a turning point for his future development, realizing admitting and getting over failure, being interested instead of being interesting type of kid, with a pure feeling of self-development and self-realization? -- a soul.
Would the "haves" donate genetic know-how, or would one be eventually found and commercialized? I think utopias are a powerful driving force, yet perfection remains among the biggest human weaknesses ever -- superhuman is a state of mind if you are willing to embrace it.
I feel I went through what's perhaps the most recent and extensive research done on Hacktivism, "Hacktivism and the Future of Political Participation" by Alexandra Samuel -- a perfect moment to mention the daily updated security resources, that I go through instantly, hudreds more will soon be shared as well!
The disertation "looks at the phenomenon of hacktivism: the marriage of political activism and computer hacking. It defines hacktivism as the nonviolent use of illegal or legally ambiguous digital tools in pursuit of political ends. Those tools include web site defacements, redirects, denial-of-service attacks, information theft, web site parodies, virtual sit-ins, virtual sabotage, and software development. The dissertation uses data from fifty-one interviews in conjunction with additional primary and secondary source material. This data is used to construct a taxonomy of hacktivism, and apply the taxonomy to three core issues in political participation."
The big picture, the details, and everything in between, how fast can you print, bind and read this masterpiece?
"To explore these problems, we modified an existing framework for analyzing online authorship and applied it to Arabic and English Web forum messagesassociated with known extremist groups. We developed a special multilingual model—the set of algorithms and related features—to identify Arabic messages, gearing this model toward the language’s unique characteristics. Furthermore, we incorporated a complex message extraction component to allow the use of a more comprehensive set of features tailored specifically toward online messages. A series of experiments evaluating the models indicated a high level of success in identifying communication patterns."
Social network analysis has a lot of potential, and with data mining it seems to be the perfect match for the recent trouble with NSA's domestic spying program. DearNSA.com and the Patriot Search are aiming to solve the problem for both parties -- efficiently.
There's a lot of propaganda chat going on online all the time, and among the very few limitations that bother me about such web aggregation of open source information are the use of steganography, or plain-simple Dark Web (closed for crawlers with basic/sophisticated authentication in place) communication -- remember there's a lot of noise to sort out through as well.
Obviously, plain old paranoia without solid background still dominates as "Representative Frank Wolf (R-VA) has announced that the State Department has agreed not to use 900 computers purchased from Chinese-owned Lenovo on classified computer networks. The US-China Commission, a bipartisan congressional commission, raised concerns when State announced the purchase of 16,000 desktop computers from Lenovo, with 900 to be used on secret networks connected to the Defense Department's classified SIPRnet (Secret Internet Protocol Router Network). State is changing its procurement process to better track changes in vendor ownership that could impact national security."
There's a common myth that a nation's military uses a specially dedicated networks, ones greatly differing from the standart OSI model the way we know it -- which is wrong as it would limit the usability, and increase the costs of operating. My point is that, even a PC sold by Dell would eventually run a Microsoft OS, thus exposing it to the monocultural insecurity by itself, and the human weaknesses of the person operating the PC itself, not guarding the SIPRnet
It would be easier for Chinese hackers or government entities to take advantage of client side attacks on any of these systems, then to ship them backdoor-ready risking too much in case of possible espionage fiasco. There have been known cases of malware leaking nuclear plant information, or employees P2Peering sensitive/classified information. Be it, hardware keyloggers, logic bombs, BIOS rootkits, given the scrutiny, even a slight ambition might have vanished in the air. Modern spy gadgets are evolving, espionage cases are still happenning and some get even public, but in case you're interested in the true ghost covert operative - stay tuned for the Stand Alone Complex Novel!
malicious activity through google hacking, has already reached levels of automation -- the problem is how the threat gets often neglected by those that actually suffer from a breach later on. I came across to an article pointing out that :
"Anyone who wants to hack into sensitive information on New Zealand internet sites might be pleased to know it can be as easy as typing keywords into a Google search. Researchers at Massey University’s Albany campus say the country’s websites are more vulnerable to "Google hacking" than anywhere else in the world. University Information and Mathematical Sciences Institute senior lecturer Dr Ellen Rose and graduate student Natalia Nehring recently completed a study into the topic."
Not exactly a type of cyberterrorism exercise such as the most recent DigitalStorm, but it's logical to conclude that if someone takes the time and effort to data mine the web, localize the attack like in this case, a lot will be revealed. In a recent article, CSOonline goes in-depth into the security implications posed by Google. I once had a chat with Johnny Long on many topics, among the "few", of course, was google hacking. He made a good point on saying that it's whatever you actually do with the results that matters most, and how diverse is the threat -- by googling your lights off for instance. What you should keep in mind is that it isn't Google to blame, the way "Improving the Security of Your Site by Breaking Into it" provoked awareness, and not damage. Think the problem isn't big of a shot -- gather some intelligence by yourself through the Google Hack Honeypot project.
Monday, May 22, 2006
"The Google Earth study on the impacts and uses for defence and security is aimed at answering a number of questions. What are the technical features, the reliability and limits of GE data and software, regarding international security regulations? Which confidence in data, real dangers of a pernicious use, or impacts of such an easy access to imagery is there on users or the geographical information market? What are the new applications stemming from GE, which services can be derived from this application, or what are the ways to integrate GE into an information system?"
Stay tuned for the upcoming 0day sights from around the world.
Tuesday, May 16, 2006
Can we argue that cyberterrorism is the direct effect of techno imperialism, or let's use a more friendly word such as IT-dependent society and information infrastructure?
What exactly does cyberterrorism mean? When does an average internet user's malicious activity turns into cyberterrorism ones? Are there clear definitions, or the lack of such as resulting in the in a total misunderstanding for both, the media and the general public. The recently released Google Trends, which I covered in a previous post, doesn't even count Cyberterrorism, so I looked further and came across to a very good research "Fear-mongering or fact: The construction of ‘cyber-terrorism’ in U.S., U.K, and Canadian news media" that aims to emphasize on the common misunderstanding when defining Cyberterrorism and the media's acceptance of the concept. The outcome? Declining media presence with the years, to end up where it is today, but what you should keep in mind is that the concept is still out there.
Trying to seperate Cyberterrorism as a tool for achieving Information Warfare dominance is like on purposely ignoring the the big picture -- that Cyberterrorism, one that sometimes results out of hacktivism tensions is a powerful tool for achieving the full effect of information warfare. Whereas such attacks occur all the time, I can argue that the actual impact of cyberterrorism cannot be easily and quantitatively justified. We all know that it's theoretically logical for terrorists to use the Internet for various cyberplanning and cyber communication, what can we do about it?
Crawling for terrorist web sites clearly associated with different organizations, or trying to spot terrorist symphatizers have been in the execution stage for yers. Projects such as the Terrorism Knowledge Discovery Project, take a very deep look into the subject by introducing Terrorism Knowledge Portal, an aggregated source for intelligence. Moreover, according to a recent article : "SAIC has a $US7 million Defence Department contract to monitor 1500 militant websites that provide al Qaeda and other militant organisations with a main venue for communications, fund-raising, recruitment and training." It's also interesting to note other initiatives that started back in 2001, such as the Automatic Identification of Extremist Internet Web Sites.
Another concept goes in-depth into Confronting Cyberterrorism with Cyber Deception as "if it is possible to deceive terrorists, then it should also be possible to deceive cyberterrorists. The reliance of cyberterrorists on information technology makes them vulnerable to cyber deceptions. In addition, many of the methods and tools that cyberterrorists would use are similar to those used by other less malicious hackers, so we can plan specific deceptions to use against them in advance." As you can see on the grid above, the actors, the deception target and the level of difficulty provide more insight into the idea, great research!
Steganography embedded images used by terrorists on the public web can be doubtful, but on the Dark Web, why not? According to a research I came across to some time ago :
"In academia, graduate students Niel Provos and Richard Honeyman at the University of Michigan have written a web crawling program to detect steganographic images in the wild. The program has already digested 2 billion JPEG’s on popular sights such as ebay and has so far found only one stego-image in the wild. The detected image was on an ABC web page that dealt with the topic of steganography."
Detecting Steganographic Content on the Internet as a concept has been around for ages, while plain old encryption is the de-facto practice according to a well researched news article :
• Wadih El Hage, one of the suspects in the 1998 bombing of two U.S. embassies in East Africa, sent encrypted e-mails under various names, including "Norman" and "Abdus Sabbur," to "associates in al Qaida," according to the Oct. 25, 1998, U.S. indictment against him. Hage went on trial Monday in federal court in New York.
• Khalil Deek, an alleged terrorist arrested in Pakistan in 1999, used encrypted computer files to plot bombings in Jordan at the turn of the millennium, U.S. officials say. Authorities found Deek's computer at his Peshawar, Pakistan, home and flew it to the National Security Agency in Fort Meade, Md. Mathematicians, using supercomputers, decoded the files, enabling the FBI to foil the plot.
• Ramzi Yousef, the convicted mastermind of the World Trade Center bombing in 1993, used encrypted files to hide details of a plot to destroy 11 U.S. airliners. Philippines officials found the computer in Yousef's Manila apartment in 1995. U.S. officials broke the encryption and foiled the plot. Two of the files, FBI officials say, took more than a year to decrypt.
Among the many cases I am aware of worth mentioning are :
- What are the real risks of cyberterrorism? In 1998, a 12-year-old hacker broke into the computer system that controlled the floodgates of the Theodore Roosevelt Dam in Arizona, according to a June Washington Post report. If the gates had been opened, the article added, walls of water could have flooded the cities of Tempe and Mesa, whose populations total nearly 1 million.
- Cyberterrorism: How Real Is the Threat? Yonah Alexander, a terrorism researcher at the Potomac Institute—a think tank with close links to the Pentagon—announced in December 2001, the existence of an “Iraq Net.” This network supposedly consisted of more than one hundred websites set up across the world by Iraq since the mid-1990s to launch denial-of-service or DoS attacks against U.S. companies. The concept of botnets wasn't that popular at the time, so that's an example of marginal thinking on acquiring DoS power.
- In the indictment against Zacharias Moussaoui, it states that Moussaoui had among his possessions a flight simulator program, software for reviewing pilot procedures for a Boeing 747 Model 400, and a computer disk of information on aerial spraying of pesticides. The indictment also outlines Moussaoui’s use of e-mail to inquire about flight training.
- For almost two years, intelligence services around the world tried to uncover the identity of an Internet hacker who had become a key conduit for al-Qaeda. The savvy, English-speaking, presumably young webmaster taunted his pursuers, calling himself Irhabi -- Terrorist -- 007. He hacked into American university computers, propagandized for the Iraq insurgents led by Abu Musab al-Zarqawi and taught other online jihadists how to wield their computers for the cause.
I can argue which article is more intriguing compared to BusinesWeek's writeup on catching the ShadowCrew, but anyway all you need to a get a reader's attention is a name such as Abu Musab al-Zarqawi, a point that I feel is totally brainwashed in this paragraph :)
Cyberterrorism is an inseparable part of Information Warfare, and while we would hopefully never witness a catastrophic scenario, that is offensive use of Cyberterrorism, recruitment and propaganda flood the Internet on a daily basis. Just stop being suspicious about everyone, and try to enjoy life in between, can you, as terrorists are not everywhere -- but where we see them at the bottom line!
"Boeing has been under investigation for improperly acquiring thousands of pages of rival Lockheed Martin's proprietary documents in the late 1990s, using some of them to help win a competition for government rocket-launching business. The government stripped Boeing of about $1 billion worth of rocket launches for its improper use of the Lockheed documents."
Boeing and Lockheed Martin remain the key players in the defense industry, ensuring their portfolio of services (cyberwarfare, theater warfare, grid networking compatibility etc.) remain competitive. I once said that during the Cold War, the tensions between the U.S and the Soviet Union used to be the driving force of progress and innovation, these days, terrorism is the driving force and the "excuse" for military and intelligence spending. And while NASA's budget has been decreasing with the time, the next major space innovation wouldn't come from NASA, but from the commercial sector.
What's the bottom line? A minor short-term effect, and long-term business continuity for sure as "Boeing shares fell $1.76, or 2 percent, to $85.25 in morning trading on the New York Stock Excange."
Basically, it outlines critical issues such as, what is the U.S(or pretty much any other country thinking asymmetric warfare) doing to ensure critical civil infrastructure is protected against EMP attacks, how does the vulnerability of EMP attacks encourage other nations to develop such capabilities, and yes, of course the "threat" of terrorist EMP warfare -- in your wildest dreams only. An excerpt :
"However, other analysts maintain that some testing done by the U.S. military may have been flawed, or incomplete, leading to faulty conclusions about the level of resistance of commercial equipment to the effects of EMP. These analysts point out that EMP technology has been explored by several other nations, and as circuitry becomes more miniaturized, modern electronics become increasingly vulnerable to disruption. They argue that it could possibly take years for the United States to recover fully from widespread damage to electronics resulting from a large-scale EMP attack."
Why wouldn't a "reported sponsor of terrorist" nations wage EMP warfare, or even try to over the U.S? Because they would have the U.S in their backyard in less than a day, but the opportunity to balance the powers, or achieve temporary military advantage given the attack remains undetected is a tempting factor for future developments -- the ongoing miniaturization and the fact that intense energy effects can be can be produced without an A-Bomb makes it even worse. Surgical HPM and EMP attacks without fear of retaliation is what possible adversaries could be aiming at, and of course portability :
"Other HPM weapons being tested by the military are portable and re-usable through battery-power, and are effective when fired miles away from a target. These weapons can also be focused like a laser beam and tuned to an appropriate frequency in order to penetrate electronics that are heavily shielded against a nuclear attack. The deepest bunkers with the thickest concrete walls reportedly are not safe from such a beam if they have even a single unprotected wire reaching the surface."
Yesterday I was looking for an article I wrote in 1998 on Nuclear Weapons and seem to have found it -- it makes me smile given my age, and the fact that I had to orally defend the topic, hope you will find it an interesting retro read :) I don't necessarily agree with all the things, it just the way I was perceiving the world back than. For instance, Russia didn't accelerate their scientific efforts, as the A-bomb secret eventually leaked out to them, and with the fall of the Soviet Union and ICBMs available in every corner of the country and its republics, it wasn't hard for other nations to piggyback too.
Did you know that Stalin was aware of the U.S's A-bomb, even before Harry Truman was? -- the consequence of too much secrecy sometimes!
There has always been war, and will always be though we live in more peaceful world nowadays. It's a long time that nuclear weapons are not the same threat to the world's peace as they were years ago. Despite all the reducement and limitation of nuclear weapons they haven't disappeared yet completely. Today all the nuclear arsenals are able to kill everybody on EARTH, a thousand times, though nobody wants to die even once. One of the greatest scientific and human's achievements - mastering the nuclear energy, is in position both to change the traditional sources of energy, and to move toward the social progress. However, this discovery was used not in people's behalf, but against it. During Truman's leadership nuclear scientists
were working on the project"MANHATTAN" as they were to finish mastering the nuclear energy, but they didn't know that their discovery would change completely the world to worse, demanding death to million people. Americans have always been competing with Russians in each sphere. When Americans discovered the A-BOMB Russians were far from it. Then Truman decided to drive Russia into a corner. But he didn't have the chance, due to Stalin who ostensibly didn't pay attention to the threat. To show his power Truman threw the A-BOMB on Hiroshima on 6 of August at 8 :00 am. It generated a huge amoung of energy when it exploded. Most people died within a few hours. By the end 0f 1945 the estimated number of peole who died as a direct result of the bomb was 140,000. But later it has been concluded that the number of people who died was approximately 200,000, even more. Russia decided that it could't last so long and accelerated the speed of doing their project for the A-BOMB several times. Only for 4 years they worked it out which the Americans succeeded for 20. As Russia's A-BOMB appeared the United State's plans for starting a war and attack Russia made them think. All their plans went wrong. When the U.S controlled the weapons of mass destruction their strategists used to think about the harmful power of the weapons. Now, the U.S have completely changed their policy line. When a conflict arise anywhere in world they would help. When a disaster damages a country, when a war starts they always stand by the side of the weaker. They mastered outer space and they don't do it just for themselves but for the whole mankind. Now all the people in world develop good relationships. But we live in a troubled world. Our daily cares are increasingly dwarfed by the thought that they may vanish in a flash. People separated by continents and oceans are uneted in their wish to prevent the global nuclear catastrophe. Young people today do not wish war they want peace and love. It's not just a wish, it's a must!
This is eight years ago, and I'm still keeping the spirit I guess :)
Monday, May 15, 2006
- on the majority of occasions companies are taking an outdated approach towards security, that is still living in the perimeter based security solutions world
- companies and data brokers/aggregators are often reluctant to report security breaches even
when they have the legal obligation to due to the fact that, either the breach still hasn't been detected, or the lack of awareness on what is a breach worth reporting
- the flawed approaches towards quantifyingthe costs related to Cybercrime are resulting in overhyped statements in direct contradiction with security spending
- companies still believe in the myth that spending more on security, means better security, but that's not always the case
- given the flood of marketing and the never ending "media echo" effect, decision makers often find themselves living with current trends, not with the emerging ones, which is what they should pay attention to
It is often mistaken that the more you spend on security, the higher level of security would be achieved, whereas that's not always the case -- it's about prioritizing and finding the most suitable metrics model for your investment.
Here's an article describing exactly the same impression :
"Security breaches from computer viruses, spyware, hacker attacks and equipment theft are costing British business billions of pounds a year, according to a survey released Tuesday. The estimated loss of $18 billion (10 billion pounds) is 50 percent higher than the level calculated two years ago, according to the survey that consultancy PricewaterhouseCoopers conducted for the U.K. Department of Trade and Industry. The rise comes despite the fact that companies are increasing their spending on information security controls to an average 4 percent or 5 percent of their IT budget, compared with 3 percent in 2004."
That's pretty much the situation everywhere, companies are striving to apply metrics to security investments and this is where it all gets blur. Spending more on security might seems to be logical answer, but start from the fact that open networks, thus exposed to a great deal of uncontrollable external factors, undermine the majority of models so far. Bargaining with security, or "Getting paid for getting hacked" remains a daily practice whatsoever. Let's consider various social aspects concerning the participants.
A financial executive often wants to know more on :
- Do I get any return on my investment (ROI) ?
- What % of the risk is mitigated and what are your benchmarking methods?
- What may I lose if I don't invest, and where's the sweet spot?
- How much is enough?
- How do I use basic financial concepts such as diversification in the security world?
- How would productivity be influenced due to the lack of solutions, or even their actual use?
A security consultant on the other hand might be interested in -- How do I convince senior management in the benefits of having a honeyfarm in respect to mitigating the overall risk of having real systems breached into, without using Cyberterrorism as the basis of discussion?
These different school's of though, positions, responsibilities and budget-allocation hungry individuals are constantly having trouble communicating with each other. And while you cannot, and perhaps even should not try to educate your security workforce in to the basics of finance, an understanding of both side's point of view may change things -- what you don't see value in, is often someone else's treasure.
Another recent article on the topic of justifying security expenditure, or mostly assigning value made me an impression :
"So we came up with Value Protection," Larson says. "You spend time and capital on security so that you don't allow the erosion of existing growth or prevent new growth from taking root. The number-one challenge for us is not the ability to deploy the next, greatest technology. That's there. What we need to do now is quantify the value to the business of deploying those technologies." "It adds value; we're very supportive of it," says Steve Schmitt, American Water's vice president of operations, of Larson's Value Protection metric. For a while, people were just trying to create reasonable security, Schmitt says, "but now you need something more—something that proves the value, and that's what Bruce developed. Plus, as a secondary benefit, it's getting us better visibility from business owners and partners on risks and better ways to mitigate the risks."
Good point on first estimating the usefulness of current technologies, before applying the "latest", or "newest" ones. The rest comes to the good old flaws in the ROSI model, how would you be sure that it would be the $75,000 virus outbreak that will hit your organization, and not the $5000 one? "Return On Security Investment (ROSI) – A Practical Quantitative Model" emphasized on the challenges to blindly assigning the wrong value to a variable :
"The virus scanner appears to be worth the investment, but only because we’re assuming that the cost of a disaster is $25,000, that the scanner will catch 75% of the viruses and that the cost of the scanner is truly $25,000. In reality, none of these numbers are likely to be very accurate. What if three of the four viruses cost $5,000 in damages but one costs $85,000? The average cost is still $25,000. Which one of those four viruses is going to get past the scanner? If it’s a $5,000 one, the ROSI increases to nearly 300% – but if it’s the expensive one, the ROSI becomes negative!"
Among the first things to keep in mind while developing a risk management plan, is to identify the assets, identify the potential attackers, and find ways to measure the threat exposure and current threatscape as well. In a publication I wrote three years ago, "Building and Implementing a Successful Information Security Policy", that as a matter of fact I still find a quality and in-depth reading on the topic, I outlined some ideas on achieving the full effect of the abovementioned practices -- it's also nice to came across it given in assignments and discussed in lectures too. An excerpt on Risk Analysis :
"As in any other sensitive procedure, Risk Analysis and Risk Management play an essential role in the proper functionality of the process. Risk Analysis is the process of identifying the critical information assets of the company and their use and functionality -- an important (key) process that needs to be taken very seriously. Essentially, it is the very process of defining exactly WHAT you are trying to protect, from WHOM you are trying to protect it and most importantly, HOW you are going to protect it."
Identifying the threats and some current threats worth keeping in mind
- windows of opportunities/0day attacks
- lousy assets/vulnerability/patch management
- insecure end users' habits
- sneaky and sophisticated malicious software
- wireless/bluetooth information leakage
- removable media information leakage
How would you go for measuring the risk exposure and risk mitigated factor?
Risk exposure and risk mitigated are both interesting and hard to quantify, should we consider the whole population given we somehow manage to obtain fresh information on the current threats ( through the use of Early Warning System such as Symantec's DeepSight Analyzer, The Internet Storm Center, or iDefense's Intelligence services for instance). Today, it is often based on :
- the number of workstations and network assets divided by the historical occurrence of a particular security event on the network -- the use of mobile agents for the specifics of a company's infrastructure effects is hard sometimes
- on the historical TCO data related to typical breaches/security events
Risk mitigated is often tackled by the use of Best practices -- whether outdated or relevant is something else, Cyber Insurance and the current, sort of, scientifically justified ROSI model are everyday's practice, but knowing the inner workings of your organization and today's constantly changing threatscape and how it(if) affects you is a key practice while prioritizing expenditure. You cannot, and should not deal with all the insecurities facing your organization, instead consider prioritizing your security expenditure, not just following the daily headlines and vendor-released, short-term centered research.
It's hard to quantify intellectual property's value, the way it's hard to quantify TCO loses due to security breaches and it's perhaps the perfect moment to mention the initiative that I undertook in the beginning of this year - a 50/50 security/financial cross-functional team on coming up with a disruptive idea -- more on the current status soon, still, thanks for the time and efforts folks! To sum up, a nice quote by the authors of the research I mentioned : "Most of the problems stem from the fact that security doesn’t directly create anything tangible – rather it prevents loss. A loss that’s prevented is a loss that you probably won’t know about."
At the bottom line, are you making money out of having security, that is thinking business continuity, not contingency planning, and should we keep on trying to adapt financial concepts, and not rethinking them all?
Recommended reading/resources on the topic of justifying security expenditure :
Return on Information Security Investment
Risk - A Financial Overview
Calculated Risk - Guide to determining security ROI
The Return on Investment for Network Security
Analysis of Return on Investment for Information Security
Methodologies for Evaluating Information Security Investments
Risk Assessment for Security Economcis - very informative slides
Economics and Security Resource page
Information Security in the Extended Enterprise: Some Initial Results From a Field Study of an Industrial Firm
PKI and Financial Return on Investment
Privacy Breach Impact Calculator
Guide to Selecting Information Technology Security Products
Friday, May 12, 2006
"It'd be one thing if the NSA's massive sweep of our phone records was actually helping catch terrorists. But what if it's not working at all? A leading practitioner of the kind of analysis the NSA is supposedly performing in this surveillance program says that "it's a waste of time, a waste of resources. And it lets the real terrorists run free." Re-reading the USA Today piece, one paragraph jumped out: This kind of data collection from phone companies is not uncommon; it's been done before, though never on this large a scale, the official said. The data are used for 'social network analysis,' the official said, meaning to study how terrorist networks contact each other and how they are tied together. So I called Valdis Krebs, who's considered by many to be the leading authority on social network analysis -- the art and science of finding the important connections in a seemingly-impenetrable mass of data. His analysis of the social network surrounding the 9/11 hijackers is a classic in the field."
It gets even more interesting with a comparison of a Fortune 500 company's network and Al Qaeda's one. Social networks are among the driving forces of Web 2.0, and I find the concept of communication and planning online a very realistic one. And if you really want to know more about social networks in the business world, corporate anthropologist Karen Stephenson - The Organization woman is really up to it, very good article. And of course, Valdis Kreb's blog on smart economic networks.
Thursday, May 11, 2006
"Last month, a company called Stealth Ideas Inc. of Woodland Hills, Calif., came out with its StealthSurfer II ID Protect. The miniature flash drive lets you surf anonymously from any computer using an integrated browser that runs in an encrypted mode. It comes loaded with several tools, including Anonymizer Anonymous Surfing 1.540 (which has IP masking), RoboForm Pass2Go 6.5.9 (a user ID/password management application) and Thunderbird 1.0.7 (for e-mail access). But before you buy, check to see if the company has upgraded its browser, which, according to company officials at the product’s launch, is Firefox 18.104.22.168. US-CERT and others have warned about significant vulnerabilities in certain versions of Firefox (and Thunderbird, for that matter). The version available as of press time, Version 22.214.171.124, addresses those flaws."
Is the Anonymizer behind the idea, or is it a middleman trying to add value to the Anonymizer's existing offer, and harness the brand powers of Firefox and Hushmail all in one? Wise, but the entire idea of anonymity is based on the Anonymizer's service, when anonymity still can be freely achieved to a certain extend. Very portable idea, the thing is there are already free alternatives when it comes to pocket anonymity and that's TorPark: Anonymous browsing on a USB drive, and I think I can live without the enhancements.
Yesterday, I came across to a translated version of Bin Laden's most recent "State of Jihad" speech April 23, 2006, and I feel blaming the "infidels" for whatever goes around the world, or taking anything against Islam personally, is a very weak point. From the article :
"One more time Al Jazeera pomotes an Usama Bin Laden speech. After airing portions of the Bin Laden audiotape al Jazeera posted large fragments of the “speech” on its web site. This was the longest version possible we were able to have access to. After careful reading, my assessment of the “piece” got reinforced: This is not just another audiotape or videotape of a renegade in some cave. Regardless of who is the speaker and his whereabouts, the 30 minutes long read statement is a declaration, probably as important as the February 1998 declaration of war against America, the Crusaders and their allies. Imagine yourself as an Arab viewer: The speech was repeated endlessly throughout the day. Bin Laden didn't have his 20 minutes of shine, but 24 hours at least. The Bin Laden audiotape wasn't played one or two times but until every word was sinking deep in the minds of the attentive viewers. However the most powerful part of the speech wasn't restricted to its content: Al Jazeera lined up the best of its "experts on Islamist groups" to react instantly to the audiotape and throughout the day, and add "more details and substance."
At the bottom line, religion still remains the opium of the masses and an excuse for not taking care of your own destiny but expecting "someone else" to.
"builds on the idea behind the Google Zeitgeist, allowing you to sort through several years of Google search queries from around the world to get a general idea of everything from user preferences on ice-cream flavors to the relative popularity of politicians in their respective cities or countries."
This is what I've been waiting for quite some time, and you can easily make very good judgements on key topics based on regions, languages, even cities -- marketers get yourself down to business!
Antivirus, Malware, Spyware, NSA, Censorship, Privacy
What's next, the rise of MyWare and its integration on the Web? Give a try to Yahoo!'s Buzz, and PacketStormSecurity's instant StormWatch as well.
Tuesday, May 09, 2006
"The skepticism expressed so openly toward the administration's case encouraged civil liberties and education groups that argued that the U.S. is improperly applying telephone-era rules to a new generation of Internet services. "Your argument makes no sense,'' U.S. Circuit Judge Harry T. Edwards told the lawyer for the Federal Communications Commission, Jacob Lewis. ''When you go back to the office, have a big chuckle. I'm not missing this. This is ridiculous. Counsel!' The Justice Department, which has lobbied aggressively on the subject, warned in court papers that failure to expand the wiretap requirements to the fast-growing Internet phone industry ''could effectively provide a surveillance safe haven for criminals and terrorists who make use of new communications services.''
What's worth mentioning is that on a wide scale VoIP services are often banned in many countries, ISPs don't tend to tolerate the traffic which on the other hand directly bypasses their VoIP offers, and even China, one of the largest telecom market continues to have concerns about VoIP. Companies also seem to be revising their practices while trying to block Skype, among the most popular VoIP applications. Rather interesting, T-Mobile just announced that it would ban VoIP on its 3G network, but is it inability to achieve compliance or direct contradiction with their business practices? Whatever the reason, VoIP communications aren't everyone's favorite, but represent a revolution in cheap, yet reliable communications. The more easily a network is made wiretap-ready, the easier for attackers in both, the short, and the long-term to abuse the backdoored idea itself, so don't. You can actually go through the 2005's Wiretap Report and figure out the cost of wiretapping, limiting it by promoting insecure networks isn't going to solve anything, given you actually know what you're looking for at the bottom line.
Image courtesy of EFF's "Monsters of Privacy" Animation.
Related resources :
VoIP, FCC, CALEA
Communications Assistance for Law Enforcement Act and Broadband Access and Services
Secure VoIP - Zfone
Sniffing VoIP Using Cain
Oreka VoIP Sniffer
"Real-time tracking of cell phones is possible because mobile phones are constantly sending data to cell towers, which allows incoming calls to be routed correctly. The towers record the strength of the signal along with the side of the tower the signal is coming from. This allows the phone's position to be easily triangulated to within a few hundred yards. But the legal grounds for obtaining a tracking order is murky -- not surprising since technology often outpaces legislation. The panel agreed that Congress should write rules governing what level of suspicion cops need to have before tracking people through their cell phones."
While on the other hand, there's also an ongoing commercialization of the service by the industry itself, if the government were to start using practices like these with grey subpoenas, it would undermine the customers' trust in the industry and BigBrother is going to get even bigger. Enthusiasts are already experimenting with DIY cell phone tracking abilities, so if you worry about being tracked through your phone, you should also start worrying about having an extra one in your bag. Physical insecurities such as digital forensics on cell phones, even counter-offerings are today's reality, while flexible lawful wiretapping may still be taking one way or another -- I guess the NSA got all the attention recently, with their domestic spying program.
As the Mindmaker pointed out, we must assume that we are trackable wherever we go, but I think this dependence would get even more abused in the future by the time proposed laws match with the technology.
Monday, May 08, 2006
"The only economic model that does not make sense to me is the vendor's," Sutton said. "They get to know about a vulnerabilities ahead of time, but they are unwilling to pay for them." - Michael Sutton
"What I can give people who find vulnerabilities is a small amount of fame. iDefense can give them $10,000." - Darius Wiles
"As a civil rights issue, selling vulnerabilities is just fine. As a keeping-the-customers safe issue, it's junk." - Novell director of software engineering Crispin
"If I come to you and offer to sell you a vulnerability in your product, I am going to be cuffed and arrested," he told the representatives of software makers on the panel." - Matthew Murphy
And the discussion is reasonably pretty hot with a reason. Back in January Microsoft expressed their opinion on the informediaries based market model like :
"One day after iDefense, of Reston, Va., announced the bounty as part of a newly implemented quarterly hacking challenge, a spokesperson for Microsoft, based in Redmond, Wash., said paying for flaws is not the best way to secure software products. "We do not believe that offering compensation for vulnerability information is the best way [researchers] can help protect customers," the spokesperson said in a statement sent to eWEEK. "
and while Microsoft talks about responsible disclosure, that's exactly the type of model I don't really think exist anymore. Peter Mell made a good point that "I don't support this activity. Basically, it enables third parties to unfairly focus attention on a particular vendor or product. It does not help security in the industry," Mell said in an interview with eWEEK." -- but it still offers the opportunity to bring order into the chaos doesn't it?
The WMF vulnerability apparently got purched for $4000 and I among the few scenarios that I mentioned were on vendors purchasing vulnerabilities and requested vulnerabilities, or a reverse model :
"requested vulnerabilities are the worst case scenario I could think of at the moment. Why bother and always get excited about an IE vulnerability, when you know person/company X are running Y AV scanner, use X1 browser as a security through obscurity measure. That's sort of reverse model compared to current one where researchers "push" their findings, what if it turns into a "pull" approach, "I am interested in purchasing vulnerabilities affecting that version of that software", would this become common, and how realistic is it at the bottom line?"
Coming across 0day vulnerabilities for sale, I also came across Rainer Boehme's great research on various market models, among them exploit derivatives. Have you ever though of using exploit derivatives, on the called "futures market"? I think the idea has lots of potential, and he described it as :
"Instead of trading sensitive vulnerability information directly, the market mechanism is build around contracts that pay out a defined sum in case of security events. For instance, consider a contract that pays its owner the sum of 100 EUR on say 30 June 2006 if there exists a remote root exploit against a precisely specified version of ssh on a defined platform."
The OS/Vendor/Product/Version/Deadline type of reverse model that I also mentioned is a good targeted concept if it were used by vendors for instance, and while it has potential to have a better control over the market, the lack of common and trusted body to take the responsibility to target Windows and Apple 50/50 for istance, still makes me think. The best part is how it would motivate researchers at the bottom line -- deadlines result in spontaneous creativity sometimes.
More on the topic of security vulnerabilities and commercializing the market, in a great article by Jennifer Granick (remember Michael Lynn's case?) she said that :
"I'm more concerned that commercialization, while it promotes discovery, will interfere with the publication of vulnerability information. The industry adopted responsible disclosure because almost everyone agrees that members of the public need to know if they are secure, and because there is inherent danger in some people having more information than others. Commercialization throws that out the window. Brokers that disclose bugs to their selected list of subscribers are necessarily withholding important information from the rest of the public. Brokers may eventually issue public advisories, but in the meantime, only the vendor and subscribers know about the problem."
Who should be empowered at the bottom line, the informediaries centralizing the process, or the security researchers/vulnerability diggers starting to seek bids for their reseach efforts?
On the other hand, I think that the current market model suffers from a major weakness and that is the need for achieving faster liquidity if we can start talking about such. Basically, sellers of vulnerabilities want to get their commissions as soon as possible, which is where the lucrative underground market easily develops. While I am aware of cases where insurers are already purchasing vulnerabilities to hedge risks until tomorrow I guess, anyone would put some effort into obtaining a critical MS vulnerability given a deadline and hefty reward, but who's gonna act as a social planner here?