Role of Encryption in Cybercrime

Encryption will become an increasing presence in cybercrimes for a number of reasons. Encryption is an excellent method for protecting data from prying eyes. In most cases corporations will use encryption to protect data from criminals, but now criminals are implementing encryption to cover their tracks and hide illegal material such as child pornography and copyright infringing material. Encrypted data is extremely difficult to decipher without a decryption key, and the technical means to do so is well beyond most law enforcement resources.

Current laws do not include any provisions forcing individuals to release their decryption keys or passwords. In some landmark cases, judges have either mandated individuals to give up their passwords, or exclude encrypted data from incriminating evidence. In most cases, defendants have claimed the Fifth Amendment, claiming that being forced to give up their encryption key effectively incriminates themselves, which is unconstitutional. In other regions around the globe, some governments have implemented “mandatory disclosure laws”, which forces an individual under law to decrypt their data as evidence. In the In re Boucher case in Vermont (United States District Court for the District of Vermont, 2009), the District Court overturned a Magistrate’s decision to uphold the Fifth Amendment by claiming Boucher was only required to reveal the unencrypted contents of the laptop hard drive, not reveal his decryption key. Incriminating evidence was discovered and he was sentenced in 2010.

Until mandatory disclosure laws are universally implemented across the country, cybercriminals will implement encryption in more cases, due to the obvious advantages encryption provides in committing cybercrimes.  

Cybercrime Ecosystem

Most IT professionals are not aware of the vast criminal ecosystem thriving on the internet. Criminal organizations have developed a way to monetize the exploitation of computer systems in many ways. Identity Theft is the most prevalent in the media, where criminals will obtain and sell credit cards and other personal identifiable information to commit many types of fraud. In addition to a “dox” marketplace, cybercriminals will sell DOS services, botnets, targeted malware, and as covered in a recent article, remote access to corporate computers. One of the leading security researchers, Dancho Danchev, often covers the latest malware frameworks on the web. Entire software suites exist to manage targeted DOS and phishing operations, such as Zeus. Leading security researchers in large organizations can attest to what is considered that Advanced Persistent Threat.   

                APT’s are the hot topic in the security realm these days, which describe dangerous and recurring security attacks that are usually state sponsored and  difficult to detect. They have a targeted purpose and active only when a special set of circumstances are met. While these attacks may be state sponsored for the time being; due to the vast amount of knowledge and expertise it requires to create such a dangerous software attack, the cybercrime ecosystem is evolving to a point where APT’s may come with a dollar value. Criminal organizations have thrived off of monetizing any kind of illegal acts, as long as there is a benefit and a market. As the internet expands, encompassing more than just corporations, one can definitely expect the expansion of a cybercrime market. 

IP: The Great Debate

Another massive DMCA screw-up hit the newswire today when hosting provider ServerBeach took down 1.45 million education blogs for a little over an hour in an attempt to comply with a DMCA takedown notice. One blog had content copyrighted by publishing giant Pearson from 1974. While this is just the latest in a series of widespread events in where innocent people are harmed by the Digital Millenium Copyright Act, it brings up a hot topic in securing intellectual property.

As security information professionals, and information technology gurus, we often like to push the whole IP thing under the rug. Anyone who uses computers on a regular basis knows how and where to get the latest "warez", albeit PirateBay, Demonoid, or other torrent/file sharing website. As security professionals, we are expected to uphold high integrity, and secure intellectual property from crackers instead of passing it around. Some claim that file sharing is harmless, and some studies go so far to claim that file sharing increases awareness, improving business sales. I personally feel the same amount of guilt for file sharing as I do breaking the speed limit, but in most cases, file sharing hurts developers and artists alike.

In the instance of the EduBlog case today, its easy for users to cry fowl of the DMCA act and push for less regulation on the internet. The reality is, business models are perfect, and neither are government regulations. It doesn't change the fact that IP does need protection. While crackers may justify their actions for breaking the latest SecuROM, as a way to convince businesses to change their model and lower prices, its often the developers, artists, and writers behind the IP that get the shaft when sales are not optimal. Kindle ebook authors rarely get more than 50% of their book sales back, developers only see a fraction of game sales in their yearly salaries. Piracy hurts the industry, no matter how or where it occurs. It's for this reason that information security professionals should take a moment to realize the impact of that latest download on their hard drive, and consider how their life would be if someone took advantage of our skillsets for free.

DARPA's Hackerspaces

Friday the New York Times published an article outlining one of DARPA’s latest research grants, money to finance “Hackerspace” programs at local schools in California. These security research programs provide an outlet for students to experiment and practice their cyber security skills, in what O’Leary deems a “shop class for the 21^st” century. While these types of programs are an excellent development for the computer technology realm, some have concerns about the underlying motivations that come with DARPA money.

Personally I believe this news of government funded security research is great news, for several reasons. DARPA funds several other edge projects, not just IT related fields. To associate these government funded programs with military co-op is rather paranoid and unfounded. Of course this bias is often associated with the New York Times, a very liberal and anti-military news organization. The government has historically fallen behind with adopting new technologies; often outsourcing IT related needs to private entities. By investing some money in the young minds most familiar with the fast paced technology realm, the government can glean information and innovations to be applied across the nation.

High school IT training is also either nonexistent or ineffective for most schools. By introducing some advanced research, DARPA leads the way in schools to introduce some better IT classes, and promote interest in more students. Students who are familiar with modern information security threats are also more knowledgeable in basic IT and programming techniques, learning best practices before they even get to a university or college.

I would like to see more of a government initiative in cyber security research. After all, the United States opened the court for cyber warfare and malware use with Stuxnet, we should be better prepared for retaliation and implementation going forward.

O'Leary, A. (2012, October 5). Worries Over Defense Department Money for ‘Hackerspaces’. Retrieved from The New York Times: http://www.nytimes.com/2012/10/06/us/worries-over-defense-dept-money-for-hackerspaces.html?hpw&_r=0

[ams]

Public Key Infrastructure

Adobe, the major software corporation that brings us Flash, PDF’s, and the all-encompassing Creative Suite, experienced a major security breach last week when hackers were able to sign malware with one of their encryption certificates. The two signed programs discovered were rather minor pieces of malware, however the attacker’s ability to exploit Adobe’s signing structure poses a more serious threat. It also shines light on one of the key weaknesses of Public Key Infrastructure (PKI), the framework that enables SSL/TLS secured communication between servers and clients.

To fully understand this weakness, one has to understand how PKI actually works. A client or server will create what is called an “encryption key” that allows data to be encrypted based on the random characters inside the encryption key file. In traditional symmetrical encryption, that same encryption key is used to both encrypt & decrypt the data. This can pose a security problem because that key file has to be shared between all parties for them to understand each other’s data.

Asymmetrical encryption algorithms were developed that allow a party to encrypt data with one key, and decrypt it with another. Now clients and servers generate two keys, a private secret key file, and a public, accessible, key file. Party A that wants to communicate with Party B will grab Party B’s public key to encrypt the data, and Party B will use its secret private key to decrypt the information. This eliminates the need for users to share that secret key information.

In short, certificates are basically public encryption keys. Certificates are a way to distribute the public keys, and identify that those public keys really belong to the parties they claim they are. X.509 is the technical standard by which certificates are created. Normally most companies will request a certificate from a trusted third party, with their private key, who will then verify and generate a certificate to be distributed across the web for that company. These trusted third parties are called Certificate Authorities, and exist only to verify that companies are who they say they are, and aren’t malicious hackers after your information.

If the picture is any clearer now, you will begin to understand how dangerous a compromised certificate is. These hackers are able to pose as Adobe, distributing trusted software. It is even more serious when CA’s are breached, which happens more often than one would expect. This is why it is important to pay attention to your web browser. If a prompt appears claiming to not trust the “security certificate”, it’s usually a good indicator the website you are visiting is not who they claim to be. 

Recent Mobile Security Improvements

Apple recently released its iOS 6 mobile device operating system, bringing some small features and performance tweaks to the platform for the iPhone 5 and some existing devices. With the new phone and operating system, more businesses are looking to adopt Apple smartphones or incorporate those personal devices into their own network environment. Historically Apple & Android smartphones have very weak native security controls. A new type of solution to manage these devices outside the trusted network has arisen in what’s called Mobile Device Management, or MDM. A few major contenders in this space are AirWatch and GoodLink. Both AirWatch and GoodLink incorporate a rather intrusive solution that allows administrators to remotely wipe your device should it be lost or unaccounted for. While this supports good security, it also places your personal device at risk for data loss. The individual is usually the one to make that decision.

Should the corporation wish to provide their own Apple products for employees to use, iOS 6 has incorporated some new security features to restrict access and configuration. Guided Access, primarily an iPad feature, has been added to iPhone and iPods as well. This allows administrators to define boundaries for a user inside the iOS environment. This is particular useful in setting up iPad’s as kiosks or workstations where users are defined to a single app or area.

Apple has also introduced Supervised Mode with remote manageability in iOS6. With the free Apple’s Configurator app, administrators can generate profiles that restrict access to almost every element inside iOS6, improving the deployment capabilities of Apple hardware amongst the workforce.

 

Gallgher, S. (2012, September 21). Locking up, locking down: Hands-on with iOS 6 enterprise management. Retrieved from ArsTechnica: http://arstechnica.com/apple/2012/09/locking-up-locking-down-hands-on-with-ios-6-enterprise-management/

[ams]

Exit Personal Computer, Enter Hybrid Monster

According to All Things D, the Personal Computing Age is over. No longer are personal computers the Apple of everyone's eye, the height of computing technology, or even the most widely used devices in today's marketplace. New market data has revealed that PC’s no longer account for the largest market share of consumer memory chips, which are finding themselves in more smartphones, tablets, ultrabooks, and other amorphous computational devices. The definition of a computer has never been more blurry, as anyone can observe from watching five minutes of the Consumer Electronics Show (CES) in Vegas. Computers are now becoming devices with any combination of keyboards, screens, touch-sensitive displays, and strange form factors. Is the Age of the Personal Computer truly over?

While more and more devices emerge from the dark secret labs of Samsung, Apple, Intel, and other personal electronics makers, there is still one king of the hill. IPads and tablets are great and fun toys, but they are far from being a viable replacement for a full laptop computer. Some editors have gone so far as to claim the iPad is a step backwards in innovation, citing the whole point of a keyboard and screen is to move the hands out of the workspace. While extended battery life and the ability to interact with programs using your hands is an interesting development in the computing space, I have yet to encounter any user interface where I feel more in control or productive on a tablet or smartphone. They are excellent form factors for portability, but they cannot achieve the level of interaction and capability a personal computer can.

So I can’t help but shake my head at these ridiculous claims and buzzword articles. The Age of Personal Computing will be around for as long as I still have to carry around a laptop to get any real work done.

 

Hesseldahl, A. (2012, September 15). It’s Official: The Era of the Personal Computer Is Over. Retrieved from All Things D: http://allthingsd.com/20120915/its-official-the-era-of-the-personal-computer-is-over/

Open Wifi. Free game?

 An Illinois Judge recently ruled that accessing and sniffing traffic over an open wifi network is not illegal. (Lee, 2012) While this was a preliminary judgment, and in direct contradiction with one made in 2011 against Google, who was accused of sniffing traffic from open networks around its Street View vehicles, this could open the door to abuse of open wireless networks in places such as restaurants, cafés, and public areas around the nation.

Sniffing is a term used by security professionals to describe the process of copying or analyzing data that is being transmitted over a network. Traditionally, an intruder would require physical access to network equipment to be able to sniff data, but with the advent of 802.11 wireless networking equipment, it is a trivial matter to crack the encryption code and gain access to a wireless network. Open Wifi networks do not even have encryption enabled, making it extremely easy to take advantage of other clients on the network.

But wait! Don’t most website use their own SSL encryption now? Unfortunately, several attacks can be used against local clients on the network such as ARP cache poisoning, sslstrip, and other man-in-the-middle attacks (MITM) enabling an intruder to intercept your data, decrypt it, and gain access to whatever you are sending over the internet (including passwords).

By now it should be obvious that this ruling is a mistake. Not every wireless implementation can use encryption to protect accessibility, as the goal is to make the network accessible to everyone. While users should practice good security while they are on insecure wireless networks, the law shouldn’t give  a green light to malicious users looking to spy on others.

 

Lee, T. B. (2012, September 7 2012). Sniffing open Wifi networks is not wiretapping, judge says. Retrieved from Ars Technica: http://arstechnica.com/tech-policy/2012/09/sniffing-open-wifi-networks-is-not-wiretapping-judge-says/

[ams]

DPI, NSA, and Your Privacy

Deep Packet Inspection (DPI) technology has emerged as key feature and innovative advancement in firewall technology. Firewalls in the past have only been able to monitor and control traffic based on the destination, source, and state information that packets contain. More modern firewalls are implementing DPI as a base feature, allowing network administrators to take an extremely close look at the data segments of IP packets and perform complex analysis on what exactly is traversing across their networks. (Porter, 2010) While this feature evolved as a way to combat malware, it is quickly turning into a surveillance tool, which if abused, can have significant negative impacts on our privacy.

                A perfect example of this abuse can be found in tumultuous Libya. The infamous dictator Muammar Gaddafi implemented technology supplied by French firm Bull to track internet traffic for the entire country. (Gallgher, 2012) More examples of internet tracking and filtering are surfacing in countries such as China, North Korea, and Iran. While these methods to deter western influence on extremely conservative countries seem like radical ideas to our American free world ideals, to eastern viewpoints, our western ideals seem radical. Americans would consider this huge breach of privacy an unethical abuse of government technology and power.

                Unfortunately, Americans may be surprised to know that the National Security Agency (NSA) may be guilty of these same monitoring and surveillance practices, which is illegal in the United States. The EFF was issued evidence by AT&T employee Mark Klein that the broadband megacorp was working in conjunction with the NSA to direct an entire fibre optic line to a special analysis location controlled by the NSA. (Electronic Frontier Foundation) As the saying goes “Where there’s smoke, there’s fire”, there is sufficient reason to believe the NSA conducts other clandestine monitoring of the nation’s citizens.

                Is networking analysis and monitoring unethical? In cases such as the aforementioned fibre splitter, copying citizen’s internet data without warrant is illegal. In countries where monitoring and filtering is widely acknowledged and practiced, should global organizations make efforts to combat the abuse of technology to subvert privacy? One must look at the context of these two drastically different implementations. In America where privacy is greatly protected by law, actions such as the NSA’s are extremely unethical, regardless of cause. In eastern countries where culture, religion, and tradition are paramount, internet access control and monitoring may be seen as a necessary precaution to the ruling body.  It is difficult to determine whether internet traffic monitoring is strictly unethical, but in the United States, the law slims down this shady area of grey.

Electronic Frontier Foundation. (n.d.). AT&T's Role in Dragnet Surveillance of Millions of Its Customers. Retrieved September 3, 2012, from www.eff.org: https://www.eff.org/files/filenode/att/presskit/ATT_onepager.pdf

Gallgher, S. (2012, August 29). Big Brother on a budget: How Internet surveillance got so cheap. Retrieved September 3, 2012, from Ars Technica: http://arstechnica.com/information-technology/2012/08/big-brother-meets-big-data-the-next-wave-in-net-surveillance-tech/

Porter, T. (2010, October 19). The Perils of Deep Packet Inspection. Retrieved September 3, 2012, from Symantec Connect: http://www.symantec.com/connect/articles/perils-deep-packet-inspection

Hello W0rld

Welcome to the Black Tie Security blog, a commentary and collection of Information Security related topics that I will be discussing for my Fall 2012 Emerging Issues in InfoSec course at Kennesaw State University. I am Austin Schoen, part time Quality Assurance intern for nCircle Network Security and senior undergraduate student. I do testing on Purecloud, a cloud based network vulnerability scanner. I also frequently work on web development projects and IT support for people in the metro Atlanta area.

Since I won't have a formal post for another few days I'll just go ahead and include some of my favorite sites on the web where I glean the latest security news.

My all time favorite is ArsTechnica. They have awesome in depth articles on everything IT, security included. Its usually the first site I hit when I sit down to read and check out what's going on.

http:///www.arstechnica.com

Some other good sites I visit frequently are:
http://www.reddit.com/r/netsec (user revers3TCP for fellow redditors!)
http://www.zdnet.com
http://www.anandtech.com
http://packetstormsecurity.org/

I also follow several great sources on Twitter for the latest security happenings. If you aren't a fan of Twitter, or have any desire to tweet, I would encourage everyone to at least create an account and find great sources to follow. Twitter is most valuable as a real time news feed, (not just a long list of when everyone stops by Starbucks). I will be sure to compile a list of my favorite people on Twitter to follow in a future post.

[ams]