Cybercrime Ecosystem

Most IT professionals are not aware of the vast criminal ecosystem thriving on the internet. Criminal organizations have developed a way to monetize the exploitation of computer systems in many ways. Identity Theft is the most prevalent in the media, where criminals will obtain and sell credit cards and other personal identifiable information to commit many types of fraud. In addition to a “dox” marketplace, cybercriminals will sell DOS services, botnets, targeted malware, and as covered in a recent article, remote access to corporate computers. One of the leading security researchers, Dancho Danchev, often covers the latest malware frameworks on the web. Entire software suites exist to manage targeted DOS and phishing operations, such as Zeus. Leading security researchers in large organizations can attest to what is considered that Advanced Persistent Threat.   

                APT’s are the hot topic in the security realm these days, which describe dangerous and recurring security attacks that are usually state sponsored and  difficult to detect. They have a targeted purpose and active only when a special set of circumstances are met. While these attacks may be state sponsored for the time being; due to the vast amount of knowledge and expertise it requires to create such a dangerous software attack, the cybercrime ecosystem is evolving to a point where APT’s may come with a dollar value. Criminal organizations have thrived off of monetizing any kind of illegal acts, as long as there is a benefit and a market. As the internet expands, encompassing more than just corporations, one can definitely expect the expansion of a cybercrime market. 

IP: The Great Debate

Another massive DMCA screw-up hit the newswire today when hosting provider ServerBeach took down 1.45 million education blogs for a little over an hour in an attempt to comply with a DMCA takedown notice. One blog had content copyrighted by publishing giant Pearson from 1974. While this is just the latest in a series of widespread events in where innocent people are harmed by the Digital Millenium Copyright Act, it brings up a hot topic in securing intellectual property.

As security information professionals, and information technology gurus, we often like to push the whole IP thing under the rug. Anyone who uses computers on a regular basis knows how and where to get the latest "warez", albeit PirateBay, Demonoid, or other torrent/file sharing website. As security professionals, we are expected to uphold high integrity, and secure intellectual property from crackers instead of passing it around. Some claim that file sharing is harmless, and some studies go so far to claim that file sharing increases awareness, improving business sales. I personally feel the same amount of guilt for file sharing as I do breaking the speed limit, but in most cases, file sharing hurts developers and artists alike.

In the instance of the EduBlog case today, its easy for users to cry fowl of the DMCA act and push for less regulation on the internet. The reality is, business models are perfect, and neither are government regulations. It doesn't change the fact that IP does need protection. While crackers may justify their actions for breaking the latest SecuROM, as a way to convince businesses to change their model and lower prices, its often the developers, artists, and writers behind the IP that get the shaft when sales are not optimal. Kindle ebook authors rarely get more than 50% of their book sales back, developers only see a fraction of game sales in their yearly salaries. Piracy hurts the industry, no matter how or where it occurs. It's for this reason that information security professionals should take a moment to realize the impact of that latest download on their hard drive, and consider how their life would be if someone took advantage of our skillsets for free.

DARPA's Hackerspaces

Friday the New York Times published an article outlining one of DARPA’s latest research grants, money to finance “Hackerspace” programs at local schools in California. These security research programs provide an outlet for students to experiment and practice their cyber security skills, in what O’Leary deems a “shop class for the 21^st” century. While these types of programs are an excellent development for the computer technology realm, some have concerns about the underlying motivations that come with DARPA money.

Personally I believe this news of government funded security research is great news, for several reasons. DARPA funds several other edge projects, not just IT related fields. To associate these government funded programs with military co-op is rather paranoid and unfounded. Of course this bias is often associated with the New York Times, a very liberal and anti-military news organization. The government has historically fallen behind with adopting new technologies; often outsourcing IT related needs to private entities. By investing some money in the young minds most familiar with the fast paced technology realm, the government can glean information and innovations to be applied across the nation.

High school IT training is also either nonexistent or ineffective for most schools. By introducing some advanced research, DARPA leads the way in schools to introduce some better IT classes, and promote interest in more students. Students who are familiar with modern information security threats are also more knowledgeable in basic IT and programming techniques, learning best practices before they even get to a university or college.

I would like to see more of a government initiative in cyber security research. After all, the United States opened the court for cyber warfare and malware use with Stuxnet, we should be better prepared for retaliation and implementation going forward.

O'Leary, A. (2012, October 5). Worries Over Defense Department Money for ‘Hackerspaces’. Retrieved from The New York Times: http://www.nytimes.com/2012/10/06/us/worries-over-defense-dept-money-for-hackerspaces.html?hpw&_r=0

[ams]

Public Key Infrastructure

Adobe, the major software corporation that brings us Flash, PDF’s, and the all-encompassing Creative Suite, experienced a major security breach last week when hackers were able to sign malware with one of their encryption certificates. The two signed programs discovered were rather minor pieces of malware, however the attacker’s ability to exploit Adobe’s signing structure poses a more serious threat. It also shines light on one of the key weaknesses of Public Key Infrastructure (PKI), the framework that enables SSL/TLS secured communication between servers and clients.

To fully understand this weakness, one has to understand how PKI actually works. A client or server will create what is called an “encryption key” that allows data to be encrypted based on the random characters inside the encryption key file. In traditional symmetrical encryption, that same encryption key is used to both encrypt & decrypt the data. This can pose a security problem because that key file has to be shared between all parties for them to understand each other’s data.

Asymmetrical encryption algorithms were developed that allow a party to encrypt data with one key, and decrypt it with another. Now clients and servers generate two keys, a private secret key file, and a public, accessible, key file. Party A that wants to communicate with Party B will grab Party B’s public key to encrypt the data, and Party B will use its secret private key to decrypt the information. This eliminates the need for users to share that secret key information.

In short, certificates are basically public encryption keys. Certificates are a way to distribute the public keys, and identify that those public keys really belong to the parties they claim they are. X.509 is the technical standard by which certificates are created. Normally most companies will request a certificate from a trusted third party, with their private key, who will then verify and generate a certificate to be distributed across the web for that company. These trusted third parties are called Certificate Authorities, and exist only to verify that companies are who they say they are, and aren’t malicious hackers after your information.

If the picture is any clearer now, you will begin to understand how dangerous a compromised certificate is. These hackers are able to pose as Adobe, distributing trusted software. It is even more serious when CA’s are breached, which happens more often than one would expect. This is why it is important to pay attention to your web browser. If a prompt appears claiming to not trust the “security certificate”, it’s usually a good indicator the website you are visiting is not who they claim to be.