Cybercrime Ecosystem

Most IT professionals are not aware of the vast criminal ecosystem thriving on the internet. Criminal organizations have developed a way to monetize the exploitation of computer systems in many ways. Identity Theft is the most prevalent in the media, where criminals will obtain and sell credit cards and other personal identifiable information to commit many types of fraud. In addition to a “dox” marketplace, cybercriminals will sell DOS services, botnets, targeted malware, and as covered in a recent article, remote access to corporate computers. One of the leading security researchers, Dancho Danchev, often covers the latest malware frameworks on the web. Entire software suites exist to manage targeted DOS and phishing operations, such as Zeus. Leading security researchers in large organizations can attest to what is considered that Advanced Persistent Threat.   

                APT’s are the hot topic in the security realm these days, which describe dangerous and recurring security attacks that are usually state sponsored and  difficult to detect. They have a targeted purpose and active only when a special set of circumstances are met. While these attacks may be state sponsored for the time being; due to the vast amount of knowledge and expertise it requires to create such a dangerous software attack, the cybercrime ecosystem is evolving to a point where APT’s may come with a dollar value. Criminal organizations have thrived off of monetizing any kind of illegal acts, as long as there is a benefit and a market. As the internet expands, encompassing more than just corporations, one can definitely expect the expansion of a cybercrime market. 

IP: The Great Debate

Another massive DMCA screw-up hit the newswire today when hosting provider ServerBeach took down 1.45 million education blogs for a little over an hour in an attempt to comply with a DMCA takedown notice. One blog had content copyrighted by publishing giant Pearson from 1974. While this is just the latest in a series of widespread events in where innocent people are harmed by the Digital Millenium Copyright Act, it brings up a hot topic in securing intellectual property.

As security information professionals, and information technology gurus, we often like to push the whole IP thing under the rug. Anyone who uses computers on a regular basis knows how and where to get the latest "warez", albeit PirateBay, Demonoid, or other torrent/file sharing website. As security professionals, we are expected to uphold high integrity, and secure intellectual property from crackers instead of passing it around. Some claim that file sharing is harmless, and some studies go so far to claim that file sharing increases awareness, improving business sales. I personally feel the same amount of guilt for file sharing as I do breaking the speed limit, but in most cases, file sharing hurts developers and artists alike.

In the instance of the EduBlog case today, its easy for users to cry fowl of the DMCA act and push for less regulation on the internet. The reality is, business models are perfect, and neither are government regulations. It doesn't change the fact that IP does need protection. While crackers may justify their actions for breaking the latest SecuROM, as a way to convince businesses to change their model and lower prices, its often the developers, artists, and writers behind the IP that get the shaft when sales are not optimal. Kindle ebook authors rarely get more than 50% of their book sales back, developers only see a fraction of game sales in their yearly salaries. Piracy hurts the industry, no matter how or where it occurs. It's for this reason that information security professionals should take a moment to realize the impact of that latest download on their hard drive, and consider how their life would be if someone took advantage of our skillsets for free.

DARPA's Hackerspaces

Friday the New York Times published an article outlining one of DARPA’s latest research grants, money to finance “Hackerspace” programs at local schools in California. These security research programs provide an outlet for students to experiment and practice their cyber security skills, in what O’Leary deems a “shop class for the 21^st” century. While these types of programs are an excellent development for the computer technology realm, some have concerns about the underlying motivations that come with DARPA money.

Personally I believe this news of government funded security research is great news, for several reasons. DARPA funds several other edge projects, not just IT related fields. To associate these government funded programs with military co-op is rather paranoid and unfounded. Of course this bias is often associated with the New York Times, a very liberal and anti-military news organization. The government has historically fallen behind with adopting new technologies; often outsourcing IT related needs to private entities. By investing some money in the young minds most familiar with the fast paced technology realm, the government can glean information and innovations to be applied across the nation.

High school IT training is also either nonexistent or ineffective for most schools. By introducing some advanced research, DARPA leads the way in schools to introduce some better IT classes, and promote interest in more students. Students who are familiar with modern information security threats are also more knowledgeable in basic IT and programming techniques, learning best practices before they even get to a university or college.

I would like to see more of a government initiative in cyber security research. After all, the United States opened the court for cyber warfare and malware use with Stuxnet, we should be better prepared for retaliation and implementation going forward.

O'Leary, A. (2012, October 5). Worries Over Defense Department Money for ‘Hackerspaces’. Retrieved from The New York Times: http://www.nytimes.com/2012/10/06/us/worries-over-defense-dept-money-for-hackerspaces.html?hpw&_r=0

[ams]

Public Key Infrastructure

Adobe, the major software corporation that brings us Flash, PDF’s, and the all-encompassing Creative Suite, experienced a major security breach last week when hackers were able to sign malware with one of their encryption certificates. The two signed programs discovered were rather minor pieces of malware, however the attacker’s ability to exploit Adobe’s signing structure poses a more serious threat. It also shines light on one of the key weaknesses of Public Key Infrastructure (PKI), the framework that enables SSL/TLS secured communication between servers and clients.

To fully understand this weakness, one has to understand how PKI actually works. A client or server will create what is called an “encryption key” that allows data to be encrypted based on the random characters inside the encryption key file. In traditional symmetrical encryption, that same encryption key is used to both encrypt & decrypt the data. This can pose a security problem because that key file has to be shared between all parties for them to understand each other’s data.

Asymmetrical encryption algorithms were developed that allow a party to encrypt data with one key, and decrypt it with another. Now clients and servers generate two keys, a private secret key file, and a public, accessible, key file. Party A that wants to communicate with Party B will grab Party B’s public key to encrypt the data, and Party B will use its secret private key to decrypt the information. This eliminates the need for users to share that secret key information.

In short, certificates are basically public encryption keys. Certificates are a way to distribute the public keys, and identify that those public keys really belong to the parties they claim they are. X.509 is the technical standard by which certificates are created. Normally most companies will request a certificate from a trusted third party, with their private key, who will then verify and generate a certificate to be distributed across the web for that company. These trusted third parties are called Certificate Authorities, and exist only to verify that companies are who they say they are, and aren’t malicious hackers after your information.

If the picture is any clearer now, you will begin to understand how dangerous a compromised certificate is. These hackers are able to pose as Adobe, distributing trusted software. It is even more serious when CA’s are breached, which happens more often than one would expect. This is why it is important to pay attention to your web browser. If a prompt appears claiming to not trust the “security certificate”, it’s usually a good indicator the website you are visiting is not who they claim to be. 

Recent Mobile Security Improvements

Apple recently released its iOS 6 mobile device operating system, bringing some small features and performance tweaks to the platform for the iPhone 5 and some existing devices. With the new phone and operating system, more businesses are looking to adopt Apple smartphones or incorporate those personal devices into their own network environment. Historically Apple & Android smartphones have very weak native security controls. A new type of solution to manage these devices outside the trusted network has arisen in what’s called Mobile Device Management, or MDM. A few major contenders in this space are AirWatch and GoodLink. Both AirWatch and GoodLink incorporate a rather intrusive solution that allows administrators to remotely wipe your device should it be lost or unaccounted for. While this supports good security, it also places your personal device at risk for data loss. The individual is usually the one to make that decision.

Should the corporation wish to provide their own Apple products for employees to use, iOS 6 has incorporated some new security features to restrict access and configuration. Guided Access, primarily an iPad feature, has been added to iPhone and iPods as well. This allows administrators to define boundaries for a user inside the iOS environment. This is particular useful in setting up iPad’s as kiosks or workstations where users are defined to a single app or area.

Apple has also introduced Supervised Mode with remote manageability in iOS6. With the free Apple’s Configurator app, administrators can generate profiles that restrict access to almost every element inside iOS6, improving the deployment capabilities of Apple hardware amongst the workforce.

 

Gallgher, S. (2012, September 21). Locking up, locking down: Hands-on with iOS 6 enterprise management. Retrieved from ArsTechnica: http://arstechnica.com/apple/2012/09/locking-up-locking-down-hands-on-with-ios-6-enterprise-management/

[ams]

Exit Personal Computer, Enter Hybrid Monster

According to All Things D, the Personal Computing Age is over. No longer are personal computers the Apple of everyone's eye, the height of computing technology, or even the most widely used devices in today's marketplace. New market data has revealed that PC’s no longer account for the largest market share of consumer memory chips, which are finding themselves in more smartphones, tablets, ultrabooks, and other amorphous computational devices. The definition of a computer has never been more blurry, as anyone can observe from watching five minutes of the Consumer Electronics Show (CES) in Vegas. Computers are now becoming devices with any combination of keyboards, screens, touch-sensitive displays, and strange form factors. Is the Age of the Personal Computer truly over?

While more and more devices emerge from the dark secret labs of Samsung, Apple, Intel, and other personal electronics makers, there is still one king of the hill. IPads and tablets are great and fun toys, but they are far from being a viable replacement for a full laptop computer. Some editors have gone so far as to claim the iPad is a step backwards in innovation, citing the whole point of a keyboard and screen is to move the hands out of the workspace. While extended battery life and the ability to interact with programs using your hands is an interesting development in the computing space, I have yet to encounter any user interface where I feel more in control or productive on a tablet or smartphone. They are excellent form factors for portability, but they cannot achieve the level of interaction and capability a personal computer can.

So I can’t help but shake my head at these ridiculous claims and buzzword articles. The Age of Personal Computing will be around for as long as I still have to carry around a laptop to get any real work done.

 

Hesseldahl, A. (2012, September 15). It’s Official: The Era of the Personal Computer Is Over. Retrieved from All Things D: http://allthingsd.com/20120915/its-official-the-era-of-the-personal-computer-is-over/

Open Wifi. Free game?

 An Illinois Judge recently ruled that accessing and sniffing traffic over an open wifi network is not illegal. (Lee, 2012) While this was a preliminary judgment, and in direct contradiction with one made in 2011 against Google, who was accused of sniffing traffic from open networks around its Street View vehicles, this could open the door to abuse of open wireless networks in places such as restaurants, cafés, and public areas around the nation.

Sniffing is a term used by security professionals to describe the process of copying or analyzing data that is being transmitted over a network. Traditionally, an intruder would require physical access to network equipment to be able to sniff data, but with the advent of 802.11 wireless networking equipment, it is a trivial matter to crack the encryption code and gain access to a wireless network. Open Wifi networks do not even have encryption enabled, making it extremely easy to take advantage of other clients on the network.

But wait! Don’t most website use their own SSL encryption now? Unfortunately, several attacks can be used against local clients on the network such as ARP cache poisoning, sslstrip, and other man-in-the-middle attacks (MITM) enabling an intruder to intercept your data, decrypt it, and gain access to whatever you are sending over the internet (including passwords).

By now it should be obvious that this ruling is a mistake. Not every wireless implementation can use encryption to protect accessibility, as the goal is to make the network accessible to everyone. While users should practice good security while they are on insecure wireless networks, the law shouldn’t give  a green light to malicious users looking to spy on others.

 

Lee, T. B. (2012, September 7 2012). Sniffing open Wifi networks is not wiretapping, judge says. Retrieved from Ars Technica: http://arstechnica.com/tech-policy/2012/09/sniffing-open-wifi-networks-is-not-wiretapping-judge-says/

[ams]