Mandiant APT1 Report: 25 Best Commentaries of the Last 12 Days

Two weeks ago today our team at Mandiant was feverishly preparing the release of our APT1 report.

In the twelve days that followed publication on the evening of Monday the 18th, I've been very pleased by the amount of constructive commentary and related research published online.

In this post I'd like to list those contributions that I believe merit attention, in the event you missed them the first time around.

These sorts of posts are examples of what the security community can do to advance our collective capability to counter digital threats.

Please note I avoided mass media accounts, interviews with Mandiant team members, and most general commentary.

They are listed in no particular order.

1. Seth Hall (Bro): Watching for the APT1 Intelligence
2. Jason Wood (SecureIdeas): Reading the Mandiant APT1 Report
3. Chris Sanders: Making the Mandiant APT1 Report Actionable
4. Symantec: APT1: Q&A on Attacks by the Comment Crew
5. Tekdefense (NoVA Infosec): MASTIFF Analysis of APT1
6. Chort Row (@chort0): Analyzing APT1 with Cuckoobox, Volatility, and Yara
7. Ron Gula (Tenable): We have Microsoft Tuesday, so how long until we have Indicator Wednesday?
8. OpenDNS Umbrella Labs:An intimate look at APT1, China’s Cyber-Espionage Threat
9. Chris Lew (Mandiant): Chinese Advanced Persistent Threats: Corporate Cyber Espionage Processes and Organizations (BSidesSF, slides not online yet)
10. Adam Segal: Hacking back, signaling, and state-society relations
11. Snorby Labs: APT Intelligence Update
12. Wendy Nather: Exercises left to the reader
13. Brad Shoop (Mandiant): Mandiant’s APT1 Domain/MD5 Intel and Security Onion for Splunk
14. Brad Shoop (Mandiant): Mandiant’s APT1 Domain/MD5 Intel and Security Onion with ELSA
15. Kevin Wilcox: NSM With Bro-IDS Part 5: In-house Modules to Leverage Outside Threat Intelligence
16. Cyb3rsleuth: Chinese Threat Actor Part 5
17. David Bianco: The Pyramid of Pain
18. Wesley McGrew: Mapping of Mandiant APT1 malware names to available samples
19. Russ McRee: Toolsmith: Redline, APT1, and you – we’re all owned
20. Jaime Blasco ( AlienVault Labs): Yara rules for APT1/Comment Crew malware arsenal
21. Brandon Dixon: Mandiant APT2 Report Lure
22. Seculert: Spear-Phishing with Mandiant APT Report
23. PhishMe: How PhishMe addresses the top attack method cited in Mandiant’s APT1 report
24. Rich Mogull (Securosis): Why China's Hacking is Different
25. China Digital Times: Netizens Gather Further Evidence of PLA Hacking

M-Unition (Mandiant) published Netizen Research Bolsters APT1 Attribution.

I'd also like to cite Verizon for their comments and mention of IOCExtractor and Symantec for publishing their indicators via Pastebin after I asked about it.

Thank you to those who took the time to share what you found when analyzing related APT1 data, or when showing how to use APT1 indicators to do detection and response.

Tweet

Read More

To Be Hacked or Not To Be Hacked?

People often ask me how to tell if they might be victims of state-serving adversaries. As I've written before, I don't advocate the position that "everyone is hacked." How then can an organization make informed decisions about their risk profile?

A unique aspect of Chinese targeted threat operations is their tendency to telegraph their intentions. They frequently publish the industry types they intend to target, so it pays to read these announcements.

Adam Segal Tweeted a link to a Xinhua story titled China aims to become world technological power by 2049. The following excerpts caught my attention:

China aims to become a world technological power by 2049 and strives to be a leading nation in innovation and scientific development, according to a government document released on Sunday.

The document, released by the Communist Party of China Central Committee and the State Council, or the Cabinet, namely opinions on "deepening technological system reform and accelerating national innovation system construction," sets the goal for the country to be "in the ranks of innovative nations" by 2020...

In this intro we read two key dates: 2020 for "in the ranks of innovative nations" and 2049 for a "world technological power." As we've seen during the last 10-12 years, one of the ways China pursues these goals is to steal intellectual property from target industries. What are those industries?

The development of strategic emerging industries, such as energy preservation and environmental protection, new-generation information technology, biology, advanced equipment manufacturing, new energy and material as well as green vehicles, should be accelerated, it said.

Major breakthroughs of key technologies should be materialized in sectors including electronic information, energy and environment protection, biological medicine and advanced manufacturing, it said.

Those industries have already been targeted and compromised by Chinese intruders. If you work in these areas but aren't actively seeking to detect and respond to Chinese intruders in your enterprise, I recommend taking a closer look at who is using your network.

Later in the document I was somewhat surprised to read the following:

And technological innovation should be made in industries that were related to people's livelihoods, such as health, food and drug safety, and disaster relief, the document said.

The underlined industries explain some activity I've seen recently, and it may be a warning for those of you in those sectors.

The last part of the document I would like to mention says the following: It called for an enhanced system to integrate the technologies for military use and those for civilian purposes.

The document said the nation's technological plan would be more open to the outside world in terms of cooperation, and international academic institutions and multinational companies would be encouraged to set up R&D centers.

None of that is new, but it shows the Chinese commitment to applying "dual use" technologies to both sides of that equation. It also shows the Chinese think they can still fool Western companies into sending engineers to China, where stealing IP is as easy as setting foot in an office building. Unfortunately plenty of Western companies appear to be falling for this ploy.

Tweet

Read More

The Toughest Question in Digital Security

The toughest question in digital security is "who cares?"

The recent Tweet by hogfly (@4n6ir) made me ponder this question. He points to an Aviation Week story by David Fulghum, Bill Sweetman, and Amy Butler titled China's Role In JSF's Spiraling Costs. It says in part:

How much of the F-35 Joint Strike Fighter’s spiraling cost in recent years can be traced to China’s cybertheft of technology and the subsequent need to reduce the fifth-generation aircraft’s vulnerability to detection and electronic attack?

That is a central question that budget planners are asking, and their queries appear to have validity. Moreover, senior Pentagon and industry officials say other classified weapon programs are suffering from the same problem. Before the intrusions were discovered nearly three years ago, Chinese hackers actually sat in on what were supposed to have been secure, online program-progress conferences, the officials say.

The full extent of the connection is still being assessed, but there is consensus that escalating costs, reduced annual purchases and production stretch-outs are a reflection to some degree of the need for redesign of critical equipment. Examples include specialized communications and antenna arrays for stealth aircraft, as well as significant rewriting of software to protect systems vulnerable to hacking.

It is only recently that U.S. officials have started talking openly about how data losses are driving up the cost of military programs and creating operational vulnerabilities, although claims of a large impact on the Lockheed Martin JSF are drawing mixed responses from senior leaders. All the same, no one is saying there has been no impact.

While claiming ignorance of details about effects on the stealth strike aircraft program, James Clapper, director of national intelligence, says that Internet technology has “led to egregious pilfering of intellectual capital and property. The F-35 was clearly a target,” he confirms.

The point of this article is to question the impact, in business and operational terms, of the cyberwar China continues to prosecute against the West.

The toughest question in digital security is "who cares" because it is usually extremely difficult to determine the impact of an intrusion. Consider the steps required to define the business and operational impact of the theft of intellectual property (as one example -- there are many others).

1. The victim must learn that an intrusion occurred.
2. The victim must determine exactly what IP was stolen.
3. The victim must understand the adversary's capability and intention to exploit the stolen IP.
4. The victim must recognize when the adversary exploits the stolen IP by using it in an operational context.
5. The victim must determine what countermeasures or changes in courses of actions are possible to mitigate the adversary's exploitation of the stolen IP.
6. The victim must synthesize most or all of the previous points into an assessment of the business and operational cost of the IP theft.

Steps 1 and 2 are largely technical, but 3-6 are more business-focused. From what I have seen, everyone who is a victim in the ongoing cyberwar struggles to conduct "battle damage assessment" (BDA) for digital intrusions. Articles like the one I cited are examples showing how difficult it is to determine if anyone should care about China's exploitation of Western IP.

Tweet

Read More

National Public Radio Talks Chinese Digital Espionage

When an organization like National Public Radio devotes an eleven minute segment to Chinese digital espionage, even the doubters have to realize something is happening. Rachel Martin's story China's Cyber Threat A High-Stakes Spy Game is excellent and well worth your listening (.mp3) or reading time.

Rachel interviews three sources: Ken Lieberthal of the Brookings Institution, Congressman Mike Rogers (chairman of the House Intelligence Committee), and James Lewis from the Center for Strategic and International Studies.

If you listen to the report you'll hear James Lewis mention "a famous letter from three Chinese scientists to Deng Xiaoping in March of 1986 that says we're falling behind the Americans. We're never going to catch up unless we make a huge investment in science and technology."

James is referring to the so-called 863 Program (Wikipedia). You can also read directly from the Chinese government itself here, e.g.:

In 1986, to meet the global challenges of new technology revolution and competition, four Chinese scientists, WANG Daheng, WANG Ganchang, YANG Jiachi, and CHEN Fangyun, jointly proposed to accelerate China’s high-tech development. With strategic vision and resolution, the late Chinese leader Mr. DENG Xiaoping personally approved the National High-tech R&D Program, namely the 863 Program.

Implemented during three successive Five-year Plans, the program has boosted China’s overall high-tech development, R&D capacity, socio-economic development, and national security.

In April 2001, the Chinese State Council approved continued implementation of the program in the 10th Five-year Plan. As one of the national S&T program trilogy in the 10th Five-year Plan, 863 Program continues to play its important role.

1. Orientation and Objectives

Objectives of this program during the 10th Five-year Plan period are to boost innovation capacity in the high-tech sectors, particularly in strategic high-tech fields, in order to gain a foothold in the world arena; to strive to achieve breakthroughs in key technical fields that concern the national economic lifeline and national security; and to achieve “leap-frog” development in key high-tech fields in which China enjoys relative advantages or should take strategic positions in order to provide high-tech support to fulfill strategic objectives in the implementation of the third step of our modernization process.

There's more to read, but that gives you a sense of what the "letter" involves.

I hope this NPR story helps some of you realize that the China threat is not "hype." Consider Dr Lieberthal in relation to Chairman Rogers and Jim Lewis. You can decide to try to refute their positions by saying that the Chairman has "an agenda," and Mr Lewis is essentially too distant from the problem. I personally think Chairman Rogers is right on the money, but I sometimes question where Mr Lewis gets his information.

Dr Lieberthal, however, is one of the world's finest minds regarding China (Wikipedia entry), and he served in the Clinton administration. He even wrote a book on how to achieve corporate success in China (Managing the China Challenge: How to Achieve Corporate Success in the People's Republic). He is not a "China hawk" trying to start some kind of "war" with the Chinese, yet he takes the threat seriously enough to discuss the countermeasures he takes when visiting China ten times a year. Do those who doubt the China threat still believe it's all "hype"?

Tweet

Read More

Interview with One of My Three Wise Men

Tony Sager from the NSA is one of my Three Wise Men. (Dan Geer and Ross Anderson are the other two.) Eric Parizo from SearchSecurity.com interviewed Tony this week and posted the video online.

Tony notes that the escalation in threat activity during the last few years is real. He is in a position to know, given he has worked at NSA since the 1970s. Tony says the threat activity is getting people's attention now, especially at more senior levels of the government and industry. Now targeted organizations are thinking beyond the question "does this affect my company" to "does this affect my industry?"

Tony explains that a generational effect may account for the change in awareness. More senior leaders grew up with technology, so they know how to think about it. There is also more public reporting on serious security incidents today.

My favorite quote was:

"If you're not a little concerned, you haven't been paying attention."

Since Tony is Mr Reasonable, I think that's a significant statement!

Eric asked Tony for his opinion on APT, and he replied that APT isn't that useful a concept for his line of work. That's possibly because his agency uses the original intrusion set names to manage threat intelligence, rather than an unclassified, "umbrella" term for discussing threat actors in private industry. Tony did explain that the "advanced" aspect for him means conducting operations in multiple "domains," e.g., escalating to physical, non-digital attacks when necessary.
Tweet

Read More

C-SPAN Posts Video of Tuesday Hearing

You can now access video of Tuesday's House Select Committee on Intelligence Hearing on Cybersecurity at C-SPAN.

Some people are already asking "what's new" about this. For me, what's new is that the chairman of the HPSCI is pointing his finger straight at the threat, and letting the world know in an open hearing that the adversary's actions are unacceptable and will not be tolerated. This is exactly the sort of attention and action that the threat deserves and I applaud the Chairman and HPSCI for pursuing this course.

Remember that the HPSCI is more likely to hold closed hearings than open hearings due to the nature of its classified intelligence oversight work. By conducting an open hearing, Chairman Rogers wanted to send a clear message to victims, the public, and the adversary.
Tweet

Read More

Bejtlich Cited in Chinese Article on APT

I found it ironic to see the names Richard Bejtlich and MANDIANT appearing in the article How to reduce the losses caused by APT attack? The reason this is funny is that the article appears in a Chinese-language story, published by a site operating in Beijing!

You can read the Google Translation if you can't read the original.

According to Tianji Media Group:

Established in January 1997, ChinaByte was the first IT news website in China.

So, welcome to the APT coverage!
Tweet

Read More

Classic Chinese Defensive Propaganda

Thanks to the sharp eye of a colleague from a mailing list, I learned of the article Is China Really Cyberdragon? in the English-language China Daily newspaper. The article is by Tang Lan, deputy director of the Institute of Information and Social Development Studies, China Institutes of Contemporary International Relations (a state-directed research institute). His writing displays all of the class elements of what I call Chinese defensive propaganda, in this case specifically addressing APT intrusions.

I'll cite a few examples so you know what I mean.

Hacking poses a threat to both China and Western countries and politicizing the problem will be detrimental to all.

The beginning of the article introduces the reader to the concept that China is just as much a victim of hacking as the West. This is the first invocation of "the victim card," which is a constant aspect of Chinese self-identity and international relations.

Tang Lan then dismisses accusations that the Chinese hack Western organizations, naming a few companies specifically. Then we read:

This is not the first time China has been the victim of such accusations. In fact, it was also accused of having instigated several previous systemic long-term intrusions, namely Operation Titan Rain, Night Dragon and Operation Aurora.

Again we see the victim card, using the actual word "victim." I think this section is counter-productive, because it reminds the reader that the Chinese have been publicly active against Western targets since 2003 (i.e., the mention of Titan Rain).

Western governments and media would have people believe that China has become a "cyberdragon", able to infiltrate the computer systems of countries and companies seemingly at will.

It may be tough for the author to appreciate this statement, but it's fairly true.

Besides, it is simply untrue to say that China is not a victim of cyber attacks. China was hit by nearly 493,000 cyber attacks last year, about half of which originated from foreign countries, including 14.7 percent from the US and 8 percent from India, according to a report issued on Tuesday by the Computer Network Emergency Response Technical Team / Coordination Center of China (CNCERT/CC), the country's primary computer security monitoring network.

Notice the third use of the victim card. More interestingly, who said "China is not a victim of cyber attacks?" Tang Lan introduces a red herring (pun intended) to divert our attention, and then uses statistics from CNCERT to show an argument (made by no one) is false.

Hacking poses a great threat to both China and Western countries and should be considered a common enemy. It is irresponsible to accuse any other country without ample evidence, and politicizing the problem will only prove detrimental to the interests of all.

As a responsible country, China has long held the principle of strengthening supervision of the Internet, and encourages all countries to cooperate for the common good.

We also hope other countries can hear China's voice, and understand China's efforts in defending the security of all.

In this amusing conclusion to the article, there are three points. First, we have a fourth invocation of the victim card. Second, we read of "irresponsible" and "responsible" countries. The US is "irresponsible" because its private, non-state-owned security firms are pointing the finger at China. China is "responsible" because it promotes "supervision of the Internet" (obviously via the Great Firewall of China). Third, China is supposedly encouraging "all countries to cooperate for the common good" and "defending the security of all." How is that happening, exactly?

I thought it was telling that someone in the Party decided to commission a response via an institutional speaker. The double-speak in the article shows China craves being seen as "responsible," which gives the West a strategy for diplomatic pressure against APT intrusions. I also expect to see the victim strategy used by China as a constant justification for whatever activity they pursue.

On a slightly humorous note, one of the responses to this article that I read on a mailing list asked the following question:

Given that the Chinese PLA assaults Chinese Web sites from compromised IP addresses in the United States (reported in Slip-Up in Chinese Military TV Show Reveals More Than Intended), what would the statistics look like if they removed all their self-inflicted attacks?
Tweet

Read More

Expect to Hear "IDS Is Dead" (Again)

Do you remember when IDS was dead, and supposed to be replaced by "thought-leading firewalls" by 2005?



Well, that prediction died pretty quickly. However, I expect to hear it again after reading DIB cybersecurity pilot has stopped 'hundreds' of intrusions, says Lynn:



About 20 companies participate in the Defense Department's 90-day pilot for an active network defense capability for the defense industrial base analogous to the Homeland Security Department's Einstein 3 effort, said Deputy Defense Secretary William Lynn.



During an address to the 2011 DISA Customer and Industry Forum in Baltimore, Md., Lynn said the sharing of malicious code signatures gathered through intelligence efforts to pilot participants has already stopped "hundreds of intrusions."



Lynn also laid blame for intrusions into military and defense industrial base networks on "foreign intelligence services," stating that they have stolen military plans, weapons system designs, source code and other intellectual property.



"This kind of cyber exploitation does not have the dramatic impact of a conventional military attack," Lynn said. "But over the long term, it has a deeply corrosive effect. It blunts our edge in military technology and saps our competitiveness in the global economy."



Foreign intruders have extracted terabytes of data from defense companies, he added.



This sort of story is likely to lead to the same arguments I heard eight years ago regarding "Intrusion Detection Systems" vs "Intrusion Prevention Systems," namely:



If you can detect it, why can't you prevent it?



This is a broad topic, so rather than try to answer everything here and now, I'll likely work on it over the coming weeks in individual posts.



Tweet

Read More

Bejtlich Leading Session at IANS

The IANS group just posted their fall forum announcement. It states I will be leading a session on the APT at their event in Boston on 20 September 2011.



Kicking off the morning will be Richard’s session on “Mitigating the Advanced Persistent Threat.” IANS continually hears from our clients that APT and cyber crime is a constant, nagging concern (if not for their own company… yet, then because of headline news read by company executives), and it is the CISO’s job to deal with real, perceived, and impending APT issues.



Thus, during his session Richard will provide advice and real-life use cases on what he’s seen, what’s worked, what doesn’t, and what CISOs can do to deal with APTs at their own organizations.



Following the short presentation portion of the session, CISOs will collectively discuss 1) How to keep up with industry-specific threats; 2) Tactics and techniques to detect and mitigate the APT; and 3) The real implications of APT incidents



This should be a great event, because the afternoon session also features Grady Summers, my old boss from GE (who was the CISO there). Grady will:



lead CISO participants through a follow-on discussion on managing cyber security at a board level. With today's threats consistently making front-page news, even the most traditional boards are starting to ask about cyber security.



To be prepared for such an event, Grady will walk participants through varying scenarios on handling: 1) What works and what’s not effective with regard to board communication on information security; 2) What audit committee chairs at some of the world's biggest companies are saying about security; and 3) Why you might not be doing your job if you're trying to "speak the language of the business" to your board.



I think this will be a great event, without death by PowerPoint. Please visit the announcement for registration information. Thank you.

Tweet

Read More

Bejtlich Keynote at Hawaiian Telcom Conference

Thanks to Hawaiian Telcom I will be speaking at their 2011 Security Conference in Honolulu on 7 September 2011.



My topic is "Putting the A, P, and T into the Advanced Persistent Threat:"



Advanced Persistent Threat, or APT, is a controversial term. Just what qualifies as the APT? Who invented this term? Is it a marketing vehicle or is there a method to its use? In this keynote, Mandiant CSO Richard Bejtlich will explain the history of the APT, and what makes it Advanced, Persistent, and a Threat. He will discuss the concepts of "fighting through" an intrusion and "operating in a contested network," approaches to dealing with the APT that work in the real world.



My colleague and friend Kris Harms will also attend, presenting "Network Security FTW."



We hope to see you there! And no, Jeremiah Grossman, we will not be joining you to fight MMA-style. Well, maybe Harms will.



Tweet

Read More

Why Business Methods Are as Important as IP to China

Courtesy of China Defense Blog, I just read a fascinating (if you like aircraft) report on China's capability to natively produce jet engines produced by China SignPost titled Jet Engine Development in China: Indigenous high-performance turbofans are a final step toward fully independent fighter production (pdf).

It's common to see open source reports describing how the APT seeks intellectual property (IP), which many people read as plans, designs, and related mechanical and scientific information. What some miss, however, is that China needs business know-how as well as technical know-how in order to achieve its economic and security goals. The report includes examples of this:

What China must achieve, however, is a methodology akin to Six Sigma or Total Quality Management (TQM) to ensure quality control and sufficient organizational honesty to ensure that actual problems are reported and that figures are not doctored.

Otherwise, standardization and integration may be the one in which the costs of China’s ad hoc, eclectic approach to strategic technology development truly manifest themselves.

The Soviet defense industrial base failed in precisely this area: talented designers and technicians presided over balkanized design bureaus and irregularly-linked production facilities; lack of standardization and quality control rendered it “less than the sum of the parts.”

If there's anything you need to know about the Chinese government, it's that it seeks to avoid mistakes made by others. The Chinese government does not want to repeat the Soviet failure, and it knows that technology isn't the only component when trying to build jet engines. Expect to more open and hidden actions by Chinese actors to gain the resources they need to indigenously create this core military and civilian capability.

Tweet

Read More

APT Drives Up Bomber Cost

Bill Sweetman wrote a good article on the new Air Force bomber program titled USAF Bomber Gets Tight Numbers. I found the following paragraph interesting:

One factor will drive up the cost of the bomber’s R&D: its status as a SAP [Special Access Program]. SAP status — whether the program is an acknowledged SAP, as the bomber is likely to be, or completely black — incurs large costs. All personnel have to be vetted before they are read into the program. Information within the program is compartmentalized, reducing efficiency. SAP status has been estimated to add 20% to a program’s cost.

Security for SAP isn't cheap! Sweetman elaborates:

The most likely reason for this measure is the sensitivity of ELO [extreme low-observable] technology, combined with the fact that the U.S. is the target of what may be the most extensive and successful espionage program in history — China’s Advanced Persistent Threat.

How much is the new bomber supposed to cost?

The magic numbers for the bomber are a fleet size of 80-100 and a flyaway cost of $500 million.

So, that's $50 billion, assuming 100 aircraft at $500 million each? Let's assume that cost includes SAP fees. If SAP protection adds 20%, that means without SAP the cost would be roughly $42 billion.

That means, for this program alone, the APT costs the US taxpayer $8 billion.

I find this sort of article really interesting because it demonstrates a real-world cost due to ongoing computer intrusions perpetrated by the APT.

Tweet

Read More

Aviation Week on China's Military Capabilities

Today Richard D. Fisher, Jr. and Bill Sweetman published an online article for Aviation Week titled Sizing Up China's Military Capabilities. Of interest to my readers might be the following:

It is no secret that long-term U.S. Air Force and Navy planning is focused on China...

A decade ago, many U.S. analysts were unimpressed by the People’s Liberation Army (PLA)... By 2011, such hubris has given way to palpable concern...

The elements of this capability include:

Information attack. In the mid-2000s, U.S. intelligence agencies identified the Advanced Persistent Threat (APT), a pattern of cyberespionage largely traceable to China and aimed mainly at the U.S. defense industry and armed forces...

I really like to see organizations that are not selling digital security, but who are still defense experts, discuss APT!

Some of you probably think Aviation Week is part of the "create a new bogey man" strategy as we draw down forces in Iraq. Surely APT is just "yellow peril"? Think again:

In the Soviet era, it was commonplace for U.S. intelligence agencies to exaggerate Soviet capabilities and predict that new systems would enter service sooner and in larger numbers than actually happened. A consistent trend in analysis of China’s military capabilities is to do the reverse...

So how does the US military tend to think about the Chinese threat?

U.S. officials have tended to view this increasing A2/AD [“anti-access” or “area denial”] force through the prism of a potential conflict over the future of Taiwan or a contest for dominance in the Western Pacific.

In the event of a conflict, it is assumed the PLA would launch cyberstrikes against regional U.S. and allied military facilities and U.S. political and military leadership, while directing air, naval and special forces strikes against nearby American facilities in Okinawa and Guam.

Should Washington refuse to sue for peace, and deploy forces into the theater, the PLA would fashion joint missile, air and submarine strikes to deter or defeat naval and air forces.

I know the whole US military does not think solely in terms of Taiwan, but clearly the limited characterization of APT as "only" "espionage," and the "prism" of Taiwan show that too many people don't see the big picture.

On a related note, I look forward to reading this document:

China's National Defense in 2010.

Tweet

Read More

Initial Thoughts on RSA "APT" Announcement

Today RSA's Art Coviello announced the following:

Recently, our security systems identified an extremely sophisticated cyber attack in progress being mounted against RSA...

Our investigation has led us to believe that the attack is in the category of an Advanced Persistent Threat (APT).

Our investigation also revealed that the attack resulted in certain information being extracted from RSA's systems. Some of that information is specifically related to RSA's SecurID two-factor authentication products.

While at this time we are confident that the information extracted does not enable a successful direct attack on any of our RSA SecurID customers, this information could potentially be used to reduce the effectiveness of a current two-factor authentication implementation as part of a broader attack...

This is one of the problems with debates over terminology. If we all accepted the actual definition of APT as created by the Air Force in 2006, we would know what Mr Coviello is describing. Without that clarity we're left wondering if he means any threat on the planet that he and RSA choose to describe as "APT."

Without knowing anything more than what is printed in the RSA announcement, I can offer the following opinion. It is not outside the realm of APT methodology and targeting to attack RSA in order to access internal details on their authentication technology. We know APT actors have attacked other technology companies to steal their intellectual property, ranging from software to algorithms to private keys, all to better infiltrate other targets.

As I Tweeted on March 10th, it's public knowledge that validated APT actors have targeted public key infrastructure for several years. Besides PKI, enterprises of all types rely heavily on two-factor systems such as those created by RSA. Stealing technology and examining it for weaknesses, or identifying ways to exploit the supply chain, or otherwise gain an advantage over RSA users are all valid APT interests.

Hopefully we will learn more about this issue as time passes.

Tweet

Read More

More on Chinese Stealth Fighter and APT

Since my 27 December post Courtesy of APT, featuring the new Chinese stealth fighter, Aviation Week writer Bill Sweetman wrote more about the development of this aircraft and the support from APT:

One question that may go unanswered for a long time concerns the degree to which cyberespionage has aided the development of the J-20. U.S. defense industry cybersecurity experts have cited 2006—close to the date when the J-20 program would have started—as the point at which they became aware of what was later named the advanced persistent threat (APT), a campaign of cyberintrusion aimed primarily at military and defense industries and characterized by sophisticated infiltration and exfiltration techniques.

Dale Meyerrose, information security vice president for the Harris Corp. and former chief information officer for the director of national intelligence, told an Aviation Week cybersecurity conference in April 2010 that the APT had been little discussed outside the classified realm, up to that point, because “the vast majority of APT attacks are believed to come from a single country.”

Between 2009 and early 2010, Lockheed Martin found that “six to eight companies” among its subcontractors “had been totally compromised—e-mails, their networks, everything,” according to Chief Information Security Officer Anne Mullins.

Note the 2006 date is consistent with my APT history article for Information Security magazine. However, before being officially named "APT" by the US Air Force in 2006, APT was active against cleared defense contractors in 2003, and probably earlier.

Bill makes an interesting point about the availability of photographs of this aircraft:

The way in which the J-20 was unveiled also reflects China’s use and control of information technology to support national interests. The test airfield is located in the city of Chengdu and is not secure, with many public viewing points. Photography is technically forbidden, but reports suggest that patrols have been permitting the use of cell phone cameras. From Dec. 25‑29, these images were placed on Chinese Internet discussion boards, and after an early intervention by censors—which served to draw attention to the activity—they appeared with steadily increasing quality. Substantial international attention was thereby achieved without any official disclosures.

In other words, consistent with their information warfare doctrine, China is presenting this aircraft as a deterrent to Western, and specifically American, interference in their region, through psychological operations.

Tweet

Read More

Courtesy of APT

The photo at left is Bill Sweetman's take on a photo posted to an aviation forum (.jpg) that is probably China's Chengdu J-20 fighter, claimed to be their "stealth fighter." Bill's comment caught my attention:

I think that we can count on China to start delivering more technological surprises - and in some cases they will be aided by cyber-espionage. Remember that's what the Advanced Persistent Threat is all about, and the great thing about cyber-espionage is that it can be exploited without risking human sources. That makes it much more useful - both in learning how to do things and avoiding blind alleys and pitfalls in R&D. (emphasis added)

There are several ways information stolen by APT could have helped with this aviation program. A few include:

• Theft of Western technology for direct application to building the Chinese aircraft


• Theft of Western technology to help design the Chinese aircraft to counter Western aircraft


• Theft of Western technology to help Chinese integrated air defense systems and other counter-aircraft weapons to deny, degrade, or destroy Western aircraft and systems


• Theft of Western program histories and experiences to guide Chinese designers and builders away from failed approaches and toward more promising methods


• Theft of Western plans and tactics to assist Chinese pilots flying against Western pilots

Building Chinese stealth fighters isn't the end goal of APT activity. They are tasked with their missions to further national ends, which involve strategic goals. This fighter is a means to an end.
Tweet

Read More

Why Neither the US Nor China Admits Cyberwar

Why won't the US or China (or even Russia) admit we're engaged in cyberwar? I have a theory based on historical precedent, involving all three countries: the Korean War. Since my time in the Air Force I knew that US pilots had directly engaged Russian pilots in the skies over Korea in the 1950s. This was an "open secret." Recently I watched the NOVA episode Missing in MiG Alley, which confirmed this fact:

NARRATOR: For 40 years, Russia's role in Korea remained a secret. Now, one of the Soviets' top aces, Sergei Kramarenko, can finally talk about his exploits in MiG Alley.

SERGEI KRAMARENKO: (Russian dialogue)

INTERPRETER: It was a secret mission, neither before nor after the war were we allowed to reveal that we were going to fly for the North Koreans...against the Americans. It was top secret.

SERGEI KRAMARENKO: (Russian dialogue)

INTERPRETER: We were told that in case we were shot down beyond the front line we had to kill ourselves. Not to surrender was in the interests of the State.

SERGEI KRAMARENKO: (Russian dialogue)

INTERPRETER: Of keeping the military secret.

NARRATOR: If word got out of their involvement, the Russians feared the Korean conflict might trigger World War Three. But then, this was not a secret easily kept...

NARRATOR: And yet, while the pilots knew who they were up against, the American public did not. Both sides, Western and Communist, kept the secret.

Colonel Orlov was a Soviet intelligence officer in North Korea.

COLONEL ORLOV: (Russian dialogue)

INTERPRETER: It was kept from the American public in case they demanded action against the Soviet Union. By this time Russia had atomic bomb and neither Washington nor Moscow wanted to risk full-scale nuclear war.

The comparison with our current situation is clear: neither side has an incentive to talk about cyberwar, because it could incite both sides to clamor for escalation.

In a related issue, both sides have no incentive to admit that while their offense is very effective, their defense is horrible.
Tweet

Read More

On the Other Side of an Advanced Persistent Threat

I found these excerpts from yesterdays DEBKAfile story An alarmed Iran asks for outside help to stop rampaging Stuxnet malworm to be interesting:

Tehran this week secretly appealed to a number of computer security experts in West and East Europe with offers of handsome fees for consultations on ways to exorcize the Stuxnet worm spreading havoc through the computer networks and administrative software of its most important industrial complexes and military command centers...

The impression debkafile sources gained Wednesday, Sept. 29 from talking to European computer experts approached for aid was that the Iranians are getting desperate. Not only have their own attempts to defeat the invading worm failed, but they made matters worse: The malworm became more aggressive and returned to the attack on parts of the systems damaged in the initial attack.

One expert said: "The Iranians have been forced to realize that they would be better off not 'irritating' the invader because it hits back with a bigger punch..."

As it is, the Iranian officials who turned outside for help were described by another of the experts they approached as alarmed and frustrated. It has dawned on them that the trouble cannot be waved away overnight but is around for the long haul. Finding a credible specialist with the magic code for ridding them of the cyber enemy could take several months. After their own attempts to defeat Stuxnet backfired, all the Iranians can do now is to sit back and hope for the best, helpless to predict the worm's next target and which other of their strategic industries will go down or be robbed of its secrets next.

It seems some emotions concerning cyberwar cross all sorts of boundaries!

Tweet

Read More

Five Reasons "dot-secure" Will Fail

Thom Shanker reported in Cyberwar Chief Calls for Secure Computer Network the following this week:

The new commander of the military’s cyberwarfare operations is advocating the creation of a separate, secure computer network to protect civilian government agencies and critical industries like the nation’s power grid against attacks mounted over the Internet.

The officer, Gen. Keith B. Alexander, suggested that such a heavily restricted network would allow the government to impose greater protections for the nation’s vital, official on-line operations. General Alexander labeled the new network “a secure zone, a protected zone.” Others have nicknamed it “dot-secure.”

It would provide to essential networks like those that tie together the banking, aviation, and public utility systems the kind of protection that the military has built around secret military and diplomatic communications networks — although even these are not completely invulnerable.

I'd like to share five reason why I think this approach will fail.

1. "dot-secure" becomes new target number one. I can't think of an easier way to help an adversary target the most critical information and capabilities on industry computers. If you're going to attack a company with hundreds of thousands of users and computers, it can be tough to decide where to focus attention. Multiply that target set across dozens or hundreds of companies and the adversary's problems also multiply. Now, suppose those companies put their most sensitive, important data on "dot-secure." Now all the adversary has to do is penetrate that network and take everything.


2. "Separation" is a fool's goal. Didn't we just read about Operation Buckshot Yankee, where malware jumped between networks of different classification levels? I guarantee users will want and need to transfer information between their normal company Internet-connected computers and "dot-secure." As long as those vectors exist, there is no "separation."


3. The network will be too big to keep "secure." Organizations build networks because there is value in exchanging information. In fact, the larger the network, the more valuable it becomes. So, what organizations will be allowed to connect to "dot-secure"? It will surely be more than the small handful that have a prayer of successfully defending themselves from APT and similar threats. That means weaker organizations will participate, and they will be compromised. As the network grows, it will get weaker and weaker.


4. How can "dot-secure" be any more successful than SIPRNet? I don't expect "dot-secure" to be as well-protected as SIPRNet. (And calling SIPRNet "well-protected" is probably causing some people to laugh.) Trying to get a SIPRNet terminal deployed is very expensive, and I don't expect DoD to make the same demands upon organizations as those required to host SIPRNet terminals. Many people consider SIPRNet compromised (I'm repeating public rumors, not confirming -- I have no direct knowledge), so why would "dot-secure" be any more successful?


5. "dot-secure" is another technical "solution" to a non-technical problem. I am dismayed to see DoD, of all places, taking a vulnerability-centric approach to an inherently threat-centric problem. It's clear that DoD is much more proficient in offense and that the "defense" part of the Department's name is increasingly misplaced. (I prefer the original "Department of War" anyway. Let's not fool ourselves!) How many hundreds of millions, or billions of dollars of taxpayer money could be wasted on "dot-secure," only to see DoD report to the Secretary or the President in 5 or 8 years that the network is also thoroughly compromised. Oops!

I think it would be far cheaper, and more effective, to engage the diplomatic and economic instruments of power to convince threats that they should keep their military and state hands out of American private enterprise.

Tweet

Read More