CIO Magazine on IP Theft

CIO magazine, which features an impossible-to-navigate Web site but decent print version, published Hacked: The Rising Threat of Intellectual Property Theft and What You Can Do About It by Stephanie Overby. I liked these excerpts:

“There’s a ceiling on how much money can be made by stealing identities,” says Scott Borg, director and chief economist of the U.S. Cyber Consequences Unit, an independent nonprofit institute set up at the request of the federal government to examine the economic and strategic consequences of cyberattacks. “You can actually steal the business—its processes, its internal negotiating memos, its merchandising plans, all the information it uses to create value. That’s a very large payoff.”

I agree, but what's up with the USCCU Web site? I had to find an archive from February 2006 to see what this group does. Spend a little of that DHS money on a Web site, folks.

CIOs may be less aware of the threat to IP than to their systems, and therefore less prepared to protect the former. “Companies are thinking about worms and viruses, things that will not have very bad consequences and have always been wildly exaggerated,” says Borg. “Or they’re thinking about ID theft, which attracts a lot of attention, even though the number of cases is remarkably low.”

There’s a difference, too, in the systems an intruder looking for corporate secrets may target. IP thieves “won’t necessarily look at obvious financially sensitive areas,” says Borg, thereby escaping detection. “They may be looking at technical data, controls systems, automation software.” And the results of IP theft can be hard to see—a slow degradation of one’s competitive position in the market may easily be attributed to other, noncriminal factors.

Until recently, the most conclusive public evidence that sustained industrial espionage has taken place in cyberspace has come from the military. Titan Rain was “the most systematic and high-quality attack we have seen,” says Ira Winkler, author of, most recently, Zen and the Art of Information Security. Chinese hackers successfully breached hundreds of unclassified networks within the Department of Defense, its contractors and several other federal agencies. One Air Force general admitted at an IT conference last year that China had downloaded 10 to 20 terabytes of data from DoD networks. (emphasis added)

Forget about "slow degradation." In some future war over the Taiwan Straight an American jet fighter is going to dogfight a Chinese plane and lose the battle because some sensitive design or technical data was stolen. This is a constant in warfare as I mentioned in my post FISMA Dogfights.

To defend against targeted attacks, Motorola uses traditional controls such as firewalls, intrusion detection tools, antivirus software and digital forensics—but with a difference. “We’re operating our information security toolkit with a counterintelligence mind-set,” says Boni [Motorola CIO]. Like the military, Boni assumes there’s an enemy looking for an advantage and it’s his job to outwit him. “Putting those tools together with an understanding of what is or could be of greatest interest to competitors allows a more granular focus on the data,” says Boni, “not just on the network.”

Bingo. CI is exactly right.

“The thought process is no longer making sure nothing bad ever happens,” says DuBois [general manager of information security and infrastructure services security for Microsoft]. “There may be a bug in the Cisco code or someone might misconfigure a device. If [attackers] get at that chess piece we left unprotected, what will we do?”...

“If eternal vigilance is the price of freedom,” says Boni, paraphrasing Thomas Jefferson, “continuous monitoring and preparation to respond quickly is the cost associated with global digital commerce.” (emphasis added)

Again, exactly right. Prevention Eventually Fails. Detection. Response. Hopefully more CIOs will pay attention.

Read More

Pervasive Security Monitoring

After Black Hat I've been thinking of how to address gaining insight into the security state of the enterprise. My first book addressed how to detect and response to intrusions using traffic sources in the form of network security monitoring. I've talked about gaining pervasive network awareness several times as well. Recently I've talked about security application instrumentation and several times over the years I've discussed why I am not anti-log.

I am beginning to formulate my thoughts on what I'm calling Pervasive Security Monitoring. I don't have a formal definition yet, but the concept will extend past NSM data sources (traffic) into reports on the state of platforms, OS, applications, and data. The dictionary definition, to become spread throughout all parts of, captures the concept fairly well at this stage.

I noticed Cisco and a few others used the term pervasive security awareness, but it's used as a way to encourage employees to become security conscious. That's not what I mean. I see pervasive security monitoring as a way to achieve pervasive security awareness, in the form of collecting data to inform the decision-making process.

I considered using the term "enterprise security monitoring," but I don't think that term as previously used covers everything I have in mind. As I develop these thoughts I will discuss them here.

Read More

Exploiting FTP clients using PASV command

Finally, i am back home to Singapore again. I am so happy and my mood starts to brighten again. I was researching about web security and i came across Wade Alcorn's website. He found out that it was possible to launch a reverse shell and own a Asterisk server using inter-protocol Exploitation. Also, check out BeEF, which is equivalent to Metasploit type of framework for web applications. Lastly, do check out the FTP PASV command manipulation which allows FTP servers to cause vulnerable FTP clients to connect to other hosts.

"The paper discusses how the FTP client flaw in detail and demonstrates how it can be used to attack common web browsers such as Konqueror, Opera and Firefox. Proof of concept code is presented that extends existing JavaScript port-scanning techniques to scan any TCP port from Firefox (even though it now implements "port banning" restrictions)."

http://www.bindshell.net/papers/ftppasv

The Hacka Man

Read More

Minneapolis Bridge Lessons for Digital Security

The Minneapolis bridge collapse is a tragedy. I had two thoughts that related to security.

1. If the bridge collapsed due to structural or design flaws, the proper response is to investigate the designers, contractors, inspectors, and maintenance personnel from a safety and negligence perspective. Based on the findings architectural and construction changes plus new safety operations might be applied in the future. This is a technical and operational response.


2. If the bridge collapsed due to attack, the proper response is to investigate, apprehend, proseceute, and incarcerate the criminals. Redesigning bridges to withstand bomb attack is unlikely. This is a threat reduction and deterrence response.

Do you agree with that assessment? If yes, why do you think response 1 (try to improve the "bridge" and similar operations) is the response to every digital security attack (i.e., case 2)? My short answer: everyone blames the victim, not the criminal.

The NTSB is on scene in Minneapolis with law enforcement to figure out if the bridge collapse was caused by scenario 1 or 2. Why don't we have a National Digital Security Board investigating breaches? My short answer: it's easier to hide a massive security breach than the destruction of any bridge, building, plane, or train.

Read More

Kung Fu Wisdom on Threats

Given the seriousness of my last post, I though some words of wisdom from the great Kwai Chang Caine would improve everyone's mood. Consider a scene from Kung Fu.

Caine is talking to an Amish man who says "When someone hits me with a stick, I have three choices: I can hit him back, I can let him hit me again, or I can run away.” Caine replies with a fourth option: "You can take the stick away from him."

The unspoken element of Caine's reply is that you can peacefully disarm an opponent, which may require Shaolin-like skill. Most people do not have such skills and are stuck with one of the three previous options.

None of these work approaches for digital security.

1. If you hit the intruder back, unless he's incapacitated he remains ready for another attack. If you do knock out one of his drones, he activiates number two of ten thousand.


2. If you let him attack again, you lose a second time. The threat is also free to hit again.


3. If you run away by disconnecting from the network, you lose all the network's benefits.


4. Taking away the stick (perhaps by criminalizing "hacker tools") only punishes law-abiding citizens. If you do peacefully shut down a drone, again he activates number two of ten thousand.

The answer to this problem is you apprehend the criminal for assault, prosecute, and incarcerate. "Rehabilitation" is nice, but at least for the duration of his prison time he can't hurt those outside prison. You may enjoy a deterrence effect, although this is debatable. Regardless, this is the only way to deal with a threat once it has obtained evil capabilities and intentions. (You can argue for shaping the threat's life such that those evil capabilities and intentions are not reached, but that's an issue for social scientists.)

It's all about the risk equation: Risk = Asset value * Vulnerability * Cost

• No one is deploying worthless assets.


• 30+ years of trying to develop resources that are vulnerability-free has failed.


• Only the threat component has a chance to be reduced, thereby reducing overall risk (assuming it outpaces the asset and vulnerability categories, which is problematic still).

Read More

Black Hat Final Thoughts

Based on my summaries of the talks I saw on day one and two of Black Hat USA 2007, some of you have called me "depressed" or "negative." I call it realistic and largely historic. Nothing I described was brand new the day I saw it. Most if not all of everything I saw was already discussed in public forums or private groups. Sometimes it takes a live explanation by a real expert to synthesize and demonstrate the technique to make it come to life and help attendees connect the dots. This was certainly the case for me and I expect other people too.

I've spent almost my whole career watching defenses fail and then trying to contain and remove the mess. The fact that nothing has reduce my workload during the last decade indicates our approach to this problem is not working. I attend Black Hat so I can get semi-clued-in to attack techniques, and I recommend everyone else who cares about how they are already being abused attend or ask someone who attended to summarize what he or she learned.

The fact that you do not know you are being compromised does not mean it is not happening. This is a fundamental problem with digital security. Consider the analog world.

• If a house is robbed by amateurs while the owner is away, upon return even the most ignorant person will likely notice the breach.


• If a house is bugged by professionals while the owner is away, upon return even the most vigilant person will likely miss the breach.

Consider the digital equivalent.

• If a digital asset is compromised by amateurs while the owner is away, upon return the ignorant person will definitely not notice the breach, and a vigilant person might notice the breach.


• If a digital asset is compromised by professionals while the owner is away, upon return even the most vigilant person will be hard pressed to notice the breach. Everyone else is hopeless.

Observe a key element of these observations is vigilance. I liked Tate Hansen's post Attackers will win so what can you do? because it alludes to this thought. Here are my three recommendations.

1. Monitor everything you can, within the bounds of legal, political, and technical means. The absolute first priority for any digital security operation is to know what is happening. Bruce Schneier was so right in 2001 when he wrote Monitoring First. If you think I am hopeless but you believe in Bruce, then read what he wrote. It's as relevant today as ever.
   
   Monitoring is to the digital world as accounting is to the financial world. How can any company expect to stay in business if its bleeding money? Similarly, how can any enterprise preserve confidentiality, integrity, and availability of digital assets if the state of those assets is unknown?
   
   When I talk of monitoring, keep in mind three data sources; these are terms I'm using from here forward.
   
   
   
   • First order monitoring observes the attack as it happens. It's difficult if not impossible to accomplish this. Because you can't stop what you can't see, preventing intrusions is increasingly impossible for all or most cases.
   
   
   • Second order monitoring observes continuation of the incident. These are signs following compromise, like installation and use of a back door, command-and-control, exfiltration of data, and the like. This is difficult to detect but potentially not as difficult as the first order case.
   
   
   • Third order monitoring observes consequences of the incident. This includes discovery of your company's IPs in botnet command-and-control channels or Web sites, finding sensitive company documents on p2p networks, the release by your competitor of a new product based on your design, and related events. These are easier to detect but usually difficult to tie to a specific incident.
   
   
   
   My final comment on monitoring is this: monitoring helps prioritize resources. If you instrument your platforms, OS, applications, and data, you can see how they are being abused. Then you direct resources to mitigate the most pressing problems.
   
   Consider the 2002 CERT advisory on SNMP vulnerabilities. At the time it looked like the end of the world because everyone was vulnerable. My clients basically didn't care, because I was watching for any SNMP traffic to or from their sites. Guess what -- I hardly saw anything (and SNMP is easy to see if you're wondering.) Because I didn't see recon or exploitation, I advised my clients to concentrate on problems I did see being probed or attacked.
   
   It's the same situation a battlefield commander faces. Without on-scene situational awareness, how do you know if you need to reinforce your flank or commit your reserves to defending the center? If you have no clue and you guess wrong, you lose. Let's manage by fact instead of belief if we want to win.
   


2. Force vendors to ship feature-disabled applications by default. I don't want my Flash viewer to initiate sockets to hosts on my internal network. Alternatively, let my security team, IT department, or PC vendor decide how my machine should be configured, then let me make changes if I decide I do want Flash to initiate connections. Let's face it: the Web browser is the new operating system. Securing the OS is great but it's all about the features and configuration of your Web browser and its embedded rich media content rendering applications. Reducing our application exposure will limit the risk.


3. Force our governments to focus on the threat. Techies like technical solutions. This is not working. We have to take the fight to the enemy by removing the threat, not countering their tools.
   
   We cannot code, block, or patch our way out of this situation. We have to deter, investigate, apprehend, prosecute, and incarcerate threats. It's the only approach that has ever had a chance to work in the real world. As the digital world continues to resemble and in some ways surpass the analog world, why do we think we are smart enough to reject 3,000 years of human history and rely on technical means to solve this problem?
   
   If you don't believe me, please read my next post.

Read More

Snort Report 8 Posted

My 8th Snort Report on How to Test Snort is now available online. From the start of the article:

"How do I test Snort?" is one of the most popular questions asked on the snort-users mailing list. While a seemingly simple question, the answer depends on your intent. Value-added resellers (VARs) and systems integrators (SIs) may need to provide customers with validation that the network intrusion detection system (IDS) is working as expected. This edition of Snort Report explains what it means to test Snort. I reveal some common misperceptions and offer alternatives to satisfy the majority of readers.

Also note that Snort 2.7.0.1 was posted today. The release notes appear to be the same as those for Snort 2.7.0, both online, in CVS and in the tarball.

Read More