The Security Skeptic

SOPA: a great example of failing to know your enemy...or your friends

Proponents of SOPA want Congress to believe that DNS filtering will strike a death blow to online piracy. They argue that preventing the domain names that criminals use for infringing sites from resolving to Internet addresses will prevent criminals from distributing copyrighted material or selling knockoff versions of "brand" goods. The premise is false.

Photo by LesHoward

Know Your Enemy

If we have learned nothing else about electronic crime in the past decade, we do know one thing for certain. Online criminals adapt.

When an attack, stealth, or evasion technique ceases to be effective, online criminals try something different. A recent article at Dark Reading reports that security consultants and government agencies are tracking a dozen groups responsible for advanced persistent threats. What these parties have learned about one group in particular provides a wonderful teaching moment for SOPA proponents. 

APT actors identified as the Comment Crew uses HTML comments (information for web developers that is not use by a browser to render a page) to remotely control infected computers that form its botnet. An obvious countermeasure here is to strip comments from web traffic. This will disrupt communications, the botnet will be contained, and additional measures will be taken to dismantle it. 

Blocking HTML comments will be effective against Comment Crew, but for how long? History suggests that the answer is "not long at all". Does anyone seriously believe that the Comment Crew will throw their hands up in dismay and abandon their criminal or state sponsored activities?  The Comment Crew will employ a different means to communicate with its bots; specifically, they'll find a way to bypass or evade the countermeasures deployed against them.  

An important aside here is that stripping HTML comments is a good example of a proportional measure. Organizations or ISPs will voluntarily implement the HTML comment filtering countermeasure at their own site. They will enforce it within the boundaries of their own administrative domain, and will try not to harm or interfere with the daily operations of other networks in the process. Blocking the domain names of every web site that hosts HTML containing comments is not proportional. It overreaches, the results are unpredictable, and there is a high probability of disruption of desired and intended operations or collateral damage.

An unintended consequence of implementing Draconian filters when a more granular solution would suffice is that not only will criminal actors seek a way to evade such measures but legitimate users will do so as well. In Mandates Can't Alter the Facts, Paul Vixie explains that users will evade mandated filtering by using any of "dozens if not thousands of off-shore Domain Name servers they can switch to with the click of a mouse." Paul's claim is corroborated by a recent Cisco 2011 Security Report that 7 of 10 employees admit to violating IT policies in order to access the Internet. We live in a world where the prevailing attitude is that Internet access is a basic human right, US citizens will no doubt scoff the law. 

[ED: With nearly perfect timing for my article, an Addon for Mozilla Firefox - DNS Evasion to Stop Oppressive Policy in America (DeSOPA) - is now available. "When turned on, DeSopa intercepts URLs, sends the base URL to three offshore DNS services via HTTP, makes a best effort to check that two of them are equivalent, caches the IP for the browser session, redirects to the equivalent URL using the IP, and substitutes out the domain name in the source code with the IP address for future requests."]

Comment Crew is one of dozens I could cite to illustrate that SOPA proponents neither understand nor respect their adversaries. SOPA presupposes that criminals, faced with a DNS filtering shock and awe campaign, will fold tents and leave the Internet. Good luck with this.

Friend or Foe?

Sadly, SOPA proponents neither know nor respect their friends nor do they distinguish friend from foe. Individuals who oppose SOPA are portrayed as "pro-piracy", insensitive to the harm and loss musicians suffer, and other equally ludicrous characterizations. 

Does anyone seriously think that the best Internet and security minds in the world have never considered broad brush filtering of domain names as a measure to stop online piracy? We have, and we concluded long ago that this measure will not work, is not scalable or enforceable, and not without consequences. Despite this, SOPA proponents argue something along the lines of "despite the warnings and criticisms you've offered regarding DNS filtering we still want to add the considerable weight of federal legislation and force everyone to use it because doing this is better than doing nothing." In doing so, these proponents dismiss and disrespect the members of the technical community that work daily to defeat all forms of online criminal activity. Ironically, some of these members are employed by the very organizations most vocal in supporting SOPA, and they are probably collaborating with security and law enforcement to takedown a piracy site as you read this article. 

How much activity on the Internet is truly consensual?

A tweet from LondonCyber, presumably the official account for the London Conference on Cyberspace, attributes Roger Wilkins, Secretary General, Attorney General’s Department, Government of Australia with asserting that most activity on the internet is consensual.

At times, it does seem that Internet users are little more than an enormous population rushing about applying for or declining invitations to clubs, voluntarily. It's more, of course, and SG Wilkins no doubt made additional comments not conveyed in the tweet. 

I wish that SG Wilkins had made use of the superlative to describe other aspects of Internet activity that are decidedly non-consensual; for example,

• Most user or behavior tracking is non-consensual. It's hard to claim tracking is consensual when there is no notice of tracking and no consent granted. 
• Most transport and delivery of unsolicited commercial email is non-consensual. No ISP I know has a clause permitting transmission of spam in its terms of service/acceptable use.
• Most malicious registrations are non-consensual. Again, registrars generally don't invite criminals or miscreants to register and misuse domain names.
• Most infections resulting from drive-by malware downloads are non-consensual. You can arue that Harry gets what he deserves when he surfs indiscriminately for p0rn but it's not likely he was seeking or consented to have his computer pwned and botted.

SG Wilkins' assertion is, statistically speaking, true. His analogy, "it [the Internet] is like a club. if you don't like it, don't join it" is an intriguing observation. Consider:

• Most users consent (expressly or implicitly) to disclosure of their personal data, opinions, photos, and more when they "join" social networks. 
• Most users consent to whatever terms of service a social network imposes for the sake of membership.
• Most users consent to any terms of service to obtain a free service or membership. 

Much of Internet activity is indeed consensual. Much is not. Think of the different impact SG Wilkins' tweet might have had if he'd said much of the activity on the Internet is consensual but uninformed. 

Black Hat Hires: Can the benefits ever outweigh the risk?

Ellyne Phneah's article, Black hats can benefit firms but precautions needed, considers both sides of the controversial subject of hiring black hats.The arguments Ellyne elicits from Eric Chan, who suggests that this practice can be beneficial, and my reactions, follow: A pool of reformed hackers is available for hire  The article provides no evidence that the hacker community is in the throws of a moral reformation. Honestly, I'm not certain a reformation of this kind is all that attractive. In one possible scenario, the hacker admits to malicious, possibly criminal (possibly felony) acts. These admissions may result in arrest, prosecution, trial, and jail time. A second scenario is that some number of  hackers already serving sentences claim they are reformed. In another scenario, a candidate interviews with you and privately discloses he is a black hat and describes his hacktivities. Work out the rest of this scenario for yourself. Are you comfortable with any of these scenarios?

by PSD

Hackers have experience or know the trade

These are ambiguous claims at best.  I won't argue that elite hackers may indeed have a keen understanding of programming, operating systems, network protocols... Later in Ellyne's article, however, Richard George correctly points out that it is certainly possible to learn the same skills without breaking the law ( I make the same points in my Security Hats article). I am willing to concede that these are opposing views, but I know of no body of scientific data to support the claim that black hats know the trade better than white hats. I do know that reports of high profile security incidents demonstrate that certain black hats can successfully attack certain sites that are not adequately protected. I also know that black hat activities get better press and social media coverage than white hats. Do you recall the last time you read an article praising a white hat for having secured his shop so well that black hats turn away and look for lower hanging fruit?

Black hats add a dimension of expertise

The assumption that a certain dimension of expertise can only be acquired by hiring a black hat is curious. Chan explains that "A good hacker loves the challenge of finding vulnerabilities in networks and systems, and spends countless hours perfecting his craft and is hence competent at this role." I can characterize any number of security and operations staff I've had the privilege to meet and work with this way. More importantly, I can add "they act ethically and have never committed criminal acts."

Black hats are cheap labor

I am embarrassed for any security professional who would argue in favor of hiring hackers on the basis that "They could also be cheap to hire [compared to] computer science PhD holders." The truly elite and reformed black hat probably doesn't come cheap. Moreover, there are costs beyond the salary you pay the black hat to consider. For example, in the article, Chan stresses the need for background checks. A background check on a white hat is unlikely to require a costly and extensive investigation resulting in hundreds of pages. The equivalent check when investigating someone with a rap sheet can be very expensive (if you doubt this, visit the FBI Identification Record page). Next, add the cost of managing a probationary period Chan recommends. How does the cost-risk-benefit look now? These are the obvious tangible costs. We haven't yet considered the cost of managing (alleviating) concerns among business customers, peers, and partners to whom you should feel ethically obliged to disclose your hiring practice, much less attrition of customers, peers or partners who won't accept the risk your hiring practices pose to their businesses.

None of these arguments are new or convincing, yet we discuss this issue every time someone mentions hacking.

In Ellyne's article, Paul Ducklin asks a common sense question:

"Why would I want to bother in the first place?"

Why, indeed.

If you still need to be convinced, you may want to read to my reasons to avoid hiring hackers.

 

FCC Paper on IPv6 Transition says little about security: or is this all they can say?

The FCC released a report in December 2010, Potential Impacts on Communications from IPv4 Exhaustion & IPv6 Transition. The report describes the near exhaustion of the IPv4 address space and introduces IPv6, citing support for adoption by all Internet addressing authorities and a long list of government and standards bodies, including US DoD, OMB and Federal CIO Council,  ICANN, ISOC, the European Commission, the OECD, and the ITU.  The paper offers a history lesson on network protocol transitions (NCP to TCP/IPv4 in the early 1980s). This is helpful for folks who are unfamiliar with terms such as "dual stack", "flag-day", and "offline" (hint: this is what happened to your network if you failed to complete your transition by the flag-day). The paper continues with an interesting discussion of potential issues. The pace of adoption is slow, largely because of a negative networking effect, a polite way of saying no one is converting because you can't reach much content using IPv6 once you do. The paper also cites consumer demand. Actually it admits, "there has not been consumer demand for IPv6". It also mentions that there is no flag-date, "no hard and fast deadline creating urgency, which has been key to other successful transitions" such as the US Congress mandated for digital TV (DTV). The paper finishes with a discussion of IPv6 transition methods, preparation, costs, NAT, and Security. The entire section on Security is reproduced below: "IPv6 is a new network protocol which will require new training, experience, and implementations. During the transition, new vulnerabilities could be introduced, and IPv4 security devices and software may be of limited use. As network operators have done when introducing anything new into networks, operators will have to work with and test IPv6 implementations in order to ensure security."

I worry that the obvious is the most the FCC could find to say about security and IPv6. Was it wrong for me to hope that the paper would offer some information regarding the availability and quality of IPv6 security software and hardware? Or comment whether organizations would be able to deploy security measures in IPv6 nets that are commensurate with what they have in their IPv4 nets? I know that "security commensurate to IPv4" doesn't exactly set the bar very high, but the clock is ticking: has anyone done a thorough gap analysis yet? Care to share?

Legal disclaimers in email messages

Legal disclaimers for email messages are appearing more frequently as organizations recognize the need to exercise control over corporate communications. I'm referring to the two kilobytes of legalese bloat appended to the tail of an email message that proclaims "this message is privileged and confidential!" and blather on, explaining that, if mis-delivered, the recipient should notify the sender, destroy the copy, keep whatever he might have read confidential, degauss the hard drive on which the copy was stored...

Being a long-time advocate of secure email, any time I read a legal disclaimer, I try not to laugh at the futility here, or at best, the misplaced notion of trust. Email is fundamentally like a post card. Postal handlers, the mail boy, or anyone who happens to see the post card as they pass by your office desk can read it.

David Steele, a colleague and attorney, made some helpful observations about attaching such disclaimers to the tail of your mail in a thread on a public list. David explains that the flaw in this practice is obvious. "...Putting disclaimers at the bottom of an email means that the reader has to read down the email to get to the part that says 'this is confidential and don't read it if you're not the intended recipient."

David's solution? "Whenever I send something that is really confidential, I put the notice at the top of the email, with the statement PRIVILEGED AND CONFIDENTIAL COMMUNICATION in all caps as well. I then add a bunch of blank lines to make sure the message is well below the notice. This, in my view, achieves the requirement of providing the notice before the information is read". This practice gives early notice and provides the reader with an opportunity to stop scrolling before reading the correspondence, but it doesn't alter the fact that the message has been disclosed to unintended recipients: for this, you need secure (encrypted) mail.

Many employees pay little attention to the details of a disclaimer policy. They were told to attach disclaimers to faxes and the "right for fax, right for email" logic has proven expedient for many organizations. Unfortunately, the tendency among employees is to attach the disclaimer to every message. I suspect this is because disclaimer policies are simply implemented badly: IT or employees configure mail clients to attach it to every message sent.

The carpet-bomb approach defeats the purpose of legal disclaimers. David Steele weighs in that, "if you use the notice on everything you send out, regardless of whether or not it is confidential, then the notice will become too diluted and have less or no effect when something that is confidential gets sent out to the wrong party." David's message is clear: use it judiciously.

We now have two elements of a best practice when applying legal disclaimers. If you choose to use a disclaimer, (1) place it  at the top of your messages and (2) apply it only when you are sending a message that merits this special consideration.

David offers this example of a disclaimer:

PRIVILEGED AND CONFIDENTIAL COMMUNICATION This e-mail transmission, and any documents, files or previous e-mail messages attached to it, may contain confidential information that is legally privileged. If you are not the intended recipient or a person responsible for delivering it to the intended recipient, you are hereby notified that any disclosure, copying, distribution or use of any of the information contained in or attached to this transmission is STRICTLY PROHIBITED. If you have received this transmission in error, please: (1) immediately notify me by reply e-mail, or by collect telephone call; and (2) destroy the original transmission and its attachments without reading or saving in any manner.

If  you find this too stuffy and are enough of a counter-corporate culture creature, you could try this version:

This is email. Treat it like a Post Card. While the probability of intentional interception is low, anyone can read it during transit, anyone may have changed it along the way, or anyone may be impersonating me, the purported sender. You may not even be an intended recipient. If this mail or any attachment was delivered to you, and contained malicious code, it probably did *not* come from me, so please don't send me an email with the subject line "your email contained a worm".

I'll save a discussion on the challenge of attaching legal disclaimers to Tweets and instant messages for a future post.

New twist on full disclosure: do you employ hackers?

Mich Kabay has published an update to his 2005 series on Hiring Hackers. In Hiring hackers (part 2), Mich reviews conclusions criminal psychologists reach following extensive research into computer criminal behavior and attitude. Computer criminals are described in the literature of exhibiting one or more of the following attributes: addictive or compulsive behavior, need for power or recognition, willing to rationalize negative, immoral or unethical actions, narcissism, entitlement, or vindictiveness. 

Temptation to draw analogies to CEOs who've contributed to the economic crisis notwithstanding, these are *not* at the top of my list of folks whom I'd hire to clean my keyboard, much less administer systems hosting sensitive information, run networks, or (how could you even think of) developing software for security or defense systems. However, Mich takes a more forgiving attitude towards hiring hackers than I did in 2005 in an article entitled Security Hats: Black or White, no Grayscale. In that article, I emphasize that security professionals wear white hats, only and always.

Mich offers an interesting list of additional precautionary measures employers should add to their usual hiring scrutiny when considering candidates who have less than pure white hat track records. His methods involve challenging a candidate with hypothetic scenarios, asking a candidate to assess a case of criminal hacking, and self-appraisal ("tell me what you were thinking when you destroyed records of your previous employer"). Putting a positive assessment hat on, a candidate may reveal his true nature when answering questions of this kind. He may show remorse, better judgement, etc. Donning a negative assessment cap, he can also lie, and persuasively so. The latter is especially true if the candidate had a history of social engineering victims.

Some organizations may be willing to turn a cheek seven times seven times seven. A more interesting question is whether their colleagues, customers or shareholders are as charitable. An even more interesting question is whether their colleagues, customers or shareholders are entitled to know when an employer hires a hacker.

Are we entitled to full disclosure when organizations that have associations or influence on our business or communications hire hackers? If your bank informed you that they'd hired a convicted hacker, would you bank there?. If the school bus company informs me that they hire drivers with DUI convictions, would you let your child board any bus? Your answer may be yes or no, depending on what you know, and how you assess the risk. You can't assess risk accurately, however, with partial knowledge. 

I'm willing to concede that hackers will likely be hired. I think Mich's precautionary measures are an interesting complement to customary measures. With a caveat...

Society has identified numerous areas where prior behavior and criminal acts must be disclosed by candidates seeking positions as teachers, coaches, bus drivers, physicians, lawyers, and more. If we are going to accept hackers into the work force (and I honestly think this is a hugely dangerous decision), let's provide all parties potentially affected by their actions with full disclosure so they can make informed decisions.