CERIAS Combined Feed News and Blog posts from CERIAS. This feed does not include our events calendar (http://www.cerias.purdue.edu/feeds/events) 2010-02-09T23:06:53-05:00 Zend_Feed_Writer http://www.cerias.purdue.edu/ CeriasCombinedFeedhttp://feedburner.google.com <![CDATA[Is it ‘High Noon’ for Google, China?]]>

“The fact that multiple very large corporations indicated they had all been victims of this … and many issued public statements and took a stand, that’s not something we’ve seen before,” said Eugene Spafford, a computer security specialist at Purdue University who has advised two U.S. presidents and numerous companies and government agencies.

]]> 2010-01-26T09:51:00-05:00 http://www.cerias.purdue.edu/site/news/view/is_it_high_noon_for_google_china/ CERIAS Webmaster coj@cerias.purdue.edu <p><p>&#8220;The fact that multiple very large corporations indicated they had all been victims of this &#8230; and many issued public statements and took a stand, that&#8217;s not something we&#8217;ve seen before,&#8221; said Eugene Spafford, a computer security specialist at Purdue University who has advised two U.S. presidents and numerous companies and government agencies.</p> </p> <div><a href="http://www.cnn.com/2010/BUSINESS/01/22/google.china/index.html">More information &raquo;</a></div><img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/5fLsPsn2-4I" height="1" width="1"/> 0 <![CDATA[Scammers target givers after Haiti earthquake]]>

Professor Spafford describes how events like the recent earthquake in Haiti bring out con artists and scammers, and how to avoid them.

WEST LAFAYETTE, Ind. - The earthquake Tuesday (Jan. 12) in Haiti caused massive destruction with widespread loss of life and property. The stories and pictures over the next few days and weeks will undoubtedly trigger the urge in people to make contributions to help.

“Unfortunately, these events also bring out the con artists and scammers who are more interested in making money for themselves rather than contributing to the rescue and restoration efforts,” said Eugene H. Spafford, professor and executive director of CERIAS (Center for Education and Research in Information Assurance and Security) at Purdue University.

Researchers at CERIAS know that criminals will take advantage of the most tragic of circumstances and exploit the sense of urgency people have to “do something” in order to overcome their normal caution.

“Our past research showed that the same people who normally commit fraud with get-rich-quick e-mails adjust their scams - within a matter of hours - to act as victims of these tragedies,” said Howard Sypher, a professor with CERIAS and head of the Department of Communication. “Web sites are undoubtedly already constructed to impersonate major charities and thus trick the unwary.”

Spafford cautions that fraudulent calls for aid could come in many forms.

“Be alert for fraudulent but sincere-sounding appeals for aid from Haitian victims, from what appear to be charities, or from government or U.N. officials,” he advises. “These solicitations may be sent as e-mail to you or a group to which you belong, as postings or messages on a social newsgroup such as Facebook or Twitter, as a phone call from someone soliciting donations, or as a Web site to which you are directed or that pops up when visiting a site.”

Both professors emphasized that, based on their past experiences, some of these fraudulent appeals will sound convincing, and the associated Web pages will appear official and legitimate.

Here are some tips from the experts at CERIAS on how to avoid being scammed, now and at other times:

  • Do not enter any information at a Web page that pops up unexpectedly when you visit some other site.

  • Never click on a Web site address (URL) in e-mail sent to you; it may look official, but most will be pointers to fraud or attack sites.

  • Don’t assume that every Web address returned by a search engine, such as Google or Bing, is a legitimate organization.

  • Do not respond to e-mail requesting donations or making a special offer (such as asking you to hold their assets while Haiti rebuilds).

  • Do not reveal any personal or financial information during a phone call you did not dial yourself.

  • If a friend forwards a URL, phone number or e-mail, don’t trust it until you check its validity. Your friend may have been scammed first.

How do you find a real charity to which you can contribute? Spafford recommends one starting point at CNN that lists real charities and how to contact them.

“Use your phone book to find the information of a nearby chapter of the American Red Cross or the Salvation Army,” Spafford said. “Call or visit them and ask how you can contribute to Haitian disaster relief. Even small donations help and will be gratefully received - by real charities, not crooks.”

CERIAS is the nation’s premier interdisciplinary academic center for research and education in information assurance, security, privacy and digital crime.

For more information, contact Eugene H. Spafford at 765-494-7825, or visit the CERIAS Web site at http://www.cerias.purdue.edu/

Writer:

Sources:

]]> 2010-01-14T13:34:00-05:00 http://www.cerias.purdue.edu/site/news/view/scammers_target_givers_after_haiti_earthquake/ CERIAS Webmaster coj@cerias.purdue.edu <p><p>Professor Spafford describes how events like the recent earthquake in Haiti bring out con artists and scammers, and how to avoid them.</p> </p> <div><p>WEST LAFAYETTE, Ind. - The earthquake Tuesday (Jan. 12) in Haiti caused massive destruction with widespread loss of life and property. The stories and pictures over the next few days and weeks will undoubtedly trigger the urge in people to make contributions to help.</p> <p>&#8220;Unfortunately, these events also bring out the con artists and scammers who are more interested in making money for themselves rather than contributing to the rescue and restoration efforts,&#8221; said Eugene H. Spafford, professor and executive director of CERIAS (Center for Education and Research in Information Assurance and Security) at Purdue University.</p> <p>Researchers at CERIAS know that criminals will take advantage of the most tragic of circumstances and exploit the sense of urgency people have to &#8220;do something&#8221; in order to overcome their normal caution.</p> <p>&#8220;Our past research showed that the same people who normally commit fraud with get-rich-quick e-mails adjust their scams - within a matter of hours - to act as victims of these tragedies,&#8221; said Howard Sypher, a professor with CERIAS and head of the Department of Communication. &#8220;Web sites are undoubtedly already constructed to impersonate major charities and thus trick the unwary.&#8221;</p> <p>Spafford cautions that fraudulent calls for aid could come in many forms.</p> <p>&#8220;Be alert for fraudulent but sincere-sounding appeals for aid from Haitian victims, from what appear to be charities, or from government or U.N. officials,&#8221; he advises. &#8220;These solicitations may be sent as e-mail to you or a group to which you belong, as postings or messages on a social newsgroup such as Facebook or Twitter, as a phone call from someone soliciting donations, or as a Web site to which you are directed or that pops up when visiting a site.&#8221;</p> <p>Both professors emphasized that, based on their past experiences, some of these fraudulent appeals will sound convincing, and the associated Web pages will appear official and legitimate.</p> <p>Here are some tips from the experts at CERIAS on how to avoid being scammed, now and at other times:</p> <ul> <li><p>Do not enter any information at a Web page that pops up unexpectedly when you visit some other site.</p></li> <li><p>Never click on a Web site address (URL) in e-mail sent to you; it may look official, but most will be pointers to fraud or attack sites.</p></li> <li><p>Don&#8217;t assume that every Web address returned by a search engine, such as Google or Bing, is a legitimate organization.</p></li> <li><p>Do not respond to e-mail requesting donations or making a special offer (such as asking you to hold their assets while Haiti rebuilds).</p></li> <li><p>Do not reveal any personal or financial information during a phone call you did not dial yourself.</p></li> <li><p>If a friend forwards a URL, phone number or e-mail, don&#8217;t trust it until you check its validity. Your friend may have been scammed first.</p></li> </ul> <p>How do you find a real charity to which you can contribute? Spafford recommends one starting point at CNN that <a href="http://www.cnn.com/2010/LIVING/01/13/haiti.earthquake.how.to.help/index.html">lists real charities and how to contact them</a>.</p> <p>&#8220;Use your phone book to find the information of a nearby chapter of the American Red Cross or the Salvation Army,&#8221; Spafford said. &#8220;Call or visit them and ask how you can contribute to Haitian disaster relief. Even small donations help and will be gratefully received - by real charities, not crooks.&#8221;</p> <p>CERIAS is the nation&#8217;s premier interdisciplinary academic center for research and education in information assurance, security, privacy and digital crime.</p> <p>For more information, contact Eugene H. Spafford at 765-494-7825, or visit the CERIAS Web site at <a href="http://www.cerias.purdue.edu/">http://www.cerias.purdue.edu/</a></p> <p>Writer:</p> <ul> <li>Jim Bush, 765-494-2077, <a href="mailto:jsbush@purdue.edu">&#106;&#115;&#x62;&#x75;&#x73;&#x68;&#x40;&#x70;&#x75;rd&#117;&#101;&#46;&#101;&#100;&#117;</a></li> </ul> <p>Sources:</p> <ul> <li>Eugene Spafford, 765-494-7825, <a href="mailto:spaf@purdue.edu">&#x73;&#112;&#x61;&#102;&#x40;&#112;&#x75;&#114;&#100;&#x75;&#101;&#x2e;&#101;&#x64;&#117;</a></li> <li>Howard Sypher, 765-494-3300, <a href="mailto:hsypher@purdue.edu">&#104;s&#x79;&#112;h&#x65;&#114;&#64;&#x70;&#117;r&#x64;&#117;e&#x2e;&#101;d&#x75;</a></li> </ul> </div><img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/8IMPrLoVbOo" height="1" width="1"/> 0 <![CDATA[Drone “Flaw” Known Since 1990s Was a Vulnerability]]> "The U.S. government has known about the flaw since the U.S. campaign in Bosnia in the 1990s, current and former officials said. But the Pentagon assumed local adversaries wouldn't know how to exploit it, the officials said." Call it what it is: it's a vulnerability that was misclassified (some might argue that it's an exposure, but there is clearly a violation of implicit confidentiality policies). This fiasco is the result of the thinking that there is no vulnerability if there is no threat agent with the capability to exploit a flaw. I argued against Spaf regarding this thinking previously; it is also widespread in the military and industry. I say that people using this operational definition are taking a huge risk if there's a chance that they misunderstood either the flaw, the capabilities of threat agents, present or future, or if their own software is ever updated. I believe that for software that is this important, an academic definition of vulnerability should be used: if it is possible that a flaw could conceptually be exploited, it's not just a flaw, it's a vulnerability, regardless of the (assumed) capabilities of the current threat agents. I maintain that (assuming he exists for the sake of this analogy) Superman is vulnerable to kryptonite, regardless of an (assumed) absence of kryptonite on earth.

The problem is that it is logically impossible to prove a negative, e.g., that there is no kryptonite (or that there is no God, etc...). Likewise, it is logically impossible to prove that there does not exist a threat agent with the capabilities to exploit a given flaw in your software. The counter-argument is then that the delivery of the software becomes impractical, as the costs and time required escalate to remove risks that are extremely unlikely. However, this argument is mostly security by obscurity: if you know that something might be exploitable, and you don't fix it because you think no adversary will have the capability to exploit it, in reality, you're hoping that they won't find or be told how (for the sake of this argument, I'm ignoring brute force computational capabilities). In addition, exploitability is a thorny problem. It is very difficult to be certain that a flaw in a complex system is not exploitable. Moreover, it may not be exploitable now, but may become so when a software update is performed! I wrote about this in "Classes of vulnerabilities and attacks". In it, I discussed the concept of latent, potential or exploitable vulnerabilities. This is important enough to quote:

"A latent vulnerability consists of vulnerable code that is present in a software unit and would usually result in an exploitable vulnerability if the unit was re-used in another software artifact. However, it is not currently exploitable due to the circumstances of the unit’s use in the software artifact; that is, it is a vulnerability for which there are no known exploit paths. A latent vulnerability can be exposed by adding features or during the maintenance in other units of code, or at any time by the discovery of an exploit path. Coders sometimes attempt to block exploit paths instead of fixing the core vulnerability, and in this manner only downgrade the vulnerability to latent status. This is why the same vulnerability may be found several times in a product or still be present after a patch that supposedly fixed it.

A potential vulnerability is caused by a bad programming practice recognized to lead to the creation of vulnerabilities; however the specifics of its use do not constitute a (full) vulnerability. A potential vulnerability can become exploitable only if changes are made to the unit containing it. It is not affected by changes made in other units of code. For example, a (potential) vulnerability could be contained in the private method of an object. It is not exploitable because all the object’s public methods call it safely. As long as the object’s code is not changed, this vulnerability will remain a potential vulnerability only.

Vendors often claim that vulnerabilities discovered by researchers are not exploitable in normal use. However, they are often proved wrong by proof of concept exploits and automated attack scripts. Exploits can be difficult and expensive to create, even if they are only proof-of-concept exploits. Claiming unexploitability can sometimes be a way for vendors to minimize bad press coverage, delay fixing vulnerabilities and at the same time discredit and discourage vulnerability reports. "

Discounting or underestimating the capabilities, current and future, of threat agents is similar to the claims from vendors that a vulnerability is not really exploitable. We know that this has been proven wrong ad nauseam. Add configuration problems to the use of the "operational definition" of a vulnerability in the military and their contractors, and you get an endemic potential for military catastrophies.]]> 2009-12-18T10:32:00-05:00 http://www.cerias.purdue.edu/site/blog/post/drone_flaw_known_since_1990s_was_a_vulnerability/ Pascal Meunier pmeunier@cerias.net <a href="http://online.wsj.com/article/SB126102247889095011.html" title="&quot;The U.S. government has known about the flaw since the U.S. campaign in Bosnia in the 1990s, current and former officials said. But the Pentagon assumed local adversaries wouldn't know how to exploit it, the officials said.&quot;">"The U.S. government has known about the flaw since the U.S. campaign in Bosnia in the 1990s, current and former officials said. But the Pentagon assumed local adversaries wouldn't know how to exploit it, the officials said."</a> Call it what it is: it's a vulnerability that was misclassified (some might argue that it's an exposure, but there is clearly a violation of implicit confidentiality policies). This fiasco is the result of the thinking that there is no vulnerability if there is no threat agent with the capability to exploit a flaw. I argued against Spaf regarding this thinking previously; it is also widespread in the military and industry. I say that people using this <b>operational definition</b> are taking a huge risk if there's a chance that they misunderstood either the flaw, the capabilities of threat agents, present or future, or if their own software is ever updated. I believe that for software that is this important, an <u>academic definition of vulnerability</u> should be used: if it is possible that a flaw could conceptually be exploited, it's not just a flaw, it's a vulnerability, regardless of the (assumed) capabilities of the current threat agents. I maintain that (assuming he exists for the sake of this analogy) Superman is vulnerable to kryptonite, regardless of an (assumed) absence of kryptonite on earth. <BR> <BR> The problem is that it is logically impossible to prove a negative, e.g., that there is no kryptonite (or that there is no God, etc...). Likewise, it is logically impossible to prove that there does not exist a threat agent with the capabilities to exploit a given flaw in your software. The counter-argument is then that the delivery of the software becomes impractical, as the costs and time required escalate to remove risks that are extremely unlikely. However, this argument is mostly security by obscurity: if you know that something might be exploitable, and you don't fix it because you think no adversary will have the capability to exploit it, in reality, you're hoping that they won't find or be told how (for the sake of this argument, I'm ignoring brute force computational capabilities). In addition, exploitability is a thorny problem. It is very difficult to be certain that a flaw in a complex system is not exploitable. Moreover, it may not be exploitable now, but may become so when a software update is performed! I wrote about this in "<a href="http://homes.cerias.purdue.edu/~pmeunier/aboutme/classes_vulnerabilities.pdf" title="Classes of vulnerabilities and attacks">Classes of vulnerabilities and attacks</a>". In it, I discussed the concept of latent, potential or exploitable vulnerabilities. This is important enough to quote: <BR> <BR> "A latent vulnerability consists of vulnerable code that is present in a software unit and would usually result in an exploitable vulnerability if the unit was re-used in another software artifact. However, it is not currently exploitable due to the circumstances of the unit&#8217;s use in the software artifact; that is, it is a vulnerability for which there are no known exploit paths. A latent vulnerability can be exposed by adding features or during the maintenance in other units of code, or at any time by the discovery of an exploit path. Coders sometimes attempt to block exploit paths instead of fixing the core vulnerability, and in this manner only downgrade the vulnerability to latent status. This is why the same vulnerability may be found several times in a product or still be present after a patch that supposedly fixed it. <BR> <BR> A potential vulnerability is caused by a bad programming practice recognized to lead to the creation of vulnerabilities; however the specifics of its use do not constitute a (full) vulnerability. A potential vulnerability can become exploitable only if changes are made to the unit containing it. It is not affected by changes made in other units of code. For example, a (potential) vulnerability could be contained in the private method of an object. It is not exploitable because all the object&#8217;s public methods call it safely. As long as the object&#8217;s code is not changed, this vulnerability will remain a potential vulnerability only. <BR> <BR> Vendors often claim that vulnerabilities discovered by researchers are not exploitable in normal use. However, they are often proved wrong by proof of concept exploits and automated attack scripts. Exploits can be difficult and expensive to create, even if they are only proof-of-concept exploits. Claiming unexploitability can sometimes be a way for vendors to minimize bad press coverage, delay fixing vulnerabilities and at the same time discredit and discourage vulnerability reports. "<BR> <BR> Discounting or underestimating the capabilities, current and future, of threat agents is similar to the claims from vendors that a vulnerability is not really exploitable. We know that this has been proven wrong <i>ad nauseam</i>. Add configuration problems to the use of the "operational definition" of a vulnerability in the military and their contractors, and you get an endemic potential for military catastrophies.<img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/DLd0LC1SWG4" height="1" width="1"/> 0 <![CDATA[An old canard reappears (sort of)]]> I have a set of keywords registered with Google Alerts that result in a notification whenever they show up in a new posting. This helps me keep track of some particular topics of interest.

One of them popped up recently with a link to a review and some comments about a book I co-authored (Practical Unix & Internet Security, 3rd Edition). The latest revision is over 6 years old, but still seems to be popular with many security professionals; some of the specific material is out of date, but much of the general material is still applicable and is likely to be applicable for many years yet to come. At the time we wrote the first edition of the book there were only one or two books on computer security, so we included more material to make this a useful text and reference.

In general, I don't respond to reviews of my work unless there is an error of fact, and not always even then. If people like the book, great. If they don't, well, they're entitled to their opinions -- no matter how ignorant and ill-informed they may be. grin   

This particular posting included reviews from Amazon that must have been posted about the 2nd edition of the book, nearly a decade old, although their dates as listed on this site make it look like they are recent. I don't recall seeing all of the reviews before this.

One of the responses in this case was somewhat critical of me rather than the book: the text by James Rothschadl. I'm not bothered by his criticism of my knowledge of security issues. Generally, hackers who specialize in the latest attacks dismiss anyone not versed in their tools as ignorant, so I have heard this kind of criticism before. It is still the case that the "elite" hackers who specialize in the latest penetration tools think that they are the most informed about all things security. Sadly, some decision-makers believe this too, much to their later regret, usually because they depend on penetration analysis as their primary security mechanism.

What triggered this blog posting was when I read the comments that included the repetition of erroneous information originally in the book Underground by Suelette Dreyfus. In that book, Ms. Dreyfus recounted the exploits of various hackers and miscreants -- according to them. One such claim, made by a couple of hackers, was that they had broken into my account circa 1990. I do not think Ms. Dreyfus sought independent verification of this, because the story is not completely correct. Despite this, some people have gleefully pointed this out as "Spaf got hacked."

There are two problems with this tale. First, the computer account they broke into was on the CS department machines at Purdue. It was not a machine I administered (and for which I did not have administrator rights) -- it was on shared a shared faculty machine. Thus, the perps succeeded in getting into a machine run by university staff that happened to have my account name but which I did not maintain. That particular instance came about because of a machine crash, and the staff restored the system from an older backup tape. There had been a security patch applied between the backup and the crash, and the staff didn't realize that the patch needed to be reapplied after the backup.

But that isn't the main problem with this story: rather, the account they broke into wasn't my real account! My real account was on another machine that they didn't find. Instead, the account they penetrated was a public "decoy" account that was instrumented to detect such behavior, and that contained "bait" files. For instance, the perps downloaded a copy of what they thought was the Internet Worm source code. It was actually a copy of the code with key parts missing, and some key variables and algorithms changed such that it would partially compile but not run correctly. No big deal.

Actually, I got log information on the whole event. It was duly provided to law enforcement authorities, and I seem to recall that it helped lead to the arrest of one of them (but I don't recall the details about whether there was a prosecution -- it was 20 years ago, after all).

At least 3 penetrations of the decoy account in the early 1990s provided information to law enforcement agencies, as well as inspired my design of Tripwire. I ran decoys for several years (and may be doing so to this day grin. I always had a separate, locked down account for personal use, and even now keep certain sensitive files encrypted on removable media that is only mounted when the underlying host is offline. I understand the use of defense-in-depth, and the use of different levels of protection for different kinds of information. I have great confidence in the skills of our current system admins. Still, I administer a second set of controls on some systems. But i also realize that those defenses may not be enough against really determined, resourced attacks. So, if someone wants to spend the time and effort to get in, fine, but they won't find much of interest -- and they may be providing data for my own research in the process!

]]> 2009-12-12T00:29:00-05:00 http://www.cerias.purdue.edu/site/blog/post/an_old_canard_reappears_sort_of/ Gene Spafford spaf@cerias.purdue.edu <p>I have a set of keywords registered with <a href="http://www.google.com/alerts">Google Alerts</a> that result in a notification whenever they show up in a new posting. This helps me keep track of some particular topics of interest.</p> <p>One of them popped up recently with a link to a review and some comments about a book I co-authored (<a href="http://www.spinsafe.com/2009/12/10/practical-unix-internet-security-3rd-edition/"><cite>Practical Unix &amp; Internet Security, 3rd Edition</cite></a>). The latest revision is over 6 years old, but still seems to be popular with many security professionals; some of the specific material is out of date, but much of the general material is still applicable and is likely to be applicable for many years yet to come. At the time we wrote the first edition of the book there were only one or two books on computer security, so we included more material to make this a useful text and reference.</p> <p>In general, I don't respond to reviews of my work unless there is an error of fact, and not always even then. If people like the book, great. If they don't, well, they're entitled to their opinions -- no matter how ignorant and ill-informed they may be. <img src="http://www.cerias.purdue.edu/site/images/smileys/grin.gif" width="19" height="19" alt="grin" style="border:0;" /> &nbsp;&nbsp;</p> <p>This particular posting included reviews from Amazon that must have been posted about the 2nd edition of the book, nearly a decade old, although their dates as listed on this site make it look like they are recent. I don't recall seeing all of the reviews before this.</p> <p>One of the responses in this case was somewhat critical of me rather than the book: the text by James Rothschadl. I'm not bothered by his criticism of my knowledge of security issues. Generally, hackers who specialize in the latest attacks dismiss anyone not versed in their tools as ignorant, so I have heard this kind of criticism before. It is still the case that the "elite" hackers who specialize in the latest penetration tools think that they are the most informed about all things security. Sadly, some decision-makers believe this too, much to their later regret, usually because they depend on penetration analysis as their primary security mechanism.</p> <p>What triggered this blog posting was when I read the comments that included the repetition of erroneous information originally in the book <cite><a href="http://en.wikipedia.org/wiki/Underground_(book)">Underground</a></cite> by Suelette Dreyfus. In that book, Ms. Dreyfus recounted the exploits of various hackers and miscreants -- according to them. One such claim, made by a couple of hackers, was that they had broken into my account circa 1990. I do not think Ms. Dreyfus sought independent verification of this, because the story is not completely correct. Despite this, some people have gleefully pointed this out as "Spaf got hacked."</p> <p>There are two problems with this tale. First, the computer account they broke into was on the CS department machines at Purdue. It was not a machine I administered (and for which I did not have administrator rights) -- it was on shared a shared faculty machine. Thus, the perps succeeded in getting into a machine run by university staff that happened to have my account name but which I did not maintain. That particular instance came about because of a machine crash, and the staff restored the system from an older backup tape. There had been a security patch applied between the backup and the crash, and the staff didn't realize that the patch needed to be reapplied after the backup.</p> <p>But that isn't the main problem with this story: rather, the account they broke into wasn't my real account! My real account was on another machine that they didn't find. Instead, the account they penetrated was a public "decoy" account that was instrumented to detect such behavior, and that contained "bait" files. For instance, the perps downloaded a copy of what they thought was the Internet Worm source code. It was actually a copy of the code with key parts missing, and some key variables and algorithms changed such that it would partially compile but not run correctly. No big deal.</p> <p>Actually, I got log information on the whole event. It was duly provided to law enforcement authorities, and I seem to recall that it helped lead to the arrest of one of them (but I don't recall the details about whether there was a prosecution -- it was 20 years ago, after all).</p> <p>At least 3 penetrations of the decoy account in the early 1990s provided information to law enforcement agencies, as well as inspired my design of Tripwire. I ran decoys for several years (and may be doing so to this day <img src="http://www.cerias.purdue.edu/site/images/smileys/grin.gif" width="19" height="19" alt="grin" style="border:0;" />. I always had a separate, locked down account for personal use, and even now keep certain sensitive files encrypted on removable media that is only mounted when the underlying host is offline. I understand the use of defense-in-depth, and the use of different levels of protection for different kinds of information. I have great confidence in the skills of our current system admins. Still, I administer a second set of controls on some systems. But i also realize that those defenses may not be enough against really determined, resourced attacks. So, if someone wants to spend the time and effort to get in, fine, but they won't find much of interest -- and they may be providing data for my own research in the process!</p><img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/xzxFc7Bk1WE" height="1" width="1"/> 0 <![CDATA[Talking to the Police All the Time]]>
Those kind of statements expose naïveté or, if intended as a manipulative statement, perversity. It takes a long time to explain the risks and convince others that they are real, and that they are really exposed to them, and what the consequences might be. Even if you could somehow manage to explain it convincingly on the spot, before you're done, chances are that you'll be dismissed as a "privacy nut". In addition, you rarely have that kind of time to make a point in a normal discussion. So, that fallacy is often a successful gambit simply because it discourages someone from trying to explain why it's so silly.

You may buy some time by mentioning anecdotes such as the man falsely accused of arson because by coincidence, he bought certain things in a store at a certain time (betrayed by his grocery loyalty card) [1]. Or, there's the Indiana woman who bought for her sick family just a little too much medication containing pseudoephedrine, an ingredient used in the manufacture of crystal meth [2]. Possibilities for the misinterpretation of data or the inappropriate enforcement of bad laws are multiplied by the ways in which it can be obtained. Police can stick a GPS-tracking device on anyone they want without getting a search warrant [3] or routinely use your own phone's GPS [4]. Visiting a web page, regardless of whether you used an automated spider, clicked on a linked manually, perhaps even being tricked into doing it, or were framed by a malicious or compromised web site, can trigger an FBI raid [5] (remember goatse? Except it's worse, with a criminal record for you). There are also the dumb things people post themselves, for example on Facebook, causing them to lose jobs, opportunities for jobs, or even get arrested [6].

Regardless, people always think that happens only to others, that "they were dumb and I'm not" or that they are isolated incidents. This is why I was delighted to find this video of a law professor explaining why talking to police can be a bad idea [7]. Even though I knew that "everything you say can be used against you", I was surprised to learn that nothing you say can be used in your defense. This asymmetry is a rather convincing argument for exercising 5th amendment rights. Then there are the chances that even though you are innocent, due to the stress or excitement you will exaggerate or say something stupid. For example, you might say you've never touched a gun in your life -- except you did once a long time ago when you were a teen maybe, and forgot about it but there's a photo proving that you lied (apparently, that you didn't mean to lie matters little). People say stupid things in less stressful circumstances. Why take the chance? There are also coincidences that look rather damning and bad for you. Police sometimes make mistakes as well. The presentation is well-made and is very convincing; I recommend viewing it.

There are so many ways in which private information can be misinterpreted and used against you or to your disadvantage, and not just by police. Note that I agree that we need an effective police; however, there's a line between that and a surveillance society making you afraid to speak your mind in private, afraid to buy certain things at the grocery store, afraid to go somewhere or visit a web site, or afraid of chatting online with your friends, because you never know who will use anything you say or do against you and put it in the wrong context. In effect, you may be speaking to the police all the time but don't realize it. Even though considering each method separately, it can be argued that technically there isn't a violation of the 5th amendment, the cumulative effect may violate its intent.

Then, after I wrote most of this entry, Google CEO Eric Schmidt declared that "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place" [8]. I'm afraid that's a realistic assessment, even if it's a lawful activity, given the "spying guides" published by the likes of Yahoo!, Verizon, Sprint, Cox, SBC, Cingular, Nextel, GTE, Voicestream for law enforcement, and available at Cryptome [9]. The problem is that you'll then live a sad life devoid of personal liberties. The alternative shrug and ignorance of the risks is bliss, until it happens to you.

[1] Brandon Sprague (2004) Fireman attempted to set fire to house, charges say. Times Snohomish County Bureau, Seattle Times. Accessed at http://seattletimes.nwsource.com/html/localnews/2002055245_arson06m.html

[2] Mark Nestmann (2009) Yes, You ARE a Criminal…You Just Don't Know it Yet. In "Preserving your privacy and more", November 23 2009. Accessed at http://nestmannblog.sovereignsociety.com/2009/11/yes-you-are-a-criminalyou-just-dont-know-it-yet.html

[3] Chris Matyszczyk (2009) Court says police can use GPS to track anyone. Accessed at http://news.cnet.com/8301-17852_3-10237353-71.html

[4] Christopher Soghoian (2009) 8 Million Reasons for Real Surveillance Oversight. Accessed at http://paranoia.dubfire.net/2009/12/8-million-reasons-for-real-surveillance.html

[5] Declan McCullagh (2009) FBI posts fake hyperlinks to snare child porn suspects. Accessed at: http://news.cnet.com/8301-13578_3-9899151-38.html

[6] Mark Nestmann (2009) Stupid Facebook Tricks. In "Preserving your privacy and more", November 27 2009. Accessed at http://nestmannblog.sovereignsociety.com/2009/11/stupid-facebook-tricks.html

[7] James Duane (2008) Don't Talk to Police. http://www.youtube.com/watch?v=i8z7NC5sgik

[8] Ryan Tate (2009) Google CEO: Secrets Are for Filthy People. Accessed at http://gawker.com/5419271/google-ceo-secrets-are-for-filthy-people

[9] Cryptome. Accessed at http://cryptome.org/
Last edited Jan 25, as per emumbert1's suggestion (see comments).]]> 2009-12-08T14:16:00-05:00 http://www.cerias.purdue.edu/site/blog/post/talking_to_the_police_all_the_time/ Pascal Meunier pmeunier@cerias.net I started writing this entry while thinking about the "if you have nothing to hide, then you have nothing to fear" fallacy. What do you say to someone who says that they have nothing to hide, or that some information about them is worthless anyway, so they don't care about some violation of their privacy? What do you say to a police officer who says that if you have nothing to hide then you have nothing to fear by answering questions? It implies that if you refuse to answer then you're probably "not innocent". That "pleading the 5th" is now used as a joke to admit guilt in light banter, is a sign of how pervasive the fallacy has become. It's followed closely with "where there's smoke there's probably fire" when discussing someone's arrest, trial, or refusal to answer questions. However, in the field of information security, it is an everyday occurrence to encounter people who don't realize the risks to which they are exposed. So why is this fallacy so irritating? <BR> <BR> Those kind of statements expose na&#239;vet&#233; or, if intended as a manipulative statement, perversity. It takes a long time to explain the risks and convince others that they are real, and that they are really exposed to them, and what the consequences might be. Even if you could somehow manage to explain it convincingly on the spot, before you're done, chances are that you'll be dismissed as a "privacy nut". In addition, you rarely have that kind of time to make a point in a normal discussion. So, that fallacy is often a successful gambit simply because it discourages someone from trying to explain why it's so silly.<BR> <BR> You may buy some time by mentioning anecdotes such as the man falsely accused of arson because by coincidence, he bought certain things in a store at a certain time (betrayed by his grocery loyalty card)<a href="http://seattletimes.nwsource.com/html/localnews/2002055245_arson06m.html" title=" [1]"> [1]</a>. Or, there's the Indiana woman who bought for her sick family just a little too much medication containing pseudoephedrine, an ingredient used in the manufacture of crystal meth<a href="http://nestmannblog.sovereignsociety.com/2009/11/yes-you-are-a-criminalyou-just-dont-know-it-yet.html" title=" [2]"> [2]</a>. Possibilities for the misinterpretation of data or the inappropriate enforcement of bad laws are multiplied by the ways in which it can be obtained. Police can stick a GPS-tracking device on anyone they want without getting a search warrant <a href="http://news.cnet.com/8301-17852_3-10237353-71.html" title="[3]">[3]</a> or routinely use your own phone's GPS <a href="http://paranoia.dubfire.net/2009/12/8-million-reasons-for-real-surveillance.html" title="[4]">[4]</a>. Visiting a web page, regardless of whether you used an automated spider, clicked on a linked manually, perhaps even being tricked into doing it, or were framed by a malicious or compromised web site, can trigger an FBI raid <a href="http://news.cnet.com/8301-13578_3-9899151-38.html" title="[5]">[5]</a> (remember goatse? Except it's worse, with a criminal record for you). There are also the dumb things people post themselves, for example on Facebook, causing them to lose jobs, opportunities for jobs, or even get arrested <a href="http://nestmannblog.sovereignsociety.com/2009/11/stupid-facebook-tricks.html" title="[6]">[6]</a>. <BR> <BR> Regardless, people always think that happens only to others, that "they were dumb and I'm not" or that they are isolated incidents. This is why I was delighted to find this video of a law professor explaining why talking to police can be a bad idea <a href="http://www.youtube.com/watch?v=i8z7NC5sgik" title="[7]">[7]</a>. Even though I knew that "everything you say can be used against you", I was surprised to learn that nothing you say can be used in your defense. This asymmetry is a rather convincing argument for exercising 5th amendment rights. Then there are the chances that even though you are innocent, due to the stress or excitement you will exaggerate or say something stupid. For example, you might say you've never touched a gun in your life -- except you did once a long time ago when you were a teen maybe, and forgot about it but there's a photo proving that you lied (apparently, that you didn't mean to lie matters little). People say stupid things in less stressful circumstances. Why take the chance? There are also coincidences that look rather damning and bad for you. Police sometimes make mistakes as well. The presentation is well-made and is very convincing; I recommend viewing it.<BR> <BR> There are so many ways in which private information can be misinterpreted and used against you or to your disadvantage, and not just by police. Note that I agree that we need an effective police; however, there's a line between that and a surveillance society making you afraid to speak your mind in private, afraid to buy certain things at the grocery store, afraid to go somewhere or visit a web site, or afraid of chatting online with your friends, because you never know who will use anything you say or do against you and put it in the wrong context. In effect, you may be speaking to the police all the time but don't realize it. Even though considering each method separately, it can be argued that technically there isn't a violation of the 5th amendment, the cumulative effect may violate its intent. <BR> <BR> Then, after I wrote most of this entry, Google CEO Eric Schmidt declared that "If you have something that you don't want anyone to know, maybe you shouldn't be doing it in the first place" <a href="http://gawker.com/5419271/google-ceo-secrets-are-for-filthy-people" title="[8]">[8]</a>. I'm afraid that's a realistic assessment, even if it's a lawful activity, given the "spying guides" published by the likes of Yahoo!, Verizon, Sprint, Cox, SBC, Cingular, Nextel, GTE, Voicestream for law enforcement, and available at Cryptome <a href="http://cryptome.org/" title="[9]">[9]</a>. The problem is that you'll then live a sad life devoid of personal liberties. The alternative shrug and ignorance of the risks is bliss, until it happens to you. <BR> <BR> [1] Brandon Sprague (2004) Fireman attempted to set fire to house, charges say. Times Snohomish County Bureau, Seattle Times. Accessed at http://seattletimes.nwsource.com/html/localnews/2002055245_arson06m.html<BR> <BR> [2] Mark Nestmann (2009) Yes, You ARE a Criminal&#8230;You Just Don't Know it Yet. In "Preserving your privacy and more", November 23 2009. Accessed at http://nestmannblog.sovereignsociety.com/2009/11/yes-you-are-a-criminalyou-just-dont-know-it-yet.html<BR> <BR> [3] Chris Matyszczyk (2009) Court says police can use GPS to track anyone. Accessed at http://news.cnet.com/8301-17852_3-10237353-71.html<BR> <BR> [4] Christopher Soghoian (2009) 8 Million Reasons for Real Surveillance Oversight. Accessed at http://paranoia.dubfire.net/2009/12/8-million-reasons-for-real-surveillance.html<BR> <BR> [5] Declan McCullagh (2009) FBI posts fake hyperlinks to snare child porn suspects. Accessed at: http://news.cnet.com/8301-13578_3-9899151-38.html<BR> <BR> [6] Mark Nestmann (2009) Stupid Facebook Tricks. In "Preserving your privacy and more", November 27 2009. Accessed at http://nestmannblog.sovereignsociety.com/2009/11/stupid-facebook-tricks.html<BR> <BR> [7] James Duane (2008) Don't Talk to Police. http://www.youtube.com/watch?v=i8z7NC5sgik<BR> <BR> [8] Ryan Tate (2009) Google CEO: Secrets Are for Filthy People. Accessed at http://gawker.com/5419271/google-ceo-secrets-are-for-filthy-people<BR> <BR> [9] Cryptome. Accessed at http://cryptome.org/<BR> Last edited Jan 25, as per emumbert1's suggestion (see comments).<img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/Dv6OtMRWDdc" height="1" width="1"/> 0 <![CDATA[CERIAS partners with industry, academic leaders to address nation’s cybersecurity threats]]>

CERIAS is partnering with Northrop Grumman Corp., CMU and MIT to advance research and address the nation’s most pressing cyber threats. This new consortium will work to accelerate the transfer of technology from ideas to real-life application.

Purdue University’s Center for Education and Research in Information Assurance and Security is partnering with Northrop Grumman Corp. and two other universities to advance research and address the nation’s most pressing cyber threats.

The Northrop Grumman Cybersecurity Research Consortium, involving Purdue, Carnegie Mellon University in Pittsburgh and the Massachusetts Institute of Technology in Cambridge, Mass., was announced Tuesday (Dec. 1) at the National Press Club in Washington, D.C. The group will work to accelerate the transfer of technology from ideas to real-life application.

“The Cybersecurity Research Consortium is a wonderful new initiative for CERIAS,” said Gene Spafford, the Purdue center’s executive director. “For more than 15 years, Purdue has been the leading academic group in research and education in information security. Our mission has been to build collaborative relationships with industry, government and other academic entities to advance the state of cybersecurity through basic and applied research while serving as a resource to the global community. We welcome this opportunity for new collaborations and inspirations and look forward to continuing to innovate at the forefront of information protection and privacy.”

Robert Brammer, chief technology officer for Northrop Grumman Information Systems, said Purdue was among the first institutions the corporation thought of when putting the consortium together.

“Purdue’s CERIAS is the largest academic security center in the United States and has won many awards for research and educational excellence in cybersecurity,” Brammer said. “Purdue has produced about 25 percent of the Ph.D.’s in cybersecurity in the past several years and has developed many successful security inventions.”

A motivating factor in starting the consortium was to address some of the issues in President Obama’s report last May of the threats and the need to be in front of cybersecurity issues, Spafford said. CERIAS research was referenced four times in the president’s report.

“CERIAS has long held the belief that too much of today’s information security research focuses on patching near-term problems at the expense of fixing long-term issues,” Spafford said. “The consortium enables four leading research institutions to focus on addressing the fundamental issues of information security, assurance and privacy.”

The consortium will take on some of our world’s leading cyber problems, initially sponsoring 10 projects and providing graduate student fellowships while continuing to expand the portfolio of research to cover the many different aspects of cybersecurity. Members will coordinate research projects, share information and best practices, develop curricula, author joint case studies and other publications, and provide a greater number of learning opportunities and applications for students and the defense community.

For its part, CERIAS will conduct research in four areas:

  • Elisa Bertino, a computer science professor and director of research for CERIAS, will examine embedding information into a digitial signal and origins of data streams for information attribution.

  • Bharat Bhargava, a computer science professor and CERIAS fellow, will lead research into the detection and defense against attacks in cloudlike distributed systems.

  • Sonia Fahmy, associate professor in computer science, will lead research into decomposing Internet-scale models to accurately perform constrained experiments.

  • Rick Mislan, assistant professor in computer and information technology, will lead research into fast forensics, improving the speed and fidelity of forensics in the field on cell phones, PDAs and similar devices.

CERIAS is the world’s largest multidisciplinary academic center addressing the issues of information security, assurance, privacy and cybercrime. The center involves more than 80 faculty and 100 graduate students from 18 academic departments across eight of Purdue’s colleges.

The center was spawned from the Computer Operations, Audit and Security Technology (COAST) lab that was started in 1991 within Purdue’s computer sciences department from research by professors Spafford and Samuel Wagstaff Jr. In 1998 CERIAS began with state funding to look at information security from a multidisciplinary perspective. Since then, the center has taken part in more than 200 projects with private business, agency or government funding, including a recent study for antivirus software giant McAfee Inc. that found companies lost an estimated $4.6 billion in intellectual property in 2008 as a result of cybercrime.

Spafford has worked with government, law enforcement, corporate and academic officials, including two U.S. presidents, the FBI, departments of Justice and Energy, the U.S. Air Force, Microsoft, Intel, Unisys, and the National Science Foundation. He is the 2009 recipient of the Computing Research Association’s Distinguished Service Award and has testified before Congress many times on cybersecurity.

About Northrop Grumman

Northrop Grumman is an industry leader in all aspects of computer network operations and cybersecurity. Northrop Grumman is offering customers innovative solutions to help secure the nation’s cyber future. More about cybersecurity at Northrop Grumman.

Northrop Grumman Corp. is a leading global security company whose 120,000 employees provide innovative systems, products and solutions in aerospace, electronics, information systems, shipbuilding and technical services to government and commercial customers worldwide.

Writer: Jim Bush, 765-494-2077, jsbush@purdue.edu

Source: Eugene Spafford, 765-494-7825, spaf@purdue.edu

Related release: Northrop Grumman news release

]]> 2009-12-01T11:44:00-05:00 http://www.cerias.purdue.edu/site/news/view/cerias_partners_with_industry_academic_leaders_to_address_nations_cybersecu/ Randy Bond bond@cerias.purdue.edu <p><p>CERIAS is partnering with Northrop Grumman Corp., CMU and MIT to advance research and address the nation&#8217;s most pressing cyber threats. This new consortium will work to accelerate the transfer of technology from ideas to real-life application.</p> </p> <div><p>Purdue University&#8217;s Center for Education and Research in Information Assurance and Security is partnering with Northrop Grumman Corp. and two other universities to advance research and address the nation&#8217;s most pressing cyber threats.</p> <p>The Northrop Grumman Cybersecurity Research Consortium, involving Purdue, Carnegie Mellon University in Pittsburgh and the Massachusetts Institute of Technology in Cambridge, Mass., was announced Tuesday (Dec. 1) at the National Press Club in Washington, D.C. The group will work to accelerate the transfer of technology from ideas to real-life application.</p> <p>&#8220;The Cybersecurity Research Consortium is a wonderful new initiative for CERIAS,&#8221; said Gene Spafford, the Purdue center&#8217;s executive director. &#8220;For more than 15 years, Purdue has been the leading academic group in research and education in information security. Our mission has been to build collaborative relationships with industry, government and other academic entities to advance the state of cybersecurity through basic and applied research while serving as a resource to the global community. We welcome this opportunity for new collaborations and inspirations and look forward to continuing to innovate at the forefront of information protection and privacy.&#8221;</p> <p>Robert Brammer, chief technology officer for Northrop Grumman Information Systems, said Purdue was among the first institutions the corporation thought of when putting the consortium together.</p> <p>&#8220;Purdue&#8217;s CERIAS is the largest academic security center in the United States and has won many awards for research and educational excellence in cybersecurity,&#8221; Brammer said. &#8220;Purdue has produced about 25 percent of the Ph.D.&#8217;s in cybersecurity in the past several years and has developed many successful security inventions.&#8221;</p> <p>A motivating factor in starting the consortium was to address some of the issues in President Obama&#8217;s report last May of the threats and the need to be in front of cybersecurity issues, Spafford said. CERIAS research was referenced four times in the president&#8217;s report.</p> <p>&#8220;CERIAS has long held the belief that too much of today&#8217;s information security research focuses on patching near-term problems at the expense of fixing long-term issues,&#8221; Spafford said. &#8220;The consortium enables four leading research institutions to focus on addressing the fundamental issues of information security, assurance and privacy.&#8221;</p> <p>The consortium will take on some of our world&#8217;s leading cyber problems, initially sponsoring 10 projects and providing graduate student fellowships while continuing to expand the portfolio of research to cover the many different aspects of cybersecurity. Members will coordinate research projects, share information and best practices, develop curricula, author joint case studies and other publications, and provide a greater number of learning opportunities and applications for students and the defense community.</p> <p>For its part, CERIAS will conduct research in four areas:</p> <ul> <li><p>Elisa Bertino, a computer science professor and director of research for CERIAS, will examine embedding information into a digitial signal and origins of data streams for information attribution.</p></li> <li><p>Bharat Bhargava, a computer science professor and CERIAS fellow, will lead research into the detection and defense against attacks in cloudlike distributed systems.</p></li> <li><p>Sonia Fahmy, associate professor in computer science, will lead research into decomposing Internet-scale models to accurately perform constrained experiments.</p></li> <li><p>Rick Mislan, assistant professor in computer and information technology, will lead research into fast forensics, improving the speed and fidelity of forensics in the field on cell phones, PDAs and similar devices.</p></li> </ul> <p>CERIAS is the world&#8217;s largest multidisciplinary academic center addressing the issues of information security, assurance, privacy and cybercrime. The center involves more than 80 faculty and 100 graduate students from 18 academic departments across eight of Purdue&#8217;s colleges.</p> <p>The center was spawned from the Computer Operations, Audit and Security Technology (COAST) lab that was started in 1991 within Purdue&#8217;s computer sciences department from research by professors Spafford and Samuel Wagstaff Jr. In 1998 CERIAS began with state funding to look at information security from a multidisciplinary perspective. Since then, the center has taken part in more than 200 projects with private business, agency or government funding, including a recent study for antivirus software giant McAfee Inc. that found companies lost an estimated $4.6 billion in intellectual property in 2008 as a result of cybercrime.</p> <p>Spafford has worked with government, law enforcement, corporate and academic officials, including two U.S. presidents, the FBI, departments of Justice and Energy, the U.S. Air Force, Microsoft, Intel, Unisys, and the National Science Foundation. He is the 2009 recipient of the Computing Research Association&#8217;s Distinguished Service Award and has testified before Congress many times on cybersecurity.</p> <p>About Northrop Grumman</p> <p>Northrop Grumman is an industry leader in all aspects of computer network operations and cybersecurity. Northrop Grumman is offering customers innovative solutions to help secure the nation&#8217;s cyber future. <a href="http://www.northropgrumman.com/cybersecurity">More about cybersecurity at Northrop Grumman</a>.</p> <p>Northrop Grumman Corp. is a leading global security company whose 120,000 employees provide innovative systems, products and solutions in aerospace, electronics, information systems, shipbuilding and technical services to government and commercial customers worldwide.</p> <p>Writer: Jim Bush, 765-494-2077, <a href="mailto:jsbush@purdue.edu">&#106;&#115;&#x62;&#x75;&#x73;&#x68;&#x40;&#x70;&#x75;rd&#117;&#101;&#46;&#101;&#100;&#117;</a></p> <p>Source: Eugene Spafford, 765-494-7825, <a href="mailto:spaf@purdue.edu">&#x73;&#112;&#x61;&#102;&#x40;&#112;&#x75;&#114;&#100;&#x75;&#101;&#x2e;&#101;&#x64;&#117;</a></p> <p>Related release: <a href="http://www.irconnect.com/noc/press/pages/news_releases.html?d=179362">Northrop Grumman news release</a></p> </div> <div><a href="http://www.purdue.edu/newsroom/general/2009/091201SpaffordConsortium.html">More information &raquo;</a></div><img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/QaWBcgEWcy0" height="1" width="1"/> 0 <![CDATA[“Verified by VISA”: Still Using SSNs Online, Dropped by PEFCU]]> written before about the "Verified by VISA" program. While shopping for Thanksgiving online this year, I noticed that Verified by Visa scripts were blocked by NoScript, and I could complete my purchases without authenticating. It was tempting to conclude that the implementation was faulty, but a few phone calls clarified that the Purdue Employee Federal Credit Union stopped participating in the program. I have ambivalent feelings about this. I'm glad that PEFCU let us escape from the current implementation and surprise enrollment based on SSN at the time of purchase, and SSN-based password reset. Yet, I wish a password-protection system was in place because it could significantly improve security (see below). Getting such a system to work is difficult, because in addition to needing to enroll customers, both banks and merchants have to support it. For the sake of curiosity, I counted the number of participating stores in various countries, as listed on the relevant VISA web sites:
CountryNumber of Stores
USA126
Europe183
Thailand439
Taiwan144
Japan105
China90
Singapore65
Malaysia27
Hong Kong20
Vietnam17
Australia13
India7
Others0
Multiply this by the fraction of participating banks (data not available for the US), and for a program that started in 2001, that's spotty coverage. Adoption would be better by getting people to enroll when applying for credit cards, when making a payment, by mail at any time, or in person at their bank. The more people adopt it, the more stores and banks will be keen on reducing their risk as the cost per participating card holder would decrease. Ambushing people at the time of an online purchase with an SSN request violates the security principle of psychological acceptability. The online password reset based on entering your SSN, which I had criticized, is still exposing people to SSN-guessing risks, and also the only means to change your password. I wish that VISA would overhaul the implementation and use an acceptable process (e.g., a nonce-protected link via email to a page with a security question). The reason I'm interested is because I'd rather have a password-protected credit card, and a single password to manage, than a hundred+ online shopping accounts that keep my credit card information with varying degrees of (in)security. Using an appropriate choke-point would reduce attack surface, memorization requirements, and identity theft.]]> 2009-11-26T10:58:00-05:00 http://www.cerias.purdue.edu/site/blog/post/is_verified_by_visa_security_theater/ Pascal Meunier pmeunier@cerias.net I have <a href="http://www.cerias.purdue.edu/site/blog/post/verified-by-visa-issues/" title="written before about the &quot;Verified by VISA&quot;">written before about the "Verified by VISA"</a> program. While shopping for Thanksgiving online this year, I noticed that Verified by Visa scripts were blocked by NoScript, and I could complete my purchases without authenticating. It was tempting to conclude that the implementation was faulty, but a few phone calls clarified that the Purdue Employee Federal Credit Union stopped participating in the program. I have ambivalent feelings about this. I'm glad that PEFCU let us escape from the current implementation and surprise enrollment based on SSN at the time of purchase, and SSN-based password reset. Yet, I wish a password-protection system was in place because it could significantly improve security (see below). Getting such a system to work is difficult, because in addition to needing to enroll customers, both banks and merchants have to support it. For the sake of curiosity, I counted the number of participating stores in various countries, as listed on the relevant VISA web sites: <table> <TR><TH>Country</TH><TH>Number of Stores</TH></TR> <TR><TD>USA</TD><TD>126</TD></TR> <TR><TD>Europe</TD><TD>183</TD></TR> <TR><TD>Thailand</TD><TD>439</TD></TR> <TR><TD>Taiwan</TD><TD>144</TD></TR> <TR><TD>Japan</TD><TD>105</TD></TR> <TR><TD>China</TD><TD>90</TD></TR> <TR><TD>Singapore</TD><TD>65</TD></TR> <TR><TD>Malaysia</TD><TD>27</TD></TR> <TR><TD>Hong Kong</TD><TD>20</TD></TR> <TR><TD>Vietnam</TD><TD>17</TD></TR> <TR><TD>Australia</TD><TD>13</TD></TR> <TR><TD>India</TD><TD>7</TD></TR> <TR><TD>Others</TD><TD>0</TD></TR> </table> Multiply this by the fraction of participating banks (data not available for the US), and for a program that started in 2001, that's spotty coverage. Adoption would be better by getting people to enroll when applying for credit cards, when making a payment, by mail at any time, or in person at their bank. The more people adopt it, the more stores and banks will be keen on reducing their risk as the cost per participating card holder would decrease. Ambushing people at the time of an online purchase with an SSN request violates the security principle of psychological acceptability. The online password reset based on entering your SSN, which I had criticized, is still exposing people to SSN-guessing risks, and also the only means to change your password. I wish that VISA would overhaul the implementation and use an acceptable process (e.g., a nonce-protected link via email to a page with a security question). The reason I'm interested is because I'd rather have a password-protected credit card, and a single password to manage, than a hundred+ online shopping accounts that keep my credit card information with varying degrees of (in)security. Using an appropriate choke-point would reduce attack surface, memorization requirements, and identity theft.<img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/_x8kH5SKO8o" height="1" width="1"/> 0 <![CDATA[Firefox Vulnerabilities: Souvenirs of Windows 95]]> I've been waiting for an announcement of vulnerabilities in Firefox due to popular extensions. I've compared it to Windows 95 before. Yet students often opine that Firefox is more secure than Internet Explorer. It is worth repeating this explanation from the announcement:

"Mozilla doesn't have a security model for extensions and Firefox fully trusts the code of the extensions. There are no security boundaries between extensions and, to make things even worse, an extension can silently modify another extension."

Asking which of Firefox and Internet Explorer is most secure is like asking which of two random peasants is wealthier. They both might be doing their best and there may be significant differences but I wouldn't expect either to be a financier. While I'm running with this analogy, let me compare the widespread and often mandatory use of client scripts in websites (e.g., JavaScript) to CDOs: they both are designed by others with little interest in your security, they leverage your resources for their benefit, they are opaque, complex, nearly impossible to audit, and therefore untrustworthy. They have also both caused a lot of damage, as having scripting enabled is required for many attacks on browsers. How much smaller would botnets be without scripting? Like CDOs, scripting is a financial affair; it is needed to support advertising and measure the number of visitors and click-throughs. Scripting will stay with us because there's money involved, and if advertisers had their way, there would be no option to disable plugins and JavaScript, nor would there be extensions like NoScript. To be fair, there are beneficial uses for JavaScript, but it's a tangled mess with a disputable net value. Here's my take on media and advertising:

Every medium supported exclusively by advertising tends to have a net value of zero for viewers and users (viewsers?). This is where radio and TV are right now. If the value was significantly higher than zero, advertisers could wring more profits from it, for example by increasing the duration or number of annoying things, polluting your mind or gathering and exploiting more information. If it was significantly less than zero, then they would lose viewership and therefore revenue.

So, with time, and if advertising is allowed to power all websites through the requirement for scripting and JavaScript, surfing the web will become as pleasant, useful and watchable as TV, for example (with the difference that your TV can't be used --yet-- to attack people and other nations). I don't mind being locked out of websites that critically depend on advertising revenue -- just like I don't watch TV anymore because it has become a negative value proposition to me. However I mind being needlessly exposed to risks due to other people's decisions, when I use other websites. I'm looking forward to the "component directory lockdown" in Firefox 3.6 as a step in the right direction, and that's the bright light at the end of the tunnel: some things are improving.]]> 2009-11-20T12:37:00-05:00 http://www.cerias.purdue.edu/site/blog/post/firefox_vulnerabilities_souvenirs_of_windows_95/ Pascal Meunier pmeunier@cerias.net <a href="http://www.cerias.purdue.edu/site/blog/post/finally-somebody-gets-secure-web-browsing-and-does-it-the-right-way/" title="waiting">I've been waiting</a> for an <a href="http://www.net-security.org/secworld.php?id=8527" title="announcement">announcement</a> of vulnerabilities in Firefox due to popular extensions. I've compared it to Windows 95 <a href="http://www.cerias.purdue.edu/site/blog/post/more-javascript-browser-attacks-meanwhile-isc2-requires-javascript-and-all-/" title="before">before</a>. Yet students often opine that Firefox is more secure than Internet Explorer. It is worth repeating this explanation from the announcement:<BR> <BR> <b> "Mozilla doesn't have a security model for extensions and Firefox fully trusts the code of the extensions. There are no security boundaries between extensions and, to make things even worse, an extension can silently modify another extension."</b><BR> <BR> Asking which of Firefox and Internet Explorer is most secure is like asking which of two random peasants is wealthier. They both might be doing their best and there may be significant differences but I wouldn't expect either to be a financier. While I'm running with this analogy, let me compare the widespread and often mandatory use of client scripts in websites (e.g., JavaScript) to <a href="http://www.vinodkothari.com/cdos.htm" title="CDOs">CDOs</a>: they both are designed by others with little interest in your security, they leverage your resources for their benefit, they are opaque, complex, nearly impossible to audit, and therefore untrustworthy. They have also both caused a lot of damage, as having scripting enabled is required for many attacks on browsers. How much smaller would botnets be without scripting? Like CDOs, scripting is a financial affair; it is needed to support advertising and measure the number of visitors and click-throughs. Scripting will stay with us because there's money involved, and if advertisers had their way, there would be no option to disable plugins and JavaScript, nor would there be extensions like NoScript. To be fair, there are beneficial uses for JavaScript, but it's a tangled mess with a disputable net value. Here's my take on media and advertising:<BR> <BR> <b>Every medium supported exclusively by advertising tends to have a net value of zero for viewers and users</b> (<a href="http://www.doubletongued.org/index.php/dictionary/viewser/" title="viewsers">viewsers</a>?). This is where radio and TV are right now. If the value was significantly higher than zero, advertisers could wring more profits from it, for example by increasing the duration or number of annoying things, polluting your mind or gathering and exploiting more information. If it was significantly less than zero, then they would lose viewership and therefore revenue.<BR> <BR> So, with time, and if advertising is allowed to power all websites through the requirement for scripting and JavaScript, surfing the web will become as pleasant, useful and watchable as TV, for example (with the difference that your TV can't be used --yet-- to attack people and other nations). I don't mind being locked out of websites that critically depend on advertising revenue -- just like I don't watch TV anymore because it has become a negative value proposition to me. However I mind being needlessly exposed to risks due to other people's decisions, when I use other websites. I'm looking forward to the <a href="http://www.computerworld.com/s/article/9141044/Firefox_3.6_locks_out_rogue_add_ons" title="&quot;component directory lockdown&quot; in Firefox 3.6">"component directory lockdown" in Firefox 3.6</a> as a step in the right direction, and that's the bright light at the end of the tunnel: some things are improving.<img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/n7AdqSQO7GQ" height="1" width="1"/> 0 <![CDATA[Computer Researcher Named Distinguished Fellow of Information Security Group]]>

Eugene H. Spafford has been named as a Distinguished Fellow of the ISSA.

Eugene H. Spafford, a professor at Purdue University and Executive Director of the Center for Education and Research in Information Assurance and Security (CERIAS), has been named as a Distinguished Fellow of the Information Systems Security Association (ISSA), the association’s highest tribute, for his leadership in foundational research in security technology, his leading role in development of influential educational programs, and his long-time advocacy and public service in information security. This follows on his earlier selection to the ISSA Hall of Fame in 2001.

Spafford is widely regarded for his ongoing efforts in cybersecurity and privacy issues. In particular, he has been recognized for his pioneering research in cyberforensics, intrusion detection, network security and firewall design, and integrity management issues, among other items. In 1998 he was the founder of CERIAS at Purdue, and helped establish the first interdisciplinary graduate degree in information security. He has also service in senior advisory roles in various professional organization and government agencies, including as chair of ACM’s US Public Policy Council (USACM), and service on the President’s Information Technology Advisory Committee (PITAC) from 2003-2005.

Over the last few decades, Spafford has been recognized with other professional distinctions, including the National Computer System Security Award in 2000, the IEEE Taylor L. Booth Award in 2004, the ACM President’s Award in 2007, and the CRA Distinguished Service Award in 2008. He has also received all three of Purdue’s major awards for excellence in teaching and education. He is a Fellow of the AAAS, the ACM, the IEEE and the (ISC)^2.

ISSA is an international association of information security practitioners who work to protect privacy, data and systems for businesses, government, education, health care and law enforcement.

ISSA’s Web site is http://www.issa.org. For more information about CERIAS, visit http://www.cerias.purdue.edu. More information on Professor Spafford is at http://spaf.cerias.purdue.edu/narrate.html.

]]> 2009-11-19T14:27:00-05:00 http://www.cerias.purdue.edu/site/news/view/computer_researcher_named_distinguished_fellow_of_information_security_grou/ Randy Bond bond@cerias.purdue.edu <p><p>Eugene H. Spafford has been named as a Distinguished Fellow of the ISSA.</p> </p> <div><p>Eugene H. Spafford, a professor at Purdue University and Executive Director of the Center for Education and Research in Information Assurance and Security (CERIAS), has been named as a Distinguished Fellow of the Information Systems Security Association (ISSA), the association&#8217;s highest tribute, for his leadership in foundational research in security technology, his leading role in development of influential educational programs, and his long-time advocacy and public service in information security. This follows on his earlier selection to the ISSA Hall of Fame in 2001.</p> <p>Spafford is widely regarded for his ongoing efforts in cybersecurity and privacy issues. In particular, he has been recognized for his pioneering research in cyberforensics, intrusion detection, network security and firewall design, and integrity management issues, among other items. In 1998 he was the founder of CERIAS at Purdue, and helped establish the first interdisciplinary graduate degree in information security. He has also service in senior advisory roles in various professional organization and government agencies, including as chair of ACM&#8217;s US Public Policy Council (USACM), and service on the President&#8217;s Information Technology Advisory Committee (PITAC) from 2003-2005.</p> <p>Over the last few decades, Spafford has been recognized with other professional distinctions, including the National Computer System Security Award in 2000, the IEEE Taylor L. Booth Award in 2004, the ACM President&#8217;s Award in 2007, and the CRA Distinguished Service Award in 2008. He has also received all three of Purdue&#8217;s major awards for excellence in teaching and education. He is a Fellow of the AAAS, the ACM, the IEEE and the (ISC)^2.</p> <p>ISSA is an international association of information security practitioners who work to protect privacy, data and systems for businesses, government, education, health care and law enforcement.</p> <p>ISSA&#8217;s Web site is <a href="http://www.issa.org">http://www.issa.org</a>. For more information about CERIAS, visit <a href="http://www.cerias.purdue.edu">http://www.cerias.purdue.edu</a>. More information on Professor Spafford is at <a href="http://spaf.cerias.purdue.edu/narrate.html">http://spaf.cerias.purdue.edu/narrate.html</a>.</p> </div><img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/AFMw-QWd92U" height="1" width="1"/> 0 <![CDATA[Are We All Aware Yet?]]> So, here we are, in November already. We've finished up with National Cyber Security Awareness Month — feel safer? I was talking with someone who observed that he remembered "National Computer Security Day" (started back in the late 1990s) that then became "National Computer Security Week" for a few years. Well, the problems didn't go away when everyone started to call it "cyber," so we switched to a whole month but only of "awareness." This is also the "Cyber Leap Ahead Year." At the same level of progress, we'll soon have "The Decade of Living Cyber Securely." The Hundred Years' War comes to mind for some reason, but I don't think our economic system will last that long with losses mounting as they are. The Singularity may not be when computers become more powerful than the human mind, but will be the point at which all intellectual property, national security information, and financial data has been stolen and is no longer under the control of its rightful owners.

Overly gloomy? Perhaps. But consider that today is also the 21st anniversary of the Morris Internet Worm. Back then, it was a big deal because a few thousand computers were affected. Meanwhile, today's news has a story about the Conficker worm passing the 7 million host level, and growing. Back in 1988 there were about 100 known computer viruses. Today, most vendors have given up trying to measure malware as the numbers are in the millions. And now we are seeing instances of fraud based on fake anti-malware programs being marketed that actually infect the hosts on which they are installed! The sophistication and number of these things are increasing non-linearly as people continue to try to defend fundamentally unsecurable systems.

And as far as awareness goes, a few weeks ago I was talking with some grad students (not from Purdue). Someone mentioned the Worm incident; several of the students had never heard of it. I'm not suggesting that this should be required study, but it is indicative of something I think is happening: the overall awareness of security issues and history seems to be declining among the population studying computing. I did a quick poll, and many of the same students only vaguely recalled ever hearing about anything such as the Orange Book or Common Criteria, about covert channels, about reference monitors, or about a half dozen other things I mentioned. Apparently, anything older than about 5 years doesn't seem to register. I also asked them to name 5 operating systems (preferably ones they had used), and once they got to 4, most were stumped (Windows, Linux, MacOS and a couple said "Multics" because I had asked about it earlier; one young man smugly added "whatever it is running on my cellphone," which turned out to be a Windows variant). No wonder everyone insists on using the same OS, the same browser, and the same 3 programming languages — they have never been exposed to anything else!

About the same time, I was having a conversation with a senior cyber security engineer of a major security defense contractor (no, I won't say which one). The engineer was talking about a problem that had been posed in a recent RFP. I happened to mention that it sounded like something that might be best solved with a capability architecture. I got a blank look in return. Somewhat surprised, I said "You know, capabilities and rings — as in Multics and System/38." The reaction to that amazed me: "Those sound kinda familiar. Are those versions of SE Linux?"

Sigh. So much for awareness, even among the professionals who are supposed to be working in security. The problems are getting bigger faster than we have been addressing them, and too many of the next generation of computing professionals don't even know the basic fundamentals or history of information security. Unfortunately, the focus of government and industry seems to continue to be on trying to "fix" the existing platforms rather than solve the actual problems. How do we get "awareness" into that mix?

There are times when I look back over my professional career and compare it to trying to patch holes in a sinking ship while the passengers are cheerfully boring new holes in the bottom to drop in chum for the circling sharks. The biggest difference is that if I was on the ship, at least I might get a little more sun and fresh air.

More later.

]]> 2009-11-02T13:27:00-05:00 http://www.cerias.purdue.edu/site/blog/post/are_we_all_aware_yet/ Gene Spafford spaf@cerias.purdue.edu <p>So, here we are, in November already. We've finished up with <a href="http://www.cerias.purdue.edu/site/blog/post/what_about_the_other_11_months/">National Cyber Security Awareness Month</a> — feel safer? I was talking with someone who observed that he remembered "National Computer Security Day" (started back in the late 1990s) that then became "National Computer Security Week" for a few years. Well, the problems didn't go away when everyone started to call it "cyber," so we switched to a whole month but only of "awareness." This is also the "Cyber Leap Ahead Year." At the same level of progress, we'll soon have "The Decade of Living Cyber Securely." The Hundred Years' War comes to mind for some reason, but I don't think our economic system will last that long with losses mounting as they are. The <a href="http://en.wikipedia.org/wiki/Technological_singularity">Singularity</a> may not be when computers become more powerful than the human mind, but will be the point at which all intellectual property, national security information, and financial data has been stolen and is no longer under the control of its rightful owners.</p> <p>Overly gloomy? Perhaps. But consider that today is also the 21st anniversary of the <a href="http://en.wikipedia.org/wiki/Internet_Worm">Morris Internet Worm</a>. Back then, it was a big deal because a few thousand computers were affected. Meanwhile, today's news <a href="http://www.eweek.com/c/a/Security/Conficker-Still-Infecting-Windows-Machines-A-Year-Later-Remains-an-Enigma-543974/">has a story</a> about the Conficker worm passing the 7 million host level, and growing. Back in 1988 there were about 100 known computer viruses. Today, most vendors have given up trying to measure malware as the numbers are in the millions. And now we are seeing instances of fraud based on fake anti-malware programs being marketed that actually infect the hosts on which they are installed! The sophistication and number of these things are increasing non-linearly as people continue to try to defend fundamentally unsecurable systems.</p> <p>And as far as awareness goes, a few weeks ago I was talking with some grad students (not from Purdue). Someone mentioned the Worm incident; several of the students had never heard of it. I'm not suggesting that this should be required study, but it is indicative of something I think is happening: the overall awareness of security issues <i>and history</i> seems to be declining among the population studying computing. I did a quick poll, and many of the same students only vaguely recalled ever hearing about anything such as the Orange Book or Common Criteria, about covert channels, about reference monitors, or about a half dozen other things I mentioned. Apparently, anything older than about 5 years doesn't seem to register. I also asked them to name 5 <a href="http://en.wikipedia.org/wiki/List_of_operating_systems">operating systems</a> (preferably ones they had used), and once they got to 4, most were stumped (Windows, Linux, MacOS and a couple said "<a href="http://en.wikipedia.org/wiki/Multics">Multics</a>" because I had asked about it earlier; one young man smugly added "whatever it is running on my cellphone," which turned out to be a Windows variant). No wonder everyone insists on using the same OS, the same browser, and the same 3 programming languages — they have never been exposed to anything else!</p> <p>About the same time, I was having a conversation with a senior cyber security engineer of a major security defense contractor (no, I won't say which one). The engineer was talking about a problem that had been posed in a recent RFP. I happened to mention that it sounded like something that might be best solved with a capability architecture. I got a blank look in return. Somewhat surprised, I said "You know, capabilities and rings — as in Multics and <a href="http://en.wikipedia.org/wiki/System/38">System/38</a>." The reaction to that amazed me: "Those sound kinda familiar. Are those versions of SE Linux?"</p> <p>Sigh. So much for awareness, even among the professionals who are supposed to be working in security. The problems are getting bigger faster than we have been addressing them, and too many of the next generation of computing professionals don't even know the basic fundamentals or history of information security. Unfortunately, the focus of government and industry seems to continue to be on trying to "fix" the existing platforms rather than solve the actual problems. How do we get "awareness" into that mix<span>?</span></p> <p>There are times when I look back over my professional career and compare it to trying to patch holes in a sinking ship while the passengers are cheerfully boring new holes in the bottom to drop in chum for the circling sharks. The biggest difference is that if I was on the ship, at least I might get a little more sun and fresh air.</p> <p>More later.</p><img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/0AXDJjQ7eCA" height="1" width="1"/> 0 <![CDATA[Cassandra Firing GnuPG Blanks]]> logging to the service. Then click on the affected profile name (from the subject of the email), then "Search" and "this month". This will retrieve the latest alerts over an interval of one month for that profile. Messages will not be signed until we figure out a fix. We're sorry for the inconvenience. Edit (Monday 11/2, noon): This has been fixed and emails are signed again. I also added a pre-flight test to detect this condition in the future.]]> 2009-11-01T04:52:00-05:00 http://www.cerias.purdue.edu/site/blog/post/cassandra_firing_gnupg_blanks/ Pascal Meunier pmeunier@cerias.net A routine software update (a minor revision number) caused a serious problem. A number of blank messages were sent until we realized that attempts to sign messages with GnuPG from PHP resulted in empty strings. If you received a blank message from Cassandra, you can find out what it was about by <a href="https://cassandra.cerias.purdue.edu/user/login.php" title="logging to the service">logging to the service</a>. Then click on the affected profile name (from the subject of the email), then "Search" and "this month". This will retrieve the latest alerts over an interval of one month for that profile. Messages will not be signed until we figure out a fix. We're sorry for the inconvenience. Edit (Monday 11/2, noon): This has been fixed and emails are signed again. I also added a pre-flight test to detect this condition in the future.<img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/IEZ1wnF8jpc" height="1" width="1"/> 0 <![CDATA[Spafford Interviewed on IA/IS Education Issues by GovInfoSecurity.com]]>

Information assurance is a topic atop many agendas these days, starting with the president’s own cybersecurity initiative. But what is the state of information assurance education?

]]> 2009-10-20T14:14:00-04:00 http://www.cerias.purdue.edu/site/news/view/spafford_interviewed_on_ia_is_education_issues_by_govinfosecurity.com/ Randy Bond bond@cerias.purdue.edu <p><p>Information assurance is a topic atop many agendas these days, starting with the president&#8217;s own cybersecurity initiative. But what is the state of information assurance education?</p> </p> <div><a href="http://www.govinfosecurity.com/articles.php?art_id=1789&amp;opg=1">More information &raquo;</a></div><img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/s3xk4wJWaVA" height="1" width="1"/> 0 <![CDATA[What About the Other 11 Months?]]> October is "officially" National Cyber Security Awareness Month. Whoopee! As I write this, only about 27 more days before everyone slips back into their cyber stupor and ignores the issues for the other 11 months.

Yes, that is not the proper way to look at it. The proper way is to look at the lack of funding for long-term research, the lack of meaningful initiatives, the continuing lack of understanding that robust security requires actually committing resources, the lack of meaningful support for education, almost no efforts to support law enforcement, and all the elements of "Security Theater" (to use Bruce Schneier's very appropriate term) put forth as action, only to realize that not much is going to happen this month, either. After all, it is "Awareness Month" rather than "Action Month."

There was a big announcement at the end of last week where Secretary Napolitano of DHS announced that DHS had new authority to hire 1000 cybersecurity experts. Wow! That immediately went on my list of things to blog about, but before I could get to it, Bob Cringely wrote almost everything that I was going to write in his blog post The Cybersecurity Myth - Cringely on technology. (NB. Similar to Bob's correspondent, I have always disliked the term "cybersecurity" that was introduced about a dozen years ago, but it has been adopted by the hoi polloi akin to "hacker" and "virus.") I've testified before the Senate about the lack of significant education programs and the illusion of "excellence" promoted by DHS and NSA -- you can read those to get my bigger picture view of the issues on personnel in this realm. But, in summary, I think Mr. Cringely has it spot on.

Am I being too cynical? I don't really think so, although I am definitely seen by many as a professional curmudgeon in the field. This is the 6th annual Awareness Month and things are worse today than when this event was started. As one indicator, consider that the funding for meaningful education and research have hardly changed. NITRD (National Information Technology Research & Development) figures show that the fiscal 2009 allocation for Cyber Security and Information Assurance (their term) was about $321 million across all Federal agencies. Two-thirds of this amount is in budgets for Defense agencies, with the largest single amount to DARPA; the majority of these funds have gone to the "D" side of the equation (development) rather than fundamental research, and some portion has undoubtedly gone to support offensive technologies rather than building safer systems. This amount has perhaps doubled since 2001, although the level of crime and abuse has risen far more -- by at least two levels of magnitude. The funding being made available is a pittance and not enough to really address the problems.

Here's another indicator. A recent conversation with someone at McAfee revealed that new pieces of deployed malware are being indexed at a rate of about 10 per second -- and those are only the ones detected and being reported! Some of the newer attacks are incredibly sophisticated, defeating two-factor authentication and falsifying bank statements in real time. The criminals are even operating a vast network of fake merchant sites designed to corrupt visitors' machines and steal financial information.   Some accounts place the annual losses in the US alone at over $100 billion per year from cyber crime activities -- well over 300 times everything being spent by the US government in R&D to stop it. (Hey, but what's 100 billion dollars, anyhow?) I have heard unpublished reports that some of the criminal gangs involved are spending tens of millions of dollars a year to write new and more effective attacks. Thus, by some estimates, the criminals are vastly outspending the US Government on R&D in this arena, and that doesn't count what other governments are spending to steal classified data and compromise infrastructure. They must be investing wisely, too: how many instances of arrests and takedowns can you recall hearing about recently?

Meanwhile, we are still awaiting the appointment of the National Cyber Cheerleader. For those keeping score, the President announced that the position was critical and he would appoint someone to that position right away. That was on May 29th. Given the delay, one wonders why the National Review was mandated as being completed in a rush 60 day period. As I noted in that earlier posting, an appointment is unlikely to make much of a difference as the position won't have real authority. Even with an appointment, there is disagreement about where the lead for cyber should be, DHS or the military. Neither really seems to take into account that this is at least as much a law enforcement problem as it is one of building better defenses. The lack of agreement means that the tenure of any appointment is likely to be controversial and contentious at worst, and largely ineffectual at best.

I could go on, but it is all rather bleak, especially when viewed through the lens of my 20+ years experience in the field.  The facts and trends have been well documented for most of that time, too, so it isn't as if this is a new development. There are some bright points, but unless the problem gets a lot more attention (and resources) than it is getting now, the future is not going to look any better.

So, here are my take-aways for National Cyber Security Awareness:

  • the government is more focused on us being "aware" than "secure"
  • the criminals are probably outspending the government in R&D
  • no one is really in charge of organizing the response, and there isn't agreement about who should
  • there aren't enough real experts, and there is little real effort to create more
  • too many people think "certification" means "expertise"
  • law enforcement in cyber is not a priority
  • real education is not a real priority

But hey, don't give up on October! It's also Vegetarian Awareness Month, National Liver Awareness Month, National Chiropractic Month, and Auto Battery Safety Month (among others). Undoubtedly there is something to celebrate without having to wait until Halloween. And that's my contribution for National Positive Attitude Month.

]]> 2009-10-04T11:57:00-04:00 http://www.cerias.purdue.edu/site/blog/post/what_about_the_other_11_months/ Gene Spafford spaf@cerias.purdue.edu <p>October is "officially" <a href="http://www.dhs.gov/files/programs/gc_1158611596104.shtm">National Cyber Security Awareness Month</a>. Whoopee! As I write this, only about 27 more days before everyone slips back into their cyber stupor and ignores the issues for the other 11 months.</p> <p>Yes, that is not the proper way to look at it. The proper way is to look at the lack of funding for long-term research, the lack of meaningful initiatives, the continuing lack of understanding that robust security requires actually committing resources, the lack of meaningful support for education, almost no efforts to support law enforcement, and all the elements of "Security Theater" (to use <a href="http://www.schneier.com/">Bruce Schneier</a>'s very appropriate term) put forth as action, only to realize that not much is going to happen this month, either. After all, it is "Awareness Month" rather than "Action Month."</p> <p>There was a big announcement at the end of last week where Secretary Napolitano of DHS announced that DHS had new authority to hire 1000 cybersecurity experts. Wow! That immediately went on my list of things to blog about, but before I could get to it, Bob Cringely wrote almost everything that I was going to write in his blog post <cite><a href="http://www.cringely.com/2009/10/the-cybersecurity-myth/">The Cybersecurity Myth - Cringely on technology</a></cite>. (<i>NB. Similar to Bob's correspondent, I have always disliked the term "cybersecurity" that was introduced about a dozen years ago, but it has been adopted by the hoi polloi akin to "hacker" and "virus."</i>) I've <a href="http://homes.cerias.purdue.edu/~spaf/usgov/commerce.pdf">testified before the Senate</a> about the lack of significant education programs and the <a href="http://www.cerias.purdue.edu/site/blog/post/centers_of_academic_adequacy/">illusion of "excellence"</a> promoted by DHS and NSA -- you can read those to get my bigger picture view of the issues on personnel in this realm. But, in summary, I think Mr. Cringely has it spot on.</p> <p>Am I being too cynical? I don't really think so, although I am definitely seen by many as a professional curmudgeon in the field. This is the 6th annual Awareness Month and things are worse today than when this event was started. As one indicator, consider that the funding for meaningful education and research have hardly changed. NITRD (National Information Technology Research &amp; Development) <a href="http://www.nitrd.gov/Pubs/2010supplement/FY10Supp-FINALFormat-Web.pdf">figures show</a> that the fiscal 2009 allocation for Cyber Security and Information Assurance (their term) was about $321 million across all Federal agencies. Two-thirds of this amount is in budgets for Defense agencies, with the largest single amount to DARPA; the majority of these funds have gone to the "D" side of the equation (development) rather than fundamental research, and some portion has undoubtedly gone to support offensive technologies rather than building safer systems. This amount has perhaps doubled <a href="http://www.eric.ed.gov:80/ERICDocs/data/ericdocs2sql/content_storage_01/0000019b/80/19/e7/eb.pdf">since 2001</a>, although the level of crime and abuse has risen far more -- by at least two levels of magnitude. The funding being made available is a pittance and not enough to really address the problems.</p> <p>Here's another indicator. A recent conversation with someone at <a href="http://www.mcafee.com">McAfee</a> revealed that new pieces of deployed malware are being indexed at a rate of about 10 <i>per second</i> -- and those are only the ones detected and being reported! Some of the newer attacks are incredibly sophisticated, <a href="http://blogs.zdnet.com/security/?p=4402">defeating two-factor authentication</a> and <a href="http://www.wired.com/threatlevel/2009/09/rogue-bank-statements/">falsifying bank statements</a> in real time. The criminals are even operating a vast network of <a href="http://www.computerworld.com/s/article/9138514/Russian_cybergangs_make_the_Web_a_dangerous_place?source=CTWNLE_nlt_security_2009-09-25">fake merchant sites</a> designed to corrupt visitors' machines and steal financial information. &nbsp;&nbsp;<a href="http://www.ibls.com/internet_law_news_portal_view_prn.aspx?s=latestnews&amp;id=1882">Some accounts</a> place the annual losses in the US alone at over $100 billion per year from cyber crime activities -- well over 300 times everything being spent by the US government in R&amp;D to stop it. (Hey, but what's <a href="http://www.informationisbeautiful.net/visualizations/the-billion-dollar-gram/">100 billion dollars</a>, anyhow?) I have heard unpublished reports that some of the criminal gangs involved are spending tens of millions of dollars a year to write new and more effective attacks. Thus, by some estimates, the criminals are vastly outspending the US Government on R&amp;D in this arena, and that doesn't count what other governments are spending to steal classified data and compromise infrastructure. They must be investing wisely, too: how many instances of arrests and takedowns can you recall hearing about recently?</p> <p>Meanwhile, we are still awaiting the appointment of the <a href="http://www.cerias.purdue.edu/site/blog/post/on_cyber_czars_and_60-day_reports/">National Cyber Cheerleader</a>. For those keeping score, the President announced that the position was critical and he would appoint someone to that position right away. That was on May 29th. Given the delay, one wonders why the National Review was mandated as being completed in a rush 60 day period. As I noted in that earlier posting, an appointment is unlikely to make much of a difference as the position won't have real authority. Even with an appointment, there is disagreement about where the lead for cyber should be, <a href="http://www.nextgov.com/nextgov/ng_20090925_9014.php">DHS</a> or the <a href="http://homelandsecuritynewswire.com/single.php?id=7574">military</a>. Neither really seems to take into account that this is at least as much a law enforcement problem as it is one of building better defenses. The lack of agreement means that the tenure of any appointment is likely to be controversial and contentious at worst, and largely ineffectual at best.</p> <p>I could go on, but it is all rather bleak, especially when viewed through the lens of my 20+ years experience in the field.&nbsp;&nbsp;The facts and trends have <a href="http://www.cerias.purdue.edu/site/blog/post/cyber_security_challenges_and_windmills/">been well documented</a> for most of that time, too, so it isn't as if this is a new development. There are some bright points, but unless the problem gets a lot more attention (and resources) than it is getting now, the future is not going to look any better.</p> <p>So, here are my take-aways for National Cyber Security Awareness:</p> <ul> <li>the government is more focused on us being "aware" than "secure"</li> <li>the criminals are probably outspending the government in R&amp;D</li> <li>no one is really in charge of organizing the response, and there isn't agreement about who should</li> <li>there aren't enough real experts, and there is little real effort to create more</li> <li>too many people think "certification" means "expertise"</li> <li>law enforcement in cyber is not a priority</li> <li>real education is not a real priority</li> </ul> <p>But hey, don't give up on October! It's also <a href="http://www.epromos.com/calendar/vegetarian-awareness-month.html">Vegetarian Awareness</a> Month, <a href="http://www.epromos.com/calendar/national-liver-awareness-month.html">National Liver</a> Awareness Month, <a href="http://www.epromos.com/calendar/national-chiropractic-month.html">National Chiropractic</a> Month, and <a href="http://www.epromos.com/calendar/auto-battery-safety-month.html">Auto Battery Safety</a> Month (among <a href="http://www.epromos.com/calendar/promotional-calendar.html">others</a>). Undoubtedly there is something to celebrate without having to wait until Halloween. And that's my contribution for <a href="http://www.epromos.com/calendar/positive-attitude-month.html">National Positive Attitude</a> Month.</p><img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/MUjBR77bBP4" height="1" width="1"/> 0 <![CDATA[Spafford Comments on Gary McKinnon Case]]>

Professor Eugene Spafford, founder of the Center for Education and Research in Information Assurance and Security at Indiana’s Purdue University, said the victim of a cybercrime should not take the blame. If someone broke a door to rob a store, he said, it was usual to charge them the cost of the door.

]]> 2009-09-25T13:46:00-04:00 http://www.cerias.purdue.edu/site/news/view/spafford_comments_on_gary_mckinnon_case/ CERIAS Webmaster coj@cerias.purdue.edu <p><blockquote> <p>Professor Eugene Spafford, founder of the Center for Education and Research in Information Assurance and Security at Indiana&#8217;s Purdue University, said the victim of a cybercrime should not take the blame. If someone broke a door to rob a store, he said, it was usual to charge them the cost of the door.</p> </blockquote> </p> <div><a href="http://www.computerweekly.com/Articles/2009/09/22/237807/expert-challenges-ufo-hackers-700k-bill.htm">More information &raquo;</a></div><img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/qIeXljVTV-0" height="1" width="1"/> 0 <![CDATA[CERIAS Prof Finds Confidential Information on State-Auctioned Computers]]>

Rogers found the lottery hard drives contain a list of lottery players, along with their home addresses, email addresses and birthdates; personal emails to and from lottery employees including lewd jokes and information about workers’ children; agency databases, contact lists and contracts; serial numbers and other information about lottery scratch-off and pull tab ticket machines placed in retail stores around the state; and employee usernames and passwords used to log on to state computers.

]]> 2009-09-25T13:44:00-04:00 http://www.cerias.purdue.edu/site/news/view/cerias_prof_finds_confidential_information_on_state-auctioned_computers/ CERIAS Webmaster coj@cerias.purdue.edu <p><blockquote> <p>Rogers found the lottery hard drives contain a list of lottery players, along with their home addresses, email addresses and birthdates; personal emails to and from lottery employees including lewd jokes and information about workers&#8217; children; agency databases, contact lists and contracts; serial numbers and other information about lottery scratch-off and pull tab ticket machines placed in retail stores around the state; and employee usernames and passwords used to log on to state computers.</p> </blockquote> </p> <div><a href="http://www.wthr.com/global/story.asp?s=11150901">More information &raquo;</a></div><img src="http://feeds.feedburner.com/~r/CeriasCombinedFeed/~4/lC63lVDQED8" height="1" width="1"/> 0