Friday, March 16, 2007

Way to Go Joanna

I briefly met Joanna Rutkowska at Black Hat Federal 2006 when she spoke about rootkits. Today I saw she was interviewed by Dark Reading and said the following:

Still, she worries that security technology and research is too prevention-oriented and doesn't emphasize detection enough. "The whole industry is focusing on prevention, and we have all those anti-exploitation technologies, which are very helpful indeed. But I'm so surprised that no one cares about detection," she says. "Every time there's prevention, there is some bypass method" created.

Without detection, there's no way to know if an attacker has grabbed administrative access to a machine, she says. And if you can't see that an attacker has infiltrated the system, nothing in that system will be "reliable" anymore. "The scary part is that once an attacker [gets] into the system, we can't reliably read system memory, neither using software-based, nor hardware-based, methods. That means we can't answer the question of whether the system is clean or not," she says.
(emphasis added)

Wow. I am so pleased to read someone of Johanna's caliber stressing the need for detection. I have been working on slides for ShmooCon and I plan to talk about this very subject, and you probably know I've been saying for years that prevention eventually fails. Her comment about reliability of evidence relates to my TaoSecurity Pyramid of Trust, where I mentioned Johanna with respect to her techniques to defeat memory capture.

4 comments:

joanna said...

:)

Rob Lewis said...

What would be necessary for prevention to succeed? A mathematically complete and closed system perhaps? Since there are none around, perhaps that is why they are going to eventually fail?

Keydet89 said...

In both my first book as well as my soon-to-be-released book ("Windows Forensic Analysis" from Syngress), I make the point that incidents will happen and that there is a need for training in basic troubleshooting and IR methodologies in order to accurately identify and categorize (hello, FISMA!?!) an incident. I've seen too many cases where a virulent worm rampages across a network, and because the IT staff has limited training, knowledge, time and other resources, the common reaction is to proclaim defeat at the hands of a rootkit.

Now I know Joanna is most likely stating this from the point of view of commercial applications, which in itself answers the question of "why aren't we seeing detection"? And from the perspective of most users/IT shops, the push is for vendors to produce prevention products, because that means once something's prevented, the incident is done and over with, and no more work is required. Any detection product is going to point you to a problem, requiring additional time and resources to investigate. Until senior management starts taking security and IR more seriously, there won't be a push for detection.

Harlan
http://windowsir.blogspot.com

Anonymous said...

I saw here in Hack in the Box in Kuala Lumper last year!

http://hackathology.blogspot.com/