Thursday, April 30, 2015

The Need for Test Data

Last week at the RSA Conference, I spoke to several vendors about their challenges offering products and services in the security arena. One mentioned a problem I had not heard before, but which made sense to me. The same topic will likely resonate with security researchers, academics, and developers.

The vendor said that his company needed access to large amounts of realistic computing evidence to test and refine their product and service. For example, if a vendor develops software that inspects network traffic, it's important to have realistic network traffic on hand. The same is true of software that works on the endpoint, or on application logs.

Nothing in the lab is quite the same as what one finds in the wild. If vendors create products that work well in the lab but fail in production, no one wins. The same is true for those who conduct research, either as coders or academics.

When I asked vendors about their challenges, I was looking for issues that might meet the criteria of Allan Friedman's new project, as reported in the Federal Register: Stakeholder Engagement on Cybersecurity in the Digital Ecosystem. Allan's work at the Department of Commerce seeks "substantive cybersecurity issues that affect the digital ecosystem and digital economic growth where broad consensus, coordinated action, and the development of best practices could substantially improve security for organizations and consumers."

I don't know if "realistic computing evidence" counts, but perhaps others have ideas that are helpful?

Tuesday, April 28, 2015

Will "Guaranteed Security" Save the Digital World?

Thanks to a comment by Jeremiah Grossman on LinkedIn, I learned of his RSA talk No More Snake Oil: Why InfoSec Needs Security Guarantees. I thought his slide deck looked interesting and I wish I had seen the talk.

One of his arguments is that security products and services lack guarantees, "unlike every day 'real world' products," as shown on slide 3 at left.

The difference between the products at left and those protected by security products and services, however, is that security products and services are trying to counter intelligent, adaptive adversaries.

Jeremiah does include a slide showing multiple "online security guarantees" for financial services. Those assets do indeed face challenges from the sorts of adversaries I have in mind. I need to hear more about what Jeremiah said at this point, and also I need to learn more about this individual guarantees.

It may be useful to look at what physical security companies offer by way of guarantees. I did not see this angle in Jeremiah's slides, although he may have talked about it.

Taking a tentative step in this direction, I visited the ADT web site. You've seen their ads for protecting homes, and you might even be a customer. This is the sort of company that faces at least some threats who are intelligent and/or adaptive. What guarantees does ADT offer?

The screen capture below shows the answer. I am particularly interested in the "Theft Protection Guarantee."


A theft protection guarantee is like a "hack prevention guarantee." As you can see, if your home is burglarized while under ADT monitoring, you get up to $500 paid toward your insurance deductible.

The fine print is even more interesting:

"The Customer presenting ADT with this ORIGINAL CERTIFICATE will be eligible to receive a reimbursement of up to five hundred dollars ($500) of Customer’s homeowner’s insurance deductible (if any) if, and only if, ALL of the following requirements are met to ADT’s reasonable satisfaction

(i) the property loss was the result of a burglary that took place while the security system installed at Customer’s protected premises was in good working order and was “on,” and while all of Customer’s doors and windows were locked; and 

(ii) the intruder entered the residence through a door, window or other area equipped with an ADT detection device, and such detection device was not “bypassed”; and 

(iii) Customer is not in any way in default under the ADT Residential Systems Customer’s Order; and 

(iv) Customer files a written claim with their homeowner’s insurance company, and such claim is not rejected or otherwise contested by the insurer; and 

(v) Customer reports the burglary loss to the appropriate police department and obtains 
a written police report; and 

(vi) Customer provides ADT with copies of the insurance claim report, the police report within six
ty (60) days of the property loss and proof of settlement by insurance carrier; and 

(vii) Customer certifies in writing to ADT (by signing this ORIGINAL CERTIFICATE and presenting it to ADT within sixty [60] days of the property loss) that all of the foregoing requirements have been satisfied. 

Customer understands that presentation of this ORIGINAL CERTIFICATE signed by Customer is required and understands that ADT reserves the right to reject any application for reimbursement that does not comply with ALL of the requirements." (emphasis added)

Can you imagine the equivalent conditions for a digital security service or product? Could you imagine a customer being able to prove it met the requirements?

It would be interesting to see how many times ADT has paid out this guarantee money.

Wait, you might say, Jeremiah showed a car in the slide at the top of this post. What do car security guarantees look like? I'm glad you asked. Here's one of the top results I found online, for Viper.


Here is the fine print:

"Qualifications:

    The qualifying system was sold, installed, and serviced by an authorized dealer for DIRECTED, remains in the car in which the system was originally installed, and owned by the original purchaser of the qualifying system. Window decals must have been in place on the vehicle at the time of installation.

    The theft occurred less than one year after the date of purchase of the qualifying Viper system.

    This GPP claim is made within sixty (60) days of settlement of your claim with your insurance carrier. (90 days in New York state)

    The warranty registration card was completely filled out and mailed to DIRECTED within 10 days of purchase.

    The vehicle was stolen as a result of alarm system failure and the automobile was not left in an inactive/disarmed mode for whatever reason, even if left at a service station.

    A police report must be filed and a copy submitted with your GPP claim.

    Vehicle must be insured against theft at the time vehicle was stolen.

    The insurance company must accept and pay the claim.

    A DIRECTED starter kill device must have been installed on the vehicle and the sales receipt must show starter kill installation.

Your claim MUST meet all of the criteria as stated above to be eligible to file a claim for reimbursement of your comprehensive deductible...

A product's warranty is automatically void if its date code or serial number is defaced, missing, or altered. GPP does not cover vandalism, theft of vehicle parts, contents, damage to vehicle and/or towing charges. Furthermore, vehicles that are consigned or displayed for sale are not covered by the GPP program. GPP is not available to employees, agents, friends or relatives of Directed or of its dealers. 

GPP does not extend to or cover motorcycles or vehicles without lockable doors, ignition systems and/or engine compartments." (emphasis added)

Again, I ask, can you imagine the equivalent conditions for a digital security service or product? Could you imagine a customer being able to prove it met the requirements?

Given these examples of security guarantees in the physical work, I don't think we will see much progress in the digital world, perhaps beyond paying insurance deductibles.

I believe the heavy work on the economic side will be done by the insurance companies, as is indicated by these physical security examples.

We are likely to see more insurance on the security vendor side, as we are already seeing (as noted in Jeremiah's talk) much more insurance in the security consumer (enterprise) arena.

Quick addendum: It just occurred to me that the security services mentioned earlier are primarily means to the following:


  1. Decrease insurance premiums.
  2. Deter attackers.
  3. If deterrence fails, increase the changes of more rapid police response.
These ideas have some relevance in the digital security world, although I think "stickers" saying "protected by product X and service Y" may have the opposite effect, as they may give intruders ideas on how to bypass the defenses. Then again, that might already happen with the house and car alarm examples.


Monday, April 13, 2015

Example of Chinese Military Converging on US Military

We often hear of vulnerabilities in the US military introduced by net-centric warfare and a reliance on communications network. As the Chinese military modernizes, it will introduce similar vulnerabilities.

I found another example of this phenomenon courtesy of Chinascope:

PLA Used its Online Purchasing Website for its First Online Purchase

Written by LKY and AEF   

Xinhua reported that on, April 7, the PLA announced that five manufacturers won the bidding, totaling 90 million yuan (US$14.48 million), to supply general and maintenance equipment to the PLA. The article said that these were the first purchase orders that the PLA received since it launched its military equipment purchasing website in January. The site is at http://www.weain.mil.cn/. 

The PLA claimed that it saved close to 12 million yuan (US$1.93 million) compared to the list price. The purchase order consisted of items such as containers for maintenance equipment and tools, gas masks, carrier cases, and army field lighting. The article said that the PLA equipment purchasing website was launched on January 4. On February 25, the PLA General and Maintenance department made a public announcement on the website calling for bids. On March 19, the public bidding was held at Ordnance Engineering College in Shijiazhuang City of Hebei Province. 

Over 20 manufacturers submitted bids and 5 of them, including some privately owned companies, won the bidding.

Source: Xinhua, April 12, 2015
http://news.xinhuanet.com/info/2015-04/12/c_134143641.htm

(emphasis added)

You can imagine the sorts of opportunities this story presents to adversaries, including impersonating the Chinese Web site, phishing either party (supplier or purchaser), and so on.

I expect other militaries to introduce similar vulnerabilities as they modernize, presenting more opportunities for their adversaries.

Network Security Monitoring Remains Relevant

Cylance blogged today about a Redirect to SMB problem found in many Windows applications. Unfortunately, it facilitates credential theft. Steve Ragan wrote a good story discussing the problem. Note this issue does not rely on malware, at least not directly. It's a problem with Microsoft's Server Message Block protocol, with deep historical roots.

(Mitigating Service Account Credential Theft on Windows [pdf] is a good paper on mitigation techniques for a variety of SMB problems.)

Rather than discussing the technical problem, I wanted to make a different point. After reading about this technique, you probably want to know when an intruder uses it against you, so you can see it and preferably stop it.

However, you should be wondering if an intruder has already used it against you.

If you are practicing network security monitoring (described most recently in my newest book), then you should already be collecting network-based evidence of this attack.

  • You could check session data and infer that outbound traffic on using traditional SMB ports like 139 or 445 TCP are likely evidence of attack. 
  • You could review transaction data for artifacts of SMB traffic, looking for requests and replies. 
  • Best of all, you could review full content data directly for SMB traffic, and see exactly what happened. 

Whenever you see a discussion of a new attack vector, you will likely think "how do I stop it, or at least see it?"

Don't forget to think about ways to determine if an attacker has already used it against you. Chances are that certain classes of intruders have been exercising it for days, weeks, months, or perhaps years before it surfaced in the media.

PS: This post may remind you of my late 2013 post Linux Covert Channel Explains Why NSM Matters.

Sunday, April 12, 2015

Please Support OpenNSM Group

Do you believe in finding and removing intruders on the network before they cause damage? Do you want to support like-minded people? If you answered "yes," I'd like to tell you about a group that shares your views and needs your help.

In August 2014, Jon Schipp started the Open (-Source) Network Security Monitoring Group (OpenNSM). Jon is a security engineer at the National Center for Supercomputing Applications at the University of Illinois at Urbana-Champaign. In his announcement on the project's mailing list, Jon wrote:

The idea for this group came from a suggestion in Richard Bejtlich's most recent book, where he mentions it would be nice to see NSM groups spawn up all over much like other software user groups and for the same reasons.

Network security monitoring is the collection, analysis, and escalation of indications and warnings to detect and respond to intrusions. It is an operational campaign supporting a strategy of identifying and removing intruders before they accomplish their mission, thereby implementing a policy of minimizing loss due to intrusions. At the tactical and tool level, NSM relies on instrumenting the network and applying hunting and matching to find intruders.

Long-time blog readers know that I have developed and advocated NSM since the late 1990s, when I learned the practice at the Air Force Computer Emergency Response Team (AFCERT).

I am really pleased to see this group holding weekly meetings, which are available live or as recordings at YouTube.

The group is seeking funding and sponsorship to build a NSM laboratory and conduct research projects. They want to give students and active members hands-on experience with NSM tools and tactics to conduct defensive operations. They outline their plans for funding in this Google document.

I decided to support this group first as an individual, so I just donated $100 to the cause. If you are a like-minded individual, or perhaps represent an organization or company, please consider donating via GoFundMe to support this OpenNSM group and their project. You can also follow them @opennsm and Facebook, and check out their notes at code at GitHub. Thank you!