Network Security Blog

Zach was a little late, but Rich and Martin start with talks of their recent travels (Martin wins) and prepping for DefCon. Then we jump into the latest super hot security news.

Network Security Podcast, Episode 279, May 29, 2012

Time: 38:34

Show notes:

• IBM bans Siri. Must not like the snark.
• FBI forms net surveillance unit.
• Google to notify users of DNSChanger infections.
• Flame bait.
• Did China backdoor a US military chip? Maybe, maybe not.
• Tonight’s Music: 8 Ball Aitken with Black Swamp Creek

After the scary Canadians ransacked our show, Rich needed some alone time in the cornfields of some midwestern state. Respecting Rich’s need for “meditation” (or a quick sell of all of his Facebook shares), Martin and Zach, in their respective bleary-eyed states, recorded anyway.

Network Security Podcast, Episode 278, May 22, 2012

Time:  37:05

Show notes:

• Boards Are Still Clueless About Cybersecurity
• China hits back at Pentagon’s cyber spy allegations (see also http://pastebin.com/wamYsqTV, with regard to ZTE backdoor mention)
• Anonymous leaks US government crime statistics data
• A closer look into the RSA SecureID software token
• Facebook hit with $15 billion class action user tracking lawsuit
• Tonight’s Music: Jodi Jet with 80′s Girl

I just spent the last two weeks in Singapore, Kuala Lumpur, Sydney and the Gold Coast.  It was arguably one of the best trips of my career, both from a work perspective and from a tourist perspective.  Of course, I’ve never really been a one man traveling road show before, but it’s part of the role when your job title includes the word ‘evangelist’.  I was more than a little humbled by some of the people I got to meet and excited by the chances I had to meet a lot of people who’d only been digital signatures up until this point.  Nothing like finally putting a face to a name 8000 miles from home to make you realize how small the world really has become.

One of the more interesting conversations I found myself in was at the AusCERT Conference.  The Chatham House Rule was invoked, so I can’t say exactly who was involved, which is pretty convenient since I couldn’t remember the names or affiliations of half the people who were in the room at the time in any case.  A large number of the vendors at AusCERT got invited by representatives from the the Australian police forces to participate in open conversation and feedback.  This wasn’t simply a pretense to make vendors feel good, the LEO’s (Law Enforcement Officer) were genuinely interested in hearing from people who worked in the business.  The sad part is that after a break, only a few of the vendors came back for the second half of the conversation.  Not that I had any problems speaking my mind either half of the conversation.

The question that took up most of the time was “Australia is going to put our healthcare information online, how do we keep it safe?”  There were numerous suggestions, but the point that resonated with almost everyone was that the data was almost certainly already compromised and if it wasn’t, it would be soon.  This led to a few incredulous stares and the statement, “90% of businesses already admit to being compromised, the other 10% just won’t admit it or don’t know yet.”  Isn’t it uplifting when you get 20 or so vendors in a room and every one of them tells you you’re probably already compromised?  Several of the comments from the LEO’s gave me the impression that they had exactly the same opinion, even if they couldn’t admit it in any forum that contained people without the proper security clearances.

This conversation left me wondering.  How do we live in a world where we have to assume that if our data isn’t already compromised, it soon will be?  How do we make the data useful to the people who rely on it while denying value to the people who would want to steal it?  We know we can’t secure data forever, so can we give it a lifetime in some way and still continue to use it? 

One of the solutions I thought about was encryption.  We use it widely for the protection of credit cards, though perhaps not as widely as we really should.  It’s great for keeping data in motion secure if we’re using short lived keys and well known algorithms.  It’s relatively good for dealing with data at rest, at least as long as the keys are well maintained and everyone treats the data with due diligence.  Which is seldom the case, since most evidence points to compromises taking place in ways that easily circumvent encryption technologies.  The best encryption in the world doesn’t help much when legitimate user accounts are compromised.

We live in a world where our defenses don’t seem to be working and all data will be eventually compromised by someone.  We’re at a stage where we can’t pretend our static defenses will protect us from much except the pickers of low hanging fruit on the Internet.  Whether it’s a nation state actor, a chaotic actor or an out of work actor, someone wants our data; and they’re going to get it eventually, since we have so many holes in our protections.  Which means we have to change our way of securing the data to make it useless to anyone outside it’s intended audience.

I’m not even sure what making information lose it’s value outside of it’s intended audience would look like.  One idea is to make the information publicly available, which removes the value to an attacker, but that’s probably never going to be a viable option when dealing with healthcare information.  Rumors of technologies that will make data self-destruct when it’s removed from it’s proper environment is appealing, but I have yet to talk to anyone who’s actually given any such solution a walk through.  Hardware based solutions that rely upon encryption are slightly better than software, but then you have problems like vendor lock-in and longer life cycles for the technology, which really only help the vendor.

As usual, I don’t have an answer for this problem.  But I know that our data is leaking from where it’s stored every day and the leak may soon become a deluge.  Australia isn’t the only country that’s looking at putting their healthcare information online, and they need a solution that’s going to work as well for the big corporations as it does for the single doctor clinics in the Outback.  Any technology that can’t be operated by a doctor who’s willing to live hundreds of miles from the closest IT guy isn’t going to work.  And while the US might be a little different, I’m not sure we should look at the tech our doctors might use any differently.

If you have an answer to this problem, it might be the wave of the future.

By the grace of FSM, schedules synced up this week so we could all get together (despite Martin’s perpetual jet lag). Narrowly avoiding a discussion of CISPA (we’ll save that for later), the gang touches on some vulnerability disclosure gaffes, an “attack back” proposal (what year is this?), and more.

Network Security Podcast, Episode 275, May 1, 2012

Time:  34:21

Show notes:

• RuggedCom Owes its Customers an Explanation
• Oracle scrambles to contain 0-day SNAFU
• The history of a -probably- 13 years old Oracle bug: TNS Poison
• ‘Stand Your Cyberground’ Law: A Novel Proposal for Digital Security
• Big Data’s Big Problem: Little Talent
• British ISPs Ordered to Block The Pirate Bay
• Tonight’s Music: Jet Lag Gemini with Run this City

As a follow up to last week’s episode, Martin was joined last week by Josh Corman to talk to Wade Baker about the 2012 Verizon Data Breach Investigation Report.  Wade talks to us about how the information for the report was gathered, some of the strengths and weaknesses of the analysis and finally how the amazing puzzle that is the front cover was concieved.  The episode is a little longer than normal, but worth the time.

When this podcast was first release, it was mistakenly seen by iTunes as the PDF of the DBIR as being the podcast.  Subsequent attempts to upload were similarly misidentified.  Here’s hoping that a remix of the podcast will be significantly different enough that it doesn’t try keying on the DBIR again

Network Security Podcast, Episode 272v2

“The Internet will never again be as free as it is this morning” – Dan Geer at SOURCE Boston

Think on that for a while.  If it doesn’t scare you, it should.

Update:  Here’s the full text of Dan Geer’s talk at SOURCE Boston

The gang is scattered to the wind.  Rich is off at some random Margaritaville and Zach is pretending he has a real life and a new job or something.  So Martin called out the cavalry and is joined tonight by none other than Dave Lewis, aka Gattaca on twitter (I bet many of you didn’t realize he had a ‘normal’ name).  We talk a lot about privacy (go figure), the TSA (big surprise) and the difference between Canadian and Amercian veiwpoints on a few things.  A good time was had by all.  Or at least by Martin, which is what really matters.  And let’s not forget BSides Chicago coming up soon!

Network Security Podcast, Episode 274, April 17, 2012

Time:  30:00 (Exactly, which may be a first)

Show notes:

• Internet Service Provider to put our privacy first
• CISPA is getting better, but still has a long way to go
• Kip Hawley finally admits the TSA is broken… and offers suggestions to fix it
• War games with China
• Tonight’s Music: Big Sandy with Big Fat Trouble

Unlike it’s brethren, SOPA and PIPA, CISPA doesn’t scare me because it’s aimed at shutting down piracy and giving the media companies unheard of powers. CISPA scares me because it is aimed at letting companies share information between each other and with the government in order to stop bad guys, which is a noble cause. Unluckily, CISPA is written in such a way that 1) it tramples on the very basic rights of due process and privacy to combat these threats and b) it includes clauses that name intellectual property and private information as reasons for this sharing. Which places us right back in SOPA/PIPA land, because it now the media companies are back in the thick of things.

Let’s have some laws to promote information sharing. But let’s not give up our civil liberties and make our government into more of a surveillance state than it already is.

Update:  At the suggestion of a co-worker, I sat down and read the entirety of the CISPA bill, only to find it had changed significantly from when I’d first skimmed over it.  Several of the clauses that would have allowed the media companies to share information freely if they suspect piracy have been changed to clarify that it’s only if there is an attempt at network compromise that the CISPA sharing would be invoked.  Of course, that might not stop businesses from claiming they’re justified in sharing, which is a fairly likely event given previous experience with many media companies.  It also got a little worse in some ways, including the power infrastructure companies and limiting the liability of companies even more and making it nearly impossible to claim a violation, provided you can even find out there was one in the first place.  Techdirt has a good explanation of some of the changes.  There’s improvement, but not enough that we shouldn’t do everything we can to stop this law in it’s current form. 

Infographic designed by Lumin Consulting

Zach is off settling in to the new job and prepping for Source Boston, but Rich and Martin managed to get together to discuss travel, the latest security news, and Rich’s rant on the whole Mac malware thing.  And Martin apologizes to listeners for the mixup with episode 272.

…

Network Security Podcast, Episode 273, April 10, 2012

Time:  40:20

Show Notes:

• When the cops subpoena your Facebook information, here’s what Facebook sends the cops
• Hotel’s Free Wi-Fi Comes With Hidden Extras
• Executives Abroad May Get Owned Before They’re Off The Tarmac
• After killing SOPA, Internet activists take aim at a new House cybersecurity bill
• Mac malware thingy