SteveJ-restore-test

Marcus Ranum, renowned IT Security expert, has interesting views on Cyberwar. It's a lot more nuanced and subtle than "One Big Attack". Where I diverge: a Big Event is a great distraction for really 'interesting', subtle actions - and can be just as simple as the First Worm by Morris. Oooops, it wasn't meant to do that... Things you should read or view: RSA Conference, 2012, On Cyberwarfare Fabius Maximus posts on cyberwar You must Be >this< Tall To Play Cyberwar (has DoD grown enough yet?) Cyberwar: The Pentagon Cyberstrategy Cyberwar: About Stuxnet‏, the next generation of warfare? Congress Authorizes Pentagon to Wage Internet War  [Wired. Ryan Singel] M.R. on rearguard-security: Cyberwar

What  did US Intelligence tell the Australian Government about Real Network Security  when a chinese vendor was vetoed  as supplier of NBN (central?) switches? Now that we have O'bama admitting " we did Stuxnet, with a little help ", we know that they aren't just capable and active, but aware of higher level attacks and defences: you never admit to your highest-level capability. Yesterday I read two pieces that gave me pause: the first,  the US Navy replacing Windows with Linux for an armed drone was hopeful, the other should frighten anyone who understands Security: there's now a market in Zero-Day vulnerabilities . The things the new-world of the NBN has to protect us against just got a lot worse than you can imagine. Links in that article: Google's responsible disclosure  [and payments] “The Hackers Who Sell Spies The Tools To Crack Your PC (And Get Paid Six-Figure Fees) " “Shopping For Zero-Days: A Price List For Hackers’ Secret Software Exploits ...

We've crossed a Internet Security Rubicon: the USA admits to combined cyber-attack operations with Israel against Iran's nuclear enrichment program .[NY Times] The Washington Post's " Zero Day " series says a lot more. It's a very important event when a government goes public with its most-secret security or intelligence programs: it took over 4-decades after WWII (and the 'Spycatcher' court case) for news of just part of the Allied SIGINT activities to become public. The work of Bletchley Park, the home of Alan Turning's biggest contribution, was kept secret to the point of allowing mass casualties rather than give it away. The only reason I can think of for O'Bama to publicise the USA's active, and successful, practice of cyber-attack is they think they've developed protections against it. For competent, well-resourced and persistent/dogged attackers, like the Military or Intelligence Agencies, even the Gold Standard of Internet Sec...

CYBER-WARFARE and the Australian NBN. We know from "Stuxnet" that Nation States are actively building and deploying Cyber warfare tools, applying them to National Security concerns and running them as Military, not technical, operations. This includes accurate reconnaissance and network topology and vulnerability mapping. The worst case is that attackers will gain access to the network control tools and infrastructure. Recent coverage suggests that Obama denied a US Military request to launch a cyber attack on Syria's infrastructure during the recent 'troubles'. From the "slammer" worm, we know that any Cyber warfare attack will be fully developed within 3 minutes, and any attack will be launched at the worst possible time for defenders, possibly accompanied by physical distractions. Recovery from "munitions grade" worm/malware compromise will be long and expensive. Experience is that malware infections is as damaging to businesses as a fire: W...

Whilst reading this piece today I 'had a thought'. " Militarisation of cyberspace: how the global power struggle moved online ",  Nick Hopkins, guardian.co.uk, Monday 16 April 2012 15.00 BST One argument in support of the NBN I've not heard is about Security , but not the "how to keep your bank account and credit card safe" kind - the usual direct theft or Identity Fraud talked about at Cyber-Security conferences. The National Security kind that interest the Intelligence agencies and Military, a.k.a. "Cyber-warfare". This is as far removed from normal Cyber-security as guarding bank vaults is from fighting a war. Attack, and hence Defence, is taken to a whole new level: because the resources employed and what is at stake is taken to a whole new level. The Y2K debacle/non-event conclusively demonstrated a number of things, one of which was Federal Government "front office" functions (normal day-to-day tasks) were completely dependent ...

There's an 800-lb Gorilla in Internet Security that nobody discusses or acknowledges: If Governments decide to apply their Technical and Military Intelligence skills to the Internet, not only won't we know, we won't be able to do anything about it. Talking to a friend recently, off the top of my head I outlined 4 levels of Internet attackers/exploits (highest level/most competent at the top): [4] National Military and Commercial Intelligence: surveillance, espionage, counter-espionage, targeted cyber-attack. [3] Commercial Espionage and "Exploit as a business": Exploits and SPAM as a Service, botnets, Credit Card and Identity trading. [2] small-scale, "hobbyist" and semi-professional technical creators. Some sales to level [3]. [1] script-kiddies, Internet "graffiti"/vanity attackers, customers of level [3]. These levels may or may not be "official" and may not be complete. But they are roughly right. 2004 was a watershed year: The Ha...

A new Internet Security report for July-Dec 2011 from M86 is out: " New M86 Security Labs Report Reveals Spread of Malware Growing via Social Media, Targeted Attacks and Exploit Kits " [ PDF ] It triggered a thought that first occurred to me during the "No Internet Censorship" campaign: The perfect place for those wanting to hide illegal activities is "within the network", to work as Admins for Internet Providers. They can monitor, avoid and intercept Law Enforcement etc. requests and respond in many subtle ways. This thought arose after two rather disconcerting incidents for me: A TV documentary on Internet Porn mentioned the officers have to view these images and that it can lead to desensitisation over time, and an unprovoked personal attack within an Admin's forum by a "security professional" upon an individual. Sexually explicit language was used and that the language went unremarked by the entire forum was gob-smacking for me.  We als...

Information Security is both very hard and very easy at the same time. Not only are Internet Nasties a nuisance, or worse, they prevent the  new, useful Applications and Networks like e-Commerce, i-EDI, e-Health, e-Banking, e-Government and other business/commercial transactions systems. Perfect Security isn't possible: ask any bank. Defenders need to be 100.00% correct, every minute of every day. Attackers need just one weakness for a moment to get in. Not all compromises/breaches are equal: from nothing of consequence, up to being in full control with system owners not being aware of it. All 'Security Systems' can only be "good enough" for their role, which depends on many factors. How long do you need to keep your secrets? Minutes or Decades? Building a system isn't an end-point: "Information Security is a journey, not a destination" (Schneier) Security has two aspects: creation and operation or patrolling. Not only do you have to build it safe, ...

I've written on Microsoft heading for financial trouble and mounting internet security problems - but they have an underlying cause. Both ignore the hard-won Unix principle: Less is More . [the joke behind the pager, 'less'] This isn't just some arbitrary style choice, it's rooted deep in Computer Science and Software Engineering: smaller, cleaner interfaces - many fewer bugs if bugs/LOC is static (errors = LOC squared ) smaller code - potentially better understandability the Einstein principle: As simple as possible, but no simpler . Controlling system entropy - smaller code, less entropy to grow. Learning curve for new maintainers is lower - "cognitive span" of individuals not exceeded Learning curve for programmers lower and risk of errors of misunderstanding lower. More is Worse in Software Engineering - in every technical dimension. Microsoft has gone on to demonstrate that it is possible to have excessive 'customer features'. But this isn...

It never ceases to amaze me, the Politician attitude to Porn and 'Spam' & it's friend, malware. Porn is "bad, bad, bad" and Pollies show very high interest - including policy & legislation. Lots of angst & trashing around about eradicating something that 2,000+ years of writing/publishing shows can't be controlled/legislated away. The physical publishing world & (cable) TV show that the *only* effective is means of control is to allow-but-license. Same as tobacco. Never going to eradicate it, only control it. 'Restricted Content' access can only be controlled iff: every page is 'classified' at source (meta-tags), an unforgeable Internet 'proof-of-age' card/system is created, there are criminal penalties for subverting the system, forging identities or misclassifying pages, there are no legal jurisdictions outside 'the system' [e.g. on the high-seas], all browsers enforce 'the rules', and browsers can...

The 2005 Australian Computer Crime and Security Survey (PDF) reports that at the end of 2004 "the hackers turned pro". The ACCSS index may be easier for downloads. For 2-3 years now, most malware has satisfied the definition of Organised Crime - it's theft, it's purposeful, it's co-ordinated. In an August 2006 post , I reported the ACCSS comments and new comments from SANS . ZDNet now report that Rootkits becoming increasingly complex and operate by stealth. They say: Rootkits -- malicious software that operates in a stealth fashion by hiding its files, processes and registry keys--have grown over the past five years from 27 components to 2,400, according to McAfee's Rootkits Part 2: A Technical Primer (PDF). If you use a Microsoft system and connect to the Internet without extensive protection, you should be afraid, very afraid. And even large organisations who do everything right, are still open to targetted "zero day" attacks. The first Windo...