{"id":26907,"date":"2011-08-29T03:11:07","date_gmt":"2011-08-29T02:11:07","guid":{"rendered":"http:\/\/alienbabeltech.com\/main\/?p=26907"},"modified":"2011-08-29T03:32:22","modified_gmt":"2011-08-29T02:32:22","slug":"cyber-security-%e2%80%a6-a-work-in-progress-starts-with-users","status":"publish","type":"post","link":"http:\/\/alienbabeltech.com\/main\/cyber-security-%e2%80%a6-a-work-in-progress-starts-with-users\/","title":{"rendered":"Cyber Security \u2026 a Work in Progress, Starts with Users"},"content":{"rendered":"
\n
The following is by G. A . “Andy” Marken, President of Marken Communications<\/span><\/a> Inc. He has kindly given us permission to republish his thought-provoking article. As with everything that we publish at AlienBabelTech, the opinions expressed are solely those of the individual writer and do not necessarily reflect the views and the opinions of the rest of the ABT staff.<\/strong><\/span><\/span> \u2013Mark Poppin,<\/span> ABT Senior Editor<\/span><\/span><\/strong><\/h6>\n<\/blockquote>\n

Black Hats, DefCon<\/strong><\/p>\n

\"\"<\/a>\u201c<\/em><\/strong>Of course, the whole point of a Doomsday Machine is lost, if you *keep* it a *secret*!\u201d<\/em> \u2013 Dr. Strangelove in \u201cDr. Strangelove or How I Learned to Stop Worrying and Love the Bomb,\u201d Columbia Pictures (1964)\u00a0 <\/strong><\/p><\/blockquote>\n

The annual Black Hat, DefCon events\u2026you can almost smell the cyber napalm in the morning<\/p>\n

While there are a lot of good things about Las Vegas (business-friendly policies), it\u2019s a logical location for a hacking, malware, cyber penetration convention.\u00a0 After all, it was founded on a fundamental human frailty \u2026 personal greed, beating the odds.<\/p>\n

HINT:<\/strong>\u00a0 It\u2019s impossible to beat the odds!<\/p>\n

Unfortunately, you also can\u2019t beat the odds when it comes to protecting personal, corporate and government secrets.<\/p>\n

Malicious and pain-in-the-behind bad guy hacking, hacktivism wins more often than the good guys.<\/p>\n

It\u2019s why no one with half a brain uses any of the ATM machines when the nearly 9,000 \u201cattendees\u201d are in town. They\u2019re hacked just for the heckovit!<\/p>\n

It was here that Aruba wanted to demonstrate the strength of their cryptographic technology and wireless technology by provisioning the two events.<\/p>\n

Now that takes \u2026 well, you know!<\/p>\n

Conference Fun<\/strong><\/p>\n

Seems like everyone took a whack at them, generating:<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 670 rogue attacks<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 191 AP flood attacks<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 489 AP spoofing<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1,659 hotspot attacks<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 1,700 Block ACK attacks<\/p>\n

\u00a0As Major Kong said, \u201cShoot, a fella’ could have a pretty good weekend in Vegas with all that stuff.\u201d<\/em><\/p>\n

Yeah, there was a lot of fun \u2018n games; but a lot of serious business was discussed and I gotta\u2019 tell you, the future isn\u2019t all that bright.<\/p>\n

The \u201cnoise\u201d highlight of the two conferences was McAfee\u2019s report of a five-year global study.<\/p>\n

Their report (Operation Shady Rat) is available on their website but they focused on the cyber-espionage activities against 70 targets \u2013 sensitive government, business and private organizations.<\/p>\n

The bottom line was they had all been penetrated\/ripped off; but the real news was how long they had gone unnoticed \u2013 some for months, but many for a year or more.<\/p>\n

Dmitri Alperovitch, of MacAfee Labs, noted that pretty much anyone with data worth stealing had been compromised and that was just the tip of the iceberg.<\/p>\n

General Turgidson looked at the amount of damage being done and said, \u201c<\/em>Gee, I wish we had one of them doomsday machines.<\/em><\/p>\n

\"\"<\/a>Global Issue \u2013 <\/strong>McAfee\u2019s five-year study uncovered cyber penetrations everywhere, even in the most aggressively protected organizations.\u00a0 The countries, areas not shown?\u00a0 Those folks haven\u2019t uncovered the malicious, vicious work or they swept the attacks under the rug.\u00a0 Complex programming produces a lot of the openings for hackers, hactivists, cybercriminals but users who bypass organization program\/network security pose the best opportunities for getting inside.\u00a0 Source – McAfee<\/strong><\/p><\/blockquote>\n

The conclusion was, companies (and folks) could be divided into two categories:\u00a0 Those Global organizations that know they\u2019ve been compromised <\/em>and those that don\u2019t yet know<\/em>.<\/p>\n

Us?\u00a0 Ignorance is bliss.<\/p>\n

The security folks weren\u2019t ignorant of the problem though and didn\u2019t mince words in the sessions about management\u2019s poor response to all the bad things that can happen when security sucks.<\/p>\n

Instead of beefing up security staffs (the shows were hunting grounds for new employees), organizations were buying hack insurance.<\/p>\n

Why protect company information and secrets when you can pass the buck?<\/p>\n

As General Ripper said, \u201c<\/em>Today, war is too important to be left to politicians.\u201d<\/em><\/p>\n

While Anonymous has scored some impressive penetrations in company, government and law enforcement organizations, one of the panels didn\u2019t give them much credit except for showing folks how their network security sucked.<\/p>\n

\"\"<\/a><\/p>\n

Packed Sessions \u2013 <\/strong>The DefCon and Black Hat sessions brought forward industry leaders and lots of discussions including concern over Net neutrality, privacy, and cyberwar activities\/concerns.\u00a0 Mudge noted that added layers of security not only add to the complexity but increase the attack surface.\u00a0 Robert Clark of the U.S. Army Cyber Command, who packed his session, said governments need to monitor\/seize data and user rights.\u00a0 Source – TechRepublic<\/strong><\/p><\/blockquote>\n

Bad Kids at Play<\/strong><\/p>\n

People who hack\/secure for a living didn\u2019t think much of Anonymous or LulzSec equating their self-righteous activities to a bunch of kids sneaking into a school to smash and steal stuff.<\/p>\n

Releasing private, personal, secret documents may be cool; but increasingly, personal information about people is being outed ruining reputations and putting folks in danger.<\/p>\n

The professional hackers\/hacktivists didn\u2019t condone that type of reckless activity, since the whole objective of the two shows was to point out weaknesses in the systems and get people to correct them.<\/p>\n

When that doesn\u2019t happen, they let everyone know how they can get inside the organization.<\/p>\n

Or, if the organization is doing really bad stuff, dig it up and expose it to the world.<\/p>\n

Sounds reasonable to us.<\/p>\n

A lot of the speakers like Pieter Zatko or \u201cMudge\u201d were seasoned hackers who went legit working for businesses and organizations to improve programming\/network quality and beef-up security.<\/p>\n

Zatko noted that because today\u2019s systems are so complex, they\u2019re breeding grounds for malicious coders.<\/p>\n

A recent IBM report showed that for every 1,000 lines of code, one to five bugs were introduced, providing open doors for kids who are really good at hacking and crooks who are really \u201cinspired.\u201d<\/p>\n

General Ripper knew the source of the problem and explained, \u201c<\/em>That’s the way your hard-core Commie works.\u201d<\/em><\/em><\/p>\n

Back in the good old days of the two events, it was only natural that most of the discussions centered on the big target in the room — Microsoft Windows.<\/p>\n

With \u201ceveryone\u201d using the OS, it was fun\/easy for hackers, crackers and attackers to beat the living c__p out of MS without even trying.<\/p>\n

But that has slowly changed because MS:<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 \u00a0is investing a lot in security technology<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 improved the quality of their programming\/development<\/p>\n

–\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0\u00a0 has been more responsive when problems have been uncovered<\/p>\n

\u00a0Or\u2026it\u2019s just no fun kicking the old dog anymore.<\/p>\n

Then too, some folks see Windows as irrelevant in the brave new \u201cpost PC World.\u201d<\/p>\n

The rogues have turned their attention on Jobs\u2019 Apple.\u00a0 \u00a0The disorganized Anonymous said Mac OS X and other OSes were their big focus for the coming year.<\/p>\n

It wasn\u2019t a big issue when IT departments kept Macs at a safe distance.<\/p>\n

Office Apples<\/strong><\/p>\n

But now that companies have \u201cbent\u201d their policies, and are allowing people to BYOD (bring your own device), \u00a0security holes are becoming a major problem.<\/p>\n

We knew that Apple increasing their marketshare wasn\u2019t something that would lead to any good.<\/p>\n

\"\"<\/a>Generation Wired \u2013 <\/strong>We will always have hackers \u2013 good and bad \u2013 who are better, smarter, faster than the generations that try to protect the Net\/users.\u00a0\u00a0 Like this 10-year-old who attended the two events, every new generation is wired differently and digging around stuff just to uncover problems, issues, opportunities is natural to them.\u00a0 Little things like security are minor inconveniences, not locks on the doors.\u00a0 Source \u2013 CNN Money<\/strong><\/p><\/blockquote>\n

The issue seems to be that the more secure the OS and your device, the less convenient it is to use; and you\u2019ve gotta\u2019 admit Apple\u2019s devices are easy to use.<\/p>\n

DefConers and BlackHatters like to point out that one of the reasons hackers, hactivists and cybercriminals succeed so well is that folks just turn off the security features to make their stuff easier to use.<\/p>\n

Crud\u2026we wanted it both ways!<\/p>\n

One of the highlights of the two events \u2013 beside hacking ATMs and rubbing shoulders with the CIA, FBI, DEA, etc.. — \u00a0is the annual Pwnie awards.<\/p>\n

\"\"<\/a>Pwnie Awards \u2013 <\/strong>Every year, companies, hackers, discoveries are \u201chonored\u201d for their inability to protect their content, for the bugs\/holes they uncovered, their deeds (good and bad).\u00a0 The conclusion from this year\u2019s DefCon, Black Hat Conference was that there will be even more awards presented next year and the malicious, vicious attacks will be bigger and more profuse.<\/p><\/blockquote>\n

Individuals, companies as well as malware discoverers and breakers are honored with a garish gold My Little Pony prize each year.<\/p>\n

Prize Winners<\/strong><\/p>\n

Gates had a matching collection of them and he passed them on to Ballmer who also has an unbroken record.<\/p>\n

Sony got theirs, so did a lot of individuals who weren\u2019t able to attend because they were doing hard time.<\/p>\n

Then there are the folks who wanted to bask in the spotlight, but outing themselves to the crowd just didn\u2019t seem really \u201cprudent.\u201d<\/p>\n

Jobs won\u2019t send anyone next year–period.<\/p>\n

Other than a few people getting job offers, others getting ticked because they were one-upped by a **** little 10-year-old no less; Black Hat and DefCon are two conferences you can bet will be around for years.<\/p>\n

While attention is being focused on the bad guys\/gals and the havoc they cause, the security industry still isn\u2019t doing a good job of protecting computer users from themselves and the hostile world around them.<\/p>\n

Yes, law-enforcement agencies around the globe are tracking down and arresting more malicious folks and cybercriminals.<\/p>\n

While some of the hacking community has a strong sense of social responsibility, there are more who think nothing of hacking, defacing, exposing an organization and individuals because they feel they\u2019ve been wronged.<\/p>\n

Many get carried away with their own \u201cpower\u201d and hurting people because the Net gives them invisibility; and bragging about their exploits is a big ego booster.\u00a0 But there are a lot of ethical hackers out there who get a real rush out of finding a firewall hole or software bug that gives them entrance into an organization\u2019s database so the weaknesses can be corrected.<\/p>\n

For the rest of us who are system\/net challenged, all we can do is be cautious, skeptical, alert.<\/p>\n

Just remember what Major Kong said, \u201c<\/em>I got a pretty fair idea that something doggone important is goin’ on back there.\u201d <\/em><\/p>\n

\"\"<\/a><\/p>\n

The hackers can be a pain in the behind, but the really bad guys?\u00a0 If it looks\/sounds too good to be true\u2026it probably is!!!<\/p>\n

# # #<\/p>\n

by: G.A. “Andy” Marken<\/strong><\/p>\n

President<\/strong><\/p>\n

Marken Communications Inc.<\/strong><\/p>\n

Andy@markencom.com<\/a><\/strong><\/p>\n

Please join us in our Forums<\/a><\/p>\n

Become a Fan on Facebook<\/a><\/p>\n

Follow us on Twitter<\/a><\/p>\n

For the latest updates from ABT, please join our RSS News Feed<\/a><\/p>\n

Join our Distributed Computing teams<\/p>\n