White Wolf Security

UK Hospital Operational After Virus Outbreak

Alright, yes, it was a computer virus outbreak that infected the hospital network. And yes, the hospital network was disconnected by the administrators to prevent further spreading of the problem. But this seemed like the perfect story for a sensationalist headline, and I decided to take it.

Three hospitals in London, St. Bartholomew's, the Royal London Hospital and the London Chest Hospital had their networks shut down earlier in the week after detection of a virus outbreak. Over the past few days the IT staff has been slowly bringing key systems and departments back online as they can be secured. Initially the staff thought they had it contained, but it turned out to be worse than they thought, crashing systems when doctors and staff tried to log on to systems, prompting to more drastic shutdown and disconnection.

The entire story, with many more details, is available here. Luckily for the hospital it looks like their disaster recovery planning has actually gone pretty well. According to the story the operations of the hospitals have continued mostly unaffected throughout the network outage, and it's taken the staff 2-3 days to bring key parts of all 3 hospitals back online. Although there is one thing that struck me as a little off about the whole thing...

From the article:

A serious computer virus infection at the Trust - later identified as caused by the Mytob worm - was first detected on Monday.

Wait, the Mytob worm is what brought down 3 hospital networks? You mean, this Mytob worm? Mytob primarily spreads via mass mailing. The malware grabs the address book from a Windows computer and sends email with an attachment to everyone in it. The Sophos information page also notes that it can spread using the LSASS vulnerability, a flaw patched in Windows 4 years ago. I think I know why that disaster recovery plan was locked down so tight.

This is another great example of how hard security is, especially on large networks that must support legacy software, and it's even harder on healthcare networks that have a huge amount of specialized hardware installed on them. If nothing else, the hospitals are in good company, the Wikipedia page on the Zotob worm (a Mytob variant that spreads via a Microsoft flaw patched in 2005) quotes a Businessweek article that lists ABC, CNN, AP, the New York Times and Caterpillar, Inc. as companies being hit by this worm (all of whom, presumable, have larger IT security budgets than a UK hospital group).

And, speaking of being in the company of larger budgets, news also came out today about a worm that's been spreading across military networks. All the details are still classified, so we don't know what worm or anything else about it, except that the DoD has taken the drastic step of banning all external media from the network (everything from thumb drives to burned CDs and DVDs). It's really easy to get viruses into a network, really hard to get them out, and it only takes one mistake to open the door. Defense-in-depth and compartmentalization are great strategies, but they're also expensive to implement, difficult to implement well, and a determined user can usually outmaneuver the systems.

Also, as an interesting side note, a frequent solution to these kinds of problems, both by lawmakers and non-security people, is that we need tougher legislation or new laws to handle these kinds of things. In the case of the Mytob and Zotob worms, the creators were both arrested after the fact. While law enforcement takes some time to work, even if they were arrested the day after the worms were released (or the hour after, for that matter), it wouldn't have mattered.

Once the worm is on the network, it's a feeding frenzy. A pathology-mimicking performance with the new code playing the part of the biological attacker seeking the machines with no defenses prepared, and system administrators playing the role of evolution, trying to keep their systems working against the onslaught of malicious code. Just like in the real world the viruses don't get tired, they just try and replicate using whatever is in reach, whether the vulnerability is 4 days or 4 years old. And even when the systems are patched and everything seems safe, it just takes one email attachment to bring the attacker inside, and it all starts again.

I'm not sure exactly what the solution to these problems is, but I'm pretty sure it has less to do with the "new legislation" method and more to do with the "disaster recovery" method the hospitals used: having trained, professional people on hand to put things back together when they all fall apart.

Hackers Gain New Ally In Their Semantic War

About a month ago I wrote about Sarah Palin's Yahoo! email account getting hacked. Police found a suspect fairly quickly and arrested a University of Tennessee student, on suspicion of committing the crime. An article over at The Register today details a new filing made by the defense attorneys in the case, specifically, that their client not be referred to by the misleading term "hacker".

There are 2 interesting things of note in this case: one of them comes from the article, and the other comes from the comments on the article. For years a semantic war has raged over the true definition of the word "hacker". On one side you have the legions of the tech-savvy, fighting to uphold the good name of their good word. On the other side are the laypersons, who don't understand the rich history of the term, that are potentially brainwashed by media outlets telling them of the dangers of hackers.

To understand why, we'll have to take a look back into the before-time, in the long long ago of the 1960s...

Brief History

As far back as the 1960s a culture of "hacking" had emerged at prestigious institutions like MIT. These people thought of themselves as hackers, and their main focus was on solving problems in creative ways. At this point the term hacker was almost synonymous with "free thinker" and "problem solver". Seeing these people as role models, other people adopted the term.

As the 1980s and 1990s came around the hacker culture had expanded. More and more people started to have home computers and wanted in on the hacker culture. So now computer hobbyists, and enthusiasts in general, considered themselves hackers. They, too, found creative solutions to problems and found interesting ways of putting together various hardware components. Hacking no longer meant "free thinker", the term had evolved to mean "computer expert".

Because computer enthusiasts also frequently wrote code, the term hacker also became linked to coders, specifically clever coding. It's one thing to take code from a book on coding and tweak it slightly to do what you want, but to do something different or original or novel with code, now that's hacking. Linus Torvalds and Bill Gates were hackers, what you do in an Introduction to Programming class certainly is not.

As the mid-1990s came around, and Microsoft helped set off a PC revolution, the barrier to entry for owning a computer was significantly lowered. Many people had no idea about the culture of hacking. For many people what they had purchased was a black box full of magic. They knew enough to write documents and play games, but not enough to know why these things worked, because the answers to those questions is deep magic. And who are the people who can control the deep magic? Only the hackers.

And as the Internet swept across the planet, and things like identity theft became rampant, the only people that had the knowledge to make computers do their bidding was the dreaded hacker.

Back to the Present

The term "hacker" has evolved considerably since its creation 50 years ago. Searching around the Internet (or reading the comments in that article) is enough to show that the battle is still going strong. Purists maintain that hackers, by definition, are not malicious. A hacker, by their definition, is simply an intelligent person that finds clever and novel solutions to problems. Along the same lines they use the term "cracker" to define a malicious hacker that uses their skills to break into computer systems.

A couple of my friends in college would constantly argue over this point. On one hand, by the original definition of the word, breaking into a computer system doesn't make you a hacker, it makes you a cracker. On the other hand, the definition of words is dictated by their popular usage; the meaning of words frequently changes as the people that use the word change. Over the past several years society at large has taken the definition of hacking to mean the more negative "someone that breaks into computers", and it's tough to fight it when all the major news networks and a lot of bloggers use it that way on a daily basis.

Back to the Article

But in any case, the motion mentioned in the article is for the defendant not to be referred to as a "hacker" and for his actions not to be referred to as "hacking" (even by witnesses), because of the negative connotation associated with the words. While it might seem a little strange to make this request, it's not unprecedented. "Hacking" isn't actually illegal in the United States, "unauthorized access to a restricted computer" is the crime that (I believe) he's being tried for. In this context it doesn't really make sense to use a word that probably amounts to a slang term in the courtroom.

The important thing is this: if you hold the opinion that there's nothing wrong with being a hacker then, as the title implies, you've got yourself a new ally. And when it comes to arguments dealing with semantics, they're second to none.

Don't Want To Give Up Your Encryption Keys? That'll Be 2-5

At least in the UK it will be.

According to an article over at LinuxWorld discussing the results of a recent case that found individuals may not deny access to an encryption key under the rights of self-incrimination (or the right to silence, as it's referred to in the UK). The UK court determined that:

...an encryption key is no different than a physical key and exists separately from a person's will.

"The key to the computer equipment is no different to the key to a locked drawer," the court found. "The contents of the drawer exist independently of the suspect; so does the key to it. The contents may or may not be incriminating: the key is neutral."

I've written on this blog before about encryption techniques, as well as the legal standing of compelling encryption keys in the US, but I believe this is the first time the issue has been tested in the UK.

Quick History

I wasn't sure what the legal differences were between the US right to avoid self incrimination (5th Amendment rights) and the UK right to silence. I did some quick research (and had a quick conversation with a lawyer) only to discover that your rights are actually very similar under both sets of laws. The right to remain silent under police investigation under both systems came from police forces using beatings and torture methods to force detainees to talk about alleged crimes. Both sets of self incrimination statutes were instituted to prevent police misconduct in suspect interviews.

The primary difference I found is something UK law refers to as "adverse inferences". Under US criminal law the invocation of 5th Amendment rights cannot be used against a defendant as a sign of guilt. Basically, all that means is that refusing to speak doesn't make you seem any more guilty, it just means you're refusing to speak (hypothetically). In the UK there are certain circumstances where this isn't the case, mostly focusing on a defendant changing their story or refusing to account for things that were present at the time of arrest. In those cases the jury can draw inferences from the defendant's silence (they also may choose not to).

Back To Encryption Keys

The analogy seems fairly sound. If I have a safe, or even a locked desk drawer, in my house and the police show up to arrest me with a valid warrant I can't refuse to give them the key to the desk under the 5th Amendment. There may be physical evidence in the desk, the police have followed due process to be allowed to search it, and the key is a physical object which I cannot refuse to produce. If I do refuse to produce it, then the police will just break the lock (or blowtorch the safe) to search for evidence.

Similarly, encrypted storage is like my safe. My encryption key is like the combination to my safe. The UK court has determined that there is no difference between the safe combination and my encryption key, except in ths case there is. If I refuse to give up my encryption key, there is no "blowtorch option" for the police to use. If I've chosen a long enough encryption key, then the police are out of luck figuring out what I've encrypted.

Therein lies the problem.

Forcing 21st Century Ideas Into 20th Century Shoes

There is plenty of precedent to say that a court shouldn't be able to compel an individual to give up their encryption key. For one, US law says that the court cannot compel a performance. For example, if I enter into a contract to paint someone's house, then I break the contract, the court cannot compel me to paint the house. They can have someone else paint the house and then charge me for that work, but they can't force me to do it. Regardless of analogy, an encryption key (unless written down) is not a physical object. In order to compel the key I must type it or, more likely, tell you what it is or write it down.

For another, what if I have a safe with a built-in tamper mechanism (say an acid safe pouch that disperses if the safe is tampered with)? By refusing to give the combination to police, they will force their way into it, and the acid will destroy any documents within. In that case, you're now going to be charged with destruction of evidence, obstruction of justice or something along those lines.

The real issue at hand is that encryption introduces an unsavory element into criminal investigations. Without a way for police to force their way into encrypted documents they're left with a block of impossible to reach potential evidence. There may be important elements of the case (or other cases) inside, or even evidence of other crimes.

The ruling seems unnecessary to me, as the UK already has laws in place that allow juries to draw adverse inferences about information defendants refuse to divulge. This new ruling merely adds a new punishment for refusing to divulge your encryption keys. It might just seem excessive to me, but a 2-year sentence for refusing to give up a key seems a bit much.

Of course, comments are always welcome.

Warning: Web Proxies May Result in Unexpected Consequences

When teaching classes on network forensics to law enforcement officers there are always a few sections that stick out, to me, due to the reactions they generate: Internet Routing (attempting to explain the difference between an internal IP address here and what a server sees on the other end) and, similarly, Proxies.

For some students just learning about the complexities and intricacies of Internet architecture, discussions of proxy servers and chained proxies is just too much. Conceptually proxy servers are simple, they're simply servers that sit between a user and the Internet (or some other network). The proxy server takes requests from the user and sends them to a server, then receives responses from the server and gives it back to the user. A simple handoff. The real problem comes in trying to explain the method for tracking a user through a proxy, or chain of proxies.

Often students become frustrated; tracking users through multiple proxies in multiple countries seems like a very difficult and insurmountable task. And, certainly, it can be. The advice I give to them usually boils down to this: Don't think about how to find a proxied attacker head-on, because it probably won't work and will take up a lot of time. You're investigating the entire situation, not just this one connection, look at all the other pieces of information you have and narrow other things down, just keep the proxy in the back of your mind for when you've pieced together more of the investigation.

It turns out that, many times, someone using a proxy might make other mistakes that completely negate the benefits of the proxy.

Enter Sarah Palin, Republic Vice Presidential Nominee Extraordinaire.

A couple days ago 2 of Palin's private Yahoo! email accounts were hacked by a group called Anonymous. Anonymous has gained Internet notoriety over the past year for it's crusade against Scientology. Anonymous has hacked into numerous Scientology websites releasing internal documents and mail, as well as creating grass roots rallies against Scientology in a number of major cities around the world. And now, they've decided to take a shot at Governor Palin.

After the email accounts were compromised, the login details were posted to a popular underground message board site called 4chan. A user, presumably from 4chan, then logged in to Palin's Yahoo mail account using a web proxy, called CTunnel, and took screenshots of several of the email lists, contact lists, as well as some personal pictures from the emails. This information has been posted in other places around the web, most notably on Wikileaks.

So a simple diagram of this part of the attack looks like this:

CTunnel, the orange computer in the diagram above, is acting as a proxy. Requests from the hacker are sent to CTunnel, which then sends them to Yahoo. When Yahoo responds, it sends the response to CTunnel, which then goes back to the hacker. Pretty simple. This adds a layer of anonymity for the hacker. Yahoo doesn't know who logged in to Palin's account, only that it came from CTunnel. This means investigators need to get 2 sets of subpoenas, and go through 2 sets of logs, if the evidence is still there at all. Good for the hacker, bad for investigators.

The Catch

Well, actually, there are 2 catches. Rule #1 when dealing with Internet systems is that they are only as secure as the trust you can place in them. No matter how many layers of anonymity or types of encryption I use, if I can't trust the computers I'm transmitting to it probably doesn't matter. I'm sending all my data to a site I don't own, hosted in the United States, that offers a free service. How much can I trust that service?

From CTunnel's "About" page:

• Why should I trust Ctunnel?
  By going through any proxy, you trust any data you send or receive to the proxy owner. To earn your trust I will be as open and honest with you as possible. See below for information about who I am and why I run this service. Open proxies may be honeypots to steal your information, or may be left open accidentally and be down tommorow, or be otherwise unreliable. Ctunnel however, operates soley off money derived from advertising shown during the proxy session, and therefore will not be down tommorow. Because our visitors value their privacy, it is not in our interests to spy on you, lest we lose traffic and advertising revenue. Because government subpenoa could require us to hand over our server access logs, access logs are regularly deleted to protect your privacy. In short, we value your browsing experience as well as your anonymity, and would not do anything to break your trust in us.

Server access logs are deleted regularly. That's good, those are the things that are going to be tracing which computers made requests to which other computers. Somewhere in those logs is every website you visited using their service, which means somewhere in those logs is an entry showing someone logging into Sarah Palin's Yahoo mail account. But the logs are deleted regularly (probably on the order of several days, or weekly, depending on how the administrator sets it up) so all you have to do is wait a few days and you're in the clear. By the time the police get to the CTunnel server to look for your information it will have been deleted and you'll be safe.

Oh, but you know that's not the end.

How do we know that the hacker used CTunnel instead of some other anonymizing service, anyway? Because the screenshots he took of Palin's email account are of his entire browser window, not just the email. If you look at the screenshosts from Wikileaks, or just click this one for an example, you'll see the titlebar at the top displaying an address beginning with "http://ctunnel.com" followed by a long string of characters.

Those characters are not random, they link a user to his request. Those characters are exactly what you need to find the records you need in CTunnel's database. It's kind of like robbing a bank wearing a ski mask, but leaving your nametag from work on. Sure, nobody in that bank knows who you are, but it sure won't be too hard to find you now.

The CTunnel Admin Is Your Friend?

Last chance. CTunnel is a site that values privacy, maybe it's run by a left-wing privacy nut that, upon hearing about the story, will destroy all the logs to stick it to the man!

From The Register:

"Usually, this sort of thing would be hard to track down because it's Yahoo email, and a lot of people use my service for that," he told El Reg in a phone interview. "Since they were dumb enough to post a full screenshot that showed most of the [Ctunnel.com] URL, I should be able to find that in my log."

...

To prevent abuse of the service - such as the occasional bomb threat or other illegal act that's been known to happen - Ramuglia logs each user's IP address, along with the time and web destination...

Nope, the Admin tracks all this information in case of abuse...and thinks the hacker is an idiot for posting the screenshots like that. Well, on the plus side, the person who accessed the account doesn't appear to be the one who hacked in, they were just using the credentials they found. Of course, they did then download the address book, personal pictures and correspondence of the Vice Presidential Candidate of the Republican Party. Probably not the smartest move.

Oh, and a special message to Governor Palin (since I'm sure you'll be reading this blog post), rumor has it that your password was "popcorn". Just some friendly IT advice: you might want to try something a little more complex. Throw in some upper and lower case, maybe some symbols or numbers. It might not keep Anonymous out of your email accounts, but it definitely couldn't hurt.

Why the Large Hadron Collider Is Really Going to Destroy the World

The Large Hadron Collider is a 27 kilometer ring beneath the ground of Switzerland and France. Tomorrow the collider will fire it's first beam of energy through the entire 27 kilometer length of the ring beginning the run-up to one of the largest scientific experiments ever conducted, and the search for further verification of the Standard Model of Physics and the Higgs-Boson particle. But there is a darker side to the Large Hadron Collider. Critics claim that the Collider could destroy the earth by forming a super-dense black hole which would rip the Earth apart with it's massive gravitational field. But those people have completely missed the mark. The Large Hadron Collider is going to destroy the Earth, and I know exactly how it's going to do it.

The answer, of course, is zombies. That's right, I said it. Zombies.

You might think that I've lost my mind, that there is simply no way that a scientific experiment like the Large Hadron Collider (LHC) would end in the destruction of the human race via zombie infestation. But I submit that you are wrong. I have gathered a mound of circumstantial evidence and, if Law and Order and CSI have taught me nothing else, it's that if I get enough of those together then they become fact. But first, some background...

Background

The LHC is a scientific experiment to understand the most basic workings of our physical universe. The goal is to accelerate protons to very high speeds, and thereby very high energies, then smash them into one another. The resulting collision will break down the protons into their components pieces, much like when the universe was first formed, and then we can see what happens. Think of it like studying fundamental biology via head-on collision (except that in Physics, it actually makes sense). The LHC will also accelerate lead particles and smash them together. There are intersections within the LHC where the particles will collide, and at these intersections are high-tech monitoring devices to watch the action. ALICE will watch the lead ion collisions, CMS and ATLAS are used to watch for new particles (specifically the Higgs-Boson, the particle theorized to give matter mass).

How do I know all these facts about the LHC? Did I do my duty as a scientist and blogger and research, vet and corroborate this information? No, I got this information the same place I get all my information, from a rap song:

ALICE

And now we get into the real facts. ALICE seems like an odd name for a particle detecting instrument. The LHC and its creator, CERN, would have you believe that ALICE is an acronym for "A Large Ion Collider Experiment". A likely story, but I wasn't fooled.

And then I remembered where I had heard about "Alice" before. Maybe CERN called it "Project Alice" first...So you see, the LHC has their Project Alice on the job, on the lookout for potentially unknown results that might come from their experiments. And what kind of experiments go awry when Alice is around? Yep, Zombies.

That's Strike One, LHC. But let's see what else we can come up with.

Red Queen

In the first Resident Evil Movie the computer systems were controlled by the Red Queen, a hologram that represented an AI supercomputer. Since the calculations required to run the experiment and process the results must be massive, and since Alice is already there, I think it's safe to assume that the LHC has a Red Queen. This really isn't so bad, you need a semi-cogniscent AI to manage your scientific experiments, that goes without saying, but not all AI are created equal. So that got me thinking, where else have I seen AI representations with strange voices that, seemingly, want to help?

That's right, take the British accent away from the Red Queen and what are we left with? GlaDOS, the homicidal AI from Portal. And what do we know about GlaDOS? She's interested in scientific experiments and is willing to promise her testers wonderful and fanciful things. She lied about cake! Is the Higgs-Boson metaphorically linked to cake? I can't say for sure, but I bet at this point the Higgs-Boson seems a lot like cake to those researchers.

Strike Two, LHC.

The CERN Conspiracy

Not that we need to continue, but I think the final strike here is the overseeing organization itself, CERN. CERN is a multi-national science laboratory responsible for the testing of cutting edge research. The Umbrella Corporation, which created Project Alice, has a paramilitary wing. The member nations of CERN have militaries. Aperture Science Laboratories, which created GlaDOS, do cutting edge research, just like CERN.

Therefore, I can conclude that, ipso facto:  Umbrella Corporation + Aperture Science Labs = CERN

So, there you have it. Zombies will soon be among us. Mark my words, maybe not tomorrow, but soon the legions of the undead will be released. To aid you in this post-LHC world I can only offer you two pieces of advice:

1. If you are fighting back the zombies: use this
2. If you must succumb to the zombie threat: use this

Security by The Force - The Death Star Doesn't Need An Incident Response Team

Everyone knows the scene from Star Wars where Obi-Wan Kenobi uses the Force to get past a pair of guards. With a wave of his hand he tells the guards that they don't need to see his identification, that "these aren't the droids you're looking for". Everyone knows it because it's been spoofed or used as a line by every long-running TV show (for example, here's Family Guy's take on it from their Star Wars episode), and probably several of your friends as well. In fact, friends of mine in high school attempted to use The Force to get by bouncers at both bars and "adult book stores" (FYI: The Force doesn't work on bouncers, they do need to see your identification, apparently).

But, unbeknownst to me, you can also use the Force to handle computer security incidents. When a story about one of your laptops going missing, a laptop containing sensitive personal information about 33,000 of your customers, makes national news, with a wave of your hand you can simply respond "What laptop? The laptop was never gone. There was no security breach. Move along."

Or, at least, that's the track that Verified Identity Pass, a New York based company, decided to take when it was reported that a laptop was stolen from a locked office at the San Francisco International Airport. Verified Identity Pass (VIP, oh I get it) runs a service called Clear at about 16 international airports in the US. You apply to Clear and go through a number of identity verification processes, put your biometric data on file with them, and then get a card that allows you to skip the lines at airport security. This service costs you $128 per year.

So, a laptop got stolen from a locked office in San Francisco. It's reported missing to the police on July 26th, then to the TSA on July 28th. This shouldn't be an issue, though. This is a company dealing with airport security measures and people's private information (names, addresses, birthdates, driver's license, passport and green card information was all stored on the laptop) so certainly all of this information was encrypted in case of theft.

But if it were, it wouldn't have made nearly as much news. No, the laptop data wasn't encrypted. Against company policy, the laptop wasn't encrypted. But luckily the laptop was found! On Tuesday, August 5th. That would be the Tuesday over a week after it was initially reported lost. And the laptop was found...in the same office that it was originally lost from... Therefore (ipso facto, and with a wave of my hand) the laptop was never actually gone! Tada! The explanations boggle the mind.

The San Francisco Chronicle spoke with Allison Beer, senior vice president for corporate development of Clear, and has her responses in their article about the incident. Attempting to interpret all the responses given is kind of like walking to a local store, except your street is now a Mobius Strip. From the article:

The laptop was found Tuesday in the same airport office, but not in the same location from which it had been discovered missing, according to the sheriff's office, which is helping with the investigation.

Beer said the airport office is always locked, so if the laptop was removed, someone would have needed a key to return it.

What? Of course the laptop wasn't found in the same place it was reported missing. If the laptop had been in the same place, it wouldn't have been missing. I've seen some big offices, definitely offices that you could lose a laptop in, no problems. But I've never seen an office so large that when people start to talk about people getting fired for losing 30,000 customer records, it can't be turned inside out and searched pretty quick. And hey, once the national news picked up the story, the laptop did get found pretty quick, so maybe they just weren't looking.

And there is, of course, the other part of the logic from that quote. The office is always locked, the laptop was in the office, therefore a thief would have needed a key, therefore the laptop was not stolen. I'm no master at logic, but I'm pretty sure that sentence breaks down to "The only person that could have put the laptop back, is someone that could have stolen it in the first place." Well, after all that I'm pretty reassured about my data's security in your hands. Why don't we let Ms. Beer give us a couple more reassuring quotes:

"Yes, it was sensitive privacy information, but not the stuff that was most sensitive," she said.

"We take this very seriously," she said.

Gee, thanks.

IDS as Prophylactic: Users Experience a 2% Per-Year Pregnancy Rate

The Boston Globe ran an article over the weekend about magic tricks and human cognition. The article (which is short, informative and very interesting) discusses how magicians use flaws in human perception to make magic tricks possible. It turns out that neuroscientists are now finding that they're running into the same questions as magicians, and have now realized that magicians have been studying the same phenomena for much longer.

The article also references a new paper co-authored by a number of magicians, published in the Nature Reviews Neuroscience magazine, titled Attention and awareness in stage magic: turning tricks into research. The paper actually discusses a number of sleight-of-hand and magic tricks and outlines how they're done and what neurological tricks make them possible. The paper also has 94 (!) footnotes, so you know it must be good.

But why am I writing about magic tricks and human cognition on this a, primarily, security related blog? It turns out that there are a number of parallels that you can draw from the neurological research presented in both the paper and the article relevant to computer security. There are clear parallels between cognition and social engineering (look at this FedEx uniform, clearly I must be an employee). And there are also clear parallels between misdirection and hacking (causing security personnel to watch or spend their time on one system while another is the actual target), but I've decided to go a different way.

My first real experience with gaps in perception was with finding the eye's blind spot. The blind spot is a place in our vision that our eyes just can't see, we are presented with an, apparent, uninterrupted field of vision thanks to the work of our brain. Our brain uses guesswork to determine what is probably at that spot, and it's pretty good at it. But it's certainly not perfect, and the brain bases its guess on a lot of assumptions about our environment.

...a new model has arisen over the past decade, in which visual cognition is understood not as a camera but something more like a flashlight beam sweeping a twilit landscape. At any particular instant, we can only see detail and color in the small patch we are concentrating on. The rest we fill in through a combination of memory, prediction and a crude peripheral sight. We don't take in our surroundings so much as actively and constantly construct them.

"Our picture of the world is kind of a virtual reality," says Ronald A. Rensink, a professor of computer science and psychology at the University of British Columbia and coauthor of a paper on magic and psychology that will be published online this week in Trends in Cognitive Sciences. "It's a form of intelligent hallucination."

For some reason I really like that turn of phrase, our reality is an "intelligent hallucination". We take pieces of input from all over the place: sounds, sights and smells, add in a number of assumptions based on previous experiences and expected future outcomes and we get what we perceive as our reality.

Richard Bejtlich has long been a proponent of Network Security Monitoring (NSM). In his books The Tao of Network Security Monitoring and Extrusion Detection: Security Monitoring for Internal Intrusions, Bejtlich argues that true network security can only be realized if you are fully aware of the things happening on your network at any given time. Using statistics and various monitoring tools you make yourself more secure by constantly increasing your awareness of your surroundings.

But this research tells us something interesting. While increased awareness of our surroundings is important to protecting ourselves (whether it's in a dark alley or on our network), humans senses can be deceived into thinking they have all the information available, when much of that information is based on assumptions we've made based on past experiences and incomplete information. Where can I get a Jump to Conclusions mat?

Security experts frequently argue that various network and computer security products offer a false sense of security. Antivirus and anti-spyware software is frequently ineffective against new threats, but simply having it installed leads people to believe that they are protected. Misconfigured firewalls can allow attackers in to a network while the network admins think they're being protected. Almost as a form of self-misdirection we put products in place that are meant to protect us, and then tell ourselves we no longer need to look in that direction because it's already protected.

We are flooded with information every day and are expected to make intelligent decisions based on that information. But whether it's a magician using sleight-of-hand or an IDS alert console that says "all clear", our minds can easily be tricked into thinking that things are one way, while a pickpocket walks away with our wallet or a hacker walks away with some data. But not to worry, this is a self correcting problem. As soon as we develop a better way to perceive reality, magic tricks, pickpockets and security intrusions should become a thing of the past.

Back From Vacation

Warm weather and long days means summer, and summer means summer vacations. Last week I was on vacation so there were no new postings, as I was far too busy chilling on the beach and ignoring anything that involved work.

But now I'm back, and on top of catching up with all the events and emails from last week, and preparing for our next exercise in 2 weeks, I've got some new posts planned for this week. Not all the material is brand new, but I still thought it worth a mention.

Stay tuned, new posts coming shortly...

Amateur Lockpickers - Society's Greatest Danger

An excellent article was posted in The Globe and Mail today, about amateur lockpicking and its meteoric rise in popularity thanks, in large part, to the Internet.

Anyone working anywhere near the computer security industry knows that hackers and computer security types love lockpicking. Maybe not all of them, but certainly a large percentage. Several of the major security conferences have a "lockpicking village" or equivalent (Defcon and Shmoocon both come to mind) where people can go to learn about lockpicking, talk to locksmiths and practice picking locks on some simple demo locks.

The site mentions a number of forums that have popped up to service the lockpicking hobbyist (Lockpicking101 is mentioned by name in the article), and there are also organizations that cater to the hobbyist (The Open Organisation of Lockpickers ran a table about the legalities of lockpicking the last time I was at Defcon). It's certainly no secret that you can find information about picking locks in various places, YouTube has a huge number of lock picking videos and lock picking talks are also available from several security conferences (like this one from Notacon this year).

But everybody knows that stuff, what really makes this article great is the reaction of the locksmiths. They're pissed, and they hate these so-called hobbyists. The hobbyist interviewed for the article was actually thrown out of a locksmith's shop for asking about Medeco locks (he was thrown out after telling the locksmith that he wasn't going to install one, he was just a hobbyist). And why do these locksmiths hate the hobbyists so much? I'll let them explain:

"This is a skill that can do a lot of harm," says Paul Bentley, president of the Association of Ontario Locksmiths. "That's why we kind of protect it."

Just three decades ago, the finer points of lock-picking remained shrouded in mystery. Family locksmith businesses had hoarded their secrets since the 1400s, when guilds fiercely defended the purity of the trade.

"When I started 35 years ago, the business was still very much closed to outsiders," Mr. Bentley said. "You had to be a member of the family."

You see, locksmiths are concerned with the public's safety, and dirty hobbyists are vagrants "training thieves" with their decadent "free flow of information". Let me see if I can break this down. A profession kept primarily secret, and often as a family business, that hasn't changed much for the past 500 years is suddenly challenged by the exchange of information on the Internet. So your business is threatened by people talking about it, so what is the natural reaction? Appeal to the public's fear of faceless criminals. Beware citizens, your neighbors may have learned to pick locks online, and once they start picking small locks they'll only want to pick larger locks, and pretty soon they'll be out cracking safes and picking GIANT locks.

But then I got to thinking, couldn't I make those statements apply to pretty much anyone's profession? I mean, if your job has been affected at all by the Internet. Hold on, let me try it out...

"Politics is a skill that can do a lot of harm," says Bentley, Senator from Massachusetts. "That's why we kind of protect it."

Just a few decades ago, the finer points of politics remained shrouded in mystery. Family politicians had hoarded their secrets since the 1700s, when political parties fiercely defended the purity of the trade.

"When I started 35 years ago, the business was still very closed to outsiders," Bentley said. "You had to be a member of the family."

Hundreds year old occupation? Check. Close-knit group of practitioners, hoarding secrets about how the entire process works? Check. A profession that can be dangerous in the wrong hands? Check. Status quo shaken up by the Internet and an influx of amateurs into the profession, like Internet-savvy local representatives getting tens of thousands of dollars in compaign contributions from strangers on the Internet? Check.

But we can do better. Let's try again...

"Chemistry is a skill that can do a lot of harm," says Bentley, president of the American Chemical Society. "That's why we kind of protect it."

Just a few decades ago, the finer points of chemistry remained shrouded in mystery and deep academia. Academics had hoarded their secrets since the 1500s, when scientists fiercely defended the purity of the art.

"When I started 35 years ago, the science was still very closed to outsiders," Bentley said. "You had to be a member of a major university."

They teach basic Chemistry in high school. You can find advanced chemistry lessons from universities online, but I don't see any chemists complaining about the pollution of their art. Alright, Chemistry's a little different. I'm pretty sure downloading lessons on Chemistry gets you added to an FBI watch list, but still if you think lockpicking is a greater danger than chemistry, please raise your hand. If you have your hand up, put it back down and think about what you've done.

Even better than quotes from the article (as always), are the user submitted comments to the article. The following comments I have loving cherry-picked for their inanity:

      David Gibson from Hamilton, Canada writes: We would be better of without c. 20% of the people in society, and these pickers are all in the category. Training criminals to rip people off, how cute.

      Bob M from Canada writes: What seems like a 'hobby' is actually semi-criminal in a world with the Internet and Google, for 'sharing' such information aids and abets crime. I am not impressed.

      Cynthia Boston-Brown from Canada writes: great ...... and in their spare time they watch Star Trek and dress up like Druids .......ah... just teasing folks!

Alright, the last one was just funny. The first commentor there wants to execute a full 20% of society (although he doesn't specify whether that refers to "civilized socety" or the "Society of People that Make Idiotic Suggestions"), even the Romans only killed 10% of groups to make a point. And the second commentor sees the Internet and Google as evil co-conspirators in this plot to enable "hobbyists" to destroy humanity by "sharing" this so-called "information". I'm not impressed, either.

Lockpicking is semi-criminal in the same sense that learning to fly a plane, shoot a gun, modify electronic devices, drive a car or build a bridge is semi-criminal. Having the knowledge to do these things could allow you to do great harm. Therefore, of course, we should all employ chaueffeurs(or "carsmiths") to take us to and from anywhere we go, lest we think too hardly about running our cars into things. A number of commenters point out that knowledge isn't the problem, it all depends on how you choose to use it, and outlawing knowledge is not a valid defense against criminal behavior.

There's a show in the US, on the Discovery Channel, called It Takes a Thief. It's a reality show (I know, this puts its credibility somewhat in question) in which homeowners allow a former burglar to try and break in to their home. Cameras are installed and the homeowners are only told that he will try and break in at some point during a 1-week window, so they don't know exactly when to expect it. The former burglar, John Douglas Rainey, never picks a lock on the show. Never even attempts to pick a lock on the show. He breaks windows, kicks in doors, uses ladders left outside to climb to the second story where there is an unlocked window and all in broad daylight. What does this prove? Nothing. But it does show that you don't need to know how to pick a lock to break into a house, car or other building, and picking a lock certainly isn't the fastest way to steal things.

Criminal Roundup

There have been several articles over the past week or so that I wanted to mention here, but they didn't quite warrant an entire post dedicated to them. Luckily they just kept piling up, so now I get to make a roundup post about all the criminal activity.

GPS Knows Where You Are (and it might tell others...)

First up is a story from across the pond where detectives at Scotland Yard have been using GPS devices to implicate criminals. But that's not the interesting part, the detectives have been forensically analyzing commercial GPS devices to find out previous locations of criminals, especially in cases of kidnapping and murder, to determine if an alleged criminal was near the scene of a crime.

Here's a quick checklist, for any would-be criminals, you can follow that can help ensure you don't fall victim to the same mistakes:

1. Are you carrying an electronic device capable of identifying your location to within 100 feet (depending on satellite coverage)? This list should include, but not be limited to, GPS navigation systems, cell phones with GPS enabled, OnStar, LoJack and the tracking device the FBI stuck on your car while you were busy checking all your devices (but you don't know about that one yet).
   1. If yes, proceed to 2.
2. Is your portable electronic tracking device really just a small embedded computer, with readable and writable memory? You can tell by your ability to save locations or other information and run other applications on it, the small slot in the side that accepts additional memory sticks is usually a dead giveaway.
   1. If yes, proceed to 3.
3. Do not carry this electronic device with you while committing crimes.

It's pretty clear from the article that they're catching people who commit crimes, but unwittingly leave their GPS devices activated. I prefer to imagine the scenario more as someone using their GPS to track their way to their intended target, sort of like a slightly upgraded version of the bookie thieves in Snatch.

Convictions May Be Detrimental To Your Career

The next story comes to us from across a much larger pond, the Pacific Ocean. An 18-year old hacker from New Zealand, alleged mastermind behind a botnet group responsible for a global adware campaign and an attack against a University of Pennsylvania server was sentenced today. But first...

How do we know he was the mastermind? Well, an international investigation involving New Zealand police, the FBI, the US Secret Service and Dutch authorities gathered evidence against him. He also took about $40,000 from the profits of the botnet for his work. And he also confessed.

Oh right, we know he did it because he confessed and said he did it. Well, I"m sure that was part of some plea agreement, the judge will probably take it easy on the sentencing because of his cooperation with law enforcement efforts. So what sort of punishment did he receive? Well, he's free, no criminal conviction on his record.

But why would a confessed botnet controlling computer hacker walk free? The judge in the case felt that our hacker wasn't motivated by "criminal intent", but rather "to show that he could". Since coming up on charges he has had offers to work with the police, as well as several job offers, and the judge felt that a criminal conviction would jeopardize his future prospects.

While I'm not a legal or criminology expert, I think the argument could be made that convicting any criminal of a crime that they actually committed could be detrimental to their future employment prospects, regardless of their age.

Problem: People don't want to hire convicted felons. Solution: Stop convicting people of felonies.

There were some punishments dished out for the kiwi hacker, though. He had to pay fines of $9,526 in damages to UPenn and $5,000 in costs. Let me check my math quick. Money from botnet - fines for conviction = net profit of $25,474. Felony conviction jeopardizing future prospects? Not at these rates. Been convicted for hacking lately and had to do jail time? Maybe you were just hacking from the wrong country.

The Curse of Twitter

The final story for this post comes to us from a place which is no stranger to scandals and breaking laws, Capitol Hill itself. John Culberson, a representative from Texas has been using the Twitter service to keep his constituents updated with his current actions. But this apparently is in violation of certain House rules regarding where representatives are allowed to post official data (such as the actions or statements of representatives). The fact that someone was so bothered by a Texas representative using Twitter that they actually took this so far is amazing in and of itself, but there are more amazing facets of this story.

For one thing, there's a representative who knows how to, and actually does, use Twitter! I mean, come on, in an era where Senators describe the communications backbone of the current global economy as a "series of tubes", arguments about Net Neutrality seem to be made in a vacuum where no Internet exists, and a contender for President doesn't know how to use email there's a representative that uses Twitter and is pissed that people want him to stop! This is quite possibly the craziest episode of the Twilight Zone that has ever taken over my life.

So anyway, the controversy. The government has rules which state that official House content must reside on the house.gov domain. By using Twitter, or any other blogging service for that matter, to track your current House movements you are storing official data on other servers, namely Twitter's. While the content that he's posting isn't controversial (he tells his constituents what he's voting on, or when there's a video about a vote coming up) it certainly seems as though this guy has pissed off someone, because this seems to be a controversy about nothing created from thin air.

Culberson's argument is, basically, that data is becoming ubiquitous, and is frequently so prevalent and scattered across so many services that it's ridiculous to constrain representatives to only posting data on this one domain. Makes sense. If Culberson updates Twitter about a vote, and I then take that data and put it on my blog to let other people in my area know about it, that's fine. I'm a citizen with a right to that data, so posting it on my blog is okay. If Culberson does the same thing, he's in violation, because representatives can't post official content outside the house.gov domain.

There are a couple other interesting points in the article. The discussion about distinguishing between the data of different services (Twitter vs. email, live video broadcast vs. the same video on another site) is technically flawed but functionally relevant. People have become used to transmitting data between others, it's how we share information and restricting elected officials simply by domain name doesn't seem a logical way to control the flow of information.

To bring us back to reality a bit, there's a quote from the article regarding the regulation of the Internet:

"Mike, you're going to have about as much luck regulating the Internet as King Knut did when he ordered his men to put this throne on the beach, and he tried to order the tide to stop"...

Ah, now there's the political speak we know and love. Not tech-savvy representatives tweeting from their Blackberries and updating their relationship status on Facebook, but obscure references to Viking kings. Watch out regulators, history repeats itself and the Norman Conquest might be due for it's next Internet-based revolution.