Entries Tagged "hacking"

Page 56 of 79

More on Chinese Cyberattacks

Wow, is this a crazy media frenzy. We should know better. These attacks happen all the time, and just because the media is reporting about them with greater frequency doesn’t mean that they’re happening with greater frequency.

Hype aside, the Mandiant report on the hackers is very good, especially the part where the Chinese hackers outted themselves through poor opsec: they logged into Facebook from their work computers.

But this is not cyberwar. This is not war of any kind. This is espionage, and the difference is important. Calling it war just feeds our fears and fuels the cyberwar arms race.

In a private e-mail, Gary McGraw made an important point about attribution that matters a lot in this debate.

Because espionage unfolds over months or years in realtime, we can triangulate the origin of an exfiltration attack with some certainty. During the fog of a real cyber war attack, which is more likely to happen in milliseconds, the kind of forensic work that Mandiant did would not be possible. (In fact, we might just well be “Gandalfed” and pin the attack on the wrong enemy.)

Sadly, policymakers seem to think we have completely solved the attribution problem. We have not. This article published in Computerworld does an adequate job of stating my position.

Those of us who work on security engineering and software security can help educate policymakers and others so that we don’t end up pursuing the folly of active defense.

I agree.

This media frenzy is going to be used by the U.S. military to grab more power in cyberspace. They’re already ramping up the U.S. Cyber Command. President Obama is issuing vague executive orders that will result in we-don’t-know what. I don’t see any good coming of this.

EDITED TO ADD (3/13): Critical commentary on the Mandiant report.

Posted on February 21, 2013 at 12:54 PM • View Comments

Over $3M in Prizes to Hack Google Chrome

Google’s contest at the CanSecWest conference:

Today we’re announcing our third Pwnium competition­Pwnium 3. Google Chrome is already featured in the Pwn2Own competition this year, so Pwnium 3 will have a new focus: Chrome OS.

We’ll issue Pwnium 3 rewards for Chrome OS at the following levels, up to a total of $3.14159 million USD:

  • $110,000: browser or system level compromise in guest mode or as a logged-in user, delivered via a web page.
  • $150,000: compromise with device persistence—guest to guest with interim reboot, delivered via a web page.

We believe these larger rewards reflect the additional challenge involved with tackling the security defenses of Chrome OS, compared to traditional operating systems.

News article.

Posted on February 7, 2013 at 6:35 AM • View Comments

New York Times Hacked by China

The New York Times hack was big news last week, and I spent a lot of time doing press interviews about it. But while it is an important story—hacking a newspaper for confidential sources is fundamentally different from hacking a random network for financial gain—it’s not much different than GhostNet in 2009, Google’s Chinese hacking stories from 2010 and 2011, or others.

Why all the press, then? Turns out that if you hack a major newspaper, one of the side effects is a 2,400-word newspaper story about the event.

It’s a good story, and I recommend that people read it. The newspaper learned of the attack early on, and had a reporter embedded in the team as they spent months watching the hackers and clearing them out. So there’s a lot more detail than you usually get. But otherwise, this seems like just another of the many cyberattacks from China. (It seems that the Wall Street Journal was also hacked, but they didn’t write about it. This tells me that, with high probability, other high-profile news organizations around the world were hacked as well.)

My favorite bit of the New York Times story is when they ding Symantec for not catching the attacks:

Over the course of three months, attackers installed 45 pieces of custom malware. The Times ­—which uses antivirus products made by Symantec ­—found only one instance in which Symantec identified an attacker’s software as malicious and quarantined it, according to Mandiant.

Symantec, of course, had to respond:

Turning on only the signature-based anti-virus components of endpoint solutions alone are not enough in a world that is changing daily from attacks and threats. We encourage customers to be very aggressive in deploying solutions that offer a combined approach to security. Anti-virus software alone is not enough.

It’s nice to have them on record as saying that.

EDITED TO ADD (2/6): This blog post on Symantec’s response is really good.

Posted on February 6, 2013 at 6:36 AM • View Comments

Commenting on Aaron Swartz's Death

There has been an enormous amount written about the suicide of Aaron Swartz. This is primarily a collection of links, starting with those that use his death to talk about the broader issues at play: Orin Kerr, Larry Lessig, Jennifer Granick, Glenn Greenwald, Henry Farrell, danah boyd, Cory Doctorow, James Fallows, Brewster Kahle, Carl Malamud, and Mark Bernstein. Here are obituaries from the New York Times and Economist. Here are articles and essays from CNN.com, The Huffington Post, Larry Lessig, TechDirt, CNet, and Forbes, mostly about the prosecutor’s statement after the death and the problems with plea bargaining in general. Representative Zoe Lofgren is introducing a bill to prevent this from happening again.

I don’t have anything to add, but enough people have sent me their thoughts via e-mail that I thought it would be good to have a thread on this blog for conversation.

EDITED TO ADD (1/23): Groklaw’s legal analysis. Secret Service involvement.

EDITED TO ADD (1/29): Another.

EDITED TO ADD (2/28): The DoJ has admitted that Aaron Swartz’s prosecution was political.

EDITED TO ADD (3/4): This profile of Aaron Swartz is very good.

Posted on January 23, 2013 at 6:14 AM • View Comments

Lexical Warfare

This essay, which uses the suicide of Aaron Swartz as a jumping off point for how the term “hactivist” has been manipulated by various powers, has this to say about “lexical warfare”:

I believe the debate itself is far broader than the specifics of this unhappy case, for if there was prosecutorial overreach it raises the question of whether we as a society created the enabling condition for this sort of overreach by letting the demonization of hacktivists go unanswered. Prosecutors do not work in a vacuum, after all; they are more apt to pursue cases where public discourse supports their actions. The debate thus raises an issue that, as philosopher of language, I have spent time considering: the impact of how words and terms are defined in the public sphere.

“Lexical Warfare” is a phrase that I like to use for battles over how a term is to be understood. Our political discourse is full of such battles; it is pretty routine to find discussions of who gets to be called “Republican” (as opposed to RINO – Republican in Name Only), what “freedom” should mean, what legitimately gets to be called “rape”—and the list goes on.

Lexical warfare is important because it can be a device to marginalize individuals within their self-identified political affiliation (for example, branding RINO’s defines them as something other than true Republicans), or it can beguile us into ignoring true threats to freedom (focusing on threats from government while being blind to threats from corporations, religion and custom), and in cases in which the word in question is “rape,” the definition can have far reaching consequences for the rights of women and social policy.

Lexical warfare is not exclusively concerned with changing the definitions of words and terms—it can also work to attach either a negative or positive affect to a term. Ronald Reagan and other conservatives successfully loaded the word “liberal” with negative connotations, while enhancing the positive aura of terms like “patriot” (few today would reject the label “patriotic,” but rather argue for why they are entitled to it).

Posted on January 15, 2013 at 6:10 AM • View Comments

Hackers Use Backdoor to Break System

Industrial control system comes with a backdoor:

Although the system was password protected in general, the backdoor through the IP address apparently required no password and allowed direct access to the control system. “[Th]e published backdoor URL provided the same level of access to the company’s control system as the password-protected administrator login,” said the memo.

The security of this backdoor is secrecy. Of course, that never lasts:

Hackers broke into the industrial control system of a New Jersey air conditioning company earlier this year, using a backdoor vulnerability in the system, according to an FBI memo made public this week.

Posted on December 26, 2012 at 6:05 AM • View Comments

Database of 12 Million Apple UDIDs Leaked

In this story, we learn that hackers got their hands on a database of 12 million Apple Unique Device Identifiers (UDIDs) by hacking an FBI laptop.

My question isn’t about the hack, but about the data. Why does an FBI agent have user identification information about 12 million iPhone users on his laptop? And how did the FBI get their hands on this data in the first place?

For its part, the FBI denies everything:

In a statement released Tuesday afternoon, the FBI said, “The FBI is aware of published reports alleging that an FBI laptop was compromised and private data regarding Apple UDIDs was exposed. At this time there is no evidence indicating that an FBI laptop was compromised or that the FBI either sought or obtained this data.”

Apple also denies giving the database to the FBI.

Okay, so where did the database come from? And are there really 12 million, or only one million?

EDITED TO ADD (9/12): A company called BlueToad is the source of the leak.

If you’ve been hacked, you’re not going to be informed:

DeHart said his firm would not be contacting individual consumers to notify them that their information had been compromised, instead leaving it up to individual publishers to contact readers as they see fit.

Posted on September 6, 2012 at 6:48 AM • View Comments

1 … 54 55 56 57 58 … 79

Sidebar photo of Bruce Schneier by Joe MacInnis.