Progress toward an identity ecosystem

Progress toward an identity ecosystem

First, a bit of good news.

The National Institute of Standards and Technology met its March 16 deadline to produce baseline requirements for its Identity Ecosystem Framework (IDEF), the bedrock document aimed at revving up a move to more secure credentials that are interoperable across the Internet and a big advance toward the holy grail of a single, Internetwide sign-on for individuals.

The first version of the IDEF will be launched sometime this summer. By defining the overall set of interoperability standards, risk models, privacy and liability policies needed to fully describe an identity-based ecosystem, both government and private organizations will be able to see how their identity efforts match up to the IDEF requirements.

The IDEF springs from the Obama administration's National Strategy for Trusted Identities in Cyberspace (NSTIC) initiative, which was launched in 2011. The intent was for the government, through NIST, to bring together the private sector, advocacy groups and government agencies to create an environment that replaces the current one, which uses many different kinds of authentication to access online services,

NIST has a rundown of the kinds of things such an identity ecosystem can be used for, and it does seem enticing when compared to today’s authentication systems. The IDEF by itself won't be enough, of course, because such an ecosystem depends on a broad level of trust among parties, and that will be a huge nut to crack.

But identity is increasingly the focus for future security platforms because, as has become obvious over the past couple of years, traditional network, data and systems protection techniques are of limited use against the focused efforts of today's more sophisticated cyber criminals. Beyond security, a strong identity solution will also act as an enabler, according to Jeremy Grant, the head of the NSTIC initiative.

“If we have easy-to-use identity solutions that enable secure and privacy-enhancing transactions, we can enable citizens to engage with government in more meaningful ways,” he wrote. “With a vibrant identity ecosystem – where citizens can use the same credential to access services at multiple sites – we can enable a wide array of new citizen-facing digital services while reducing costs and hassles for individuals and government agencies alike.”

That the trust needed to build that ecosystem should be at the top of the list of requirements is made clearer by a report from the Ponemon Institute, which looked at the use of security certificates and cryptographic keys around the world and found rampant abuse.

The survey, with over 2,300 security professionals responding, found that 58 percent of them believed their organizations needed to do better in securing certificates and keys in order to stop man-in-the-middle attacks. Over half of them didn't even know where all of their certificates and keys were located.

Over the last two years, the number of keys and certificates deployed on web servers, network appliances and cloud services grew to almost 24,000 per enterprise, the survey found. The major fears respondents listed were of a “cryptopocalypse” and misuse of mobile certificates. All of this could cost organizations at least $53 million over the next couple of years, Ponemon concluded, up 51 percent from 2013.

NIST has already funded four rounds of pilot programs aimed at developing the technologies needed for the identity ecosystem, for a total so far of around $30 million. The intent, according to Grant, is that by 2019 consumers “will think it's quaint” when online service providers ask them to create a new account, and that the NSTIC program office will have become “a blessed memory.”

Posted by Brian Robinson on Mar 27, 2015 at 1:32 PM0 comments


Massive OpenSSL audit hopes to squash Heartbleed-like bugs

Massive OpenSSL audit hopes to squash Heartbleed-like bugs

OpenSSL is back in the news again, almost a year after it first made a splash with the now infamous Heartbleed bug revelation. This time around, however, it looks like it could be a good thing.

Cryptography Services, a part of the Linux Foundation's Core Infrastructure Initiative (CII), is going to audit OpenSSL security. It's billed as an independent audit, even though the CII has been instrumental over the past year in trying to right the OpenSSL ship by providing some of the money to get the beleaguered open source software full time development help.

Heartbleed was a major shock to the cybersecurity ecosystem for several reasons: Not only is OpenSSL widely used in both public and private organizations' network and system security, the coding mistake that created it apparently went undetected for several years before it could be patched, and no one could say for certain how many systems had been affected or what data might have been compromised.

The crisis created by that bug fed into a concern about open source software overall, with other threats such as the Shellshock vulnerability in the Linux and Unix operating systems and a possible SQL injection attack on the popular Drupal content management system adding to the worries.

It’s not as if any of these major open source resources can easily be replaced. OpenSSL is reckoned to be used on up to two-thirds of existing web servers; Linux and Unix also drives many servers, and Drupal has become a reliable and flexible option for website operations, including those at the White House and other government agencies.

Open source software isn’t alone in having security holes, of course, as many users of Microsoft, Apple, Adobe, Java and other proprietary software know. But open source security is seen as suffering from the same resource that’s considered its strength, namely an army of volunteer developers. On the one hand that leads to innovation and fast turnaround of new features that users of open source crave but also to more opportunities for tampering and coding mistakes.

Admittedly, others think all those volunteer developers can also be a security strength, since it puts that many more eyeballs into reviewing code. However, the events of 2014 threw enough doubt onto the security of open source software that both industry and government have been moved to do something to improve it, from bills aimed at ensuring the software supply chain to proposals for controls on the use of third-party software components.

At first glance, the Cryptography Services  audit could be the most comprehensive and important of these efforts. According to the consultants that will be running it, the audit will cover a range of security concerns but will focus primarily on Transport Layer Security stacks and on protocol flow, state transitions and memory management. The audit may be the largest effort to date to review OpenSSL, the group said, and it’s “definitely the most public.” It will help to spot and fix bugs such as Heartbleed before they become the kind of problem they did last year.

Preliminary results of the audit could be out by the beginning of the summer, Cryptography Services  said.

It should be eagerly anticipated, as the revelation of Heartbleed, Shellshock and other bugs hasn’t necessarily brought better security. Months after the initial announcement of Heartbleed, around half of the 500,000 servers thought to be vulnerable from the bug had not been fixed. And the vulnerabilities keep on giving, with Cisco just one of the latest to say that its products had been affected.

Posted by Brian Robinson on Mar 13, 2015 at 11:43 AM0 comments


Equation’s firmware threat

Now that’s persistent: Equation’s firmware threat

The recent revelation that the Equation Group uses disk drive firmware to plant malware in systems points to the kind of sophisticated and hard-to-tackle threat that will increasingly be a part of black hat attacks.

Kaspersky Lab, which came out with the initial report on Equation, said the group attacked the firmware of major drive makers such as Samsung, Seagate, Western Digital, Hitachi and Maxtor. Unlike other attacks, apparently no kind of clean-up efforts can scrub the firmware. That gives a whole new context to the phrase “persistent.”

Technically, the attack uses the nls_933w.dll module to both reprogram the disk drive firmware with a custom payload, as well as provide an application programming interface for attackers to access hidden storage sectors on the drive. Kaspersky also published a much more detailed version of its investigation (in which it breathlessly labeled Equation “The Death Star” of the malware galaxy) and listed organizations it believed the group had infiltrated, many of them government related.

A number of sources have suggested Equation might be a very limited threat, given the effort needed to master the level of programming required to rewrite the firmware. However, that could be an optimistic assessment given the level of sophistication that other state-sponsored groups and organized crime have shown recently.

Using hard drive firmware as an avenue of attack is also not that new of an idea. Researchers at public universities were detailing five years ago how disk drive firmware could be used to embed malicious software.

Rewriting software that controls hardware is also at the heart of what’s been described as one of the hottest hacks of 2014. BadUSB is an attack that reprograms the controller chips on USB peripherals, including thumb drives, to emulate a keyboard and allow an attacker to issue commands to download files or install malware. It can also be used to redirect network traffic or install  a virus to infect an operating system before it boots.

As with the disk drive firmware attack, it’s apparently hard to clean up a BadUSB infection. Reinstalling an operating system won’t necessarily work since the drive used for that may itself be compromised, and a BadUSB device may already have replaced a system’s BIOS.

Researchers have been busy detailing how BadUSB attacks could be used against organizations, some of which get to be downright scary. Michael Toecker of Context Industrial Security recently described how USB-to-serial converters that are being used to connect critical legacy hardware at industrial control plants can have their firmware reprogrammed. He tested his theory on 20 different converters, and 15 of the chips could not be reprogrammed, so it would probably be a tough nut to crack. But that still left five that could be manipulated.

The Kaspersky revelations are not the first time firmware reprogramming has been mentioned in relation to the NSA. In December 2013, German magazine Der Spiegel published a lengthy investigative piece on the activities of the NSA, which had several months earlier been shown to have intercepted the mobile phone conversations of a number of state leaders, including that of German Chancellor Angela Merkel.

As a part of that investigation, the magazine detailed the contents of what it called the NSA’s Spy Catalog, a years-in-the-making collection of NSA-developed malware and surveillance hardware. That included, according to documents the magazine obtained, “spyware capable of embedding itself unnoticed into hard drives manufactured by Western Digital, Seagate and Samsung.”

It’s tempting to believe that if this catalog exists (there were no official confirmations),it’s a rare resource only available to those with the money and technical sophistication of the NSA. Given the industrialization of malware over the past few years, however, that’s a big leap.

Posted by Brian Robinson on Feb 27, 2015 at 11:36 AM0 comments


Cyber info sharing: More noise than signal?

Cyber info sharing: More noise than signal?

The need for timely sharing of information about both potential and actual attacks has been considered a prime focus for government and industry cybersecurity for at least the past decade. The 9/11 Commission report first brought to light the lack of intell sharing among agencies, for example, and that lack was seen extending into the cybersecurity realm.

The language used in the report, though aimed at terrorism, speaks as much to the problems surrounding cybersecurity today. The events of 9/11 showed "an enemy who is sophisticated, patient, disciplined, and lethal," and also the "fault  lines within our government (and the) pervasive problems of managing and sharing information across a large and unwieldy government."

The Obama administration's most recent push to improve U.S. cybersecurity tries to ratchet up  efforts to improve information sharing both within government and with the private sector. Shortly after, the administration announced the formation of a new Cyber Threat Intelligence Integration Center that's intended to be the government's focus for rapid collection and dissemination of information on cyberthreats.

How far this will go is an open question. While some have welcomed the new proposals, others wonder if the new center will just add to the organizational confusion. The National Security Agency, the Department of Homeland Security, the FBI and the military already have responsibility for collecting this kind of information and, after years of acrimony and pushback, they've managed to develop cohesion about sharing it.

Technically, the tools for sharing have also progressed, leading to a number of acronymic specs such as TAXII (the Trusted Automated eXchange of Indicator Information), STIX (the Structured Threat Information eXpression) and the Cyber Observable eXpression (cybOX). Joining them recently is the Data Aggregation Reference Architecture (DARA), a first response to the 2012 National Strategy for Information Sharing and Safeguarding.

These and other tools all perform important roles. DARA, for example, is aimed at providing a model for how various groups can pull data sets together in order to improve security while also protecting individual privacy, which has been one of the big stumbling blocks to sharing of information.

But is all of this enough? If 2014 showed anything, it's that cybersecurity efforts are falling behind the speed and the level of sophistication attackers apply to the way they get threats into the cyber infrastructure. President Obama in fact mentioned the attack on Sony Pictures late last year as just the latest reason behind his new legislative proposals.

Industry looks to the government for a lead on many aspects of cybersecurity, but the fact is that government is not noted for its speed in dealing with cyber threats, or for convincing industry to share information about attacks with it. However, it is trying. The FBI, for example, released an unclassified version of its Binary Analysis Characterization and Storage System (BACSS) as an additional incentive to public/private sharing.

Now industry seems to be expanding its own efforts to improve sharing. Facebook has launched a framework for "importing information about [threats] on the Internet in arbitrary formats, storing it efficiently, and making it accessible for both real-time defensive systems and long-term analysis." Early partners already include Bitly, Dropbox, Pinterest, Tumblr, Twitter and Yahoo.

Microsoft last year also introduced Interflow, its own attempt to collaborate more closely with the cybersecurity community. That adds to a number of other international collection and sharing efforts, as well as the global infrastructures that individual security companies have established to collect information about threats.

There are still major barriers to sharing, particularly privacy and the need for encryption. How government manages to live within, and profit from, this growing sharing ecosystem while improving how fast it reacts to threats is the real question it has to address.

Posted by Brian Robinson on Feb 13, 2015 at 9:41 AM3 comments