Another Word For It Patrick Durusau on Topic Maps and Semantic Diversity

The 2015 Trust Wave Security Report calculates that attacks on end users enjoys an ROI of 1,425%.

Can you guess the liability for producing software that allows attacks on end users?

It’s the same amount as the return on making software secure. That is 0% ROI.

No doubt the Obama administration will spend $millions if not $billions in its multi-year cyber egg roll to improve cybersecurity for government networks, but the result will be:

an insecure IT stack topped off by insecure security software.

Unless and until there are economic incentives and hence meaningful ROIs for secure software, cyberinsecurity will continue.

Given the near idolatry of capitalism and economic incentives in the United States, it is truly surprising that lesson remains unlearned.

Well, save for the realization that secure software requires more investment in tools, training and testing, than current approaches to building commercial software.

Customers demanding more secure software, who are willing to pay more for secure software and liability for the production of insecure software, are all keys to solving (over time) the current state of cyberinsecurity.

Some of the contractors that have helped OPM with managing internal data have had security issues of their own—including potentially giving foreign governments direct access to data long before the recent reported breaches. A consultant who did some work with a company contracted by OPM to manage personnel records for a number of agencies told Ars that he found the Unix systems administrator for the project “was in Argentina and his co-worker was physically located in the [People’s Republic of China]. Both had direct access to every row of data in every database: they were root. Another team that worked with these databases had at its head two team members with PRC passports. I know that because I challenged them personally and revoked their privileges. From my perspective, OPM compromised this information more than three years ago and my take on the current breach is ‘so what’s new?'”
(emphasis added)

From: Encryption “would not have helped” at OPM, says DHS official by Sean Gallagher.

China based contractors? What about that would raise security concerns in your mind?

The president should spend the remainder of his term in office:

1. Dismantling the current IT contracting system
2. Forcing all government offices to inventory their IT systems

Either one of those steps without the other will perpetuate the deeply insecure federal IT systems of today.

Enough time has passed since the known OMP hacks for some of the commentary to become less breathless and morally outraged. As I pointed out in The New ‘China Syndrone’ – Saving Face By Blaming China (June 6, 2015), the hack of OPM could have been by anybody given the state of its security.

Kristen Eichensehr points out in The OPM Hack and the New DOD Law of War Manual that even assuming that China was behind the hack, this was just day-to-day espionage, which is no prohibited by international law.

I have been meaning to post about the new DOD Law of War Manual just to call it to your attention so consider that done. Bearing in mind the laws of war are drafted to favor current “conventional” tactics. Another example of law having its thumb on the scale of justice.

Benjamin Wittes quotes Dennis Hayden (former NSA and CIA chief) as saying:

The episode, he says, “is not shame on China. This is shame on us for not protecting that kind of information.” (Michael Hayden: “Those Records are a Legitimate Foreign Intelligence Target”)

How much “shame on us?”

Ken Dilanian reports in Fed Personnel Agency Admits History of Security Problems:

An Office of Personnel Management investigative official said June 16, 2015, the agency entrusted with millions of personnel records has a history of failing to meet basic computer network security requirements. Michael Esser, assistant inspector general for audit, said in testimony prepared for delivery that, for years, many of the people running the agency’s information technology had no IT background. He also said the agency had not disciplined any employees for the agency’s failure to pass numerous cyber security audits.
…

I suspect it will take months of testimony to drag out the sorry tale of cyberinsecurity at OPM. But in a calmer atmosphere, it is clear that all fault for the breach lies with the Office of Personnel Management.

The some of the remaining questions are:

1. How to fix a fundamentally broken IT system (that hasn’t been fully accounted for)?
2. How to hold staff accountable for failures to maintain cybersecurity?

I can give you a hint on the first question: Don’t use traditional the traditional prime, sub-primes, etc. infrastructure. Hire contractors to write requirements (who won’t be bidding on fulfillment), with built-in milestones and then ask several of the larger IT services companies to bid.

The second question is easier. Fire everyone with managerial responsibilities and keep the other staff. Blacklist the fired staff from any future government service or employment with a government contractor. Then freeze all their benefits until their liability for damages from the data breaches can be assessed.

Think of it as a “teaching moment” that will encourage greater diligence when it comes to cybersecurity in government offices.

PS: In terms of a likely timetable for improvement of cybersecurity at OMP and other federal offices, see my: Cybersecurity Sprint or Multi-Year Egg Roll?

Samsung devices, including Galaxy S6, vulnerable to remote code execution by Ashley Carman.

From the post:

More than 600 million Samsung mobile device owners are vulnerable to cyberattacks that could allow a perpetrator to remotely execute code as a privileged system user.

The vulnerability exists in Samsung’s pre-installed Swift keyboard. The keyboard, which cannot be uninstalled or disabled, issues update check requests every couple hours or so, explained NowSecure CEO Andrew Hoog during a Wednesday interview with SCMagazine.com. NowSecure discovered the bug, CVE-2015-2865, in 2014, and notes that to execute a successful attack, a person must be capable of modifying upstream traffic.

If a user is logged into an insecure WiFi network, for example, a successful man-in-the-middle (MitM) attack could allow a cybercriminal to monitor the network traffic for these requests. Once one is spotted, the attacker can respond with a malicious payload. From there, the attacker could tamper with the compromised device. Sample exploitations could include accessing sensors and resources, such as the device’s camera; installing malicious apps without the user’s knowledge; listening in on calls; or accessing personal data, such as pictures and text messages.
…

See Ashley’s post for the rest of the details. Including a suggestion that an attack focused on a single device is unlikely.

That’s like arguing purse snatching isn’t a problem because banks have more money. In fact we know that purse snatching happens despite the existence of banks. Smaller return but less risk.

A 600 million device target area sounds big enough to attract malicious interest.

Android Security Rewards Program

Covers:

• Nexus 6
• Nexus 9

Rewards as of June 2015:

Reward amounts

The reward amount depends on the severity of the vulnerability and the quality of the report. A bug report that includes reproduction code will get more than a simple report pointing out vulnerable code. A well-written CTS test and patch will result in an even higher reward.

Our base reward amounts for vulnerability severity are typically:

• Critical – $2,000
• High – $1,000
• Moderate – $500

We’ll reward up to 1.5x the base amount if the bug report includes standalone reproduction code or a standalone test case (e.g., a malformed file). If the bug report includes a patch that fixes the issue or a CTS test that detects the issue, we’ll apply up to a 2x reward modifier. If there is both a CTS test and a patch, there’s a potential 4x reward modifier. Keep in mind that submitted CTS tests and patches must apply cleanly to AOSP’s master branch and comply with Android’s Coding Style Guidelines to be eligible for these additional reward amounts.

This table shows an overview of the reward schedule for typical rewards:

Severity	Bug	Test case	CTS / patch	CTS+Patch
Critical	$2,000	$3,000	$4,000	$8,000
High	$1,000	$1,500	$2,000	$4,000
Moderate	$500	$750	$1,000	$2,000
Low	$0	$333	$500	$1,000

Besides these reward levels, we offer additional rewards for functional exploits:

• An exploit or chain of exploits leading to kernel compromise from an installed app or with physical access to the device will get up to an additional $10,000. Going through a remote or proximal attack vector can get up to an additional $20,000.
• An exploit or chain of exploits leading to TEE (TrustZone) or Verified Boot compromise from an installed app or with physical access to the device will get up to an additional $20,000. Going through a remote or proximal attack vector can get up to an additional $30,000.

The final amount is always chosen at the discretion of the reward panel. In particular, we may decide to pay higher rewards for unusually clever or severe vulnerabilities; decide that a single report actually constitutes multiple bugs; or that multiple reports are so closely related that they only warrant a single reward.

We understand that some of you are not interested in money. We offer the option to donate your reward to an established charity. If you do so, we will double your donation – subject to our discretion. Any rewards that are unclaimed after 12 months will be donated to a charity of our choosing.

You need to decide what you want to earn per hour and then decide if this reward program meets your needs.

Personally I would call the US Navy about its recently advertised zero-day program. (officially withdrawn but it doesn’t hurt to ask)

The Whitehouse should establish a public auction for zero-day exploits. Vulnerabilities would have more publicity and buyers would be on a fairer footing. Let the free market decide what vulnerabilities are worth.

Apple CORED: Boffins reveal password-killer 0-days for iOS and OS X by Darren Pauli.

From the post:

Six university researchers have revealed deadly zero-day flaws in Apple’s iOS and OS X, claiming it is possible to crack Apple’s password-storing keychain, break app sandboxes, and bypass its App Store security checks.

Attackers can exploit these bugs to steal passwords from installed apps, including the native email client, without being detected.

The team was able to upload malware to Apple’s app stores, and passed the vetting processes without triggering any alarms. That malware, when installed on a victim’s Mac, raided the keychain to steal passwords for services including iCloud and the Mail app, and all those stored within Google Chrome.

Lead researcher Luyi Xing told El Reg he and his team complied with Apple’s request to withhold publication of the research for six months, but had not heard back as of the time of writing.

They say the holes are still present in Apple’s software, meaning their work will likely be consumed by miscreants looking to weaponize the work.

Apple was not available for immediate comment.

The Indiana University boffins Xing; Xiaolong Bai; XiaoFeng Wang; and Kai Chen joined Tongxin Li, of Peking University, and Xiaojing Liao, of Georgia Institute of Technology, to develop the research, which is detailed in a paper titled Unauthorized Cross-App Resource Access on Mac OS X and iOS.

See Darren’s post for more non-technical details and the paper for the full monty.

Is your first impulse on reading about Apple CORED to run out and buy stock in security software companies that don’t address the underlying vulnerability? No? Perhaps because security software doesn’t address the underlying problem? Or perhaps because security software could have its own vulnerability to add to the maze of known and unknown vulnerabilities of your own IT stack?

You should feel smart today because a lot of investors aren’t as bright as you. The Billion-Dollar Bet That Better Software Can Back Off Hackers by Joseph Ciolli, is more appropriately titled: The Billion-Dollar Theft That Better Software Can Back Off Hackers.

From Joseph’s post:

About the only thing rising as fast as online mischief is the stock of firms trying to thwart it.

Companies from FireEye Inc. to Palo Alto Networks Inc. have taken off in 2015, extending the gain in a four-year-old index tracking network security firms past 200 percent. An exchange-traded fund tied to the shares just surpassed $1 billion in market value, having doubled in size since the start of April.

Online intrusions such as last week’s breach of confidential government employee records have fanned cyber paranoia, boosting spending on network security and making darlings out of companies with a hand in safeguarding digital data. The theme is starting to feed on itself among investors afraid of being left out.

“This is an industry where the higher the price goes, the more attractive it becomes to people,” said John Manley, who helps oversee about $233 billion as chief equity strategist for Wells Fargo Funds Management in New York. “It’s been a herd mentality in these stocks as these companies offer a level of security that wasn’t offered before.”

A 24 percent gain in 2015 and a frenzy of investor inflows swelled the market value of the PureFunds ISE Cyber Security ETF past the $1 billion threshold on Tuesday. That’s up from $107 million at the start of the year and $494 million at the end of the first quarter.
…

I have been practicing with Gimp and here is how I would visualize the present security dilemma.

As you can see, your present IT stack is holes all the way down. That is the crux of the current security dilemma. Not that the network has vulnerabilities or your OS has vulnerabilities or that applications have vulnerabilities or that your hardware has vulnerabilities. Holes all the way down.

The $billion software solution makes your IT stack look like this:

I colored the security software contribution to your stack in red to symbolize its impact on your bottom line.

The answer to cybersecurity is NOT better but leaky security software on top of a leaky IT stack.

The answer to cybersecurity IS better software in the IT stack. Security as an integral part of software design.

With the rising tide of data breaches, it won’t be that long before some judge is quoting these lines in a judgement against a software vendor:

To establish the manufacturer’s liability it was sufficient that plaintiff proved he was injured while using the [product] in a way it was intended to be used as a result of a defect in the design and manufacture of which the plaintiff was not aware that made the [product] unsafe for its intended use. (Greenman v. Yuba Power Products, Justice Traynor)

I found that quote in a delightful summary on product liability law, An Introduction to Product Liability Law by Dennis W. Stearns. The summary only runs thirteen pages and 1,000+ page tomes exist on the subject. Use the summary as a starting point, not an end point.