Cyber Cease-Fire: US v. China

100615-640x400

As published on Norse on October 6th, 2015

Interesting times indeed, now that the outcome of Chinese president Xi Jinping’s two-day visit to the White House last week has been made public. According to the White House press release, this is what was agreed:

  • The United States and China agree that timely responses should be provided to requests for information and assistance concerning malicious cyber activities.  Further, both sides agree to cooperate, in a manner consistent with their respective national laws and relevant international obligations, with requests to investigate cybercrimes, collect electronic evidence, and mitigate malicious cyber activity emanating from their territory.  Both sides also agree to provide updates on the status and results of those investigation to the other side, as appropriate.
  • The United States and China agree that neither country’s government will conduct or knowingly support cyber-enabled theft of intellectual property, including trade secrets or other confidential business information, with the intent of providing competitive advantages to companies or commercial sectors.
  • Both sides are committed to making common effort to further identify and promote appropriate norms of state behavior in cyberspace within the international community.  The United States and China welcome the July 2015 report of the UN Group of Governmental Experts in the Field of Information and Telecommunications in the Context of International security, which addresses norms of behavior and other crucial issues for international security in cyberspace.  The two sides also agree to create a senior experts group for further discussions on this topic.
  • The United States and China agree to establish a high-level joint dialogue mechanism on fighting cybercrime and related issues.  China will designate an official at the ministerial level to be the lead and the Ministry of Public Security, Ministry of State Security, Ministry of Justice, and the State Internet and Information Office will participate in the dialogue.  The U.S. Secretary of Homeland Security and the U.S. Attorney General will co-chair the dialogue, with participation from representatives from the Federal Bureau of Investigation, the U.S. Intelligence Community and other agencies, for the United States.  This mechanism will be used to review the timeliness and quality of responses to requests for information and assistance with respect to malicious cyber activity of concern identified by either side.  As part of this mechanism, both sides agree to establish a hotline for the escalation of issues that may arise in the course of responding to such requests.  Finally, both sides agree that the first meeting of this dialogue will be held by the end of 2015, and will occur twice per year thereafter.

 

Second-guessing

At first glance this sounds wonderful, but it didn’t take long before the second-guessing started. With Barack Obama making statements such as “What I’ve said to President Xi, and what I say to the American people, [is] the question now is: ‘Are words followed by actions?’”.

It’s important to look at this meeting in the context in which it was held. As most people are aware, the US has been experiencing cyber-attacks almost non-stop for years now, on multiple fronts. The US criticizes China for attacking not only US government infrastructure, but commercial enterprises are suffering massive theft of intellectual property in almost every industry as well. The widely publicized OPM hackwas only the most recent event that made the American cup ‘runneth over’.

But the US is hardly the innocent victim that it portraits itself to be. Well-known whistleblower Edward Snowden revealed that the US has actively been attacking Chinese infrastructure as well, in order to ‘prepare the battlefield’ for any potential physical conflict. They have admitted doing so, but claim that no intelligence from the large cyber intelligence gathering ‘driftnet’ known mostly by its moniker PRISM is fed to American enterprises for their commercial benefit. Whether that is true, of course, remains to be seen. After all, accusations of unfair commercial advantages through government espionage have been shown to contain some substance in the past.

 

Limiting cyber-attacks

In this regard, it is not surprising that it is the US calling for an agreement on limiting the cyber-attacks between the two nations. When taking the theft of intellectual property into account, the US simply has more to lose. It should also not be forgotten that not long ago China signed a treaty with Russia that, among other things, contained a pledge that they would not hack each other. This same treaty also further solidified their efforts to influence global internet governance, about which I commented in an earlier article, giving the US all the more reason to try to calm the waters with China.

 

So what does this treaty mean?

Of the four points covered under Cybersecurity, only the first two are points with some meat to it. As also mentioned in my previous article, the Chinese are very unlikely to sign any treaty on internet norms of behavior that include a reference to the UN’s definition on human rights. The entire bullet point might as well not have been there. It is window dressing and was probably only agreed upon because it shows a willingness to ‘get along’, whether real or imagined. The last point about the ‘cyber hotline’ doesn’t actually say a whole lot at all, so let’s move on to the more salient points.

It should be noted that the US is trying to stop the attacks against American businesses while trying to keep the option of ‘battlefield preparation’ on the table. This isn’t guesswork, its public record; just look atwhat American politicians are saying on the subject. In other words, both countries now seemingly agree that attacks on government networks are more-or-less allowed, but commercial enterprises are considered off-limits. In the unlikely event that both parties actually honor the agreement, this would be a clear win for the US.

 

An unlikely agreement

And that the agreement will be honored does seem very unlikely. For one, the Chinese government has never acknowledged that it has any involvement in cyber-attacks against commercial enterprises, and it is highly unlikely that they ever will. If those attacks would now suddenly cease, it would be a tacit admission that it had such control in the first place and put the lie to every official statement the Chinese government has ever issued on this topic. Another important factor is the simple question of “Cui Bono?”. Who benefits? The Chinese would lose a very effective method for national advancement in many areas, and the only cost thus far has been (relatively light) international criticism. They would gain nothing, whereas the US would gain a stopgap in the massive IP drain.

In short: The agreement seems a bit one-sided and that does not bode well. It may well be that China agreed only to stave off the sanctions that the US has been casually dropping to the press recently. Whether China takes these sanctions seriously is debatable, because China still remains the greatest holder of US debt, which means it can give a considerable pushback. Then again, China not honoring the agreement is probably expected. Despite what some critics may say, the people involved in drafting this treaty are not fools. With this agreement on the table it makes the American case much stronger if Chinadoes violate it, as Jason Healey points out.

As always, time will tell.

 

The Right to Strike Back

pic3-640x400As published on Norse on June 26, 2015.

Last week, at the HiP Conference in Paris, there was a debate on whether or not it should be allowed to strike back when you are being hacked. Currently, criminal law in most countries does not allow it. But is this tenable in today’s’ highly digitized society rife with cybercrime?

My position in this matter is that we should create a legal recognition of the fact that we are in a social gray area where it concerns the Internet, even if it is only a temporary recognition, and allow for somecapability to strike back at cyber criminals. As I’ve said before, humanity is only now scratching the surface of what it means, socially and culturally, to have (largely) unrestricted access to the collective knowledge of Man at our fingertips, (almost) everywhere and (almost) anytime we desire.

In virtually every aspect of the human experience, it has made its’ impact felt. The number of human lives that remain completely unchanged through some kind of information technology is rapidly dwindling to zero as technology advances, and our adoption of them continues to rise.

Under the umbrella-term “Cyber”, that is similarly revered and reviled, we are inching our way through the various aspects of our daily lives to adapt our old notions of how we ‘did things’ to incorporate the new realities we face in the Information Age. Crime, international politics and armed conflicts are among the most hotly debated topics in this regard. What I am getting at, is that in a social and cultural sense, Cyberspace can (and in my opinion should) be considered terrain in the early stages of colonization. Think of it as the New Frontier or the Wild West, if you will.

We recognize that there is this huge new area that can be explored, colonized and exploited, but exactlybecause it is new and untamed, there should be only a limited expectation of Law and Order. Certainly, in most countries the national laws have been revised to incorporate the new realities of Cyberspace. But often these amendments or new laws are only rough first drafts because very few (if any) people understand exactly what Cyberspace means (culturally and socially).

What doesn’t help is the fact that as our technology continues to advance, our uses –and in turn the consequences- are changing with it. In other words: even if we manage to define proper laws for the circumstances right now, there is a good chance that they will be outdated due to technological advances in short order. But that is not really the core issue. Having properly defined, applicable and reasonable laws is only the first step. You have to be able to enforce a law if you expect people to follow it, otherwise it just becomes little more than an advisory note. A cute bauble that the criminally inclined can have a chuckle over while they continue making money off of these exact crimes you’re trying to prevent. And that, unfortunately, is largely where we are now.

Despite being a horrible analogy in every other sense, Cyberspace is the Wild West. Law and Order is reasonably established in some areas, but for the most part you can only depend on the occasional sheriff or Ranger. As was the case in the early years of the Wild West, there –on the whole- isn’t a whole lot of coordination between law enforcement, the government and the citizenry. This can be easily verified by looking at the figures. The number of successfully prosecuted cybercrime cases is very small indeed, when compared to the number of reported incidents. Also consider that we don’t see every incident, and even when incidentsare discovered, they are not always reported. Please don’t misunderstand what I am trying to say: This is not intended as a snipe against law enforcement or the government. They are trying to get a handle on these cases. But the fact of the matter is that we have a serious lack of expertise and experience across the board. There just aren’t enough people skilled and experienced enough to make a serious dent in the numbers. Or, for that matter, to faster develop an underlying framework that makes law enforcement of cybercrime any easier.

Frameworks containing (and hinging on) effective international agreements, laws and political policy to address cybercrime are also still being developed. The often-heard argument to forbid people from striking back at cyber criminals is that to do so is anoffensive act, and not a defensive one. In other words, striking back should be considered a weapon and not a shield. In the strictest sense of the definition this is indeed correct. However, just looking at the success rate of cyber-attacks alone will dissuade anyone from the notion that a “good defense” is enough to stave off a cyber-attacker.

Even the US military, with the highest defense budget in the world, can’t prevent some attacks from being successful. In very practical terms this tells us that we cannot count on being secure when we are only allowed to defend ourselves; something is clearly missing. Perhaps that missing element is the right to strike back. To stick to the earlier analogy of the Wild West, we are unarmed and criminals are not. Essentially we are telling people not to act when they are being attacked. To trust the Police to protect us against predators. To sit still and pray that the criminals don’t find the valuables we’ve buried in the proverbial shed. But clearly the Police are not capable of doing so right now, as can be easily deduced from the figures mentioned earlier.

In my opinion this is untenable, and quite frankly I find it unconscionable to leave the average citizen as such an easy prey. During the debate I therefore argued for at least a temporary recognition that allows for striking back at our assailants, with the express goal of halting an attack. It will be interesting to see how the other panelists view it, and I look forward to hearing if perhaps there is another solution to the problems we face today.

Dutch Police Hacking Back – A Privacy Violation Waiting To Happen?

media_xl_1757672Here in the Netherlands, we’ve seen a proposal for new legislation regarding Cybercrime pop up occasionally for well over a year now. It is coming up for a formal vote by the Senate (Eerste Kamer) on October 7th and was topic for debate on the 24th of September.

The proposed law “Wet Computercriminaliteit III” in Dutch, which translates to the Law on Computercrime III, appears to have some kind of personal note for the Dutch Minister of Security & Justice Ivo Opstelten.

That is, if you take into consideration that many consider it to be an ill-defined law full of poorly understood ideas that can have severe unintended consequences (most notably violating the privacy of innocent civilians), which has been bashed by virtually all sides except Law Enforcement, but still keeps making its reappearance. Even though the general opinion was negative, it was amended slightly before stealthily being put up for a vote of Congress just before the summer recess this year.

This method is sometimes used by Dutch politicians when they wish to slip it in unnoticed. Whether that is the case here, or whether it has indeed worked towards easing the political path remains to be seen. Regardless, this topic has drawn much attention in the Netherlands.

The Computercrime law in question covers a relatively broad spectrum. In a few points the law enables Police to:

  • Remotely investigate computers belonging to criminals, allowing them to copy data or make it inaccessible;
  • Hack into a system if it is unknown where a targeted system is located, while taking notice of international law (please note that this is not the same as ADHERING to international law);
  • Tap or observe communications, but this requires a judge to sign off;
  • Listen in on Skype calls;
  • Prosecuting people for providing access to stolen data, equal to Fencing stolen property;
  • Force a suspect to decrypt encrypted data – refusal to decrypt can lead to a prison sentence of no more than 3 years.

While translated, these bullet points -in my opinion- reflect the way the proposal was worded. Immediately I had some questions. Here are a few:

  • Remotely investigate systems belonging to criminals – Does this mean that if you’ve ever been convicted, they can access your system whenever they like? Or do they mean SUSPECTS? Also, see my later point on having a judge signing off.
  • Hacking into systems of unknown location while taking notice of international law – Aren’t we required to ADHERE to international law instead of simply taking notice? I should try this excuse to get out of a speeding ticket!
  • Tap or observe communications – This is the only specific point that especially mentions it needs a judge to sign off on. That is strange. It seems to me that tapping and/or observing is, when compared to actually breaking and entering into a system, the lesser power.
    Why is it not stated that hacking into a system requires a judge to sign off? Given the generally careful wording of articles of law, I can only surmise that this absence means that the actual hacking into a system does NOT require a judge to sign off first.
  • Listen in on Skype calls – How about any other kind of sort-of-encrypted voice communication application? Skype is popular now, but which application will be popular in the future? This point seems to limit itself unnecessarily. Also, does this fall under tapping or observing communications, which means it requires a judge to sign off?
  • Equating fencing with providing access to stolen data – This might be (mis)used to criminally prosecute people who share ‘warez’ with their Torrent client. In the almost erratic behavior we have been seeing from BREIN (the Dutch equivalent of the RIAA / MPAA) and its head honcho Tim Kuik, we already know their lobbyists will be foaming at the mouth on this item.

    Bad news for the Warez community, to be sure. But with all the already controversial items, why was this put in? It would be nice if a plausible case (preferably more!) was given where this item is useful that is NOT linked to the Netherlands becoming a stooge for the (largely American) Music & Video industry.

  • Forcing suspects to decrypt encrypted data – This is in special response to several child pornography cases where suspects had strongly encrypted content on their systems that Law Enforcement officers could not break. Looking at it from that perspective, it is understandable that this is to be desired.

    However, child pornography is NOT the only reason why anyone would want an encrypted folder. I personally use encrypted containers to store my company’s valuable data in, and I would certainly recommend it for anyone. What are the environmentals of putting this item into practice? And by that, I mean I would appreciate a list of the type of cases where judges will be using this law.

    Most people will agree with using this in cases against child pornography, but it would be an entirely different matter in cases of, say, intellectual property rights of a company. In any case, I would bet that any really guilty child pornographer would prefer 3 years jail time over a full sentence for child pornography. Especially after the way these folks are (understandably) treated by the general populace once their identities are known. In other words: isn’t this item a bit useless to use against hardcore criminals?

Opstelten versus the Community
A few months ago I shared a stage at Nyenrode Business University with, among others, Wil van Gemert (the Dutch National Counterterrorism Coordinator at the NCTV) and Ronald Prins (Fox-IT). Mr van Gemert, who has long worked for the Dutch police before being promoted to his current position, was the only speaker who unequivocally supported this law. All the other speakers, stemming from industries such as Finance, Technology and Education, opposed for a variety of reasons.

We all understood perfectly well that times have changed, and that the police must be able to change with it if we expect them to protect us from criminal behavior. That is not the issue I have with these plans. The issue is how to prevent misuse of this power, and given the many examples we can cite from, this is not a minor consideration that is easily dismissed.

Police officers are human beings too, and they too will bring their personal lives to the job. What is to stop an officer from cracking open the mailbox of a loved one suspected of cheating? Why is it so unclear whether a judge is required to sign off on an action versus the police making a judgment call?

The questions are also of a practical nature: HOW are the police going to crack systems? What software will they use? Will they make use of the same vulnerabilities known to the criminal industry, or will they somehow develop their own backdoors? Will we ever know? If they discover new vulnerabilities, will they still inform us of their existence or keep them under wraps just to ensure their own capability of gaining access? Will they strike deals with software giants such as Microsoft to get a backdoor?

The most critical questions for me have everything to do with prevention of misuse. Who can perform what action, under what circumstances? And who will make sure they cannot do it under other circumstances?

Who will check whether the police have complied with the regulations and limitations we impose on this law? What will be the consequence for a police officer or official when he or she violates them? How plausible will enforcement and auditing still be if the only result is a minor slap on the wrist?

Bart Jacobs, a well known Dutch professor who teaches and researches information security at the Radbout University in the Netherlands, also made clear his reservations about this law. When asked, he had these questions:

How can I know the police didn’t change anything on my system if I am a suspect? Can I ever prove the police didn’t change anything? Or that they have? Can you EVER know?

Please note that I am translating and paraphrasing somewhat. Other observations he made were interesting to share: “When creating the law on tapping phones, the government promised it would be sparsely used. Now, we are one of the most-tapped nations in the world.”  And  “The police are acting like their backs are against the wall. They are framing the debate in a “poor me” fashion to garner sympathy.” It is clear from these remarks that Professor Jacobs is not a fan of this new law.

There are many questions that need to be answered before implementing such an article of law. Naturally I understand that the current wording and phrasing is not what will end up in Dutch law, but all above points should be given due consideration. Cyber crime has brought us considerable change with regards to criminal activity, and the laws we currently have may not be sufficient. But knee-jerk reactions make bad laws and if we are to really deal with cybercrime, we must have good and solid laws that ensure citizen safety (and privacy!) without compromising Justice.

 

Argent Consulting buys B-Able Argent Consulting

PRESS STATEMENT

Monday, 26th May 2014. The Netherlands: Due to insurmountable differences among management, the joint effort between Argent Consulting and B-Able, dubbed “B-Able Argent Consulting” has been terminated. Argent Consulting has bought out the remaining shares and will fulfill existing contracts until their natural termination. The Argent Consulting brand will return to the field in full force; offering new and revised products and services in the global Cyber industry.

Argent Consulting’s CEO Don Eijndhoven had this to say: “The joint venture was entered into based on an estimation of overlap of skills and services between Cyber Security and the more established field of Information Security. We expected a much more receptive customer base but there wasn’t sufficient foundation to work on. In short, the alliance wasn’t as fruitful as we hoped it would be. While this is regrettable, there was also good news: In the Cyber realm we did, and continue to, perform excellently. Having landed several prestigious consultancy contracts with global NASDAQ-listed firms, our core business scores very well and we are going to keep advancing in this strategic direction under the Argent Consulting flag.”

On Dutch Banking Woes and DDoS Attacks

DDOS-attackIf you don’t live in the Netherlands or don’t happen to have a Dutch bank account, you can certainly be forgiven for not having caught wind of the major banking woes that have been plaguing the Dutch. For weeks now, massive DDoS attacks (linked article in Dutch) have brought low the online services of several banks, interrupting mobile payments and slowing down overall online financial traffic. At the center of the digital storms is ING, which was hit first (Dutch) and is hit the most often (Dutch), but Rabobank, ABN AMRO and SNS Bank are also frequent targets. Dutch online payment system iDeal has also been attacked several times, impacting virtually all Dutch banks as well as the many online retailers that use it.

What the goal behind this wave of DDoS attacks is, is as yet unknown, but there are several possible motives at play. It could be simple vandalism, a rather hefty attempt at misdirection to cover up real hacking attempts, or it could have something to do with ING and ABN AMRO being implicated or involved with investigations into tax evasion through offshore banking by the ICIJ. The latter seems unlikely, as most of the DDoS traffic appears to be coming from Romania (according to hackers collective HacksIn – I had a link about that, but lost it somehow) and no motive has made itself known thus far. It was a matter of time until Anonymous came along to jump on the bandwagon, and indeed its Dutch chapter appears to have done so this week when someone posing as Anonymous posted a message on Pastebin. In it, they claim to know who is behind the DDoS attacks (a group of Muslim extremists called Izz al-Din al Qassam Cyber Fighters), and that the Dutch people should go out and collect their money from these banks because it is not safe there.

There are, however, some issues with this post on Pastebin. Firstly, the group they blame for the DDoS attacks is in fact the group responsible for attacks on US BANKS, and there is no discernible link between the US banks being hit or the Dutch banks currently under attack. The motive for the attack against US banks seems clear: Izz al-Din al Qassam demands the removal of the movie “Innocence of Muslims” from Youtube. Once the movie is removed the attacks will stop, they claim. To my knowledge, no such demands have been made here in the Netherlands.

The second issue is that the advice posed by Anonymous would, in fact, immediately collapse the Dutch financial market, as no Dutch bank is currently strong enough to survive such a proposed bank run. They simply don’t have sufficient cash in their vaults. In other words: this is a really bad idea.

So what now?
For starters, ING should hire someone who knows how to communicate during a crisis. Its obvious that they suck at it. They’ve finally stepped off their “Silence, Evade, Deny” strategy but its taken a while. All major companies should look into this, because they may very well be next. Second, major companies with a serious online presence should really start taking this stuff seriously. DDoS attacks are hardly new material to deal with, and proper impact negation tactics have been around for a while. If your income is dependant on online services and this income is significant, get a real ISP that understands this and has expertise in countering such digital vandalism such as Arbor Networks or Prolexic.

The bad news is that according to a recent Prolexic report, DDoS attacks are getting increasingly stronger. They have seen the first 130GB/s DDoS attack this year, and during the first quarter of this year the average attack bandwidth was 48.25GB/s, which signifies a whopping 718% increase over last year. The increase seems to come from a change of victims in the botnets (Dutch) they use. Apparently, they are now targeting web servers especially for their higher bandwidth capacity, which in turn increases overall attack bandwidth. On top of that, the DDoS attack seems to have regained its popularity because the targetlist is growing. Airlines such as KLM (Dutch) and Dutch authentication firm DigID (Dutch) have also recently been hit with massive attacks. In an effort to stave off this wave of disruptions, the Dutch National Cyber Security Center has been organising collective defense (Dutch) between Dutch banks, but it seems they may have to include firms from other walks of life as well. I think we can safely conclude that this avenue of attack is still very worthwhile and won’t be going away anytime soon.

In fact, things may get a lot worse if this newly discovered DDoS technique gets incorporated. Apparently Incapsula mitigated a small attack of 4GB/s recently, and they traced it back to a single source. Generating 8 million DNS queries per second, causing ALL of the 4 GB/s traffic by its lonesome, certainly qualifies it to be called a DDoS Cannon instead of a lowly bot. I don’t know if it is technically feasible, but imagine 100K+ systems doing this.

Wrapping up this piece, I would like to ask mainstream news reporters to please start learning some basic truths about information security. Stop referring to DDos attacks as “(sophisticated) cyber attacks”. They’re not. A DDoS attack is annoying, yes. But on the scale of sophistication they rate roughly as digital graffiti. Also, some major outages are caused by stupidity from the victim rather than an outside source. At least ONE major outage on april 4th of this year at ING was caused by someone messing up certain files that had to be read into a system. This caused a major outage and customers seeing the wrong amount on their bank accounts. This incident was also the most significant failure of ING’s webcare / crisis communication because they didn’t do anything until the problem was almost fixed (many hours later). Still, mainstream media fed the panic frenzy that it was an external “sophisticated cyber attack” until the absolute very end. Very poor reporting if you ask me. Proper reporting matters because your news is read by people who take it for immediate truth. You can, and do, cause panic and unrest when you blow things out of proportion, so please stop doing so. Thank you.

Trojans for the Bundestag – German PD acquired Finfisher

FinfisherIn December of last year, the German public prosecutors’ office had declared that there was no legal basis for the use of the so-called “Bundestrojaner” spyware, which was used to spy on German citizens. On top of it being illegally used, it was also found to be of very poor quality by extensive research performed by the Chaos Computer Club. In a surprising turn of events, German political platform NetzPolitik.org has now uncovered secret documents belonging to the Ministry of Finance, that the Ministry of the Interior sent to the Bundestag (the political seat of Germany) that reveals the German Federal Police’s intention to use Gamma Group’s Finfisher spyware to do the exact same thing.

Finfisher is quite an elaborate suite that allows for remote take-over of both computer systems and mobile devices such as iPhones, Androids, Blackberries and Windows Mobile-phones by pretending to be a software update. Gamma Group sells this product to dictatorial regimes all over the world, and that says a lot. What is also quite interesting is the presence of the logo for the UK’s Home Office and a link to its’ premier Security & Policing Exhibition. Does this imply that the UK government also purchased this product? Wikileaks recently published a document that looks like Finfishers’ marketing brochure and it is certainly geared towards the more modern police forces, as it sports solid integration with LEMF, which stands for Law Enforcement Monitoring Facility.

In august of last year, Bloomberg published an article that reported Finfisher presence on 5 continents and analysis performed by Rapid7 indicated its presence in at least Australia, the Czech Republic, Dubai, Ethiopia, Estonia, Indonesia, Latvia, Mongolia, Qatar, Bahrain  and the United States.  Now, of course this is not concrete proof that these governments actually use Finfisher, but Gamma Group is based in the UK and they have placed this software in the category of goods requiring an export permit because of the restrictions on exporting such digital weapons. Combined with how Gamma specifically markets Finfisher as ‘Governmental IT intrusion‘, it is highly unlikely that the British government would allow legitimate export to be done to just anyone. In a similar story posted by the New York Times, Bloomberg spoke to Martin J. Muench, who is managing director of Gamma International, and he stated that they had not sold their product to Bahrain and the malware that was found must have either been a stolen demonstration copy, or reverse-engineered by criminals.

To be clear, the use of this software is highly questionable. A while back the Dutch Minister of Safety and Justice Ivo Opstelten revealed that a plan was in the works to change the law so that it became allowed for the Dutch police to hack systems belonging to suspects. This led to international resistance and an open emergency letter [PDF warning – Dutch] was sent to the Minister to have this plan terminated because it was a gross violation of privacy. Apparently Germany is already at least one step further than this, having purchased the software already. Is this the future for the Netherlands as well? Will Minister Opstelten dust off his ill-advised plan and follow Germany in purchasing this software? I hope not. Not only is the Dutch police severely understaffed as it is, it also has a serious history of bending (or outright breaking) the rules and violating people’s rights when it comes to (ab)using technology such as this. And just how long will it take before hacking a suspects’ computer will no longer require an approval from a court judge? Where is our oversight then?

Correlating and Escalating Cyber

On September 20th, CNet reported on a new wave of malware called ´Mirage´, embedded in PDF´s that were distributed through spear-phishing attacks against a multitude of targets, such as a Philippine oil company, a Taiwanese military organization and a Canadian energy firm. The attackers´ target set also included firms in Brazil, Israel, Egypt and Nigeria. Their report was based on the findings of Silas Cutler, a security researcher at Dell CTU. The researchers declined to comment on the origins of this new malware, but as we´ve seen before the characteristics of this digital crimewave are a dead match to the likes we´ve encountered during Night Dragon, Operation Aurora and pretty much everything we´ve seen coming out of China the last decade. Call me old-fashioned, but when I read attack characteristics such as these, I feel confident that a talk with the PRC is warranted:

  • Widespread – broad targeting of an entire industry, aiming for commercially sensitive data;
  • Not extremely sophisticated, just adequate to get in;
  • Supporting command and control network is highly active;
  • Attacks seem well-prepared and highly organized;
  • Some of the malware is made by the Honker Union (a well-known Chinese hacker group);
  • Command and control IP address belonging to China, as did three others that have been used in the Sin Digoo affair earlier;

Looking at this pretty much confirms that those talks US Secretary of Defense Leon Panetta had with the Chinese recently about exactly these kinds of cyber-attacks, had little effect. Considering how much American debt is held by the Chinese, you would have to ask yourself just how hard a line the US can draw against such practices, but other countries would probably do well to start talking more sternly through the diplomatic channel with China. Make no mistake: the economic damages of these attacks are so high that involvement is definitely required at the state level.

Getting out of Dodge first
So here we have a rather clear-cut case of attacker correlation which, as ever, is done pretty much after the fact by an international firm who investigated the malware. My question is: How do you deal with this as a nation, as it happens?

This one question breaks down into a number of smaller issues. First off, you´d have to establish at least somewhat formally who defends what network. And let’s be fair: if you´re a democracy, it’s unlikely to be just one entity. The second issue you have to tackle is detecting the actual attack as it happens. Some network administrators will be able to, others won´t. To be of any use on a national level, defenses on all networks should probably be somewhat similar. At least quality-wise, you´d need them to be similar otherwise you wouldn´t be able to determine the whole scope of each outbreak, even after the fact.  This begs the question as to how wise or desirable it would be to regulate information security measures in some way. In many companies, information security is still seen only as an expense and not as a requirement, even though we can cite countless examples of companies being severely damaged by successful cyber-attacks.

So let’s assume we know who defends every network, and assuming they can all detect a new wave of malware as they happen. Then what? This information is usually kept a secret (or ignored, but that’s another matter entirely) and no signals are exiting these defending parties. When is the last time you called your government after a major cyber-attack hit your company? If you can answer that question, you´re really in a minority and most likely operating in a heavily regulated industry such as Finance or Healthcare. The rest is pretty much left to fend for itself. Attacked entities need a local place to send information about these attacks. I would argue that for governments to be able to correlate various cyber-attacks, it must first have a central authority to which each entity can report attacks on their networks and systems. I haven´t heard of any country having this, but a while back a couple of my friends here in the Netherlands started talking about the lack of such an authority. This was thought up during a brainstorming session at the Dutch MoD and initially dubbed a Security Operation Center (SOC). Even though I feel this name is somewhat ambiguous, let’s keep it for now. Given its national scope, we should probably stick to the CERT naming convention and call it GOVSOC.

Alright, then what?
At the risk of becoming repetitive, let’s assume for now that such a GOVSOC is formed and operational. You´d then need to devise thresholds and escalation paths, along with policies to deal with all eventualities. You´d also need some pretty good agreements with law enforcement, the military and civil government. All three of these parties need some kind of mandate to be able to act on information. It would also need to be covered how each of these parties will act on given information. In case of an actual cyber-attack wave being detected, it would first need to be established on whether there is nation-state involvement or if it´s cybercrime. In case of nation-state involvement, what would you want your government to do? Even when you´re certain who did what, what are thresholds to acting on it? How big must the damage be before diplomatic relations deteriorate? Is this affected by how much you engage in these activities yourself?

Maybe I’m wrong, and I sure hope I am, but I haven´t heard of any country getting to this point yet. Many have been debating these and similar questions, but how about some action? For instance, in the Netherlands the National Cyber Security Center (NCSC) seems like a great candidate to embed that GOVSOC function in. Its government, but it’s a public-private collaboration. If you know of any such developments in your country, please share it with me.

The Dutch and the Dorifel

Unless you happen to live in the Netherlands, chances are that you missed the outbreak of a ‘new’ piece of malware a few weeks ago called Dorifel, also known as XDocCrypt. With over 3000 infections in a matter of hours, of which 90% were systems in the Netherlands, this triggered the Dutch National Cyber Security Center almost instantly. XDocCrypt/Dorifel is a new trojan that encrypts executables, Excel- and Word files that it finds on USB drives and network disks, causing companies to come to a grinding halt almost immediately after infection. Later investigation by Digital Investigations turned up that it also distributes phishing banking websites for ING Bank, ABN AMRO and SNS Bank (all banks with a strong presence in the Netherlands). With such distinctive traits, you would expect that it would be ransomware, but it’s not. It doesn’t ask for money, and there are no real clues what the point is of encrypting those files. It may simply have been a trial run just to find out how good this technique works, but it’s all conjecture at this point.

As an aside, it should be mentioned that the malware’s efforts in encryption did uncover something I found interesting: it exploits the RTLO Unicode Hole, which uses a Windows standard Unicode “Right-to-left override” that are more commonly used in Arabic and Hebrew texts (meaning it’s a Feature, not a Bug). Through this use of the RTLO Unicode Hole, they make filenames such as testU+202Ecod.scr appear in the Windows Explorer as testrcs.doc, and effectively make a harmful executable look like a simple Word doc.

What worries me most, and this is the reason for this article, is the delivery vehicle used by this new piece of malware. You see, it doesn’t exploit some new weakness. Instead, it’s being delivered by systems previously infected with the Citadel/Zeus trojan. This means that over 3000 systems in the Netherlands –systems belonging mostly to ministries, local government and hospitals- already had active botnets inside their networks before getting infected with this new malware! Mind you, virtually all of these systems and networks had active antivirus and IDS systems, and NONE detected either the Citadel/Zeus botnet already in place, nor the new XDocCrypt/Dorifel malware. If anything should be a severe wake-up call for Dutch firms who still half-ass their security, this is it.

Major AV vendors such as Kaspersky and McAfee now address this piece of malware, but it does make you wonder: If this Trojan hadn’t gone through the trouble of encrypting all those files, would it ever have been caught? Clearly, with only a couple of thousand infections, it is not that big of an outbreak. Chances are good that Dorifel would have stayed below the “economic feasibility to fix” line that most antivirus corporations adhere to. With malware code mutation getting increasingly easier and more mature, will this be our future? No more large infections, but a lot more small ones to stay below the collective AV radar? It seems plausible. It certainly makes the dim future of the current AV Modus Operandi that much dimmer. When will we finally see a paradigm shift in our approach to defeating malware?

Cyber – Boundless Nonsense

In the Cyber industry, there is much to gripe about. We have a lot of very vocal experts out there, and roughly the same amount of opinions as there are experts. Most of the times, the differences of opinion are really just people being pedantic (or clueless) and while this is a detriment to the entire industry, we have bigger fish to fry. Some notions out there are just plain wrong, and they lead to really poor laws or national policies. If you’ve read any of my previous articles, you may know that when I go off on a tangent, my rants usually involve people who claim cyber warfare doesn’t exist. But the pundits have been strangely quiet on this topic lately, and so it leaves my hands free to chase another topic that’s been bothering me lately. Quite frankly I’m a bit surprised that I haven’t seen more articles on this subject, but here we go anyway:

Cyberspace is NOT without borders. Cyberspace DOES have boundaries.

As any IT person with a basic education in networks & systems will tell you, networks are made by connecting physical networking devices. These devices obviously occupy a physical space somewhere, making them susceptible to the national (and possibly international) laws of the country they are in. You can even configure most networking devices to only service a subset of internet traffic or, and this is especially relevant in this context, deny service to internet traffic involving certain geographic regions. In other words: if you run a country that is geographically wedged in between two countries that are at war with each other, you CAN opt to cease routing their internet traffic. It may not be easy, and it may not be politically useful, but it is certainly not impossible. Back in 2007 during the cyber attacks on Estonia, the responders actually mitigated much of the barrage of DDOS attacks arrayed against them by dropping large portions of international internet traffic.

The question is: What is neutral behavior in the context of cyber warfare? Are you, as a neutral country in the scenario described above, obliged to drop all traffic between these two nations that crosses your national networks? And if you’re not, are you obliged to make sure none of the cyber attacks are originating from compromised systems within your borders? Given the stakes involved, you may want to do that anyway. Simply dropping traffic might be easier though.  But what if dropping traffic from either side gives offense or is considered a hostile act? This can quickly develop into a political conundrum either way.  There is no official “right answer” yet, so for now governments will have to decide this on their own.

A more interesting question is: What constitutes our digital territory online? Our geographical borders are usually quite well defined, but 90% of the hardware on which the internet is built, is commercially owned and maintained. Would this mean that networks owned and operated by foreign companies are to be considered foreign territory? Does this automatically make them susceptible to the laws of the country that they originate from or registered at? But what about networks that aren’t owned by any official entity? And what about wireless networks? How would you treat areas that are covered by multiple wireless access points? If you look at the way territorial borders are handled by governments in physical space, I see no reason to treat cyberspace differently. In fact it’s probably a much easier approach to just declare the entire electromagnetic spectrum inside national borders as national territory than to figure out some new approach “just because it’s cyber”. You can even re-use the notion of Extraterritoriality or the special privileges as described in the Vienna Convention of Diplomatic Relations [PDF Alert].  Considering how international collaborations against cybercrime is currently being approached, we’re actually pretty much doing this anyway.

In conclusion, I would ask that experts and organizations such as RAND [PDF Alert],  Margaret Chon (Seattle University School of Law), NCCIC  and the Stanford Law Review (just a random grab) either develop a better understanding of cyberspace or be more clear about what they mean. In all fairness, I haven’t read the complete works of all these authors. They may actually understand what I just covered and if you read closely enough, they might not even be (technically) wrong. Nevertheless they give off the sense that cyberspace doesn’t have any borders and this is simply a poor representation of reality. The differences between Cyberspace and Physical space are not so big that we need to reinvent the wheel for every policy, law or process we have.  Let’s be sensible and re-use what we already have.

US vs The World – The Cyber Monroe Doctrine

On December 2nd in 1823, the US introduced the Monroe Doctrine. This article declared that the US would view further European interference in the Americas (the Western Hemisphere) as acts of aggression and reserved the right to an armed response. On march 10th, 2009 it was argued in front of a Homeland Security Subcommittee on “Emerging Threats, Cybersecurity and Science and Technology” by Mary Ann Davidson that this same piece of US doctrine would be a suitable candidate for application in cyberspace. You can find more information at Whitehouse.gov about this testimony, from where it has recently resurfaced on various discussion boards such as the Dutch Cyber Warfare Community group on LinkedIn (thank you Matthijs).

Not unlike other testimonies on the subject of Cyber Warfare and Cyber Doctrine coming from the US, we see a very ‘red-blooded American’ attitude seeping through, and quite frankly that’s not helping matters. Im generally a big fan of ‘re-using’ existing laws and policies when they apply well enough to Cyber, but Davidson demonstrates a lack of true understanding of the situation. It is possible that her testimony was misunderstood or misquoted by the person who wrote the testimony excerpt, but nevertheless I would like to address a few key issues I have with the testimony.

“We are in a conflict – some would say a war. Let’s call it what it is.”
In the very first segment of the testimony, Davidson asserts a number of things that are simply incorrect. The title of the paragraph is a clear giveaway, and sets the tone for the rest of the testimony. Davidson observes that the US is under constant attack in cyberspace, and that this amounts to war. What she does here is lump together all the cyber attacks that are recorded, and make it seem like this is all part of one big cyber war. But this is not the case. I would argue that 80% (if not more) of these attacks are merely ill-advised scriptkiddie attacks, maybe not even really aimed at government resources specifically. This is so common that many security people have come to call these attacks ‘internet white noise’. The remainder of the attacks might be more targetted, but their origins are at least as diverse as of the earlier 80%. They are perpetrated by cyber criminals, stalkers, curious college students putting their class material into practice, security pentesters who overstep their bounds, bored high school drop-outs, disgruntled administrators and many more potential attackers. You just don’t know. You can’t know. There are just too many attacks from too many sources to make it feasible to chase every one of them to find out. To lump all these attacks together and paint them as a constant barrage by one enemy is not just incorrect, its also dangerous and foolish. If anything, you’re not in one conflict, you’re in thousands.

Even if you consider all these attacks by all these different enemies conflicts, which implicates that there is some underlying plan or strategy to said attacks, its still a big leap in logic to call it a War. America’s habit of declaring war on abstract notions (the War on Drugs, War on Terror et cetera) may sometimes be necessary to get people to act, but in case of Cyberspace it just doesn’t work. Internet is everywhere and, considering the earlier clarification on the attacks, you’re attacked by thousands of enemies. What are they going to call it? “The War Against Everyone”? Actually, given the tone of the testimony I should probably refrain from giving Davidson any ideas. It is exactly this attitude that gives credence to people who claim that the war drums are being beaten unnecessarily to militarize the Internet and to reduce the rights and freedoms of netizens.  Language matters. Talk of war incites thoughts of war, and it should be used sparingly.

 Given the diversity of potentially hostile entities building cadres of cyberwarriors, probing our systems including our defense systems for weaknesses, infiltrating U.S. government networks and making similar attempts against American businesses and critical industries, is there any other conclusion to be reached? Whatever term we use, there are three obvious outgrowths from the above statement. One is that you do can’t win a “conflict” – or war if you don’t admit you are in one. The second is that nobody wins on defense. And the third is that we need a doctrine for how we intercede in cyberspace that covers both offense and defense and maps to existing legal and societal principles in the offline world.

Emphasis is mine. As previously stated, there are a multitude of conclusions you could draw from what is happening on your networks. The three points mentioned thereafter make even less sense, because she speaks about ‘winning’  the ‘war’. But what does that mean? The Monroe Doctrine referred to Military/Political consequences to Military/Political interference by foreign nations on US soil. Or rather the entire Western Hemisphere but I digress. I mention this with emphasis because the Internet and/or Cyberspace is a different animal altogether. The majority of the cyber equivalent of ‘US soil’ isn’t actually ‘US soil’, but is actually owned and operated completely and totally by third parties. To further complicate matters, a large portion of that is owned and operated by third parties who are distinctly not American such as foreign-owned corporations. Imposing a Cyber Monroe Doctrine would effectively militarize the entire US portion of cyberspace. That is, if they can ever decide on what parts of that cyberspace they could and could not call American. Davidson acknowledges this problem with the use of the term ‘turf’ but fails to grasp the severity of the problems it causes with her theory.

So that covers the underlying theory by Mary Ann Davidson, but the three ‘outgrowths’ don’t even make sense on their own. “You can’t win a war if you don’t admit that you’re in one.” Aside from the whole War statement…I mean…Really? This is a complete non-sequitur if you ask me. You could argue the exact reverse and it would be equally true (or untrue, of course). I might be piling on here, but someone should probably have told the US Senate this before the Vietnam war, which the US never formally admitted as being a War. Had they used Davidson’s logic, they would have known this was a war they could not win.

The second is that nobody wins on defense.” This is another argument that doesn’t stand up to closer scrutiny. The Monroe Doctrine revolved mostly around defense. It was enacted to work as a deterrent to protect (not project) US interests in the Western Hemisphere. So what does Davidson envision with this statement? It seems to me that she’s calling for offensive cyber operations, which is something that isn’t covered by the Monroe Doctrine. Monroe wanted to defend his Home, while Davidson seems to want to cross the pond and kick some butt. She’s calling for a Sword to match the Shield, but doesn’t take into account that they are two entirely separate entities with entirely different properties, capabilities and logistics.

And the third is that we need a doctrine for how we intercede in cyberspace that covers both offense and defense and maps to existing legal and societal principles in the offline world.” So if I read this correctly, Davidson argues the US needs a doctrine because….well, because! This last argument isn’t actually an argument. Its a possible answer to her first two statements and probably only included because she needed a third argument. Three arguments makes it sound nice and official. And why would the US need one doctrine to cover everything? It has been my understanding that the US Government has published various doctrinal documents that cover a variety of issues, such as the International Strategy for Cyberspace. The US Department of Defense has also published a number of documents on Cyberspace over the last few years, and these map to a number of existing legal and societal principles in the offline world. These can be easily found online.

So is Mary Ann Davidson correct in her assertion that the Monroe Doctrine would be a handy fit in Cyberspace? To be honest, I don’t know. Im not a politician and im not a military strategist. But her arguments are flawed and they didn’t sway me. Im usually a big fan of a common-sense approach to Cyber-anything, and in most cases we can apply existing legal and societal frameworks just fine. But in this particular case we simply cannot forget that the US already has an potentially undue influence over the proper functioning of the Internet, and any kind of overly agressive stance will foster more animosity between the US and the rest of the world. The Internet is, and should remain, an active demonstration of global cooperation. We would all be better off if we strived to make things safer for everyone.