The new team on a new field

We are now starting to see what the team is going to look like in the Federal sector of cyber security at the very top: Brennan (DCIA), Hagel (SoD), and Keith Alexander (DIRNSA) .

John Brennan

Obama has been personally involved in cyber efforts for some time, and hence, Brennan has as well. Below are some articles which highlight his efforts in our area:

• http://www.talkradionews.com/news/2012/08/08/brennan-president-open-to-executive-action-on-cyber-security.html
• http://articles.washingtonpost.com/2012-04-15/opinions/35454335_1_infrastructure-cyberthreat-disruptions
• "Our nation’s security and economic prosperity depend on the security, stability, and integrity of communications and information infrastructure that are largely privately-owned and globally-operated."

I think we can depend on Mr. Brennan to continue to invest heavily in the cyber industrial complex, and have a leading role in helping build the legal and policy frameworks that cyber desperately needs. His experience with counter-terrorism will be vital, but his challenge will be to port that to the traditional intelligence role of large nation state versus large nation state. 

Chuck Hagel

The NY Times pointed this quote out:

“Cyber is a huge issue, that cyberwarfare dimension which we are just now just getting our arms around, as other nations are. If you concentrate on that arena of warfare, you can completely paralyze a nation. You can paralyze power grids; you can paralyze financial services; you can stop a country; you can paralyze computers on ships. I think the greater threat to all of us is going to be directly a dagger at the heart of economic interests, and certainly I would start with cyber. All the other threats are still going to be there — nuclear proliferation, terrorism, weapons of mass destruction, and all the things we're dealing with today. But, in the end, we can deal with those; we can manage those; we can work our way through those. The big issues are things like cyber, that's where we've really got to pay attention. It's not like sending one army against another. You're not going to win that by having a bigger navy that the other guy's navy. You need big navies, you need strong security, but you need so much more now today to protect our economic interests, which are our vital security interests."– PBS Interview, "Great Decisions in Foreign Policy," May 2012

Other than that quote, there's not a whole lot available on his views there. One thing is sure about Hagel: He's into international alliances - something that cyber depends on to a great degree. And I think it's telling that one major thing Chuck Hagel realizes he's protecting against cyber attack is the economy. The financial sector is highly sensitized to its weakness when it comes to cyberwar - and for good reason.

So to sum up: Cyber (both defense and offense) will find continued strong support in the coming administration. The worm in the soup here is, as always, congressional support, which means the dollars and cents budgetary glop that cyber is unfortunately having to wade through at the moment. These are not small programs, and they are not small changes, and having large scale uncertainty about which things will have to be cut to meet a sequester could hamstring any major efforts to improve cyber security, or take the ball on offense.

Tools of Oppression

"In reality, cyber tools of oppression are most often in the form of databases."

http://infosecisland.com/blogview/22587-The-EFF-is-Losing-Its-Way-on-Internet-Freedom.html

Just a short note for the day. Gary McKinnon not being extradited is interesting as well - truth be told, America's sentencing guidelines for hackers tend to be far out of the ordinary for a first world nation. Generally a hacker is looking at more time than a rapist or murderer, which is probably a bit out of whack.

You don't see the EFF going on about this though. You do see them talking about exploit sales, which I think is a misjudgment.

Being "held accountable" is the new black.

There's a general proscription in the IC about talking in any way about offensive things - for good reason. For for that reason, I recommend you take a little grain of salt with some of the things in Secretary Panetta's talk (here).

But even more alarming is an attack that happened two months ago when a very sophisticated virus called Shamoon infected computers in the Saudi Arabian State Oil Company Aramco.  Shamoon included a routine called a ‘wiper’, coded to self-execute.  This routine replaced crucial systems files with an image of a burning U.S. flag.  But it also put additional garbage data that overwrote all the real data on the machine.  More than 30,000 computers that it infected were rendered useless and had to be replaced.  It virtually destroyed 30,000 computers.

For example, the reason the Iranians named their module "wiper" is to reflect the name against their attackers, who had previously destroyed some Iranian oil refinery computers (http://news.techworld.com/security/3379060/mystery-wiper-malware-linked-to-duqu-says-security-firm/) .


Over the last two years, DoD has made significant investments in forensics to address this problem of attribution and we're seeing the returns on that investment.  Potential aggressors should be aware that the United States has the capacity to locate them and to hold them accountable for their actions that may try to harm America.

Likewise, offensive operations are how you do attribution, although defensive tools (such as forensics) typically have a small role as well (IMHO).

A big question here is the meaning of "Hold them accountable." Does this mean targeted assassination, the way it does with Iranian nuclear scientists? Is that how far we've come?

Debates

There's been no real "Cyber Security" in the last two debates, either the Presidential or last night's VP debate. In fact, there's been very little "tech" at all in the last few debates, although the Republicans are coming out as "anti-green-energy-subsidies" which may or may not be a good political move.

Is it possible we'll get all the way to the election without cyber security becoming a Presidential-level issue?

There are Consequences for Getting Caught

So the big news is about to drop. The unfortunate thing, whether Huawei has been spying or not, is they are in a very difficult and indefensible position. Even their direct whitepaper response leaves a lot to consider.

Huawei's response that it would required hundreds of thousands of people to pull off an attack of this magnitude is false. The final firmware burn-in on their products would be controlled by very small teams, if not individuals. A well placed government asset in this position could very easily slip code in that passes all regression testing by the quality assurance team, but has additional behaviour that doesn't affect the end product.

Assuming their manufacturing process is locked down, do they apply the same rigor when handling remote firmware updates? Numerous times in the past we've seen build servers (ala Adobe) or source repositories get remotely compromised. The result varies, but the typical end goal is to backdoor the product, and Huawei is a prime target for an attack of this nature. The important thing to note is that this does not require an embedded government asset, only a well placed attack. Let's not forget that Cisco had their own breach that saw an 800MB chunk of source code get stolen, some of which was later publicly posted. Had the Cisco attacker used a little less ego, he very well could have begun a targeted campaign to backdoor Cisco products or IOS updates.

It begs to ask the question: how does the CSO of Huawei, or the US government know that the supply chain has or hasn't been compromised? The only way for the US to know this for certain is to have someone embedded at the same trust level as the people actually coordinating or carrying out the espionage. Disclosing this fact compromises their own position, so less likely, but still a possibility.

Could it also be that Huawei has been caught enough times, and a mountain of independent evidence has finally piled up to a tipping point? If this is the case then how does their CSO not know that they have been compromised? If this is true, it is the most damaging situation Huawei could find themselves in.

I often wonder why the US has picked Huawei out of a number of foreign telecommunications manufacturers. Why aren't we examining all foreign entities that power critical infrastructure in North America? The unfortunate thing is the congressional report will give the high level information, but their classified annex will have the real dirty details as to why they did this in the first place. Information that only a select few will have access to.Yet they are still free to wage a very public campaign against Huawei.

There is a key takeaway from this story that other foreign companies should be aware of. If the US comes knocking at your door: open it, let them do what they want, see what they want, and record what they want or they will make you pay dearly for it.


UPDATE: The committee report is here.

Obama and Cyber Security

President Obama has released an Op-Ed with some interesting comments on Cyber Security.

To put his post into context, every year FEMA runs these big "games" which are essentially planning sessions for national-level emergencies. They help the country organize roles and responsibilities, and get all the legal paperwork in place in the event something happens. On one hand, they are large brainstorming sessions, where various parts of industry get to explain how they would react or be hurt or could help in the event of some kind of attack, and on the other hand, they're political stunts where various industries and parts of government can demonstrate their needs and sometimes their usefulness.

In this year's simulation, Obama had to use new laws to shut down the Internet in response to ongoing effective cyber-attacks. And, although I'm not privy to the classified side of the simulation, he probably also had to absorb intelligence, establish attribution, and launch a military response. Of course, the FEMA simulation ends there. In the real world, we would have to deal with the aftermath.

Politically, Cyber is an area Obama is demonstrating vision in - assuming Sanger's book is at all accurate, he's seen first hand the role Cyber can play in the future of war, and wants to inoculate his own country from the oncoming threat. Frankly, that's Presidential.

It's telling the the Romney team (which includes former DIRNSA Michael Hayden) has not come out on this issue one way or the other, choosing instead to focus their message entirely on "the economy" as relates to internal social issues (aka Health Care and Taxation). But addressing cyber security issues should be a key component of any job-bill, with regards to protecting industries from nation-state economic espionage, or simply noting that there's a huge proportion of people invested in the industry and effected by the oncoming sequester.

Where have all the hackers gone (in VA)?

The latest polls say Obama is beating Romney by seven points in Virginia. Either way, it's close, and it's close entirely because of this weird beast called Northern Virginia, where I grew up. When I was growing up, there was a large collection of people who worked for the federal government. But now, if you throw a rock, and you don't hit L-3 or Raytheon or ManTech or another federal contractor, you have a really really bad arm.

And a large amount of what these people are doing is cyber security and technology related. I know all the media play is in the exploit business, assessments, FISMA, etc. But the actual job ads in the cafes are for "Big Data" and "HADOOP", and that sort of thing. And generally when they say "Big Data" they actually mean it - it's sort of like "If you can afford it without being the government, it's not big data".

Hackers, of course, have a society like any other sub-culture, and it's largely libertarian. So what you would expect is that you'd see Ron Paul picking up votes in Arlington and Fairfax. But, if you look at the "Federal" counties in NoVA they voted largely for Mitt Romney over Ron Paul (more than the average).

There are some contributing factors, perhaps. Virginia is an open primary state. Seems like low turnout since 300K people voted, but five million are eligible to vote (especially considering the democratic primary is not competitive this year).

Likewise, a lot of the voters are women, especially among newly registered voters. Women are underrepresented in tech fields (and in Ron Paul supporters).

But the bigger question is this: Given that there IS a voting block of swing voters in NoVA (and swing donors), why hasn't EITHER campaign tried to woo them? Mitt Romney has Michael Hayden advising him, and no reason not to drum the "Anti-Chinese" beat on the economy. But he doesn't. You'll notice he has NO opinion whatsoever on CISPA or the Lieberman bill now being debated. None.

Obama has a strong cyber-security track record, and has taken a position on CISPA (anti), but does not seem to engage on cyber-security issues even when his administration is making news about it!

So from both sides we have relative silence. The question is: Why?