Smart spear phishing could kill the power grid, experts warn

While the energy industry may fear the appearance of another Stuxnet on the systems they use to keep oil and gas flowing and the electric grid powered, an equally devastating attack could come from a much more mundane source: phishing.

Rather than worry about exotic cyber weapons like Stuxnet and its big brother, Flame, companies that have Supervisory Control and Data Acquisition (SCADA) systems—computer systems that monitor and control industrial processes—should make sure that their anti-phishing programs are in order, say security experts.

"The way malware is getting into these internal networks is by social engineering people via email," Rohyt Belani, CEO and co-founder of the anti-phishing training firm PhishMe, said in an interview.

"You send them something that's targeted, that contains a believable story, not high-volume spam, and people will act on it by clicking a link or opening a file attached to it," he said. "Then, boom, the attackers get that initial foothold they're looking for."

In a case study cited by Belani, he recalled a very narrow attack on a single employee working the night shift monitoring his company's SCADA systems.

The attacker researched the worker's background on the Internet and used the fact he had four children to craft a bogus email from the company's human resources department with a special health insurance offer for families with three or more kids.

The employee clicked a malicious link in the message and infected his company's network with malware. "Engineers are pretty vulnerable to phishing attacks," Tyler Klinger, a researcher with Critical Intelligence, said in an interview.

He recalled an experiment he conducted with several companies on engineers and others with access to SCADA systems in which 26 percent of the spear phishing attacks on them were successful.

Success means that the target clicked on a malicious link in the phishing mail. Klinger's experiment ended with those clicks. In real life, those clicks would just be the beginning of the story and would not necessarily end in success for the attacker.

"If it's a common Joe or script kiddie, a company's [Intrusion Detection Systems systems will probably catch the attack," Klinger said. "If they're using a Java zero-day or something like that, there would be no defense against it."

In addition, phishing attacks are aimed at a target's email, which are usually located on a company's IT network. Companies with SCADA systems typically segregate them from their IT networks with an "air gap."

That air gap is designed to insulate the SCADA systems from the kinds of infections perpetrated by spear phishing attacks. "Air gaps are a mess these days," Klinger said. "Stuxnet taught us that."

"Once you're in an engineer's email, it's just a matter of cross-contamination," he added. "Eventually an engineer is going to have to access the Internet to update something on the SCADA and that's when you get cross-contamination."

Phishing attacks on SCADA systems are likely rare, said Raj Samani, vice president and CTO of McAfee's EMEA.

"I would anticipate that the majority of spear phishing attacks against employees would be focused against the IT network," Samani said in an interview. "The espionage attacks on IT systems would dwarf those against SCADA equipment."

Still, the attacks are happening. "These are very targeted attacks and not something widely publicized," said Dave Jevans chairman and CTO of Marble Security and chairman of the Anti-Phishing Work Group.

Jevans acknowledged, though, that most SCADA attacks involve surveillance of the systems and not infection of them. "They're looking for how it works, can a backdoor be maintained into the system so they can use it in the future," he said.

"Most of those SCADA systems have no real security," Jevans said. "They rely on not being directly connected to the Internet, but there's always some Internet connection somewhere."

Some companies even still have dial-in numbers for connection to their systems with a modem. "Their security on that system is, 'Don't tell anybody the phone number,'" he said.

John Mello writes on technology and cyber security for a number of online publications and is former managing editor of the Boston Business Journal and Boston Phoenix.
More by John P. Mello Jr

View the original article here

Encryption still protects data, even from NSA, experts say

Though the National Security Agency spends billions of dollars to crack encryption technologies, security experts maintain that properly implemented, encryption is still the best way to maintain online privacy.

The Guardian newspaper and other media outlets last week published stories based on internal internal NSA documents that explain how the spy agency bypasses encryption technologies by using backdoors, brute force attacks, lawful intercepts via court orders, and partnerships with tech vendors.

The reports, based on documents leaked to reporters by former NSA-contract employee Edward Snowden, suggest that many encryption algorithms now widely used to protect online communications, banking and medical records, and trade secrets have been cracked by the NSA and its British counterpart, the GCHQ.

Steve Weis, chief technology officer at PrivateCore and holder of a Ph.D in cryptography from MIT, said despite the NSA activities, the mathematics of cryptography remains very hard to crack.

He suggested that it's likely that the NSA managed to break through insecure and outdated implementations of some encryption technologies.

For example, the documents suggest that the NSA built a backdoor into an NIST-approved encryption standard called Dual EC DRBG, which is used to generate random numbers. Weis noted that the Dual EC DRBG standard has been available for six years and has been rarely used since two Microsoft engineers discovered the NSA backdoor, Weis said.

It remains unclear whether NSA experts have the ability to crack more robust encryption technologies, he said. "So far, I've not seen anything to suggest than an algorithm like AES (Advanced Encryption Standard) has been broken," Weis said.

"When properly implemented, encryption provides essentially unbreakable security," said Dave Anderson, a senior director with Voltage Security, a provider of encryption technology.

"It's the sort of security that would take implausibly powerful supercomputers millions of years to crack. But if it's carelessly implemented, and the key management processes are not sound, this security can be reduced to the level where a hacker with a mid-market PC can crack in a few hours at most," he said an email to Computerworld.

Anderson said the NSA may have been able to take advantage of flaws in key management processes that support the encryption, rather than cracking the cryptography itself, he said. It's possible that the NSA can decrypt financial and shopping accounts, but it can happen only if the cryptography was improperly implemented through faulty, incomplete or invalid key management processes, he said.

Dave Jevans, founder and CTO of Marble Security, a maker of mobile security technology, said some of the concerns raised by the NSA documents are based on a misunderstanding of the facts.

Most email, web searches, Internet chats, and phone calls are not automatically encrypted, so the NSA or anyone else can merely scan online traffic to access them, he said.

The main vulnerability to encrypted traffic is key management, Jevans said. Encryption keys are long, randomly generated passwords that can encrypt and decrypt Internet traffic. "Stealing the key is like stealing a password," he said.

The NSA's enormous financial resources and manpower allow it to effectively go after encryption keys and key management systems rather than break the math behind encrypted code, he said. "It's about a billion times more effective," Jevans noted.

Despite the recent revelations, encryption remains the best way to protect online data, Weis contends.

Concerned companies should consider using open source technologies like Open SSL—whose code is always visible to developers—rather than commercial software, which is more vulnerable to NSA backdoors, he said. "The code is there for people to audit and you can see the changes. At least you have some assurance that there is no intentional vulnerability" built into the software, he said.

Jaikumar Vijayan covers data security and privacy issues, financial services security and e-voting for Computerworld.
More by Jaikumar Vijayan

View the original article here

Tech firms' responses to latest NSA disclosures cloud the truth, experts say

Technology companies may be hiding behind legal jargon to avoid being more forthcoming in their responses to new documents on government surveillance that were disclosed Friday, some experts say.

Internet and software companies including Microsoft, Yahoo, Google and Facebook “are legally compelled to lie,” said security expert Bruce Schneier, citing national security letters that companies are prohibited from disclosing.

Some similar statements were made in interviews with the IDG News Service following a report published Friday in The Guardian alleging that the National Security Agency paid millions of dollars to companies such as Google and Facebook to cover costs involved in surveillance.

The tech companies incurred these costs in fulfilling tighter certification requirements after a 2011 court ruling said the government’s data collection was unconstitutional, according to documents obtained by The Guardian.

That ruling, which was handed down by the Foreign Intelligence Surveillance Court and was made public on Wednesday, said that the way the NSA collected data violated the Fourth Amendment because the agency did not effectively design its collection efforts to target only foreigners of interest to national security.

The NSA was “misusing its authority” by collecting the digital communications of U.S. citizens for years, the ruling said.

The documents revealed Friday describe the problems that the agency experienced after that ruling and the resulting efforts required to bring companies into compliance, according to The Guardian. The list of involved companies includes Google, Yahoo, Microsoft and Facebook, its report said.

The documents were passed on to The Guardian by former NSA contractor Edward Snowden, the man behind the original leaks of various government surveillance programs such as Prism. The documents provide the first evidence of a financial relationship between technology companies and the NSA, the Guardian report said.

The FISA court is required to sign annual certifications that provide the legal framework for surveillance operations, the report said. After the 2011 ruling, those certifications were only being renewed on a temporary basis as the NSA worked to fix its data collection methods that the court deemed unconstitutional.

This adjustment process entailed huge costs, according to a 2012 NSA newsletter entry, excerpts of which were published by The Guardian. “Last year’s problems resulted in multiple extensions to the certifications’ expiration dates which cost millions of dollars for Prism providers to implement each successive extension,” the newsletter said.

The Guardian did not give an exact figure for the costs.

The latest disclosure raises serious questions around the use of taxpayer money to finance government surveillance, the Guardian said. But another issue is the growing discrepancy between the information contained in leaked government documents and technology companies’ responses to it.

Snowden’s original leaks revealing Prism described a program aimed at the mass collection of data owned by U.S. citizens through direct access to company servers. Google and other tech companies have denied cooperating with the NSA to allow the mass collection of data.

They gave similar denials on Friday in response to questions from the IDG News Service.

“Facebook has never received any compensation in connection with responding to a government data request,” a Facebook spokeswoman said.

“We think the continued misreporting on this matter by The Guardian and others is troubling,” she added in an email.

Google said it has “not joined Prism or any government surveillance programs.”

“We do not provide any government with access to our systems and we provide user data to governments only in accordance with the law,” a spokeswoman said.

Both Yahoo and Microsoft offered more legalistic, complicated responses. Their responses make it clear that the companies’ deals for government compensation are more complicated than something they can simply confirm or deny.

“Microsoft only complies with court orders because it is legally ordered to, not because it is reimbursed for the work,” a spokesman said. “We could have a more informed discussion of these issues if providers could share additional information, including aggregate statistics on the number of any national security orders they may receive,” he said.

Microsoft asked for permission in June to aggregate statistics about the number of requests for data it receives under the U.S. Foreign Intelligence Surveillance Act.

Currently, companies can reveal the number of FISA requests they receive only if they lump them together with all other requests from U.S. law enforcement agencies.

Yahoo said it had nothing to add beyond the statement that the company supplied to The Guardian, which said “federal law requires the U.S. government to reimburse providers for costs incurred to respond to compulsory legal process imposed by the government.”

“We have requested reimbursement consistent with this law,” the company said.

Semantics are at play in companies’ responses, experts said.

Friday’s leaked documents “say that these companies cooperate with bulk NSA data collection,” said Schneier. “The companies deny it, but their denials are precisely worded with a lot of wiggle room,” he said.

Also, if companies are compelled by a National Security Letter to comply, they are prohibited from talking about their compliance, Schneier said.

In its response Friday, Google said it continues to await the government’s decision on the company’s petition to publish more national security request data, “which will show that our compliance with American national security laws falls far short of the wild claims still being made in the press today.”

Roger Kay, an IT analyst and founder at Endpoint Technologies Associates, said he was not surprised by the documents that were revealed Friday. Though the companies don’t say whether they provided information to the government, the legalistic language in some of their responses suggests they did, he said.

Also, companies’ responses to the growing number of leaks, whether they are flat-out denials, chock full of complicated legalese, or just plain vague, are probably damaging some users’ trust in the companies, Kay argued.

But for Internet users with short attention spans, disclosures like the ones revealed Friday may just blow over, he added.

Still, many questions remain about the type of data collection that was paid for in the millions of dollars in compliance costs that companies reportedly incurred.

It’s not clear how the NSA gathers data from companies, Kay said. “Is it like a direct stethoscope into the main artery, or a broader snapshot?”

Getting answers to those kinds of questions may also boil down to semantics. “Perhaps different people mean different things by ‘direct access,’” said Seth Schoen, senior staff technologist at the Electronic Frontier Foundation.

In another new development, The Guardian and The New York Times announced on Friday that they would work as partners to give the U.S. paper access to other documents leaked by Snowden. Both papers will be working together to publish more stories tied to the documents.

View the original article here

Tech firms' responses to latest NSA disclosures cloud the truth, experts say

Technology companies may be hiding behind legal jargon to avoid being more forthcoming in their responses to new documents on government surveillance that were disclosed Friday, some experts say.

Internet and software companies including Microsoft, Yahoo, Google and Facebook “are legally compelled to lie,” said security expert Bruce Schneier, citing national security letters that companies are prohibited from disclosing.

Some similar statements were made in interviews with the IDG News Service following a report published Friday in The Guardian alleging that the National Security Agency paid millions of dollars to companies such as Google and Facebook to cover costs involved in surveillance.

The tech companies incurred these costs in fulfilling tighter certification requirements after a 2011 court ruling said the government’s data collection was unconstitutional, according to documents obtained by The Guardian.

That ruling, which was handed down by the Foreign Intelligence Surveillance Court and was made public on Wednesday, said that the way the NSA collected data violated the Fourth Amendment because the agency did not effectively design its collection efforts to target only foreigners of interest to national security.

The NSA was “misusing its authority” by collecting the digital communications of U.S. citizens for years, the ruling said.

The documents revealed Friday describe the problems that the agency experienced after that ruling and the resulting efforts required to bring companies into compliance, according to The Guardian. The list of involved companies includes Google, Yahoo, Microsoft and Facebook, its report said.

The documents were passed on to The Guardian by former NSA contractor Edward Snowden, the man behind the original leaks of various government surveillance programs such as Prism. The documents provide the first evidence of a financial relationship between technology companies and the NSA, the Guardian report said.

The FISA court is required to sign annual certifications that provide the legal framework for surveillance operations, the report said. After the 2011 ruling, those certifications were only being renewed on a temporary basis as the NSA worked to fix its data collection methods that the court deemed unconstitutional.

This adjustment process entailed huge costs, according to a 2012 NSA newsletter entry, excerpts of which were published by The Guardian. “Last year’s problems resulted in multiple extensions to the certifications’ expiration dates which cost millions of dollars for Prism providers to implement each successive extension,” the newsletter said.

The Guardian did not give an exact figure for the costs.

The latest disclosure raises serious questions around the use of taxpayer money to finance government surveillance, the Guardian said. But another issue is the growing discrepancy between the information contained in leaked government documents and technology companies’ responses to it.

Snowden’s original leaks revealing Prism described a program aimed at the mass collection of data owned by U.S. citizens through direct access to company servers. Google and other tech companies have denied cooperating with the NSA to allow the mass collection of data.

They gave similar denials on Friday in response to questions from the IDG News Service.

“Facebook has never received any compensation in connection with responding to a government data request,” a Facebook spokeswoman said.

“We think the continued misreporting on this matter by The Guardian and others is troubling,” she added in an email.

Google said it has “not joined Prism or any government surveillance programs.”

“We do not provide any government with access to our systems and we provide user data to governments only in accordance with the law,” a spokeswoman said.

Both Yahoo and Microsoft offered more legalistic, complicated responses. Their responses make it clear that the companies’ deals for government compensation are more complicated than something they can simply confirm or deny.

“Microsoft only complies with court orders because it is legally ordered to, not because it is reimbursed for the work,” a spokesman said. “We could have a more informed discussion of these issues if providers could share additional information, including aggregate statistics on the number of any national security orders they may receive,” he said.

Microsoft asked for permission in June to aggregate statistics about the number of requests for data it receives under the U.S. Foreign Intelligence Surveillance Act.

Currently, companies can reveal the number of FISA requests they receive only if they lump them together with all other requests from U.S. law enforcement agencies.

Yahoo said it had nothing to add beyond the statement that the company supplied to The Guardian, which said “federal law requires the U.S. government to reimburse providers for costs incurred to respond to compulsory legal process imposed by the government.”

“We have requested reimbursement consistent with this law,” the company said.

Semantics are at play in companies’ responses, experts said.

Friday’s leaked documents “say that these companies cooperate with bulk NSA data collection,” said Schneier. “The companies deny it, but their denials are precisely worded with a lot of wiggle room,” he said.

Also, if companies are compelled by a National Security Letter to comply, they are prohibited from talking about their compliance, Schneier said.

In its response Friday, Google said it continues to await the government’s decision on the company’s petition to publish more national security request data, “which will show that our compliance with American national security laws falls far short of the wild claims still being made in the press today.”

Roger Kay, an IT analyst and founder at Endpoint Technologies Associates, said he was not surprised by the documents that were revealed Friday. Though the companies don’t say whether they provided information to the government, the legalistic language in some of their responses suggests they did, he said.

Also, companies’ responses to the growing number of leaks, whether they are flat-out denials, chock full of complicated legalese, or just plain vague, are probably damaging some users’ trust in the companies, Kay argued.

But for Internet users with short attention spans, disclosures like the ones revealed Friday may just blow over, he added.

Still, many questions remain about the type of data collection that was paid for in the millions of dollars in compliance costs that companies reportedly incurred.

It’s not clear how the NSA gathers data from companies, Kay said. “Is it like a direct stethoscope into the main artery, or a broader snapshot?”

Getting answers to those kinds of questions may also boil down to semantics. “Perhaps different people mean different things by ‘direct access,’” said Seth Schoen, senior staff technologist at the Electronic Frontier Foundation.

In another new development, The Guardian and The New York Times announced on Friday that they would work as partners to give the U.S. paper access to other documents leaked by Snowden. Both papers will be working together to publish more stories tied to the documents.

View the original article here

Google seeks experts for its soon-to-launch Helpouts video service

Google needs help. More specifically, the Internet giant is looking for people who are experts on basically anything to lead some of the first sessions for its soon-to-launch Helpouts video calling program.

Helpouts is a face-to-face, live video calling service, based on the company’s Google+ Hangouts product, that the company has been testing internally for some time. The service is designed to let professionals or experts in a particular area share their expertise or knowledge with others who want to learn from them, for a price.

Helpouts could provide an additional platform for Google to attract new users beyond its usual channels within the Google+ social network. It may also give Google a strong e-commerce business in providing users with more personalized expert information that can’t be gathered from a simple search on Google.com.

If someone is an IT expert looking to make some extra cash, Helpouts can connect that person with less technically savvy people to, say, hook up a wireless router or connect a laptop to a printer, Google said in one example of the service.

The company is stressing the social side of the service. “Helpouts is a new way to connect people who need help with people who can give help, over live video, anytime, anywhere,” the service’s current landing page proclaims.

Helpouts is not yet open to the public, but the company is looking to attract people with expertise across a range of topics to offer sessions within the program once it goes live. Google is looking to bring on people and businesses who are experts across a number of categories, including information technology, home and garden skills, fashion and education, a Google spokeswoman said.

People who are interested can visit the Helpouts site to submit their contact information. “If we feel they are a good fit, we will follow up with them and possibly extend an invitation to apply,” the Google spokeswoman said. Users will need an invitation code to sign up as a provider and create listings on Helpouts.

Google declined to say exactly when Helpouts would launch, but it will be rolling out soon, the spokeswoman said. The company has been conducting internal tests of the product with multiple partners for some time.

Once it goes live, here’s how Helpouts will work: Expert providers can charge for their sessions or offer Helpouts for free if they want, but a platform fee must still be paid to Google for each completed Helpout. The service is designed to let people start or join a call from their desktop computer, Android-based mobile device, iPhone or iPad.

Helpouts is designed to make it easy for people to grow their businesses by setting their own rates and getting paid online, according to the company. Providers can work on their own schedules, whether they’re at home or on the go.

If the provider charges a fee for the session, both providers and customers will need to use Google Wallet for the payment, according to the Helpouts site.

Helpouts has a strong social component for a reason: Social networking is an area of Google’s business that the company is continually seeking to scale out to better compete against rivals such as Facebook and Twitter. While Facebook and Twitter have more than 1 billion and 200 million active users, respectively, Google+ has about 190 million, the company reported in May.

Google already provides videos covering practically every topic through its YouTube video-sharing site, some of which are instructional in nature. But Helpouts looks to be a step up in both the level of interaction and the qualification of the experts, given its current invitation-only sign-up process.

View the original article here