Black Hat Briefings 2011: Mudge of DARPA, the App as Ultimate Wingman, Why the Water Comissioner's Hair is on Fire, & Other Strange Tales

Black Hat Briefings 2011: Mudge of DARPA, the App as Ultimate Wingman, Why the Water Comissioner's Hair is on Fire, & Other Strange Tales

By Richard Power

Here are my notes from Black Hat Briefings (USA) 2011, held at Caesar's Palace in Las Vegas, Nevada.

Mudge of DARPA

"Mudge of DARPA" sounds like the name of a character out of World of Warcraft, or some other massively multiplayer online role-playing game (MMORPG). But no, and although in the case of this analogy, truth is not stranger than fiction, it was indeed remarkable to see Peiter "Mudge" Zatko, legendary denizen of the L0pht, author of L0phtCrack, and founder of @Stake, truly one of the iconic figures of the cyber security counter culture, keynoting at Black Hat 2011, in his new role as Program Manager at the Defense Advanced Research Project Agency (yes, DARPA).
In his talk, Mudge offered glimpses into two of his initiatives: Analytic Framework for Cyber Security and Cyber Fast Track.

Touching on the Analytic Framework for Cyber Security, Mudge remarked, "Think of the cold war, and spending, right now we're looking pretty much like Russia."

Using a few fascinating graphs and charts, Mudge illuminated some of fundamental flaws in established approaches. For example, one of his charts, titled "We are Divergent with the Threat," compared average lines of code over a fifteen year period from 1985 to 2010: security software (currently at ten million lines) versus average lines of code in malware (holding consistently at one hundred twenty five lines of code).

The second of these two initiatives, the Cyber Security Fast Track (DARPA-RA-11-52), had just gone live.

According to Mudge, a single government cyber security project typically takes eighty-one months to reach completion.
"Six years. The threat landscape will be different by then. So rather than run one program for six years let's run hundreds with maker spaces and boutique security firms ... Small groups of motivated and like-minded researchers have repeatedly shown significant talent and capabilities."

He hopes to reach such entities with a streamlined funding application and approval process, vetted by four compatriots belonging to that same cyber security counter culture from which Mudge emerged.

"This relationship needs to be mutually beneficial. DARPA intends to cultivate relations and become a resource."

I do not know how the tale of Mudge of DARPA will end; but somehow it feels right to me that he's there, and I hope it leads to genuine breakthroughs. But I assure you, after twenty years in the wilderness that is cyber security, I could only be pleasantly surprised.


100% Out of Sync

In a panel discussion entitled Trillions of Lines of Code and Counting - Securing Applications At Scale, Jeremiah Grossman, founder and CTO of WhiteHat Security offered some insightful perspectives that echoed that kind of critical thinking Mudge had been advancing when talking about developing his Analytical Framework earlier in the day.

Grossman's views are worthy of attention. His street cred? WhiteHat performs weekly vulnerability assessments on four thousand high profile sites (.e.g, banks, insurance companies, healthcare providers, retailers, etc.), seven out of ten of those sites have serious vulnerabilities (i.e., the kind that would enable attackers to access customer information, or hack users accounts, or perform other headline-grabbing misdeeds).

"Whenever we discuss the software security problem, it is inevitably said that what we need to do is train developers to secure code, and it is difficult to argue against that position, especially in regard to people going through college and graduate school programs. But meanwhile there are seventeen million active developers, my guess is that less than one percent of them have formal software security training. How do you give remedial training to seventeen million developers? We don’t even have anywhere near the number of instructors that would be required. Computer-based training would be the only viable solution."

But according to Grossman, the loudly trumpeted issue of training developers hides a different problem, that is just as systemic and at least as damning.

"If you look at IT budgets, businesses investing in the network, host and application layers. Generally, organizations spend the least on routers and switches, and spend a little more on servers, desktops, commercial software, etc. But they spend the most on their own applications, they have legions of developers writing code. It is said that one of the major financial institutions has three developers for every banker. So that's where the business is investing. Now InfoSec likes to say it practices risk management aligned with business. And yet, where does InfoSec spend its money? It spends the most on firewalls and IDS, to protect what the business spends the least in building, followed by anti-virus and patch managements to protect the host, but very little protecting the apps where the business is spending the most. The way we do Infosec budgeting doesn't work. Congratulations, InfoSec, you are 100% out of sync!"

In the Age of Augmented Reality, the Ultimate "Wingman"

CyLab's Alessandro Acquisti broke some of the biggest news at Black Hat Briefings 2011; well, just prior to Black Hat 2011 actually, since The Economist (8-30-11) and the Wall Street Journal (8-1-11) ran exclusives leading up to his conference presentation.

In "Faces Of Facebook-Or, How The Largest Real ID Database In The World Came To Be," Acquisti debuted the results of research conducted with two other Carnegie Mellon researchers, Ralph Goss and Fred Stutzman. This sensational work is a worthy follow-up to the blockbuster study on guessing social security number) Acquisti and Goss co-authored in 2009.


In the course of three experiments, Acquisti and his research colleagues investigated the "feasibility of combining publicly available online social network data with off-the-shelf face recognition technology for the purpose of large-scale, automated, peer-based ... individual re-identification, online and offline, and 'accretion' and linkage of online, potentially sensitive, data to someone’s face in the offline world."

What does this mean in practical terms. A lot. And in terms of individual privacy much of it disconcerting.

Imagine a smartphone app, with which a man in a bar could snap a photo of a woman he is talking to, and after a brief search have access to her dating site info; imagine at the same moment, she is accessing his credit score. Acquisti and a member of his team demonstrated how this would work with a little program amusingly named "Wingman."

The implications are staggering, as Acquisti articulates.

"Is the combination of technologies described [facial recognition and social media applications] going to provide these linkages [all your different, perhaps disguised on-line personas with your actual identity], where we are not simply giving a name to an anonymous face, but we actually blend together on-line and off-line data? ...[Guessing social security numbers] is just one example of what is going to happen, through this blending of on-line and off-line data, this convergence of personal and predictable information - in a way it is written on your face, even if you may not be aware of it. It may democratize surveillance, and i am not saying this in a good sense, I am saying it with concern. We are not talking just about constricted and restrained Web 2.0 applications that are limited to consenting, opt-in users, such as maybe Picasia or currently Facebook tagging. We are talking about a world in which anyone could, in fact, recognize your face and make these inferences, because the data is already out there, it is already publicly available. So what will our privacy mean in this kind of future of augmented reality? We have already created a de-facto Real ID infrastructure ... Nationally, Americans are against Real IDs, but we have already created one for the marketplace."

For better and worse, it will change our world.

"In fact, augmented reality may also carry deep‐reaching behavioral implications. Through natural evolution, human beings have evolved mechanisms to assign and manage trust in face‐to‐face interactions. Will we rely on our instincts, or on our devices, when mobile devices make their own predictions about hidden traits of a person we are looking at?"

For more insights on this important study, you can read my CSO Magazine interview with Acquisti, "Face recognition and social media meet in the shadows". And on Acquisti's own site, you will find an excellent Frequently Asked Questions (FAQ) on the Facial Recognition, as well as the Draft Slides for the Black Hat 2011 Presentation

Google This ...

In "Pulp Google Hacking: Next Generation Search Engine Hacking Arsenal," Fran Brown and Rob Ragan of Stach & Liu, LLC debuted a slew of sophisticated, new tools to optimize the use of Google searches for open source intelligence, including:

• GoogleCodeSearchDiggity, which identifies vulnerabilities in open source code projects hosted by Google Code, MS CodePlex, SourceForge, etc. (loaded with 40 default searches that identify SQL injection, cross-site scripting, insecure remote and local file includes, hard-coded passwords, etc.)
• DiggityDLP, which leverages Google and Bing to identify exposures of SSNs, credit card numbers and other sensitive information via common document formats such as .doc, .xls, and .pdf
• FlashDiggity, which provides automated Google searching, downloading, decompiling and analysis of SWF files to identify Flash vulnerabilities and info disclosures
• DroidDiggity, an smartphone app that delivers GoogleDiggity and BingDiggity to Android phones.

Here is just one of their numerous (and compelling) examples of such tools' powerful capabilities, and the implications thereof.

"Another interesting one that made the news last week or the week before ... I believe this was released by one of the members of Anonymous ... governmentsecuritybags.com ... this is a web site that sells bags with locks on them that you can use to carry around top secret or classified documents ... this has been removed now ... while they were good enough to remove it, thank you Google for cacheing it ... This made the news last week, I didn't even notice it until one of our searches with "Blvd" and "75th." So, basically, we are looking at the actual personal information, billing addresses, usernames and passwords that they registered with ... So if you want to go one-stop shopping for the e-mail addresses, passwords, billing addresses ... it even has a picture of the bag they purchased, so you know what to look for ... Here is a list of six hundred or so people you could go after, who are walking around with top secrets bags on them."

If intelligence gathering is something required in your work (and at this point, if you are in cyber security and it isn't already your skill set, you are way behind the curve), or if you or your organization are the likely target of intelligence gathering, whether it be corporate, state-sanctioned or lone wolf (and at this point who or what wouldn't be from some vector or another), then you ignore the Google Hacking Project at your own risk.



Why is the Water Commissioner's Hair on Fire?

In the developed world, when people turn on the tap, they expect the water to flow; and while they might prefer to drink bottled water, they also expect the tap water to be relatively safe. Of course, although these expectations are based on a lifetime's experience, it is also based on ignorance. Water is one of the most pressing sustainability issues that confronts the human race in the 21st Century. Furthermore, the infrastructures that delivers the water to our populations are, in many (if not most) cases, old, deteriorating and vulnerable to both bad actors and bad luck.

Of course, that's not stopping the push toward and smart water meter networks; and just as with the similar, albeit much more high-profile push toward a smart power grid, this push will open new vulnerabilities and aggravate some existing ones.

John McNabb of South Shore PC Services (Boston, MA.), has undertaken his own independent research into the potential risks and threats involved. For thirteen years, McNabb served as Water Commissioner for a small local water utility.

Speaking on "Vulnerabilities of Wireless Water Meter Networks" at Black Hat 2011, McNabb shared his insights.

There is a lot at stake and a lot at risk.

"Water is a $400 billion global industry ... Al Qaeda has repeatedly threatened to 'poison' U.S. drinking supplies ... the American Society of Civil Engineers gives the nation’s drinking water infrastructure a D- grade and estimates that an investment of $255 billion is needed to bring the system to needed standards."

Think of a water meter as a cash register, McNabb suggest.

"$40 billion, the annual income of US water utilities, comes mostly from meter information."

Thus, the threats and risks involve not only terrorists or some disgruntled ex-worker bent on sabotage, but also common criminality (yes, the kind of criminality that always rises in times of great economic hardship).

According to McNabb, theft through meter tampering is not only a big issue for energy suppliers ("electric utilities assume 10% loss each year from theft"), it is also an issue for water utilities (“Theft of water by tampering with or bypassing water meters costs BWSC [Boston] thousands of dollars a year & .. imposes costs every paying customer.”

There should be plenty of opportunity for everyone.

"The U.S. advanced metering infrastructure (AMI) market (electricity+gas+water) will grow from $2.54 billion in 2010 to $5.82 billion in 2015, an 18% compound annual growth rate." Although most US water meters are still read manually (only 28% have [Automatic Meter Reading] AMR meters). the worldwide installed base of smart water meters is expected to increase from 5.2 million in 2009 to 31.8 million by 2016."

Today, McNabb continued ,much of the data collection. even with smart meters, is done by walk-by and drive-by, but, of course, the fixed network is where it is all going.

"This takes the full capabilities of the wireless water meter and enables it to become a sensor network for the water utility that can allow almost continuous water usage readings (usually every 5-15 minutes). In the fixed network the signals from the single meter are transmitted and then collected in a central receiving station, if close enough, or to repeaters and then to the central receiving station. In most cases a star topology is used, but in some implementations a mesh topology is used to each meter can act as a repeater for any others within range."

McNabb cites numerous vulnerabilities in wireless water meters, ranging from design (e.g., low on-board memory) to lack of security awareness ("Badger gives out its default network username, password and wireless key on web site') to no encryption (even though "more of them are coming out with encryption now").

"Water meters are an integral component of the national drinking water infrastructure," McNabb concluded. "Tampering with water meters, either mechanically or electronically, cost s money for local water systems. Wireless water meters need to be better secured to prevent potential financial loss to water suppliers and to reduce potential security vulnerability to the water system."

Hopefully, his quest will prove to be more than Quixotic.

After all, there is the Maroochie incident, as McNabb reminded us in his presentation.

"The Maroochie incident in 2000, when a disgruntled former contractor used inside info to release 800,000 liters of sewage into the environment, using wireless network communications from his laptop, is an example of how insider threat could impact a wireless sensor network."

Related Posts

BlackHat USA 2010: How to Turn ATMs Into Jackpotted Slots, Basejump the GSM, Lift Malware Developer's Fingerprints & Face Our Existential Dilemma

From Parking Meters to the Cloud, from SMS to Smart Grids ... Is Everything Broken? -- Report from Black Hat Briefings (Las Vegas 2009)

BlackHat USA 2010: How to Turn ATMs Into Jackpotted Slots, Basejump the GSM, Lift Malware Developer's Fingerprints & Face Our Existential Dilemma

BlackHat USA 2010: How to Turn ATMs Into Jackpotted Slots, Basejump the GSM, Lift Malware Developer's Fingerprints & Face Our Existential Dilemma

By Richard Power

Flying into Las Vegas at dawn for the first day of BlackHat USA 2010, I once again felt the poignancy of this extraordinary place. From the original Ocean's Eleven (1960) to Martin Scorsese' Casino (1995), from Howard Hughes to Hunter S. Thompson, Las Vegas is the stuff of legends.

As I walked to the taxi stand, I wondered, which is more remarkable, the incredible heat and dryness of this desert, or the incredible flow of energy and water demanded to sustain this desert city?

And, of course, in Las Vegas, all around you, every moment of the day, the sun beats down, offering all the energy you would need to negate the heat it generates; and of course that energy is yet to be tapped.

Ah, the human folly.

Now the subject of human folly provides an excellent segue way to the cyber security scene here at the end of the first decade of the 21st Century.

In his opening remarks of Jeff Moss (the man who launched BlackHat way back when), made an important point: “We are all heads’ down, working on technical, specific problems. Everyone once in awhile it is probably a pretty good idea to get an idea about ‘what’s the bigger world we are all operating in, what is the larger context we do this for, is it for society, or your business, or your personal advancement? ... What security problems have we fundamentally solved? I can’t really think of any real big things we have killed. Can we send e-mail securely? I don’t think so. Can we write a packet securely? Can we browse the Web securely? No. But we’ve got 50,000 new vendors, and lots of widgets. I am trying to understand what is the incentive? How do we solve these larger problems that are so fundamental, the underpinnings of everything we do? For our country and for every country in the world the Internet is an engine for innovation and commerce. And yet , we do not seem capable of putting the energy forth to secure the fundamental underpinnings .. In whatever endeavor you are in I want you to think about how we can fix the underlying fundamentals."

Moss' creation, BlackHat continues to evolve, year after year, both as an important industry event and as an invaluable technical resource.

Here are some highlights from three of the sessions that I found compelling.

The Grugq, who lives in Thailand, and works as a senior security researcher for Singapore-based Coseinc, spoke on "Base Jumping: Attacking the GSM Baseband and Base Station."

The Grugq gave an overview of the GMS protocol and infrastructure, and then explained some GSM attacks: RACHell, in which the attacker floods the BSS with requests and prevents everyone from using that cell, IMSI Flood, in which the attacker overloads the HLR/VLR infrastructure, and prevents everyone from using the network, and IMSI DETACH, in which the attacker sends multiple Location Update Requests, including a spoofed IMSI, and prevent a SIM from receiving calls and SMS.

In his understated conclusions, Grugq observed: "GSM is no longer a walled garden. GSM spec has security problems. Expect many more issues as OSS reduces costs for entry."

Greg Hoglund of HBGary, Inc. spoke on "Malware Attribution: Tracking Cyber Spies and Digital Criminals."

Hoglund suggested that in a world where "the largest computing cloud" is "controlled by Conficker," we should be paying more attention to the creators of such malicious programs: "Attribution is about the human behind the malware, not the specific malware variants; and that the focus must be on human influenced factors."

He went on to show that on a spectrum of intelligence sources regarding the originators of malware, ranging from "nearly useless" (e.g., blacklists) to "nearly impossible" (physical surveillance/HUMINT), "Developer Fingerprints" (e.g.,"IDS signatures with long‐term viability") occupied a "Sweet Spot."

Hoglund offered some compelling evidence that malware attribution was "possible through forensic toolmarking combined with both open and closed source intelligence."

Barnaby Jack, Director of Research at IOActive Labs, spoke, to an overflowing audience, on "Jackpotting Automated Teller Machines Redux."

To loud laughter from the audience, Jack cited the disturbing words of Windows CE developer, Thomas Fenwick: “We were concerned about protection, but not about security. We weren’t trying to design an airtight system like Windows NT.”

Then Jack proceeded to take us step by step through turning a stand-alone ATM machine into the equivalent of a Vegas slot machine that had hit the jackpot, and highlighting the tools he has developed to do so, Scrooge, his own rootkit, and Dillinger, his own remote attack and administration tool, which allows for "management of unlimited ATMs."

By the end of Jack's stunning presentation, the two ATMs on the stage were spitting out dollar bills to uproarious applause.

What a compelling metaphor for the state of cyber security in the last year of the first decade of the 21st Century.

Jack offered some suggestions in terms of countermeasures, including "offer upgrade options on physical locks," and "implement trusted environment."

See Also

From Parking Meters to the Cloud, from SMS to Smart Grids ... Is Everything Broken? -- Report from Black Hat Briefings (Las Vegas 2009)

And Other CyBlog Conference Coverage ...

SOUPS 2010: Insight into Usable Privacy & Security Deepens at 6th Annual Symposium

Notes on TIW 2010: The Builders & Building Blocks of Trustworthy Infrastructure

CyLab Research has Powerful Impact on 2010 IEEE Security & Privacy Symposium

RSA 2010: Lost in the Cloud, & Shrouded in the Fog of War, How Far Into the Cyber Future Can You Peer? Can You See Even Beyond Your Next Step?

Android Security, Naked Keystrokes, Selling Viagra, Crying Wolf & More! -- A Report from the 18th USENIX Security Symposium (Montreal, 2009)

Reflections on SOUPS 2009: Between Worlds, Cultivating Superior Cleverness, Awaiting a Shift in Consciousness

RSA Conference 2009: Summary of Posts

From Parking Meters to the Cloud, from SMS to Smart Grids ... Is Everything Broken? -- Report from Black Hat Briefings (Las Vegas 2009)

Las Vegas Strip at Night from the International Space Station (NASA)

Seem like every time you stop and turn around
Something else just hit the ground
Broken cutters, broken saws,
Broken buckles, broken laws,
Broken bodies, broken bones,
Broken voices on broken phones.
Take a deep breath, feel like you're chokin',
Everything is broken
– Bob Dylan

From Parking Meters to the Cloud, from SMS to Smart Grids ... Is Everything Broken? -- Report from Black Hat Briefings (Las Vegas 2009)

-- Richard Power

From legendary billionaire Howard Hughes to legendary Gonzo journalist Hunter Thompson , Las Vegas has worked its strange magic on many talented people, including cyber security conference entrepreneur Jeff Moss. Back in 1993, Moss held the first DEFCON hackers convention in Las Vegas, and a few years later, in 1997, spun-off Black Hat Briefings, which has, arguably, become what its hype trumpets, the "world's premier technical security conference." And although BlackHat now go on tour to Tokyo, Amsterdam and Washington, D.C., Las Vegas is still home to the main event, both for DEFCON and Black Hat.

Robert Lentz, Chief Security Officer for the US Department of Defense, was one of BlackHat's 2009 keynote speakers. Lentz articulated the goal of a "resilient cyber eco-system." Lentz cited the need for "culture changing in cyberspace." He stressed the role of education in achieving this goal, citing not only the CAE but also Cyber U.S. Cyber Challenge and the Dc3 Digital Forensics Challenge. He even alluded to the green movement, and the passion it evoked, and called for "a cyber-green movement." "That is something we could all rally around," he added. It was encouraging to hear the bold vision and the high values, but of course when working within an entity as huge, complex and long-established as the US federal government, delivering is the challenge.

The sessions in the body of this year's Briefings ranged from sessions on attacking everything from SMS to "the Smart Grid," and from parking meters to "the Cloud."

Dan Kaminsky, a cyber security researcher typically breaks news at BlackHat, not only broke news this year (see Kaminsky reveals key flaws in X.509 SSL certificates at Black Hat) was himself breaking news this year:

Two noted security professionals were targeted this week by hackers who broke into their web pages, stole personal data and posted it online on the eve of the Black Hat security conference.
Security researcher Dan Kaminsky and former hacker Kevin Mitnick were targeted because of their high profiles, and because the intruders consider the two notables to be posers who hype themselves and do little to increase security, according to a note the hackers posted in a file left on Kaminsky’s site.
The files taken from Kaminsky’s server included private e-mails between Kaminisky and other security researchers, highly personal chat logs, and a list of files he has purportedly downloaded that pertain to dating and other topics. Wired, 7-29-09

Carnegie Mellon CyLab's Alessandro Acquisti spoke on his team's recent headline-grabbing revelation on the accuracy of predicting of social security numbers, using publicly available information.

Acquisti's message --

The vulnerability presented here is not based on some secret bug hidden inside some software. It is based purely on publicly available data. This reflects the unexpected/unintended consequences of the interaction of complex information systems (i.e., combination of SSN issuance patterns, SSDI, EAB, SSNVS, and availability of personal information) and highlights the need to think past SSNs as authenticators.

(For more on this research, see There is an Elephant in the Room; & Everyone’s Social Security Numbers are Written on Its Hide.)

Moxie Marlinspike offered "More Tricks for Defeating SSL."

His conclusions --

We have a MITM attack that will intercept communication for almost all SSL/TLS implementations.
In the case of NSS (Firefox, Thunderbird, Evolution, AIM, Pidgin) we only need a single certificate.
We've defeated the OCSP protocol as implemented.
We've hijacked the Mozilla auto-updates for both applications and extensions.
We've got an exploitable overflow.
In short, we've got your passwords, your communication, and control over your computer.

(Marlinspike recently spoke at CyLab, see CyLab Seminar Series Notes: The Evolution of A Hacking Tool, Moxie Marlinspike on SSLstrip)

There were two other sessions that I found particularly interesting: Nathan Hamiel and Shawn Moyer on “Weaponizing the Web -- More Attacks on User-Generated Content," and Cormac Herley and Dinei Florencio on “Economics and the Underground Economy.” More on them can be found in my full report on Black Hat, available only to CyLab partners in the Intelligence Briefing section of the partners-only portal.

I will also have more to say about Black Hat 2009 as well as the upcoming USENIX Security Symposium in my article for CSO Magazine (August 2009).