Abandoning identity in favor of attributes

By Steve Wilson, Principal Analyst, Constellation Research

Wilson works at the intersection of digital identity, privacy, cryptography and policy. He has worked in identity R&D and strategy for 18 years with his current research applying Darwinian thinking and cultural ecology to understand how identities evolve in real world business.

---

Identity online is a vexed problem. The majority of Internet fraud today can be related to weaknesses in the way we authenticate people electronically. Internet identity is terribly awkward too. Unfortunately today we still use password techniques dating back to 1960s mainframes that were designed for technicians, by technicians.

Our identity management problems also stem from overreach. For one thing, the information era heralded new ways to reach and connect with people, with almost no friction. We may have taken too literally the old saw “information wants to be free.” Further, traditional ways of telling who people are, through documents and “old boys networks” creates barriers, which are anathema to new school Internet thinkers.

For the past 10-to-15 years, a heady mix of ambitions has informed identity management theory and practice: improve usability, improve security and improve “trust.” Without ever pausing to unravel the rainbow, the identity and access management industry has created grandiose visions of global “trust frameworks” to underpin a utopia of seamless stranger-to-stranger business and life online.

Why is identity online so strangely resistant to these well-meaning efforts to fix it? In particular, why is federated identity so dramatically easier said than done?

Well-resourced industry consortia and private-public partnerships have come and gone over the past decade or more. Numerous “trust” start-up businesses have launched and failed. Countless new identity gadgets, cryptographic algorithms and payment schemes have been tried.

And yet the identity problem is still with us. Why is identity online so strangely resistant to these well-meaning efforts to fix it? In particular, why is federated identity so dramatically easier said than done?

Identification is a part of risk management. In business, service providers use identity to manage the risk that they might be dealing with the wrong person. Different transactions carry different risks, and identification standards are varied accordingly. Conversely, if a provider cannot be sure enough who someone is, they now have the tools to withhold or limit their services. For example, when an Internet customer signs in from an unusual location, payment processors can put a cap on the dollar amounts they will authorize.

Across our social and business walks of life, we have distinct ways of knowing people, which yields a rich array of identities by which we know and show who we are to others. These Identities have evolved over time to suit different purposes. Different relationships rest on different particulars, and so identities naturally become specific not general.

The human experience of identity is one of ambiguity and contradictions. Each of us simultaneously holds a weird and wonderful ensemble of personal, family, professional and social identities. Each is different, sometimes radically so. Some of us lead quite secret lives, and I’m not thinking of anything salacious, but maybe just the role-playing games that provide important escapes from the humdrum.

Most of us know how it feels when identities collide. There’s no better example than what I call the High School Reunion Effect: that strange dislocation you feel when you see acquaintances for the first time in decades. You’ve all moved on, you’ve adopted new personae in new contexts – not the least of which is the one defined by a spouse and your own new family. Yet you find yourself re-winding past identities, relating to your past contemporaries as you all once were, because it was those school relationships, now fossilised, that defined you.

Frankly, we’ve made a mess of the pivotal analogue-to-digital conversion of identity. In real life we know identity is malleable and relative, yet online we’ve rendered it crystalline and fragile.

We’ve come close to the necessary conceptual clarity. Some 10 years ago a network of “identerati” led by Kim Cameron of Microsoft composed the “Laws of Identity,” which contained a powerful formulation of the problem to be addressed. The Laws defined Digital Identity as “a set of claims made [about] a digital subject.”

Your Digital Identity is a proxy for a relationship, pointing to a suite of particulars that matter about you in a certain context. When you apply for a bank account, when you subsequently log on to Internet banking, when you log on to your work extranet, or to Amazon or PayPal or Twitter, or if you want to access your electronic health record, the relevant personal details are different each time.

The flip side of identity management is privacy. If authentication concerns what a Relying Party needs to know about you, then privacy is all about what they don’t need to know. Privacy amounts to information minimization; security professionals know this all too well as the “Need to Know” principle.

All attempts at grand global identities to date have failed. The Big Certification Authorities of the 1990s reckoned a single, all-purpose digital certificate would meet the needs of all business, but they were wrong. Ever more sophisticated efforts since then have also failed, such as the Infocard Foundation, Liberty Alliance and the Australian banking sector’s Trust Centre.

Significantly, identity federation only works within regulatory monocultures – for example the US Federal Bridge CA, or the Scandinavian BankID network – where special legislation authorises banks and governments to identify customers by the one credential. The current National Strategy for Trusted Identities in Cyberspace has pondered legislation to manage liability but has balked. The regulatory elephant remains in the room.

One of the most promising identity developments today is the Open Identity Foundation’s Attribute Exchange Network, a new architecture seeking to standardise how identity claims may be traded. The Attribute Exchange Network resonates with a growing realization that, in the words of Andrew Nash, a past identity lead at Google and at PayPal, “attributes are at least as interesting as identities – if not more so.”

If we drop down a level and deal with concrete attribute data instead of abstract identities, we will start to make progress on the practical challenges in authentication: better resistance to fraud and account takeover, easier account origination and better privacy.

My vision is that by 2019 we will have a fresh marketplace of Attribute Providers. The notion of “Identity Provider” should die off, for identity is always in the eye of the Relying Party. What we need online is an array of respected authorities and agents that can vouch for our particulars. Banks can provide reliable electronic proof of our payment card numbers; government agencies can attest to our age and biographical details; and a range of private businesses can stand behind attributes like customer IDs, membership numbers and our retail reputations.

In five years time I expect we will adopt a much more precise language to describe how to deal with people online, and it will reflect more faithfully how we’ve transacted throughout history. As the old Italian proverb goes: It is nice to “trust” but it’s better not to.

Newly Discovered 'Master' Cyber Espionage Group Trumps Stuxnet

The so-called Equation Group epitomizes the goal of persistence in cyber spying--reprogramming hard drives and hacking other targets such as air-gapped computers--and points to possible US connection.

KASPERSKY SECURITY ANALYST SUMMIT -- Cancun, Mexico -- Move over Stuxnet, Flame, and Regin: a newly uncovered cyber espionage operation that predates and rivals Stuxnet has been underway since at least 2001, armed with advanced tools and techniques that include hacking air gapped computers and a first -- silently reprogramming victims' hard drives such that malware can't be detected or erased.

Researchers from Kaspersky Lab here today gave details of the so-called Equation Group, a hacking operation that they describe as the most sophisticated attack group they have seen thus far of the around 60 such groups they currently track. The Equation Group also has ties to Stuxnet and Flame, but outranks those attacks, having deployed in 2008 two of the zero-day exploits that were later used by Stuxnet. That suggests the Equation Group provided those exploits to the Stuxnet gang and is the "masters" over them, according to Kaspersky Lab.

The Equation Group has hit tens of thousands of highly targeted victims in more than 30 countries, with Iran, Russia, and Pakistan as the most infected. Other nations with victims include Syria, Afghanistan, Kazakhstan, Belgium, Somalia, Hong Kong, Libya, United Arab Emirates, Iraq, Nigeria, Ecuador, Mexico, Malaysia, Sudan, the US, Lebanon, Palestine, France, Germany, Singapore, Qatar, Pakistan, Yemen, Mali, Switzerland, Bangladesh, South Africa, Philippines, United Kingdom, India and Brazil. The targets are in government and diplomacy, telecommunications, aerospace, energy, nuclear research, oil and gas, military, nanotechnology, mass media, transportation, financial institutions, cryptographic development, as well as Islamic activists and scholars based in the US and UK.

Kaspersky estimates that the attack group was infecting some 2,000 individuals per month. But what's most unnerving is that Equation Group has basically gone dark since 2014, indicating that they've taken an even stealthier tack. All of their command & control servers were moved to the US in 2014, according to Raiu, who says his team has found about 300 of their servers worldwide. "For sure they have registered some new servers in 2014, so they are still active. But we haven't seen any new [malware] samples compiled … they are either now untraceable or randomly changing all of the timestamps," says Costin Raiu, head of Kaspersky's global research and analysis team. The malware targets Windows systems.

"But in operations, there was nothing new in 2014. It's super-scary," he says.

Despite the elephant-in-the-room question of whether the Equation Group is the US National Security Agency, Kaspersky researchers say they can't identify who's behind the campaign. Even so, a couple of months after Edward Snowden leaked the trove of NSA documents, the Equation Group replaced one of its malware variants with a more sophisticated one, called Grayfish. "They shut down some old stuff and the new Grayfish" came, Raiu says.  "I don't know if that's related or not."

The level of funding and sophistication required to craft the bevvy of tools used by the Equation Group, plus English-language usage in the code, and other clues, such as the targeted (and non-targeted) regions, appear to point to a possible US connection. "We have not found any exact match of these code names .. with [the information leaked by] Snowden, so we cannot tell you it matches an NSA profile," says Vitaly Kamluk, director of the EEMA Research center at Kaspersky Lab.

An NSA spokesperson declined to comment on the findings, according to multiple published media reports.

"This malware is extremely sophisticated. It's way more complex than anything we've seen. It's most likely a nation-state because there doesn't seem to be any connection with cybercrime," he says.

Hard Drives Hacks

Among the hacking group's more unique and complex capabilities that Kaspersky has identified are two modules that can reprogram more than a dozen different hard drive brands, including big names like Maxtor, Seagate, Hitachi and Toshiba, basically rewriting the hard drive's operating system. This trick puts the "p" in APT (advanced persistent threat), by allowing the malware to go undetected by antivirus and to remain alive even if the drive is reformatted or the operating system gets reinstalled. The technique--powered by the Grayfish malware module-- also could resist deletion of a specific disk sector, or provide the attackers with the ability to swap a sector with a malware-ridden one.

The attackers also could use the infected drive to store stolen information until they siphon it to their own systems.

"This is what makes this group gods among APT actors. We have never seen anything close to this," Kamluk says. Knowing how to reprogram a hard drive would entail gathering intelligence from each vendor, which is no simple feat, he says. "Then it would take a very skilled programmer many months or years to master this."

"[This] shows us a level of sophistication that we haven't seen before, or maybe a few times in the past with Flame and Stuxnet," for example, says Jaime Blasco, head of AlienVault's security research team. "Whoever is behind this has access to a huge amount of financial and research resources, including access to sigint/humint capabilities that they clearly use in combination with the" tools, he days.

Blasco says the module that infects the hard drive firmware is "state of the art."

Then there's the module the Equation Group named "Fanny" that allows them to air-gapped computers, or systems that are not connected to a network. Kaspersky researchers first noticed this module after uncovering a case where a scientist attending a scientific and aerospace industry conference in Houston had been mailed a CD-ROM from the conference proceedings--but it had obviously been intercepted and rigged with Fanny malware, ultimately infecting his hard drive.

Fanny also comes via USB sticks, where someone physically inserts them into the air gapped machine to infect them. Kaspersky found a privilege escalation exploit that was used in Stuxnet being used by the Fanny worm.

The worm basically is aimed at gathering intelligence about the network topology of the air gapped environment and to then send commands to those systems. The USB stick itself stores commands from the malware in a hidden area of the device.

Raiu says the Equation Group is likely the only such attack group at this high level. And Kaspersky Lab's findings about them likely only scratches the surface of what they can do. "We haven't seen Mac or iPhone malware [from them], but we know it exists," for example, he says. "We're sure there's some Linux malware, too … and probably a lot of other stuff we have not found yet."

BY: Kelly Jackson Higgins for Dark Reading

Is this the future of cyberwarfare?

 

Five years ago, the most sophisticated cyber weapon the world had ever seen ravaged Iran's nuclear program. Allegedly developed by the U.S. and Israel, the complex virus infected the computer system that ran the centrifuges. Slight tweaks to the software caused hundreds of the centrifuges to self-destruct, setting the program back years. The malware was dubbed Stuxnet.

Traditionally, foreign governments have used malware to spy and steal. But this was something entirely different.

German computer security expert Ralph Langner helped decode Stuxnet.

“Stuxnet, it is a weapon, it’s not 'like' a weapon,” says German computer security expert Ralph Langner, who was the first to identify how the virus worked. “It is a weapon because it was designed to cause physical damage.”

Now, Langner worries that Stuxnet could come back to haunt the U.S. Those same vulnerabilities in Iran's nuclear control systems that the malware exploited can be found in similar systems throughout America. 

“These components are used in chemical plants, nuclear power plants, everywhere," Langner said. “We open Pandora's box without any idea, any clue, how we would deal with that when somebody turns that around. And that turnaround is only a question of time.”

But there are signs the threat that Langner has feared may have already arrived.

Espionage, then sabotage?

In early January, the world’s foremost experts in hacking and industrial control systems packed into a conference room in Miami for the buzziest event of the S4x15 security conference. The speaker was Kyle Wilhoit, a virus hunter who's been tracking the evolution of a sophisticated new threat known as BlackEnergy.

The Department of Homeland Security has identified BlackEnergy malware deep within the industrial control systems that operate critical infrastructure. Though BlackEnergy was initially designed to steal information, Wilhoit, a senior threat researcher at Trend Micro, believes it’s targeting some of the same types of industrial control systems exploited by Stuxnet. He fears this tool of espionage could be turned to sabotage.

Kyle Wilhoit tested BlackEnergy in his personal virus-hunting laboratory and found that it had the potential to be weaponized.

“The concerning aspect about this malware is that it’s modular in nature,” he says. “You can take a piece of destructive code and easily introduce it into Black Energy and weaponize it to be destructive.”

Malicious code could theoretically be used to manipulate the controls of pipelines, water purification systems, power generators and other critical infrastructure, resulting in real-world physical damage. That could mean blackouts or disruptions to an entire city's water supply. In short, it could be catastrophic.

While Langner decoded Stuxnet in 2010, the vulnerability of industrial control systems to such an attack was known several years earlier. In 2007, researchers at the Idaho National Laboratory launched a simulated attack called Aurora to see if they could damage a power plant by hacking into its control system. This video, released by the Department of Homeland Security under the Freedom of Information Act, shows how they were able to throw a power generator out of phase, causing it to self-destruct.

Experts worry that BlackEnergy could be programmed to do something similar, since its complexity hints at a highly skilled team of hackers with a broad technical background.

“The particular individuals that were writing this malware had not only IT security experience, but also engineering experience,” Wilhoit says. “The information that they're getting is very specific, and it's very specific to engineering technology.”

The next question, of course, is to discover who these hackers are. Finding out whether they're agents of a foreign government, an international criminal network or something else makes all the difference when it comes to fighting back.

From Russia with love

Russian President Vladimir Putin marches in a parade celebrating the public holiday Defend the Fatherland Day in 2013.

Jen Weedon and her team of sleuths at the cybersecurity firm FireEye have traced the targets and digital footprints of BlackEnergy to a well-known Russian-based group known as Sandworm. The group had previously used an earlier version of BlackEnergy to spy on targets of interest to the Russian government, including NATO and the Georgian government. But now, Weedon says, its target has shifted.

“The same group that was conducting political military espionage was also using BlackEnergy to get into critical infrastructure,” Weedon said.

While the malware has the fingerprints of the Russian government, Weedon can’t prove a definite link. After all, the Kremlin may have simply bought the malware from criminals. 

 ‘There’s no benign explanation for why somebody in Russia is interested in how the lights go on and off in Ohio.’  - David Smith director, Potomac Institute Cyber Center

As the adviser to Georgia’s minister of defense during the 2008 Russian invasion, Khatuna Mshvidobadze was on the receiving end of one of these Russian cyber attacks. Before Russian troops crossed the border, the country’s Internet was crippled by denial-of-service attacks traced to a shadowy cyber criminal gang: the Russian Business Network. 

Khatuna Mshvidobadze was an adviser to Georgia’s Minister of Defense during the 2008 Russian invasion.

“It was very hard to put our information in the website to reach the whole world [about] what's going on in Georgia,” she says.

For her husband David Smith, the director of the Potomac Institute Cyber Center, the timing of the cyber and military attacks suggested coordination.

“The Georgian war was kind of a watershed, because people kept trying to find [out], who did it? Was it criminals? Was it government?” he says. “The answer to both questions is yes. It's the Russian government using criminal groups.”

Smith believes the Russian government allows cyber criminals to operate with impunity in the country on the condition that they don't attack government interests and are ready and willing whenever state officials need their help.

“It's like having a reserve force and not paying a penny for it,” he explained. “When you need them, you've got an expert core of cyber warriors ready to go.”

But as BlackEnergy evolves to target industrial control systems, with the potential to physically damage American critical infrastructure, Smith believes Russia’s cyber-strategy is entering a dangerous phase.

“There's no benign explanation for why somebody in Russia is interested in how the lights go on and off in Ohio,” he says. “If you're asking me, is somebody preparing the battlefield against the United States and its allies? You bet somebody is.” 

Infiltrated infrastructure

According to a 2014 survey by ThreatTrack Security, the U.S. energy sector is hacked more than banks.

In his State of the Union address last month, President Obama warned about growing cyber threats: “No foreign nation, no hacker should be able to shut down our networks," he said. But critics say the cyber bill he's pushing Congress to pass, which would push companies to share information about network threats and expand the authority to prosecute online crimes, does little to force utilities to address vulnerabilities in the critical industrial control systems of America’s power grid.

“These devices are becoming more interconnected,” says Wilhoit. “They’re becoming more network connected, which then exposes them to a wider target base.”

And it’s not just the Russians who are discovering the potential Achilles' heel in American infrastructure.

“It’s alarming,” Weedon said. “BlackEnergy isn’t the first malware that we've seen in this space. We’ve seen some China-based groups that look like they’re probing related information.”

In fact, Weedon’s company FireEye has found 50 different types of malware that were targeting energy companies.According to a 2014 survey by ThreatTrack Security, a malware detection firm, 37 percent of businesses in the U.S. energy sector were infiltrated in the previous year. The Department of Homeland Security was alarmed enough to publish a special bulletin in December about the dangers posed by malware like BlackEnergy.

“I would say right now, I’m not sure we are prepared,” says Weedon. “This is a wake-up call.”

For five years, Langner has been trying to sound that wake-up call, but he believes America's utility companies aren't taking the threat seriously enough to make the necessary, and significant, investments required to truly protect critical infrastructure.

“We positively know they could be turned into sabotage campaigns," he warns. "We just cannot continue this way any longer. The bad news is, it’s going to cost money. Unless somebody is going to do that, nothing’s going to change."

by Aaron Ernst   @aaronernst

Security now one of the top risks for business leaders worldwide Posted on 10 February 2015.

Cybersecurity has come to the forefront of risk oversight for board members and C-suite executives, according to results of a survey of business executives by Protiviti and the Enterprise Risk Management (ERM) Initiative at the North Carolina State University Poole College of Management.

More than half of the global 277 survey respondents (53 percent) indicated that insufficient preparation to manage cyber threats is a risk that will "significantly impact" their organizations this year. Following a string of data breaches in the past year, cyber threats jumped to number three this year, up three rank positions in year-over-year survey results, reflecting increased concern about operational and reputational damage associated with potential breaches.

The survey findings suggest that while the business environment in 2015 will be somewhat less risky than in the previous two years, most of the business leaders surveyed indicated that they are more likely to invest in additional risk management resources in 2015.

The survey also identified differing perceptions between boards of directors and members of the executive team regarding the current risk environment; CEOs and boards of directors reported more optimism about risk issues while CFOs and chief audit executives perceived a more risky business environment.

"While regulation continues to be top-of-mind for business leaders worldwide, there are emerging risks that are receiving increased consideration and attention. Based on our ongoing conversations with boards and executive teams, we added five new risk areas for participants to rank in the survey this year. Two of these made it to the top 10 risk list: one focused on organizational culture and its ability to encourage identification and escalation of risk concerns and the other on customer retention in the face of evolving customer preferences," said Jim DeLoach, a managing director with Protiviti. "The top-10 ranking of these two risks indicates a shift in mindset and priorities for corporate leaders. As a result, we expect there will be increased oversight in these areas at the board level during the next year."

The top 10 risks for 2015

Following are the top 10 risks identified in the annual risk survey, along with the percentages of respondents who identified each risk as having a "Significant Impact" on their business.

Regulatory changes and heightened regulatory scrutiny may affect the manner in which our products or services will be produced or delivered (67 percent)

Economic conditions in markets we currently serve may significantly restrict growth opportunities for our organization (56 percent)

Our organization may not be sufficiently prepared to manage cyber threats that have the potential to significantly disrupt our core operations and/or damage our brand (53 percent)

Our organization's succession challenges and ability to attract and retain top talent may limit our ability to achieve operational targets (56 percent)

Our organization's culture may not sufficiently encourage the timely identification and escalation of risk issues that have the potential to significantly affect our core operations and achievement of strategic objectives (51 percent)

Resistance to change may restrict our organization from making necessary adjustments to the business model and core operations (49 percent)

Ensuring privacy/identity management and information security/system protection may require significant resources for us (52 percent)

Our organization may not be sufficiently prepared to manage an unexpected crisis significantly impacting our reputation (46 percent)

Sustaining customer loyalty and retention may be increasingly difficult due to evolving customer preferences and/or demographic shifts in our existing customer base (48 percent)

Our existing operations may not be able to meet performance expectations related to quality, time to market, cost and innovation as well as our competitors (46 percent). 

Who’s Attacking Whom? Realtime Attack Trackers

From Brian Krebs  Krebsonsecurity.com

It seems nearly every day we’re reading about Internet attacks aimed at knocking sites offline and breaking into networks, but it’s often difficult to visualize this type of activity. In this post, we’ll take a look at multiple ways of tracking online attacks and attackers around the globe and in real-time.

A couple of notes about these graphics. Much of the data that powers these live maps is drawn from a mix of actual targets and “honeypots,” decoy systems that security firms deploy to gather data about the sources, methods and frequency of online attacks. Also, the organizations referenced in some of these maps as “attackers” typically are compromised systems within those organizations that are being used to relay attacks launched from someplace else.

The Cyber Threat Map from FireEye recently became famous in a 60 Minutes story on cyberattacks against retailers and their credit card systems. This graphic reminds me of the ICBM monitors from NORAD, as featured in the 1984 movie War Games (I’m guessing that association is intentional). Not a lot of raw data included in this map, but it’s fun to watch.

FireEye’s “Cyber Threat Map”

My favorite — and perhaps the easiest way to lose track of half your workday (and bandwidth) comes from the folks at Norse Corp. Their map — IPViking — includes a wealth of data about each attack, such as the attacking organization name and Internet address, the target’s city and service being attacked, as well as the most popular target countries and origin countries.

Norse’s IPViking attack map is eye candy-addictive, but very resource-intensive.

Another live service with oodles of information about each attack comes from Arbor Networks‘ Digital Attack map. Arbor says the map is powered by data fed from 270+ ISP customers worldwide who have agreed to share anonymous network traffic and attack statistics. This is a truly useful service because it lets you step back in time to attacks on previous dates going all the way back to June 2013.

The Digital Attack Map from Arbor networks is powered by data shared anonymously by 270 ISPs.

Kaspersky‘s Cyberthreat Real-time Map is a lot of fun to play with, and probably looks the most like an interactive video game. Beneath the 3-D eye candy and kaleidoscopic map is anonymized data from Kaspersky’s various scanning services. As such, this fairly interactive map lets you customize its layout by filtering certain types of malicious threats, such as email malware, Web site attacks, vulnerability scans, etc.

Kaspersky’s Cyberthreat Real-time Map is probably the closest of them all to a video game.

The Cyberfeed, from Anubis Networks, takes the visitor on an automated tour of the world, using something akin to Google Earth and map data based on infections from the top known malware families. It’s a neat idea, but more of a malware infection map than an attack map, and not terribly interactive either. In this respect, it’s a lot like the threat mapfrom Finnish security firm F-Secure, the Global Botnet Threat Activity Map from Trend Micro, and Team Cymru‘s Internet Malicious Activity Map.

The Cyberfeed from AnubisNetworks takes you on a global tour of malware infections.

The Honeynet Project‘s Honey Map is not super sexy but it does include a fair amount of useful information about real-time threats on honeypot systems, including links to malware analysis from Virustotal for each threat or attack.

The Honeynet Project’s Honey Map

Additionally, the guys at OpenDNS Labs have a decent attack tracker that includes some nifty data and graphics.

Data from OpenDNS’s Global Network graph.

If all these maps are a bit too Hollywood for you, then you’ll love the simplicity and humor behind PewPew, which derives its name from the added sound effects. Might want to turn the volume down on your computer’s speakers before visiting this map (especially if you’re at work while viewing it).