Tag Archives: Victor Sheymov

The secret reason behind the Chinese hacking

Leave a reply

For quite some time I’ve been puzzled by the alleged Chinese hacking of our databases. I could understand if they hacked our advanced research and development– that would save them time, effort and money. But why the databases? Then it dawned on me: it’s a savvy business strategy.
We routinely encounter problems with our databases. One organization can’t find our file, another somehow has the wrong information about us, and all too often they certainly can’t get their act together, and we see classic cases of the left hand not knowing what the right one is doing . The pre-9/11 non-sharing of intelligence is a good illustration. In other words, we have a somewhat messy general situation with our databases; we’re used to taking this in stride; and we just sigh when we have to deal with some organization that accuses us of something we aren’t guilty of.
The Chinese understood the problem, but they just never got used to it. For many centuries they had a much bigger population than other countries, but somehow they always managed to know exactly who is who, who is related to whom, and what he/she is doing.
So naturally they wanted to have the same level of knowledge about the rest of the world. To their dismay, in the US they found disorganized databases and mismatching records. So they had to process all that information to make sense of it for themselves. And suddenly they saw a perfect business opportunity: they would develop a gigantic and very efficient database of the US, and then sell this data back to us piecemeal, retail. This would give them full and exact knowledge of the US, and the US would pay for the project, with a significant profit for the Chinese. For us this would be a very valuable service, a kind of of involuntary outsourcing where we (both the Government and the private sector) can get relevant and reliable data at a modest price. Makes perfect business sense.
This approach has a special bonus for the US Government: when buying data abroad they won’t have to deal with privacy restrictions imposed by the US Constitution and constantly debated by Congress. The logic is impeccable: we bought it abroad, and if the Chinese know it, we are entitled to know what they know about us.

EU Cyber Incompetence

Leave a reply

Utter incompetence of high-level officials is not exactly a scarce phenomenon. However, it’s rarely displayed so vividly as it was by Troels Oerting, the head of Europol’s Cybercrime Center, in his recent interview with the BBC’s Tech Tent radio show.
Mr. Oerting proudly declared that international law enforcement just needs to target a “rather limited group of good programmers.” He went further, proudly stating “We roughly know who they are. If we can take them out of the equation then the rest will fall down.” Voila, easy and simple. Arrest the 100 known dudes and cybercrime disappears. He didn’t specify what it means to know “roughly”–you either do or you don’t, and that is exactly, not “roughly.”
The man obviously hasn’t a clue. The trouble is that he’s speaking for Europol and the EU. And the idea that the EU’s main cybercrime law enforcement unit assesses the cybercrime situation this way is truly troubling. It would simply mean that the cybercriminals don’t have much to worry about.
The reality is drastically different. There are many thousands of programmers around the world good enough to hack most of the attractive targets. Many of them, for one reason or another, are disappointed with their employment or personal situation. Given the current dire state of our cybersecurity, making a few bucks off easy targets is really tempting. This temptation looks even more attractive if the target is a rich bank or some large allegedly unethical company. This often satisfies the conscience of many of the hackers. The continuing deterioration of the European economy worsens the situation.
Add the “script kiddies” to the equation and Mr. Oerting’s job becomes even harder than he probably can envision in his worst nightmares. He should also know that really good programmers only publish their crumbs for the script kiddies, scripts they developed long ago. They keep their best stuff for themselves.
Furthermore, many of these off-the-grid programmers have their own very large botnets capable of performing rather sophisticated operations that they can offer to all sorts of customers as a service.
All in all, Mr. Oerting should urgently realize that he is mainly dealing with the mediocre cybercriminals who are not good enough to be stealthy. Really good “top-100” programmers don’t get caught. I wouldn’t be at all surprised if one of them, having read Mr. Oerting’s statements, would hack his next target through this top EU cyber cop’s computer, just to demonstrate the point.

Cyber Backdoors: myth and reality

Leave a reply

Every day we read articles on cybersecurity and privacy referring to “backdoors.” This term needs some clarification. I’ve seen all sorts of explanations of the term and its origin, including even linking it to Internet pornography. While the current situation in cybersecurity is certainly reminiscent of pornography, the origin and nature of cyber backdoors is very different.
The term is borrowed from residential architecture and means just what it says. It’s not the supposedly well-protected “front door,” but a relatively obscure entrance for casual private use, commonly having weaker protection for the residents. In cyber systems it’s exactly that: a supposedly secret entry point supplementary to the main entry point to a system, granting simplified logon procedures with deeper access to those in the know.
And that’s where the real problem lies.
First of all, any additional entry point to a network inevitably weakens a system’s security. The more entry points there are the more difficult it is to arrange and manage security. So, point one here is that even the very fact that any backdoor exists automatically weakens the security of a network.
Secondly, simplified entry procedures for the backdoors always mean they have weaker security than the front doors. For example, it’s not uncommon to have a backdoor to a network that creates a shortcut around a stronger VPN (Virtual Private Network) system protecting a front door, with the backdoor protected by a firewall that is always more vulnerable. So, point two here is that the common setup of a backdoor weaker than the front door always compromises the system.
Now, what’s the rationale for creating backdoors? For hackers, it’s pure and simple: it allows perpetual deep and undetected access to the system. The only risk is that it can be discovered and eliminated. So what? The hacker can simply make a different backdoor. With the Government it’s a totally different story; they seem to think that if a company creates a backdoor for them it’s for the Government’s exclusive use. The problem is that if a backdoor exists it can be discovered and hacked by anybody.
Believing that a backdoor is exclusive is fundamentally flawed. It’s as flawed as the wishful thinking in some government circles that they can develop a cyber security technology that they alone can hack. This is an arrogant assumption that historically has been defeated time and time again. You are never the smartest guy on the planet. Period.
So, in addition to all other issues involved in the Government’s pursuit of backdoor data collection, the uncomfortable but obvious conclusion is that by requiring backdoors they further weaken the already weak enough security of our networks, making them easier prey for any attacker.

JPMorgan Chase Tooth Fairy Hack

Leave a reply

JPMorgan Chase is the latest victim of a cyber attack. The company announced that unknown hackers broke into their computer system and stole over 80 million customers’ names, addresses, phone numbers and email addresses. This is a really odd announcement for a serious company. Believing that a hacker broke into a bank’s system only to get what he can get from the White Pages is more naïve than believing in the Tooth Fairy. It’s like believing that a burglar broke into the house just to look at the clock because he lost his watch.
The company somewhat hedged its conclusion by stating that there’s no evidence of hackers stealing anything else, but still assuring their customers that there’s nothing to worry about.
The reality is that this tells us that whoever did it is a competent hacker. He either obtained all the financial data right away and covered his tracks well enough that neither JP Morgan nor the FBI could find anything, or left malware that will be sending him that data later. This type of malware is extremely difficult to detect, and the JP Morgan/FBI failure is typical.
This is also indicative of a well-heeled hacker who is financially already very comfortable and can afford to wait until a later date when he can safely start milking the golden cow.
The scariest part of this story is that if this hacker is so good technically and astute financially JPMorgan Chase and its millions of customers are in for a very interesting future. At this time most banks can afford to absorb losses from cyber fraud (but of course passing on the cost to us in interest and fees). It remains to be seen for how long this is going to be the case.

Dawn of Cyber Reality

Leave a reply

It’s being presented as mainstream media shockers that a Russian cyber gang stole 1.2 billion cyber identities, including user names and passwords, or that somebody stole 4.5 million hospital records including including addresses, birth dates and social security numbers. How awful!

Now, a good reality check is clearly in order. The alleged Russian criminal gang of less than a dozen members comes from a small town in the middle of Russia that most people never heard of. By any measure this gang is nowhere close to the top of Russian cyber criminal outfits, never mind the government spooks of many countries. If they managed to get all the data reported, there’s absolutely no doubt that higher-level cyber attackers have much more — they just prevent others from finding out about it. Actually, it’s usually wisest to hide your success in any intelligence operation or theft.

The current cyber reality is that practically all user data is stolen. One of the qualities of cyberspace is that the same cyber asset can be stolen multiple times by multiple perpetrators. In other words, in the physical world a burglar can steal your asset only once; in cyberspace it can be stolen many times by multiple cyber burglars. So understand: whether you like it or not, all user data is stolen by many attackers, including multiple cyber gangs and, of course, by several countries’ spooks.

The real question isn’t whether user data is stolen, nor who stole it—it’s what to do about it. And, in another reality check, it’s being recognized by more and more “experts” that nothing can be done about it beyond fuming until we finally get to develop a real cyber security. Indeed, what difference does it make who stole your assets? There is none, unless you have a preferred burglar for your house.

So, it looks like all this hype about stolen identities is no more than a lot of hot air until we develop a cybersecurity technology that actually works. Then we can seriously discuss the issues now hotly and fruitlessly debated in apparent perpetuity.

 

Don’t Blame the Hacking Victim; Blame the Cyber Security Product

Leave a reply

“People are the weakest link in security” is an adage that has proven valid over the centuries. It’s also a common rationale for explaining cyber security breaches. It sounds like a pretty convincing explanation, but is this proposition really true?

There’s one important factor in these historical failures: otherwise good security systems—i.e. if a human being had not made a mistake, the system would have remained undefeated. That’s a fundamentally different situation from what we have now with our legacy cyber security systems. These systems are built on current technologies that have for some time been well proven to be thoroughly flawed. Virtually every firewall and router delivered to the first customer has already been hacked, and thus proven unfit for their intended purpose even before they are installed. The human factor in cyber security is only a very convenient excuse for the failure.

But clearly, the human factor is not the real reason for the failure.

Router vulnerability is especially critical because it can be exploited to perform “man-in-the-middle” cyber attacks that can very quickly cripple entire networks. Router manufacturers regularly blame their customers for failing to reset the default password on the router. Never mind that the new password would delay a competent hacker by just a few minutes at best. But officially it’s the customer’s fault and “human failure” is the cause.

Blaming the customer for equipment failure is not generally a successful business strategy, but, cyber security companies somehow manage to get away with it – perhaps because of the still somewhat mysterious nature of cyberspace.

There’s a very simple conclusion to be drawn here: currently available cyber security technology is not anywhere at the level where the “human factor” is the weakest link. The weakest link is the fundamentally flawed cyber security technologies that fail well before the “human factor” can even come into play.

So, stop blaming the customers. The real cause of the failure is the human factor of those who are supposed to protect our cyberspace assets with real security technologies but consistently fail to do so –while charging their customers heftily for products that are known to be unfit for the purpose.

VCC -Variable Cyber Coordinates

2 Replies

In my previous posting I mentioned VCC – Variable Cyber Coordinates method of communication. In response to questions from readers the following is a an article on the subject in Wikipedia (April 25, 2014).

Variable Cyber Coordinates (VCC) is a method of network communications by which the cyber coordinates of the participating objects or entities are constantly changing. It provides an algorithmic foundation for the dynamic security of network devices against network-based cyber attacks.

Cyber coordinates are sets of statements that determine the position of an object in cyberspace. For instance, an IP address singularly determines the location of a computer within the Internet. Cyber coordinates enable computers connected to the Internet to “find” each other and to communicate, much in the same way that knowledge of geographic coordinates of a location on Earth enables guidance of an object to travel to that location. Essentially, any communications parameter can be viewed as a cyber coordinate. Other examples of cyber coordinates are computer Port numbers, MAC addresses, telephone numbers, file names, radio calls, etc.

With the VCC method of communications cyber coordinates of participating objects or entities are made variable. They are assigned temporary values, often random or pseudorandom. These temporary cyber coordinates are usually encrypted and distributed only to authorized devices. Authorized devices can communicate with each other using the currently valid set of cyber coordinates. Other devices on the network that are not privy to the currently valid set of cyber coordinates, cannot communicate with the authorized devices. However, a determined attacker with sufficient resources, effort and time can identify the currently valid cyber coordinates. To prevent this, the currently valid set of cyber coordinates is periodically changed. The process is repeated at predetermined or random intervals sufficiently frequent to prevent a potential attacker from finding the protected devices and launching a successful attack.

An example of a simplified explanation of the VCC method of communications is illustrated in Fig.1.

Variable Cyber Coordinates
Fig.1

       The black line denotes regular computer communications;
       The red arrow denotes distribution of currently valid variable cyber coordinates.

In this example computer A is assigned an IP address xxx.xxx.xxx.123. Only computers B and C are authorized to communicate with computer A. Thus, computer A’s current IP address xxx.xxx.xxx.123 is sent to B and C only. Since computer D has not been sent A’s IP address, it would be difficult for it to determine A’s IP address. Thus no computer except B and C can communicate with A. The controller assigns cyber coordinates to protected computers and ensures their compatibility with the network administration’s policies and procedures.

To further strengthen computer A’s protection, A’s IP address is at some time changed to xxx.xxx.xxx.234. While not affecting A’s physical location, it moves it to another cyber space location. The new coordinates are sent to B and C, but to no other computer. Then even if computer D has made some progress in identifying A’s cyber coordinates, this progress is instantly obsolete with every new cycle of changing A’s cyber coordinates. Using the VCC methodology enables protected computers to evade cyber attacks even before they are launched.

Real VCC-based systems are much more complex than the example above and involve changes of multiple cyber coordinates for computers based in different networks.

The VCC method of communications was invented by Victor Sheymov and patented in 1999.