Bookmark This Post!

I just heard on the car radio a news/commentary mention of a great new development (sarcasm). Some outfit has, after years of diligent testing, completed the design and successful adjustment runs of a driverless tractor trailer rig fleet. Planned to provide over-the-road delivery between Dallas and Houston soon, I seem to recall that it's got a dozen or two huge semi's that have driven themselves (with human observers) along the mapped-out areas enough times to prove the concept.

The radio commentator claimed that there were two sorts of people responding to this: those who were very much in favor and those that were concerned about possible hazards to other vehicles along the way.

Naturally, the commentator forgot a third (probably small) group. There just might be a few persons wondering if anybody put a great deal of effort into securing the devices, applications and networks used by this enterprise.

SECURING THE DEVICES etc. etc...

Anyone feel like a little wager as to how many of the trucks are already hosting a few spam servers? But don't worry. Nothing else could possibly go wrong.

Emerging Trends In Computer Security

There are many articles offering surveys of the cybersecurity landscape. One of the better ones I've seen in recent weeks would be this one. TechJournal.org proposes ten areas to watch. This article surfaced in January of this year and I can't see it as having been disproven yet. Here's a simplified, skeletal restatement of TechJournal's longer investigations of these subjects:

1. Cyber Deception Technologies
You've heard of honeypots and honeynets? Decoy construction is improving as machine learning and AI are being introduced here.

2. Homomorphic Encryption for Secure Data Processing
Suppose data that's encrypted could also be processed in that state, without decryption? It's becoming practical - hopefully without occurring within insecure applications...

3. Behavioral Biometrics In Authentication
Suppose an authentication system could take into account your finger swipe tendencies, or your keyboarding speed? They could be grouped with a passphrase for greater security - assuming the form of storage of those biometrics was also secure.

4. Secure AI Development Frameworks
Since writing AI applications is best done securely, why not use AI-enabled code review programs?

5. Advances In Threat Intelligence Sharing
Using blockchain to create communications channels between defense agents could increase the integrity of intelligence by many multiples.

6. Cybersecurity For Space Systems
From missile targeting and battlefield situational awareness to weather forecasting and logistics tracking, satellite groups are being deployed in increasing numbers. The operation of these units requires continuing improvements in burst approaches, compression/expansion and cryptology.

7. Securing The Internet Of Things
How likely is it that a $20 webcam will be provided with timely updates, updates at all or even an updater at all?

8. Quantum-Resistant Cryptography
Algorithmic resistance to the evident power of quantum computing is becoming a reality, and not a moment too soon.

9. Enhanced Email Encryption Solutions
Certificate strategies and key generation methods need to be constantly improved in order to preserve the practicality of this oldest of computer communication forms.

10. Zero Trust Architecture
Begin device connection with the assumption of compromise.

Drones: Updates & Speculations

The now-not-so-current flurry of drone stories re: activity off Atlantic City or somewhere is still quite pertinent, in that many of us are aware that many questions remain unanswered.

My brash guess is that what really happened (other than an actual peak in drone presences) was a lack of preparation at the public relations departments of the FAA, the White House staff, the Coast Guard and local police agencies. I think it's actually pretty difficult to keep track of hundreds of cheap helicopter toys across the state of NJ between Philadelphia and the coast even in the least stressful of times. And our capabilities to do so are matters we might best keep a lid upon.

But what's a public relations officer to do?

If I were that officer (and I used to have a vaguely similar job somewhere), I'd simply point out that if a foreign navy were capable of sending a cruiser over this way with a Remotely Operated Vehicle hanger near the poop deck, and that the Captain of said vessel sent out the odd $50,000 drone... then might WE BE CAPABLE OF THE SAME THING?? And capable of watching said operations from an either HF wireless or even tethered observation device from an Ohio-class low rider a few hundred feet down or so?

Perhaps.

A New Type Of Spam?

So an insurance salesperson (via a cold call over the phone) conned me into connecting in a Zoom call in which I revealed personal connections and email addresses.

Now, I'm actually NOT a complete idiot. The salesperson (and her higher-pressure sales manager) not only were pretty good at the act (a sort of HR upper managerial style of behavior) but they had an interesting bit of inside information: they worked for an insurance company that was the provider of a free benefit from my current employer, so they were able to pretend to be legit, and to have a need to update information on beneficiaries and so forth. They were just trying to upsell, not to steal. Clever, huh?

I still consider the call a kind of breach, although not the sort we're most fearful of. And the salesgirl was actually what she claimed to be (local), which I determined by her geographical references, slang, dress and accent. The AI that can fake all that stuff has to be two or three years away. Okay, maybe one.

It was my first "insider threat" experience in years. It was fascinating. More of an invasion of privacy than a perimeter breach, but a reminder that, shall we say, rust never sleeps.

Preliminary Post on Drones

There's a bit of a to-do these days about large groups of unidentified drones being reported in New Jersey. Theories abound, from US government tests to foreign powers sending them in from offshore to swarms of domestic drones, some trying to follow others. An interesting aside (underreported) is the group of legal ramifications now being identified. Drone presence is outside a property owner's purview, occuring in FAA-controlled space. Also, it's a crime to damage or destroy any flying vehicle, even a $25 drone. So there seems to be little way to defend against a recalcitrant drone, perhaps even one bearing a grenade. The two thoughts that occur to me regarding defense (other than jamming) would be either to lase various sensors on the drone's frame, or to snare the vehicle with a net or grapple from another drone. Of course, all of the above might be considered illegal interference by the FAA.

As might be the case if one were to hack the control telemetry of the drone, taking over the device and landing it without destruction.

I'm no lawyer, but it looks like there's room for precedent here. Perhaps someone should jam a drone's control communications, hack and land the device and then wait for the owner to file suit. I doubt, after all, that these devices are designed to follow Asimov's Laws Of Robotics, which are as follows (see the story "Runaround" (1942) and later publications like the book "I, Robot"):

(1) A robot may not injure a human being or, through inaction, allow a human being to come to harm
(2) A robot must obey the orders given it by human beings except where such orders would conflict with the First Law
(3) A robot must protect its own existence as long as such protection does not conflict with the First or Second Law
(4 or zeroth) A robot may not harm humanity, or, by inaction, allow humanity to come to harm.

We live in interesting times.

Book Review: Philip Wilie

I attended a computing industry conference recently and got a free copy of Philip Wilie’s “The Pentester Blueprint”. In my opinion, “pentester” isn’t so much a job description as it is an Additional Duty As Assigned to somebody already working on a project or at an existing job. It’s nevertheless important, so I grabbed the gratis copy. The first four chapters were so basic I assumed that the target audience of the book was management, since only mention was made of tools used and very little procedure or strategy was discussed. A few points were important in legalistic senses, such as the absolute need for preparation if challenged during break-in attempts, virtual or real. One needs immediate contact information to customer authorities and admins, plus written permission to engage in penetration testing. But most of these first four chapters related to definitions and background issues. Chapter 4, Education Resources, was helpful in that it contained descriptions of organizations (like OWASP) with which I was familiar, but told of aspects of those groups I’d not known. Prior to chapter 5, though, I was losing hope regarding a new experience of any kind.

Chapter 5 provided quite a surprise. Its title, “Building A Pentesting Lab”, had me expecting a cooking recipe sort of approach, relying on hardware and software recommendation lists like many other books have done. But the chapter didn’t take that route, instead containing interviews with working admins and testers who described how and why they put together their specific systems (revealing as much as possible without violating confidences). Rationales were provided for what tools and hardware were included. And they varied considerably. If you’re doing web application security, you may need only a couple of laptops. But if you’re looking at industrial control systems, a whole virtualized network or three would be a good idea – and constructed with the specific type of PLC host (programmable logic controller) you’d be trying to research, defeat and then protect. This interview-based discussion method by Wilie is one I’ve not seen used in the computer books I’ve read, but I’ve seen it used by first-person accounts in 2600 Magazine. AND Wilie mentions that magazine in a resource section of his book, making this the first time I’ve ever seen that happen. If you know, you know.

I could go on, but this middle-of-the-book switcheroo by Wilie totally fooled me. I didn’t think he would deliver the goods for quite awhile, but I continued plodding along. It paid off. Consider “The Pentester Blueprint” if you see it, since it informs those of many other job descriptions than just the one of the title.

SO Obvious... but Sadly Needed To Mention Anyway

I must note at least one point about the recent prohibitions/restrictions upon certain software (at least in the US). Last Thursday the Biden Administration placed a ban upon sales of software from the Kaspersky company due to possible risks from the Russian government's access to telemetry or results from such software (like antivirus products). This recalls similar moves against Tik Tok, a social media platform with ties to China, indirect though they may be.

I'm not a lawyer but as I understand it, both situations mentioned above are questionable since the owner/operators of the programs/platforms have some connection to offshore entities (governments). This means that there exists a channel or channels possible to exfiltrate information from US users to potentially hostile or competitive interests which would not exist in many or most other products. That's the empirical point here - the channels exist.

There's also a legal point. If and when such channels are used to exfiltrate anything from domestic US users to any offshore location/entity, any number of violations of export restrictions could happen. And although the specifics of the exfiltering operation may not be mentioned by current legislation, the intent if not the letter of the law could easily be at risk here.

And there's an additional empirical point: if a channel exists via which domestic user information could be snatched, what's to prevent the curious third party (domestic or foreign) from discovering that channel? So here's the list of issues that impelled me to comment: first, we have potentially insecure communications situations present in certain software. Second, legal risks are created by the existence of said com situations. Third, the com situations create potential vulnerabilities that would be discoverable by any additional organization with the analytic capability to search for them.

I thought it was needed to overtly mention these points so as to contribute to the national-security-VS-free-speech debate (my own position being that free speech protections would not apply where national security concerns are objectively demonstrable).