Blackhat 2014 Floating Big in the Cybersecurity Bubble

Blackhat2014 USA was held at the Mandalay Bay, Las Vegas, after being held at Caesar’s for the past 15 years or so. While the location wasn’t central like Caesar’s, the hotel was more spacious, easier to navigate, cleaner, and generally an improvement.

Jeff Moss inspired the Blackhat 2014 crowd with his introduction, and suggested that we are in a bubble that will pass. The cybersecurity crowd not only is finally taken seriously, but has never been more relevant, and is close to its peak of relevance. Access control manufacturers, medical device makers, automotive producers like Tesla, all of these enterprises are now not only listening. They are baking security better into their production processes, and this is good. We have made some progress. But with this relevance, when we look back, what can we say we contributed?

Dan Geer’s rich keynote wound through a long list of policy proposals for a set of current cybersecurity challenges. Although I can’t agree with everything he says, he is one of my favorite thinker-speaker-writers in the space and I find myself seeking out his talks. Interesting topics included mandatory reporting on cybersecurity failures on a national level, strikeback, resiliency, and the right to be forgotten. There were more. Many more. A text version of “Cybersecurity as Realpolitik” is online, and I recommend setting aside a block of time for dense, thoughtful material like this.

Dan supports mandatory reporting for breaches as laid out in “Surviving on a Diet of Poisoned Fruit”, and real support for a cybersecurity failure reporting regime. He laid out current precedent in relevant law requiring reporting for other subject matter, and basic examples of why it would work. The CDC’s communicable disease reporting and Mitre’s anonymized near-miss aviation reporting center are strong examples of systems where self reporting on sensitive events, communicable disease and airline flight near misses, is both working and beneficial. He made the strong case that such a collection of cybersecurity data can be practical and is highly valuable, and it is time for national government or quasi-governmental entities to support transparent, anonymous collections.

The legitimacy of defensive strikeback is something that Dan dismissed onstage for strange reasons, but his text version gives it a LIMITED YES. He claimed that while Microsft and the Fbi are pulling off examples of successful strikeback activity, smaller organizations do not have the means to properly perform a strikeback effort. This is strange because small businesses can pool resources when they are under attack, co-ops and other pooling structures can help solve that problem. The US Chamber of Commerce, for example, is an incredibly powerful organization partly acting on behalf of small businesses pooling resources to get things done. The Chamber is incredibly powerful in the US, and small businesses benefit in some ways from some of those efforts (and perhaps suffer from some of them as well). And he didn’t address the idea that strikeback doesn’t need to be messy, extremely destructive, or sustained to put a quick end to a variety of attacks. But remotely stopping a large scale DDoS attack launched from compromised servers does not necessarily require attribution, and certainly does not require very messy or destructive solutions. They can be precise, and attribution is often possible. Everyone makes mistakes. He mentioned that difficulty in attribution compounds the problem. The bigger issue here is that these events cross multiple jurisdictions, definitions of law, and law enforcement organizations. And for some activity that would be otherwise criminal in different parts of the world, there is little if any enforcement.

Dan’s take on the right to be forgotten brings out some unsettling Foucaltian subject matter, “I’ve spoken elsewhere about how we are all intelligence agents now, collecting on each other on behalf of various overlords” and that he wants to maintain some rights in the digital world to defend privacy, “I want to choose whether to misrepresent myself”. But it’s refreshing to hear a thought leader describe his desire and right to hop out of the digital panopticon.

Kaspersky Lab’s Vitaly Kamluk, Sergey Belov, and Cubica’s Anibal Sacco presented on “Absolute Backdoor Revisted”, a surprising update on the state of security for a widely deployed low level utility. They presented a set of unusual behaviors implemented by this software that I rarely see exhibited by legitimate software but very frequently by malware. And then they abused it in multiple live demos, remotely wiping a brand new Windows 8 x64 laptop just out of the box via Absolute Computrace vulnerabilities.

Several years would seem to be ample opportunity to fix severe problems in update mechanisms, and it seems that the work has recently begun in response to the research review.

Web services came under serious attack this year. “Pivoting in Amazon Clouds” from Andres Riancho was interesting in light of the recent attacks on Elasticsearch sites abused in the Amazon cloud, demonstrating post-exploitation issues that enable attackers to further burrow into the cloud. He released a nice Nimbostratus tool and Hacme environment that aided his past penetration tests and EC2 security issue understanding. And Mobile Device Management systems were demonstrated to be chock full of web application problems with SQLi, poorly chosen crypto and encoding schemes, and poorly designed custom authentication schemes briefly put on the screen by Stephen Breen in “Mobile Device Mismanagement”.

Finally, if you find a minute to get away from the Defcon fun, check out the Epic Turla report and IoC release (pdf) from GReAT that was published during Blackhat this year.