CanSecWest: Let’s talk about non-targeted attacks

Today is the last day of CanSecWest – a security conference taking place in Vancouver, Canada.
On Wednesday I filled in for Costin Raiu and talked about our forensics work into Duqu’s C&C servers.

As I’m writing this, Google Chrome just got popped. Again. The general feeling is that $60k, even with a sandbox escape, isn’t a whole lot of money for a Chrome zero-day.
So, to see multiple zero-days against Chrome is quite the surprise, especially when considering the browser’s Pwn2Own track record.

Separately, I found the Q&A session following Facebook’s Alex Rice’s presentation immensely intriguing.

Alex presented on Facebook’s social CAPTCHA, a secondary authentication step that uses friends’ photographs that kicks in when Facebook suspects a compromised/phished account.

The introduction of this system has meant that mass Facebook phishing attacks have gone away. They’ve become ineffective.

However, during the Q&A, there were a lot of comments about how this system can be circumvented in a targeted attack.

Clearly, any system which simply eradicates an entire ‘class’ of attack, while not really impacting user experience, should be considered a huge success.

Facebook should be applauded for their solution, but instead they mostly got criticism from the audience.

Seeing so much criticism is extremely worrisome. We shouldn’t be dismissing ideas or systems simply because they’re not particularly effective against targeted attacks. It’s not always black or white.

After all, the vast majority of (cyber-)crime is not targeted. Let’s not forget that.