| Invisible threats have a way of eventually sneaking up on you |
 |
|
JULY 31, 2008 | What you can’t see can hurt you -- and most likely, it already has. By now, your credit card number is probably sitting somewhere on a crime server, either already compromised or ripe for the picking. But since we don’t actually see this happen nor can we put a face to the perpetrators, it’s easy to dismiss the threat or ignore it altogether -- until we feel it in our wallets. The stakes are higher than a compromised credit card account, however. There’s a cyberspace Cold War going on right now between the U.S. and two countries-who-must-not-be-named (two guesses), according to a commissioner on the Commission on Cyber Security for the 44th Presidency, which is working on policy, research, and technology recommendations for the next administration to combat cybercrime and cyber warfare. (See Cyber Security for the 44th Presidency Group to Come Out of the Shadows at Black Hat.) Try bringing that up at a cocktail party, and you can kiss your car keys goodbye. We live in a society in which seeing is believing. If it’s intangible and we can’t view it on YouTube, it must not be real. But the cyber security commission, which is made up of a who’s who of experts and policymakers (some are so top secret they can’t be named), is about to give the U.S. a serious reality check with a major report on recommendations for how to fight cybercrime and cyber warfare. Congress and the Presidential candidates will get first dibs on the report, which is due within the next two months. Several members of the commission will sit on a panel at Black Hat USA next week to give attendees an update of their progress so far, and to unofficially launch a public awareness campaign of just how serious this mostly invisible threat really is.A couple of tidbits: over 100 countries around the world have dedicated cyber attack groups, and in many developing countries, cybercrime is institutionalized like the drug cartels of the 1970s and 1980s, according to Tom Kellermann, one of the commissioners who will participate in the panel at Black Hat. If the vision of a raging Cold Cyber War or cybercrime cartels isn’t enough to shake you out of denial, there’s another silent but deadly series of attacks, happening every day on Websites. And no, you can’t stop them with an IDS, block them with a Web application firewall, or patch for them. Famed Web application security researcher Jeremiah Grossman and colleague Trey Ford have unearthed several cases of so-called logic flaw attacks, where bad guys capitalize on weaknesses in the coding of a Website app, or in the handshake between Web applications or business processes. They are making big bucks, too: up to seven figures a month using these methods of attack, some of which are a decade old and can’t be detected. (See Hacking Without Exploits.) Grossman and Ford will demonstrate some real-world attacks using these low-tech hacks that don’t require ninja hacking skills, tools, or exploit code. All you need is a browser. Even if you can see a threat with your own eyes, it’s not always easy to discern. Take video surveillance cameras. There are typically too many of them for one security guard -- who may be watching dozens or hundreds of them at once -- to spot suspicious activity as it occurs. In many cases when there are so many cameras to monitor, it’s more about luck in spotting something going down. But a new company headed up by a former Secret Service agent has created a technology that converts video images into machine-readable language and analyzes any unusual activity caught on camera that would suggest suspicious behavior. (See New Video Surveillance Technology 'Recognizes' Abnormal Activity.) The new software from Behavioral Recognition Systems, or BRS Labs, works a lot like behavioral analysis software that looks for malware or other suspicious activity in networks. We don't always get a visual aid to keep us on the watch for threats, especially the ones online. So sometimes you just have to believe what you can't see. |
