Devi fare il budget sulla sicurezza informatica? Se sei stato fortunato: ti sei preso un ransomware

Devi fare il budget sulla sicurezza informatica? Se sei stato fortunato: ti sei preso un ransomware

ho pensato che sia cosa utile fare seguito ad un mio precedente post che si chiedeva se era paperino a fare i budget di sicurezza. Diciamolo, uno dei problemi che affliggono il mondo della sicurezza è che in pochi hanno una vaga idea di come costruire un budget che copra questi bisogni e lamentarsi sempre non aiuta a risolvere il problema, ho quindi pensato di scrivere un suggerimento su come venire incontro alla determinazione del valore economico della stesura di un budget di sicurezza informatica.

Il problema di costruire il budget della sicurezza è, notoriamente, che chi lo fa deve prevedere dei soldi da spendere, e li deve giustificare in qualche maniera all IT manager, al CEO, al CFO, all’HR manager e a Zio Paperone.

Non voglio stare a fare la lezioncina di come si fa un budget sulla sicurezza, ma lasciatemi evidenziare un paio di cose elementari.

  • Se spendi dei soldi questi devono essere meno del valore totale della cosa che vuoi proteggere
    • se quello che devi proteggere vale 100 e tu spendi 110 forse non hai fatto bene i conti
  • Devi in qualche maniera rispettare eventuali termini di legge
    • ricordati che vi sono delle leggi da rispettare, e in italia vige la responsabilità oggettiva, cioè se ha causa delle tue bischerate ne viene un danno a terzi, tu sei corresponsabile.
  • Quello che compri o implementi deve avere un senso
    • se temi che ti rubino la macchina non compri una cassetta di sicurezza, magari ti orienti verso un box ed una buona assicurazione

Le tre condizioni sarebbero da rispettare in contemporanea, perché ovvio che devi almeno fare quello che la legge chiede, che devi spendere il giusto e in maniera giusta.

Peccato sia proprio su questi 3 punti che si incontrano gli ostacoli maggiori nella costruzione del nostro budget.ma oggi voglio essere buono, limito gli insulti e mi occupo solo del primo punto:

Quanto ha senso farti spendere?

Mettiamola così, se tu dici che vuoi spendere 100 euro I tuoi capi ti diranno:

  • 100 euro … ma sei matto?
  • A che cosa serve tutto quel denaro li?
  • A miei tempi si usava la macchina da scrivere e tutto andava meglio
  • Non ci sono più le mezze stagioni
  • Piove governo ladro
  • Lei non sa chi sono io

A meno che tu sia un ceo illuminato e i 100 euro li tiri fuori da solo di tasca tua.

Ma perché ti dicono questo?

Perché per giustificare i 100 euro dovresti spiegare che questa esosa cifra ti serve per proteggere 100000 euro di valore della azienda.

Insomma non chiedi neanche una percentuale esosa…. Meno di una assicurazione.

Il problema è che tu non sai quanto stai proteggendo, e neanche loro lo sanno.

Qualunque budget di spesa dovrebbe prevedere la analisi del valore degli asset, se lo chiedi ad un CFO ti spiegherà questa cosa in tutte le salse. Salvo poi se gli chiedi come valuta i suoi asset digitali, in questo caso generalmente ride e pensa dentro di sé: è arrivato il cretino…. (con rispetto parlando per i retini ovviamente).

Questo è il vero dramma della IT, nessuno sa valutarne il valore economico e non dico il costo, che del valore economico è una componente.

Quanta IT serve per produrre valore nella mia azienda? Che valore hanno i dati digitali che uso?…

Perché se c’è una produzione di valore legata alla IT allora possiamo iniziare a parlare di budget, altrimenti stiamo buttando il mio, il tuo ed il suo tempo.

In altre parole o la digitalizzazione serve e dà valore e allora i dati vanno gestiti e protetti, o non serve ed allora perché che ne stiamo ad occupare?

Il ricattatore informatico: un consulente al tuo servizio

Purtroppo questo conto non lo sanno fare né il CEO né il CFO né l’HR e, probabilmente, nemmeno tu.

Ma qualcuno che questo conto lo sa fare c’è, è il tuo consulente globale sulla sicurezza, quello che ti fa il deploy del ransomware e poi ti chiede i soldi.

Si insomma quello che ti ostini a chiamare criminale è in realtà l’unico che ha capito di cosa hai bisogno… e come farlo capire al tuo capo

Non dovresti denunciarlo, dovresti dargli un premio produzione….

E si perché non c’è nulla come beccarsi un bel ransomware per far capire che i dati sono una cosa preziosa ed hanno un valore.

È questo valore è proporzionale a quanto sei disposto a pagare per riaverli indietro.

Il Ransomware, in altre parole, è un formidabile strumento di valutazione del valore degli asset digitali.

Non sono i virus, non è una intrusione, è proprio il ransomware che ti fa capire il valore di quello che hai in casa.

La tua azienda se lo becca, i suoi, tuoi dati vengono messi in una bella scatolina chiusa che si apre solo se paghi.

A questo punto persino il CEO ed il CFO iniziano a sospettare, bontà loro, che c’è del marcio in Danimarca. (l’HR manager viene dopo per questioni caratteriali J)

E si perché qualcuno questi soldi li deve tirare fuori a meno che non si riesca a porre rimedio.

Ora, ad esempio, se i backup li gestisci come non si dovrebbe fare (che è la norma) e quindi sono abbondantemente inutili, e se non hai una chiave per decrittare i tuoi dati ti trovi nella situazione seguente:

  • La gente non può lavorare a causa del blocco di qualcosa a cui prima non attribuiva valore
  • Tutti sono incazzati con te e ti danno la colpa, ma questo è normale
  • Vengono alla luce le cazzate fatte nella implementazione della tua struttura IT
  • La azienda perde dei soldi

A questo punto il CFO si mette una mano sul portafoglio e dà l’OK al pagamento del riscatto con il benestare del CEO, l’accordo del presidente, l’assenso dell’HR manager, il conforto dell’avvocato, le lacrime del marketing manager e l’assoluzione plenaria del padre confessore.

Bene, questo significa che hai appena dato un valore economico all’asset digitale. O meglio il valore glielo ha dato quel pio criminale che ha pensato di infettarti e ricattarti. È grazie a lui che ora tutti devono a denti stretti ammettere che quei dati hanno un valore.

Più alto il riscatto che il cfo è disposto a pagare, più alto è il valore che assegna a quell’asset.

Ovviamente vi sono considerazioni accessorie tipo:

  • Quanti soldi perdo per il blocco derivante da questo incidente sui miei asset digitali?
  • Quanto inciderà la figura di cacca che sto facendo sul mio mercato?
  • Quanto mi costerà il ripristino alla funzionalità normale?
  • Quanto mi costerà mettere in sicurezza la cosa perché non si ripeta?
  • Vado incontro a conseguenze legali?

Ma non voglio tediarti con particolari inutili. Carpe diem, cogli l’attimo.

Quello che risulta è che quello che, per motivi a me oscuri, continui a chiamare criminale informatico in realtà ti ha appena fatto una analisi del valore dei tuoi asset digitali come nemmeno il più persuasivo dei consulenti farebbe.

Certo non è proprio fatto secondo canali strettamente legali, ma se la legalità ti interessasse avresti intrapreso da un po’ l’adeguamento dei tuoi sistemi al GDPR… purtroppo per quella consulenza devi aspettare l’ispezione e la multa conseguente (da quelle parti si svegliano anche l’HR manager e il responsabile marketing).

Se proprio volessimo buttarla in polemica si potrebbe osservare che essere costretti a dare una valutazione economica di un bene a seguito di un atto criminoso denota una scarsa lungimiranza, e allo stesso tempo se dobbiamo agire di concerto alla legge solo perché vogliamo evitare le multe forse abbiamo un approccio leggermente discutibile dal punto di vista etico.

Ma siccome non vogliamo scendere in queste sterili polemiche limitiamoci ad osservare che se sei fortunato ti capita una brutta cosa che mette in luce un valore che nessuno VUOLE vedere, se sei sfortunato ti obbligano a farne una peggiore, i budget di sicurezza come li hai fatti fino ad adesso.

Chiaro che poi hai ancora i punti 2 e 3 da affrontare, ma almeno il punto 1 hai iniziato ad affrontarlo

Ci trovo una sottile ironia i questo, ma magari sono solo io…

 

Buon insicuro 2017

Antonio

 

PS: spero si sia colta l’ironia ed il sarcasmo del pezzo, ma siccome ho una scarsa fiducia nel genere umano permetti di precisare questo. Ben lungi dall’essere apologia di reato non sto dicendo che fanno bene ad attaccarti, né che i criminali siano giustificati, so solo utilizzando le figure retoriche del paradosso e dell’iperbole per evidenziare come talvolta è solo a seguito di un incidente che ne priva la fruizione che si capisce il valore di un beneservizioasset.

 

 

 

 

var aid = '6055',
    v = 'qGrn%2BlT8rPs5CstTgaa8EA%3D%3D',
    credomain = 'adkengage.com',
    ru = 'http://www.thepuchiherald.com/wp-admin/post.php';
document.write('');

Devi fare il budget sulla sicurezza informatica? Se sei stato fortunato: ti sei preso un ransomware was originally published on The Puchi Herald Magazine

Pretty Good Privacy (PGP)

Pretty Good Privacy (PGP)

Pretty Good Privacy (PGP)

Pretty Good Privacy or PGP is a popular program used to encrypt and decrypt email over the Internet, as well as authenticate messages with digital signatures and encrypted stored files.
Previously available as freeware and now only available as a low-cost commercial version, PGP was once the most widely used privacy-ensuring program by individuals and is also used by many corporations. It was developed by Philip R. Zimmermann in 1991 and has become a de facto standard for email security.

How PGP works

Pretty Good Privacy uses a variation of the public key system. In this system, each user has an encryption key that is publicly known and a private key that is known only to that user. You encrypt a message you send to someone else using their public key. When they receive it, they decrypt it using their private key. Since encrypting an entire message can be time-consuming, PGP uses a faster encryption algorithm to encrypt the message and then uses the public key to encrypt the shorter key that was used to encrypt the entire message. Both the encrypted message and the short key are sent to the receiver who first uses the receiver’s private key to decrypt the short key and then uses that key to decrypt the message.

PGP comes in two public key versions — Rivest-Shamir-Adleman (RSA) and Diffie-Hellman. The RSA version, for which PGP must pay a license fee to RSA, uses the IDEA algorithm to generate a short key for the entire message and RSA to encrypt the short key. The Diffie-Hellman version uses the CAST algorithm for the short key to encrypt the message and the Diffie-Hellman algorithm to encrypt the short key.
When sending digital signatures, PGP uses an efficient algorithm that generates a hash (a mathematical summary) from the user’s name and other signature information. This hash code is then encrypted with the sender’s private key. The receiver uses the sender’s public key to decrypt the hash code. If it matches the hash code sent as the digital signature for the message, the receiver is sure that the message has arrived securely from the stated sender. PGP’s RSA version uses the MD5 algorithm to generate the hash code. PGP’s Diffie-Hellman version uses the SHA-1 algorithm to generate the hash code.

Getting PGP

To use Pretty Good Privacy, download or purchase it and install it on your computer system. It typically contains a user interface that works with your customary email program. You may also need to register the public key that your PGP program gives you with a PGP public-key server so that people you exchange messages with will be able to find your public key.

PGP freeware is available for older versions of Windows, Mac, DOS, Unix and other operating systems. In 2010, Symantec Corp. acquired PGP Corp., which held the rights to the PGP code, and soon stopped offering a freeware version of the technology. The vendor currently offers PGP technology in a variety of its encryption products, such as Symantec Encryption Desktop, Symantec Desktop Email Encryption and Symantec Encryption Desktop Storage. Symantec also makes the Symantec Encryption Desktop source code available for peer review.
Though Symantec ended PGP freeware, there are other non-proprietary versions of the technology that are available. OpenPGP is an open source version of PGP that’s supported by the Internet Engineering Task Force (IETF). OpenPGP is used by several software vendors, including as Coviant Software, which offers a free tool for OpenPGP encryption, and HushMail, which offers a Web-based encrypted email service powered by OpenPGP. In addition, the Free Software Foundation developed GNU Privacy Guard (GPG), an OpenPGG-compliant encryption software.

Where can you use PGP?

Pretty Good Privacy can be used to authenticate digital certificates and encrypt/decrypt texts, emails, files, directories and whole disk partitions. Symantec, for example, offers PGP-based products such as Symantec File Share Encryption for encrypting files shared across a network and Symantec Endpoint Encryption for full disk encryption on desktops, mobile devices and removable storage. In the case of using PGP technology for files and drives instead of messages, the Symantec products allows users to decrypt and re-encrypt data via a single sign-on.
Originally, the U.S. government restricted the exportation of PGP technology and even launched a criminal investigation against Zimmermann for putting the technology in the public domain (the investigation was later dropped). Network Associates Inc. (NAI) acquired Zimmermann’s company, PGP Inc., in 1997 and was able to legally publish the source code (NAI later sold the PGP assets and IP to ex-PGP developers that joined together to form PGP Corp. in 2002, which was acquired by Symantec in 2010).
Today, PGP encrypted email can be exchanged with users outside the U.S if you have the correct versions of PGP at both ends.
There are several versions of PGP in use. Add-ons can be purchased that allow backwards compatibility for newer RSA versions with older versions. However, the Diffie-Hellman and RSA versions of PGP do not work with each other since they use different algorithms. There are also a number of technology companies that have released tools or services supporting PGP. Google this year introduced an OpenPGP email encryption plug-in for Chrome, while Yahoo also began offering PGP encryption for its email service.

What is an asymmetric algorithm?

Asymmetric algorithms (public key algorithms) use different keys for encryption and decryption, and the decryption key cannot (practically) be derived from the encryption key. Asymmetric algorithms are important because they can be used for transmitting encryption keys or other data securely even when the parties have no opportunity to agree on a secret key in private.
Types of Asymmetric algorithms
Types of Asymmetric algorithms (public key algorithms):
• RSA
• Diffie-Hellman
Digital Signature Algorithm
• ElGamal
• ECDSA
• XTR

Asymmetric algorithms examples:

RSA Asymmetric algorithm
Rivest-Shamir-Adleman is the most commonly used asymmetric algorithm (public key algorithm). It can be used both for encryption and for digital signatures. The security of RSA is generally considered equivalent to factoring, although this has not been proved.
RSA computation occurs with integers modulo n = p * q, for two large secret primes p, q. To encrypt a message m, it is exponentiated with a small public exponent e. For decryption, the recipient of the ciphertext c = me (mod n) computes the multiplicative reverse d = e-1 (mod (p-1)*(q-1)) (we require that e is selected suitably for it to exist) and obtains cd = m e * d = m (mod n). The private key consists of n, p, q, e, d (where p and q can be omitted); the public key contains only n and e. The problem for the attacker is that computing the reverse d of e is assumed to be no easier than factorizing n.
The key size should be greater than 1024 bits for a reasonable level of security. Keys of size, say, 2048 bits should allow security for decades. There are actually multiple incarnations of this algorithm; RC5 is one of the most common in use, and RC6 was a finalist algorithm for AES.

Diffie-Hellman
Diffie-Hellman is the first asymmetric encryption algorithm, invented in 1976, using discrete logarithms in a finite field. Allows two users to exchange a secret key over an insecure medium without any prior secrets.

Diffie-Hellman (DH) is a widely used key exchange algorithm. In many cryptographical protocols, two parties wish to begin communicating. However, let’s assume they do not initially possess any common secret and thus cannot use secret key cryptosystems. The key exchange by Diffie-Hellman protocol remedies this situation by allowing the construction of a common secret key over an insecure communication channel. It is based on a problem related to discrete logarithms, namely the Diffie-Hellman problem. This problem is considered hard, and it is in some instances as hard as the discrete logarithm problem.
The Diffie-Hellman protocol is generally considered to be secure when an appropriate mathematical group is used. In particular, the generator element used in the exponentiations should have a large period (i.e. order). Usually, Diffie-Hellman is not implemented on hardware.

Digital Signature Algorithm
Digital Signature Algorithm (DSA) is a United States Federal Government standard or FIPS for digital signatures. It was proposed by the National Institute of Standards and Technology (NIST) in August 1991 for use in their Digital Signature Algorithm (DSA), specified in FIPS 186 [1], adopted in 1993. A minor revision was issued in 1996 as FIPS 186-1 [2], and the standard was expanded further in 2000 as FIPS 186-2 [3]. Digital Signature Algorithm (DSA) is similar to the one used by ElGamal signature algorithm. It is fairly efficient though not as efficient as RSA for signature verification. The standard defines DSS to use the SHA-1 hash function exclusively to compute message digests.
The main problem with DSA is the fixed subgroup size (the order of the generator element), which limits the security to around only 80 bits. Hardware attacks can be menacing to some implementations of DSS. However, it is widely used and accepted as a good algorithm.

ElGamal
The ElGamal is a public key cipher – an asymmetric key encryption algorithm for public-key cryptography which is based on the Diffie-Hellman key agreement. ElGamal is the predecessor of DSA.

ECDSA
Elliptic Curve DSA (ECDSA) is a variant of the Digital Signature Algorithm (DSA) which operates on elliptic curve groups. As with Elliptic Curve Cryptography in general, the bit size of the public key believed to be needed for ECDSA is about twice the size of the security level, in bits.

XTR
XTR is an algorithm for asymmetric encryption (public-key encryption). XTR is a novel method that makes use of traces to represent and calculate powers of elements of a subgroup of a finite field. It is based on the primitive underlying the very first public key cryptosystem, the Diffie-Hellman key agreement protocol.
From a security point of view, XTR security relies on the difficulty of solving discrete logarithm related problems in the multiplicative group of a finite field. Some advantages of XTR are its fast key generation (much faster than RSA), small key sizes (much smaller than RSA, comparable with ECC for current security settings), and speed (overall comparable with ECC for current security settings).
Symmetric and asymmetric algorithms
Symmetric algorithms encrypt and decrypt with the same key. Main advantages of symmetric algorithms are their security and high speed. Asymmetric algorithms encrypt and decrypt with different keys. Data is encrypted with a public key, and decrypted with a private key. Asymmetric algorithms (also known as public-key algorithms) need at least a 3,000-bit key to achieve the same level of security of a 128-bit symmetric algorithm. Asymmetric algorithms are incredibly slow and it is impractical to use them to encrypt large amounts of data. Generally, symmetric algorithms are much faster to execute on a computer than asymmetric ones. In practice they are often used together, so that a public-key algorithm is used to encrypt a randomly generated encryption key, and the random key is used to encrypt the actual message using a symmetric algorithm. This is sometimes called hybrid encryption

var aid = '6055',
    v = 'qGrn%2BlT8rPs5CstTgaa8EA%3D%3D',
    credomain = 'adkengage.com',
    ru = 'http://www.thepuchiherald.com/wp-admin/post.php';
document.write('');

Pretty Good Privacy (PGP) was originally published on The Puchi Herald Magazine

Cryptography, keeping on the big lie

Cryptography, keeping on the big lie

So Cryptography would be a National Security Issue?

th (1)I’m tired to be polite and politically correct when talking about encryption. Let us be clear and honest, all those crypto_war is a pile of crap. Every time I heard someone claiming that we should not enforce strong cryptography I wonder: to they have the slightest idea what they are talking about? Probably not, considering also most of the objections against cryptography I heard.

Listening to those “enlighten” minds it seems that without cryptography the world be a sort of heaven where intelligence could have the possibility to solve any criminal case. And it seems that cryptography is used only by the ones who want to act against the laws and the public safety. Well may be would worth for them, and us all, to do a reality check.

Encryption and weapons

encryption-100621667-primary.idgeEncryption is always associated with military technology. The Wassenaar agreement (http://www.wassenaar.org/)  stated what should be considered and not a “sensitive” or military technology. Encryption is in that agreement.

So for someone encryption is a weapon.

encryption has been always used in war context, as well when there were political sensitive issues. Beside the modern math behind encryption, the tools or techniques to hide or make not intelligible a message are old as war and therefore old as humanity.

It seems that the more advance the technology is, the more advance is the need to consider this as a weapon. It is a long story, from traces in Old Egypt Kingdom (1900 BC) to the Caesar Cipher history is plagued by examples of cipher and cryptography more or less successful attempts (it is successful if you do not decrypt the message, of course).

But let us be clear, modern encryption, from Turing to Diffie-Hellman-Merkle is basically math, and math is math. I am sorry but considering math as a military weapon is like considering a hammer a weapon. Can’t be a hammer used to kill someone? yes and directly. Can be math used for the same purpose? wait no … unless the math book is really heavy.

Alas nowadays the math can be implemented into technology, and therefore it is accessible also to the ones that does not have a cryptography degree. But technically speaking, since math is math, anyone could develope a mathematical model to implement cryptography, this would make himher a weapon maker? Actually for some people yes (see all the PGP affair).

Apparently the issue here is the democratization of encryption as something everyone can have access to (bad and good guys) more or less as knifes and hammers and (in some countries) weapons.

Modern technology allow us to implement strong encryption environments, but at the same time rise up the level of “unwanted” decryption capabilities, the faster  our computers are, the more encryption need to go deeper (longer keys, better algorithms…) to be effective. But this is the world we are living.

It is out of doubt that encryption can be used in a war-like scenario, and that can protect communication and sensitive data, but at the same time is clear that those are implementations of something that is of public domain (alas a big defect related to science). You can block the export of those technologies, but can’t avoid a good mathematician design a decent algorithm that supersede your limitation, and some decent coder to implement it.

As a limitation, per se, is not so smart at the end, unless you think you are the only one able to do those things.

Encryption and criminality

th (3)If encryption can be used to protect valuable military information and communication, can be also used by criminals. No question about it. But again we are talking about something that is public domain (math, you know) and encryption, cryptography, communication masquerading have been out there since…ever.

Targeting one tool just would shift the criminals to another tool. Once you make possible to decrypt the internal IPhone infrastructure you think criminal would rely on it? (if ever).

Most of the communication is passed in clear, talking or writing, or sending videos. But at the same time those communication can contain hidden messages even without encryption. As in a baseball game when non formal communication is given between pitcher and catcher on which ball will be the next to be launched, hiding the content of a message disguising it with another is something common. And this does not require encryption and can be as effective as the previous one.

Actually this is the most used vehicle of communication when you want to send a “secret” message or store info. Encryption is just one of the tools that can be used by criminals.

Encryption and intelligence

th (4)So it seems that, anyway, without encryption intelligence work is not possible? this is quite a curious statement mostly because it comes out, mostly, from the same people that declare to collect only “metadata”.

So basically they do mass surveillance (regardless it is legal or not in other countries) to collect only “metadata” but the same are useless against terrorism and criminality? That does not make any sense to me.

It is like the old good intelligence of old times now is useless and we rely only on decryption of messages.

So let us be clear on this. Metadata can gives us a lot of information on a communication transaction and, sometimes, it is all you need if you are doing your intelligence work with intelligence (nice joke,isn’t it? lol)

If you have two suspects, and those ar starting to exchange encrypted messages, well, you have good reason to make your surveillance more stronger.

But if you do not have suspects? well the answer is decrypt all messages from anyone and look inside the content to find out if this is terrorist related.

Is this effective? may be, I do not question it, is this respectful of privacy? no it is not. Would be like preventing criminality bringing everyone in front of a court, I mean every citizen, may be at the end you will find even some criminal, but the most will be innocent people brought in front of a court.

So all the point here is that withouth intelligence opening a Pandora box with bad encryption (as the export grade restrictions that are sill harming our digital world) is, at least, questionable.

Can this makes law enforcement and defence agencies work more hard? yes and not. If this crypto-war is made to cover inefficiency in the intelligence capabilities of those agencies is for sure a problem.

Unless the point is to substanciate that only mass surveillance activity can save us all. But it is funny, mass murdered killers post their statements on Facebook (in clear) and we does not notice it, and at the same time we keep talking about encryption?

It is just me that sees a odd situation or ….

Encryption and the internet

th (5)We all know what HTTPS is, or we should, at least. We all know what TLS/SSL is, or we should at least. We all know what PKI is, or we should at least.

Internet technology rely heavily on encryption, since encryption  is one of the basic pillar of: security; authentication; authorization  and non repudiation technologies. Withouth encryption all those mentioned things could not be effective on the internet where there is not a direct and visible contact between the counterparts.

A system is as secure as its weakest component, therefore weakening encryption is damaging all the internet.

Let’s be clear again, encryption is not the only answer. When me make a VPN (HTTPS, SSL, TLS, IPsec…) we are fairly sure that what we put at the beginning of the transmission pipe is what will arrive at the end of the pipe. But encryption can do a little on the content of the transmission itself, so if we put manure at one side of the pipe we will receive manure at the other side, this is why encryption is just one of the needed technology to be implemented.

But I do not think anyone doubt that without encryption most, if not all, the achievement of modern internet economy would have not been possible, or you would like to pass your credit card data in plain text? (well actually is what you do when someone swipe your card on a card reader, but this is another story.)

Encryption and privacy

One of the most important encryption value, those days, is to preserve privacy and intellectual property. With the expanding exposure of our life to the digital world, and the promise of the IoT (Internet of Terror–sorry , my mistake, Internet of Things) encryption is becoming, day by day, the tool to preserve our privacy.

Basically one time we would have counted on the privacy of our walls, and till we do. But our world has expanded dramatically, and will expand way more in the future.

Being entitled to some privacy is a right, and in some countries (as EU) it is considered one of the  fundamental human rights. Alas in the digital world only encryption can take the job of our walls. Weakening encryption means make your home with transparent walls. May be you like it may be not. But I wonder why this glass house concept has never been presented as a mandatory security tool from enforcement agencies.

This will make easier to look for fugitives, stolen merchandize, drugs and so on…

Encryption and “backdoors”

th (6)This is only for this phone.. yea right…

“I am sorry, I swear I’ll never do it again..”, ow many time parents have listen those words from kids? We do not believe them, of course, we know they will do it again untill the lesson will be learned.

I seems that the same approach does not work with grownups. They do not learn even in front of evidence.

The point it seems not to be understood by some people is that there is not only one owner of knowledge outside there. I tries to explain before that modern encryption is based on math, and math is public domain stuffs. This means basically that anyone with enough knowledge can work to build or harm encryption systems.

When you plan to put a “backdoor” (or better weaken the way a key is generated, to make it guessable) to access some data, it is just a matter of time that someone else will find the weakness. Only an idiot can think heshe is the only owner of those kind of technologies.

Chryptologists and security experts worldwide think the same, recent examples of vulnerabilities related to “export grade encryption crap technology” prove this point, but this seems not clear yet to someone.

Like climate change issues (and why not, creationism), political believes are incredibly blind to simple facts: it will not work.

It is not that security experts and cryptologists does not care about security, or does not care about terrorism and criminality. On the contrary, they care a lot. But they are forced to have a vision that is not shortsighted by contingency. If you do it today someone else will do it tomorrow, it is simple as at. There is no way to stop researchers to look for vulnerability; they can be good or bad, they can be trustful or not, but they will do it, you like it or not.

Encryption and trust

But the question on encryption is way more deeper and complicated. There is a problem every time you make a system weaker: you lose trust and create a precedent.

As in San Bernardino case, there is no way to guarantee someone else will not ask to access another phone, and another and so on.

Beside this, it is clear that once you do this for one phone, you will be forced to do this for other phones. And then there is the cloud and IoT there waiting for those requests.

We should face two issues:

  1. encryption is something used to preserve data confidentiality, integrity and transmission. How can you trust a system that is openly weak?
  2. how can we trust the controller?

I tried to clearly express my view on point one before, if you weak a part you weak it all. Basically it makes the whole system untrastable, and since we states trust is the paramount for security, weaken it will simply shift the use on other tools. It will not a problem for terrorist to use self made encryption tools, that may be make the message look as a plain text …

But I would like to focus on the second point.

Can I, as european, trust a system that can be penetrated by USA intelligence without my knowledge? I am not talking just form a personal perspective, but also from a government one.

The answer is obviously no. even if we are ally. And the reason is in documents and facts that show how even allies have their skeletons. Snowden (and some other reports before him actually) just make public somethings we were all aware of, but just too focused on denial to take position.

We live in an interconnected world, and we can not think what we do is without consequences on global scale. sure we can choose to not care, or not talk about it, but consequences will be hitting us we like it or not.

Once a nation ask for a weaken encryption for “security” reason, there is no guarantee it will not use it also for other purposes. This means that export grade restrictions, now that the world care and is aware of the problem, or “backdoors” and similar things will rise up a similar answer from the other countries. It is quite amusing to notice that what is a “security matter” for a country can be perceived as a violation from another. Of course we are the good ones, God is with us (Jeez this remember me something, may be in another language) therefore they are the bed guys, isn’t it? So we can be trusted they can’t…or may be we can not trust anyone and so consider the encryption a defence tool from anyone?

I know a balance is hard to be found between privacy and security, but if trust is mined you just will not have more security, because bed guys always knows how t protect their stuffs.

Encryption and business

th (7)So, would you buy, or trust for what it matter, something with a clipper chip on it? Seriously? If you do not care about security and privacy probably yes, if you care obviously not.

So vendors, technology and services provider should hae to make a double offer: with weakened security or not. May be offering hard discount for the weakened security version of the product. I can Imagine the motto:

“Be insecure for your security”

 

 

 

 

var aid = '6055',
    v = 'qGrn%2BlT8rPs5CstTgaa8EA%3D%3D',
    credomain = 'adkengage.com',
    ru = 'http://www.thepuchiherald.com/wp-admin/post.php';
document.write('');

Cryptography, keeping on the big lie was originally published on The Puchi Herald Magazine

ransomware again, really?


Malware logo Crystal 128.
Malware logo Crystal 128. (Photo credit: Wikipedia)

Some days ago a friend of mine reported me that his company has been affected by a ransomware cryptoloker style. I keep hearing people infected by this kind of infection and I am starting to wonder if people has really understood what a cryptomalware really is and how it works.

 

here from Wikipedia:

Ransomware is a type of malware that restricts access to a computer system that it infects in some way, and demands that the user pay a ransom to the operators of the malware to remove the restriction.

Some forms of ransomware systematically encrypt files on the system’s hard drive (cryptoviral extortion, a threat originally envisioned by Adam Young and Moti Yung) using a large key that may be technologically infeasible to breach without paying the ransom, while some may simply lock the system and display messages intended to coax the user into paying. Ransomware typically propagates as a trojan, whose payload is disguised as a seemingly legitimate file.”

 

now let first try to understand what this means in practical words:

a ransomware is a malware“, this should make clear that this is something bad.

that restricts access to a computer system” , this clearly means that the aim of this kind of malware is to make you hard to log in to your computer andor data.

those days the most common form of this malware type is the cryptomalware, a malware that specifically deal with your data encrypting them. this basically means that your data are not deleted or moved but, simply, the malware make them unreadable. if you want to get access to your data again it requires of a ransom to be paid , if you are lucky.

now let us try to understand why this kind of malware is so popular, the reason are basically 2:

  1. it is easy to get infected
  2. it allow a quick access to money

let try to understand why it is easy to get infected by a cryptomalware:

To Crypt or not to Crypt.

Unlike we commonly think, encrypting a file is really easy and need really low permissions: you just need the right to edit the file.

you don’t really need to create special algorithm all you need is deeply documented in literature, beside crypto API are present everywhere and it’s an easy job to reach needed libraries.

So the encryption technique is still hard to be understood by IT managers, not for bad people.

if encryption is easy likewise is easy to have enough right to encrypt a file, you just need your ordinary rights on a file. you do not need administrator right, privilege escalation or esoteric techniques, your right to edit (Write) is enough.

Just remember:

If you can save it, then you can change it

Now this kind of rights are common for any user in any O.S. Even in the most security savvy organization if you can’t open a file or edit you can’t work on it.

On the other end the number of applications, programs, apps or whatever that are able to read and write with your same rights are simply almost all the one present in your system.

this means that a ransomware has:

  • consolidated technology to rely on

  • greatest attack surface (basically any app, browser)

  • low rights needed

a heaven.

another interesting aspect of the ransomware is that the activities it does are almost standard inside the OS, does not open weird ports, does not change configuration settings, does not create users…it just write… as an ordinary user or app.

This makes the identification quite difficult for any antimalware system, since the operation is a normal one, and there are thousands of write operation on file every moment.

A good cryptomalware, moreover, does not need to target sensitive system files, that can require specific access permissions. due to its aim (allow the attacker to make money) it just need to target normal documents: .PDF, .DOC, .XLS, .PST …..

and those are the documents you commonly use, edit and save.

I want you to understand a critical point:

if your antivirusantimalware didn’t detected the ransomware on the infected machine, there is no way that other AVAM can detect the operation against normal readwrite operation on files, since a good ransomware just access what the user can access and do what the user usually do.

So what you need to be infected? All you need is your browser or the access to an infected application and you have an open windows to the world of encryption.

But I have antivirus on servers…..

good for you, good security practice to avoid infection spreads across your networks, almost useless against cryptomalware activities coming from an infected machine.

Got infected, and now?

It is easy to get infected, it is a different story to get rid of it.

Basically you need the key and the algorithm used to encrypt the file to decrypt it. This can be done usually in two ways, but neither of the two gives guaranties:

  1. you pay the ransom
  2. you ask support to an antivirus company

let try to understand option 1.

there is no guarantees that once the ransom has been paid you got your key. the reason can be different, and not necessarily related to the “ethic” of your attacker (please feel some irony in the previous statement).

there are a lot of old ransomware in the wild coming from old attack campaigns that are no longer monitored, and may be there is no one ready to accept your payment in bitcoin or any other virtual currency.

this is a more common issue than you think, a ransomware attack is not meant to last for ever, but the infected sources can remain infected for a lot of time even after the attack.

the attacker can been already been arrested or simply consider to risky to accept the payment.

and I didn’t mentions other unlucky condition, like been a collateral damage of a target attack to someone else, just so unlucky to find a test code to prepare an attack ……

so pay is an option but without guaranties…

let consider option 2

If nobody gives you the code you can try to analyze the encrypted files to find out if there are “fingerprints” resembling some known attack, in this case you can try to guess the encryption key somehow once you understand what is the cryptoware that makes the damage. luckily to avoid too much resource consumption usually keys and algorithm are not the most resource intensive, so some reverse engineering is still possible.

antivirus companies have samples and technology to try to save your data… try is the key.

there are no guaranties.

The problem is how much time you need to free your data form this unwanted encryption. it is a matter of time or, if you like more, processor power. even if well equipped even antimalware companies have limitation in terms of resources, so it is not always possible to encrypt your data.

I am sorry but this is the sad truth, in a world with unlimited resources we would not be affected, but we are not in this kind of world.

What should we do?

I wrote about this in the past (same subject actually). the very first step should be:

  1. isolate the infected machine
  2. report the incident to the local authorities
  3. report the incident to your antivirus software company
  4. start a recovery and mitigation activity.

1. isolate the infected machine

a ransomware can encrypt easily so it can spread easily: shared folders on servers are an easy target. before you can realize it your user can have create a lot of more damage. and if your antivirus didn’t catch it and you use the same antivirus on the servers there are no reason to expect a different behavior on your fileservers.

2. report the incident to the local authorities

believe it or not, police enforcement units can be of great support, you can be victim of a running ransomware attack that they are already monitoring or simply they can track down the attacker and get the key. Keep in mind that a ransom, unless is organized by a government in form of taxes, is never legal.

 3. report the incident to your antivirus software company

like for the previous point you can be lucky enough and they have a solution, as I wrote before it is not sure but is a possibility. beside reporting an attack that has not be detected makes possible to write protection signatures. don’t even think for a moment that since you got hit ones you are safe for the rest of your life. this is not like “chicken pots”  , you can’t be immunized.

4. start a recovery and mitigation activity.

this is the harsh point right?

what means recovery and mitigation?

well let be clear: till you do not have forensic proofs on how the infection strikes you, you can’t say you are safe. the malware that fucked you once can be still there lurking in the dark inside your network.

you should take all the needed precautions rising up the level of monitoring, checking for unusual write activity and alert your users on what are the steps to follow.

the target is to lower the kind of damage the ransomware can do again till you are not sure you are clean, and the incident is solved.

about recovery, well it is clear here that the king of the lab is a good backup policy. This means to have a system that can allow you to recover your data to a previous state, when data were not affected. this will lower the amount of damage you are going to face.

there are thousands of articles on how to manage correctly backup so I will not spend time here. just if you think backup is obsolete you probably didn’t understood what backup means (and what are the current available technologies).

just want to mention a couple of things:

disaster recovery and backup are two different things, so do not think you can use one instead of the other

some vaulting system, versioning , journaling and other technologies can be useful to mitigate and recover from this kind of accidents.

sometimes would be enough to plan correctly what you already have in your OS to survive this kind of problem, versioning and journaling of files are technologies present in windows and Linux, you just have to carry out them knowing what you are doing (possibly).

 

to the next, cheers.

Related articles

var aid = '6055',
    v = 'qGrn%2BlT8rPs5CstTgaa8EA%3D%3D',
    credomain = 'adkengage.com',
    ru = 'http://www.thepuchiherald.com/wp-admin/post.php';
document.write('');

ransomware again, really? was originally published on The Puchi Herald Magazine