BlackBerry Ltd, the NSA, and The Encryption Algorithm that NIST Warned You Not To Use

As part of my ongoing efforts to sort fact from fiction regarding the RSA - NSA debacle, I learned that BlackBerry, Ltd (NASDAQ: BBRY), with its acquisition of Certicom in 2009, became the patent-holder for Dual_EC_DRBG. And since BlackBerry devices are used by so many government and military customers, I contacted the company to inquire whether they had notified their customers about the NIST warning. Before I share what happened with that inquiry, here's a short recap of the facts:

• In 2003, Certicom announced that it licensed its Elliptic Curve Cryptography technology to the NSA for US$25 million.
• In 2004, the NSA convinced RSA to make it the default CPRNG (Crypto Pseudo Random Number Generator) for its BSAFE software for an alleged US$10 million. 
• In December, 2005 NIST issued its draft standard for Dual_EC_DRBG.
• In February, 2006, RSA announced that BSAFE had conformed with Suite B cryptography requirements issued by the NSA.
• In March, 2006, RSA announced that the NSA had chosen BSAFE "for use in a classified communications project".
• Starting in March, 2006 and continuing into 2007, security researchers Kristian Gjøsteen, Berry Schoenmakers and Andrey Sidorenko, Dan Shumow and Niels Ferguson, and Bruce Schneier all published articles warning about weaknesses in Dual EC DRBG. The final NIST standard SP 800-90A published in June 2006 included mention of those weaknesses as unresolved.

BlackBerry Ltd

According to NIST's DRBG Validation List, the following BlackBerry products include Dual EC DRBG:

• BlackBerry Cryptographic Algorithm Library, Version 6.1 which apparently provides advanced cryptographic functionality to systems running BlackBerry 10 OS and components of BlackBerry Enterprise Service 10. 
• BlackBerry Algorithm Library for Secure Work Space Version 1.0. ""The BlackBerry Algorithm Library for Secure Work Space provides a suite of cryptographic services utilized by the BlackBerry Cryptographic Library for the BlackBerry Secure Work Space (BBSWS). BBSWS provides the secure operation and management of iOS and Android devices when used in conjunction with BlackBerry® mobile device management solutions." 
• BlackBerry Tablet Cryptographic Library Version 5.6. "The BlackBerry Tablet Cryptographic Library is the software module that provides advanced cryptographic functionality to BlackBerry Tablets." 

I passed this information to BlackBerry and within a couple of days received this response from Mike K. Brown, VP of Security Product Management & Research, BlackBerry.:

"The Dual EC DRBG algorithm is only available to third party developers via the Cryptographic APIs on the platform. In the case of the Cryptographic API, it is available if a 3rd party developer wished to use the functionality and explicitly designed and developed a system that requested the use of the API."

I then asked if BlackBerry has forwarded the NIST warning about not using Dual EC DRBG to its customers or developers and received this response:

"To your other question, the reason we didn’t issue an advisory is because it wasn’t a vulnerability. We only do them for fixes that are needed. You can read more about that process here: http://bizblog.blackberry.com/2013/07/security-privacy-malware-notices-advisories/. "

Therefore, since this warning from NIST:

"Recommending against the use of SP 800-90A Dual Elliptic Curve Deterministic Random Bit Generation: NIST strongly recommends that, pending the resolution of the security concerns and the re-issuance of SP 800-90A, the Dual_EC_DRBG, as specified in the January 2012 version of SP 800-90A, no longer be used."

does not meet BlackBerry's definition of a vulnerability, the company hasn't issued an advisory. If you are a BlackBerry customer or developer, be advised that it's apparently up to you to keep informed about possible backdoors among the encryption algorithms included with BlackBerry products.

Add to Cart View detail

Guess Who Owns The Patent to RSA's Backdoor Algorithm? Blackberry

Meet Certicom, a subsidiary of Blackberry Ltd, who provides the core technology for the National Security Agency (NSA) Suite B standard for secure government communications. Certicom holds 350 patents, many of which cover key aspects of Elliptic Curve Cryptography (ECC) including this one:

Elliptic curve random number generation 

Abstract

An elliptic curve random number generator avoids escrow keys by choosing a point Q on the elliptic curve as verifiably random. An arbitrary string is chosen and a hash of that string computed. The hash is then converted to a field element of the desired field, the field element regarded as the x-coordinate of a point Q on the elliptic curve and the x-coordinate is tested for validity on the desired elliptic curve. If valid, the x-coordinate is decompressed to the point Q, wherein the choice of which is the two points is also derived from the hash value. Intentional use of escrow keys can provide for back up functionality. The relationship between P and Q is used as an escrow key and stored by for a security domain. The administrator logs the output of the generator to reconstruct the random number with the escrow key.

Certicom was acquired by Research In Motion (now known as Blackberry Ltd) in March 2009 but it has been in business since 1985. The patent authors are two Certicom employees Daniel Brown and Scott A. Vanstone who are also members of the ANSI X9.82 standardization committee. Matthew Green, a cryptography professor at Johns Hopkins, wrote a blog post describing Dual EC DRBG's history with Brown and Vanstone, ANSI and the NSA on December 28, 2013.

The existence of this patent does not mean that Brown and Vanstone were responsible for Dual EC. In fact, the generator appears to be an NSA invention, and may date back to the early 2000s. What this patent demonstrates is that some members of the ANSI committee, of which RSA was also a member, had reason to at least suspect that Dual EC could be used to create a wiretapping backdoor. (Update: John Kelsey confirms this.)

To date, Blackberry has not made a public announcement about its use of Dual EC DRBG but here are the Blackberry products that use it according to NIST:

• "The BlackBerry Algorithm Library for Secure Work Space provides a suite of cryptographic services utilized by the BlackBerry Cryptographic Library for the BlackBerry Secure Work Space (BBSWS). BBSWS provides the secure operation and management of iOS and Android devices when used in conjunction with BlackBerry® mobile device management solutions."
• "The BlackBerry Cryptographic Algorithm Library is a suite of cryptographic algorithms that provides advanced cryptographic functionality to systems running BlackBerry 10 OS and components of BlackBerry Enterprise Service 10."
• "The BlackBerry Tablet Cryptographic Library is the software module that provides advanced cryptographic functionality to BlackBerry Tablets."

Other companies that have Dual EC DRBG in their products are Microsoft, RSA, Cisco, Juniper Networks, McAfee, Symantec, Samsung, Lancope, SafeLogic, GE Healthcare, Thales eSecurity, Panzura, Catbird Networks, ARX, Kony, CoCo Communications, Riverbed Technology, OpenSSL Foundation, Certicom, and Mocana. 

I've only found a few who have made public announcements advising their customers about Dual EC use: Cisco and SafeLogic. The OpenSSL Foundation has had many discussions about Dual EC in their own forum. Please leave a comment if you know of other advisories by the remaining companies which I've missed.

Related

BlackBerry Ltd, the NSA, and The Encryption Algorithm that NIST Warned You Not To Use

Add to Cart View detail

RSA Boycott or Not? 3 Questions To Help You Decide.

1. Did Joseph Menn's Reuters article contain sufficient information to raise your suspicion that RSA may have collaborated with the NSA for $10M in exchange for using NSA's preferred encryption algorithm?
If no, you can stop here. If yes, move to question 2.

2. Did RSA's response address your concerns?
If yes, you can stop here. If no, move to question 3.

3. What action can you take that you believe would prompt RSA to be more forthcoming?
Then do it.

Related

Joining Mikko in Protest, I've Cancelled My Talk at RSA

NSA's $10M RSA Contract: Origins

Add to Cart View detail

NSA Limericks, Jim Bidzos' Threats, and the 1st RSA Conference

I found some illuminating and very funny quotes that depict the adversarial relationship that existed between the NSA and RSA before the controversial $10M contract deal of 2004:

"There is a group at Fort Meade
who fear that which they cannot read
so they fight with their friends
(God knows to what ends! )
In attempts to get more than they need."
-- Jim Bidzos, CEO of RSA Data Security (source: Sam Simpson Cryptography Quotes)

"If I see you in the parking lot, I'll run your ass over"
- NSA Export Officer to Jim Bidzos (Head of RSA), April '94 (pg 287, Crypto by S.Levy)

"(C) Jim Bidzos, the aggressive RSA representative, was unable to attend but curmudgeon Whit Diffle presented a frail RSA position (Bidzos would have been much more implacable) and was essentially ignored by the panel."
- Declassified NSA "Cryptolog" March, 1994, p.17 describing a meeting at Eurocrypt '92 held on May 24-28, 1993 in Hungary.

 And then I found this recounting by Jim Bidzos of how the first RSA Security conference came about:

"Yost: You mentioned the conference. Can you talk a bit about the origin of the RSA Data
Security Conference, about both the founding and the early years of it?
"Bidzos: Yes, actually it originated—you know there’s another example where there’s just
one moment, one phone call where this happened—right about the time that the
Electronic Frontier Foundation was being born around 1991. And actually it was also the
time that something called CPSR, Computer Professionals for Social Responsibility, was
becoming EPIC, the Electronic Privacy Information Center. The director of which is a
guy named Marc Rotenberg.
"This was a time when the government made an announcement. I don’t think it was the Clipper chip at the time, I think it was something called the DSA. Anyway they were starting to try to set or dictate [encryption] standards for the business community. They had made some announcement and Marc called me up
and said, “They’ve just announced this. Have you seen this?”
"And I said, “Yes.” And he said, “What are we going to do about this?” And I said, “I don’t know. It sounds to me like the best thing we can do is educate people, so maybe what we ought to do is host a
conference and educate people about this. I’ve got access to a lot of people who can talk about it.”
"It was his phone call, basically pleading, “What are we going to do? What are you going to do?” He was really bothered by DSA, seemed up in arms and didn’t know what to do. All that nervous energy that I felt somehow made me feel obligated to do something. So that’s when I came up with this idea to have this conference. So I got Rivest and a few other people, I think Marty Hellman was there, Taher El Gamal and
some other people to say this is a bad idea and here’s why. And so we let people come for free, I think we got sixty people. It just seemed like a good thing to do again the following year."

How times have changed.

Add to Cart View detail

NSA's $10M RSA Contract: Origins

"For almost 10 years, I've been going toe to toe with these people at Fort Meade. The success of this company (RSA) is the worst thing that can happen to them. To them, we're the real enemy, we're the real target."

"We have the system that they're most afraid of. If the U.S. adopted RSA as a standard, you would have a truly international, interoperable, unbreakable, easy-to-use encryption technology. And all those things together are so synergistically theatening to the N.S.A.'s interests that it's driving them into a frenzy." 

- James Bidzos (President, RSA Data Security in an interview with Steven Levy of the New York Times, June 1994)

Compare the above remarks by former RSA President James Bidzos in 1994 with RSA's formal statement about its relationship with the NSA (December 2013):

We made the decision to use Dual EC DRBG as the default in BSAFE toolkits in 2004, in the context of an industry-wide effort to develop newer, stronger methods of encryption. At that time, the NSA had a trusted role in the community-wide effort to strengthen, not weaken, encryption.

What happened to a company that in the 90's knew exactly where it stood vis a vis the NSA and this latest NSA-friendly incarnation? According to Reuters, it was a change in business direction away from pure cryptology in favor of joining the government for the war on hackers.

"When I joined there were 10 people in the labs, and we were fighting the NSA," said Victor Chan, who rose to lead engineering and the Australian operation before he left in 2005. "It became a very different company later on." By the first half of 2006, RSA was among the many technology companies seeing the U.S. government as a partner against overseas hackers."

 Steven Levy's article "Battle of the Clipper Chip" which is where I found the top quote from James Bidzos is a must-read because although it was written 19 1/2 years ago, it provides keen insight into the issues that frame today's crisis of trust with RSA. Back then, the NSA and the Clinton Administration thought that a Key Escrow plan like Clipper Chip was the way to go. When the market place rejected using Clipper, the NSA eventually switched tactics to develop and promote its own encryption algorithm; first to RSA with a $10 million sweetener and then to NIST with the incentive that RSA had already adopted it. Today we all know that the NSA succeeded. What isn't known is why RSA agreed to it.

RSA's public statement on the issue is both misleading and lacking details which pertain to the facts uncovered by Joseph Menn for Reuters. Here are the four key points made in their statement and the problems with each:

“We made the decision to use Dual EC DRBG as the default in BSAFE toolkits in 2004, in the context of an industry-wide effort to develop newer, stronger methods of encryption. At that time, the NSA had a trusted role in the community-wide effort to strengthen, not weaken, encryption.”

This fails to disclose the terms of RSA's agreement with the NSA to use Dual EC DRBG. It also paints RSA as naive as to the NSA's motives which is ludicrous once you know what happened 10 years earlier with Clipper Chip.

“This algorithm is only one of multiple choices available within BSAFE toolkits, and users have always been free to choose whichever one best suits their needs.”

With this statement RSA is trying to pass off the responsibility for using a back-doored Random Number Generator to the user!

“We continued using the algorithm as an option within BSAFE toolkits as it gained acceptance as a NIST standard and because of its value in FIPS compliance. When concern surfaced around the algorithm in 2007, we continued to rely upon NIST as the arbiter of that discussion.”

It became a NIST standard because RSA took the NSA's money in the first place. Concerns about the algorithm were raised in 2006 and were included in NIST SP 800-90A as being unresolved. By 2007, RSA should have been sufficiently alarmed to investigate on its own. To say that they relied upon NIST as the arbiter is merely an attempt to shift responsibility away from itself as the producer and onto NIST.

“When NIST issued new guidance recommending no further use of this algorithm in September 2013, we adhered to that guidance, communicated that recommendation to customers and discussed the change openly in the media.”

So once the New York Times' article was published and NIST took steps, then RSA did the right thing? And they expect credit for that?

RSA cannot escape responsibility for offering a compromised BSAFE product for the last 9 years by saying "we just followed NIST" and "our customers had a choice". This is a gross violation of its own mission statement not to mention its own illustrious history of defending the integrity of encryption against government attempts to weaken it.

I announced last Friday that I joined Mikko Hyponnen and Josh Thomas in pulling my talk from RSAC, but there needs to be an industry-wide boycott of RSA products. It's not enough to just talk about how bad this is. RSA's parent EMC, like every other corporation, has a Board of Directors that is answerable to its shareholders for maximizing revenue. If RSA's customers begin canceling their contracts and/or refuse to buy RSA products, the company's earnings will drop and that's the type of message that forces Boards to make changes.

Related

Joining Mikko in Protest, I've Cancelled My Talk at RSA
BlackBerry Ltd, the NSA, and The Encryption Algorithm that NIST Warned You Not To Use

Add to Cart View detail

Joining Mikko in Protest, I've Cancelled My Talk at RSA

Granted, I'm no Mikko Hyponnen and my talk was a mere 20 minutes on the last day of the RSA conference, but I think it's vitally important that those of us who profoundly object to RSA's $10 million secret contract with the NSA do more than just tweet our outrage. We need to take action.

RSA has issued the weakest of denials possible on Dec 22nd and hasn't made any attempt to clarify its position since. The company's denial failed to address most of the troubling points raised in Joe Menn's article for Reuters. This on top of RSA's horrible handling of its 2011 SecureID breach has shattered any remaining trust in the company as far as I'm concerned.

Obviously, I hope that RSA and EMC's leadership will eventually rise to the occasion and be fully transparent about what happened and why. However unless and until RSA fully addresses this apparent breach of trust, I won't be speaking at any RSA events nor will I accept RSA as a sponsor at any future Suits and Spooks events.

UPDATE (Jan 3, 2014): I just learned that Josh Thomas of Atredis also pulled his talk from RSA back on December 26th. That makes three of us as of today.

UPDATE (Jan 7, 2014): Christopher Soghoian announced that he has canceled his RSA talk and Adam Langley announced that he's withdrawing from his panel.

Related

NSA's $10M RSA Contract: Origins
An Open Letter to the Chiefs of RSA and EMC by Mikko Hyponnen
Exclusive: Secret contract tied NSA and security industry pioneer by Joseph Menn

RSA Response to Media Claims Regarding NSA Relationship

Add to Cart View detail

Five Critical Panels on the Use of Offensive Tactics in Cyberspace

On February 8-9, 2013, 24 world-renowned speakers will address and interact with about 80 attendees from the public and private sectors in a beautiful conference center high above the Potomac river on some of the most important issues in cyberspace - the controversial use of offensive tactics in defending networks (i.e., Active Defense). The full agenda can be seen here, but five critical panels are as follows:

• How is Russia and Georgia engaging in Active Defense?
• Featuring Ambassador David J. Smith (ret.) and Ms. Khatuna Mshvidobadze (Georgian Security Analysis Center)
• How Duqu, Flame, Gauss, and Shamoon can be reconfigured and reused against different victims (i.e., Iran against Saudi Arabia)?
• Featuring Dr. Boldizsár “Boldi” Bencsáth (Associate Professor, Laboratory of Cryptography and Systems Security (CrySyS), Department of Telecommunications, Budapest University of Technology and Economics) and Brig. Gen. Jim Jaeger (USAF, ret), Vice President of Network Defense & Forensic Services, General Dynamics
• How Much Leeway is there in the Computer Fraud and Abuse Act and International Law for Offensive Actions in Cyberspace?
• Featuring Dr. Catherine Lotrionte (Director of the Institute for Law, Science + Global Security, Georgetown University),  Mr. Stewart A. Baker (Partner, Steptoe & Johnson), Mr. Frank J. Cilluffo, Director, Homeland Security Policy Institute at George Washington University, and Mr. Marco Obiso (Cybersecurity Coordinator, International Telecommunications Union (ITU)
• What’s the Downside of Private Sector Offensive Engagement?
• Featuring Dr. Anup Ghosh (Founder and CEO at Invincea), Mr. Jeffrey Carr (Founder and CEO, Taia Global, Inc.), Mr. David Dittrich (Chief Legal Officer, The Honeynet Project), and Mr. Robert Bigman (former CISO, Central Intelligence Agency).
• If the ITU Assumes Ownership of the Internet, How May That Impact International Offensive Cyber Operations by Nation States?
• Featuring Mr. Marco Obiso (Cybersecurity Coordinator, International Telecommunications Union (ITU), Dr. Catherine Lotrionte (Director of the Institute for Law, Science + Global Security, Georgetown University), Mr. Robert Bigman (former CISO, Central Intelligence Agency), and Brig. Gen. Jim Jaeger (USAF, ret), Vice President of Network Defense & Forensic Services, General Dynamics

There are only 28 seats remaining and the Early Bird discount expires in one week so register today to be a part of the year's most unique and informative security event - Suits and Spooks DC 2013. If your employer is interested in joining RSA and Basis Technology as a sponsor, please contact me via email for details.

Add to Cart View detail

The "January Effect" - An Annual Phenomenon Since 2009

I was recently interviewed for a feature in Discover magazine's Top 100 Stories of 2012 (January 2013 issue - on newsstands now). I'm #62 "Defender of the Digital Domain". During the interview, I was asked about a future forecast for 2013. I mentioned a phenomenon that I've noticed each year since 2009 - a major breach or act of cyber warfare that kicks off the New Year. It may start in December and then get publicized in January, or happen in January and get publicized a bit later but it has happened four years in a row now so I fully expect it to occur once again.

December 2008 - January 2009: Operation Cast Lead (a land war w/ thousands of simultaneous cyber attacks between Israel and Hamas)
December 2009 - January 2010: Google and 20+ companies are breached
January 2011 (approximate) - March 2011: RSA was breached sometime early in 2011 with the announcement being made on March 17, 2011.
January 2012: A hacker announces that he has Symantec's source code for Norton and other products.

What will occur or be announced in December 2012 - January 2013? I have no idea but I'm confident that it'll be something impressive.

Add to Cart View detail

Faulty Attribution Analysis by RSA's VOHO Report Negates Its Findings

RSA's First Watch Research and Intelligence Team just released its VOHO report (.pdf) with the declaration that China was responsible (aka "APT"). Their attribution analysis was summarized in two paragraphs:

RSA FirstWatch research has revealed an exploit and compromise campaign with connections over the past 8 months.  The collected data suggests that this attack was orchestrated and carried out by threat actors commonly referred to in the industry as “APT”:

1. Use of the “xKungFoo” script kit for victim redirection
2. Use of attack methodology that matches motives seen in past APT attacks – most notably such as those seen in the Aurora and GhostNet campaigns
3. Use of the “gh0st” remote access tool (RAT) in this and previous campaigns
4. Use of command and control infrastructure in the Hong Kong area in this and previous campaigns
5. Gross impact and on almost 900 unique organizations 
6. Targets of Interest and Opportunity being geographically disperse in addition to industrial & vertical diverse with a heavy concentration in the following areas:

• International finance & banking
• Technology
• Government – municipal, state, federal and international 
• Utilities & energy
• Educational 
• Defense Industrial Base (DIB)
• Corporate Enterprise

The possibility exists that this was intentional misdirection on the part of the attackers in
regards to their origin (emphasis added). However, the RSA FirstWatch team believes the data supports our analysis and this is further evidence of APT intrusion into United States government and corporate assets.

Of those two paragraphs, only one sentence was dedicated to alternative analysis (the one in italics). While it may seem like I'm picking on RSA, they aren't the only InfoSec company that performs lazy, biased analysis. Every company that has issued a report which included a section on attribution has failed to assess the alternatives in a non-biased, rigorous manner (.pdf). RSA's VOHO report can serve as an example of what I mean. Readers are encouraged to look for these types of analytic errors in other InfoSec reports as well.

Use of "xKungFoo script"
The authors referenced the work of researcher Mila at Contagio Dump. While it's true that the xKungFoo script is written in Chinese, that doesn't mean that Chinese hackers were responsible, nor does it mean that a person of Chinese descent wrote it. I personally know Russian, American, and Indian engineers who speak and write Chinese fluently. More importantly, as Mia pointed out in the same blog post footnoted by RSA's researchers, the xKungFoo script is widely available for anyone to use so even if it was originally created by a Chinese hacker, it doesn't mean that it was used by Chinese hackers in all instances.

Use of Attack Methodology that Matches Motives Seen in Past APT Attacks
- Watering Hole Specifics
The authors acknowledge that "the idea of using a target’s interests and likely access points is not a new method of attack" but that its scale is notable. The authors go on to note the array of websites that were used as lures:

• Related to Boston, MA
• Related to political activism
• Related to Washington DC Metro area
• Related to the Defense Industrial Base
• Related to Education

There's nothing in this grouping which would attribute this attack to any one State or non-State actor.

Additionally, the authors wrote that "one of the main sources of infection for these campaigns were sites that support the cause of democratic process in non-permissive environments, or the communication of information related to free speech. " That's way too broad an assessment to come to any conclusion on attribution. In fact, this entire section of the report doesn't include a single piece of evidence that would uniquely identify an attacker.

Use of GhostRAT
Under the reports' Attack Methodology section, it refers to the use of Ghost RAT, a widely available Remote Access Tool which anyone can use. The fact that it was used in an attack against the Dalai Lama in 2008 (GhostNet) doesn't mean that all of the later attacks which used this tool originated with the same group. In fact, even the GhostNet researchers refrained from attributing this attack to China's government.

Use of Hong Kong ISPs
The geolocation of command and control servers is probably the weakest evidence that one can give when assigning attribution, especially when the suspected attacker is China - the world's most popular cyber villan.

Targets of Interest
The targets of interest mentioned by the authors are too broad to be attributed to any one nation state. In fact, the targets of interest combined with the use of widely available malware and Hong Kong-based C&C servers makes it more likely that this was the work of an Eastern European hacker crew who was casting a wide net for data that it could sell to interested third parties.

SUMMARY
Intelligence is a two-part process: collection and analysis. RSA and its peers, by virtue of their widespread customer base, do a very good job with the collection of data but they fail in performing rigorous analysis. Further, because RSA is a vendor in the business of gaining market share, it's good business today to blame China. I know from experience that many corporations, government and DOD organizations are more eager to buy cyber threat data that claims to focus on the PRC than any other nation state. When the cyber security industry issues PRC-centric reports like this one without performing any alternative analysis of the collected data, and when the readership of these reports are government and corporate officials without the depth of knowledge to critically analyze what they're reading (i.e., when they trust the report's authors to do the thinking for them), we wind up being in the position that we're in today - easily fooled into looking in one direction when we have an entire threat landscape left un-attended. We got into that position because InfoSec vendors have been left alone to define the threat landscape based upon their product offerings. In other words, vendors only tell customers to worry about the threats that their products can protect them from and they only tell them to worry about the actors that they can identify (or think that they can identify). This has resulted in a security awareness clusterfuck of epic proportions. For more information on how the threat landscape should be defined (versus how it's being defined by security vendors), see my paper "Intelligence Preparation of the Information and Communications Environment".

Add to Cart View detail

SC Magazine's Awful "Cyber Cold War" Article

Deb Radcliff wrote a feature article for SC magazine entitled "Cyber Cold War: Espionage and Warfare". Since SC is an IT Security publication and since international tensions are rising daily around this topic, I think it's important to confront errors and/or faulty judgments when they arise. This article is filled with them. Here are the top four that stood out to me:

SC: "But, the talk (Gen. Alexander's talk at DEFCON 2012) was also ironic, given that the NSA has been outed as the agency behind Stuxnet – which caused collateral damage on unintended targets in multiple countries, while the United States provided no intel to system operators that may have needed protection."

Wrong. Even though hundreds of thousands of computers had the Stuxnet worm present, it remained inert for all systems except those that it was specifically programmed to attack at Natanz. There was no collateral damage in multiple countries as Radcliff claimed.

SC: "As with Stuxnet, cyber war starts out ‘cold,' with the theft of information that can lead to larger-scale attacks. In that instance, information about targets (Siemens control systems at Iranian enrichment facilities) was collected in preparation for stage two and three of cold war – to disrupt and cause damage. The final stage is when attacks against the national infrastructure and military operations make it impossible for the target nation to respond to a physical assault."

Wrong on multiple counts. The use of the word "cyber war" is ridiculously provocative. Stuxnet was an act of sabotage, not war. In fact, there is no such thing as "cyber war"- not in law and not in fact. The rest of that paragraph is a hypothetical chain of events that Radcliff invented for her article. Stuxnet  was not part of any larger plan to attack Iran's "national infrastructure and military operations". Its sole purpose was to disrupt a specific number of centrifuges involved in nuclear fuel enrichment. Period.

SC: "Stuxnet is one of only a few cases of actual cyber warfare with intent to damage physical systems, says Martin Libicki, senior management scientist at the RAND Corp., a government advisory think tank."

Wrong. I know Martin Libicki and have had occasion to interact with him at closed Intelligence Community events and with all due respect to his credentials, he's frequently misinformed about issues related to cyber warfare, what defines it, who conducts it and in what ways. The only actual events which can be legally described as cyber warfare are the cyber attacks launched during the Russia Georgia war in 2008, Operation Cast Lead in 2009, and possibly the most recent Kyrgyzstan revolution in 2011. In other words, cyber warfare exists when there's kinetic conflict with a cyber component. That's it.

SC: "On the other hand, a good example of mitigation and containment through fast response time is the March 2011 exfiltration of RSA SecurID code. The attack had only been in the network for days when EMC's security team discovered the compromise and took action."

Wrong. In fact, insultingly and ridiculously wrong. RSA lost its entire seed database to that attack. That breach, in turn, led to attacks against one confirmed defense contractor (Lockheed Martin) and probably a half dozen more throughout the year including L3, Northrup Grumman, and others. Nor does RSA's so-called "fast response" timeline hold up under scrutiny.

Radcliff closed her article with the following statement: "Cyber war is upon us, and organizations need better means of protecting themselves and sharing threat information to protect the larger infrastructure."
This is a false claim, irresponsibly made by a reporter who appeared to be determined to write a one-sided article. I really hope that this isn't a sign of SC magazine becoming a FUD mouthpiece for InfoSec vendors who want to stir the pot in hopes of increasing their profits.

Add to Cart View detail

China: Our Incompetent Master Adversary?

According to an article in today's Guardian, State Department and Pentagon officials with their Chinese counterparts have engaged in at least two cyber war games in 2011 and have another planned for next month. These war games are coordinated by two think tanks: Center for Strategic and International Studies for the U.S. and the China Institute of Contemporary International Relations. The goal is to try to manage escalating hostilities between the two nations over China's perceived massive cyber espionage campaign against U.S. companies.

It's distressing to see that the tensions have risen to this point because its based on a seriously flawed evaluation of the facts by well-known companies plus former and present U.S. government officials. For example:

U.S. information security companies like RSA, McAfee, Mandiant, and others routinely issue reports blaming China and ONLY China for intrusions that they've encountered. It's incredible to me that in spite of the 30+ countries actively engaging in acts of cyber espionage, these security giants have only caught China in the act.

Secretary of State Hilary Clinton has been quick to blame China for cyber attacks that targeted Google but for no other reason then because Google said so. And the Secretary has never once warned other countries to cease their cyber attacks against the U.S.

The U.S. China Economic and Security Review Commission routinely puts out alarmist reports about China's military cyber buildup while deliberately refusing to hear testimony by experts who have contrary views to the commission's anti-China agenda.

Richard Clarke's sinophobic, alarmist op-eds routinely get published in the Wall Street Journal and elsewhere even though Mr. Clarke has no standing as a cyber security expert.

No wonder that the Chinese government's irritation with the U.S. has risen to the point where we need CSIS and its Chinese counterpart to conduct a mediation. Beijing is getting tired of being blamed for every attack against every company everywhere in the world, and they're right to be mad. As I've said many times before, it's not that China doesn't do it; they absolutely do, but so do many other countries and just as frequently yet we almost never hear about a major breach being blamed on any country other than China. Either China is the greatest and dumbest adversary that we've ever had, or the real dummies are those in the InfoSec industry who can't be bothered to question the obvious when doing incident response, or who choose to cater to the rising tide of Sinophobia in the U.S. in order to boost their sales; or to politicians and journalists who parrot back the faulty claims of those same companies thereby perpetuating a bad cycle that has resulted in real-world tensions that could have been handled in a more constructive way all along.

While the marketing of anti-China sentiment by some in the InfoSec industry is clearly one part of this disaster in foreign relations, Media deserves its share for opting to print stories that cater to China FUD because it results in higher readership which means more advertising revenue. Since the American public is generally naive about cyber operations by nation states, they believe what they hear about China in the media and cast their votes for the politician who will save them from the menacing red dragon who's sopping up their brain waves and living inside their electric wires. Politicians being what they are cater to that fear and make pronouncements and threats accordingly in order to win votes.

The solution to this problem is simple. As a nation, we need to ask more questions. Accept nothing at face value no matter which "authority" tells it to you, including me. Good intelligence analysts uses negative analysis to test their findings before sending it on to their customers. A little more negative analysis by all parties involved may be what's needed to reduce U.S.-China tensions and improve U.S. security. And it doesn't cost any money to do it. 

Add to Cart View detail

EMC and AmCham-China: A Perfect Recipe For A Network Breach

Here is a classic scenario for how critical technology gets stolen. Take a C-level executive of a company whose focus is high value technology (like Cloud computing) and send him to a country who is spending millions of their currency to acquire that technology (like China) to speak at an event organized by an association that has itself been compromised (like the American Chamber of Commerce in China). 

The event I'm writing about is coming up on August 9 in Beijing: USITO/AmCham-China's ICT Breakfast Series: Cloud Meets Big Data

China is heavily investing in Cloud Computing, having set up its own Cloud Valley located in the Beijing Economic Technological Development Area for RMB 500 million.

One of AmCham-China's employees was sending out email messages with malicious attachments in January, 2011. These were not spoofed emails, which means that the entire organization's network had been compromised and probably still is.

The speaker for the event is the CTO of EMC Jeffrey Nick, whose RSA security division suffered a massive breach last March and whose company offers Cloud computing solutions.

This is a textbook case for how executives may be targeted and compromised by a nation state who's interested in their technology. And if this year has taught us anything, it's that everyone is vulnerable - even a top executive at one of the world's largest information security companies. 

Add to Cart View detail

Three U.S. National Labs Attacked on July 1: Same Mode As RSA

On July 1, 2011, Battelle Memorial Institute suffered a "sophisticated" attack against its network which also impacted Pacific Northwest National Lab and one other lab which wasn't named. Both PNNL and Battelle shut down their email servers and their Internet access as a precaution. As of 0200 03JUL2011, Battelle's website was still down (battelle.org) while PNNL.gov was functioning normally.

Oak Ridge National Lab suffered a similar attack on April 11 which involved a spear phishing email with an human resources related theme that exploited a 0-day in the IE browser. Battelle manages several Department of Energy labs including:

• Brookhaven National Laboratory
• Idaho National Laboratory 
• National Renewable Energy Laboratory
• Oak Ridge National Laboratory
• Pacific Northwest National Laboratory
• Lawrence Livermore National Laboratory

EMC's RSA SecurID division was compromised in a similar way in early March, 2011 via a spear phishing attack with a HR-related theme. In RSA's case it exploited an Adobe Flash 0-day. While Battelle and its managed national labs are all RSA SecurID customers, there is no publicly available information on the ORNL, PNNL, or Battelle attacks which suggests that the SecurID breach played a role at this time.

UPDATE (0300Z 3 JUL 2011):
Since my initial post I've discovered that on Feb 25, 2011 the Dept of Energy issued a "Preliminary notice of violation" to a division of Battelle - Battelle Energy Alliance - which involved three Severity Level I violations, and one Severity Level II violation associated with:

• classification determination; 
• protection and control of classified information; 
• cyber security;
• ineffective self-assessment processes that failed to identify the classified information security, and cyber security noncompliances disclosed by this event.

Battelle Energy Alliance is composed of Battelle Memorial Institute and 4 other institutions including BWX Technologies. BWX (Babcock & Wilcox Company) manages the Y-12 National Security Complex for the National Nuclear Security Administration (NNSA). Y-12 just had its webservers compromised through a SQL injection attack on June 12, 2011 by the Phsy hacker crew who posted usernames and passwords to a Pastebin file. One of the names posted belongs to a VP of SCI Consulting:

(SCI Consulting is the) Prime contract to the DOE Oak Ridge Office to provide the full spectrum of IT support services to the three managing and operating contractors on the Oak Ridge Reservation including Bechtel Jacobs Company, LLC; Babcock & Wilcox Technologies Y-12, LLC; and University of Tennessee-Battelle, LLC.

UT-Battelle LLC is a partnership between the University of Tennessee and Battelle Memorial Institute that manages Oak Ridge National Lab so the possibility of compromise via an SCI Consulting executive's credentials is certainly a risk worth examining. Even if this executive's stolen credentials were not used, it serves as an example of the potential exploitation of AntiSec data released in the public domain which agencies of foreign governments or their agents may use to leverage further exploitation or craft targeted attacks.

UPDATE (07 JUL 2011): The 3rd national lab has been identified as the Thomas Jefferson National Accelerator Facility (aka Jefferson Lab).

www.silobreaker.com

UPDATE (20 SEP 2011): The CIO of Pacific Northwest National Laboratories describes the attack and makes 7 recommendations.

Add to Cart View detail

Breach of Trust: 3 Major Problems With RSA's Public Statements

When a high profile attack occurs and becomes public knowledge, such as the one successfully mounted against EMC's RSA Security division, the company's preparation of its public statement(s) is a critical process. The goal is to start rebuilding customer and stock holder confidence in the company. If it's done right, it may work. If not, it can multiply the effect of the breach far beyond whatever harm the original attack caused. The reason why is because when damage control is done right, product replacement is a relatively easy fix. However when a company issues contradictory statements or when essential facts are missing or obfuscated, then customers may feel a breach of trust. And trust, once broken, can almost never be restored.
While I've recently been very critical of the RSA timeline, as soon as I read Art Coviello's second public statement (issued June 6, 2011), I decided to take a closer look at everything that the company has released on the attack and it isn't pretty, especially as it relates to three essential questions:

1. What was taken
2. How much was taken
3. Who was affected

RSA has produced 5 official statements:

• Art Coviello's Open Letter to RSA Customers March 17, 2011 [1]
• Uri Rivner's Anatomy of an Attack blog post April 1, 2011 [2]
• RSA's Required Actions For SecurID Installations (SecurCare Online Note #1) [3]
• RSA SecurCare Online Note #2 [4]
• Art Coviello's Open Letter to RSA SecurID Customers June 6, 2011 [5]

What was taken?
Art Coviello wrote in his June 6 statement that "certain information related to the SecurID product had been extracted." Now compare that wording to what the SecurCare Online Note #2 says: "Our investigation to date has revealed that the attack resulted in certain information being extracted from RSA systems. Some of that information is related to RSA SecurID authentication products", which is a direct quote from Coviello's March 17th letter.

Analysis: Both Coviellos's letter #1 and SecurCare's note #2 specified two product sets from which data was extracted. The primary was termed "RSA systems" as in "certain information being extracted from RSA systems". The second was a subset of RSA systems - RSA SecurID authentication products. Coviello's letter #2 contradicts that statement by removing the primary product set altogether but without any clarification as to why. So which statement of Art Coviello's is true. The one from March 17th or the one from June 6th?

How much was taken?
How RSA defines "certain information" sheds light on how much of RSA's IP was taken. According to Coviello's letter and the SecurCare Online Note, "certain information" is defined as everything except what is in the customer's care. Here's the exact language in the Online note:
"To the best of our knowledge, whoever attacked RSA has certain information related to the RSA SecurID solution, but not enough to complete a successful attack without obtaining additional information that is only held by our customers." FAQ question #7 is particularly telling. It asks "Have my SecurID token records been taken?". Instead of providing a direct answer, the FAQ repeats that additional customer data not held by RSA is required to mount a successful attack.

RSA has defined how much data was extracted from its systems with the phrase "certain information not held by the customer" or, to put it in plain English, RSA's attackers took everything.

Who was affected?
None of the initial reports mentioned what Coviello referred to in letter #2 as "our view of the motive of this attacker" meaning the defense industry, and he only confirmed Lockheed Martin after Lockheed Martin had made the news public. More importantly, no mention was made of the attack on L-3 Communications even though an internal company email reportedly said it involved duplicate SecurID tokens.

Summary
The presence of contradictory information in Coviello's two statements and between his statements and the SecurCare Online Notes paint a picture of a company that's trying unsuccessfully to hide the scale and scope of this breach from the public, from its shareholders, and from its own customers. Art Coviello confirmed in the most obscure language possible that everything it has pertaining to SecurID was breached; that the only parts not breached were the parts owned by the customer.

Furthermore, if the statement in both RSA's SecurCare Online Notes were accurate, other RSA security products were compromised as well although the extent is unknown. To give you an idea of the possible further scope, here is a product list from the RSA website:

The RSA Product Finder

The only other unanswered question at this point is how Coviello's mismanagement of this crisis will impact EMC's sales and stock price. His keynote at February's RSA Conference was "Proof, Not Promises". That's something that RSA's customers including the U.S. government need to be demanding right about now.

Related Posts:


18 Days From 0day to 8K - An RSA Attack Timeline Analysis

An Open Source Analysis Of The Lockheed Martin Network Breach

EMC and Google Lawyers Walked Into A Bar.

Add to Cart View detail

Was The RSA-Lockheed-L-3 Breach Over A $2.6B DHS Contract?

Site Plan New DHS Building

Since my original post on the Lockheed Martin / Prime contractors breach which I and other security researchers connected to the EMC RSA breach (a fact that EMC has now conceded to), I've been investigating possible motives for this multi-faceted attack. Its always been my belief that RSA's technology was not the primary target but a means to an end. And that "end" apparently involved breaching the networks of multiple Department of Defense contractors: Lockheed Martin, L-3 Communications, and allegedly Northrop Grumman. Other primes mentioned as possibilities by Reuters included General Dynamics, Boeing, and Raytheon.

If RSA was stage one of a multi-stage operation, that would suggest that Lockheed, L-3, and Northrup Grumman as the targets would have something else in common besides just being DOD contractors. Since it's my belief that the EMC RSA attack started earlier than March, 2011 and took some planning prior to its launch, I began looking for contract awards in mid to late 2010 that involved the three victim companies. I found a couple of possibilities that warranted further consideration but then I came across this news item from November 8, 2010: 4 competitors protest award of $2.6 billion IT contract to Northrop Grumman

The award, which is now up for re-bidding (GSA solicitation GST0011AJ0021) is for the crown jewels of the new Department of Homeland Security headquarters - building the infrastructure which will support information technology, telecommunications, security, and building management systems. The contractors who filed protests with GAO are Lockheed Martin, General Dynamics, Serco and L-3 Communications. Of the five companies involved, Lockheed and L-3 are confirmed attack targets, Northrop is an alleged target and General Dynamics is a possible target. Serco hasn't been named by any sources familiar with this attack but they also don't use RSA SecurID tokens; opting instead for Signify, one of RSA's competitors for two factor authentication. 

In order to compete for an award, companies must submit detailed technical proposals in written and oral form with an accompanying slide deck. DHS' acquisition schedule for the competing vendors corresponds with the known dates of the attacks:

DHS TIP Industry Day Deck: (Slide 39)

According to the schedule on slide #39, vendor written proposals were due in April and Orals were due in May. L-3 Communications announced active targeting with penetration attacks on April 6, 2011 while Lockheed reported that its breach commenced on May 21.  Late May was also the time of the alleged attack against Northrop Grumman. 

The information and communications infrastructure of the new DHS headquarters would certainly be a target of interest for foreign intelligence services like the FSB. Even the technical proposals from competing DOD contractors would contain valuable information. The level of detail asked for by DHS is fairly intensive as evidenced by the following slide which breaks out one of the eight required tasks: 

Task 2: Requirements Analysis and Design (slide 26)

If the November, 2010 article in the Washington Post triggered the planning stage of the operation, it offered sufficient time for an adversary to discover that the vendors shared the same two factor authentication technology; perform social engineering research on the target companies' employees, probe company websites for vulnerabilities, and craft customized attacks if needed. This doesn't require the resources of a nation state. Any experienced Eastern European hacker crew could pull it off with a relatively low budget. The upside however is huge. The information contained in those DHS technical proposals could be sold to multiple foreign governments and net the crew a seven figure or eight figure payday. And considering the scope of the DHS HQ project (the largest federal construction job since the Pentagon was built in the 1940's according to the Washington Post), this probably isn't the end of it. Whichever prime contractor wins the TIP contract, along with its sub-contractors, will almost certainly become the next targets to be compromised.

Add to Cart View detail

What the RSA and NASDAQ Directors Desk Attacks Have In Common

When I first wrote about the NASDAQ Directors Desk attack on Feb 6 and Feb 8, I pointed out the core problem with an electronic boardroom application:

Your company’s critical data along with identifying information for your key executives joins hundreds of other companies’ critical data in a private “Cloud” that is no better secured than your own home network. In fact, you’re now worse off than before because your company is part of a larger, more target rich environment that gives an adversary the efficiency of scale. Instead of just one company’s “crown jewels”, he can have access to hundreds without increasing his risk. 

There are a growing number of "electronic boardroom" service providers besides Directors Desk. A 2008 article at the National Association of Corporate Directors mentions Boardbooks by Diligent, Directors Desk by NASDAQ, BoardLink by Thompson, BoardVantage, Leaders4 Board Information Management by 80-20, as well as smaller players like BoardWorks, BoardEffect, IntraLinks, Info-Street, and Endexxhas.

There are always pros and cons to making the details of an attack public. The NASDAQ Directors Desk attack has been in the news since early February and has just had a resurgence of interest with the announcement that the NSA has joined the FBI in their investigation. Personally, I had never known about the existence of an electronic boardroom prior to writing about this attack. Now that I do, I've been advising client companies to either not use them or to drastically reduce the amount of exploitable data that they contain before another attack takes place.

After the RSA attack was announced on March 17th, and with EMC's (RSA's parent company) poor job of providing information about it publicly (not to mention their disgraceful job of not sharing details with their own customer base privately), I wondered how many electronic boardroom services use RSA technology as part of their security. After a little bit of searching, I found four:

BoardBooks by Diligent
BoardLink by Thompson
BoardWorks
IntraLinks

I highly recommend that above companies either contact EMC and demand answers regarding the extent of the RSA breach so that they can determine their own exposure or drop EMC as a security provider altogether. EMC's conduct in disclosing details about their attack has been pathetic. Their SEC filing was word-for-word identical to their press release and the latest blog post "Anatomy of an Attack", written by a marketing executive and not an engineer (which is telling in and of itself), only made matters worse by indulging in folksy descriptors and mixed metaphors as a substitute for providing hard facts on the state of the breach and offering specific guidance to its customers. I wouldn't be surprised if a class action lawsuit was filed against EMC's Board of Directors by their corporate customers for negligence. EMC, like many InfoSec companies, are charging small fortunes for products and services while assuming no responsibility for keeping their customers' data safe. A backlash is sure to follow. 

Add to Cart View detail

EMC and Google Lawyers Walked Into A Bar.

The first thing that a company does when it's compelled to report a significant breach of security is try to mitigate the impact. When Google's Chief Legal Officer David Drummond reported that the company had been the victim of a "sophisticated and highly targeted" attack, he claimed that it only affected two Gmail accounts belonging to Chinese human rights advocates. Take careful note of how Drummond opened his now famous post: "Like many other well-known organizations, we face cyber attacks of varying degrees on a regular basis."

Fast forward from January 12, 2010 to March 17, 2011 and the opening sentence from EMC's "Open Letter to RSA Customers" regarding the attack against RSA's SecureID products: "Like any large company, EMC experiences and successfully repels multiple cyber attacks on its IT infrastructure every day."

The opening sentence is so similar that you'd almost think RSA's lawyers met with Google's lawyers for strategy advice on how to draft their public statement. For the rest of us non-lawyers, the first sentence basically says "This is not our fault".

The balance of EMC's letter asks readers to believe a common conundrum; that the attackers were skillful enough to breach RSA's best security protocols but weren't smart enough to take the crown jewels. Google tried that same tactic a year earlier by referring to its own breach as a highly sophisticated attack which only succeeded in cracking a couple of Chinese dissidents' email accounts. Again, for us non-lawyers, let me break that down for you: "A Mossad hit squad found the Munich terrorists but let them live after giving them a firm talking-to".  Sure they did.

I didn't believe Google then and I don't believe RSA now. I do believe, however, that there's a punch line to this joke that we haven't heard yet. And that it's just a matter of time before we do.

Add to Cart View detail