Hiding a virus in plain sight

When I defined principle #14 of The Perfect Virus, Stealth, I suggested hiding the virus in plain sight: inside a .jpg  or .gif image. Based on Brian Krebs' blog of this week, the bad guys are half way there, swapping Google images for malware. It's only a matter of time before your grandmother's warning will quite literally come to pass:

"Son, you keep doing that and you'll go blind."

Well, at least your computer will develop some serious problems. Along with your online banking and credit card accounts.

Dear Japan/Sony; really, call Larry Ellison

Today's online Time/Techland news had two relevant Sony stories—(1) Sony CEO Stringer announces $1 million of identity theft insurance to PSN customers, and that (2) another attack is planned against Sony—which cause me to reiterate some heartfelt advice I left as a comment on #1 above:

I'm still inclined to cut Sony some slack here. The decision was "late" but not "too little" IMHO. Now, if Howard Stringer could just find a government (Japan, probably) inclined to legitimize a bunch of "cyber privateers" to open up a giant can of whup-ass on the people attacking Sony. I still think Japan's Prime Minister Kan and Sony CEO Stringer should give Oracle's Larry Ellison a call. Larry knows how to go to war, which I detail at in my previous call Larry Ellison posting.

Let's face it. The attack-Sony mentality is not some heartfelt movement by righteously indignant tekkies, but rather a plausible excuse for some wandering adolescents to go on a spray painting binge. For that reason, I don't personally see and end in sight for Sony. At least there is no end short of making it highly dangerous for anyone to attack them.

Really guys, you should call Larry. After which you should give some highly educated and financially motivated cyber privateers their get-out-of-jail-free card. From my post yesterday, there may even be the beginnings of a justification under U.S. law, assuming the U.S. District Court decision survives an inevitable Supreme Court challenge.

2nd big legal ruling of the new millenium

Yesterday's news that a U.S. District Court has ruled that an IP address is NOT a person could be quite interesting. Not as interesting as my report on the 1-800CONTACTS attempt to hijack the Internet. But follow my logic. Lewis Carroll wrote Alice in Wonderland and was also a mathematician who expounded on logic and mathematics. So is the following what Carroll might call an "invalid syllogism?" Well, as I said in the 1-800CONTACTS posting, I'm no attorney. But this could be the one-two-three punch needed to get cyber privateering (or at least a level of countermeasures) on solid legal ground:

1. The court has ruled that an IP address is NOT a person.
2. If therefore your servers, your computer, or your life is attacked from an IP address, you could then legitimately "roach" that IP address to determine from whence the attack came. Because the IP address is not a person, but a vehicle for perpetrating a crime. This is critical to enforcement of your cyber privateer Letter of Marque and Reprisal.
3. And per paragraph 1 of the Cyber Privateer Code, "Any unauthorized attempt to access your computer or phish your data access privileges constitutes a crime punishable by the looting of the attacker's assets by an authorized cyber privateer. All assets. Within 6 months of the attack."

What I'm trying to say is that today's reported ruling might be the precursor to the get-out-of-jail-free card critical to legalizing retaliatory cyber exploits.

We'll have to wait and see if the U.S. Supreme Court backs up this decision. Because it will most certainly be appealed. Let's hope they fast-track it.

Second Sony bomb a dire warning for U.S.

With the announcement of the second bomb obliterating another of Sony's online gaming networks, I also add Brian Krebs' warning from an "unnamed" security expert to emphasize the dire situation for us…er…U.S.

“What a lot of people need to understand is that there is a concerted and organized national level strategy being orchestrated against our country and others,” said one security expert who has helped a number of organizations respond to these sophisticated attacks, but who spoke on condition of anonymity because he was not authorized to speak to the press. “Not many security companies out there are highly focused on this threat. We’re at risk of being completely overwhelmed and outmatched [if we don't] work together in a collective defense.”

 As I point out in my discussion of The Perfect Virus principle #14, Stealth:

In summary, The Perfect Virus will always execute a so-called "Zero Day" exploit, and never a signature one. It can't be blocked by Whitelisting because it Seamlessly Migrated (principle #5) with trusted applications.

As I mentioned over the last two posts, contrasting the U.S. mindset with that of China, we're just about to the point of defeat in the currently raging but as yet undeclared Cyber War.  The key point of agreement is the above "unnamed" assertion that, "Not many security companies out there are highly focused on this threat." I would add to that that our government is certainly not focused on this, either.

And the "dire" part of my assessment: Not only are aggressive counterattack policies needed, but our window for even considering licensed and bonded cyber privateers is rapidly closing.

China cyber war doctrine no secret

I contrast my post yesterday (about U.S. cyber war doctrine and its endemic stupidity) with that of China. They actually published their doctrine (see this link) in which the following sentence pretty well sums up their status:

Significant progress has been made in building information systems for reconnaissance and intelligence… 

Linked with their unambiguous support of penetration hackers from within their borders (as reported today by Brian Krebs in his blog), you may understand why I characterize the U.S. cyber doctrine as patently stupid when compared with that of China. Krebs' telling sentence makes my point:

Open source information available about the tools used in recent attacks labeled APT indicates that some of the actors involved are doing little to cover their tracks: Not only are they potentially identifiable, they don’t seem particularly concerned about suffering any consequences from their actions.

Perhaps the Chinese hackers aren't particularly concerned about "suffering any consequences from their actions" because they have a get-out-of-jail-free card from their government. Which is a heck of a lot more than we can say in the U.S. So while our guys feign disinterest in the source of cyber attacks and would rather just play defense and get corporate America back up and running more securely, their private and public teams are in it to win it.

Does anybody see anything wrong with this picture?

Sincerely yours,

The Destroying Angel