At the Bleeding Edge: New Security Challenges

The Shift in the Threat Paradigm

Modern security is increasingly shifting from the protection of classical perimeters to the protection of complex socio-technical systems. A striking example of the vulnerability of new platforms was the incident with the Light Blue Touch Paper blog, which used the Wordpress engine. Despite the fact that the developers promptly closed the vulnerabilities, the blog was hacked by a Russian "script kiddie" who was trying to place drug advertisements. This case underlines the main problem: we depend ever more on applications that we do not have time to evaluate fully for security.
If formerly security focused on the protection of data and networks, today other people are becoming the "main application" of the internet. This gives rise to entirely new classes of threats, which I assign to "the bleeding edge" (The Bleeding Edge). These include online games, web applications (auctions, search, social networks), anonymity-enabling technologies and electronic voting.

Computer Games: From Pong to Virtual Economies

Computer games were one of the first applications for computers. Back on the first full-fledged computer EDSAC, students wrote games, and AI researchers created chess programs, believing that their solution would lead to the creation of full-fledged artificial intelligence. Today games are an industry whose revenues are comparable with the box-office receipts of Hollywood blockbusters, and the move of games online has given rise to unique problems of security and cheating.

Types of Cheating in Games

Cheating in games has existed for as long as games themselves, but the online environment has given it a new scale. Three main types of deception are distinguished:

1. Exploitation of known vulnerabilities and rules.
   The classic example is the game of bridge. In offline tournaments a screen is placed between partners so that they cannot see each other's cards, but cheaters can transmit information through coughing or intonation. In online bridge this problem is solved by protocols, but a new threat appears: the creation of multiple identities (Sybil attacks). If new accounts can easily be created in a game, an attacker can gain an advantage by playing against himself.
2. Standard cyberattacks.
   Game clients and servers are subject to the same threats as ordinary software: phishing, DoS attacks, memory reading and data interception. For example, 5% of all malicious code recorded by Symantec is aimed specifically at online games (the theft of Gampass and Lineage accounts).
3. New tactics generated by the network environment (Neotactics).
   In tactical shooters success ought to depend on the player's skills, and not on network delays. However, because of the peculiarities of data caching on the client, a paradox arises: a player with a higher delay (ping) gains an advantage if he is the first to come out from behind a corner. His client already "knows" about the opponent, while the server and the victim's client are still exchanging packets. The use of such network anomalies has received the name of "neotactics".

Bots, Aimbots and Unauthorized Software

One of the most persistent problems is bots and automated assistants. Aimbots (programs for automatic aiming) and wall hacks (software making walls transparent) completely destroy the balance. Developers try to combat this by protecting data streams and using anti-cheat scanners, but the arms race continues.
An interesting solution for combating cheaters was proposed by the game Call of Duty 4. It implements a system of action replays, allowing the victim to look at the killing through the eyes of the killer. This not only reveals the use of aimbots, but also reduces the perception of unfair play, which is critically important for retaining the audience.

Virtual Worlds and Virtual Economies

With the appearance of MMOs (massively multiplayer games) a new economic reality was born. Game items and currencies began to cost real money.

• Farming: "Gold farmers" appeared (often in countries with low wages, for example in China), who for hours extract game resources for sale. This gave rise to organized crime. For example, in the game Lineage hackers used stolen identifiers to create hundreds of thousands of accounts, with the help of which they stole game valuables worth about $15 million.
• Virtual worlds: Platforms such as Second Life (developer Linden Labs) allowed users to create their own content and business. The internal currency (Linden dollars) is exchanged for real dollars. However, virtual worlds quickly ran up against real legislation. After the FBI began raids on underground online casinos, a collapse of the virtual real estate market occurred in Second Life, and rental rates fell sharply.

Virtual economies also faced the problem of fraud and money laundering, which forced developers to introduce verification systems (for example, linking to credit cards) in order to comply with anti-money-laundering laws (AML).

Web Applications: eBay, Google and Social Networks

As critical components acquire the ability to communicate, and business moves online, web applications come to the fore. Developers often treat security as a secondary task, which leads to the appearance of new classes of vulnerabilities and exploits that did not exist in classical "embedded" systems.

Common Threats to Web Applications

One of the most common vulnerabilities of web services is cross-site scripting (XSS). Scripting languages such as JavaScript allow sites to interact with the user, but they also open the door to the injection of malicious code.
Another serious problem is becoming data leaks because of the phishing of employees. In November 2007 the company Salesforce.com admitted that a phishing attack on one of its employees had led to the compromise of databases, as a result of which customers began to receive fake invoices. In another incident the bank SunTrust faced the fact that 40,000 of its customers turned out to be compromised because of similar actions.

eBay and the Problems of Trust

The eBay platform and its payment system PayPal are the largest targets for phishers and fraudsters. Phishing against PayPal works according to the same schemes as against banks, but with an important difference: PayPal customers are not protected by laws such as the American Regulation E (which shifts responsibility for credit card fraud onto the bank). Here customers are forced to rely exclusively on the good will of the company itself.
Besides phishing, good old-fashioned frauds flourish on eBay. For example, tricksters send letters to users who did not win the auction (underbidders), offering them to buy an analogous item directly, which in the end turns out to be a fake or is not sent at all.
With the appearance of reputation systems (reviews and ratings) a new kind of attack also appeared — account takeovers. Attackers hack the accounts of sellers with an impeccable history and a high rating in order to use their trust for the sale of nonexistent goods.
Another sophisticated scam is connected with fake escrow services (escrow scams). The fraudster sells, for example, a car and offers the buyer to use a "secure transaction" through an escrow site. The buyer transfers the money to the fake site, after which the fraudster disappears together with the money.

Google: Search, Advertising and Confidentiality

The security of Google is a colossal task, given the scale of the company. One of the unique threats became Google Hacking — the use of the company's own search mechanisms to find vulnerable servers, open databases or confidential information left by developers in open access.
Google's business model is built on targeted advertising, which gave rise to specific attacks:

1. Click-fraud: Competitors or attackers repeatedly click on an advertisement in order to exhaust the victim's advertising budget.
2. Impression spam: Competitors load pages with advertisements but do not click on them. This artificially lowers the click-through rate (CTR), forcing Google's algorithms to downgrade the rating of the advertisement.

The phenomenon of MFA (Made for Adsense) sites also flourished. Fraudsters create "fake institutions" — they copy the sites of real charitable or educational organizations, fill them with content and place advertisements. In order to raise their search rating (PageRank), they even exchange links with real sites.
Confidentiality remains an enormous problem. Search histories and clicks contain a colossal volume of personal data. An instructive case occurred when the company AOL published (supposedly anonymized) search queries of users. Journalists easily identified specific people simply from the content of their search queries. Google, for its part, constantly balances between retaining data for business and the requirements of personal data protection laws.

Social Networks: The Complexity of Policies and New Risks

Social networks (Facebook, MySpace and others) radically changed the way people communicate, but they also brought new problems with security and privacy.
Government recommendations often come down to frightening parents with the theme of "predators"; however, research shows that the internet has not led to a rise in child abductions. The real problems lie in a different plane:

• Cyberbullying: If formerly children could find a refuge from their tormentors at home, now the harassment follows them through the screens of smartphones and computers.
• The extreme complexity of privacy settings: Security policies in social networks have become incredibly tangled. For example, in Facebook a user had to make his way through six screens of settings in order to understand who could see what. The confusion between opt-in and opt-out mechanisms leads to users mistakenly making the private public.
• The problem of tagging and other people's photos: A user does not always control his digital shadow. A striking example occurred during the New Year holidays of 2008, after the murder of Benazir Bhutto: the British press published a photograph of her son and political heir Bilal Bhutto dressed in a devil's costume at a Halloween party. This photo was found on the page of one of his student friends in Facebook.
• Third-party applications: Users often authorize third-party games and utilities, giving them full access to their profile. This leads to data leaks, since the security of the third-party developer may be at zero level.
• The threats of public search: Search functions inside social networks can index data that users considered hidden. Researchers called this problem "Go Fish", demonstrating how closed information can be extracted with the help of search queries.

Social networks try to embrace almost all aspects of human behavior, but it is precisely this totality that makes their security management a nightmare for engineers. Users find themselves drawn into a complex web of settings, where a single error can lead to reputational or even physical risks.

Privacy-Enhancing Technologies and Electronic Elections

As business and everyday life move online, huge arrays of information begin to be collected by corporations. License servers, DRM systems and trackers know everything about users. But what is to be done by those who need privacy not simply out of considerations of comfort, but for survival, for the protection of commercial secrets or for compliance with human rights?
To understand the spectrum of problems, let us consider seven hypothetical users whose tasks require different approaches to privacy:

1. Andrew is a missionary in Texas whose site is read by people converted to his faith in Saudi Arabia (where a change of religion is punishable by death). He needs to communicate in such a way that the Saudi secret police cannot trace the fact of the correspondence.
2. Betty is the user's 10-year-old daughter. She needs to remain anonymous on the net in order to avoid the attention of predators.
3. Charles is an engineer in a company working in stealth mode. He keeps a blog in violation of corporate rules and must conceal his authorship.
4. Dai is a human rights defender in Vietnam, in contact with trade union activists. The police regularly search her.
5. Elizabeth is an analyst in an investment bank studying targets for mergers and acquisitions. She needs to hide the fact of her research from the target companies.
6. Firoz is a gay man in Tehran, where homosexuality is punishable by death. He needs to download specific content without the risk of being caught.
7. Graziano is a magistrate in Palermo creating an anonymous hotline for denunciations of the mafia. He must protect informers from corrupt policemen.

Anonymous Electronic Mail: The Dining Cryptographers' Secret and Mixes

The main threat to anonymity is not necessarily the breaking of the cipher, but traffic analysis. Even if a message is encrypted, the very fact of communication between Andrew and his followers can betray them.
In 1981 David Chaum proposed the concept of the "Dining Cryptographers' Problem". Several cryptographers are dining at a round table. One of them is secretly paying the bill, but they do not want to reveal who exactly (perhaps to avoid gratitude or, conversely, revenge). The protocol allows them to guarantee mathematically that none of the participants will be able to compute the payer, even if they all collude. This provides unconditional anonymity of the sender and the receiver.
In practice this idea is implemented in mix networks (anonymous remailers). The user encrypts the message with the remailer's key, indicates the final address and sends the packet to the remailer. The remailer decrypts the packet, sees the next address (or the final recipient) and forwards it further. Thus an observer controlling the channel sees only that the user contacted the remailer, but does not know what is inside or where the message will go next.
The evolution of anonymous remailers passed through several stages:

• Digital pseudonyms (Nymservers): They allowed users to receive and send mail under fictitious names.
• Chains of remailers: The message passed through several nodes. If one node is compromised (for example, is a "trap" of the intelligence services), it sees only the previous and the next node, but not the whole chain.
• Mixmaster: A standard that fixed the size of messages and used complex routes in order to make traffic analysis by the volume and timing of packets more difficult.

However, such systems had vulnerabilities. The intelligence services could run their own nodes (honeypots) to collect statistics, and hackers could carry out DoS attacks on remailers, forcing them to disclose information or simply putting the system out of action.

Anonymous Web Surfing: Tor

For the anonymization of web traffic the project Tor (The Onion Router) was created, originally developed by the US Navy. The idea was to protect the communications of intelligence officers and agents by passing traffic through a distributed network of nodes.

How it works: The Tor client software builds a chain of several servers. The data are encrypted layer by layer (like an onion). The first node removes the first layer of cipher and sees where to go next, but does not see the content. The second node removes the second layer, and so on. Only the last node (exit node) sees the clear traffic and sends it to the recipient.
Vulnerabilities of Tor:

1. Malicious exit nodes. Since the last node sees the decrypted traffic, an attacker can run his own exit node and intercept unencrypted data. In one case, in this way, the web-mail passwords of employees of several embassies were intercepted.
2. Side channels. Browser plug-ins (Flash, ActiveX) or scripts can initiate direct connections, ignoring the Tor proxy and revealing the user's real IP address.
3. Global adversaries. Intelligence services (for example, the NSA) controlling a significant part of the backbone internet can correlate the time and volume of incoming and outgoing traffic on different nodes, de-anonymizing users.
4. Analysis of the structure of web pages. Even if the traffic is encrypted, different web pages have a unique "fingerprint" (the size of the data being loaded, the timings of requests). An observer can determine which particular page the user is visiting simply by analyzing the traffic patterns.

Confidential and Anonymous Telephone Calls

The simplest way of anonymous communication is prepaid mobile telephones (SIM cards bought for cash). However, there are risks here too. For example, leaders of "Al-Qaeda" were caught because they used SIM cards from one and the same batch bought in Switzerland, which allowed the intelligence services to track them down by metadata.
The alternative is VoIP (for example, Skype). Skype encrypts traffic, but is a centralized system. Human rights defenders (like Dai) often use a combination: Skype for voice, PGP for mail and Tor to hide the fact of using Skype. However, under conditions of total surveillance, physical security is also important: protection against listening devices in the room, the use of disposable devices and careful observance of operational camouflage.

Encryption of Electronic Mail (PGP)

Pretty Good Privacy (PGP) uses the "Web of Trust" model, where users personally sign each other's public keys, avoiding the need for centralized certification authorities.
However, PGP ran into a serious problem of usability. The study by Whitten and Tygar ("Why Johnny Can't Encrypt") showed that ordinary users do not understand how to correctly generate keys, manage them and sign messages. As a result the system either was not used, or was used with critical errors.
In addition, no mathematics protects against "rubber-hose cryptanalysis" (extortion and torture), when the attacker simply demands that the key or password be handed over under threat of violence.

Steganography and Countermeasures for Forensics

If encryption attracts attention (the very fact of the presence of ciphertext is suspicious), steganography comes to the rescue — hiding the very fact of data transmission.

• MP3stego: The covert transmission of data in MP3 audio files by modifying the least significant bits.
• Steganographic file systems: They allow not only the content, but the existence of a file to be hidden. The disk looks as if it is filled with random noise, but when the correct password is entered the hidden data "appear".

Countermeasures for forensics: To hide their actions from forensic experts, users apply various tricks. For example, the deletion of license keys from Windows Media Player (which makes downloaded films unreadable and looks like an ordinary error, rather than the deliberate concealment of evidence), the use of many devices, or the hiding of data in the "blind spots" of the operating system.

Bringing It All Together

Returning to our seven users, one can see that no ideal solution exists:

• Andrew (the missionary) cannot use open channels. He needs complex chains of remailers and steganography.
• Betty (the daughter) needs parental control and education, and not complex cryptographic tools.
• Charles (the engineer) must use anonymous networks (Tor) and pseudonyms in order to hide corporate traces.
• Dai (the human rights defender) must combine encryption (PGP), anonymization (Tor) and physical caution.
• Elizabeth (the analyst) can use corporate VPNs and isolated environments, but she needs to hide the patterns of her queries.
• Firoz (the gay man in Tehran) is forced to use deep layers of anonymization and steganography, since the risk of the death penalty is extremely high.
• Graziano (the magistrate) must protect not only the communication channel, but also the database of informers from corrupt insiders.

The main conclusion: anonymity loves company. The more people use concealment tools, the more effectively they work. The idea of "key escrow" (the handing over of copies of keys to the state) is rejected by cryptologists, since it creates a single point of failure and violates the basic principles of security.

Electronic Elections

The transition to electronic voting systems became one of the most acute problems at the junction of technology and politics. The impetus was served by the events in Florida in 2000 (the Bush versus Gore election), when mechanical problems with the ballots caused a large-scale crisis. In response the US Congress allocated billions of dollars for the modernization of voting systems, which led to the mass introduction of DRE (Direct-Recording Electronic) systems — direct electronic recording systems, where the voter presses buttons on a screen and the machine saves the result.
However, electronic elections gave rise to a fundamental security paradox:

1. The voter must be sure that his vote has been counted.
2. The voter must not have the ability to prove to anyone else exactly whom he voted for (otherwise the buying of votes or the intimidation of voters becomes possible).

In traditional paper voting this is achieved by the ballot being dropped into the box anonymously, but a physical trace remains for a possible recount. In electronic systems (DRE) the machine simply records a digit in memory.

Vulnerabilities of Electronic Systems

Analysis showed that DRE machines are extremely vulnerable to software errors and to targeted attacks:

• The Diebold Study (Johns Hopkins University): The experts discovered that the software of Diebold machines has no independent audit, contains critical vulnerabilities and allows an attacker with physical access to the machine (for example, a member of the electoral commission) to substitute the results of the voting or to inject malicious code that "quietly" changes votes.
• Florida (2007): An independent review revealed that the machines do not properly ensure the secrecy of the vote and can be compromised through network interfaces or memory cards.
• Ohio (the EVEREST Report): A large-scale study confirmed that electronic systems can guarantee neither accuracy, nor security, nor the possibility of an independent recount of votes without a paper trail.

Paper Trails and Alternatives

Security experts (such as Avi Rubin and Rebecca Mercuri) insist that any electronic voting system is obliged to generate a verifiable paper trail (VVPAT). The voter must see on the screen not only the digital choice, but also a printed ballot behind transparent glass, must confirm it, and only after that must the paper trail fall into a protected box. This makes it possible to carry out a manual recount in the event of a dispute.
An alternative to DRE is optical scanning systems, where the voter fills in a paper ballot and the machine reads it. This preserves the physical trace but reduces the risks connected with the vulnerability of the complex software of touch screens.
The conclusion to which the community of security specialists has come is disconsolate for the supporters of full digitization: electronic voting (in the DRE format) carries unacceptable risks. Without an independent paper trail verifiable by the voter, the results of elections conducted on "black boxes" (machines with closed code) cannot be trusted.

Conclusions and a Look into the Future

The Security Engineer of the 21st Century

The protection of information in computer systems is no longer a purely scientific discipline — it is a full-fledged engineering practice. The security engineer of the 21st century bears responsibility for systems that constantly evolve and face a changing spectrum of threats.
To remain effective, the specialist must constantly raise his technical literacy: track the latest attacks, master new tools and follow changes in the legal and political spheres. However, technique alone is not enough. The engineer needs a firm intellectual base: an understanding of cryptology, access control, information flows, network technologies and signal detection.
It is no less important to understand the basics of management: how accounting, finance and the client's business processes work. But the most important skill of all is the ability to manage technologies and to participate effectively in the process of the evolution of systems in order to satisfy changing business needs. The ability to speak the same language as business leaders, and not only as other engineers, is of decisive importance, and practical experience plays an enormous role. People with such a combination of skills are unlikely to face unemployment or boredom.

The Shadow of the Security-Industrial Complex

However, the profession also has a dark side. The violent growth of the security-industrial complex after the terrorist attacks of 11 September 2001 and the frank whipping up of fear on the part of many governments have become a serious scar on the face of the world and of this profession.
Engineers have a debt to help heal this wound. This can be done in several ways:

1. Research: the development of such disciplines as security engineering and security economics.
2. The dissemination of knowledge: open discussion of the real mechanisms and threats.
3. Economic growth and education: it is precisely the poor and uneducated strata of the population that are most susceptible to the influence of demagogues exploiting fears.
4. Participation in political debate: the final and most important way is to interact directly with the people who set the agenda and discuss new threats, in order not to allow irrational decisions to be adopted.

Research Problems

Despite colossal progress, a number of unsolved tasks stands before the industry. First of all, new ideas are urgently needed in the field of the management of security evaluation.
To date we use completely different and often incompatible tools for measuring the level of protection that can be expected from:

• cryptographic algorithms;
• technical mechanisms of physical protection;
• complex software;
• internal control in organizations;
• and, with the help of usability research, from people.

A number of fundamental questions arise:

• Is it possible somehow to combine these tools so that critically important elements do not fall out of view?
• Can we develop evaluation mechanisms better than the Common Criteria, which the vendors themselves privately consider meaningless bureaucracy?
• Perhaps it is worth applying the tools that economists use for working with imperfect information: from risk pricing models to the theory of the firm.
• We also need better statistical tools for measuring and predicting failures.
• And finally, we must take up "taboo" topics. For example, why did the "Millennium Bug" (the Year 2000 Problem) in the end not lead to global catastrophes?

A Final Thought

Around the industry of assurance and evaluation a whole business has been built up, supported by mountains of tax money. The enthusiasm of its adepts often acquires the features of a religious cult. Unfortunately, there is a catastrophic shortage of people prepared to write "heresy" and to question the established dogmas of this industry. It is precisely with such "heretics" that the future of security engineering lies.