Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Comments
Hacking Back & the Digital Wild West
Newest First  |  Oldest First  |  Threaded View
este1976
50%
50%
este1976,
User Rank: Apprentice
3/10/2018 | 10:45:21 PM
Re: prevention better than prosecution
Good analysis and wonderful say sir. Your in-depth post has cleared my many doubts. Of course, prevention is better than prosecution.
macker490
50%
50%
macker490,
User Rank: Ninja
3/10/2018 | 8:48:51 AM
prevention better than prosecution
Prevention is better than Prosecution

The Internet has been described as a "Fool's Paradise" from time to time.   I always liked that characterization.

The troubles on the net today largely originate in a general failure to authenticate.

Consider for example the troubles with fraudulent 1040 tax forms.    Or the new mortgage loan scams.  or the grand-daddy of them all: e/mail "phishing" (BEC).

For prevention we need to turn to the work of Whitfield Diffie and Martin Hellman.    These gentlemen understood this issue and knew what they needed to do.   What we need to do is to understand our part in their work: authentication.

When my daughter sat down in the office at the Credit Union to open a new account: that is when the Credit Union -- and my daughter -- should have authenticated the keys needed -- for her online interface(s).

This will need to be incorporated into systems as packaged technology.

We are talking about Public Key Cryptology: PGP, PKI, SSL, TLS, X.509 GnuPG ... it's "out there" -- but to make it work it is necessary to authenticate the keys.

I could give you the "fingerprint" for my key: 4DEA0DAD.  and you could download it from the servers.   But you still wouldn't know who I am.  Once you find a way to identify me and verify the fingerprint on my key THEN you can SIGN my key.   This will make my key VALID in your system meaning you are satisfied that you know who I am.    This doesn't happen with X.509: it's too easy for anybody to acquire an x.509 certificate -- and -- generally -- users have no idea what the certificates are supposed to look like or what data they should contain.

That doesn't matter: HERE -- but -- at the Credit Union or with my tax software and such : yes, it does matter.

Note: the most important aspect of PKI/PGP/GnuPG --- is AUTHENTICATION.

what was the cost of hacking last year:   I'm remembering $600B - .8% of GDP
dave.dittrich
50%
50%
dave.dittrich,
User Rank: Apprentice
3/6/2018 | 1:08:14 AM
"Active Response Continuum" is a better phrase, better model, than "active defense"
I fully agree with Levi, that current proposals to modify existing computer crime statutes are insufficiently nuanced, insufficiently framed, and not ready to move forward. He is right that the consequences of allowing the private sector to become too agressive, too casually, will likely make the situation for law enforcement more difficult rather than easier. I published my own analysis of the ACDC Act 2.0 (and proposals to improve it) along the lines of Levi's suggestions. You can find that analysis on Medium (search for "Medium Dittrich Active Defense Certainty Act", since URLs are not allowed in comments) and read about the Active Response Continuum (search "Dittrich Active Response Continuum").

I believe the end goal here should be to facilitate victims' reporting of meaningful evidence of computer crimes in a timely manner to law enforcement, to better enable the U.S. government to use its sovereign levers of power (diplomacy, intelligence, military, economic sanctions and law enforcement, DIME-LE for short) to pursue criminal actions and violations of international norms and laws against foreign and domestic actors. The private sector does not have the authorities, nor the "whole of government" options, necessary to reduce international incidents like those Levi listed.

There are many examples of corporations using civil legal process (e.g., botnet "takedowns" using temporary restraining orders) within the U.S. justice system. When and if a victim determines that the situation is sufficiently grave to justify violating domestic laws and taking aggressive uncooperative actions on systems not under their authority, outside of civil or criminal legal process, they already have the option under U.S. law to make an affirmative defense for their actions. The idea in the ACDC Act of forcing a harmed intermediary to bring suit in civil court for damages resulting from an entity taking ill considered "active defense measures" seems to me to be unfair and unecessary.


Mobile Banking Malware Up 50% in First Half of 2019
Kelly Sheridan, Staff Editor, Dark Reading,  1/17/2020
7 Tips for Infosec Pros Considering A Lateral Career Move
Kelly Sheridan, Staff Editor, Dark Reading,  1/21/2020
For Mismanaged SOCs, The Price Is Not Right
Kelly Sheridan, Staff Editor, Dark Reading,  1/22/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment:   It's a PEN test of our cloud security.
Current Issue
IT 2020: A Look Ahead
Are you ready for the critical changes that will occur in 2020? We've compiled editor insights from the best of our network (Dark Reading, Data Center Knowledge, InformationWeek, ITPro Today and Network Computing) to deliver to you a look at the trends, technologies, and threats that are emerging in the coming year. Download it today!
Flash Poll
How Enterprises are Attacking the Cybersecurity Problem
How Enterprises are Attacking the Cybersecurity Problem
Organizations have invested in a sweeping array of security technologies to address challenges associated with the growing number of cybersecurity attacks. However, the complexity involved in managing these technologies is emerging as a major problem. Read this report to find out what your peers biggest security challenges are and the technologies they are using to address them.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-7245
PUBLISHED: 2020-01-23
Incorrect username validation in the registration processes of CTFd through 2.2.2 allows a remote attacker to take over an arbitrary account after initiating a password reset. This is related to register() and reset_password() in auth.py. To exploit the vulnerability, one must register with a userna...
CVE-2019-14885
PUBLISHED: 2020-01-23
A flaw was found in the JBoss EAP Vault system in all versions before 7.2.6.GA. Confidential information of the system property's security attribute value is revealed in the JBoss EAP log file when executing a JBoss CLI 'reload' command. This flaw can lead to the exposure of confidential information...
CVE-2019-17570
PUBLISHED: 2020-01-23
An untrusted deserialization was found in the org.apache.xmlrpc.parser.XmlRpcResponseParser:addResult method of Apache XML-RPC (aka ws-xmlrpc) library. A malicious XML-RPC server could target a XML-RPC client causing it to execute arbitrary code. Apache XML-RPC is no longer maintained and this issue...
CVE-2020-6007
PUBLISHED: 2020-01-23
Philips Hue Bridge model 2.X prior to and including version 1935144020 contains a Heap-based Buffer Overflow when handling a long ZCL string during the commissioning phase, resulting in a remote code execution.
CVE-2012-4606
PUBLISHED: 2020-01-23
Citrix XenServer 4.1, 6.0, 5.6 SP2, 5.6 Feature Pack 1, 5.6 Common Criteria, 5.6, 5.5, 5.0, and 5.0 Update 3 contains a Local Privilege Escalation Vulnerability which could allow local users with access to a guest operating system to gain elevated privileges.