Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Vulnerabilities / Threats

8/9/2013
04:46 PM
Mike Rothman
Mike Rothman
Commentary
50%
50%

Black Hat: The Problems Don't Change, But The Solutions Have

An increase in attacker capabilities has drawn an innovative response from industry, and emerging research promises more to come

Bill Brenner figures there is nothing new in security. But it seems he's looking at it only from the perspective of the problem space. I agree that the problems we face as security professionals remain consistent. Bad folks want to steal our stuff. Employees and senior management don't care about security. And these same employees get very pissed when you tell them they can't do something, like watch adult movies on their iPads while connected to the VPN looking at next quarter's financials. Go figure.

Click here for more of Dark Reading's Black Hat articles.

But here's the deal: For the first time in a long time, there is real innovation happening in security. And we need that kind of innovation because the adversaries continue to up their games -- big time. They game applications, they blow up business processes, and they seem to have inside information about how your defenses work. So to think that your signature-based controls and traditional PCI-approved security products will stop these adversaries is naive. And, of course, you aren't naive, right?

Combine that with some pretty good outcomes for investors, like Sourcefire's multibillion-dollar deal with Cisco and FireEye's projected IPO, and you have a Internet bubble-style feeding frenzy on all things cybersecurity. And with new business models and technology architectures (yes, cloud, I'm looking at you), the attack surface is getting bigger and the risk continues to skyrocket. The only thing constant in security is change. So if you thought you were getting into a nice, cushy gig when you studied for that CISSP, forget about it.

Having just returned from a month at Black Hat (well, three days in Vegas seems like a month), there is a lot of stuff to talk about. Remember that Black Hat (and DEF CON, as well) are about emerging research. The stuff I talk about in the Vulnerabilities and Threats section now -- that will be covered in Dark Reading's Attacks and Breaches section in 12 to 18 months. The research at Black Hat was split among a number of pretty timely areas, including malware detection and evading those detections, security monitoring, and mobility.

The most active for research (and innovation) continues to be advanced malware detection. I mentioned a little of what's happening in Controlling the Big 7 a few weeks ago. These new endpoint-centric controls are the tip of the iceberg. Expect to see significant innovation coming to market relative to endpoint forensics and network-based malware detection. Is it perfect yet? No. Will these new tools promise to block every attack? Of course not. The reality is, today's traditional controls can't even block script kiddies using attack kits they bought on Craigslist with Bitcoins. These new offerings will fair better, although they'll be far from perfect.

The tactics to detect malware continue to advance as well. A few years ago, doing malware analysis required a significant investment (think millions of dollars) for both highly skilled people and gear to figure out what malware was doing and to profile it. Now we're seeing folks offering up Web-based services to do the same thing, and open-source initiatives to leverage Big Data analytics to decipher patterns across large data sets to isolate bad behaviors. I guess Big Data can be useful for more than figuring out how to make you pay the most for your airplane ticket or hotel room, and figuring out what should be on the shelves of your local Wal-Mart.

We also saw a bunch of research that can be useful to improve your protection against these malware attacks. But the sessions weren't pitched like that. You saw talk after talk about evasion, and there's a reason for that. Researchers don't really find protection that compelling. But getting around existing protections? Yeah, that's cool. So that means you (as a defender) need to figure out how these new evasion tactics obviate your preventive controls. Then you need to respond and evolve your defenses. Given the sexiness of sandboxes (on both the endpoint and network), it wasn't surprising to see a lot of research focused on bypassing these sandboxes. I hope the vendors were listening, since by the time research is shown at Black Hat, it's well on its way to being weaponized by the adversaries.

There was also Black Hat research on timely issues, like denial-of-service (DoS) attacks and attacking mobile devices. Actually, I was surprised by the modest number of sessions on mobile. Mobility was all over Black Hat last year, so either the topic is not as interesting (unlikely) or the selection committee has mobile exhaustion (more likely). And with the preponderance of DoS attacks, it's not surprising that research is going into figuring out how to evade the scrubbing services and other mitigation techniques.

I understand that Bill may be frustrated that the industry continues to have the same discussions about the same problems year after year without seeming to make any progress. But when you look under the covers both on the attack front and the defense front -- there is plenty of innovation happening. You just need to know where to look.

Mike Rothman is President of Securosis and author of The Pragmatic CSO Mike's bold perspectives and irreverent style are invaluable as companies determine effective strategies to grapple with the dynamic security threatscape. Mike specializes in the sexy aspects of security, like protecting networks and endpoints, security management, and ... View Full Bio

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
macker490
50%
50%
macker490,
User Rank: Ninja
8/10/2013 | 12:47:23 PM
re: Black Hat: The Problems Don't Change, But The Solutions Have
the single consistent thread in computer based business is a failure to authenticate,-- whether that be financial transactions -- or software. the solution has been available for years -- public key encryption. It was developed back in the 60s and made publicly available by Phil Zimmerman.

that PGP has not become a general practice is a question that needs to be examined: Cui Bono?
Commentary
Ransomware Is Not the Problem
Adam Shostack, Consultant, Entrepreneur, Technologist, Game Designer,  6/9/2021
Edge-DRsplash-11-edge-ask-the-experts
How Can I Test the Security of My Home-Office Employees' Routers?
John Bock, Senior Research Scientist,  6/7/2021
News
New Ransomware Group Claiming Connection to REvil Gang Surfaces
Jai Vijayan, Contributing Writer,  6/10/2021
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win an Amazon Gift Card! Click Here
Latest Comment: Zero Trust doesn't have to break your budget!
Current Issue
The State of Cybersecurity Incident Response
In this report learn how enterprises are building their incident response teams and processes, how they research potential compromises, how they respond to new breaches, and what tools and processes they use to remediate problems and improve their cyber defenses for the future.
Flash Poll
How Enterprises are Developing Secure Applications
How Enterprises are Developing Secure Applications
Recent breaches of third-party apps are driving many organizations to think harder about the security of their off-the-shelf software as they continue to move left in secure software development practices.
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2021-34202
PUBLISHED: 2021-06-16
There are multiple out-of-bounds vulnerabilities in some processes of D-Link AC2600(DIR-2640) 1.01B04. Ordinary permissions can be elevated to administrator permissions, resulting in local arbitrary code execution. An attacker can combine other vulnerabilities to further achieve the purpose of remot...
CVE-2021-32659
PUBLISHED: 2021-06-16
Matrix-appservice-bridge is the bridging service for the Matrix communication program's application services. In versions 2.6.0 and earlier, if a bridge has room upgrade handling turned on in the configuration (the `roomUpgradeOpts` key when instantiating a new `Bridge` instance.), any `m.room.tombs...
CVE-2020-25755
PUBLISHED: 2021-06-16
An issue was discovered on Enphase Envoy R3.x and D4.x (and other current) devices. The upgrade_start function in /installer/upgrade_start allows remote authenticated users to execute arbitrary commands via the force parameter.
CVE-2020-25754
PUBLISHED: 2021-06-16
An issue was discovered on Enphase Envoy R3.x and D4.x devices. There is a custom PAM module for user authentication that circumvents traditional user authentication. This module uses a password derived from the MD5 hash of the username and serial number. The serial number can be retrieved by an una...
CVE-2020-25753
PUBLISHED: 2021-06-16
An issue was discovered on Enphase Envoy R3.x and D4.x devices with v3 software. The default admin password is set to the last 6 digits of the serial number. The serial number can be retrieved by an unauthenticated user at /info.xml.