Starting an International Cybersecurity Conversation

crimeandpunishment writes "Every government in the world is dealing with cybercrime, but they're all doing it on their own. In the context of 'cyberwar' saber-rattling on all sides, getting governments to share information is a challenge. But an international security conference this week in Dallas is aimed at doing just that — even if only on an informal basis."

Comments

Re:OpenBSD could eliminate "cybercrime".

[YrWrstNtmr]

"Cybercrime" could be outright eliminated if OpenBSD was more widely used.

You
Are
High

yes, OpenBSD is more secure than windows/OSX.whatever. But a lot of 'cybercrime' happens as a result of userspace. Social engineering. Fraudulent emails. You will need to fix the users.

Also, what do you do about the desktop? You can go on all you want about OpenOffice, etc, but a decade ago when Company X went with Office 97 or 2000...those alternatives did not exist. So now they have 10+ years of corporate crap and tribal knowledge built around the MS Office ecosystem, which cannot change quickly. No matter how much you want it to, it cannot/will not change easily.

Technical problem? Ok, make [your fave distro] integrate as easily as Office/Exchange/Outlook/SharePoint. Not parts of it....all of it.

I guess... who cares?

[Moraelin]

All the talk about "cyberwar" is good and fine, but in the end it seems to me like it's already had a name: "security". In the end, there's very little difference between hardening a machine so chinese government blackhats don't get in, and hardening it so script kiddie asshats don't get in. Unlinke SF movies, there is no way to just type "retrieve password" on some terminal with big letters and get in a system that had no unpatched vulnerabilities to start with.

In the end, a buffer overflow is a buffer overflow, and an XSS exploit is still an XSS exploit, and files accessible by guessing the URL are still files accessible by guessing the URL. And so on. If that exploit is, well, actually exploited by a Russian government blackhat it's "cyberwar", if the exact same exploit is used by an asshat kiddie, it's just being pwned.

And it seems to me like security experts were already going to conferences and otherwise communicating with each other. Exactly what's the loss if they don't explicitly represent some government?

Imaginary problem

[girlintraining]

Everybody's talking about cyberwarfare, but nobody's ever come up with an example of it. Identity theft? Viruses? malware? That's not war. War involves people being hurt -- and I mean really hurt. Not skimming a few extra bucks off the till or organized crime, which is the closest any of this has come so far.

Has anyone managed to shut off the internet? Disable emergency services (911) across the country (or even a state)? Have planes fallen out of the sky, power gone out, hospital computers taken down, or any other act that can be directly attributed to a malignant entity (as opposed to mere human error)? No. And it's not likely to happen anytime soon either.

It's just not cost effective to spend tens of thousands of dollars finding and exploiting security weaknesses in those systems when a 5 gallon tank of diesel, fertilizer, and a match can take out those same systems for a lot less cost. Cyberwarfare between countries isn't likely to happen until other, cheaper methods of warfare somehow become ineffective. At best, cyberwarfare would consist of espionage efforts and manipulating data to advance certain political goals -- and countering that threat is currently handled by the intelligence community.

Re:Imaginary problem

[TubeSteak]

You didn't RTFA did you.

Underscoring the threats: recent attacks on Google Inc. that caused the Internet search leader to move its search engine out of mainland China, and the revelation last year that spies hacked into the U.S. electric grid and left behind computer programs that would let them disrupt service.

There's one concrete example of cyberwarfare.
I'm not even going to bother with the rest of your post.
There's just too much ignorance and "it hasn't happened yet, so it won't" thinking.

Re:Imaginary problem

[ehinojosa]

You're wrong. See Russia's cyberwars on Estonia (2nd story) and Georgia.

Re:Imaginary problem

[Agarax]

Cyberwarfare between countries isn't likely to happen until other, cheaper methods of warfare somehow become ineffective.

And how is a $569K cruise missile to destroy a powerplant cheaper than having someone hack into their systems and leave a program behind to brick the whole thing on invasion night?

Re:Imaginary problem

[davester666]

Well, it entirely depends on how much of the grid they would have control of and what kind of control they could gain. If this gave them control over how generators operated, or how nuclear plants operated, or how hydro-electric dams operated, then they could potentially cause floods, damage to the plant itself [by say, overdriving the plant] or just something like what happened in the Northeast US/Canada, where a small grid failure killed power to a fairly large number of people for a significant amount of time. Do this at the right time, like in the middle of summer or winter, and the potential for a significant number of deaths goes up rather quickly.

Re:Imaginary problem

[grcumb]

There's one concrete example of cyberwarfare.

... which was apparently detected and corrected.

Er, yeah, those are the only ones they can talk about, because they're the only one they want the public to know about. If a problem's been detected and the damage report isn't complete yet, or if a fix hasn't been fully implemented or even if the damage done was embarrassing... there's no way you'd want to tip your hand and let the attacker know your reaction.

And so what if they knock out a small part of the grid for a few hours or days -- What damage does that actually cause? Unless it's part of a coordinated strike, it doesn't do much.

Asked and answered. At the right moment, a power cut can be catastrophic. Perhaps military channels remain open, but if civilian channels are closed, it throws the environment into chaos, making a coordinated response to the civilian crisis vastly more difficult to manage. This ties up resources that could have been focused on defence or counter-attack.

Disabling these services also denies the military the ability to fall back to using the civilian infrastructure in the event of excessive damage to its own capability. That's a great way to shorten the conflict. Why do you think the very first things to get hit during an attack are military and civilian communications and logistics?

The ability to do so over the Internet, without any significant expenditure of personnel or materiel, must seem like a godsend to some.

Re:Imaginary problem

[JWSmythe]

None of your examples have to be cybercrime related. They can easily be done by someone internally. It's more likely that kind of stuff would happen accidentally by the non-malicious staff working it. Look at the power plant incidents that have happened in the past.

    As far as that goes, you could have a major impact on the power grid with some improvised explosives (or several other methods) and knowing where the high tension lines run. If the tower looks like this, it isn't going to work quite as well as expected.

Re:Imaginary problem

[JWSmythe]

    You should try to live in some of the harsh weather states, like Florida.

    When I was a kid, we'd experience up to 12 hours of power outages about once a month. If it was night time, the most chaos was to look to see if the neighbors lights were on.

    During (and after) hurricanes, it's a given that you will probably expect a prolonged power outage. People get along fine without the need of electricity. You'll find both LEOs and civilians directing traffic at busy intersections. You'll even find people helping out with anything they can. I've helped move large trees out of the road and off of houses with little more than a pickup truck, chains, a few helpful people, and a little effort.

Re:Imaginary problem

[grcumb]

You should try to live in some of the harsh weather states, like Florida.

I was born in Canada, ran an ISP in the Arctic for 3 years and now live in the South Pacific, land of earthquakes, tsunamis, hurricanes and volcanoes. I've lived for extended periods of time without power, including the Great Canadian Ice Storm and the blackout of 2002.

I accept what you're saying, but my conclusions from the same evidence differ a little. What we're talking is losing power over wide areas at a crucial moment:

• 12 hours of power loss in NYC is a problem;
• 12 hours of it in the immediate vicinity of a 9/11-style event would severely exacerbate the effects;
• 12 days of it would be a disaster.

Re:Imaginary problem

[JWSmythe]

    Well, from both of our observations, and from what I have seen from other people, we all survive fine.

    The Northeast US gets really nasty storms (i.e., nor'easters). I was only 4 during the blizzard of 1978, but I do remember seeing ice floating in the road and our yard, and houses that had been swept out to sea. I asked my mom about it recently, and she said we were without power or gas for 14 days. Our basement (where the gas heater was) was flooded for a while, so until that got cleared up, we were warmed by whatever they could burn in the fireplace.

    Around mid-summer 2002 (I believe), I remember widespread power outages in the Southeast US due to a hurricane. I was moving from Florida to California, and every hotel (that had power) along I-10 was booked up because the utility companies took all the rooms for their crews. That's also when I found that it's possible but less than comfortable for two people to sleep in the cab of a U-Haul truck. We didn't find a hotel with an available room until we hit Texas.

    In digging around, there have been instances of outages in major cities, including a week long blackout for major parts of New York City in 2006.

Re:Imaginary problem

[HungryHobo]

"how bout the constant attacks on DOD and DOE systems from china"

How about the constant attacks on everywhere from everywhere all the time.

"that they just might lose their minds if they lost it."

So that's where the canibles in all the post apoc movies come from. They're teenagers who lost access to facebook!

Industrial espionage

[Weezul]

We're mostly talking about industrial espionage here. Companies often don't buy security just like people often don't buy health insurance. China's has set an example of government backed industrial espionage, which plays a big role in their growth. So governments see this as an opportunity to provide a service.

In fact, the companies would probably learn they need good geeks eventually, unlike people and health care. Governments could help the most by explaining good people security, which I'm sure get way more subtle than "don't hire chinese nationals for sensitive work."

PEBKC

[Agarax]

The problem exists between keyboard and chair.

An OS is only as secure as the person who uses it.

Anything else is fanboyism.

Re:PEBKC

[DWRECK18]

Your right that the "chair" in question is necessarily the one that the user is sitting in, however you make it sound as if the OP by Agarax is is wrong when its not. For as much as you harden a network and lock it down and secure everything those issues where some user looks at an e-mail and says sure i'll visit your BOA page and input all my information again because well you apparently need it, come on. I have work on secure facilities where things were locked down tighter on the network than fort knox and yet still a user managed to get some form of malware on the network. It happens, unless you completely take away use of the internet from users which by the way I dont recommend as it makes for a very unhappy workplace. However, Antique Geekmeister you aren't wrong either as security through obscurity and just all around poor physical security and network security could also cause as much damage. So as we step back and look at this, we can't blame any single person because depending on what the vulnerability is that was exploited is truly what dictates where the problem started.

Fake Conference?

[An anonymous Frank]

This just totally feels like those fake conferences that were posted about recently, where people would book hotel/voucher packages online only to find out the conference itself did not even exist!

Wouldn't that be sweet irony?

Re:Fake Conference?

[qwerty8ytrewq]

If you had posted a link to your own double-blind fake conference on fake conferences that would be ironic genius.

"Cyber"

[Arancaytar]

How long is it going to take till I can read a word starting with "cyber" without grinning? :D

Re:OpenBSD could eliminate "cybercrime".

[BhaKi]

Your logic is flawed. Your argument is like - OS2 is based on OS1, and OS1 is secure, therefore OS2 is secure. When it comes to security, the valid argument is - If OS2 is based on OS1, and OS2 is secure, then OS1 is secure. This is because the number of bugs in OS2 would be greater than or equal to (but not less than) the number of bugs in OS1. Of course, I'm assuming that bugs are the only mechanism for the emergence of vulnerabilities. But you get the point, right?