Slashdot Mirror
The Lesson of Recent Hacktivism
itwbennett writes "LulzSec says they're retired, which may or may not be true. But one thing the world has learned from their 'frightening yet funny escapades is that 'the state of online security stinks,' writes blogger Tom Henderson. LulzSec (and Anonymous) have 'demonstrated that an awful lot of people are either asleep at the switch or believed in arcane security methods like security through obscurity.'"
A related story at the Guardian suggests that governmental attempts to control the internet are spurring these activities.
Its a site that allows celebrities & famous people to make twats of themselves by not speaking through agents, PR or lawyers.
They believed that money spent on security products == we are secure. They were not asleep. They did not believe in security through obscurity. They trusted the industry. They gave it money in return for products that were supposed to protect them. They lived in ignorant bliss. Unfortunately, the security industry (and the rhetoric they proclaim) is all about the end goal of the industry making money. Companies are lured into a false sense of security based on what they are being told, and what they spend money on - and it seems totally reasonable from their perspective. Unfortunately, the public (and the victim companies) are not aware of one tenth of one percent of what is actually going on. Any company that has anything worth significant financial value is either compromised or is a target with a big bulls eye on their gold stash - guaranteed.
LulzSec might have ended, but I can guarantee you the exact same stuff is happening underground, except this time you probably won't know all your information has been stolen. Other than exposing corrupt whitehats I don't really agree with their actions, but I'm not sure if the alternative of keeping it in the hands of underground blackhats and IRC scriptkiddies is any better (not that is wasn't going on during LulzSec as well, but still).
Regardless, the AntiSec movement seems to be picking up some steam, at least within Brazil (protests are planned for July 2nd), and the first AntiSec release has just been posted to Pirate Bay: http://thepiratebay.org/torrent/6502765 with more promised tomorrow.
Regardless of their "supposed" script kiddie status (they did break into a hacking contest website and turned down the 10k), I think it was smart for them to disband and take up a greater cause, and I guess time will tell if they are successful or just run out of water.
V for Vendetta? Seriously? That quote's from W.B. Yeats: Turning and turning in the widening gyre The falcon cannot hear the falconer; Things fall apart; the centre cannot hold; Mere anarchy is loosed upon the world, http://www.potw.org/archive/potw351.html Credit where it's due.
Actually, arcane means something is known to few/obscure. So an arcane security method could be interpreted as a security method that relies on obscurity.
I don't think people are asleep at the switch, at all.
I also don't think they are relying on security through obscurity.
In large companies I have worked for, there are a lot of very competent people that care a lot about security. But the thing is, security is a minor consideration to spend time and money on compared to making working systems.
Obviously it would be better if that would change, but I don't think honestly it can until someone has had the lesson REALLY driven home to them by a major security issue.
I would bet that within five years Sony security is actually pretty good. It is a good wake-up call to the industry, but remember that generally the alarm clock is only really heard by the owner of the house it rings in...
"There is more worth loving than we have strength to love." - Brian Jay Stanley
Nobody wants security. Everyone wants compliance.
From an auditor's point of view, it's very easy to explain the reason why the security in most companies is at a level that's not even laughable. No company is interested in it. What they want is certificates, they want their ISO27k and their PCI-DSS, but not because they want them to know for themselves that they're secure, they want them to display to others that they are, so they can get contracts or are compliant with legal requirements to be allowed to do something.
Now, some might think security and compliance with security requirements is the same. Both mean that you "want" security. And that's the fallacy. Security is something you want yourself. You want security because you want to be secure. Security is in this case the primary interest and the focus by itself. Compliance is something that is forced onto you. You want security because someone else wants you to be secure. Security is in this case only the means to the goal, be it to conform with legal requirements to continue operations or be it to be allowed to process credit card payment.
Within the last decade or so, the number of companies where I actually had the idea that they wanted security for themselves, even if only as a side effect to the compliance requirements, was very, very low. Most want to get done with it, preferably fast and without hassle. If the compliance requirement is that your door is locked and barred but doesn't say anything about your windows, they won't even listen to you if you tell them they have no windows but just big holes in the wall. Their door is sealed, that suffices to be compliant. The windows? Not part of the compliance requirement, we don't care.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Here's the thing: information security, just like any other type of security or insurance, is completely relative.
My dinky little websites have adequate capacity to serve the few hundreds of people a day who visit them, but would not withstand a Slashdotting or DDoS. My house is secure enough to resist a burglar, but not secure enough to resist a Navy SEAL strike team. Does this mean I'm negligent? No, it means that I could spend thousands of dollars on additional infrastructure for security or capacity but I choose not to because it's highly unlikely I would need to.
That's why the example of LulzSec is pathethic and not instructional. There are lots of "soft targets" on the Internet (in terms of security or capacity) that you could take down pretty easily if you wanted to, just because those sites can't justify full-time security teams or massively extensible infrastructures. I'm not talking about high-profile sites like Sony or the CIA, but stuff like EVE login servers or some county in Arizona. A bunch of douchebag script kiddies taking down some MMO server doesn't necessarily mean that anyone was truly "negligent," it just means that they picked easy targets. And there is not, nor will ever be, a shortage of easy targets on the Internet if you're willing to aim at those.
"95% of all Slashdot
I swear to fucking god - look at how my posts are modded on this thread.
Don't bring up Bush and claim your post isn't flamebait. I mean, seriously, this is what you said:
"I actually blame the parents (the Bush-haters) for breeding such a bunch of twats as LulzSec. Please don't mark this down as flamebait"
CEO sociopaths? Well, maybe to a degree, but that isn't the underlying cause. Greed is rather the reason. Greed, but not (only) on the CEO's side.
The CEO is under pressure, like everyone else in the company: He has to perform, and he has to perform well. He has to generate revenue, and lots of it. Else he's being replaced by one who does.
The sociopath CEO now does it without remorse. The conscious CEO does it because he rationalizes that a lot of people have invested their money, probably all their life savings, into the stocks of that company and he has a responsibility to do his best to justify that trust. That's the beauty of the system, nobody is a sociopath, everyone can rationalize what he does. Your boss fires you, who's knee deep in dept, but he can rationalize it because he has to fire someone from the team or he has to fire everyone 'cause his budget doesn't allow him to continue the project else. His boss in turn, who signed the budget, couldn't give him more because he, in turn, only had so much money to spend and he doesn't even know you, he only knows that if he distributes his money well, a lot of people will be able to keep their jobs. This chain goes up to the CEO, who in turn rationalizes his layoffs with the responsibility to the investors. Who, in turn, don't even know what they invest in because that's something their bank's investment manager does. Who in turn can rationalize that he has to do his best to invest that money in those companies that perform best because people trusted him with money to invest for them.
You see, nobody has to be a sociopath anymore to be an asshole.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
Anti-negligence laws? I'd rather guess we'll be seeing some anti-hacker laws.
Why legislate corporations when you can legislate people?
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
If we make internets illegal, only criminals will have internets.
Wait what? Lulzsec showed that security though obscurity is bad? I thought the whole point to their "AntiSec" cause was to stop security companies publicly announcing vulnerabilities. Isn't that the definition of security through obscurity?
Yet another blogger begging for an audience.
> "A related story at the Guardian suggests that governmental attempts to control the internet are spurring these activities."
I have to admit, I read that sentence in the summary and I scoffed. Then I read the article, and I still scoffed.
How about my interpretation of Loz Kaye's article: people who are deeply involved in some cause always find the reason "bad thing happened" to because of "bad thing that they don't like and have been working against". It reminded me a lot of Pat Robertson's claim that 9/11 happened because of the gays and feminists and abortionists. Uh huh. Sure it did.
The governments of the western world seem to have it in mind that criminalizing everything will protect them from some sort of boogeyman/men. Hackers, and in general people who steal whats "theirs". People who just want to share their free thought. What the people in power want is for you to second guess everything you say or do, and to live in fear of the consequences. They want to create a cyber police and regulate every aspect of our lives. For what? For profit. To maintain control. No other reason. We've seen thanks to the actions of Anonymous and wikileaks and others how deep the corruption is. We've seen first hand what happens when some group destroys an entire eco system (the gulf of mexico) compared to when someone attacks the state. Now all the cards are on the table. They want to shut it all down. They want three strikes laws. They want search and seizure laws. They want to do things without due process or warrents. They want to impose their twisted morality on the populace. They want to frame Anonymous/Wikileaks and the like and make them out to be pedophiles or terrorists or pirates or rapists. It's rather disgusting how obvious it is. And the most shocking thing of all is that they are actually SURPRISED by the retaliation they are receiving, as minimal as it is! The actions of what appear to be just a few people have terrified the companies who thought they had carte blanc to do as they pleased. However it hasn't pressed them to change their ways, but to hide behind a veneer of superiority and attempt to stop those selfish robin hoods of the internets.
[disclosure: I do this for a living]
If you look over what happened over the last 5 years or so in security you'll see that nothing really new has happened. We get more sophisticated with defenses, stuff gets more expensive, but fundamentally it's deja vu all over again. 99% of what I come across suffers from a pure tactical focus - no long term thinking, no attempt at understanding the mindset of those seeking to cause harm or steal information, no strategy or root cause analysis of assaults.
The result is that defense has simply turned into an arms race. Immensely profitable for providers, no added value for the customer.
About 5 years ago we started to work on different approaches which normal risk assessment never touches. As a consequence of the insights gained we stamped out bank data theft for our clients without imposing new regimes or buying new equipment - all it took was a month worth of work. However, that requires people that can really think differently, whereas HR has moved towards cookie cutter tick box selections that seem to be aimed at filtering out exactly those people who can make a difference (the use of HR management seems to exacerbate this trend).
Security management has become predictable, and with predictability comes failure. The message is clear: start thinking differently - or lose the battle.
Insert
DDoSing is very hard to counter and small sites can be DDoSed by legitimate requests as well (see Slashdotted). Also, you don't leak sensitive data while being down. However SQL injection is just fucking pathetic. There's no excuse for that. That's developer negligence. I'm not excusing LulzSec for it, they comitted a crime etc., but it's like leaving your frontdoor open, being robbed, and then lamenting about "what the world has come to".
Also shared PHP hosting sites are vulnerable to other malicious user, but that's also more of a money problem not direct negligence.
When doing consultancy a lot of people told me flat out they didn't care about security. Quotes like "Anyone can walk in here during lunch and steal whatever they like; why would I (as the IT director) spend $$$ on computer security when management doesn't even care to lock the door." were very common. While the logic is obviously flawed it does illustrate that it simply wasn't a priority - which is not the same as living in ignorant bliss.
So it is with obscurity. Provided it is not the ONLY security feature used, it has a place in reducing the visibility of a target - just as camoflage has been doing in the military for hundreds of years. It also adds to the overall difficulty of getting into a secure location (be that a website or building) and therefore has a deterrent effect: even if that's only to move the baddies along to try the next target on the list, rather than yourselves.
Where does that leave obscurity? Right where it needs to be: as a valuable tool in preventing and delaying security breaches. The key thing about it (as with all security features) is to know when it is no longer effective and then to either revamp it or replace it. However, it obviously is still effective for the vast majority of institutions and therefore should not be dismissed.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons