Slashdot Mirror
CanSecWest Presenter Self-Censors Risky Critical Infrastructure Talk
msm1267 writes "A presenter at this week's CanSecWest security conference withdrew his scheduled talk for fear the information could be used to attack critical infrastructure worldwide. Eric Filiol, scientific director of the Operational Cryptology and Virology lab. CTO/CSO of the ESIEA in France, pulled his talk on Sunday, informing organizer Dragos Ruiu via email. Filiol, a 22-year military veteran with a background in intelligence and computer security, said he has been studying the reality of cyberwar for four months and came to the decision after discussions with his superiors in the French government. Filiol said he submitted the presentation, entitled 'Hacking 9/11: The next is likely to be even bigger with an ounce of cyber,' to CanSecWest three months ago before his research was complete. Since his lab is under supervision of the French government, he was required to review his findings with authorities.
'They told me that this presentation was unsuitable for being public,' Filiol said in an email. 'It would be considered as an [incentive] to terrorism and would give precise ideas to terrorists on the know-how (the methodology) and the details regarding the USA (but also how to find weaknesses in other countries)."
'They told me that this presentation was unsuitable for being public,' Filiol said in an email. 'It would be considered as an [incentive] to terrorism and would give precise ideas to terrorists on the know-how (the methodology) and the details regarding the USA (but also how to find weaknesses in other countries)."
knee-jerk reactions are the norm not the exception to security disclosure, and I doubt he has some leeto 0-day to destroy the world with.
He acted like a human? We can't have that.
withdrew his scheduled talk
That was a close one. Fortunately he withdrew his scheduled talk. Now it's impossible that anyone will ever have that information ever.
Since his lab is under supervision of the French government, he was required to review his findings with authorities.
So... There are several people in possession of a information that has a value and that has been publicly identified as valuable.
No problem. Governments only hire people immune to corruption.
In the 90s when I was on dial-up tech support we used to make fun of people who were screaming at us that "MY BUSINESS DEPENDS ON THE INTERNET". I still make fun of them... only now it's not so funny.
All of this stuff about security, privacy, and accountability is just academic masturbation. It has been for years. It is not going to change, because those with the power to change it aren't about to.
The oligarchs who control our governments, security forces, and political parties, own us completely. It is too late to stop them. It is a waste of time to complain and dangerous to resist.
Seriously.
Can we just drop all the faux political drama and talk about, I don't know, programming or something?
Scruting the inscrutable for over 50 years.
The government officials have forwarded the information to the appropriate security people.
Information like that is obviously not for the general public.
No - security through obscurity does not work. You are better off fixing security holes and making it public, preferably with open source so that everyone can see that its fixed and look for other weaknesses.
FTA: Filiol said his methodology—a combination of information gathered through open source intelligence means, mathematical modeling and infantry techniques—could damage critical infrastructure in the United States, and likely worldwide.
The "cyber" part is only a small part of it. The biggest part is the planning for a coordinated human attack on some infrastructure targets and maybe ways on how to deal with first responders (cops) to keep them from doing their jobs. - just a guess.
It's funny that the article shows a power sub station. Those things are out in the open all over the country and some are in unguarded buildings in cities like NYC.
But I'm mean really. Weather and utility screw-ups have done more damage than any terrorist attack could ever do.
unclarity is the keynote wtf
I know he says that pulling out was the moral thing to do, but describing this as "self censorship" is a bit of a misrepresentation. He showed every tiing ahead with it until the French government got involved, and if he had wanted to go ahead with it, the French government would have stopped him.
Bogtha Bogtha Bogtha
Agree. If it were a temporary "we want to close this hole first" thing then I wouldn't have an issue, but silencing disclosure seems to be seen as an alternative to securing systems, which is not only wrong but bad security.
When I read what you wrote a feeling of sadness suddenly surged ...
Have we become so pre-programmed by TPTB that we start having second thoughts of our own liberties ?
Look around us ... The American journalists are doing exactly the same.
Instead of reporting what needs to be reported, however bad/ugly the news be, they begin to modify the story in such a way that it can "easier be consumed" and/or "not rocking the boat" and/or "not jeopardizing the country", and so on, and so forth.
So much so that Snowden had to share what he had with someone from UK instead of those from the US of A.
Back to the lecture and the so-called "subject" ... Why should he pulled back on what he was going to say just because someone told him that what he said could be used by the terrorists ?
The keyword is "could", which means, it's not certain at all that
A. The terrorists would have the technological know how to carry out the sabotage
B. The terrorists could locate the actual weaknesses of the infrastructure to carry out their attacks
C. The terrorists never suspect that what he said is after all, a "honeypot"
As all of us start to pulling in a little bit of ourselves, and as we continue to pull ourselves in, bit by bit, the big brother doesn't even need to lift his little pinky to achieve total control over our lives.
We are the nerds. We are the engineers. We are the one who build and engineer and find faults within the systems.
And if we start to NOT do what we are born to do - that is, to find faults to the existing systems, then we might just as well never been born.
Muchas Gracias, Señor Edward Snowden !
The government officials have forwarded the information to the appropriate security people.
Information like that is obviously not for the general public.
No - security through obscurity does not work. You are better off fixing security holes and making it public, preferably with open source so that everyone can see that its fixed and look for other weaknesses.
What if the problems aren't fixable?
Look at the Obamacare website rollout - all kinds of visibility, tons of resources, a known problem with literally thousands of working solutions already deployed.
And it was more fucked up than a football bat.
Now imagine some obscure utility infrastructure deployment - little resources, no visibility. I'd venture to say the odds of fundamentally flawed designs and unfixable implementations is pretty good.
Incompetence - it's pervasive.
By keeping the gaping security holes semi-secret from the general public, we're sufficiently protected from terrorists. It's a flawless plan that has a 100% success rate.
No - security through obscurity does not work. You are better off fixing security holes and making it public, preferably with open source so that everyone can see that its fixed and look for other weaknesses.
That works for you chat program or web browser.
Doesn't quite work that way for your power grid infrastructure.
This is nothing but human arrogance at it's best... This human _thinks_ the information he has is exclusive to him and the no-one else will ever discover it! Let's face it, the first we normally know about militant religious group attacks (I refuse to use the word terror in this context) it a bomb goes off!
Do not under estimate the enemy but more importantly do not OVER estimate your value!
Should we really believe that the so called terrorists don't already know what he's talking about? And why should we believe that, just because it hasn't been exploited on a large, TERRORIST, scale?
I mean, be them terrorists, but very likely, they're not stupid. If he in 4 months "discovered" this, I see nothing keeping some bright young hacker with a strong motive from finding this out too.
Doesn't matter. Censorship (this isn't self-censorship at all) is intolerable.
Of course security through obscurity works. Since no security system is perfect, all security systems rely on the obscurity of their flaws in order to function. How can people not get this?
Can we stop using the term, "cyber" to mean "on or over the internet"?
- Zav - Imagine a Beowulf cluster of insensitive clods...
Maybe France wants a card they can hold against America? Or a bargaining chip that could be used to gain Americas help on a specific issue.
Doesn't matter. Censorship (this isn't self-censorship at all) is intolerable.
Bullshit. This isn't some independent scientist being censored by the government. This is a government employee doing what his boss says is permissible as an employee. I work in the financial industry. We employ a lot of researchers. Their research is proprietary. They just cannot go and openly discuss the results of their research, even if it could be groundbreaking, without prior approval first.
The government officials have forwarded the information to the appropriate security people.
Information like that is obviously not for the general public.
No - security through obscurity does not work. You are better off fixing security holes and making it public, preferably with open source so that everyone can see that its fixed and look for other weaknesses.
Although this is a very true statement, it unfortunately does not transfer well into the world of most critical infrastructure systems. Most of the vulnerabilities that we hear about are on systems that have a lot of exposure -- PC's servers, routers, and apps. The systems that drive our power grid, water supply, oil pipelines, traffic control systems, etc. are comprised of custom built machines and specialized software running on commercial systems. The engineers that were responsible for developing these systems are not of the same ilk that do software development for general consumer use. Any change to these systems takes time -- sometimes on the order of years -- to go from design through the (often overly) rigorous safety and testing procedures.
There are at least two factors that contribute to this. First, the developers are often engineers who specialize in the specifics of the environment for which the system will be working in. These engineers are simply ignorant of the security situation that the standard software developer these days is faced with. They don't know how to avoid otherwise "stupid" mistakes, and wouldn't know how to fix them if told. And it doesn't work just to bring in someone that does know how to do these things. That is because secondly, these systems are interacting with very complex mechanical systems. The subtle interactions between different systems and precise timing mean that the addition or removal of a single line of code can indirectly result in a catastrophic failure -- failure that can and does cause destruction of property, injury, and even death. It isn't just a seg fault with a shoulder shrug to worry about. The norms that rule software patching in the software world at large just don't apply well here without significant modification.
This is not so say that this is a good, or even acceptable situation. These systems were never intended to be exposed to the internet, or any other accessible network. The world around the systems has been changing, and as the people that operate these systems have adapted to the need to collect and correlate data in real time, provisions have been made to interconnect these systems to connected networks. A major overhaul is needed to adapt these systems to operate safely in the conditions they have been placed. This takes time, and perhaps even some motivation from experiencing an incident or two. (Let's all hope it doesn't come to that!) In the mean time, the reality is that there will be several situations in which making the information public is far more favorable to those that wish to do harm than those capable of fixing the problems. These things take time to fix, and for that time, it's better (for now) for the weaknesses to remain as hidden as possible.
We're no safer for his withdrawing the paper, but at least any attacks can't be traced back to info provided by him (even if it's accessible elsewhere). I'm guessing this is a CYA move. Hopefully he shares any info on security flaws with people from the relevant organizations.