Slashdot Mirror
CanSecWest Presenter Self-Censors Risky Critical Infrastructure Talk
msm1267 writes "A presenter at this week's CanSecWest security conference withdrew his scheduled talk for fear the information could be used to attack critical infrastructure worldwide. Eric Filiol, scientific director of the Operational Cryptology and Virology lab. CTO/CSO of the ESIEA in France, pulled his talk on Sunday, informing organizer Dragos Ruiu via email. Filiol, a 22-year military veteran with a background in intelligence and computer security, said he has been studying the reality of cyberwar for four months and came to the decision after discussions with his superiors in the French government. Filiol said he submitted the presentation, entitled 'Hacking 9/11: The next is likely to be even bigger with an ounce of cyber,' to CanSecWest three months ago before his research was complete. Since his lab is under supervision of the French government, he was required to review his findings with authorities.
'They told me that this presentation was unsuitable for being public,' Filiol said in an email. 'It would be considered as an [incentive] to terrorism and would give precise ideas to terrorists on the know-how (the methodology) and the details regarding the USA (but also how to find weaknesses in other countries)."
'They told me that this presentation was unsuitable for being public,' Filiol said in an email. 'It would be considered as an [incentive] to terrorism and would give precise ideas to terrorists on the know-how (the methodology) and the details regarding the USA (but also how to find weaknesses in other countries)."
knee-jerk reactions are the norm not the exception to security disclosure, and I doubt he has some leeto 0-day to destroy the world with.
He acted like a human? We can't have that.
withdrew his scheduled talk
That was a close one. Fortunately he withdrew his scheduled talk. Now it's impossible that anyone will ever have that information ever.
Since his lab is under supervision of the French government, he was required to review his findings with authorities.
So... There are several people in possession of a information that has a value and that has been publicly identified as valuable.
No problem. Governments only hire people immune to corruption.
All of this stuff about security, privacy, and accountability is just academic masturbation. It has been for years. It is not going to change, because those with the power to change it aren't about to.
The oligarchs who control our governments, security forces, and political parties, own us completely. It is too late to stop them. It is a waste of time to complain and dangerous to resist.
Seriously.
Can we just drop all the faux political drama and talk about, I don't know, programming or something?
Scruting the inscrutable for over 50 years.
The government officials have forwarded the information to the appropriate security people.
Information like that is obviously not for the general public.
No - security through obscurity does not work. You are better off fixing security holes and making it public, preferably with open source so that everyone can see that its fixed and look for other weaknesses.
I know he says that pulling out was the moral thing to do, but describing this as "self censorship" is a bit of a misrepresentation. He showed every tiing ahead with it until the French government got involved, and if he had wanted to go ahead with it, the French government would have stopped him.
Bogtha Bogtha Bogtha
Agree. If it were a temporary "we want to close this hole first" thing then I wouldn't have an issue, but silencing disclosure seems to be seen as an alternative to securing systems, which is not only wrong but bad security.
When I read what you wrote a feeling of sadness suddenly surged ...
Have we become so pre-programmed by TPTB that we start having second thoughts of our own liberties ?
Look around us ... The American journalists are doing exactly the same.
Instead of reporting what needs to be reported, however bad/ugly the news be, they begin to modify the story in such a way that it can "easier be consumed" and/or "not rocking the boat" and/or "not jeopardizing the country", and so on, and so forth.
So much so that Snowden had to share what he had with someone from UK instead of those from the US of A.
Back to the lecture and the so-called "subject" ... Why should he pulled back on what he was going to say just because someone told him that what he said could be used by the terrorists ?
The keyword is "could", which means, it's not certain at all that
A. The terrorists would have the technological know how to carry out the sabotage
B. The terrorists could locate the actual weaknesses of the infrastructure to carry out their attacks
C. The terrorists never suspect that what he said is after all, a "honeypot"
As all of us start to pulling in a little bit of ourselves, and as we continue to pull ourselves in, bit by bit, the big brother doesn't even need to lift his little pinky to achieve total control over our lives.
We are the nerds. We are the engineers. We are the one who build and engineer and find faults within the systems.
And if we start to NOT do what we are born to do - that is, to find faults to the existing systems, then we might just as well never been born.
Muchas Gracias, Señor Edward Snowden !
No - security through obscurity does not work. You are better off fixing security holes and making it public, preferably with open source so that everyone can see that its fixed and look for other weaknesses.
That works for you chat program or web browser.
Doesn't quite work that way for your power grid infrastructure.
Well, do tell. How would it make you more secure to let everyone now about them?
If it were your web browser, you could upgrade it to the latest patched version.
But how do you upgrade your local power station?
Should we really believe that the so called terrorists don't already know what he's talking about? And why should we believe that, just because it hasn't been exploited on a large, TERRORIST, scale?
I mean, be them terrorists, but very likely, they're not stupid. If he in 4 months "discovered" this, I see nothing keeping some bright young hacker with a strong motive from finding this out too.
Can we stop using the term, "cyber" to mean "on or over the internet"?
- Zav - Imagine a Beowulf cluster of insensitive clods...
But how do you upgrade your local power station?
Over the WAN. Or Sneakernet, for air-gapped systems.
You do realize that power stations are quite often manned, and the ones that aren't (including substations) receive regular visits from utility workers, right?
An enigma, wrapped in a riddle, shrouded in bacon and cheese
No, that was not the general "you". It was the specific you. What are you going to do with this knowledge? You can not act on it in any useful way.
Wanna guess how long it would take utility companies to get going about fixing these problems if they started losing billions due to attacks?
The private utility companies would likely be in the best position. They already have security teams, they have upgrade paths, and they have incentive.
The city run utilities would be in the worst position. They typically engage an engineering company for a project to oversee the installation of systems, and train a few city workers to do basic monitoring and maintenance. Twenty years later the city still "owns and operates" the system, but they do not have anyone who understands it. Even if they recognize the need to patch it, their skint budgets are determined years in advance by city council members who are under pressure to fix the potholes, keep the police on the streets, and rein in taxes and spending. There is no budget this year or the next for overhauling the water systems infrastructure. These systems are a long way from being patched.
It could easily take several years to fix every system that needs fixing, even amidst the panic a world-wide hacking spree would induce. During those years, unpatched infrastructure installations around the globe would be hacked, with very negative consequences.
John
No, that was not the general "you". It was the specific you. What are you going to do with this knowledge? You can not act on it in any useful way.
That's presuming that NO ONE in the public at large works for a power company. Which, as we all know, is nonsense.
However, that's not the point - putting a vulnerability out in the open forces the people who use those systems to fix them ASAP, rather than just ignoring the problem until after someone exploits it. Not to mention, we've got a bunch of pretty smart people in the public-at-large, so maybe it wouldn't be a terrible idea to let some of them pore over the code to make sure there aren't any other problems these particular researchers happened to miss.
An enigma, wrapped in a riddle, shrouded in bacon and cheese
We're no safer for his withdrawing the paper, but at least any attacks can't be traced back to info provided by him (even if it's accessible elsewhere). I'm guessing this is a CYA move. Hopefully he shares any info on security flaws with people from the relevant organizations.
That's presuming that NO ONE in the public at large works for a power company. Which, as we all know, is nonsense.
You realise you can actually inform the power company without informing the public at large?
However, that's not the point - putting a vulnerability out in the open forces the people who use those systems to fix them ASAP, rather than just ignoring the problem until after someone exploits it.
The problem is, you can't just fix these things instantly. This isn't like your web browser, as I said. You don't just push out a quick bug fix and install it. These things run terrible ancient legacy code that you don't even know if anyone knows any more. Fixing them can be a very long process. During all that time, you'll be vulnerable, and can't do anything about it.