Slashdot Mirror
Interviews: Ask Security Expert Mikko Hypponen A Question
Even if you pay only a fraction of your time on security news, you probably already know Mikko Hypponen (Twitter, Wikipedia). He is the Chief Research Officer at F-Secure, a security firm he joined over two decades ago. Hypponen has assisted law enforcement in the United States, Europe and Asia on cybercrime cases, and has also made several appearances on BBC, TED talks, TEDx, DLD, SXSW, Black Hat, DEF CON, and Google Zeitgeist among others. He has also written for CNN, The New York Times, Wired, and BetaNews.
Hypponen has closely watched computers, networks, and security spaces grow over the years. In 2011, Hypponen tracked down the authors of the first PC virus in history -- Brain.A. Whether you want to know about the early days of malware -- when they were mostly created by hobbyists, or get an inside view of the challenges security firms face today, or how exactly does one keep himself or herself safe in the increasingly terrifying world, use the comments section to leave your question.
Editor's note: We will be collecting some of the best questions and sending them to Mikko at 22:00 GMT, Monday.
Hypponen has closely watched computers, networks, and security spaces grow over the years. In 2011, Hypponen tracked down the authors of the first PC virus in history -- Brain.A. Whether you want to know about the early days of malware -- when they were mostly created by hobbyists, or get an inside view of the challenges security firms face today, or how exactly does one keep himself or herself safe in the increasingly terrifying world, use the comments section to leave your question.
Editor's note: We will be collecting some of the best questions and sending them to Mikko at 22:00 GMT, Monday.
Brain.A was the first MS-DOS virus...so it was first IBM PC-compatible virus but not the first "personal computer" virus.
Do you have any suggestions on how to create a successful security awareness program in a tech company? Some like Bruce Schneier prefer the time and money is spent on better security engineering. Any experts or articles or books you can recommend?
With the recent reports of anti-virus software sometimes actually adding security vulnerabilities to the systems, and the fact that windows ships with its own bundled anti-virus, what advantages do commercial third party anti-virus solutions these days offer?
I'm wondering specifically about the windows desktop, because this is the platform usually targeted by attackers.
"Edward Snowden has warned that no smartphone is safe..." Is he correct? http://www.v3.co.uk/v3-uk/news...
What are the pre-2008 intel and pre-2013 AMD processors that you consider the most secure?
What are the ones with the most vulnerable erratas? In short What are the fastest AND safest one?
https://libreboot.org/faq/#intel
https://libreboot.org/faq/#amd
One of the big security problems of Android is that you are unable to receive any software updates, including security patches, once the hardware manufacturer decides so, and hardware manufacturers have an interest in not providing updates because they cost money to test and deploy, as well as missing updates create an incentive for the customers to buy newer hardware.
This issue affects all places where the hardware vendor also supplies the software, and will become more and more important, as internet connected software gets its way into more and more things around us.
How can this problem be solved?
Have you looked into Capability based Security Operating Systems such as Genode? (Genode.org) They seem to offer a way for users to decide what to trust, instead of being forced to blindly trust everything every app does.
What do you think about this approach to security?
Nope. It was only recently (about a year ago) that I started to keep a formal list of prominent people in the security sector and, until five minutes ago, he was not there. It was the mosh pit of DNS and SSL security that finally drove me to it. To be honest, it was also the somewhat volatile Thomas H. Ptacek who drove me to it. Here's Colin Percival's rather decisive rebuttal to an ill-considered post by Ptacek.
My Very Important Knob
Interestingly, Ptacek's original post, "Colin's Very Important Knob" is nowhere to be found on the internet. Since then, I've seen them engaging in pleasant, but opinionated exchanges. Normally, you can get a quick sense of who hates whom, but with security it's more like the way certain animals share a kill: with cheeks shredded and bleeding. No hard feelings. They might even be brothers.
Hmm. The eyeball economy is strong in this one.
As it happens, I read the following article by Poul-Henning Kamp just the other day and had mixed feelings.
HTTP/2.0 — The IETF is Phoning It In (January 2016)
Mikko, what's your take on HTTP/2.0 in light of PHK's declared position?
—
For context, here are the two points that raised my own eyebrows.
First, PHK implies that HTTP/2.0 could have done something substantial to address the cookie problem.
Second, PHK implies that encryption is enough of a burden in certain circumstances to make exceptions to the privacy by default revolution. My own gut instinct is that SSL is already cheap enough to simply write off across the board as the cost of doing business, almost always.
Isn't it a rather crappy security profile to leave your "innocent" activities in clear text and only encrypt what is conventionally considered "sensitive"?
I did read a valid complaint the other day, where people writing servers trying to maintain 100,000 persistent SSL connections (average connection time measured in hours) become hot and bothered about the 20 kB per connection memory cost, enough to throw away a Go implementation (heavier in memory overhead) and go back to Ruby.
What say you about the technical/political HTTP/2 tango?
What is your opinion on the Hillary Clinton email scandal, specifically with respect to the security of her personal server and Guccifer's claims re hacking the server.
Hi Mikko, in my day job I am a security evangelist, carrying out developer education and design reviews. For 8 years previous to that I helped companies use static analysis to detect and eliminate security vulnerabilities at the implementation layer. I am becoming convinced that, with the poor state of software today and extreme complexity, there is simply no way the good guys can win. Defenders have to get it right, every single time while the bad guys only need to be right once, to establish an APT and destroy your company. If the bad guys were parasites I would say this would all simmer down to a balancing point where the parasites existed off a slow background noise of constant attacks, but never enough to kill civilization completely. But with a lack of collusion, attackers are more likely to race to the bottom and to not pay attention to the health of their host. So basically my prediction is: crime will eventually kill technology; it will become unusable. Do you have a more hopeful outcome for us?
I've seen some Finns I'd like the geminate with.
You are welcome on my lawn.
... while they're using untested and not standardized (hell, not even Version 1) protocols? Example, Discord using WebRTC and claiming it's secure.
Still waiting on Serviscope_minor to wake up to fucking reality and realize that Jessica Price isn't going to fuck him.
We (as a society) put different emphasis on security and privacy at different times. What do you think we should optimize for and where do you think is the optimum? How do you see the capabilities of our civilization evolving over the next 100-200 years? As a budding PhD student, should I take security as a primary focus? What would be your best advice?
Hello Col. Hypponen,
I have three questions for you:
1. Do you think it is still possible to secure embedded systems (aka the Internet of Things), or is that an impossibility now, practically speaking?
2. If there was one thing you could every average computer user to do to improve their security, what would it be?
3. If you were a person of interest in the murder of your neighbor in a tiny Central American country, what would your strategy be for clearing your name?
Thank you for taking the time to read this. I look forward to your answers.
Regards,
Aryeh Goretsky
Dexter is a good dog.
The name should be Hyppönen, by the way.
It's called vowel harmony, and mixing the front vowels (y, ä, ö) with back vowels (a, o, u) in a single word is forbidden, except in compound words.
https://en.wikipedia.org/wiki/...
I love how slashdot cuts off raw wikipedia links just before the article name.
Why do you want a Bluetooth toothbrush anyway,
I like my teeth white rather than blue, thanks.
Escher was the first MC and Giger invented the HR department.
Since moving to Linux about 8 years ago, there's been one thing I have missed, which i still feel is a regression: The ability to use 3rd party purchased programs to control what local processes may access the network. No operating system makes this default, but in Linux-Land, it seems guys like me get actively ridiculed for suggesting "blocking a port" != "blocking an app", which is a bit annoying. There are some promising projects like SELinux, but to date, they are not able to bring this capability into user space in any meaningful or intuitive way that I've been able to find.
Reason I ask: I respect the technological challenge this problem poses, but it still just seems like low hanging fruit to by default say: Programs don't get resources unless a user with elevated rights decides to permit this. It's not like it has never been done before. To imagine the potential benefit: Crypto ransom-ware could be de-fanged if one could decide to only whitelist processes they trusted. If malwareX found its way onto your system, but couldn't by default access corporate network file shares then damage would be hugely negated. While we're at it, let's take away default local disk access outside of highly constrained limits.
Yes. It is a continuation of the cat and mouse game, but currently it seems like the good guys working on desktop OS's aren't putting up much of a fight. My Linux smart phone has better permission controls than my Linux laptop for crying out loud...
The question:
Why do you think the computing industry is so trusting of developers and the corporations that feed them, that they by default always give processes unfettered and unquestioned access to the internet? Are the foxes watching the chickens? Do you foresee any improvements coming in our lifetime?
Or are we doomed? Shall we just roll over and trust our new programmer overlords without question?
Dear Mr. Hypponen,
As a security expert, what would you consider to be the real risks from Intel ME (& AMD equivalent) technologies for the average business? Is there a particular mitigation strategy you would recommend?
By average business I mean a company that engages in financial transactions with its vendors and customers. I'm also assuming that at least some of these companies have trade secrets they want to protect from their competitors.
Many thanks for taking the time to answer our questions.
Kind regards,
A
Congratulations of receiving so many responses on your post about a pet issue of yours - all from different users too - all of which have exactly the same style of grammar, spelling and punctuation as you do. Isn't that a weird coincidence :)
Do you think there should be more practical laws protecting people's privacy?
For example, I believe it should be mandatory for the manufacturers of any electronic devices that possess a microphone (primarily smart phones, tablets, laptops, and smart TVs) to provide physical analog controls to switch them (the microphones) off when desired, without having to power off the device itself. Moreover, the cables leading to the microphone and the switches that cut off the power to them should be easy to inspect by any (non-technical) consumer.
This would prevent let's say my Samsung smart TV from 'accidentally' recording every conversation I have in my living room, and sending it to third parties for analysis. It will also prevent malicious actors from eavesdropping, even if they manage to break into the device and install spyware.
Maybe the analog switches could also work for disabling the camera, wifi and bluetooth.
What do you think is the best way to bring about such changes in law?
Thanks,
Dex
Buy a pre-pay Visa/Mastercard from a gas station.
Change is certain; progress is not obligatory.
You're right, I'm so ashamed. Let me try again:
Mikko Hypponen (if that is your real name), it seems like the internet has never been less secure. Can you explain how and why security experts have failed so miserably?
You are welcome on my lawn.
Here is something often conflated: A device may be secure because a user can't get any access to it, but it may be easily compromised from remote. How would one make a device that the user can easily flash, and do what they please with, even flashing a custom OS or firmware, while still making it resistant from remote, and perhaps local attacks? The closest I've seen is Android, which when rooted loses none of its security (other than a user hitting "allow this app to run as root") by accident. Other ecosystems, like iOS, have their entire security model destroyed by jailbreaking.
Didn't I see this yesterday?
Up until you trying to make me use bing I was with you.
We used to have a Bill of Rights. Now, with the rights gone, all we have left is the bill.
My question is fairly simple and to the point: Do you have favorite "That one who got away" story? By that I mean some piece of malware you could almost track down the creator of, figure out how it worked or automate discovery of it, but not quite?
Do you feel security on IoT devices will ever get close to effective, or will the advent of the IoT become a security nightmare?
We play the game with the bravery of being out of range
Hi!
Mikko here... to better answer your question, could you please provide your social security number? Thanks.
What would you like to see in a computer 'health' class? After cleaning up several of my son's friend's computers from rampant spyware/malware/etc, it's clear that kids are given computers without any real training or discipline in how to protect themselves.
With all the sharing done on social media today, including lists and 'here's how to generate your porn/potter/star trek/etc name based on street address/birthday/etc', what alternate security questions should (if any) a website use to verify identity?
"Though it may take a thousand years, we shall be FREE."
Defenders have to get it right, every single time while the bad guys only need to be right once
That is the typical predator/prey asymmetry.
The lion has to only win the chase every now and then. The antelope has to win the chase every time.
What are your thoughts on the computer security industry's current trend of staffing computer security professionals who look at industry best practices and security products to run down a checklist of actions? I often point out that many (approximately *all* that I've met) computer security professionals are big on password policy, anti-virus, patching, and the like, and *never* sit down to develop operational risk and threat models. In essence: what's going on in the industry with security as simple compliance (executing a prefabricated list of tactics) versus security as an organizational strategy (studying the field and selecting what tactics to apply, and where and how)?
Support my political activism on Patreon.
What is your thoughts on companies that do public demonstrations of how to execute AV bypass? Are these companies providing a service to the public by doing webcasts that give a high level overview and show an AV bypass working on the latest version of a companies AV?
-- Slashdot, making the Left look conservative since 1997.
Do you enjoy being a security expert more than driving a racing car?
Confucius say, "Find worm in apple - bad. Find half a worm - worse."
Wait, you mean Finland is a real place? Who knew? I thought it was out of Tolkien or something.
My bad.
You are welcome on my lawn.
A recent post from David Dill from Stanford University stated that "Online Voting Is a Danger to Democracy"[1]. Given that viruses and security breaches seem to be on the rise lately, do you see e-voting being established in our lifetime? [1]: https://engineering.stanford.e...
The default ubuntu installation has a guest user without password. This feature can be turned off but I noticed that every once in a while the configuration changes (move from /etc/lightdm to /usr/share/lightdm without removing /etc/lightdm for example) so that if you don't pay attention the guest user is back. In my opinion the guest user removes one barrier for an attacker and is a bad idea.
...would you most like to answer?
Requiem for the American Dream
Huge efforts and money are spent protecting the edges of the network - whether it be firewalls and other router configurations, OS level configurations, and other filtering tools (such as virus detection and scanning, and log and packet inspection and analysis tools). There are also plenty of security companies willing to sell you a magical black box that will solve all of your security problems.
The opposite seems to be the case when it comes to spending time and money on the security of applications used by internal and external customers - either through retrofitting existing applications, or when building new applications. Companies don't want to spend money to retrofit sunk capital, and I don't see security firms talking about or creating tools and common standards for building new secure applications.
Given this dichotomy, do you think that is a correct characterization of the problem space, and do you think we are spending our time and money in the right places as a result?
Lodragan Draoidh
The more you explain it, the more I don't understand it. - Mark Twain
Sorry, too little information to help.
Change is certain; progress is not obligatory.
Neither do I.
I didn't talk about "Internet cards".
Your location.
Change is certain; progress is not obligatory.
Oh, Nederlands. Well I have known for a fact that Mastercard does have pre-paid cards there (I was looking to move there back in 2001 and I was quite aware of these back then).
Unsurprisingly, looking at it on Google, I found a fair few results on such cards. The security on pre-paid items tend to be quite poor. The trick is, you want to use something like a pre-paid gift card as they do not have a name associated with the card it self, so you're able to make payments with either any name, or a name you came up with out of nowhere during registration.
Change is certain; progress is not obligatory.