1 Raindrop

TMFStockSpam

A very interesting and meritorious effort on stock spam from the folks at Motley Fool.

First off a little background, the Fool has a game called CAPS, you can think of this like fantasy baseball, but its for picking stocks. So you pick a stock like say MMM and you enter whether or not you think it will out perform or under perform the S&P index over some period of time. Then you get points if you are right and by how much it over performs or under performs. There are over 69,000 players. (*)

So its a pretty straightforward concept, you get points for picking the right stocks. Now with that background, here is the part of interest to security. You know the gajillion stock spam messages you get typically around small cap penny stocks that you've never heard of (and wish you never had)? Well, two Fools set up an account TMFStockSpam, they take the penny stock fraud/spam messages, enter them into the CAPS engine as picks that they shorting (meaning they predict they'll go down - "red thumbing" in CAPS parlance).

TMFStockSpam has 20 picks since 12/15/09, they have shorted them all. 80% of these have underpeformed the S&P. Four of the 20 have actually generated positive returns (+2, +2, +14, 27%)

The other 16 have generated negative returns with the worst being BRGO.OB -89.5%, a recent pick from 2/23 (RCYT.OB) has lost -44.8% from 2/23-2/26.

Anyway, its interesting data on stock spam, and they are also asking for people to send them any stock offers that you receive so they can track them

 

Oh one more thing the TMFStockSpam CAPS player is ranked 5,368 out of 69,524 players

* note that the CAPS community as a whole has outperformed the S&P index over its life, something the various misguided MBA programs that drunk the efficient Market Hypothesis kool aid by the gallon would say is impossible, but which does explain why fully 80% of mutual funds (run by these same MBA grads) under perform the S&P *before* fees

Eddie Lampert on Sowell's Intellectuals and Society

Interesting annual shareholder letter from Eddie Lampert at Sears Holdings:

Making Sense of Business and Policy

I just finished Thomas Sowell’s most recent book, Intellectuals and Society. For those not familiar with his writings, Thomas Sowell is one of the clearest and most insightful writers of our era. I look forward to every book and column he publishes. In this book, he discusses the “vision of the anointed” and how their views shape society regardless of their merit. He describes how often these views conflict with reality without altering these views and, paradoxically, sometimes strengthening them. I couldn’t help noticing the parallels between his comments and the “vision of the anointed” in the financial and business world over the past few years.

Business leaders, regulators, public officials, and journalists have become an echo chamber of self-support and self-congratulation, whether on TV, in print or at numerous conferences. Their words and their actions are often self-serving (whether right or wrong), and they are typically regarded and reported on as if they were obvious and selfless. They get repeated as if there were no alternative views or possibility of error in their thinking. Dominant narratives develop and get defended primarily by repetition and secondarily by attacks on those who disagree with those narratives. When these favored people and views become endorsed in laws and regulations, some may benefit, but many get harmed.

Hitler Meme Meets Cloud Security

If you like this thank Marcus, if you don't then blame me

RSA 2010 talk

Speaking at RSA on the following:

Dealing with the Wildness That Awaits in Software Security

The starting point for assessing Margin of Safety at design time is to combine Threat Models - how a system may fail - and Attack Surface - where a system is vulnerable. The output is a Countermeasure Model, which identifies and locates the Countermeasures in the system. This session will review the Margin of Safety and examine how these are applied in deployment, runtime policies and security mechanisms. We will also discuss the failure modes present in current web service implementation

They also asked me to do a 20 minute TED-style version of the talk which is supposed to be on a webcast, not sure when.

Identifying Opportunities for Improvement in Security Architecture

Here's a report that should surprise nobody - people pick predictable passwords (say that five times fast).

 

After the security breach, database security firm Imperva analysed the passwords used, publishing a report entitled Consumer Password Worst Practices.

The data found that the most common passwords were:

1. 123456

2. 12345

3. 123456789

4. Password

5. iloveyou

6. princess

7. rockyou

8. 1234567

9. 12345678

10. abc123

The analysis revealed a large amount of users had chosen "easy-to-crack" passwords, the most common being "123456", which was chosen by 290,731 users, or almost one percent.

'Nicole' was the 11th most commonly chosen code, followed by 'Daniel' in 12th. Other names appearing in the top 20 passwords include 'Jessica' and 'Michael'.

What is surprising is that this "secret" along with other great "unknowns" like Social Security Number, is what's used in standard practice Information Security to bootstrap the whole access control program. When the users are spoofed, phished, pharmed, and otherwise tricked into clicking on something that allows the bad guys in, they're routinely insulted as "how could they be so dumb" to click on that or whatever. But is it any dumber than architecture that relies on storing & shipping the dynamite and the detonator in the same truck?

Here is the process view of a typical, simplified software architecture

That looks fine, right? The Subject (users, web service, client) is separated from the Object (Web App, Server, Web Service, data), but let's look at storage of the above.

Notice anything? The Object logic and data is stored in the same domain as the Subject *and* the Subject's secrets. Does this make any sense? I will now bash my head on my desk repeatedly. 

The current architecture is not a security architecture in any meaningful sense, its an operational and deployment convenience. If you are building out security architecture like this for Web apps, Web Services, and Cloud, then please stop. Step away from the keyboard and look at using something else.

Start here for some ideas

Its not that any of these new identity standards are silver bullets, but they do something important. They move to enforce a separation of the Subject environment and the Object environment. They get the dynamite and detonators out of the same truck and into different trucks.

Not only that, but it changes the management process to enable each domain to do what they can do best. 

The lifecycle management of the Subject - such user registration, account maintenance, user authentication, is kept separate from the lifecycle management of Objects like service versioning, app deployment, instance level authorization, business rules and so on. The third rail being the agreement points in the federation, like contracts, between the domains (such as across organization, business units, and technologies). Carving out the responsibilities this way, gives each domain a chance to execute, and the standards like SAML enable moving the tokenized version of this around so it works at  runtime.

From a security architecture standpoint there's no real excuse to spray username/password around everywhere any more. The role of architecture is to separate concerns and place functionality and ownership in places where they have the most knowledge and resources to accomplish the task. In identity the knowledge and resources required to identify and manage users are totally separate from those required to identify and manage apps and servers, yet they are often combined into a lowest common denominator. The new identity standards like Information Cards, SAML, and oauth are widely supported in products, best of breed and open source. Investigate them and find the best fit for your company and systems. The only thing worse than a weak/guessable password is lots and lots of weak/guessable username/passwords. And that's what we have now.

Jeremiah Grossman on Security Spending

Jeremiah Grossman posts on what's likely the most important enterprise security issue - budgeting. Specifically, he breaks down what Information Security spends on Infrastructure security (like network security and firewalls) versus application security. Even though the attacks come at the application and data level, the Information Security community still continues to spend on infrastructure security. 

I have done similar analysis as Jeremiah and through different means arrive at the same conclusion - you cannot find a technical, business risk justification for the percentages spent on infrastructure security. Why then is the security is the budget consumed (to the tune of 80% using Jeremiah's number) in infrastructure? Infrastructure and networks are the background of information security people, its their comfort zone. Why change? When you ask about application security they say "we got it covered", application security is not budgeted, not planned for, not executed, not measured, but somehow "its covered." What this generally means is "don't ask, don't tell." It most assuredly does not mean that it's covered, just means no one has looked or tried, its easier to go to Defcon/Blackhat and trade war stories about threat du jour and developers who "don't get it."

Here is a fun exercise for people going to the RSA show. Walk around on the floor and count how many infrastructure security booths you see, and then count how many application security booths you see. Make note of the percentages. Then when you get back your company, walk around the infrastructure group and then walk around the development group (and don't forget to count the 2,000 developers you have in India). I bet in each case they'll be off by at least an order of magnitude.

One last thing - its one thing to look at the industry numbers, but I have done this several times inside of companies. Breaking down the budgets into these categories is a pretty straightforward exercise for a single company, spend an hour with your finance person (note - I am more than a little surprised that some smart industry analyst like Andy Jaquith hasn't done the same for the industry as a whole but whatever). Once you pull these numbers from your budget for your company about what your infosec department is actually prioritizing - it tells a powerful story. Its almost always a story of misaligned priorities and missed opportunity for security improvement. You don't have unlimited funds, invest them wisely.

Idea for a Fondue Party

Spent the last couple of day teaching software security training. The class the usual mixture of developers, architects, and security people. Most had at least 5 years of development experience, and there were about 30 people in the class, so we had at least 125 years of professional development experience in the room. These weren't rookie developers.

As is my wont at the beginning of class I asked how many people had ever taken a day of software security training. Three hands went up. Two had had a one day class, one had a longer class....but it was on RACF in the 80s. So in the room we had over 125 years of development experience and 3 days of security training.

The class had a lot of energy, there were lots of real world examples discussed and we went into many rabbit holes from secure coding practices to identity management & SAML to threat modeling t how to apply in real organization's development lifecycle. At the end there were a lot of good comments and feedback, but one stood out, one of the developers wrote on their comment sheet:

I have learned that the Web is just a giant piece of Swiss cheese

Afterwards, I tweeted this quote saying how much I enjoyed the class, and "welcome to the party!", I got some comments from people thinking I tweeted sarcastically like "oh what an idiot, how did that person not know that already?" 

Here's the thing - I wasn't being sarcastic at all. I'm sincerely happy to help developers think through security failures and how to avoid them where possible. Probably get the most professional satisfaction from this. 

As to the - "how could they not know this already" - part, better question is - how would they possibly know it at all? It ain't in Kernighan & Ritchie, it ain't in Core Java, it ain't J2EE patterns, its not even in Enterprise Integration patterns; software security knowledge is located precisely nowhere a developer spends their time. A century plus of programming versus a day or so of security training? Give me a break.

Information Security groups should be the ones helping to close this gap, but most of the time they play around with various network tools, and since the whole point of scalable networks is that the network is designed to be dumb, this means at best the information security budget is spent on the dumbest part of the system (the network) while the smart part of the system - apps, data, identity (also known as assets) - get little focus. 

Jeff Williams had a great tweet on this today 

Blaming software developers for insecurity is the most divisive and counterproductive thing we could possibly do

Precisely, and this is dumb from two perspectives. First you cannot simply put all the blame on developers its not all their fault in fact they may not even be in the top 5 of people to blame, and secondly if you want to get out of this mess (instead of obsessing about threat du jour)- the developers are your way out. They are the ones who are going to build the bridges out of stone instead of wood, and then build them out of steel instead of stone. Nobody starts a career in development to have the code fall over in a stiff breeze, show them how to build more resilient systems.

Security needs to build bridges with developers, not burn them down. (James McGovern and I have a paper on exactly this topic in the next IEEE Security & Privacy journal so much more on this later.) Training is a very good example of this, not just because I do training but because I have seen it work. Many times. And work in a very cost effective way. 

Both developers and security people need training in these areas, the old ways don't work any more. Developers need to know what they don't know about security, and isn't anywhere obvious unless they sit in training and think, talk, discuss, build/break it hands on style. Security needs training just as much, you can't bolt security onto a network and then cram a gajillion users and quadrillion lines of code app and hope for the best. Hope is not a strategy, neither is divisive/counterproductive blaming of developers. You gotta unify the concerns of developers and security, find shared goals. You gotta get in the same boat.

Maybe instead of pizza parties and lunch and learns, you can do a fondue party. Have the developers bring the bread and the security people bring the Swiss cheese.

Natural Result of Slouching Towards Medium Assurance

Steven Murdoch, Saar Drimer, Mike Bond, and Ross Anderson report that Chip and PIN is broken. The consequences are pretty ugly including that a fraudulent transaction can come up as "PIN verified" on your transaction.

the attack applies to cards used online (where the merchant POS contacts the bank) as well as offline; 

the attack works regardless of the amount of money spent (not just for small value amounts that are below floor limit); 

the attack doesn’t work once a card has been cancelled by the bank — just like stolen cards in the past can only be used for a certain window of time once the cardholder discovers the loss; 

the attack doesn’t work at ATMs (cash machines); 

the failure applies to bank card schemes based on EMV – the most widely deployed standard for smartcard payments. Older national smartcard schemes may or may not be vulnerable; we don’t know.

Should we be surprised? Not really. There's an obsession with control of subjects (i.e. authentication) in many financial services, which is a good start. But just ask the Baltimore Indianapolis Colts, its doesn't matter how well you do in the first half, when they keep score for the whole game. Many finacials systems go to great lengths to impose their own authentication, to get the subjects into their system that they control, but then once in that system, the security is medium assurance at best.

In this case the whole game is not simply subjects and authentication, its objects and authorization. Its the fact that many systems are simply a web front end tacked onto a mainframe backend which naively trusts what its sent - MQ and mainframes are the canonical examples here - authorization based on weak or non-existent tokens (hey! we authenticated them at the edge of our semi-medium assurance system!).

There's an obvious case that the authorization fails, this much more common than authentication fails. In fact if you factor in Madame TOCTOU you can easily say that all authorization is broken, its just a matter of degree. But certainly this is egregious, so the second "au" in the gold standard of information security - authorization - is the main culprit.

Lots of analysis and money was clearly spend on building and deploying these systems and they were still broken, so the larger system is the lack of the third "au" audit logging which must backstop the inevitable failures. Assume it'll be broken and log accordingly.

Welcome to Chimerica

If you are looking for a catchphrase to describe current realities, I would go with Chimerica not "cyber cold war."  One current reality is that Avatar is more popular in China than Confucius (the movie that is), another reality is the trade deficit

 

And the combination of the trade deficit with the federal budget deficit is troubling. But these are economic issues. During the Cold war there was neglible trade and cultural exchange with Russia. Constrast this with reality that China already represents 10% of global trade and the linked nature today's global supply chains (from Zach Karabell):

Its capital and ideas in motion in a way that national statistics do an extremely poor job of encapsulating. The much vaunted trade deficit figure of $200-300 billion a year assumes that every dollar of trade with China is a dollar that leaves the United States and goes to China. But if 15% of that trade deficit is Walmart sourcing its good from China, a lot of that money doesn't go to China, it goes - yes to Walmart, it goes to people working on the port of Long Beach offloading the goods, it goes to Burlington Northern Railroad which Warren Buffett just bought the rest of, shipping those goods thoughout the country. It doesn't all go in that direction

Its not even clear where things are made. If GE makes a washing machine at a plant in northern China with polymers and plastics made in Malaysia and circuit boards produced in Taiwan and some cloth that was sourced from Cambodia with initially having been grown in Texas that then gets assembled partly in a plant in southern China and then gets shipped to a plant in northern China via Hong Kong (where it then counts as a Chinese export to Hong Kong and a Hong Kong export to China) and then it gets sent to the United States - where was that thing made? By a company whose shares trade on the New York Stock Exchange

So when we here terms like "cyber cold war" you really have to ask to what end with this serve either party when things are so closely linked - and by the way there are trillions in dollars in trade. What is the payoff for either party? As Michael McConnell head of NSA under Bush said the Chinese "political leadership is principally focused on creating new jobs inside the country," Of course, they are. Have you ever tried to feed 1.3 billion people? 

So is there an existential national threat? James Fallows talked to some more spooks and tried to find out:

This led to another, more surprising theme: that the main damage done to date through cyberwar has involved not theft of military secrets nor acts of electronic sabotage but rather business-versus-business spying. Some military secrets have indeed leaked out, the most consequential probably being those that would help the Chinese navy develop a modern submarine fleet. And many people said that if the United States someday ended up at war against China—or Russia, or some other country—then each side would certainly use electronic tools to attack the other’s military and perhaps its civilian infrastructure. But short of outright war, the main losses have come through economic espionage. “You could think of it as taking a shortcut on the ‘D’ of R&D,” research and development, one former government official said. “When you create a new product, a competitor can cherry-pick the good parts and introduce a competitive product much more rapidly than he could otherwise.” Another technology expert, who serves on government advisory boards, told me, when referring to the steady loss of technological advantage, “We should not forget that it was China where ‘death by a thousand cuts’ originated.” I heard of instances of Western corporate officials who arrived for negotiations in China and realized too late that their briefing books and internal numbers were already known by the other side. (In the same vein: I asked security officials whether the laptops and BlackBerry I had used while living in China would have been bugged in some way while I was there. The answers were variations on “Of course,” with the “you idiot” left unsaid.)

And of course its even possible that other countries bug telephone calls, emails and so on. So what we are left with an economic issues. Zach Karabell describes in Superfusion just how Chimerica came to be joined at the hip, almost unbeknownst to anyone because we were focused on 9/11, Iraq, subprime whatever. Competition is one thing, but there is a deep linkage in Chimerica that simply wasn't remotely present in the real Cold War

So national trade statistics do a very bad job at capturing those realities. They also do a bad job at capturing capital in motion. I want to do a brief thought experiment, the numbers I am going to give are not actual but they are representative.

One of the only sources of growth from about 2003-2008 that Wall Street investment banks saw other than creating mortgage backed securities was the possibility of doing loan and underwriting in China. Because by the World Trade Organization China had to allow these to come in. So around 2003, Morgan Stanley seeing the potential to do lots of underwriting business of dynamic new Chinese companies that want to list their shares or former state-owned Chinese enterprises that are reformed enough that they can turn to Western capital markets for an infusion of capital, Morgan Stanley decides to invest $5 billion in one of China's banks.

One of the Chinese banks takes that $5 billion and disperses a series of loans. To government sponsored projects, to build roads, rail, urban infrastructure to create a competitive domestic economy, and some to build some factories. Those factories then may make some goods that get exported to the United States. So Morgan Stanley gives $5 billion to a Chinese bank that then gives $5 billion to a variety of projects including companies that then sell goods to the United States. Americans then buy $5 billion of goods, based on that $5 billion of funding, which leads to $5 billion of reserves built up in China. China then needs to do something with those reserves, because its got to close currency account, and it invests $5 billion with the US Government. 

Come to the fall of 2008, when the financial systems is imploding, Morgan Stanley like the rest of the investment banks, needs money, because it needs to survive. So it turns to the US Government for an infusion of capital, so they don't go out of business. The US government gives Morgan Stanley $5 billion, but of course where is that money going to come from? It floats some issues of treasury notes to the public, which it does, and the major foreign buyer of those treasury notes is China. So the government of China buys $5 billion of US Treasury notes in order for the US government to give Morgan Stanley $5 billion which in turn gives $5 billion to Chinese banks so the Chinese banks can give money to Chinese factories who can then sell goods to the United States and then create currency deposits in China so that China could then loan the US government money in order to bail Morgan Stanley out.

Come the spring of 2009, Morgan Stanley needs to pay the government back, because it doesn't like owing the US government money so it decides to issue shares to the public in order to pay the US government back $5 billion and then on a Sunday so people wouldn't notice the largest buyer of that issuance is the government of China in the form of the Chinese investment corporation. So the Chinese investment corporation gives Morgan Stanley $5 billion so that Morgan Stanley can give $5 billion back to the US government so the US government can service the loan to the Chinese government which it lent it $5 billion. It lent it $5 billion because those factories that Morgan Stanley gave $5 billion to have produced a series of products that it can sell to American consumers.

So please don't talk to me about cyber cold war, much of the world's security works through federation, not firewalling, these economies and the people who depend on them are joined at a deep, structural level - this Chimerica - love it or leave it.

Models and Reality

Richard Bejtlich has a post talking about the risks of when models and reality diverge - 

Did we not just suffer a global recession exacerbated by clowns who thought they could model risk "with a high degree of accuracy"?

This of course is the financial crisis in a nutshell, we've had plenty of real estate crisis in the past, but they never lead to 10% unemployment and cratering the whole financial system. This was the first time that the geniuses had built mortgage backed security models on top of real estate (key underlying assumption - house prices never go down in the US), add in some false precision and perverse incentives, stir - and voila.

Its not to say models are bad, just when they're confused with reality. We don't need to look any further than the world of college sports. College football's championship is based solely on a model where you calculate strength of schedules, margins of victory, strength of opponents, and so on, but what you get is an unholy mess that leads to someone getting hosed every year, and endless legitimate arguments. Its all model. (Plus a zillion lame bowl games - the Swiffer Sweeper bowl?)

College basketball otoh starts with a model - picking top 64 teams (pretty large sample set, probably fair to say if you are not in the top 64 then you don't deserve to be national champ), but then the model is stress tested and determines the champ by who actually wins the game (note - Kansas looks good this year). Many times (most?) the winner is not the #1 ranked team going in, is this bad? Not at all, the model gives a logical starting point but its not an end in and of itself.