Acreto Security

Listen to part one of a multi-part podcast series on The Facebook Dossier. Researched, reported, and compiled by Acreto IoT Security.

Security Shaming the Security Ostrich – Let's Make It A Thing By Bob Gourely, ex-Chief Technology Officer for the Defense Intelligence Agency, and Babak Pasdar, CEO and CTO for Acreto IoT Security

We recently had a conversation with the CEO of an IoT manufacturing company to learn more about their strategy for IoT security. The conversation started with his immediate declaration, “Our IoTs are secure!”

“You see” The CEO continued, “we use encrypted connections for all of our IoTs”.

Given his bold tone, we waited to hear the rest - it never came.

We then inquired how he controls access - validates the integrity of the communication - verifies the integrity of data - validates the exchange of functional commands - and handles privacy and identity of the devices.

He responded, “You have to understand that our devices aren’t smart enough to be hacked.”

It was a dumbfounding response! We asked if his IoT devices use IP. “Yes,” he replied. Are they on the Internet? Again, “Yes”. Respectfully, is it possible they are just not smart enough to know they’ve been hacked?

We went on to explain that even “dumb” IoTs are susceptible to and have been involved in many recent high-profile attacks. We even offered two examples of vulnerabilities that impacted devices like his.

However, he was dismissive and unconvinced.

This technology CEO is a security ostrich choosing to bury his head in the sand rather than educate himself, hear different perspectives, and accept input from others.

In another instance, at an event with Maciej Kranz, we met a CTO for a solution provider exclusively focused on building custom IoT-centric applications. We asked this CTO how the organization handled IoT security, the CTO’s answer was simple: “We use the certs from Amazon”. We dug further and asked how these certs secured his customer’s IoTs and applications. He said, and I quote: “Not sure. It’s what Amazon offers -- they wouldn’t sell something insecure”.

Though the exact opposite of the CEO above, this CTO is also a security ostrich. He had no curiosity about what happened to the platforms they developed for their customers.

We have seen many other examples where savvy security officers take what they believe to be prudent steps to help mitigate risk for their newly developed IoT infrastructure. This is a difficult problem, and we empathize with any technologist trying to optimize their IoT security. Their challenge -- utilize enterprise security tools and approaches for IoT Security.

A case in point is an effort by a CISO of a Fortune 500 company who tried very hard to segment his industrial IoT devices into separate networks – a very prudent step.

He then acquired a commercial software product that operates at the network level specifically to help improve security. It acted a bit like the old Kerberos solution in computer security, where a separate server gives permission for devices to join and communicate on the network. The problem with this approach is that we have not seen these enterprise security methodologies and technologies scale to the size IoT infrastructure requires.

But a bigger problem is that even if it works, it does not prove that a device operates securely once it is allowed on the network. Until now, that kind of magic has not existed.

This is a case where the CISO was trying to use yesterday’s security tools to solve a next generation problem, because that’s all that was available. When the only tool you have is a hammer, you have to treat everything like a nail.

We exist in a time of unparalleled connectivity. With all the good that this connectivity serves, it also creates exposure. Exposure today is greater than ever and modern countries – especially the US – are the most exposed. Cyber attacks don’t just impact systems, data, publicity, and stock prices – attacks today impact economies and democracies.

IoTs are driving a dependency compute model where each IoT, their dependent applications and associated management platform all exist on many different public and private networks. Customers no longer control the the entire infrastructure on which their IoTs and applications operate.

This is why traditional enterprise security tools and approaches, designed to protect concentric networks, just don’t work for IoT security. Especially when multiple IoTs exist on a shared network – where each has a different function, for different use-cases and each using different remote applications, operated by different entities. When different applications that are owned by different organizations service IoTs sharing a common customer network, all the different networks, IoTs and applications become exposed and vulnerable.

It’s not only that these devices are susceptible to compromise. Or that a compromised IoT impacts the integrity of the application and dataset it serves. It’s not even that the company’s customers and the customer’s customers are impacted. By putting these vulnerable devices on the Internet, IoTs become force multipliers to launch new and more menacing attacks on many other public networks, systems, applications, and datasets. And with the prevalence of Clouds, everything is public!

IoT manufacturers and development shops should practice greater scrutiny regarding their IoT security. Despite an IoT’s small size, with IoTs, everything is bigger. If the overly confident CEO and disengaged CTO don’t respect IoT Security for their own product, company, and customers, then they should at least consider the impact their actions, or inaction, has on the rest of us.

Isn’t it time we started treating security like littering? Maybe we should make security shaming a thing. Where the entire cyber community gets involved in security shaming those who are reckless, disassociated and especially the inappropriately bold. Essentially all cases where those in the industry who are in a position to enact impactful change, choose not to act.

Could security shaming drive the change the IoT security industry needs? Perhaps! Better yet, we should treat security much like a public health crisis -- where even a single instance of an outbreak is treated with the greatest sense of urgency by the entire community.

The behavior of the security ostrich is rather formulaic. Focus on functionality. When the system is reasonably functional, then focus on performance. And when it’s performing reasonably well, then and only then do some turn their attention to security. By this point, the only options are bolt-ons and band-aids.

Moreover, some deploy self-centered risk–reward IoT security where they choose not to enact security at all. In other words, there are times when it costs more to secure some or all platform assets than their worth to the organization. Though this may look like a business decision, in actuality it is a myopic perspective that empowers hackers – against everyone!

Regardless of the asset value, securing all assets with uniform and consistent security has a dramatic positive impact on the security big picture for everyone. What is suggested here is akin to the “broken windows” policing model where eliminating the small crimes dramatically reduces the big crimes.

The IoT industry is still principally focused on function. Everyone is trying to get their heads around how to make everything actually work. However, it is precisely at this stage when there should be a focus on security – during the architecture and design phases.

We can no longer sit back, look from the outside in, shrug and say it’s their problem -- not mine. If there is one thing that the massive denial of services, botnets, ransomeware, and data thefts have taught us is that the security weak links on the Internet are weaponized against everyone.

In one case the CEO was inappropriately confident, in another the CTO was disengaged and trusting to a fault. These security ostrich executives hurt all of us – perhaps their actions are not malicious, but definitely negligent. And their actions impact business and consumer, global enterprises and family operations, Americans and Allies, us – you – everyone.

Most importantly, business leaders, tech executives or the tuned-in slash concerned participants of the tech industry should learn a lesson from their errors.

However, the CISO truly cared about doing the right thing and was failed by the industry’s lack of viable options to the IoT Security challenge. This is especially true when cloud, IoT, and dependency compute is involved.

In this case the security industry is too conservative and looks down on progressive approaches. And progressive approaches is precisely what this CISO needed.

Let’s invoke an old Internet term that needs to be resurrected. Be a good Netizen. Some, if not the majority of the effort for IoT security falls on the manufacturers and developers. They have to provide viable options for the industry. But at the same time customers and solution providers should be thoughtful and mandate security that drives the manufacturers and developers.

Think of it this way: Anyone who ignores IoT security, recklessly and negligently drags their muddy shoes across everybody else's clean white carpet – when they should know better!

Read the original 'Security Shaming' article here.

Listen to the next podcast, Putin’s Eleven – Inside Nation State Hacker Teams, here.

About Acreto IoT Security
Acreto IoT Security delivers advanced security for IoT Ecosystems, from the cloud. IoTs are slated to grow to 50 Billion by 2021. Acreto’s Ecosystem security protects all Clouds, users, applications, and purpose-built IoTs that are unable to defend themselves in-the-wild. The Acreto platform offers simplicity and agility, and is guaranteed to protect IoTs for their entire 8-20 year lifespan. The company is founded and led by an experienced management team, with multiple successful cloud security innovations. Learn more by visiting Acreto IoT Security on the web at acreto.io or on Twitter @acretoio.

Modern nation state hacker teams are not the moody, nocturnal teen blasting death metal and drinking energy drinks. As each country's cyber special forces team, nation state teams don't have to fear authorities. They are organized, directed, well-funded, and advanced in their operations. Here's how they work.

Russian Nation State Hackers & What We're Not Doing About It.  - By Bob Flores – former Chief Technology Officer of the CIA & Babak Pasdar CEO and CTO of Acreto IoT Security

The effective use of Russian nation state hackers led to a hacked election that has resulted in a hacked America. We're still licking our wounds and not doing anything about it. In fact we are arguing if it happened at all!

Cybersecurity strategy incorporates the confluence of technology, business and geopolitics with so many moving parts that to call them complex is an understatement. Strategies must span multiple geographies across a plurality of nations and continents. That is why no one can “go it alone”.  Today we need our friends more than ever – not just for geopolitics, but also for cyber defense. Collaboration is the underpinning of cybersecurity.

As the largest global economy that comprises infrastructure, industry, enterprise and institutions, the US is the most technologically advanced. Many American companies span the globe making them one big glass house while the rest of the cyber world are kids with rocks on a dare. These "kids with rocks" fall into four major categories.

First, there are hacktivists, who hack for their cause. The most well known of these being the loosely bound group called Anonymous. The second category is terrorist organizations such as ISIS and Al Qaeda. These organizations recognize cyber warfare as a cornerstone to their mid to long-term strategy and are working feverishly and investing heavily to get them to maturity. The third group is financial hackers. The best way to describe financial hackers is the Mob and Cartels' online arm. And finally, the most dangerous are state-sponsored hackers.

Even though they operate behind triple or quadruple blind systems, which makes tracking them extremely difficult, they can be identified by their unique hacking techniques or fingerprints.

Nation state hackers are not the moody lone-wolf nocturnal teenagers cranking death metal and surviving on Amp energy drinks. That's a TV cliche. And hacking is not an organic game of pickup, where individual hackers are swapped indiscriminately. Nation state hackers are carefully curated teams that train, collaborate and solve problems together. Not only do they have to get along and gel over time, but they have to build and test many foundational tools they need to perform the advanced objectives they are charged with. Sometimes this can take years!

Lets Talk Hacking Fingerprints: Cyber-threat intelligence organizations that monitor and track Advanced Persistent Threats – APT.s - use their threat fingerprints to build a profile on each team over time. The collection of fingerprints defines each team, otherwise called an APT. The profile fingerprints for the Russians, Chinese, North Koreans and Iranians all vary.

Each APT, or different hacking group, is assigned a unique number for identification. For example, APT37 is North Korea, APT34 is Iran, and the American election hacks are associated with APT.28 and AP.29 - which are obviously Russian nation state hackers. In fact, APT.28, otherwise known as "Fancy Bear", is a completely different team than APT29, "Cozy Bear", both of which work for the Russian Government.  As an example, here is a sample of the fingerprint for Fancy Bear – APT28- that has been tracked since 2007, and the reasons for American intelligence agencies' confidence in Russia as source for the election hacks:

Here are some quick hit details for APT28:

Its Target Sectors includes: The Caucasus, particularly Georgia, eastern European countries and militaries, North Atlantic Treaty Organization (NATO) and other European security organizations and defense firms.

APT. 28 is focused on Cyber-Espionage

As a summary overview: APT28 is a skilled team of developers and operators collecting intelligence on defense and geopolitical issues—intelligence that would be useful only to a government. This APT group compiles malware samples with Russian language settings during working hours (8 a.m. to 6 p.m.), consistent with the time zone of Russia’s major cities, including Moscow and St. Petersburg. This suggests that APT28 receives direct ongoing financial and other resources from a well-established organization, most likely the Russian government.

Tools commonly used by APT28 include the SOURFACE downloader, its second-stage backdoor EVILTOSS and a modular family of implants dubbed CHOPSTICK. APT28 has employed RSA encryption to protect files and stolen information moved from the victim’s network to the controller. It has also made incremental and systematic changes to the SOURFACE downloader and its surrounding ecosystem since 2007, indicating a long-standing and dedicated development effort.

Known operations include Operation RussianDoll where Adobe & Windows Zero-Day Exploits were Leveraged in highly-targeted attacks.

There are other means for determining the source of attacks.  Aside from fingerprinting, intelligence agencies do track the sale of zero-day exploits purchased on the markets. Zero-days are exploits for previously unknown vulnerabilities.

There are numerous commercial and underground organizations whose business is finding, exploiting and weaponizing vulnerabilities.  Once the exploit is developed, it's put up for bid - and governments are the most affluent bidders. Commercial organizations offer them for sale on the public market to sanctioned agencies, while underground groups sell their exploits on the black market – Dark Net - to the highest bidder indiscriminately. In the case of juicy exploits, the buyer may pay significant sums for the privilege of exclusivity. The buyer wants the advantage of a weapon that nobody else has. All governments use a variety of proprietary techniques, technologies and informants to track the exploit inventory of both rival and ally countries.

Ultimately the recourse to cyber attacks is a blunt instrument in the form of counter-attack. Counter attacks may include counter hacks, economic sanctions, embargoes, or a combination.  However, for a government to get involved in countering attacks large organizations or critical infrastructure are usually involved and even then it is reserved for the largest and most egregious attacks. American election compromise is such an example.

At this particular point in time, America has opted for a "go it alone" approach to global relationships. Collaboration on cyber issues is not exempt from this. As the occupant of "The Big Glass House" in a world of rock-throwing kids, especially Russian nation state hackers, America needs its friends more than ever.

Even though we have been hacked, America is still Not Minding The Store. Collaboration between government and commercial threat intelligence is key to a successful cyber strategy. The nation’s top intelligence officer, Director of National Intelligence Dan Coats, indicated on Friday, July 13 and I quote: "persistent danger of Russian cyberattacks today was akin to the warnings the United States had of stepped-up terror threats ahead of the Sept. 11, 2001, attacks. The system was blinking red," Coats said. (nytimes.com) "Here we are nearly two decades later and I’m here to say the warning lights are blinking red again. Today, the digital infrastructure that serves this country is literally under attack. Every day, foreign actors - the worst offenders being Russia, China, Iran, and North Korea - are penetrating our digital infrastructure and conducting a range of cyber-intrusions and attacks against targets in the United States".

Recently, Congress has zeroed out nearly $400 million from the fund used to protect the integrity of our election and has blocked subsequent efforts to fund it across partisan lines. In April 2018, the White House Cybersecurity coordinator was relieved from his role less than six months from the November elections. As of the end of July no replacement has been named. Moreover, tough sanctions passed by congress in July 2017 are yet to be implemented as of July 2018. It may be too late for anyone to take the helm and implement meaningful protections at such a late stage.

Collaborating to stop these attacks requires leadership, funding, a competent team, communications and sharing. At this point in time we have the competent team members in the form of our intelligence agencies that are raring to be let loose. However there is no leadership, no mandate and no funding. We also find ourselves in a strange situation with sparse dialog with our allies due to newly formed political trust issues. The patient is not in trouble because a first- year med student is the surgeon. Rather, the patient has been abandoned by the surgeon with little time to live while the operating room is dark because nobody paid the utility bill.

Next in this series we will look at an example of Russia's nation-state hacking teams and their construct in our blog: Putin's Eleven – Nation State hacker teams uncovered.

Learn more by visiting our web site: Acreto.io -- On Twitter: @acretoio and if you haven’t done so, sign up for the Acreto Crypto-n-IoT podcast. You can get it from Apple – Google or your favorite podcast app.

About Acreto IoT Security

Acreto IoT Security delivers advanced security for IoT Ecosystems, from the cloud. IoTs are slated to grow to 50 Billion by 2021. Acreto’s Ecosystem security protects all Clouds, users, applications, and purpose-built IoTs that are unable to defend themselves in-the-wild. The Acreto platform offers simplicity and agility, and is guaranteed to protect IoTs for their entire 8-20 year lifespan. The company is founded and led by an experienced management team, with multiple successful cloud security innovations. Learn more by visiting Acreto IoT Security on the web at acreto.io or on Twitter @acretoio.

Blockchain, it slices, dices and juliennes, but is there a Blockchain security Function?

The industry portrays that Blockchain will solve the world’s woes. Legacy companies like IBM, HP and Dell are touting Blockchain as the cure-all for anything and everything. Blockchain security seems to be the latest craze. In fact, the ‘Blockchain as a security savior’ message is so ubiquitously promoted and repeated, it has become an accepted fact. For many, Blockchain is not just secure – Blockchain IS security.

We’re here to tell you its not. Here’s why:

Crypto technologies and its variances such as Blockchain were designed to fulfill the following capacity as…

• Denomination - Blockchain functions as crypto-currency, with a specific market value.
• Transaction Processing - Blockchain exists as a denomination-independent way to process financial transactions, similar to a credit card.
• Data Validation - Blockchain validates and verifies non-financial transactions and content.

Blockchain provides a decentralized way to process and validate transactions. This is done over public networks while the transacting parties and the processing parties maintain their anonymity. Once the transaction is validated, it is documented in a public ledger shared across many systems. These make up the Blockchain network.

Business applications are built on multiple components. These include endpoints, systems, hardware, programs and data-sets, all of which have exposure points, referred to as an attack surface. Application platforms that use Blockchain are no exception. Though Blockchain is not susceptible to manipulation or fraud while in transit, it does nothing to secure the multiple attack surfaces and associated vulnerabilities of the platform components.

This means the endpoints, servers, applications and clouds that make up the platform remain vulnerable. A compromise of any of these systems could allow the attacker to forge seemingly legitimate Blockchain transactions. The end result? A transaction that appears to be made by an authorized user and endpoint which is processed by an authorized application. Blockchain is incapable of offering any protection in this scenario.

So what drives the industry to tout Blockchain is security?

Even though proper cyber-security requires multiple functions (ie: identity, controls, privacy and threat management among others) to protect the entire application platform, Blockchain is limited to ensuring the integrity of the transactions. Without the implementation of other security functions, the entire platform remains exposed and vulnerable.

Blockchain protects the transaction in a very limited and granular way. Yet large swaths of the industry believe it is a new way to secure entire technology platforms!

No doubt, this is an undesirable byproduct of marketing departments gone wild. In their clamor to “simplify” the complex nature of Blockchain, they have managed to confuse, convolute and even misdirect. It’s like paypal claiming that they protect your bank account.

There are many benefits to using Blockchain as a denomination, for financial transaction processing or non-financial data validation, but not Blockchain security. the sooner the industry is clear about the practical application of Blockchain, the more confidently it can be used in business applications. With that, Blockchain’s growing use in real business applications can even stabilize the turbulent and unpredictable coin markets.

Here is one of the articles that mislabels Blockchain's function - Blockchain Security: What keeps your transaction data safe. No company is more guilty than IBM

BONUS: The blockchain craze has taken such a life of its own that we created this spoof based on old infomercials called Bloxychain!

About Acreto IoT Security

Acreto IoT Security delivers advanced security for IoT Ecosystems, from the cloud. IoTs are slated to grow to 50 Billion by 2021. Acreto’s Ecosystem security protects all Clouds, users, applications, and purpose-built IoTs that are unable to defend themselves in-the-wild. The Acreto platform offers simplicity and agility, and is guaranteed to protect IoTs for their entire 8-20 year lifespan. The company is founded and led by an experienced management team, with multiple successful cloud security innovations. Learn more by visiting Acreto IoT Security on the web at acreto.io or on Twitter @acretoio.

The Busted Crypto Boys present the world's first crypto country song: "Blockchain's for Business"! Feel the blues with this true Blockchain security cautionary tale.

This skit highlights the major differences between IoT and enterprise technologies to set the foundation for why IoT security has a unique set of challenges. IoTs do not singularly move the needle, but their scale is driving a pivotal change in how we compute and how we live.

Historically the term "Enterprise-Grade" meant that a technology was part of an elite list of highly robust, highly scalable and highly available technologies. However compute models have changed with the proliferation of Clouds, SaaS and IoT technologies that have crept their way into every network, yet the approaches to security have not evolved. They remain some variation of on-device and network security. This podcast discusses the major differentiation between Enterprise technologies and IoT-based plat

Blockchain and Crypto security has taken a life of its own, evolving from validated transactions to be confused with providing security for an entire platform. This is especially true for highly distributed IoT platforms. In this episode we discuss the Crypto & Blockchain Security Fallacy to outline what Blockchain is and is not.

Breaking it Down: How Facebook Tracks Users and Non-Users. This is part seven of a multi-part series on, TheFacebook Dossier. Researched, reported, and compiled by Acreto IoT Security. First, let’s talk about The Facebook Cookie. The Facebook cookie is key to the organization’s data collection efforts. If at any point you (or your device) visit…