Communications of the ACM

 

Just to recount, here are some of the breaches just this year:

 

 

The scary part is, it's only going to get worse.

 

There's been a rise in the sophistication of attacks over the past years. These attackers, which range from script-kiddies to criminals to state-sponsored cyberwarriors, have been all too successful in breaking into online systems. 

 

There are two interesting observations here. The first is that these attacks have shifted from just directly attacking a computer system, an attack model that computer security specialists are somewhat good at defending against, towards also exploiting the human vulnerabilities in these systems.

 

By human vulnerabilities, I mean all of the misunderstandings, laxness, and cognitive and social biases that arise with the people that use computer systems. The list of human vulnerabilities here are numerous: poor interfaces that are hard to understand, interfaces that are easy to misconfigure, guessable passwords, reused passwords, tricking people into installing malware, tricking people into opening up documents (which use zero-day exploits), and on, and on, and on.

 

These human vulnerabilities are clearly a major weakness, but also a puzzling blindspot both from a research perspective and from an industry perspective. Well, actually, it's not that puzzling. People are messy. We all have a wide range of experiences, knowledge, and motivations, and so it's natural, so tempting to just buy that "magic black box" that claims to solve all your security problems and avoid having to actually deal with the messiness. Just go to any industry conference (like RSA), and you'll see what I mean: vendors selling row after row of magic black boxes. And by doing so, computer professionals can rest comfortably in the conventional wisdom that users are just stupid, keep on blaming the user, and not actually force ourselves to adapt to smarter attackers.

 

The other observation is that none of these hacks are actually new or innovative (and no, most zero-day attacks are not that innovative, unless you count buffer-overflow attacks as innovative). We don't know yet about the Sony Playstation Network attack, but I'm willing to bet that it didn't use any advanced techniques either. 

 

Instead, what is fascinating here is the sophistication of the execution. The attackers are more patient, adept at using a wide range of tools, and very capable of progressively exploiting smaller vulnerabilities into larger ones. It's analagous to the transition in martial arts from single schools of thought to cross-training and mixed-martial arts. These recent attacks have been highly creative, flexible to the situation, and make full use of a combination of techniques. 

 

For example, in the Epsilon case, it looks like the attackers were using spear phishing attacks for several months, trying to bait low level employees at several mailing list companies. While there are few details, there are several interesting questions. How did the attackers know which employees to target? Did the attackers know how to format the spear phishing email so it looked appropriate? Did they know when to send the malware for maximum effect? I suspect the answer to all of these is yes. 

 

The HBGary case is also an impressive case study. It started with a SQL injection on the company's web site, which led to stealing the password file, running a standard password crack, exploiting password reuse to remotely wipe the (now former) CEO's iPad and access his Twitter account, and a spear phishing to get the password for another site. Again, all standard techniques, just really well executed.

 

These kinds of security breaches will be a long-term problem that we will be struggling with for the next ten to twenty years. The only effective strategy I see is to take a three-pronged approach. First, get research and industry to develop new best practices, create better tools, and have better training of software developers. Second, complement these technical approaches with a stronger legal structure that can properly incentivize companies to take stronger measures in protecting customer data. Finally, develop new ways of actually addressing the human vulnerabilities, in the form of simpler and better designed user interfaces, more research to gain a deeper understanding of human biases and social influences in decision making, and better ways of motivating and training people so that they are effective in the face of these ongoing attacks.