Ride The Lightning

Anonymous and its Cyberwar Against Israel

I have come to the conclusion that we are unlikely ever again to see conventional warfare unaccompanied by cyberwarfare.

As CNN reported, Anonymous has declared a cyberwar against Israel for its "barbaric, brutal and despicable" treatment of the Palestinians. Since the violence began last Wednesday, the cyberattacks have ramped up though the news media seems to offer mixed commentary about their effectiveness.

Most of the attacks have been denial of service attacks, but certainly some data has been posted to the Web and some passwords leaked. Israel said on Sunday that it had been hit with 44 million cyberattacks.

Anonymous is calling the attacks #OpIsrael.

Gismodo's Sam Biddle wrote on Monday, "Today, Anon lacks the talent and semi-cohesion it once boasted across the net, and its most recent online crusade is an embarrassing reminder. This is less a war than the hacker equivalent of egging someone's house and then smoking weed behind a Denny's."

Taking down and defacing websites certainly doesn't hold a candle to the loss of human life, but this is a  disjointed effort to date. And the Israeli defenses seem to be pretty solid. As a point of interest, Israel has said that most of the attacks are coming from the U.S. and Europe, not from Arab countries.

If you're interested in learning more about how Israel's Iron Dome anti-missile system works, one of the more fascinating tangents to this story, there is a good overview of it here.

Thanks to Terry Dexter for passing several articles my way as I was collecting information.

E-mail: snelson@senseient.com         Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Clearwell and Recommind: Dueling Predictive Coding Books

A RTL reader thought it might be useful for someone neutral to review the dueling predictive coding books of Clearwell and Recommind. As you read this, I'll be returning from Rome (tough duty, I know) and I'd welcome a neutral take on these two books. Anyone want to offer a guest post?

E-mail: snelson@senseient.com        Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

How to Find a GPS Tracker in Your Car: Update

Sometimes I get my topics from odd places. Today's headline actually comes from a search someone did on the Ride the Lightning website to find an earlier post. Since then, I've learned more.

We've had some funny stories of idiots who, having been told that the tracker needed a clear line of sight, simply stuck the tracker on the car roof. They should all be this simple to find. And then there was the lady who was genuinely being stalked by her husband, but it took several hours for dumbfounded mechanics to find it, which they finally did by removing the dashboard where they found it connected to the car battery. Much smarter - no need to recharge.

Wired published a guide to finding the devices last year. We don't see many of the older, cheaper passive trackers anymore. These store data but don't transmit it - someone has to retrieve the data from the device. Those devices seem like antiques now.

What folks really want is realtime data, the active devices that transmit your location. Behind the dash seems to be the most common place to stash them but have someone who knows cars do a thorough investigation to find them. Most of the time, the person who planted the device will prefer to wire it into the car's electrical system so there is no need to recharge it. There are (natch) GPS detectors on the market as well. BrickHouse Security sells both the trackers and the tracker detectors. Gotta love the capitalist system.

And there are deep cover devices which rely more on cell tower triangulation than GPS signals. For those, you may need a mechanic to strip down the vehicle.

We've even heard of GPS trackers sewn into a child's jacket to help track the other parent. It's a crazy world.

E-mail: snelson@senseient.com           Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Judge Who Do Their Own Internet Research: Shark-Infested Waters

The Summer/Fall issue of the ABA's Litigation magazine contained a fascinating article entitled "The Lure of the Internet and the Limits on Judicial Fact Research." I watch for stories like this at the behest of our friend D.C. Superior Court Judge Herbert Dixon so I can forward them along and he can add them to his formidable lecture repertoire.

Even Judge Dixon hadn't seen some of the stories cited in this article, so if the subject interests you, you may want to get a copy of the magazine. Sorry, no online link.

In one case, a North Carolina judge hearing a child custody dispute "friended" the husband's attorney on Facebook and posted on his wall the remark that he had "two good parents to choose from" to which the attorney replied, "I have a wise judge." Not so wise of course. The judge also looked up the wife's photography business and poetry through Google.

Clearly, it is inane for a judge to comment on a case in which he is involved on social media. But more than that, a judge who wants to do independent fact research swims, as the author notes, in shark-invested waters. A judge here in Fairfax has been reprimanded for doing precisely that.

The article makes it clear that the waters are not only shark-infested but muddy. What precisely is allowed and when is less clear than you might think. Well worth a read to understand the fog that surrounds this topic.

E-mail: snelson@senseient.com      Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

FBI Expands Its Cybercrime Division

The FBI is no 90-pound weakling in the fight against cybercrime. Its victories are many and varied, as it has taken down botnets, identity thieves and hackers.

But it wants to get better. So it has announced the Next Generation Cyber Initiative, which will mean hiring more folks and more collaboration with other groups. One thing it (commendably) wants to focus on is attribution, which drives all digital detectives crazy. As the old saying goes, on the Internet, nobody knows you're a dog.

The ability of hackers to spoof IP addresses and their reliance on proxies makes attribution tough. More and more, computer scientists are working beside FBI agents in an effort to extract the digital signatures of hackers from mountains of malicious code.

The FBI is now sharing information with the Department of Defense, the Department of Homeland Security and the National Security Agency as part of the National Cyber Investigative Task Force.

I'm glad to see the turf wars diminishing. Hollywood loves to portray the arrogant FBI agent who comes to a local crime scene and announces, "I'm in charge." Where hackers are concerned, it too often feels like they are in charge. Working together may be far more productive than going it alone.

E-mail: snelson@senseient.com      Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Pentagon Opens its Market to Androids, iPhones and iPads

There was a time when RIM owned the federal marketplace. No more. The Defense Department has announced that it will hire a contractor to build a system that will manage and secure Android devices and Apple products such as the iPhone and iPad.

While BlackBerry devices will still be supported, my prediction is that once the government opens the door to choice, everyone will flock to the hipper and flashier devices.

For the year ending on March 3rd, RIM market share in the U.S. fell 47%. Not a number that any company wants to see. While RIM's survival in Canada seems fairly certain, the exodus from RIM in the U.S. is only picking up speed as RIM has failed to keep pace with its rivals.

E-mail: snelson@senseient.com         Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

South Carolina's Massive Data Breach - "Encryption is Complicated"

More than 75% of South Carolina’s residents had their social security, credit card numbers and other personally identifiable information breached. News of the breach came in October, though it actually began in August. Who uncovered the breach? Usually it is the FBI, but this time it was the Secret Service that notified S.C. on October 10th.

How did the breach happen? Someone, as yet unknown, stole legitimate credentials from one of the 250 state employees with access to the South Carolina Department of Revenue (DOR) database.

Why was the attack so easy? Because (pulling our hair out here) the data was not encrypted. While this was horrific enough, the statements by S.C. governor Nikki Haley may have been more alarming. With 3.6 million of her citizens affected, Haley was in full defensive posture, saying that encryption was “complicated and cumbersome technology.”

This is a Governor in need of some education.

She also said “The industry standard is that most Social Security numbers are not encrypted. A lot of banks don’t encrypt. A lot of those (government) agencies you might think encrypt Social Security numbers actually don’t . . . It’s not just that this was a DOR situation, but an industry situation.”

Really - banks don't encrypt? I'd like her to name one.

Industry expert Adrian Lane, the CTO of Securosis has said, accurately: “In most cases, encryption or other forms of obfuscation (masking, tokenization) can be done transparently to business operations and at a reasonable cost. It need not be complicated – but you have to actually invest some time and money to get it done, and that’s how most states fail.”

The attackers have already used the data for identity theft and state sponsored attacks against manufacturers, the defense industry and other government agencies.

"From a state point of view, this is kind of the mother of all data breaches thus far,” said Larry Ponemon, chairman of The Ponemon Institute, which researches privacy and data protection.

In spite of her assertion that encryption is complicated and cumbersome, Haley says S.C. is now considering it. A bit late for South Carolina's citizens who have had their data compromised.

E-mail: snelson@senseient.com      Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

IRS Fails to Patch Systems - An Open Invitation to Hackers

Last Thursday, the Treasury Inspector General for Tax Administration released a September 25th report which warns that thousands of IRS computers could be vulnerable to hackers because software isn't being timely patched.

Thanks to our friend Alan Goldberg for sending that news item along. It had an ironic undertone because we lectured on Friday at the Virginia Bar Association's Health Care Practitioners Roundtable where we cautioned the audience that failure to patch is one of the primary culprits for data breaches.

Still, it is pretty amazing that the IRS has not got a grip on patch management. Even more alarming, the report stated that the IRS has not yet completed an accurate inventory of its IT equipment so it can't figure out whether all systems have been patched. That is utterly incomprehensible.

Pink slips are in order for failure to comply with basic information security procedures. As for my tax returns and yours, they've just had a bulls-eye painted on them.

E-mail: snelson@senseient.com    Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq

Secretary Panetta Warns of a "Cyber-Pearl Harbor"

First, a shout out to my friend Ben Kerschberg for making sure I finally got around to covering this story.

A recent Washington Post editorial referred to the now famous address given by Secretary of Defense Leon Panetta on October 11th. He talked about Shamoon, the nickname for a virus that deleted data from 30,000 computers at Saudi Arabia’s state-owned oil company in August. He called it "probably the most destructive attack" on the private sector we've experienced in the new world of cyberwarfare.

Experts are still debating whether the source of the attack was Iran, which illustrates the complexity of retaliating when we are not sure who to retaliate against. Was that attack in retaliation for the cyber-assault by the U.S. and Israel on Iran's nuclear development efforts by damaging nearly 1,000 uranium-enrichment centrifuges?

Shamoon did not cause enough physical damage for experts to consider it the equivalent of an armed attack. But we have no measuring stick for exactly how much damage must be done before officials would say, “We can’t let this go unanswered.”

And how do we answer a cyberattack? With a cyberattack of our own? A military attack? International law is murky at best.

The government has defined an armed attack in cyberspace as one that results in death, injury or significant destruction. Harold Koh, the State Department’s chief legal adviser articulates the rule like this: “If the physical consequences of a cyberattack work the kind of physical damage that dropping a bomb or firing a missile would, that cyberattack should equally be considered a use of force.”

I suspect that Retired Gen. James Cartwright, former vice chairman of the Joint Chiefs of Staff, is right on target. He has often said that an act of war "is in the eye of the beholder." In other words, the judgment may be a political one.

That judgment - just like the official cyberwarfare deliberations to date - is likely to be made behind closed doors.

E-mail: snelson@senseient.com      Phone: 703-359-0700

www.senseient.com

http://twitter.com/sharonnelsonesq