Web Security

Is the Web Becoming Less Secure? A PBS Analysis

In the wake of the Gawker Media hacking over the weekend, Jeffrey Brown gets a wider perspective about the vulnerability of online information and the danger of further cyberattacks from James Lewis of the Center for Strategic and International Studies and Larry Clinton of the Internet Security Alliance.

Transcript

JEFFREY BROWN: Now some wider perspective on all this from two who follow the online world closely.

James Lewis is director and senior fellow of the Technology and Public Policy Program at the Center for Strategic and International Studies here in Washington. And Larry Clinton is president and CEO of the Internet Security Alliance, an industry trade group that represents companies and organizations focusing on Internet security.

Welcome to both you.

Jim Lewis, how — we listen to this. Now, broaden it out. How vulnerable is the system and where do you see the main problems?

JAMES LEWIS, Center for Strategic and International Studies: The main problem is that we’re using 1970s technology, or, at best, 1990s technology, and it just isn’t appropriate anymore for a global infrastructure.

And there are some things, like this Gawker website, that we’re just never going to be able to fix. Passwords are very difficult to make secure, maybe impossible. So if you’re depending on a password, chances are you’re going to be in trouble. And I know that might frighten people, but that’s the reality.

JEFFREY BROWN: Reason for being frightened? What do you see?

LARRY CLINTON, president & CEO, Internet Security Alliance: Well, there is reason for being frightened.

We have an insecure system that was designed to be open, not to be secure. And we’re expanding that system with all sorts of new devices, handheld devices, smartphones, et cetera. So, the system is becoming generally less secure.

JEFFREY BROWN: It’s interesting, because a lot of this isn’t about high technology. This is human nature, right? People want to simplify their lives, so we use the same password.

LARRY CLINTON: Well, that’s right. I mean, the problem really…

JEFFREY BROWN: They even use the password for password.

LARRY CLINTON: Exactly, or 12346, the most common password.

(LAUGHTER)

JEFFREY BROWN: Yes.

LARRY CLINTON: The problem isn’t that we couldn’t build secure systems. The problem is really more that we won’t buy secure systems. We want easy and we want cheap.

And we’re going to have to begin to look at cyber-security as much more than just a technological issue. It’s a strategic and economic issue. And we’re going to have to take a full-scale look at all these things in an integrated fashion.

JEFFREY BROWN: Well, give us a little sort of news that viewers can use here. I mean, what should consumers, what should they do? Especially, here we are in the holiday season, and a lot of people are online shopping, for example.

JAMES LEWIS: Yes. And if you pay a little attention to your password, you can make it harder, and you’re going to knock out the lower-end hackers, which is mainly what we have seen in a lot of these WikiLeaks and Gawker things. You know, don’t use your pet’s name.

If you have personal information on Facebook or a social networking site, don’t use that as your password.

And a lot people do that. And, finally, the default password on all equipment when you buy it is password. Change the default.

JEFFREY BROWN: What would you add to that for…

LARRY CLINTON: Well, that’s all good advice. And it does begin to scratch the surface of the problem.

But we need to get much deeper with the problem. Enterprises need to be much more involved in overall cyber-security. One of the least publicized facts in this field is that we know tons about how to secure these systems.

JEFFREY BROWN: We do?

LARRY CLINTON: We do.

JEFFREY BROWN: What do we know, for example?

LARRY CLINTON: Well, enterprises need to have a risk management plan. Most don’t. They need to have somebody in charge of the plan. Most don’t. We need to be beginning to fund the investment in cyber-security equal to the upside that we do invest.

Most businesses are happy to invest in online marketing and all the advantages for cyber-security. They are not investing in the cyber-security defensive structures that they need to be putting in place, many of which are highly effective. There are standards, practices, technologies that could protect many of these sites. They’re simply not investing in them.

JEFFREY BROWN: Is that correct, in your experience, that they don’t want to invest, even after we see something with Gawker? And we see it — of course, that’s just the tip of the iceberg, right?

JAMES LEWIS: Yes, it’s a question of investment. It’s a question of practices. And it is, to some extent, a question of technology.

To some extent, this technology is just not securable. And so there’s always going to be an element of risk. One of the things that’s nice about these denial of service attacks is it…

JEFFREY BROWN: Explain. Explain what that is.

JAMES LEWIS: Denial of services, as we heard, people launching hundreds or thousands, tens of thousands of messages at a company, to the point where their computer on the receiving end is overloaded and crashes.

That’s right.

And that’s an avoidable problem. That’s a problem that people have figured out how to beat. So when you see somebody falling prey to denial of service attack, it means they haven’t been paying any attention for the last five or six years.

JEFFREY BROWN: But so what do you tell — let’s focus on companies for a moment. We talked about individuals. What should companies be doing, do you think?

JAMES LEWIS: Companies have to take this a lot more seriously. And the denial of service is the low end of the threat.

The high end of the threat is espionage or sabotage. We have seen a lot of espionage. For denial of service, as for espionage, you have to say, am I doing the basic hygiene things? Am I making sure my systems are patched? Do I have a risk management plan? Have I put in place the technologies that will let me track who is trying to do what to my network?

All of this is out there. And, in fact, the whole WikiLeaks thing with DOD, with the right technologies, we could have avoided WikiLeaks. So this is a problem maybe of will, maybe of incentives. But it’s something that is fixable if we can get our act in gear.

JEFFREY BROWN: And yet you’re saying that, when you go to companies, a lot of companies just say, this is last on our list, after marketing and various other things?

LARRY CLINTON: Well, if you’re a small business, you want one thing, which is to become a big business. There are about a third of our major corporations that are investing adequately in this.

But in two-thirds of American businesses, investment in cyber-security is actually going down. And I think Jim is absolutely right. We need to put in place a 21st century partnership between government and industry, so that we get the proper incentives put in place to expand the perimeter of cyber-security, and, that way, we don’t have to be training our grandparents to update their Twitter accounts properly.

JEFFREY BROWN: What about the hackers? I mean, we refer to this phrase now hacktivists, right? Do you see them that way? Are they pranksters? Is it worse? And how organized is this all?

JAMES LEWIS: Well, one of the nice things about the Internet is it lets virtual communities spring up. And it can be virtual communities of people interested in the same kind of dog, or it can be people interested in the same kind of nutty political cause.

It empowers them both. And so what we have got now are groups that share views widely distributed around the globe and have a technology that will let them express their opinions. We have seen this in Estonia. We see it all the time in Asia.

It’s a way to — it’s a new form of politics. And it’s like those anarchists who come and demonstrate in front of the IMF, except, these times, they can hide behind the Internet. They can do — make a lot more noise, do a lot more damage.

JEFFREY BROWN: And do we know much about how organized they are as groups? I mean, we’re talking about Gawker. We’re talking about the Wikipedia — WikiLeaks. Excuse me.

LARRY CLINTON: Yes, they’re very organized. Actually, the biggest problem is organized crime.

The organized criminal syndicates, particularly in Eastern Europe and in China, are the ones who are providing the basis for a lot of this nefarious behavior. And then we get a lot of attention paid to the hacktivists, which generate attention.

But the real insidious threats are things like the advanced persistent threat, which, unlike a hacktivist attack, like we’re seeing with the WikiLeaks, is not designed to generate attention. It’s designed to get into a system, and so you don’t even know that it’s there. And it quietly steals, not only personal data, but corporate intellectual property, national secrets, et cetera.

And this is very, very organized. And it’s driven by the attempt to make money.

JEFFREY BROWN: And mostly quiet, right?

LARRY CLINTON: Very, very quiet.

JEFFREY BROWN: And that’s the kind of discussion — those are the things we don’t discuss, usually, and we don’t hear about.

LARRY CLINTON: That’s right.

JEFFREY BROWN: All right, Jim Lewis and Larry Clinton, thank you both very much.

JAMES LEWIS: Thank you.

LARRY CLINTON: Thank you, Jeff.

{ 0 comments }

A Gawker Analysis On PBS

Gawker Media, one of the web’s largest publishers, was hacked over the weekend and information for about 1.3 million users was made public. Jeffrey Brown speaks with the NewsHour’s Hari Sreenivasan about the cyber attack and what it means for personal security online.

Transcript

JEFFREY BROWN: And we turn to now to the vulnerability of the Internet, after a week of very visible hacks and attacks.
ARTICLE TOOLS

In the days following the release of classified government documents by WikiLeaks, thousands of the site’s supporters, so-called hacktivists, have launched online attacks aimed at companies and groups they deem hostile to WikiLeaks and to the free flow of information.

Last week, a group calling itself Anonymous targeted the websites of Visa, MasterCard and PayPal, among others, after the companies stopped processing donations to WikiLeaks. Government websites, too, have been vulnerable. The Senate website was slowed last week after Senator Joe Lieberman criticized sites enabling WikiLeaks.

The attacks used software that chain together hundreds of computers that all request information from the same website at the same time, causing a traffic jam that makes the site inaccessible.

RYAN SINGEL, staff writer, Wired.com: This is a little bit more like what happened in the ’60s when protesters took over buildings at, you know, universities, where people couldn’t get in the building, but it’s not really them blowing up the building.

JEFFREY BROWN: While all that goes on, this weekend, there was another example of online hacking, this one affecting the popular site Gawker, an eight-year-old digital media company that hosts blogs on media, technology, and pop culture.

A group calling itself Gnosis raided Gawker, burrowing inside its databases to unlock the user names, passwords, and e-mail addresses of some 1.3 million people who had left comments on the site. Gawker was forced to stop publishing temporarily Sunday and urged its users to change their passwords.

There were signs the hackers had acted in retaliation after a war of words with Gawker. They also appeared to send a message about the vulnerability of usernames and passwords, listing several thousand accounts in which the password for the account is the word “password.”

Our own Hari Sreenivasan covers technology developments for us online, has been — and has been following the Gawker situation. He joins me now for an update.

So, Hari, first, for those who don’t know much about Gawker, tell us a little bit more. What is it?

HARI SREENIVASAN: Well, it is one of the largest publishers on the Web. And it’s really an amazing set of sites. Whether you care about cars or you care about gadgets, it’s one of the must-check sites on the Internet.

And it’s almost like a modern-day salon, because people come there for information, but they’re coming just as much for the comment threads and to leave a comment and really to be part of a conversation.

JEFFREY BROWN: All right, we talk about this group called Gnosis. How much do we know about what — who they are? And what did they do to Gawker?

HARI SREENIVASAN: Well, a lot of these sort of hacker groups are very shadowy in nature, in the sense that they — there’s no card-carrying membership that says, I’m part of this club. I’m the one who did this, and here is my address and phone number.

So, really, what they did to Gawker was come in behind the scenes in the past few weeks, past few months, figure out vulnerabilities, and essentially start to take the keys to the kingdom. Everything that Gawker held dear, most important, the user information, they took all of that out and splayed it out across the Internet.

They didn’t hide the information for themselves for some sort of kind of nefarious means. They said, here, take it, because this is really — they’re the crown jewels for a website.

JEFFREY BROWN: And you were telling me earlier today that you went online last night.

HARI SREENIVASAN: Yes.

JEFFREY BROWN: So, give us examples. What could you see there?

HARI SREENIVASAN: Well, something very minimally invasive was that I could see what the future of the Gawker website was supposed to look like, which is something pretty important that you want to try to keep secret.

If I was a real kind of a technologist, I could actually see the content management system. I could see the databases. I could see where they store their passwords. I could see the advertising information, which could be very important.

But the most important, again, the crown jewels, were the usernames, the passwords, and the e-mail addresses connected to them of some 1.3 million users. That’s really the stuff that I, as a complete novice, could see.

JEFFREY BROWN: Now, how are those people affected, in what ways?

HARI SREENIVASAN: Well, so, the thing — it kind of gets back to a little bit of social engineering.

So a lot of times people don’t make separate passwords and separate usernames for different websites. Sometimes, they use the same website or same e-mail address that I have for work on to a site like Gawker, and then maybe that’s the same password that gets me into Facebook, and then it’s also connected to Twitter.

So, as we see all of these different kind of communities that we participate in during the day, people aren’t very good at keeping these walls separate. So, that’s where the real influence is.

JEFFREY BROWN: And I heard today that — so, today, they used to that affect Twitter as well, right?

HARI SREENIVASAN: That’s right. So…

JEFFREY BROWN: And this would be people who use the same password for Gawker and Twitter.

HARI SREENIVASAN: That’s right, the same username or the password. So, basically, somebody between last night and this morning wrote a small computer program that figured out that little exploit.

And, so, while hundreds or maybe thousands of people are asleep, their Twitter accounts were automatically sending out advertisements for the acai berry or acai berry, however you say it, the super berry, right? So, while you were sleeping, you were actually a victim to somebody else’s marketing scam.

JEFFREY BROWN: Now, what if I or what if our viewers don’t go on Gawker? Should they care?

HARI SREENIVASAN: Well, they should care because this actually exploits larger vulnerabilities into their workplaces.

Not only were they’re Gmail and Yahoo! accounts. There were a lot of government accounts. There were a lot of edu, which means universities or educational institution, accounts.

So if these people don’t change their passwords, don’t get a little stronger about their own protections, those systems could also be compromised. I mean, all of those e-mail addresses are now out there for other hackers to exploit.

JEFFREY BROWN: And what of Gawker? I said they temporarily stop publishing. They’re certainly back now. But have they taken any steps that we know of to prevent this in the future?

HARI SREENIVASAN: Well, they said that they are. They apologized to their users profusely on their blog. They said, we’re really embarrassed and really we want to try to help you go ahead and change your password.

But, ironically enough, this morning, if I wanted to delete my account on Gawker, I couldn’t do that because the database that would have allowed me to do that was corrupted by the hackers last night.

JEFFREY BROWN: All right, Hari Sreenivasan, thanks a lot.

{ 0 comments }