PerilScope

New Online Radar

for Detecting Risks

John S. Quarterman

Gretchen K. Phillips

InternetPerils

16 June 2006

Agora

Seattle, Washington

Traditional Internet Security

Defensible Terrain

Cannon of Henry VIII

Cannon Meet Walls

Roslin Castle History

1303 Battle of Rosslyn Glen: Sir Symon Fraser and Sir John Comyn defeat Sir John Seagrave by stealth, encirclement, and ambush; William Wallace watches

ca. 1304 Roslin Castle built at current location

1466 Rosslyn Chapel built on old castle location

1544 Henry VIII sends Earl of Hertford against it

1622 Current residence built in castle ruins

1650 Cromwell sends General Monk against it

The Disappearing Perimeter

“A second threat is a softening, if not disappearing, of the network perimeter.”

--Eugene Spafford, “Security Expert Recommends 'Net Diversity,” by Carolyn Duffy Marsan, Network World, 30 May 2006

Drawbridge Into Stone Bridge

No More Moats

Traveling laptops coming back into the company

Virtual Private Networks (VPN)

SSL-VPN and other web services

Internet Explorer (IE) welcome mat for crackers

Attacks on external assets, such as customers, via phishing, pharming, spam, etc.

A Month's Infestation

Multiple Phishing Servers

Some the same, some different

Ongoing infestation

Just one of many ISPs with this problem

One hopes the ISP doesn't know

Perhaps we should tell them

15 Phishing Servers, 7 June 2006

Multiple Targets

In this case mostly paypal and ebay

But also others

Some obvious from the domain names

Some not

No single target of phishing would know this

Cooperation enables discovery

Phishing Data Sources

Lists of phishing servers and targets from Anti-Phishing Working Group (APWG)

Topology and performance data and visualization by InternetPerils

Anti-Phishing Working Group

APWG publishes statistics on phishing, pharming, and related exploits

has stakeholders as members

collects phishing reports into a repository

acts as a clearinghouse and reputation system

more can be done, esp. reputation system

Dungeon?

More than One: An Army

Seeing the Undead

BBC (22 March 2005): U.K. leads world in zombie PCs (compromised computers)

Collected by 100s in botnets by bot herders and sold to:

spammers

phishers

pharmers

See the undead horde to help stop it.

An Infestation in Germany

5 Phishing Servers, 7 June 2006

Tea?

Miscreants and Motivations

Hacker

Cracker

Criminal

Terrorist

Industrial Spy

Government Spy

Insider

Exploration

Showing Off

$$$ Money

End Occupation

Competition

Politics

Various

Phishing Nodes
from the APWG Repository

Who's Watching?
(Door Opens In, No Handle)

Moving Ahead

Comprehensive Coverage: Internet critical infrastructure

Ongoing, regular, frequent, data collection

Independence of ISPs

Multiple viewpoints (cameras)

Multiple analyses

Interpretation: selection, focus, zoom, animation

Can't Fight An Army Alone

Criminal entrepeneurs and gangs use the global reach of the Internet for aggregate damage

Fortifying a perimeter is no longer adequate

Fortifying every machine is like expecting a single knight's plate armor to stop an army's cannon

Individual tools run by individual organizations are like single scouts with no radio or radar

Real defense requires collective action

Know Your Network Neighborhood

Cooperate with Your Neighbors

Financial services (banks, credit card companies, credit unions, brokerages, insurers)

E-commerce (eBay, Paypal, Amazon, etc.)

Government (FBI, Secret Service, etc.)

Hurricane Ivan Meets Cayman Islands

Hurricane Ivan
Disconnects Cayman Islands

12 September 2004 8AM local time (1PM GMT)

Two days offline

Reconnection: 14 Sept 9-11PM local (midnight-4AM GT 15 Sept)

Miami to Caymans

Many ways to Miami

Only one way onwards to Caymans

Example of a nonredundant path

Jamaica Not Disconnected

Reports of Jamaica’s demise were exaggerated

Jamaica Not Disconnected

News reports claimed Jamaica also disconnected

InternetPerils data shows Jamaica uninterrupted

Jamaica has multiple undersea cables and multiple ISPs

Redundant paths worked

No Substitute

There is no substitute for ongoing observations of real data

Can't expect ISPs to tell you (the customer or the government) what is going on

They consider it competitive information, and any outages might embarrass them

They don't know much beyond their own network

Need independent third party data

Force Majeure

Hurricane Ivan and the Caymans disconnect was a force majeure event, an act of God

But imagine a denial of service attack against a single path to a country or business

Central Banks

Central Banks

InternetPerils continually monitors paths to central banks around the world

Examining the database produces some useful results

Slow Link

This slowness persisted several hours

Enough to cause TCP backoff

Users would perceive as very slow

Lost business; maybe lost customers

Congested Paths

Nonredundant Paths
and Congestion

Three nodes next to each other have addresses in different netblocks

Customer may think they're routed differently for redundant web service

But they're all routed the same

There are actually five of them; the three shown were affected by the same slowdown for about six hours

Beyond the Firewall

Traditional technical security, such as

firewalling

intrusion detection

spyware scanning

Cannot protect from perils beyond the firewall:

Phishing

Pharming

Nonredundant paths

Congestion

Broken links

Bad routing announcements

Level 3 Routing Botch

Level3 upgraded a node which emitted bad routes

They fixed it almost immediately, but side effects were seen around the net

12:00-17:30 MDT 21 Oct 2005

(18:00-23:30 GMT)

Level 3 Routing Botch

Level 3 Animation

This animation shows paths to destinations that have been observed to traverse Level3 at some time

A routing blip is visible in the upper left at about 18:30 GMT

Level3 the Day Before

Level3 the Day Before

There was no visible routing blip the day before

So the blip on 21 Oct is probably a result of the Level3 botch

Is possible to zoom and isolate

Probably also to detect others

Hurricane Rita

Landfall 07:38 GMT 24 Sep 2005

Let’s look at some Louisiana destinations:

165 Education, news, government nodes

Viewed once an hour

From one camera in Texas

Animating 03:00-11:00 GMT

Rita Rerouting

Rita Same Time

Routing change upper left

Green link goes to red same time

Maybe some other simultaneous changes

Not Rita (30 Sep 2005)

Not Rita: Normal Churn

A week after Rita landfall

Same time frame

No significant routing changes

No correlated latency changes

So the anomalies shown for 24 Sep are probably due to Rita

More analysis is possible

Resilience

Backups

encrypt the backups

encrypt their network transmissions

Redundancy

computers

network paths

Diversity

especially in software

Phylloxera vastatrix

In the late nineteenth century an aphid-like insect, Phylloxera vastatrix, destroyed most of the world's vineyards, leading to the little-known fact that most French wines today are actually grown from Texas grapevine stock.

“Monoculture Considered Harmful,” by John S. Quarterman, First Monday, volume 7, number 2 (February 2002),

Big Risks

$50 billion economic damages possible from a single worst-case worm (Weaver and Paxson, WEIS04, May 2004)

$100 billion global cyber-catastrophe risk (some big company CEOs, according to mi2g, Feb 2004)

more than hurricane Andrew

global in scale

greatly exacerbated by monoculture

Big Rewards

Global reach

Convenience

Capabilities otherwise unavailable

Group-forming (sales, customers, suppliers, research)

Competitiveness

Eternal Vigilance by Everyone

Cybersecurity and fighting electronic crime

Requires eternal vigilance by everyone

Yet compliance (SOX, HIPAA, FERPA, GLBA, PIPEDA, DPD, FISMA, ISO 17799, COBIT, GAISP), and ever-higher standards of diligence aren't enough.

Eventually every security measure will fail!

What Then?

Risk Transfer

Contracts

Financial Risk Transfer Instruments

Cyberinsurance policies (don't depend on E&O or D&O)

Catastrophe bonds

Performance bonds

Assessments and adjustments require better security

Reputation Systems

Aggregate Damage Requires
Collective Action

Force majeure and electronic crime affect many organizations

Trying to fight it alone yields leverage to the miscreants

Pool resources (repositories, third party monitoring, reputation systems, insurance, legal)

Aggregate Damage Requires Collective Action

Castle Credits

Roslin Castle before 1544 courtesy Andrew Spratt

http://www.maybole.org/history/castles/roslin.htm

Map courtesy UK Ordnance Survey

Modern Roslin Castle exterior courtesy Richard Huseth

Modern Roslin Castle interiors courtesy Gretchen Phillips

Army of Henry VIII drawing from myarmoury.com

Dance of Death, Michael Wolgemut, Nurnberg, 1493

Plug the Book

Risk Management Solutions for Sarbanes-Oxley Section 404 IT Compliance

John S. Quarterman, Wiley

Contact Information

John S. Quarterman

jsq@internetperils.com

Gretchen K. Phillips

www.internetperils.com

2006-06-24T17:49:27