Trend Micro Facebook TrendLabs Twitter Malware Blog RSS Feed You Tube - Trend Micro
Search our blog:

  • Recent Posts

  • Calendar

    July 2015
    S M T W T F S
    « Jun    
  • Email Subscription

  • About Us

    Author Archive - Martin Roesler

    9:10 am (UTC-7)   |    by

    For the past couple of days the security industry has been discussing claims that the systems of a commercial aircraft was “hacked” via the on-board inflight entertainment system (IFE). This became public after a search warrant was obtained by media outlets which revealed that the Federal Bureau of Investigation had applied for a search warrant targeting Chris Roberts, a researcher looking into airplane security. The warrant alleged that Roberts could “hack” the IFE systems of various commercial planes and issued what he called the “CLB” or climb command. At the time of this warrant, Robert had made the following tweet:

    This led to Roberts being escorted off his flight and various electronic items (including his iPad, his laptop, and various USB keys) being seized.

    Reaction from both the security and aviation communities was swift. Some viewed Roberts’s actions as unethical. Many were upset that Roberts had chosen to perform his “attack” on a plane during an actual commercial flight. The veracity of his claims was doubted by many as well, and this was a reaction shared by many in the aviation community.

    What do I think happened? I don’t think he hacked into the airplane’s critical systems. Other technical factors aside, he was on the plane. Unless we’re supposed to believe he was some sort of suicide hacker, he would probably not want to cause any actual harm.

    Security research should be carried out in a controlled environment. We’ve carried out research into AIS systems, and we are currently carrying out research into in-car systems. We did not start out right away with real-life boats. For our car research, we rented cars and started out in parking lots, gradually making the environment more closely resemble real-world environments. (We are now working with the car manufacturer in question.) Doing any actual “tests” in a scenario without the consent of the parties concerned (such as the airline or other passengers) is not the way to go about this.)

    Of course, sometimes vendors do not respond well to researchers who want to work with them. When we were conducting our own AIS research, we were rebuffed because Trend Micro is not a country, and the organization in question only dealt with member-countries. We went ahead and publicized our research anyway, and now the first organizations took action and switched to encrypted AIS to protect themselves against the threats we talked about.

    The reaction to this incident reminds me of earlier days in software security, when companies were reluctant to admit that their products could contain vulnerabilities, when security through obscurity was viewed as a proper defense. The response of the FBI (to shut down the research) and by airplane/IFE manufacturers (refuse to disclose details) are natural responses. Adding security costs real money, and vendors are reluctant to spend resources that they do not have to.

    Whatever you think of Roberts and what he did or didn’t do, the fact is that the topic of airplane security is now out in the open. Like any other system, there are bugs somewhere in this system; no human-built system is 100% error-free. It will be up to governments and regulators to force vendors (both of airplanes and IFE systems) to move beyond simple security-through-obscurity and demonstrate that existing systems are secure, and to fix any vulnerabilities that do come to light. Who knows, perhaps the systems that are in place have been designed in a robust and secure manner and do a good job of keeping attackers out. Until the mindset changes, though, we can’t be 100% sure.

    If you think this is only relevant to aviation, you’re wrong. It just happens to be one of the most visible aspects of the computerization of everything, what others would call the Internet of Things. Other sectors will have to deal with their own challenges soon enough, and the quicker we learn how to do just that, the better it turns out for everybody.

    Posted in Malware |

    In the past couple of weeks, the effectiveness of PGP as a way to encrypt the emails of users has been a subject of much debate. This latest round was kicked off by Matthew Green, a professor of cryptography at Johns Hopkins University, who criticized PGP primarily for flaws in key management and for its lack of forward secrecy.

    It’s very important for the industry, as a whole, to get encryption right. It’s fundamental to securing online lives in the 21st century. PGP has been a key part of securing email for many years, so suggestions that it needs to be revised because it’s broken need to be taken seriously.

    While the encryption of PGP itself is regarded as sound, it has always been regarded as not particularly user-friendly. However, it has never really been considered to be aimed at ordinary users. Before, it was always more technically capable users who found themselves relying on PGP. These users were capable of using the PGP clients available at the time, despite their lack of polish.

    Now, things are different; it is conceivable that people might be interested in using PGP, but not have the technical capability to use the existing clients. These users want software that is “click and forget”. There is a fundamental disconnect between “what is secure” and “what is easy” that is not easily bridged.

    One particular aspect of PGP that does deserve criticism is how it manages keys. Simply put, PGP puts all the burden of managing keys on the user. This is in contrast to other encryption solutions like SSL/TLS, where this process is essentially invisible to the end user.

    There’s a fundamental tradeoff between convenience and security, and here PGP was designed with security as the highest priority: key exchange was handled directly by the users. This meant that users could decide whose keys they could trust. That’s the most basic decision in security, and PGP put it directly in the hands of users. That may have been fine for tech-savvy individuals, but for ordinary users, that’s far more difficult.

    Other email encryption solutions (like those we offer) rely on some sort of Trusted Authority (TA) to manage the keys. The TA has to authenticate users, but this takes the burden of key management away from end users. Of course, this means that the end users have to trust the TA server – this is fine for corporate environments, but for individuals this is probably not acceptable.

    There is nothing stopping a vendor from implementing PGP in a way that is more palatable to an ordinary user. This is exactly what Google and Yahoo are trying to do, and it will be interesting to see just how they meet the challenges of making PGP acceptable to the ordinary user.

    One more thing to say about PGP. Whatever its flaws, it has been proven to be reliable – and trusted – since it was introduced. Yes, it has its own problems, but to a large degree those are because it is being used by markets that it was never aimed at. In addition, as computing power increases, key length will have to be increased as needed – but this is an understood problem.

    However, the core of PGP is still sound. Saying it needs to “die” is counterproductive, as all that might do is push users towards other “solutions” that may promise security, but are actually insecure. What needs to happen is for PGP to be improved and built on in order to serve the evolving needs of users. Done properly, these can mean PGP will continue to be a strong security standard for a long time to come.

    Posted in Vulnerabilities | Comments Off on PGP: Not Perfect, But Something To Build On

    Last December, I spoke at a cybersecurity summit sponsored by the International Telecommunications Union (ITU) in Baku, Azerbaijan. I was there to discuss one thing that Trend Micro will focus on in 2014 and beyond: how we can we work together with law enforcement to stop cybercrime.

    One may ask, why does law enforcement and the security community need to work together to stop cybercrime? It’s because neither group, working alone, can protect users and stop cybercrime.

    For various reasons, police agencies don’t always deal well with cybercrime. For one, the scale of cybercrime is larger than physical crime. A gang of pickpockets stealing wallets can only target so many people in a day; a cybercriminal can victimize thousands of users in a matter of seconds.

    In addition, many police agencies don’t have the skills to effectively track down and investigate cybercrime. Tracking down cybercriminals requires a very different skill set from traditional policing, which limits the abilities of law enforcement to go after cybercriminals. It also takes resources and trained personnel, which are, in many cases, in very short supply.

    Trend Micro has spent considerable energy in building excellent working ties with law enforcement agencies such as Interpol. This allows us to work in direct partnership with these agencies and become a key part of investigations. Our role in these investigations is beyond just passively handing over information to police; instead we work actively with investigators to figure out what information they need as part of their investigation.

    In some ways, it’s as if our researchers have been deputized to work side by side with police. The investigations are no longer the responsibility of police themselves; to combat cybercrime effectively requires the private industry and police to work side by side. For that to happen, there has to be large amount of trust between us and agencies, and I am proud to say that in many cases we have built up that trust and effectively conduct investigations together.

    Both our researchers and police have to be on the same page when it comes to the objective. Our goal is the same: to put cybercriminals behind bars. We do not focus on “technical” solutions such as shutting down servers, or taking down botnets, or seizing domains. One might even argue this is counterproductive in the long term, as it means that cybercriminals will be pushed to use more sophisticated tactics and more concealed infrastructure, making investigations more difficult. This is something we noted in our 2014 predictions.

    We believe that in order to fully protect our customers, efforts have to be focused on arresting cybercriminals. Taking down their infrastructure is, at best, a short-term solution: cybercriminals can easily rebuild their infrastructure and recover from any “takedown” relatively easily. To really stop cybercrime, the “threat actors” – cybercriminals – have to be the ultimate target.

    This is not always an activity which makes the headlines or spawns press releases. However, we do believe that moving forward, this is the best way to protect our customers and the Internet as a whole.

    Posted in Malware | Comments Off on Working With Law Enforcement In 2014 And Beyond

    6:49 am (UTC-7)   |    by

    Recently, Trend Micro and INTERPOL announced that Trend Micro will help train law enforcement personnel from participating countries all over the world to help them cope with today’s cybercrime threats. We are honored to help INTERPOL in its fight against cybercrime; this is completely in line with our vision of creating “A World Safe for Exchanging Digital Information.”

    The details of our collaboration are in our press releases, but I want to use this topic to discuss, more broadly, how and why Trend Micro works with law enforcement agencies around the world to stop cybercrime.

    Why is it so important that law enforcement and security companies like Trend Micro work closely together to deal with today’s threats? The answer is: each group brings very different skillsets – and mindsets – to the table. By working together, they are able to work best to become effective against cybercrime.

    Security researchers have a wide variety of information at their disposal. They have threat information from their company’s operations, as well as underground information – frequently from the “social networks” they form while visiting underground forums undercover.

    In addition, researchers typically work as teams which are multinational, have a wide reach of knowledge and specialties available to them, and used to making decisions quickly. All these traits are quite helpful in keeping up with cybercriminals.

    However, security researchers can only go so far. Law enforcement has access to powers that are needed to truly identify those responsible for attacks. Servers can be seized, communications (electronic or otherwise) can be monitored, as provided for by courts. This in-depth information allows for the identification of the actual persons behind online crimes, who can then be arrested and brought to trial.

    In the absence of cooperation, a wide variety of problems can occur. Researchers may release information into the public, which may interfere with in-progress investigations by police. The released information may not even result in anything of significance, as the researchers cannot enforce laws. Meanwhile, law enforcement can’t deal with cybercrime: it moves fast, it’s not clear “where” it actually takes place, and depending on local laws it may not be “crime” in the first place.

    While it is essential for law enforcement to partner with security companies to catch cybercriminals, they also need to be careful in choosing their partners. Some companies are perceived (rightly or wrongly) to be close to certain governments. The partners also need to be discreet in releasing information to the public; prematurely released information can seriously damage long-running investigations and cause promising leads to go cold. Picking the wrong partner can also hurt, not help, the fight against cybercrime.

    As a company, we work very hard to ensure that we have good relationships with law enforcement agencies from all over the world. We meet at conferences, internal meetings, and other events on a regular basis that serve as a way for us to exchange information. An example of the fruits of our cooperation was the recent arrest of a key figure in ransomware gangs. By working closely with Spanish law enforcement, Trend Micro was able to gather actionable information that led to arrests in this case.

    We strongly believe that by working with law enforcement, we are able to go after cybercriminals directly. Instead of targeting their hosting infrastructure – both infected machines and malicious servers can be replaced easily enough – we go after the true suspects, the persons responsible for various attacks. Going after these perpetrators, we believe, is the best way to ensure a safer Internet for everyone.

    Posted in Malware | Comments Off on Law Enforcement Cooperation And Trend Micro

    What is the difference between cybercrime and a “cyber war”?

    There are different elements of an attack that help us understand this: the targets, the threat actors behind it, as well as the tools used. But I think one of the most important aspects, something that drives all the other aspects, is also the answer to the question I posed earlier: intent.

    I believe this difference in intent matters because it defines the threat itself. There are a lot of reports on different kinds of organizations being successfully victimized by targeted attacks, and it has become so overwhelming to the point that it has obscured our view of what kind of threats we’re dealing with. And though knowing the intent might not be able to help us stop an attack, it can enable us assess if we are a potential target.

    Cyber war or Cybercrime?

    For example, when a threat actor from country A conducts a targeted attack against several companies in country B, does it count as cyber war, or cybercrime? The answer, again, depends on the intent.

    Cyber war, as Raimund Genes also said in his 2013 predictions, refer to politically motivated attacks that may destroy data or even cause physical damage to infrastructure of a specific country. So in my example above, if the goal of the attack is to destroy the companies’ data or their infrastructure with a political intent, it may be considered an act of cyber war.

    However, if the attack is conducted in order to steal information from the companies with a pure financial intent, then it should be considered a form of cybercrime. Most of the cybercrime schemes we’ve seen in the past aimed to affect as many individual users as possible, but the cybercriminals have found a bigger and better target in companies.

    Read the rest of this entry »



    © Copyright 2013 Trend Micro Inc. All rights reserved. Legal Notice