Disintermediating the Major Defense Contractors

Innovative and cost-effective altogether? Think SpaceShipOne, a commercial space ship that didn't come from a major defense contractor, not even NASA but from a competition won by a privately run company. How to disintermediate yet innovate? Become a venture capitalist, or an angel investor and optimistically hope the academic-to-commercialization process would happen with one of your investments. The DeVenCI project aims to connect sellers with buyers and seems like a sound short-term objectives oriented idea compared with In-Q-Tel the CIA's VC fund emphasizing on long-term R&D :

"Some companies have already profited from the program. In 2003, when DeVenCI was in its experimental phase, the Defense Information Systems Agency was looking for ways to protect computer networks. After speaking to several companies through DeVenCI and evaluating their technology, the agency wound up working with ArcSight, a software company based in Cupertino, Calif., which won $3.6 million in related contracts over the next few years, DeVenCI officials said. Mr. Novak of Novak Biddle said he brought with him to the March DeVenCI meeting two executives from a small start-up developing biometric technology that could be used for things like advanced fingerprinting or eye scans. Mr. Novak said the chief executive and chief technology officer from the Virginia company, which he declined to name for competitive reasons, gave a presentation to the roughly 50 assembled procurement agents."

Here's In-Q-Tel's investment portfolio so far -- Google used to be among them.

Related posts:
Insider Competition in the Defense Industry
Aha, a Backdoor!
Overachieving Technology Companies

DDoS on Demand VS DDoS Extortion

There were recent speculations on the decline of DDoS attacks, in respect to the lack of companies actually paying to extortion attacks and that it's supposedly not a cost effective approach for malicious attackers to use their botnets. Think again, as it's always a matter of a vendor's sensor network diversity, one that's also excluding targeting mom-and-pop web properties. Just because DDoS extortion may not be working, and I say may not be working because only a few companies would admit they have paid money given the simple math of losing revenues on an hourly basis and spending more on bandwidth and security consultancy than the money requested, DDoS on demand still remains a well developed underground business model. DDoS attacks may not be profitable for the attacker directly performing them, but remain profitable if he's getting paid to provide the service only. Here's an excerpt from my Future Trends of Malware (January, 2006) publication related to DDoS extortion :

"Now you should ask yourself, would total cost of ownership of the business, the costs of the bandwidth, the DDoS attack protection solution, or the botmaster’s deal with the devil style proposition can solve the situation. If you’re thinking big, each and every time an organization pays, it not only risks a repeated demand, but is also fueling the growth of the practice in itself – so don’t do it!"

I'm aware of an ironic situation where a small-biz client's web server started getting DDoS without any reason whatsoever. The first thing that came to my mind was that it's either a DDoS extortion, or a possible rival, so I asked whether or not they've received any extortion emails. They declined, and here comes the interesting part, two days later, the attacks stopped, and a letter arrived in the form of the following email - "We saw you ignored our first email so we had to demonstrate you the power of our attack, this is your second chance to bla bla bla". What happened, and why did they say no extortion emails were sent? Here comes the irony, in the spam folder of the publicly obtainable email account for the domain was the original extortion email, that got detected as a spam. Time for some cyber intelligence to assess their capacity.. Never comply with such letters, or they'll come back for more. By the way, ever thought of the DDoS extortion bluff?

Here's another excerpt on DDoS on demand :

"There’s a lot of demand for paying to teens to shut down your competitors and hoping they would go under the radar, and while ethics are excluded, given these get busted, they’ll be the first to forward the responsibility to the buyer of the service. There’s also a clear indication of market for such services, and sooner or later these individuals will improve their communication skills, thereby increasing the impact of these attacks. For instance, Jay Echouafni, CEO of TV retailer Orbit Communications, paid a group of botmasters to DDoS his competitors, where the outage costs were estimated at $2 million. Another case of DDoS on demand occurred in March, 2005, when the FBI arrested a 17 year old and a Michigan man for orchestrating a DdoS attack, again causing direct monetary loses. DDoS attacks, and the ease of gaining capability in this field are clearly increasing."

Unethical competitions would favor a service where a third party maintains the infrastructure, launches the attack, and for the safety of both parties, remain as anonymous as possible. Here' a related article at BBC News:

"We are seeing a lot of anti-competitive behaviour," he said. Mr Sop added that many more Asian targets were being hit by DDoS attacks - a region in which Symantec did not historically have a big presence. In Asia, he said, DDoS attacks were proving very popular with unscrupulous firms keen to get ahead of their rivals. "The really frightening thing is you can buy access to a botnet for a small amount of money and you can have you competitor down for a long time," he said."

I never actually enjoyed articles emphasizing on how Russian script kiddies are taking over the world given the idea of "outsourcing malicious services". So next time you see a DDoS attack coming from the Russian IP space against U.S companies, it could still be U.S based rivals that requested the attack on their U.S based competitors -- stereotypes keep you in the twilight zone.

Meanwhile, here's a proof hacktivism is still alive and fully operational as the Estonian Internet infrastructure's been recently under permanent DDoS attacks due to real-life tensions of removing a statue from the Soviet era. It wasn't Chinese Mao-ists that did it for sure, but the recent case is another proof that it's always about the money, as everyone not aware of different malicious attackers' motives is preaching. DDoS extortion isn't dead, it's just happening beneath the radar, as targets are picked up more appropriately balanced with less greed regarding this underground business model only.

UPDATE : More developments on the DDoS attacks in Estonia now combined with defacements, which I think was only a matter of time.

Related posts:
The Underground Economy's Supply of Goods
The War against botnets and DDoS attacks
Emerging DDoS Attack Trends
Korean Zombies Behind the Root Servers Attack
Hacktivism Tensions - Israel vs Palestine Cyberwars

A Chronology of a Bomb Plot

A very detailed overview of a bomb plot, especially the lines related to anything digital such as :

- "An e-mail sent from Mr. Khawaja to Mr. Khyam on Nov. 30, 2003, read: "It's not as easy as we thought it would be. We have to design the whole thing ourselves. "There are two parts to it, one transmitter and another receiver that will be at a distance of about 1 or 2km that will be attached to the wires and send out 5 volts down the line and then we get fireworks."

No details on whether or not the communication was encrypted, how it was decrypted -- indirectly through client side attacks for sure -- and was their communication on purposely intercepted or filtered though the noise with keywords such as transmitter, wires and fireworks.

- "Mr. Mahmood was working for the British gas company, Transco, and had stolen sensitive CD-ROMs from National Grid, a British utility, that detailed the layout of hundreds of kilometres of high-pressure gas pipelines in southeast England."

And the insider threat was just an overhyped threat with lack of statistical evidence of it happenning. Think twice. Don't dedicate efforts in ensuring such information never makes it out of the organization due to terrorist fears only, but consider the consequences of it getting into the wrong hands at the first place.

- "A notebook in the living room included references for books including The Virtue of Jihad, and Declaration of War."

Propaganda writings are easily obtainable online, which reminds me that monitoring them to the very last mile is worth the risk in order to further expand their network, of both, sites they visit and people they communicate with.

- "Downloaded on to his laptop was a computer file, The Mujahideen Explosive Handbook. It contained the exact recipe to build an ammonium nitrate bomb."

On purposely placed online DIY manuals can act as honeypots themselves. As we've already seen, counter-terrorism forces across the world are establishing such fake cyber jihad communities in order to lure and monitor wannabe jihadists. But monitoring who's obtaining the already hosted in the wild manuals, is far more beneficial than hoping someone will eventually fall a victim into your cyber trap.

In another related research by the RAND Corporation entitled "Exploring Terrorist Targeting Preferences" the authors try to come up with various scenarios on the process of prioritizing possible targets such as :

"the coercion hypothesis; the damage hypothesis; the rally hypothesis; and the franchise hypothesis. If Al-Qaeda directs the next attack the coercion and damage hypothesis, and, quite possibly both, are the most likely to influence the nature of the target.

Great psychological imagination applied in the paper, worth the read. From a statistical point of view, the probability of death due to a car accident is higher than that of a terrorist attack, so consider escaping the FUD related to terrorism that's streaming from your favorite TV channels in order to remain objective. The ugliest part of them all is that everyone's discussing the post-event actions taken, and no one is paying any attenting to the pre-event activities that made it possible, and with training camps under heavy fire, the digitalization of terrorist training is taking place.

And here's another great analysis, this time covering the process of how terrorists send money by combining anonymous Internet services in between mobile banking :

"Advanced mobile technology, cooperation between international mobile communications providers and international financial institutions and the lack of regulations make for a swift, cheap, mostly untraceable money transfer -- known as "m-payments" -- anywhere, anytime, by anyone with a mobile telephone."

Dare we say adaptive?

Winamp PoC Backdoor and a Zero Day

Listen to your infection? Not necessarily as this backdoor binds cmd.exe on port 24501, but needs to be socially engineered in the form of a plugin for Winamp. Code originally released in December, 2006, see attached screenshot. Not much of a fun here either, but as the folks at SANS point out Winamp doesn't play .MP4 files automatically from a web page, so no chance to have it embedded within popular sites and cause mass outbreaks as we saw it happen with the with ANI exploit code and the WMF one.

gen_wbkdr.dll
File size: 45056 bytes
MD5: 74d149f4a1f210ea41956af6ecedb96b
SHA1: 5a2e8d5727250a647ce44d00cf7446775e6cd7d5

Anti-Censorship Lifestyle

Following a previous post on security lifestyle(s), and in between the ongoing efforts to censor a 16 digit number I feel it's about time you dress yourself properly in case you haven't done so already. Censorship in a Web 2.0 world is futile, the way security through obscurity is. Seems as everyone's talking about the number today, there's even a domain name registered with it.

The Brandjacking Index

Picture a situation where a customer gets tricked into authenticating at the wrong site of company XXX. Would they do business with company XXX after they get scammed, trojan-ized, and spammed to (virtual) death? I doubt so, and as we can also see in the results of a recently released survey on whether or not customers would do business with retailers who exposed personal data - they'd rather dump them right away.

MarkMonitor just released their first quarterly Brandjacking Index :

"The Brandjacking Index investigates trends, including drilled-down analysis of how the most popular brands are abused online and the industries in which abuse is causing the most damage. The report examines the ever-adaptive tactics of brandjackers such as cybersquatting, false association, pay-per-click (PPC) fraud, domain kiting, objectionable content, unauthorized sales channels and phishing. The Brandjacking Index tracks the top 25 brands from the 2006 Top 100 Interbrand study plus additional Interbrand ranked companies for business segment analysis."

The old marketing rule that a dissatisfied customer will share the bad experience with at least five more fully applies here, and given he or she's an opinion leader in their circle - you've got a problem as it's your brand in the domain name. Therefore, despite the companies developing a market segment for timely and reliably shutting down phishing sites, the most obvious "cybersquatted" domains shouldn't even be allowed to get registered at the first place. But given the flexibility of registering a domain these days, from a company's perspective, cybersquatting's an uncontrollable external factor, and in order to protect their future flow of "soft dollars" efforts to monitor the domain space are highly advisable.

There're several key techniques you should keep in mind. Cybersquatting, vulnerabilities within the browser to spoof the status bar and make it look like the legitimate page, or a malware infected PC that's basically redirecting all the known E-banking sites to fake ones. No anti virus, no Ebanking is highly advisable, yet not a solution to the problem, and E-banking site's compatibility with the most popular -- and targeted -- Internet Explorer browser ONLY, turn many precautions into a futile attempt to deal with the problem -- heading in the opposite direction. The question is, which technique is more effective at the end user's perspective, and how should the targeted organizations deal with this indirect form of attack on their brands, reputation and the rest of the "soft dollars" goodies such as favorable PR and stakeholder's comfortability? From another perspective, who's more irresponsible, the unaware end user, or banks whose web application security ignorance make it easier for phishers to establish trust?

One solution to the problem is shortening the lifetime of such a domain to the minimum by tracking and shutting them down by using a commercial service like this online trademark monitor, a screenshot of which you can see at the top of the post. Perhaps rather resources-consuming, but educating your customers for their own safety in times when anyone can register a pay-pal-login.tld domain like through third-party registers, is another way to go. Did I mention that anti-phishing toolbars are a free alternative in case common sense fails -- like it does?