Feeds

Security world ill-equipped to solve digital whodunnits

'Unqualified and pedestrian'

Choosing a cloud hosting partner with confidence

When anthrax-laced letters killed five people and sickened 17 others shortly after the September 11 terrorist attacks in 2001, investigators were able to pin point the precise lab where the deadly spores were manufactured. And when Confederate General Stonewall Jackson was shot on the battle field some 150 years ago, forensics showed only one of his own forces could have pulled the trigger.

While the physical world is chock full of methods for solving high-stakes whodunits, sleuths in the digital realm remain woefully ill-equipped at figuring out who is behind the increasing number of attacks hitting government, private industry and consumer networks, says Tom Parker, a security researcher who is scheduled to speak on the topic at next week's Black Hat security conference in Las Vegas. That hasn't stopped security researchers, often armed with little more than inferences, from pointing fingers at nation states, and that could have important consequences for geopolitical relations.

“A lot of those efforts are very unqualified and pedestrian,” said Parker, who is director of security consulting services at Washington, DC-based Securicon. “There's really not any science behind the efforts that many people have been making recently that have resulted in stories like China is attacking us, Russia is attacking us, Korea is attacking us.”

Parker holds out the so-called Aurora attacks that hit Google and dozens of other large companies late last year as a prominent example. Google has yet to offer any evidence for its contention that China was behind the attacks besides saying some of them targeted email accounts used by Chinese dissidents. Evidence that error-checking code used in the exploits had circulated for years on English-speaking sites later cast doubt on claims by a private researcher that the code could only have been written by someone fluent in simplified Chinese.

The dearth of commercial products and widespread methods for discovering who is behind online attacks is ironic, Parker says, because many of the raw materials needed have existed for years. A technique known as isomorphism – which quickly spots similarities between two or more pieces of code – is one possible solution. It could be used to identify the developers behind an unknown piece of malware if one or more of their previous works are already known.

Similar techniques – such as small prime product calculation, API structure analysis and Black Axon – could also bring more rigor to investigations.

“It's important to have these tools that non-technical people can use to try and dumb down that knee-jerk reaction to miss-point fingers” said Parker. “There's a lot of people that the second they see a big company get compromised we immediately think its a state-sponsored effort and likewise when we see a power company get some malware we immediately think that it's a targeted attack sponsored by a nation state when in actual fact it turns out to be someone viewing a Viagra commercial they shouldn't have looked at. There needs to be more focus, I think, on the threat rather than on what the malware does to the machine and what the attackers that we really need to be concerned about are doing.”

Parker's talk, titled Finger Pointing for Fun, Profit and War?, is scheduled for Day 1 of the conference. ®

Beginner's guide to SSL certificates

More from The Register

next story
Russian hackers exploit 'Sandworm' bug 'to spy on NATO, EU PCs'
Fix imminent from Microsoft for Vista, Server 2008, other stuff
FYI: OS X Yosemite's Spotlight tells Apple EVERYTHING you're looking for
It's on by default – didn't you read the small print?
Microsoft pulls another dodgy patch
Redmond makes a hash of hashing add-on
'LulzSec leader Aush0k' found to be naughty boy not worthy of jail
15 months home detention leaves egg on feds' faces as they grab for more power
Forget passwords, let's use SELFIES, says Obama's cyber tsar
Michael Daniel wants to kill passwords dead
Kill off SSL 3.0 NOW: HTTPS savaged by vicious POODLE
Pull it out ASAP, it is SWISS CHEESE
Facebook slurps 'paste sites' for STOLEN passwords, sprinkles on hash and salt
Zuck's ad empire DOESN'T see details in plain text. Phew!
prev story

Whitepapers

Forging a new future with identity relationship management
Learn about ForgeRock's next generation IRM platform and how it is designed to empower CEOS's and enterprises to engage with consumers.
Cloud and hybrid-cloud data protection for VMware
Learn how quick and easy it is to configure backups and perform restores for VMware environments.
Three 1TB solid state scorchers up for grabs
Big SSDs can be expensive but think big and think free because you could be the lucky winner of one of three 1TB Samsung SSD 840 EVO drives that we’re giving away worth over £300 apiece.
Reg Reader Research: SaaS based Email and Office Productivity Tools
Read this Reg reader report which provides advice and guidance for SMBs towards the use of SaaS based email and Office productivity tools.
Security for virtualized datacentres
Legacy security solutions are inefficient due to the architectural differences between physical and virtual environments.