Keith Alexander: I'm Worth $1 Million Per Month Because I'm Patenting A Way To Stop Hackers (Which I Didn't Tell The NSA)

from the say-what-now? dept

The Keith Alexander story just keeps getting more and more bizarre. Almost immediately after retiring from the top position at the NSA, where he oversaw the total failure of the NSA's supposed "100% auditing" system, allowing Ed Snowden (and who knows how many others) to escape with all sorts of documents, Alexander announced that he had set up a cybersecurity firm -- with the ridiculously Hollywood-ish name of IronNet Cybersecurity. A month ago, it was revealed that he's going around asking banks to pay him $1 million per month for his "expertise." That caused a few to wonder if he's selling classified info, because really, what else could he offer?

Alexander has a new answer: Patents! Yes, Keith Alexander is claiming that he has an amazing new anti-hacker technique that is brilliant and wonderful and deserving of at least nine patents. According to Shane Harris over at Foreign Policy:

Alexander said he'll file at least nine patents, and possibly more, for a system to detect so-called advanced persistent threats, or hackers who clandestinely burrow into a computer network in order to steal secrets or damage the network itself. It was those kinds of hackers who Alexander, when he was running the NSA, said were responsible for "the greatest transfer of wealth in American history" because they were routinely stealing trade secrets and competitive information from U.S. companies and giving it to their competitors, often in China.

Of course, this leads to all sorts of questions. If Alexander had such a brilliant, patentable solution for stopping hackers, why didn't he, you know, use it while he was at the NSA. His response? He and an unnamed "partner" just came up with it in the last couple months after leaving office:

Asked why he didn't share this new approach with the federal government when he was in charge of protecting its most important computer systems, Alexander said the key insight about using behavior models came from one of his business partners, whom he also declined to name, and that it takes an approach that the government hadn't considered. It's these methods that Alexander said he will seek to patent.

The report also notes that Alexander is a named inventor on seven patent applications filed while he was at the NSA (the US government keeps those), but that these new ones are totally separate.

Now, it is entirely possible that Alexander and his partner magically came up with some new way to deal with cybersecurity -- though I'm skeptical. Cybersecurity work involves an awful lot of trial and error in the real world, and Alexander is insisting already that his "fundamentally new approach" will "jump" ahead of existing technology. That's a bold claim for someone who hasn't ever actually done work in the commercial field. One thing that we've pointed out for years, is that people who have no experience in actually building a technology business almost always overvalue the idea, and undervalue the execution. It certainly looks like Alexander is doing exactly that. He thinks that based on the idea alone -- which is totally unproven -- he's worth $1 million per month. He claims three companies have already paid up, though he doesn't say who (or how much they're really paying). It seems likely that any actual payments are more because of Alexander's connections, rather than his brilliant "idea."

Harris spoke to another expert who notes that the approach Alexander is talking about (behavioral modeling) is one that's been talked about and tried for years without success. In other words, it's a perfect example of where ideas sound good, but execution matters. And yet, Alexander insists that his ideas alone -- which haven't been proven yet (and on which he hasn't even filed these supposed patents) -- are so amazing that they will change the nature of cybersecurity?

When Harris asks for more detail about the solution, Alexander wouldn't tell him any more "given the sensitive nature of the work." Except, of course, if he's filing patents on it, the details are supposed to be revealed the public in fairly short order (18 months at most). And, really, if the solution is so great, they should be getting it out there and testing it. Security by obscurity is not the best proving ground. Actually having your solution tested is.

Filed Under: behavior modeling, cybersecurity, hackers, keith alexander, nsa, patents, surveillance
Companies: ironnet cybersecurity

How Serious Is James Clapper About Cybersecurity When His Office Can't Even Get Its SSL Certificate Right?

from the just-asking dept

James Clapper and the Office of the Director of National Intelligence (ODNI) have been among the loudest FUD-spewers concerning the "threats" to cybersecurity out there, and the need for massively dangerous "cybersecurity" legislation that would really just open up the ability for the Intelligence Community to get more access to private data. However, security researcher and ACLU guy Chris Soghoian noticed yesterday that the SSL security certificate on the ODNI website isn't even valid:

The Director of National Intelligence (@ODNIgov) can't be bothered install a valid HTTPS cert on their website #cyber pic.twitter.com/iiPIkFEfhD

— Christopher Soghoian (@csoghoian) July 23, 2014

In response, Soghoian joked: "[ODNI], I'll make you a deal: You fix your website's broken encryption cert, and I'll start to take your cyber fearmongering seriously."

Filed Under: cybersecurity, fud, james clapper, odni, ssl

Senate Intelligence Committee Approves Dangerous Cybersecurity Bill

from the because-of-course dept

We've written about the Senate's dangerous CIPA bill -- which is Congress' latest (bad) attempt to help increase the NSA-led surveillance state by giving companies blanket immunity if they share private information with the government... all in the name of overhyped "cybersecurity." We, of course, have been through this fight before, with the CISPA bill, which passed in the House a few times, but couldn't get any traction in the Senate. This time around, the (really bad) Senate version passed out of the Senate Intelligence Committee by a 12-3 vote (held in secret, of course). Not surprisingly, two of the three who voted against it are Ron Wyden and Mark Udall.

By now you should know: if Ron Wyden and Mark Udall are against something related to surveillance, you should be against it too (and the opposite is true as well).

The "good" news is that despite the overwhelming support by the NSA's biggest cheerleaders on the rest of the Senate Intelligence Committee, it seems unlikely that the bill will have enough support in the overall Senate. And it will hopefully remain that way. This bill is a dangerous one, that is solely designed to give the NSA and some companies additional legal "cover" for aiding the NSA's surveillance efforts. Thanks to Snowden's revelations, companies are, in general, a lot less willing to do that these days anyway, but giving those companies blanket liability to do so is a bad, bad idea.

And while there's still little to no evidence that the "cybersecurity threat" is anywhere close to as big as what the FUDmongers insist it is, even if that is true, no one has yet explained what laws actually get in the way of having companies share critical cybersecurity information as needed. And, if such laws really do exist, any solution should to just be narrowly focused on fixing those laws, rather than granting broad immunity for sharing just about any info.

Filed Under: cisa, cispa, cybersecurity, dianne feinstein, mark udall, ron wyden, saxby chambliss, senate, senate intelligence committee

EFF Sues NSA Again Over Failure To Release Procedures For Dealing With Zero Days

from the eff-may-need-a-whole-floor-devoted-to-nsa-lawsuits dept

Another day, another lawsuit filed by the EFF against the NSA. As you may recall, back in April there was some discussion about how the NSA deals with zero day exploits it discovers, and (specifically) whether or not it reveals them to relevant parties or keeps them for its own ability to exploit them. The NY Times revealed that President Obama had put in place an official rule that said the NSA should have a "bias" towards revealing the flaws, but left open a gaping loophole in saying the NSA could exploit those zero days for "a clear national security or law enforcement need." That's a pretty big loophole -- especially when you consider how law enforcement has been abusing every opportunity of late.

EFF filed a FOIA request to find out about the NSA's process for determining whether to exploit or reveal a zero day... and hasn't received a response, despite a promise by the government to "expedite" the request. Hence: the new lawsuit.

"This FOIA suit seeks transparency on one of the least understood elements of the U.S. intelligence community's toolset: security vulnerabilities," EFF Legal Fellow Andrew Crocker said. "These documents are important to the kind of informed debate that the public and the administration agree needs to happen in our country."

Over the last year, U.S. intelligence-gathering techniques have come under great public scrutiny. One controversial element has been how agencies such as the NSA have undermined encryption protocols and used zero days. While an intelligence agency may use a zero day it has discovered or purchased to infiltrate targeted computers or devices, disclosing its existence may result in a patch that will help defend the public against other online adversaries, including identity thieves and foreign governments that may also be aware of the zero day.

"Since these vulnerabilities potentially affect the security of users all over the world, the public has a strong interest in knowing how these agencies are weighing the risks and benefits of using zero days instead of disclosing them to vendors," Global Policy Analyst Eva Galperin said.

These days, it really does seem that the only way to get the government to cough up these kinds of documents is to file a lawsuit, which really defeats the purpose of the whole FOIA process. Perhaps the government should just admit it's a charade and let people go straight to the lawsuit filing process instead.

Filed Under: cybersecurity, exploit, foia, james clapper, nsa, odni, surveillance, zero days
Companies: eff

Dangerous Ruling: Judge Lets Microsoft Seize & Redirect No-IP Domains Without Notice

from the breaking-the-internet dept

Microsoft posted a somewhat self-congratulatory blog post yesterday about how it was taking on a "global cybercrime epidemic" and effectively targeting systems used by malware. Of course, part of the details were that Microsoft totally misrepresented the nature of No-IP and how dynamic DNS solutions work. No-IP's parent company, Vitalwerks Solutions, was painted by Microsoft as being something of an accomplice to the malware epidemic, allowing Microsoft to convince a judge to seize a bunch of very popular No-IP domains without any notice or immediate recourse. Microsoft claims that it's just stopping malware, but the collateral damage from grabbing those domains is immense. According to No-IP:

Unfortunately, Microsoft never contacted us or asked us to block any subdomains, even though we have an open line of communication with Microsoft corporate executives.

We have been in contact with Microsoft today. They claim that their intent is to only filter out the known bad hostnames in each seized domain, while continuing to allow the good hostnames to resolve. However, this is not happening. Apparently, the Microsoft infrastructure is not able to handle the billions of queries from our customers. Millions of innocent users are experiencing outages to their services because of Microsoft’s attempt to remediate hostnames associated with a few bad actors.

As No-IP further notes, Microsoft could have easily contacted them, and the company would have taken action:

Had Microsoft contacted us, we could and would have taken immediate action. Microsoft now claims that it just wants to get us to clean up our act, but its draconian actions have affected millions of innocent Internet users.

Vitalwerks and No­-IP have a very strict abuse policy. Our abuse team is constantly working to keep the No-­IP system domains free of spam and malicious activity. We use sophisticated filters and we scan our network daily for signs of malicious activity. Even with such precautions, our free dynamic DNS service does occasionally fall prey to cyber scammers, spammers, and malware distributors. But this heavy-handed action by Microsoft benefits no one.

Except, instead, it appears that Microsoft went to court (secretly, without telling Vitalwerks/No-IP) and convinced the judge that the company itself was violating the law. And the court bought it:

There is good cause to believe that, unless the Defendant Vitalwerks is restrained and enjoined by Order of this Court, immediate and irreparable harm will result from its ongoing violations the Anti-Cybersquatting Consumer Protection Act (15 U.S.C. § 1125) and the common law of negligence. The evidence set forth in Microsoft’s TRO Motion, and the accompanying declarations and exhibits, demonstrate that Microsoft is likely to prevail on its claim that this Defendant has engaged in violations of the foregoing laws through one or more of the following:

a. Leasing to Malware Defendants No-IP sub-domains containing Microsoft’s protected marks; and
b. Negligently enabling Malware Defendants to participate in illegal acts, and failing to take sufficiently corrective action to stop and prevent the abuse of its services, all of which harms Microsoft, Microsoft’s customers, and the general public.

Given the nature of the ex-parte (without Vitalwerks being able to present its side of the story) proceedings, Microsoft was able to paint the fact that a platform provider (which has a full anti-abuse program), was somehow liable for actions of its users. This flies in the face of a variety of laws and caselaw on secondary liability, which protect the service provider from being held liable for abusive behavior by its users. Yet here, not only did the court ignore all of that, it simply flat out handed over to Microsoft a whole bunch of No-IP's domains (which, clearly, Microsoft was unable to handle), bringing down a big chunk of the web that relied on No-IP's dynamic DNS services.

This seems like a tremendously dangerous move for the internet in a variety of ways. Microsoft needs to take some of the blame. Even if its goal was to stop malware proliferation, there are better ways to do that than to falsely blame No-IP, and to misleadingly represent the service to the court, allowing the domains to be seized and rerouted.

Filed Under: cybercrime, cybersecurity, domain seizure, dynamic dns, ex parte, takedown
Companies: microsoft, no-ip, vitalwerks

Latest Cybersecurity Bill Could Actually Be A Backdoor To Destroying Net Neutrality

from the bad-definitions-make-bad-law dept

Earlier this year, we wrote about the Senate's latest attempt at a cybersecurity bill, the Cybersecurity Information Sharing Act (CISA), which tries to distinguish itself from the toxic attempts to pass CISPA over the past few years. We and many others have already detailed how CISA, like the CISPAs before it, has a tremendous problem in creating perverse incentives for companies to help the government spy on people, but as a bunch of public interest groups are noting, the definitions are so broad, that the bill could actually be a backdoor way to undermine net neutrality. That's because it has an incredibly broad definition of a "cyberthreat" such that an ISP could declare, say, Netflix to be a cyberthreat, allowing it to throttle Netflix's bandwidth. Here are two key paragraphs from a letter sent by CDT, EFF and a bunch of other groups:

Arbitrarily Harms Average Internet Users: The definition of “cybersecurity threat” is overbroad, and includes “any action” that may result in an unauthorized effort to adversely impact the security, confidentiality and availability of an information system or of information stored on such system. Countermeasures can be employed against such threats absent risk of liability. This could lead to use of countermeasures in response to mere terms of service violations. For example, logging into another individual’s social networking account – even with their permission – typically violates the website’s terms of service, and therefore qualifies as unauthorized access under the CFAA, and could be treated as a “cybersecurity threat.” A provision preventing this harm appeared in the July 2012 Cybersecurity Act and should be included in CISA.

Infringing on Net Neutrality Policy: Likewise, the July 2012 bill also contained provisions clarifying that nothing in the Act, including overbroad application of the terms “cybersecurity threat” and “countermeasure,” could be construed to modify or alter any Open Internet rules adopted by the Federal Communications Commission. Net neutrality is a complex topic and policy on this matter should not be set by cybersecurity legislation.

In other words, under the current broad definition of "cybersecurity threat," an ISP (e.g., Comcast) could argue that another service provider (e.g., Netflix) was "adversely impacting the availability" of information on its network, and thus it was going to take "any action" (e.g., throttling it down to nothing) to deal with the "threat." And, under the proposed legislation, there would be nothing anyone could do about it, as Comcast would be absolved from liability, as long as it could claim that all of that Netflix traffic was the equivalent to a cybersecurity threat according to its own definition.

The fact that there was language in previous bills that prevented this kind of thing, but is absent from this latest bill seems quite troubling. One hopes it was just an oversight in getting the bill out -- and that seems most likely. But, given how often we've seen nefarious language sneak into certain bills, it's not out of the question that others are recognizing the opportunities to backdoor in a way to get around any possible net neutrality proposal.

Filed Under: cisa, cispa, cybersecurity, cyberthreats, dianne feinstein, information sharing, net neutrality

Rep. Grayson Asks If Keith Alexander Is Selling Classified Information To Get $1 Million Per Month

from the because-what-else-are-people-buying? dept

We recently noted that former NSA boss Keith Alexander is running around asking for $600k to $1 million per month for his new "cybersecurity" consulting firm. While some people thought that the number was "low" for banks, that doesn't make any sense. You could hire a lot of really good actual security professionals for that kind of cash. So it made us wonder just what banks thought they were getting for that $1 million. Actual security professional Bruce Schneier wondered that as well, and wondered aloud if the one difference was that... Alexander could give them classified info -- such as where he hid the backdoors in their routers.

That statement apparently caught the attention of Rep. Alan Grayson, who has been a vocal opponent of NSA overreach. He's now sent a letter to the Financial Service Rountable to point out that selling classified info is a crime:

Security expert Bruce Schneier noted that this fee for Alexander's services is on its face unreasonable. "Think of how much actual security they could buy with that $600k a month. Unless he's giving them classified information." Schneier also quoted Recode.net, which headlined this news as: "For another million, I'll show you the back door we put in your router."

This arrangement with Mr. Alexander may also include additional work with the shadow regulatory firm The Promontory Group, with whom Alexander apparently will partner "on cybersecurity matters." According to Promontory spokesman Chris Winans, Mr. Alexander "and a firm he's forming will work on the technical aspects of these issues, and we on the risk-management compliance and governance elements."

Disclosing or misusing classified information for profit is, as Mr. Alexander well knows, a felony. I question how Mr. Alexander can provide any of the services he is offering unless he discloses or misuses classified information, including extremely sensitive sources and methods. Without the classified information that he acquired in his former position, he literally would have nothing to offer to you.

Grayson also demands "all information related to your negotiations with Mr. Alexander, so that Congress can verify whether or not he is selling military or cybersecurity secrets to the financial services industry for personal gain. Sure, it's a snarky move, but there is a point behind it. Alexander can't command those sums because of his actual technical expertise. The reality, of course, is that he's selling his connections to the government. But it certainly raises the question of appearances.

Filed Under: alan grayson, backdoors, bruce schneier, cybersecurity, keith alexander, nsa, surveillance

Keith Alexander Wants $1 Million Per Month For 'Cybersecurity' Consulting

from the hence-the-FUD dept

In May, we wrote about how ridiculous it was that former NSA boss Keith "collect it all" Alexander was now launching a cybersecurity consulting firm. After all, it's difficult to think of anyone who has done so much to undermine cybersecurity as Keith Alexander. Now Bloomberg is reporting that he's offering his "services" for the cut-rate price of $1 million per month. Yes, I'll repeat that:

Keith Alexander wants banks and other companies to pay him $1 million per month to help them with their "cybersecurity." At that price, I'd hope that he's just selling them the location of the backdoors he ordered to be placed in all of their hardware and software. And idiotic banks are apparently willing to pay, rather than going with the much, much cheaper option of hiring an actual security expert:

Joining a crowded field of cyber-consultants, the former National Security Agency chief is pitching his services for as much as $1 million a month. The audience is receptive: Under pressure from regulators, lawmakers and their customers, financial firms are pouring hundreds of millions of dollars into barriers against digital assaults.

Either way, given that Alexander stands to profit quite nicely from his own undermining of cybersecurity, it's obviously no wonder at all that he's spent the past month exaggerating the "threat" of what's out there, often taking it to ridiculous levels.

While Alexander is doing the exact same thing as his predecessors, pay attention to the various media coverage of Alexander in the coming months and years. He's going to appear on TV and in newspapers and magazines a lot. And he will frequently be quoted spewing FUD about threats and how dangerous it is out there. And in almost none of those cases will any of the press covering him highlight the fact that Alexander stands to profit massively from keeping big banks and other companies scared shitless, so they hire him for $1 million a month to "protect" them from this threat that he both helped to create... and is now overhyping.

Filed Under: banks, consulting, cybersecurity, fud, keith alexander, nsa, surveillance

UK Plans To Bring In Life Sentences For 'Serious Cyberattacks'

from the because-terrorism dept

At the official State Opening of the UK Parliament, the Queen makes a speech in which she lays out what the UK government hopes to achieve in the new legislative session. It's one of the quainter British ceremonies -- BuzzFeed has a good summary of just how quaint -- but the one-line statements of intent can mask some very far-reaching plans. This year, for example, the Queen's Speech contained the following item :

A serious crime Bill will be brought forward to tackle child neglect, disrupt serious organised crime and strengthen powers to seize the proceeds of crime.

The Guardian has more details of one particular measure the serious crime Bill will contain:

Any hackers that manage to carry out "cyberattacks which result in loss of life, serious illness or injury or serious damage to national security, or a significant risk thereof" would face the full life sentence, according to the serious crime bill proposed in Wednesday's Queen's speech.

As well as targeting cyberterrorists, the new offence in the proposed update to the Computer Misuse Act [CMA] 1990 would also hand harsher sentences to those hackers carrying out industrial espionage, believed to be a growing menace affecting UK business.

The law would have a maximum sentence of 14 years for attacks that create "a significant risk of severe economic or environmental damage or social disruption". Currently, the section of the CMA covering such an offence carries a 10-year sentence.

Much of this is the kind of activity carried out in the form of attacks sponsored by governments outside the UK -- or, as in the case of the NSA, directly by those governments. Despite the recent grandstanding by the US when it filed criminal charges against members of the Chinese military whom it accuses of espionage, there is little hope of ever persuading the main players to hand over their citizens for trial, so the new UK law will be largely ineffectual against the most serious threats.

But there is a real danger in the "or significant risk, thereof" part, since that gives the UK authorities huge scope to claim -- as they have in other contexts -- that some online action "risked" some terrible outcome, even though nothing actually happened. Things are made worse by the fact that there is no public interest defense or exemption for research. As the Guardian notes:

The government has also not addressed complaints over the application of current computer crime law, which some in the security industry claim actually makes the internet less safe.

This is because certain kinds of research could be deemed illegal. Experts known as penetration testers, who look for weaknesses in internet infrastructure, often carry out similar actions to real cybercriminals in their attempts to improve the security of the web, such as scanning for vulnerabilities.

But such research is punishable under British law, even if it is carried out for altruistic ends, leaving potential weaknesses unresolved, critics of the CMA said.

What this means is that while it will fail to tackle the most serious online attacks, and chill research into security flaws, the proposed Bill will conveniently allow the UK government to target groups like Anonymous who carry out high-profile but relatively harmless actions over the Net. This section of the proposed Bill is really about the UK government bolstering its already disproportionate powers to throttle online protests by characterizing them as "serious cyberattacks", and threatening to impose life sentences on anyone involved.

Follow me @glynmoody on Twitter or identi.ca, and +glynmoody on Google+

Filed Under: cfaa, computer misuse act, cyberattacks, cybersecurity, hacking, sentencing, uk

Would You Hire Former NSA Boss Keith Alexander For Cybersecurity Consulting?

from the he-knows-where-the-holes-he-buried-are dept

It is, of course, no surprise that former NSA boss Keith Alexander is now setting out a shingle for consulting work in the private sector. While we'd assumed he'd latch on with something like the Chertoff Group, it appears that he's setting up his own consulting firm in which he'll help "financial institutions looking to address cybersecurity threats." Considering this is the guy who, just days earlier, was talking about why the NSA harmed internet cybersecurity, it kind of makes you wonder if he's the person you'd really trust with any sort of cybersecurity consulting. Well, unless, as Marcy Wheeler has suggested, his sales pitch is "I know where all the holes I've left in the internet are." Still, if you were a financial institution, would you rather hire someone who's spent their career trying to make the internet safer... or the guy who worked hard to make it less secure?

Filed Under: consulting, cybersecurity, financial institutions, keith alexander, nsa, surveillance, trust