I recently came across a paper called Shadows in the Cloud, which is actually a follow-up report of Tracking GhostNet: Investigating a Cyber Espionage Network, an investigation of the attacks on the office of the Dalai Lama and some governmental bodies. The report is written by two bodies who had the privilege to investigate those attacks: the Information Warfare Monitor and the Shadowserver Foundation.
Even though the report has been out for some weeks, I think it makes sense to dig in it here as it contains a few fairly remarkable conclusions and statements. One of the key things we should think about globally is an International Incident Sharing Database (see the end of the post).
Sharing and Collaboration
If you are a regular reader of my blog posts, you know that I am a big supporter of international collaboration and I am clear about the need for a common set of rules to establish this collaboration. If you read through the paper, you will see in different areas that they were challenged during the investigation. On page 8 they state:
On our side, we felt unsure about the protocol around information sharing, and were in an awkward position to be able to give information over to governments and affected parties directly without being entirely clear about whom would be responsible and whether or not our interlocutors were appropriate authorities. The notification problems around Ghostnet informed our approach to the Shadows in the Cloud investigation, including being more conscious from the outset of documenting our notification procedures.
Think about that for a second. You investigate a security incident, e.g., in your company. During the investigation you realize that you are not the only victim but that there are others, be it companies or governments. What do you do with this information? Whom do you contact? How can you be sure that this information gets into the right hands? Fairly hard questions to answer. And, finally, what kind of information are you allowed to pass on? Additionally, the report notes that "Information sharing, generally speaking, is immature and underdeveloped, often hampered by proprietary concerns surrounding the commercial market for cyber security services [page 10] and Information sharing among victims of network intrusions and espionage is rare [page 10]". Well, what I see fairly often is that incidents do not happen as they are not supposed to happen. Rarely somebody talks openly about what happened to them.
In order to combat such attacks, the legal collaboration is key (again :-)). As otherwise, "it points to the possibility of a perfect storm that may result from a lack of international consensus, ill-developed and implemented security practices, a paucity of notification mechanisms, and the growing confluence of cyber crime, traditional espionage, and the militarization of cyberspace [page 10]". This simply tells us that we will lose the fight without international legal collaboration and harmonization, as well as the willingness of the public and the private sector to share information.
Technology
From a technical perspective, they started to use Internet-based services. For example, they used Twitter to control the botnet as well as free mail services like Gmail and free blog services like Baidu. This is to enhance the command-and-control infrastructure of a botnet, something I was never aware of but is actually a logical enhancement of what we know already. The next point, when it comes to technology is the software they seem to have exploited: "We observed the group using PDF, PPT, and DOC file formats to exploit Adobe Acrobat and Acrobat Reader, Microsoft Word 2003 and Microsoft PowerPoint 2003" – old software, software which was designed to cope with completely different threats than the ones existing today! And even if they decided to stay on the previous versions: "The Microsoft Word 2003 and PowerPoint 2003 files were mostly older exploits, which have been circulating in the underground hacker community for some time". In other words: It is about patch management again… But to be fair, they fell victim of some vulnerabilities in PDFs that were not patched at the time of the attack.
Source
Finally let’s think about the people behind the attacks. It is a joint understanding that the attacks originated from China. The Chinese government was accused to be the source behind it, but they denied it and it has never been proven otherwise. Generally – not only in China – it can be expected that there is a close collaboration between governments and the hacking or as the report states: "The degrees of the reported relationship vary between 'authorize' to 'tacit consent' to 'tolerate (Henderson 2007b)".
Conclusions
What can we learn from the report? Actually nothing new, it just re-enforces my view of the world:
- We have to be better in sharing incident information. This has two sides: One is between victims. There has to be a way (and, honestly, I do not have a solution yet) to find the right contact within a government or an organization to help them understand that they were attacked.
- We need smooth and fast international legal collaboration. This has to be based on a solid harmonized legislation.
- There are two calls when it comes to your software maintenance: Make sure you are on the latest version of your software and make sure you are patched. Patch Management is one of your fundamental processes in your organization!
And now to the final point I have been thinking about for quite a while. The airline industry suffered initially from quite some technical incidents. The way the industry finally dealt with it was to establish a sharing of incident information (as well as near misses) and a global body taking care of the airline safety (and the willingness of the governments to collaborate and share). The same process has actually started in certain countries in the healthcare sector.
When it comes to Information Security we all deny incidents unless they become public – because we fear an impact on our reputation. We have to start thinking differently. We need a place where we are able to (anonymously?) file an incident that happened or ways somebody was attacked to be shared between security professionals. That’s the only way where we can learn collectively and increase the pace of the products becoming better at defending and help security professionals improve their skills in protecting critical information. The critical question is who can own such a database? It has to be an organization that is trusted internationally and therefore cannot be state-owned. It could be an international association or an inter-governmental organization. Ideas are very welcome as I am convinced that there is a huge need of an International Incident Sharing Database.
Roger