Cyber Hacking

Wars in Virtual Space

From the Editors of Scientific American

Cover Image: Eyewire/Getty Images

Copyright © 2013 Scientific American, a division of Nature America, Inc.

All rights reserved.

Published by Scientific American

75 Varick St.

New York, NY 10013

www.scientificamerican.com

ISBN: 978-1-466833821

Scientific American and Scientific American MIND are trademarks of Scientific American, Inc.,

used with permission.

CYBER HACKING

Wars in Virtual Space

From the Editors of Scientific American

Table of Contents

Introduction

Living in a Cyber World

by Robert Keating

SECTION 1

The Hacker

1.1

The Hacker in Your Hardware

by John Villasenor

1.2

Hacking the Lights Out

by David M. Nicol

1.3

The Attack of Code Red

by Carolyn P. Meinel

1.4

How Hackers Break In...and How They Are Caught

by Carolyn P. Meinel

1.5

Attack of the Worms

by Michael Moyer

SECTION 2

Nowhere To Hide

2.1

The End of Privacy?

by Daniel J. Solove

2.2

Stealing Secrets

by W. Wayt Gibbs

2.3

Brave New World of Wiretapping

by Whitfield Diffie and Susan Landau

2.4

Tag–You’re It

by Katherine Albrecht

2.5

Malware Goes Mobile

by Mikko Hypponen

2.6

The Ultimate Database

by Simson L. Garfinkel

SECTION 3

The Solutions

3.1

How to Keep Secrets Safe

Anna Lysyanskaya

3.2

Improving Online Security

by John Rennie, et al

3.3

Can Phishing Be Foiled?

by Lorrie Faith Cranor

3.4

Beyond Fingerprinting

by Anil K. Jain and Sharath Pankanti

Introduction: Living in a Cyber World

Cyberspace has certainly transformed the world. It is critical to the delivery of essential services around the globe. The number of Internet users is nearing 3 billion. We are living digital lifestyles. Online "friends" often outnumber the flesh-and-blood variety, and it's no longer necessary to clutter up space with DVDs with options like the Amazon cloud. From media and communications to banking to science, technology and beyond, an increasing number of daily activities is performed online.

On one hand, as Secretary of Defense Leon Panetta told a gathering in New York City in October 2012, “Cyberspace is the new frontier, full of possibilities to advance security and prosperity in the 21st century. It’s transformed our way of life.”

On the other, he added a soon-to-be-soundbyte: the threat of a “cyber Pearl Harbor; an attack that could cause physical destruction and the loss of life.” Such an attack could target infrastructure networks—electric, chemical and water plants. Perhaps crashing communications, financial or transportation systems. An attacker could potentially gain control and derail trains carrying passengers or lethal chemicals. A cyber attack could “paralyze” the nation.

In this eBook, we peer behind the cyber curtain. First, we look at the hackers—Section 1 discusses who they are, how they work, their motivations and methods. The opening article examines hardware—specifically microprocessors and why they are vulnerable to tampering. Then we turn to the internal attacks, the worms and viruses whose resulting damage ranges from merely inconvenient and attention-getting to expensive and dangerous. In the latter category falls the Stuxnet virus, which attacked Iran's nuclear facilities and is discussed in "Hacking the Lights Out." Phishing scams and malware have also grown as the motivation has become more explicitly financial.

Section 2 takes a broad look at issues of privacy and the technology used to gather and track personal information. The first article analyzes how the definition of privacy has changed, often along generational lines, in the cyber age. With so much personal information volunteered on social networking and other sites, how much privacy can people expect? Most of us leave a trail of data wherever we go, and subsequent articles in this section look at how. One article looks at radiofrequency identification (RFID) tags, tracking devices that are used in a growing number of goods and that have precious little security. Another article examines technologies capable of spying, such as those that can mine confidential information from personal and office equipment as basic as a photocopier or fax machine.

On the flip side, Section 3 covers innovative technologies used to secure cyber networks and safeguard information. The first article illustrates how cryptography can provide mathematical tools beyond the mere encrypting of messages. Another discusses replacing identifiers like user names and passwords with biometrics—behavioral or anatomical markers such as fingerprints. Much more difficult to forge, copy, share or misplace, this technology is improving and spreading as inexpensive sensors and microprocessors become available.

When the novelist William Gibson first coined the word cyberspace in his 1982 short story Burning Chrome, and later in his fantasy novel Neuromancer, he thought of it as an abstract term that was “evocative,” but “essentially meaningless.” As this information-packed anthology well demonstrates, thirty years later that is not the case anymore.

-Robert Keating

Book Editor

SECTION 1

The Hacker

The Hacker in Your Hardware

by John Villasenor

Your once reliable mobile phone suddenly freezes. The keypad no longer functions, and it cannot make or receive calls or text messages. You try to power off, but nothing happens. You remove the battery and reinsert it; the phone simply returns to its frozen state. Clearly, this is no ordinary glitch. Hours later you learn that yours is not an isolated problem: millions of other people also saw their phones suddenly, inexplicably, freeze.

This is one possible way that we might experience a large-scale hardware attack—one that is rooted in the increasingly sophisticated integrated circuits that serve as the brains of many of the devices we rely on every day. These circuits have become so complex that no single set of engineers can understand every piece of their design; instead teams of engineers on far-flung continents design parts of the chip, and it all comes together for the first time when the chip is printed onto silicon. The circuitry is so complex that exhaustive testing is impossible. Any bug placed in the chip’s code will go unnoticed until it is activated by some sort of trigger, such as a specific date and time—like the Trojan horse, it initiates its attack after it is safely inside the guts of the hardware.

The physical nature of hardware attacks makes them potentially more problematic than worms, viruses and other malicious software. A virus can jump from machine to machine, but it can also in principle be wiped clean from any system it infects. In contrast, there is no fix for a hardware attack short of replacing the infected units. At least, not yet.

The difficulty of fixing a systemic, malicious hardware problem keeps cybersecurity experts up at night. Anything that uses a microprocessor—which is to say, just about everything electronic—is vulnerable. Integrated circuits lie at the heart of our communications systems and the world’s electricity supply. They position the flaps on modern airliners and modulate the power in your car’s antilock braking system. They are used to access bank vaults and ATMs and to run the stock market. They form the core of almost every critical system in use by our armed forces. A well-designed attack could conceivably bring commerce to a halt or immobilize critical parts of our military or government.

Because Trojan hardware can hide for years before it is activated, it is possible—perhaps likely—that hardware bugs have already been planted. And although no large-scale hardware attacks have yet been confirmed, they are inevitable.

As we know all too well from combating software-based cyberattacks, a relatively small proportion of people who use their technical skills for malicious purposes can have an big impact. Thus, rather than asking whether or not hardware attacks will occur, the better questions are: What forms will these attacks take? What consequences will they have? And, perhaps most important of all, what can we do to detect and stop them or at least minimize their effects?

BLOCK BY BLOCK

An integrated circuit, or chip, is simply an electronic circuit etched onto a single piece of a semiconductor material, most often silicon. Modern integrated circuits are physically quite small—no more than a few square centimeters and often much smaller—but can contain several billion transistors. The very complexity of modern chips creates the vulnerabilities that make Trojan attacks possible.

Modern chips are divided into subunits called blocks that perform different functions. In a mobile phone’s processor, for example, one block might be memory that can be used to store frames of video captured by the camera. A second block might compress that video into an MPEG file, and a third block might convert those files into a form that can be transmitted over the antenna. Data move among these blocks across a system bus, which acts like a highway connecting the different parts of the chip.

When a company embarks on the design of a new integrated circuit, it first maps out what functional blocks the circuit will need. Some of these blocks will be designed in-house, either from scratch or as a modification of a block design used in the company’s earlier chips. Others will be licensed from third parties that might specialize in a certain type of functionality—receiving data from an antenna, for example.

The block from the third party does not come as a physical piece of silicon, because the goal in building the integrated circuit is to have all the functional blocks printed onto the same surface. Instead the block comes as a data file that fully describes how the block should be etched onto the silicon. The file can be thousands of lines long, making it a practical impossibility for a human to read the file and understand everything that is going on. The block provider will also typically supply some software that the block purchaser uses to model how the block will respond to a variety of situations. Before any circuits are printed, the lead company will join all the model blocks into a computer simulation to ensure the chip will function as expected. Only when the model passes a battery of tests will the company begin the time-consuming and expensive process of fabricating the physical integrated circuits.

Here is where the vulnerability lies: because the rogue hardware requires a specific trigger to become active, chipmakers will have to test their models against every possible trigger to ensure that the hardware is clean. This is simply not possible—the universe of possible triggers is far too large. In addition to internal triggers such as a date-based trigger described in the mobile phone example, hackers could employ external triggers such as the reception of a text or e-mail message containing a speci!c set of characters. Companies test as best as they can, even though this necessarily means testing only a very small percentage of possible inputs. If a block behaves as expected, it is assumed to be functioning correctly.

GLOBAL SECURITY PROBLEM

A single chip can incorporate circuits designed in locations across the globe by hundreds of people working at many different firms. This globalization of chip design makes new product development faster and less expensive. It also creates risks, because it is difficult to detect rogue circuitry hidden among the hundreds of millions of transistors before the chip ships.

Inside an Integrated Circuit: A chip contains a set of functional blocks, each dedicated to performing a specific task. Data move from block to block across a system bus, and traffic flow in the bus is controlled by yet another block, the bus arbiter. In a cell phone, for instance, data might travel from memory (1) to a block that performs computations (2) to a block that encodes and decodes information (3) to blocks that exchange data with off-chip locations (4) and (5).

When Things Go Wrong: A chip containing a Trojan will function normally until the rogue hardware is awakened by a trigger and instructed to attack. Triggers could take many possible forms, including the arrival of a certain date and time or a “wake-up call” from the outside world arriving as a specially encoded packet of data. The Trojan can then execute one of two types of attacks—overt and covert.

In an overt attack, the rogue hardware stops the chip from functioning properly. In this example, a corrupted block refuses to release its access to the system bus, thereby preventing other blocks from communicating with one another. In this case, the chip would cease to function altogether.

In a covert attack, the rogue circuitry does not give any indication of its presence. Covert attacks are of particular concern because there is no obvious evidence that anything is wrong. Underneath, however, the rogue circuitry can be sending confidential data to an off-chip location or working in concert with other compromised systems to launch other attacks

Credit: Quick Honey

AN ISSUE OF TRUST

In the early days of integrated-circuit design, no one had to worry about hackers. The first designs were created completely in-house, executed by small teams who were working toward a common purpose. Because of this organizational security, the designers established open protocols that assumed different parts of the chip would behave as expected. (The history echoes the choices that were made in the early days of the Internet, when a small academic community built an open platform that assumed everyone would behave nicely. That assumption has not withstood the growth of the Internet.)

In today’s world, however, the design process for a single, large integrated circuit can involve contributions from hundreds or even thousands of people at locations on multiple continents. As this design goes through various stages of development, portions of the design are stored on many different physical platforms and repeatedly exchanged among many parties. For example, an American manufacturer might combine designs from separate branches of the company with designs from third-party vendors in the U.S., Europe and India, then fabricate the chip in a Chinese factory. These global networks have become a fact of life in recent years, and they have provided large savings in cost and ef!ciency. But they make security far more complicated than back in the days when things were done in one facility. Given the sheer number of people and complexity involved in a large integratedcircuit design, there is always a risk that an unauthorized outsider might gain access and corrupt the design without detection.

A very small—but not zero—risk also exists that a design could be corrupted by someone with internal access. While the overwhelming majority of people involved in any aspect of circuit design will endeavor to deliver designs of the highest quality, as with any security issue, malicious actions taken by even a very small minority of those with inside access acting maliciously can create significant problems.

Ideally, would-be attackers would never get the opportunity to gain access to an integrated circuit during the design and manufacturing process, thereby ensuring that hardware attacks never occur. This is the strategy that the Defense Advanced Research Projects Agency (DARPA), the research agency run by the Pentagon, has pursued with its Trust in Integrated Circuits program. DARPA is designing processes to ensure that all the steps in the design and manufacturing chain are carried out by companies and people known to be trustworthy and working in secure environments. (In addition, the agency is funding research into new ways to test chips before they are placed into U.S. weapons systems.) Yet in the real world, actions taken to secure the design process are never perfect.

Hardware designers should also build circuits that identify and respond to attacks even as they are taking place, like an onboard police force. Although a community should certainly engage in all reasonable measures to discourage potential criminals from committing crimes, any responsible community also recognizes that such efforts, no matter how well intentioned and thorough, will never be 100 percent effective. It is critical to have a police force that can respond quickly and appropriately when crimes do occur.

SECURING THE CIRCUIT

A circuit that can effectively detect and respond to attacks is called a secure circuit. These chips have a modest amount of extra circuitry specifically designed to look for behavior that may reveal a problem. If an attack is suspected, the secure circuit will identify the type of attack and attempt to minimize the resulting damage.

In the example of the frozen cell phone, the failure may have been caused by a single block that was acting out of order. That block interacts with all the other blocks over the system bus. This bus, in turn, has a bus arbiter—a traffic cop that decides what information can travel over the bus at what time. Yet the traffic cop analogy is not perfect. While a traffic cop can instruct traffic when to start and when to stop, a bus arbiter has less authority. It can grant permission for a block to start sending information through the bus, but the block can retain that access for as long as it wants—a vestige of the long-ago assumption that blocks would always behave properly. Herein lies the problem.

In a typical system, a block will retain access to the system bus for only as long as necessary before it relinquishes it for use by other blocks. The bus arbiter sees that the system bus is available and then assigns it to another block. But if a block keeps control of the bus indefinitely, no further data will be able move within the integrated circuit, and the system will freeze.

In contrast, a secure integrated circuit performs constant checks to ensure that the communications among different blocks have not been disrupted. When it detects one block monopolizing access to the bus, the secure integrated circuit can respond by quarantining the malicious block. It can then use its store of programmable logic hardware to replace the lost functionality. This process will likely slow the overall operation, but it will at least keep the device working.

An overt attack is probably not the most pernicious threat, however. A covert attack could be much worse. In a covert attack, the device appears to operate normally, but in reality it is acting with malicious intent. A mobile phone, for instance, might secretly begin to transmit a copy of all incoming and outgo ing text messages to a third party. An unsuspecting observer would not notice anything wrong, and the attack could continue indefinitely.

A secure integrated circuit would provide a critically important defense against this type of attack. The chip would constantly monitor the amount and type of data moving on and off the integrated circuit and statistically compare this movement with the expected data flows. Any anomaly would be flagged as a potential data leak, and the chip would either alert the user or begin to staunch the flow on its own.

In addition to taking steps to counter the effects of a Trojan attack on its own operations, an integrated circuit can notify other devices of the type of assault, potentially allowing them to take preemptive actions to avoid it (or at least to minimize its effects). Such notification is not as far-fetched as it might seem given the level of network connectivity that almost all systems now have. For example, if a circuit experiencing an attack can identify the initiating trigger, it can alert other circuits to screen for that particular message.

The measures described here will be effective only if the parts of the circuit responsible for managing security are themselves secure and trustworthy. This might seem like a circular argument—another way of saying that the only way to secure a circuit is to secure a circuit—but the elements of the circuit devoted to security constitute only a small fraction of the overall design. They can be designed in-house to ensure that only highly trusted parties have access.

HOW TO STOP HARDWARE HACKERS

A secure integrated circuit contains a modest amount of extra hardware that polices the chip from the inside. When hostile behavior is detected, a set of security measures can spring into place within microseconds to identify the source of the attack and react with countermeasures to surmount it. Here are a few strategies being developed.

Credit: Quick Honey

WHAT TO DO NEXT

Thanks to the efforts of governments, academic researchers and the commercial sector, enormous progress has been made in Internet security. The same cannot be said of the state of integrated-circuit security, which lies roughly where Internet security was 15 years ago: there is growing awareness that the issue is worthy of attention, but defensive strategies have not yet been fully developed, much less put into practice.

A comprehensive approach to preventing hardware attacks requires action on several levels. Strategies that aim to ensure compromised hardware never gets out the door, such as DARPA’s program, are a good start. But most important, we must begin to implement secure design measures such as the ones discussed here that can defend against attacks as they occur. These defenses will not come free. As with security in other domains, integrated-circuit security will require the expense of time, money and effort. A wide spectrum of options represents trade-offs between the effectiveness of the security and the cost of implementing it. Fortunately, it is possible to deliver effective security at modest costs.

A secure integrated circuit contains a small amount of extra logic. In research my group has conducted at the University of California, Los Angeles, we have found that the increase in integrated-circuit size is typically several percent. There is also generally a cost in operating speed, given that the steps taken to ensure that functional blocks are behaving appropriately can consume some clock cycles that might otherwise be used for core operational tasks. Again, however, we have found the speed reduction to be small in relative terms, and in some cases no speed reduction happens at all if the security measures are performed using logic and functional blocks that are temporarily dormant.

Keeping hardware secure will inevitably become an arms race requiring continual innovation to stay ahead of the latest attacks, as has been the case in the software world. Whereas new circuits cannot be downloaded over the Internet in the manner used to fix security holes identified in software, modern integrated circuits have a number of reconfigurable aspects that, with appropriate steps taken during the integrated-circuit design process, could be used to automatically replace parts of hardware that become incapacitated in the event of an attack. Engineered flexibility is our best defense.

Even if hardware attacks are inevitable, that does not mean that they have to be successful.

--Originally published: Scientific American 303, 82-87. (August 2010)

Hacking the Lights Out

by David M. Nicol

In 2010 word broke of a computer virus that had managed to slip into Iran’s highly secure nuclear enrichment facilities. Most viruses multiply without prejudice, but the Stuxnet virus had a specific target in its sights—one that is not connected to the Internet. Stuxnet was planted on a USB stick that was handed to an unsuspecting technician, who plugged it into a computer at a secure facility. Once inside, the virus spread silently for months, searching for a computer that was connected to a prosaic piece of machinery: a programmable logic controller, a special-purpose collection of microelectronics that commonly controls the cogs of industry—valves, gears, motors and switches. When Stuxnet identified its prey, it slipped in, unnoticed, and seized control.

The targeted controllers were attached to the centrifuges at the heart of Iran’s nuclear ambitions. Thousands of these centrifuges are needed to process uranium ore into the highly enriched uranium needed to create a nuclear weapon. Under normal operating conditions, the centrifuges spin so fast that their outer edges travel just below the speed of sound. Stuxnet bumped this speed up to nearly 1,000 miles per hour, past the point where the rotor would likely fly apart, according to a December report by the Institute for Science and International Security. At the same time, Stuxnet sent false signals to control systems indicating that everything was normal. Although the total extent of the damage to Iran’s nuclear program remains unclear, the report notes that Iran had to replace about 1,000 centrifuges at its Natanz enrichment facility in late 2009 or early 2010.

Stuxnet demonstrates the extent to which common industrial machines are vulnerable to the threat of electronic attack. The virus targeted and destroyed supposedly secure equipment while evading detection for months. It provides a dispiriting blueprint for how a rogue state or terrorist group might use similar technology against critical civilian infrastructure anywhere in the world.

Unfortunately, the electrical power grid is easier to break into than any nuclear enrichment facility. We may think of the grid as one gigantic circuit, but in truth the grid is made from thousands of components hundreds of miles apart acting in unerring coordination. The supply of power flowing into the grid must rise and fall in lockstep with demand. Generators must dole their energy out in precise coordination with the 60-cycle-per-second beat that the rest of the grid dances to. And while the failure of any single component will have limited repercussions to this vast circuit, a coordinated cyberattack on multiple points in the grid could damage equipment so extensively that our nation’s ability to generate and deliver power would be severely compromised for weeks—perhaps even months.

Considering the size and complexity of the grid, a coordinated attack would probably require significant time and effort to mount. Stuxnet was perhaps the most advanced computer virus ever seen, leading to speculation that it was the work of either the Israeli or U.S. intelligence agencies—or both. But Stuxnet’s code is now available on the Internet, raising the chance that a rogue group could customize it for an attack on a new target. A less technologically sophisticated group such as al Qaeda probably does not have the expertise to inflict significant damage to the grid at the moment, but black hat hackers for hire in China or the former Soviet Union might. It is beyond time we secured the country’s power supply.

THE BREAK-IN

In 2010 I took part in a test exercise that centered on a fictitious cyberattack on the grid. Participants included representatives from utility companies, U.S. government agencies and the military. (Military bases rely on power from the commercial grid, a fact that has not escaped the Pentagon’s notice.) In the test scenario, malicious agents hacked into a number of transmission substations, knocking out the specialized and expensive devices that ensure voltage stays constant as electricity flows across long high-power transmission lines. By the end of the exercise half a dozen devices had been destroyed, depriving power to an entire Western state for several weeks.

Computers control the grid’s mechanical devices at every level, from massive generators fed by fossil fuels or uranium all the way down to the transmission lines on your street. Most of these computers use common operating systems such as Windows and Linux, which makes them as vulnerable to malware as your desktop PC is. Attack code such as Stuxnet is successful for three main reasons: these operating systems implicitly trust running software to be legitimate; they often have flaws that admit penetration by a rogue program; and industrial settings often do not allow for the use of readily available defenses.

Even knowing all this, the average control system engineer would have once dismissed out of hand the possibility of remotely launched malware getting close to critical controllers, arguing that the system is not directly connected to the Internet. Then Stuxnet showed that control networks with no permanent connection to anything else are still vulnerable. Malware can piggyback on a USB stick that technicians plug into the control system, for example. When it comes to critical electronic circuits, even the smallest back door can let an enterprising burglar in.

Consider the case of a transmission substation, a waypoint on electricity’s journey from power plant to your home. Substations take in high-voltage electricity coming from one or more power plants, reduce the voltage and split the power into multiple output lines for local distribution. A circuit breaker guards each of these lines, standing ready to cut power in case of a fault. When one output line’s breaker trips, all of the power it would have carried flows to the remaining lines. It is not hard to see that if all the lines are carrying power close to their capacity, then a cyberattack that trips out half of the output lines and keeps the remaining ones in the circuit may overload them.

These circuit breakers have historically been controlled by devices connected to telephone modems so that technicians can dial in. It is not di!cult to find those numbers; hackers invented programs 30 years ago to dial up all phone numbers within an exchange and make note of the ones to which modems respond. Modems in substations often have a unique message in their dial-up response that reveals their function. Coupled with weak means of authentication (such as well-known passwords or no passwords at all), an attacker can use these modems to break into a substation’s network. From there it may be possible to change device configurations so that a danger condition that would otherwise open a circuit breaker to protect equipment gets ignored.

New systems are not necessarily more secure than modems. Increasingly, new devices deployed in substations may communicate with one another via low-powered radio, which does not stop at the boundaries of the substation. An attacker can reach the network simply by hiding in nearby bushes with his computer. Encrypted Wi-Fi networks are more secure, but a sophisticated attacker can still crack their encryption using readily available software tools. From here he can execute a man-in-the-middle attack that causes all communication between two legitimate devices to pass through his computer or fool other devices into accepting his computer as legitimate. He can craft malicious control messages that hijack the circuit breakers—tripping a carefully chosen few to overload the other lines perhaps or making sure they do not trip in an emergency.

Once an intruder or malware sneaks in through the back door, its first step is usually to spread as widely as possible. Stuxnet again illustrates some of the well-known strategies. It proliferated by using an operating system mechanism called autoexec. Windows computers read and execute the file named AUTOEXEC.BAT every time a new user logs in. Typically the program locates printer drivers, runs a virus scan or performs other basic functions. Yet Windows assumes that any program with the right name is trusted code. Hackers thus find ways to alter the AUTOEXEC.BAT file so that it runs the attackers’ code.

Attackers can also use clever methods that exploit the economics of the power industry. Because of deregulation, competing utilities share responsibility for grid operation. Power is generated, transmitted and distributed under contracts obtained in online auctions. These markets operate at multiple timescales—one market might trade energy for immediate delivery and another for tomorrow’s needs. A utility’s business unit must have a constant flow of real-time information from its operations unit to make smart trades. (And vice versa: operations need to know how much power they need to produce to fulfill the business unit’s orders.) Here the vulnerability lies. An enterprising hacker might break into the business network, ferret out user names and passwords, and use these stolen identities to access the operations network.

Other attacks might spread by exploiting the small programs called scripts that come embedded in files. These scripts are ubiquitous—PDF files routinely contain scripts that aid in file display, for example—but they are also a potential danger. One computer security company recently estimated that more than 60 percent of all targeted attacks use scripts buried in PDF files. Simply reading a corrupted file may admit an attacker onto your computer.

Consider the hypothetical case where a would-be grid attacker first penetrates the Web site of a software vendor and replaces an online manual with a malicious one that appears exactly like the first. The cyberattacker then sends an engineer at the power plant a forged e-mail that tricks the engineer into fetching and opening the booby-trapped manual. Just by going online to download an updated software manual, the unwitting engineer opens his power plant’s gates to the Trojan horse. Once inside, the attack begins.

SEARCH AND DESTROY

An intruder on a control network can issue commands with potentially devastating results. In 2007 the Department of Homeland Security staged a cyberattack code-named Aurora at the Idaho National Laboratory. During the exercise, a researcher posing as a malicious hacker burrowed his way into a network connected to a medium-size power generator. Like all generators, it creates alternating current operating at almost exactly 60 cycles per second. In every cycle, the flow of electrons starts out moving in one direction, reverses course, and then returns to its original state. The generator has to be moving electrons in exactly the same direction at exactly the same time as the rest of the grid.

During the Aurora attack, our hacker issued a rapid succession of on/off commands to the circuit breakers of a test generator at the laboratory. This pushed it out of sync with the power grid’s own oscillations. The grid pulled one way, the generator another. In effect, the generator’s mechanical inertia fought the grid’s electrical inertia. The generator lost. Declassified video shows the hulking steel machine shuddering as though a train hit the building. Seconds later steam and smoke fill the room.

Industrial systems can also fail when they are pushed beyond their limits—when centrifuges spin too fast, they disintegrate. Similarly, an attacker could make an electric generator produce a surge of power that exceeds the limit of what the transmission lines can carry. Excess power would then have to escape as heat. Enough excess over a long enough period causes the line to sag and eventually to melt. If the sagging line comes into contact with anything—a tree, a billboard, a house—it could create a massive short circuit.

Protection relays typically prevent these shorts, but a cyberattack could interfere with the working of the relays, which means damage would be done. Furthermore, a cyberattack could also alter the information going to the control station, keeping operators from knowing that anything is amiss. We have all seen the movies where crooks send a false video feed to a guard.

Control stations are also vulnerable to attack. These are command and control rooms with huge displays, like the war room in Dr. Strangelove. Control station operators use the displays to monitor data gathered from the substations, then issue commands to change substation control settings. Often these stations are responsible for monitoring hundreds of substations spread over a good part of a state.

Data communications between the control station and substations use specialized protocols that themselves may have vulnerabilities. If an intruder succeeds in launching a man-in-the-middle attack, that individual can insert a message into an exchange (or corrupt an existing message) that causes one or both of the computers at either end to fail. An attacker can also try just injecting a properly formatted message that is out of context—a digital non sequitur that crashes the machine.

Attackers could also simply attempt to delay messages traveling between control stations and the substations. Ordinarily the lag time between a substation’s measurement of electricity flow and the control station’s use of the data to adjust flows is small—otherwise it would be like driving a car and seeing only where you were 10 seconds ago. (This kind of lack of situational awareness was a contributor to the Northeast Blackout of 2003.)

Many of these attacks do not require fancy software such as Stuxnet but merely the standard hacker’s tool kit. For instance, hackers frequently take command over networks of thousands or even millions of ordinary PCs (a botnet), which they then instruct to do their bidding. The simplest type of botnet attack is to flood an ordinary Web site with bogus messages, blocking or slowing the ordinary flow of information. These “denial of service” attacks could also be used to slow traffic moving between the control station and substations.

Botnets could also take root in the substation computers themselves. At one point in 2009 the Conficker botnet had insinuated itself into 10 million computers; the individuals, as yet unknown, who control it could have ordered it to erase the hard drives of every computer in the network, on command. A botnet such as Conficker could establish itself within substations and then have its controller direct them simultaneously to do anything at any time. According to a 2004 study by researchers at Pennsylvania State University and the National Renewable Energy Laboratory in Golden, Colo., an attack that incapacitated a carefully chosen minority of all transmission substations—about 2 percent, or 200 in total—would bring down 60 percent of the grid. Losing 8 percent would trigger a nationwide blackout.

Holes in the Grid

The modern electrical grid involves an intricate balance between the amount of energy needed by society and the amount generated at power plants. Dozens of components orchestrate the flow of electrons over distances of hundreds of miles, aligning the alternating currents and making sure no single component gets stretched beyond its limits. Any one of these parts might suffer from the attention of malicious actors. Here are some of the most troublesome choke points and the ways they might be compromised.

Credit: George Retseck

WHAT TO DO

When Microsoft learns of a potential security liability in its Windows software, it typically releases a software patch. Individual users and IT departments the world over download the patch, update their software and protect themselves from the threat. Unfortunately, things are not that simple on the grid.

Whereas the power grid uses the same type of off-the-shelf hardware and software as the rest of the world, IT managers at power stations cannot simply patch the faulty software when bugs crop up. Grid control systems cannot come down for three hours every week for maintenance; they have to run continuously. Grid operators also have a deep-rooted institutional conservatism. Control networks have been in place for a long time, and operators are familiar and comfortable with how they work. They tend to avoid anything that threatens availability or might interfere with ordinary operations.

In the face of a clear and present danger, the North American Electric Reliability Corporation (NERC), an umbrella body of grid operators, has devised a set of standards designed to protect critical infrastructure. Utilities are now required to identify their critical assets and demonstrate to NERC-appointed auditors that they can protect them from unauthorized access.

Yet security audits, like financial audits, cannot possibly be exhaustive. When an audit does go into technical details, it does so only selectively. Compliance is in the eye of the auditor.

The most common protection strategy is to employ an electronic security perimeter, a kind of cybersecurity Maginot line. The first line of defense is a firewall, a device through which all electronic messages pass. Each message has a header indicating where it came from, where it is going, and what protocol is used to interpret the message. Based on this information, the firewall allows some messages through and stops others. An auditor’s job is partly to make sure the firewalls in a utility are configured properly so that they do not let any unwanted traffic in or out. Typically the auditors would identify a few critical assets, get a hold of the firewall configuration files, and attempt to sort through by hand the ways in which a hacker might be able to break through the firewall.

Firewalls, though, are so complex that it is difficult for an auditor to parse all the myriad possibilities. Automated software tools might help. Our team at the University of Illinois at Urbana-Champaign has developed the Network Access Policy Tool, which is just now being used by utilities and assessment teams. The software needs only a utility’s firewall configuration files—it does not even have to connect to the network. Already it has found a number of unknown or long-forgotten pathways that attackers might have exploited.

The DOE has come out with a roadmap that lays out a strategy for enhancing grid security by 2015. (A revision due this year extends this deadline to 2020.) One focus: creating a system that recognizes an intrusion attempt and reacts to it automatically. That would block a Stuxnet-like virus as soon as it jumped from the USB stick. But how can an operating system know which programs are to be trusted?

One solution is to use a one-way hash function, a cryptographic technique. A hash function takes a fantastically huge number—for example, all the millions of 1s and 0s of a computer program, expressed as a number—and converts it to a much smaller number, which acts as a signature. Because programs are so large, it is highly unlikely that two different ones would result in the same signature value. Imagine that every program that wants to run on a system must first go through the hash function. Its signature then gets checked against a master list; if it does not check out, the attack stops there.

The DOE also recommends other security measures, such as physical security checks at operator workstations (think radio chips in identification badges). It also highlights the need to exert tighter control over communication between devices inside the network. The 2007 Aurora demonstration involved a rogue device tricking a generator’s network into believing it was sending authoritative commands. These commands eventually led to the destruction of the generator.

These worthwhile steps will require time and money and effort. If we are going to achieve the DOE roadmap to a more secure grid in the next decade, we are going to have to pick up the pace. Let us hope we have even that much time.

--Originally published: Scientific American 305(1), 70-75. (July 2011).

The Attack of Code Red

by Carolyn P. Meinel

Imagine a cold that kills. It spreads rapidly and indiscriminately through droplets in the air, and you think you’re absolutely healthy until you begin to sneeze. Your only protection is complete, impossible isolation.”

Jane Jorgensen, principal scientist at Information Extraction & Transport in Arlington, Va., which researches Internet epidemiology for the Defense Advanced Research Projects Agency, isn’t describing the latest flu outbreak but an affliction that affects the Web. One such computer disease emerged in July and August of 2001, and it had computer security researchers more worried about the integrity of the Internet than ever before. The consternation was caused by Code Red, a Web worm, an electronic ailment akin to computerized snakebite. Code Red infects Microsoft Internet Information Servers (IIS). Whereas home computers typically use other systems, many of the most popular Web sites run on IIS. In two lightning-fast strikes, Code Red managed to infiltrate hundreds of thousands of IIS servers in only a few hours, slowing the Internet’s operations. Although Code Red’s effects have waned, patching the security holes in the estimated six million Microsoft IIS Web servers worldwide and repairing the damage inflicted by the worm have cost billions of dollars.

What really disturbs system administrators and other experts, however, is the idea that Code Red may be a harbinger of more virulent Internet plagues. In the past, Web defacements were perpetrated by people breaking into sites individually—the cyberwarfare equivalent of dropping propaganda leaflets on targets. But computer researchers dread the arrival of better-designed automated attack worms that could degrade or even demolish the World Wide Web.

Further, some researchers worry that Code Red was merely a test of the type of computer programs that any government could use to crash the Internet in times of war. This past spring’s online skirmishes over the U.S. spy plane incident with China emphasize the dangers. Full-scale cyberwarfare could cause untold damage to the industrialized world. These secret assaults could even enlist your PC as a pawn, making it a “zombie” that participates in the next round of computerized carnage.

Save for the scales on which these computer assaults are waged, individual hacking and governmental cyberwarfare are essentially two sides of the same electronically disruptive coin. Unfortunately, it’s hard to tell the difference between them until it’s too late.

Often popularly lumped in with viruses, Code Red and some similar pests such as Melissa and SirCam are more accurately called worms in the hacker lexicon. Mimicking the actions of its biological namesake, a software virus must incorporate itself into another program to run and replicate. A computer worm differs in that it is a self-replicating, self-contained program. Worms frequently are far more infectious than viruses. The Code Red worm is especially dangerous because it conducted what are called distributed denial of service (DDoS) attacks, which overwhelm Internet computers with a deluge of junk communications.

During its July peak, Code Red menaced the Web by consuming its bandwidth, or data-transmission capacity. “In cyberwarfare, bandwidth is a weapon,” says Greggory Peck, a senior security engineer for FC Business Systems in Springfield, Va., which works to defend U.S. government clients against computer crime. In a DDoS attack, a control computer commands many zombies to throw garbage traffic at a victim in an attempt to use up all available bandwidth. This kind of assault first made the news in 2000 when DDoS attacks laid low Yahoo, eBay and other dot-coms.

These earlier DDoS incidents mustered just hundreds to, at most, thousands of zombies. That’s because attackers had to break into each prospective zombie by hand. Code Red, being a worm, spreads automatically—and exponentially. This feature provides it with hundreds of times more zombies and hence hundreds of times more power to saturate all available Internet bandwidth rapidly.

The initial outbreak of Code Red contagion was not much more than a case of the sniffles. In the five days after it appeared on July 12, it reached only about 20,000 out of the estimated half a million susceptible IIS computer servers. It wasn’t until five days afterward that Ryan Permeh and Marc Maiffret of eEye Digital Security in Aliso Viejo, Calif., a supplier of security software for Microsoft servers, discovered the worm and alerted the world to its existence.

On July 19 the worm reemerged in a more venomous form. “More than 359,000 servers were infected with the Code Red worm in less than 14 hours,” says David Moore, senior technical manager at the Cooperative Association for Internet Data Analysis in La Jolla, Calif., a government- and industry-supported organization that surveys and maps the Net’s server population. The traffic jam generated by so many computers attempting to co-opt other machines began to overload the capacity of the Internet. By midafternoon, the Internet Storm Center at incidents.org—the computer security industry’s watchdog for Internet health—was reporting “orange alert” status. This is one step below its most dire condition, red alert, which signals a breakdown.

Then, at midnight, all Code Red zombies quit searching for new victims. Instead they all focused on flooding one of the servers that hosts the White House Web site with junk connections, threatening its shutdown. “The White House essentially turned off one of its two DNS servers, saying that any requests to whitehouse. gov should be rerouted to the other server,” says Jimmy Kuo, a Network Associates McAfee fellow who assisted the White House in finding a solution. Basically, the system administrators dumped all communications addressed to the compromised server. As it turned out, Code Red couldn’t cope with the altered Internet protocol address and waged war on the inactive site. “The public didn’t notice anything, because any requests went to the other server,” Kuo says.

By the close of July 20, all existing Code Red zombies went into a preprogrammed eternal sleep. As the worms lodge only in each computer’s RAM memory, which is purged when the machine shuts down, all it took was a reboot to eradicate their remnants. Case closed.

Or was it? A few days later analysts at eEye revealed that if someone were to release a new copy of Code Red at any time between the first through the 19th day of any month (the trigger dates coded in by the original hacker), the infection would take off again.

Over the next 10 days computer security volunteers worked to notify Microsoft IIS users of the vulnerability of their servers. On July 29 the White House held a press conference to implore people to protect their IIS servers against Code Red’s attacks. “The mass traffic associated with this worm’s propagation could degrade the functioning of the Internet,” warned Ronald L. Dick, director of the FBI’s National Infrastructure Protection Center. By the next day Code Red was all over the news.

The second coming of Code Red was, as expected, weaker than the first. On August 1, it infected approximately 175,000 servers—nearly all those susceptible and about half the total of the previous episode. A slower infection rate and fewer vulnerable servers held Internet disruptions to a minimum. After a while, the second attack subsided.

But that was not the end. Yet another worm was unleashed on August 4 using the same break-in method as Code Red. The new worm, dubbed Code Red II, installed a backdoor allowing a master hacker to direct the activities of victim computers at will. The worm degraded intranets with “arp storms” (floods of Ethernet packets) and hunted for new victims. In short order, Code Red II disabled parts of the Web-based e-mail provider Hotmail, several cable and digital subscriberline (DSL) Internet providers and part of the Associated Press news distribution system. As time passed, Code Red II managed to infect many corporate and college intranets. Halfway through August, Code Red II disabled some Hong Kong government internal servers. The most common victim computers were personal Web servers run by Windows 2000 Professional. This rash of disruptions prompted incidents. org to again declare an orange alert. Experts estimate that 500,000 internal servers were compromised.

In mid-August, Computer Economics, a security research company, said that Code Red had cost $2 billion in damage. By the time it is fully purged from the Internet, the computer attack will probably rank among the most expensive in history. Nearly $9 billion was spent to fight last year’s LoveLetter virus, and 1999’s Melissa worm assault cost $1 billion to repair.

Of course, Code Red isn’t the only worm out there. Some of them are aimed at home computers. A worm called W32/Leaves, for example, permits a remote attacker to control infected PCs in a coordinated fashion, enabling synchronized waves of attacks. (Although Code Red II allows this possibility as well, it lacks the coding that enables remote control.) The Computer Emergency Response Team, a federally funded watchdog organization at Carnegie Mellon University, has received reports of more than 23,000 W32/Leaves zombies. The current total is unknown, but as W32/Leaves continues to propagate, the infected population will probably grow significantly. In July 2001, Britain’s Scotland Yard charged an unidentified 24-year-old man with creating W32/Leaves.

“Almost any computer, operating system or software you may buy contains weaknesses that the manufacturer knows lets hackers break in,” says Larry Leibrock, a leading researcher in computer forensics and associate dean for technology of the business school of the University of Texas at Austin. Future “federal regulation could require that vendors take the initiative to contact customers and help them upgrade their products to fix security flaws,” he continues. “Today, however, it is up to each consumer to hunt down and fix the many ways hackers and cyberwarriors exploit to abuse their computers.”

World Cyberwars

Beyond the threat posed by malicious hacker programs is the danger of Internet attacks conducted in a concerted fashion by top computer talent spurred to act by international events. The cyberbattles that broke out over the collision of a Chinese fighter plane that collided with a U.S. Navy EP-3E spy plane in April of 2001 give a hint of how such a conflict might play out.

According to accounts in the press, the hacker exchanges began when negotiations for the release of American hostages stalled. On April 9 and 10, attackers defaced two Chinese Web sites with slurs, insults and even threats of nuclear war. During the following week, American hackers hit dozens more Chinese sites. Those supporting China responded by disfiguring one obscure U.S. Navy Web site.

China, however, held a weapon in reserve. In late March the National Infrastructure Protection Center had warned of a new worm on the loose: the 1i0n Worm. Lion, the hacker who founded the hacker group H.U.C. (Honkers Union of China), has taken credit for writing it. Unlike the initial Code Red’s preprogrammed zombies, 1i0n’s zombies accept new commands from a central computer. Also, 1i0n infects Linux computers, which means it can masquerade as any computer on the Net. This property makes it hard to track down infected servers.

Meanwhile pro-U.S. hack attacks escalated. The official Chinese publication, People’s Daily, reported that “by the end of April over 600 Chinese Web sites had come under fire.” In contrast, Chinese hackers had hit only three U.S. sites during the same period.

In the next few days the Chinese hacker groups H.U.C., Redcrack, China Net Force, China Tianyu and Redhackers assaulted a dozen American Web sites with slogans such as “Attack anti-Chinese arrogance!” On the first of May several DDoS strikes were initiated. Over the next week Chinese hackers took credit for wrecking about 1,000 additional American Web sites.

On May 7 China acknowledged its responsibility for the DDoS attacks and called for peace in a People’s Daily news story. It ran: “The Chinese hackers were also urged to call off all irrational actions and turn their enthusiasm into strength to build up the country and safeguard world peace.”

U.S. law-enforcement agencies, the White House and U.S. hacker organizations never objected to the American side of this cyberconflict, although the FBI’s infrastructure center had warned of “the potential for increased hacker activity directed at U.S. systems.”

How to Wage Covert Cyberwarfare

In view of the spy-plane episode, some commentators have wondered whether the U.S. federal government encouraged American hackers to become agents of cyberwar. After all, the U.S. has worked with private groups to wage covert warfare before, as in the Iran/Contra scandal. And links between the two communities have been reported. It’s difficult, however, to say exactly how strong the connection between hackers and the government might be. Clearly, the murky world of hacking doesn’t often lend itself to certainty. And because it is the policy of the U.S. National Security Agency and various Defense Department cyberwarfare organizations not to comment on Web security matters, these relationships cannot be confirmed. Still, the indications are at least suggestive.

Consider the history of Fred Villella, now an independent computer consultant. According to numerous press reports and his own statements, Villella took part in counterterrorism activities in the 1970s. In 1996 he hired hackers of the Dis Org Crew to help him conduct training sessions on the hacker threat for federal agencies. This gang also helps to staff the world’s largest annual hacker convention, Def Con.

Erik Ginorio (known to the hacker world as Bronc Buster) publicly took credit for defacing a Chinese government Web site on human rights in October 1998. This act is illegal under U.S. law. Not only was Ginorio not prosecuted, he says Villella offered him a job. Villella could not be reached for comment.

In another hacker-government connection, Secure Computing in San Jose, Calif., became a sponsor of Def Con in 1996. According to its 10-K reports to the U.S. Securities and Exchange Commission, Secure Computing was created at the direction of the National Security Agency, the supersecret code-breaking and surveillance arm of the U.S. government. Two years after that, Secure Computing hired the owner of Def Con, Jeff Moss. Several former Villella instructors also staffed and managed Def Con.

Questionable things happen at Def Cons. At the 1999 Def Con, for example, the Cult of the Dead Cow, a hacker gang headquartered in Lubbock, Tex., put on a mediagenic show to promote its Back Orifice 2000 break-in program. Gang members extolled the benefits of “hacking to change the world,” claiming that eight-year-olds could use this program to break into Windows servers.

Meanwhile Pieter Zatko, a Boston-area hacker-entrepreneur and a member of the gang, was onstage promoting a software plug-in for sale that increased the power of Back Orifice 2000. According to the Cult’s Web site, Back Orifice 2000 was downloaded 128,776 times in the following weeks. On February 15, 2000, President Bill Clinton honored Zatko for his efforts by inviting him to the White House Meeting on Internet Security. Afterward Zatko remained with a small group to chat with the president.

Every year Def Con holds a “Meet the Feds” panel. At its 2000 meeting, Arthur L. Money, former U.S. assistant secretary of defense for command, control, communications and intelligence, told the crowd, “If you are extremely talented and you are wondering what you’d like to do with the rest of your life—join us and help us educate our people [government personnel].”

In 1997 Moss launched the Black Hat Briefings. In hacker lingo, a black hat is a computer criminal. Theoretically, these meetings are intended to train people in computer security. They bear considerable similarity to Def Con, however, only with a $1,000 price tag per attendee. Their talks often appear to be more tutorials in how to commit crime than defend against it. For example, at one session attendees learned about “Evidence-Eliminator,” billed as being able to “defeat the exact same forensic software as used by the U.S. Secret Service, Customs Department and Los Angeles Police Department.”

It should be noted that the U.S. government does have a formal means to wage cyberwar. On October 1, 2000, the U.S. Space Command took charge of the Computer Network Attack mission for the Department of Defense. In addition, the U.S. Air Force runs its Information Warfare Center research group, located in San Antonio.

What Can Be Done to Defend the Web?

As Pogo the comic-strip character said, “We have met the enemy and he is us.” One of the weakest links in protecting the Internet is the home PC user. Cybernetic worms—self-replicating hacker software that can wreak havoc on Internet operations—can turn personal computers into “zombies,” or slave agents that help to destroy other computer operations. Of particular concern are worms that can conduct effectively targeted distributed denial of service (DDoS) attacks, in which zombie computers deluge a Web site with useless communications.

Computer professionals are being asked to get the word out to home users to check for zombies. “That’s because our worst Internet nightmare is the grandma who uses her DSL [high-bandwidth-capacity digital subscriber line that is always connected] to shop on eBay,” says Greggory Peck of FC Business Systems, which provides computer services to the federal government. High bandwidth means that a home zombie can pump lots of junk into the Internet, swamping targeted Web sites.

You may think your home computer is safe from assault because it runs automatic virus updates or because you registered your software and receive vendor e-mails about product upgrades. Guess again. Few vendors feel obligated to help users keep hackers out. That’s why it’s important for home users to install firewalls.

Complicating the safety issue, most new PCs will soon be running the Windows XP operating system, which enables “raw sockets.” Sockets are software constructions that generate the packets (the smallest data-transmission units) that transfer information across networks. With raw sockets technology, packets can be crafted in an arbitrary manner even if that violates safeguarding protocols. Raw sockets, for example, enabled the 1i0n worm to hide on Linux servers by forging Internet addresses. They also allow hackers to create malformed packets that will crash a receiving computer.

Beyond the home PC, another approach to defending the Web is to arrest more computer criminals. Nowadays, though, dangerous attackers may operate through a chain of compromised computers, with one or more being located across national borders. To obtain evidence in these cases requires cooperation among the law-enforcement agencies of two or more countries.

International pursuit of computer criminals would be made easier by adoption of the “Convention on Cyber-crime” now under consideration by the 44 nations of the Council of Europe, which includes the U.S., Canada and Japan. Part of the treaty would also criminalize possession or creation of computer crime instructions or programs except for the authorized testing or protection of a computer system.

These restraints are controversial, though. At least 35 lobby groups, including the Electronic Frontier Foundation and the Global Internet Liberty Campaign, oppose the treaty because they believe it would restrict freedom of speech and invade personal privacy. It’s hard to find antidotes to viruses and worms if researchers cannot study copies of them on their computers.

Another solution is to require that Internet servers be secure. For example, the U.S. Federal Trade Commission proposed a regulation in July that requires financial service companies to guard their networks against “anticipated threats.” This is only a small step in the right direction.

—C.M.

Given these resources, why would the U.S. and China encourage cybermilitias? “It’s very simple. If you have an unofficial army, you can disclaim them at any time,” says Mark A. Ludwig, author of The Little Black Book of Computer Viruses and the upcoming The Little Black Book of Internet Viruses. “If your military guys are doing it and you are traced back, the egg’s on your face.”

Wherever it came from, the Code Red assault was just a taste of what a concerted cyberwar could become. “I think we can agree that it was not an attempt at cyberwar. The worm was far too noisy and easily detected to be much more than graffiti/ vandalism and a proof-of-concept,” says Harlan Carvey, an independent computer security consultant based in Virginia.

Stuart Staniford, president of Silicon Defense in Eureka, Calif., notes, however, that if the zombie computers “had a long target list and a control mechanism to allow dynamic retargeting, [they] could have DDoSed [servers] used to map addresses to contact information, the ones used to distribute patches, the ones belonging to companies that analyze worms or distribute incident response information. Code Red illustrates that it’s not much harder for a worm to get all the vulnerable systems than it is to get some of them. It just has to spread fast enough.”

Code Red already offers deadly leverage for nefarious operators, according to Marc Maiffret, who bills himself as “chief hacking officer” of eEye: “The way the [Code Red] worm is written, it could allow online vandals to build a list of infected systems and later take control of them.”

Get enough zombies attacking enough targets, and the entire Internet could become unusable. Even the normal mechanisms for repairing it—downloads of instructions and programs to fix zombies and the ability to shut off rogue network elements—could become unworkable. In addition, hackers constantly publicize new ways to break into computers that could be used by new worms. A determined attacker could throw one devastating worm after another into the Internet, hitting the system every time it struggled back and eventually overpowering it.

“We know how [crashing the Internet] can be done right,” says Richard E. Smith, a researcher with Secure Computing and author of the newly published book Authentication. “What I’ve found particularly disquieting is how little public fuss there’s been [about Code Red]. The general press has spun the story as being an unsuccessful attack on the White House as opposed to being a successful attack on several hundred thousand servers: ‘Ha, ha, we dodged the bullet!’ A cynic might say this demonstrates how ‘intrusion tolerant’ IIS is—the sites are all penetrated but aren’t disrupted enough to upset the owners or generate much press comment. The rest of us are waiting for the other shoe to drop.”

--Originally published: Scientific American 285, 42-51. (October 2001).

How Hackers Break In...and How They Are Caught

by Carolyn P. Meinel

Editors’ note: This fictionalized account is a composite of many incidents that have occurred, at one time or another, somewhere in cyberspace. The names of people and other details have been changed, but the technologies and software do exist. Some of the events reported here are drawn from the firsthand experiences of the author, who is known both in the computer underground and among security experts for her hacking skills and for her countless battles against hackers. Scientific American thanks Rt66 Internet, an Internet service provider in Albuquerque, N.M., which tested much of the software and hardware described in this article to verify the technologies involved.

Sitting at his home computer one night, Abednego logs on to the Internet Relay Chat, the cyberspace equivalent of CB radio. After connecting to a channel devoted to the powerful Unix operating system, he watches as the on-line habitués meet to make contacts, build alliances and exchange knowledge. The scene is reminiscent of the cantina in Star Wars.

Eager to interject himself into the conversation—and to impress others—Abednego waits for someone to ask a simple- minded question so that he can incite a “flame war,” in which the participants begin hurling venomous insults at one another. Just then, someone with the handle “Dogberry” asks about writing a device driver for a home weather station. Abednego seizes his chance. “RTFM” is his response. It stands for “read the f——g manual.”

Others begin launching nasty insults, but not at Dogberry. Apparently, the question was far more complex than Abednego had realized. Dogberry’s terse put-down—“Newbie!”— fans the flames. Humiliated, Abednego vows revenge.

Using the “finger” command on Internet Relay Chat, Abednego obtains the e-mail address “Dogberry@refrigerus. com.” Abednego figures that if Dogberry is such a Unix whiz, he might be manager of the computers at refrigerus.com. To confirm his hunch, Abednego uses “telnet” to connect to the mail server of that computer. He then issues the command “expn root@refrigerus.com” and learns that Dogberry is indeed the head system administrator there.

His interest sufficiently piqued, Abednego runs Strobe, a program that attempts to connect with each of the thousands of virtual ports on refrigerus.com. The scanner will meticulously record responses from any daemons, which are automatic utility programs, such as those that handle email. Abednego knows that each port might be an open door—or a door that he might be able to break down—if he can take advantage of some flaw in its daemon.

But Strobe hits a wall—Dogberry’s firewall, to be exact. That powerful defensive software intercepts each incoming packet of data, reads its TCP/IP (transmission control protocol/ Internet Protocol) header and determines with which port it seeks to connect. The firewall compares this request with its own strict rules of access. In this case, refrigerus. com has decreed that there should be only one response to Abednego’s scanner.

From that instant on, a program on refrigerus.com sends a blitzkrieg of meaningless data, including random alphanumeric characters, back to Abednego, overwhelming his home PC. Meanwhile another daemon sends e-mail to Abednego’s Internet service provider (ISP), complaining that someone is attempting to break into refrigerus.com. Within minutes, the ISP closes Abednego’s account for suspicion of computer crime.

Although Abednego is caught off guard—many ISPs would not have taken such a strong measure so quickly—the setback is minor. The closed account was only one of several he had created after breaking into that ISP. But the termination of the account at that particular moment causes him to be dumped from Internet Relay Chat in the midst of the flames against him. To the others on-line, it looks as if Abednego has been unceremoniously booted or, worse, that he has fled for cover.

Abednego burns for retaliation. His next step is to try a stealth port scanner. Such programs exploit the way in which IP transmissions work. When one computer wishes to talk to another, it must first transmit a short message packet containing a SYN (synchronize) flag. The header of the packet also contains other important information, such as the IP address of both the source and destination. In response, the recipient daemon sends back a packet that contains an ACK (to acknowledge the received packet), a SYN and a sequence number that is used to coordinate the upcoming transmission. When the first computer gets the return ACK/SYN, it issues an ACK of its own to confirm that all is ready, thus completing a three-way handshake. Then, and only then, can the sender computer begin transmitting its message using the sequence number provided. At the end of the communication, the sender transmits a packet with a FIN (finish) flag, and the receiver returns an ACK to signal that it is aware the transmission has ended.

Abednego knows that a stealth port scanner can take advantage of this process by sending just premature FIN packets to each port on a computer. Typically if a port is open, the recipient daemon will not send any response. If a port is closed, however, the computer will return an RST (reset) packet. But because this computer does not truly recognize a connection until it has completed the opening three-way handshake, it does not record the transmission in its logs. Thus, a FIN scanner can probe a computer in relative secrecy, without ever having opened any official connections. (Yet, as Abednego will soon learn, there is enough information in even one FIN packet to establish a sender’s identity.)

Abednego surfs the Internet to search for an advanced stealth port scanner and finds one at an underground Web site. The program, like most other hacker tools, is written in the C computer language. Abednego struggles to compile, or convert, the scanner from C into a form that can be executed on his home PC, which runs on Linux, one of the many variants of Unix.

Abednego’s difficulty in converting the software is not unusual because of the many peculiarities of the different flavors of Unix. And Abednego, like many hackers, did not formally study computer science. In fact, also like most hackers, Abednego never learned to program because he never had to: almost any software a computer criminal might ever want is available on the Internet, already written and free for the taking—as long as the hacker knows how to compile it (or has cohorts who do).

The young Dogberry had taken a different path. After befriending a technician at a local ISP, he learned how to administer a network. Before long, Dogberry and the technician were playing computer break-in and defense games. The payoff came when they used the results to help the ISP improve its security. With that success, Dogberry was hired by the ISP to work part-time while he pursued his computer science degrees.

Thus, when Abednego decided to take on Dogberry, he had already made his first mistake. Dogberry is a white-hat (or nonmalicious) hacker and a veteran of many cyberbattles.

Casing the Joint

As dawn breaks, Abednego has finally finished compiling the code and is ready to deploy it. Within minutes, the FIN scanner has given him a snapshot of the services that refrigerus.com offers to those coming only from an approved IP address. Two that draw his attention are a secure-shell daemon, which is a way to make encrypted Internet connections, and a Web server.

Then Abednego’s heart skips a beat. An unusual port number, 31,659, has also turned up on his FIN scan. Could another intruder have preceded him and left a back door, a secret passage to enter the system undetected?

The beeping of a pager jolts Dogberry out of a deep sleep. EtherPeek, a sniffer program installed on the refrigerus.com network, has detected the port scan. Dogberry rushes into the office to watch for more attacks from the console of his administrative computer. His best defensive programs run only from that machine and only for someone who is physically there, so that they cannot be tampered with remotely by an attacker.

Meanwhile, despite the powerful temptation of that 31,659 daemon, Abednego leaves the chase for now. Something— his hacker intuition—tells him that he should return on another night. So by the time Dogberry arrives at work, he sees no more activity.

Curious about the unusual attack, though, Dogberry begins analyzing his computer logs and is able to retrieve the source address from the hacker’s FIN packets. With this information, he sends an e-mail to Abednego’s ISP, advising the firm of the break-in attempt and asking for details about Abednego’s account. But the system administrator at the ISP rejects Dogberry’s request, citing a confidentiality policy, because merely running a scanner breaks no law.

Three evenings later Abednego resumes the hunt. But when his computer dials into his account, he finds out his password is no longer good. Upset, he phones the ISP and learns that his account has been shut down because of the FIN scan. Yet this turn of events does little to discourage him. In fact, he is now even more determined.

With his credit-card number and a telephone call to a different ISP, he is back on-line within minutes. This time, though, Abednego is more cautious. Through this new account, he logs on to one of his hacked accounts at yet another ISP. Once there, he gives the simple command “whois refrigerus.com.” The response tells him the domain name belongs to Refrigerators R Us, a national retail chain.

Next, Abednego tries to log on to refrigerus.com through the 31,659 port by issuing the command “telnet refrigerus. com 31,659.” The response is, “You lamer! Did you really think this was a back door?!” Then the 31,659 daemon attempts to crash his PC by sending corrupt packets, while emailing the system administrator at Abednego’s hacked ISP that someone has attempted to commit a computer crime. Within minutes, Abednego’s connection dies.

More determined, Abednego now tries to tiptoe around the firewall instead of forcing his way through it. Using yet another of his many hacked accounts, he begins by attempting to catalogue the computers that belong to refrigerus. com. To obtain this information, he tries “nslookup,” which initiates a search throughout the Internet for master databases containing directories of IP addresses.

But “nslookup” is unable to retrieve anything useful. Dogberry must have set up the refrigerus.com network so that all packets destined for any of its internal addresses are sent first to a name-server program, which then directs them to the appropriate computers within the network. This process hinders anyone on the outside from learning details about the computers inside the firewall.

Abednego’s next attempt is through an IP address scanner. First, he converts refrigerus.com to a numerical address, using “nslookup.” With that number as a starting place, he scans the IP addresses above and below it. He discovers some 50 Internet host computers. Although there is no guarantee that these belong to refrigerus.com, Abednego knows it is a good bet they do.

Next, he uses “whois” to ask whether any other domain names are registered to Refrigerators R Us. The response reveals another: refrigeratorz.com, with an address that is numerically distant from that of refrigerus.com. The IP address scanner soon reveals five additional Internet hosts on numbers nearby refrigeratorz.com.

As a safety precaution, Abednego telnets from his current hacked account into another of his pirated accounts. He then telnets from that location to yet another account that he has hacked, remotely logging on to it in preparation to run more FIN port scans. The extra steps will force anyone in law enforcement to obtain search warrants for three companies, encumbering the process.

He also decides to hide on the third hacked computer under the protection of a root kit, a Trojan horse program that, despite its harmless appearance, will automatically delete any evidence of his actions from the logs used to detect abnormal activities. The software also defeats other programs that seek to detect alterations to system files on that computer. A root kit will even prevent people from determining that he is logged on and running programs.

From this safe perch, Abednego scans one after another of the Internet host computers at refrigerus.com and refrigeratorz. com. The FIN scanner slips straight through the firewall to every one of them. The activity, though, is detected by the EtherPeek sniffer, which again sets off Dogberry’s beeper.

A haggard Dogberry, after rushing to work, soon identifies the origin of the FIN scans and alerts the system administrator at Abednego’s third hacked account. But the root kit has done its job, hiding Abednego from mystified computer operators there. Abednego boldly continues, switching from the stealth scanner to Strobe in hopes of finding an IP address that the firewall does not protect.

He succeeds only in having the refrigerus.com firewall unleash a flood of meaningless data. The sudden load finally convinces the system administrator at Abednego’s hacked account that there really must be an attacker at work. She takes the drastic step of cutting the entire system off from the Internet. As his connection fizzles, Abednego realizes there is no elegant way around the firewall.

Finding a Workaholic

For each of the several dozen Internet hosts at Refrigerators R Us, Abednego guesses that there are probably many other desktop computers sitting quietly in employees’ cubicles and offices. What are the chances, he muses a few nights later, that somewhere among those hundreds of users are workaholics who circumvent the company firewall by phoning into their computers from their homes to perform late-night tasks? It’s simple, really, for someone to buy a modem, connect it to a computer at work and plug a phone line into it before leaving for the day.

Knowing that almost every large corporation has at least one unauthorized modem on its network, Abednego sets up ShokDial, a war-dialer program that will call each of the extensions to the phone system at Refrigerators R Us as well as other numbers within that exchange. At the headquarters building of the company, the night watchman hears the ringing of one office phone after another but thinks nothing of it.

Then, at 2:57 A.M., the war dialer pulls up a modem, and Abednego is greeted with the log-on screen of a Silicon Graphics computer: “Refrigerators R Us Marketing Department. Irix 6.3.” Great, Abednego thinks, because Irix is a type of Unix, which means he has found a potent portal into Dogberry’s world.

Abednego’s next strategy is to try brute force, using a program that will repeatedly dial the Irix box and guess passwords for root, a top-level account (usually reserved for system administrators) from which he can run any command and access all information on that particular computer. He is hoping that the owner of the Irix machine, like many harried workaholics, has negligently allowed remote access to a root account.

The password guesser starts with common words and names and from there tries less obvious choices. The slow, painstaking process can take months, even years, as the program exhausts every word in an unabridged dictionary, all names in an encyclopedia and each entry from a local phone book. But Abednego gets lucky. Around 5 A.M. he learns that the password is simply “nancy.”

“Yes!” Abednego shouts as he logs on to a root shell, from which he can then issue other commands to run on that machine. Next, he secures his beachhead, using FTP (file transfer protocol) to plant a root kit and sniffer onto his latest victim. He sets the program to capture and record everything typed in at the console (a process known as keystroke logging), as well as any log-on sessions from the network. The sniffer will hide this information in an innocuously named file right there on the unwitting host. Within minutes, Abednego’s root kit has even set up an additional way to log on: user name “revenge,” password “DiEd0gB.”

Abednego’s last deed that morning is simple. To find the Internet address of the hijacked box, he types the “who” command, and his computer shows user “revenge” logged on to picasso.refrigeratorz.com. Later that morning the rightful owner of picasso logs on and sees no indication that someone has usurped control of her computer. Abednego’s root kit is doing its job.

For Dogberry’s part, all that his log reveals is an early-morning attempt to enter refrigeratorz.com from the Internet. Remembering the recent FIN scans, Dogberry is troubled by this latest incident, but he has too little information to take action.

Two nights later Abednego dials in and connects with picasso to view his logs. To his dismay, he sees that information on the internal network traffic has been encrypted. But the keystroke logger of his sniffer has recorded that someone on picasso had logged on to another computer named fantasia. Abednego now owns a user name and password for fantasia. Open sesame!

Abednego discovers that the computer is a SPARC workstation used for rendering animated sequences, perhaps for television ads. Because the box is probably a server used by many other computers, Abednego begins hunting for a password file, hoping that some of the passwords he finds will also work on other machines inside the company network.

He locates the file but discovers only “x” characters where the encrypted passwords should have been. Apparently, the information he seeks is hidden elsewhere in a shadowed file. Smiling to himself, Abednego runs the FTP program and tricks it into crashing. Bingo, core dump!

Fantasia is forced to flush a part of its random-access memory (RAM). Fortunately for Abednego, the discarded information—a record of what was being held in that RAM sector at that moment—ends up in the user directory.

The legitimate purpose of a core dump is to enable programmers to perform an autopsy on the digital remains in search of clues to a program’s failure. But, as Abednego well knows, a core dump has other uses. A shadowed password system sometimes places encrypted passwords in RAM. When a person logs on, the computer does a one-way encryption of the password the user attempts and compares that with the encrypted password from the shadowed file. If the two match, the person gets in.

The shadowed password file that Abednego is able to retrieve from the core dump on fantasia is encrypted, so he starts running his password cracker. The program could be busy for the next few days, maybe even weeks.

Too impatient to wait, Abednego is already working on his next maneuver— exploiting a common vulnerability of Unix. When a program running on that operating system pours excessive data into a buffer (a temporary storage space in memory), the information will leak, infiltrating other areas of the computer’s memory.

Abednego takes advantage of the buffer overflow by using it to insinuate his own code into the SPARC. The added software helps him create a root shell, from which he can then run other commands and programs. Pleased with his latest effort, Abednego next installs a root kit and sniffer. Because the kit will hide evidence of his activities only from the time when the program was activated, Abednego must mop up by deleting previous actions of his busy night.

One task remains. Is there anyone who is allowed to log on to fantasia from the Internet? Abednego types the “last” command to display records of connections people may have made to fantasia. He perks up as he sees that user names vangogh and nancy have recently entered fantasia from the Internet through the domain “adagency.com,” which lies outside the Refrigerators R Us firewall.

Abednego can hardly fall asleep that morning. His adrenaline flowing, he buzzes with the knowledge that he will soon “own” Refrigerators R Us.

Closing in for the Kill

The next evening Abednego makes short work of breaking into adagency.com. At first he uses IP spoofing to trick that computer into recording a false IP address for his location. By probing adagency. com with SYN packets to elicit ACK/SYN responses with an assortment of sequence numbers, Abednego’s program is able to tease out a pattern from which he can then guess the next sequence numbers and use that knowledge to fake his origin. Abednego quickly installs a sniffer on adagency. com and uses a secure-shell program to create an encrypted connection for logging on to fantasia.

From that computer, he types the “netstat” command to view tables of active connections within the network. He discovers a computer that he had missed in his earlier search. Its name, “admin.refrigerus.com,” is promising. Could that be from where Dogberry oversees the system?

Meanwhile every time Abednego’s PC cracks yet another combination of user name and password, he tries it on various refrigerus.com computers. But none of them works anywhere except on fantasia, which he already “owns.”

Then Abednego hits the jackpot. Twice.

On fantasia he captures keystrokes made by vangogh as that user updated the company’s Web server. Now Abednego has the password he needs to hack the Refrigerators R Us Web site. In addition, his sniffer on picasso reveals that someone, Nancy, has dialed into that computer and from there used a back door to log on to a root account, hidden by her root kit, at admin.refrigerus.com.

He slips right behind Nancy into admin.refrigerus.com. Using the root account there, he tries logging on to one Refrigerators R Us computer after another. Dogberry, however, has been exceedingly careful. On the Refrigerators R Us network, even root privileges do not allow someone to enter other computers without providing new passwords.

Only briefly distracted, he turns his attention back to the Web server and logs on to it using his recently acquired password. From his home PC, he then uploads a new version of the Refrigerators R Us home page that he had put together in anticipation of this day.

Back at Refrigerators R Us, Dogberry is working late, poring over his logs. It seems the marketing people have been getting an unusual number of connections from adagency. com. Tomorrow he will ask those folks exactly what is going on. He will also call the system administrator at adagency. com, a colleague whom he once helped to install some new system software.

Just as Dogberry is about to head home for the night, the phone in his office rings. An angry customer complains that Refrigerators R Us’s Web site features a pornographic movie with a refrigerator as a prop. After bringing up and viewing the defaced Web page, Dogberry moves quickly to sever the umbilical Ethernet cable that connects the company network to the Internet.

Abednego is enraged when his obscene masterpiece is taken down so quickly. But he is also worried that he has left too much evidence behind, so he returns using the dial-up line to picasso—an entryway that is still unknown to Dogberry. He buys time by reformatting completely the administrative computer’s hard disk, which shuts down the company network, temporarily thwarting Dogberry’s efforts to gather details of the attack.

Dogberry rushes to the administrative computer with hopes to reboot it from the console, but he is too late. Dogberry must now rebuild the software on that computer from scratch. (Unbeknownst to Abednego, though, the EtherPeek sniffer running on a nearby Macintosh has also been making logs.)

Abednego, still peeved about the Web site, has one final act that night: he unleashes a flood of data packets against refrigerus.com. Soon Dogberry gets a frantic call from a company salesperson who, using her laptop PC and a phone line in her hotel room, wants to retrieve her important email but has been unable to connect to the mail server at Refrigerators R Us.

The next morning an exhausted Dogberry begs the vice president of technology at Refrigerators R Us for an okay to wipe clean every computer in the network, reinstall every program and change all passwords. But the extensive— though prudent—measure would require shutting the system down for days, and the vice president denies the request.

At this point, Abednego’s malicious and destructive exploits have gone well past the legal bounds for hacking. But the FBI, which is severely understaffed, has been busy investigating some recent break-ins at several army and navy computer systems around the U.S. Dogberry will have to gather more evidence himself.

Because the attacker remained on the system even after it had been physically disconnected from the Internet, Dogberry suspects there must be a contraband modem somewhere in the building. He runs his own war dialer and discovers the culprit. He will soon have words with the marketing department!

Dogberry then reloads a clean version of his main administrative computer. Next, on a Windows NT server that Dogberry knows has not been tampered with, he deploys Tsight, an advanced antihacker program that can monitor every machine on the company network.

Last, Dogberry sets his trap. T-sight will watch for the attacker’s next connection to admin.refrigerus.com and will redirect the intruder into a “jail” computer. Once there, the culprit can be monitored and traced. To keep the unsuspecting person distracted, Dogberry enlists a team of programmers to make the jail look like an accounting system, complete with the tempting bait of fake financial data.

Pride Goeth Before...

Just two nights later Dogberry is standing watch at 8:17 P.M. when he discovers someone once again entering admin. refrigerus.com. It is Abednego. Why has he returned so soon? Abednego was exhilarated when he learned that his pornographic Web site had become the talk of the hacker underground. He had even rated a brief mention on CNN. The publicity and his hubris were a potent combination, making Abednego feel invincible.

In fact, tonight he has brazenly reentered Refrigerators R Us without his customary caution. After dialing into a guest account on an ISP, he telnetted directly to adagency.com to gain faster access to fantasia’s back door.

From admin.refrigerus.com, Abednego is lured to the jail by T-sight. He can hardly control his excitement as he begins sifting through what he believes are sensitive financial records.

Dogberry, too, is busy. Quickly analyzing data from Tsight, he obtains Abednego’s root password on fantasia— DiEd0gB—and is able to trace the intruder back to adagency. com. Dogberry calls the pager of the system administrator there. She has already left work, but she phones Dogberry from a restaurant to help him continue tracking Abednego.

So while Abednego is retrieving a huge file containing bogus credit-card numbers, Dogberry installs a sniffer on adagency.com. He is even able to sneak unnoticed into Abednego’s account on that computer by typing DiEd0gB, because Abednego has lazily used the same password for all his root kits. Then, just minutes before Abednego finishes his download and logs off, Dogberry succeeds in tracking the trail of the plundered credit-card file back to Abednego’s dial-up account at the ISP.

The information Dogberry has obtained is enough to bring in the FBI, which contacts the ISP the next day to obtain Abednego’s identity from the company’s phone logs. With enough evidence in hand, including the Macintosh’s high-quality EtherPeek logs, the U.S. Attorney’s office approves a search warrant.

Soon after, FBI agents raid Abednego’s apartment and confiscate his PC. The hard disk of the computer will reveal all. Abednego had taken the precaution of erasing incriminating files from his PC after each night’s escapade. He is chagrined to learn that the FBI can extract that information from his hard drive even after it had been erased and overwritten several times. Soon a laboratory has recovered details of his past trespasses, including the time he romped through the computer system at a major banking institution in the Northeast.

The megabytes of incriminating data provide the smoking gun necessary to indict Abednego on multiple counts of computer fraud. Unfortunately for him, the trial judge assigned to his case is known for her tough stance on cybercrime. Taking his attorney’s advice, Abednego wisely accepts a plea bargain even though, like many hackers who have crossed the line, he insists that his activities—which, for Refrigerators R Us alone, resulted in thousands of dollars in damages—were just playful pranks. Abednego is currently serving a two-year sentence in a federal prison.

--Originally published: Scientific American 279(4), 98-105. (October 1998)

Attack of the Worms

by Michael Moyer

Computer users could be forgiven if they kept their machines off on April 1, 2009. When it first appeared in November 2008, the malicious software known as the Conficker worm had established itself as one of the most powerful threats the Internet had seen in years, infecting an estimated 10 million computers worldwide. The malware slipped into machines running the Windows operating system and waited quietly for April Fools’ Day (the timing did not go unnoticed), when it was scheduled to download and execute a new set of instructions. Although no one knew what was to come, the worm’s sophistication provided a stark example of how the global malware industry is evolving into a model of corporate efficiency. At the same time, it raised calls for security researchers to steal a trick from their black hat counterparts.

A worm takes advantage of security holes in ubiquitous software—in this case, Microsoft Windows—to spread copies of itself. Conficker, though, was a strikingly advanced piece of code, capable of neutering a computer’s antivirus software and receiving updates that would give it more complex abilities. Its sudden march across the Web reignited interest in one of the most controversial ideas in security protection: the release of a “good” worm. Such software would spread like a worm but help to secure the machines it infected. The approach had already been attempted once before. In late 2003 the Waledac worm burrowed into Windows machines by exploiting the same vulnerability as the then widespread Blaster worm. Yet unlike Blaster, which was programmed to launch an attack against a Microsoft Web site, Waledac updated the infected machines with security patches.

On the surface, Waledac appeared to be a success. Yet this worm, like every worm, spiked network traffic and clogged the Internet. It also rebooted machines without users’ consent. (A common criticism of automatic security updates—and a key reason why many people decide to turn them off—is that updating a security patch requires restarting the computer, sometimes at inopportune moments.) More important, no matter how noble the purpose, a worm is an unauthorized intrusion.

After Waledac, the discussion about good worms went away, at least in part because worms themselves went away. “Back in the early 2000s, there weren’t strong business models for distributed malware,” says Philip Porras, program director of the nonprofit security research firm SRI International. Hackers, he explains, “were using [worms] to make statements and to gain recognition.” Worms would rope computers together into botnets—giant collections of zombie computers—which could then attempt to shut down legitimate Web sites. Exciting (if you’re into that sort of thing), but not very profitable.

In the past five years malware has grown ever more explicitly financial. “Phishers” send out e-mails to trick people into revealing user names and passwords. Criminals have also begun uploading to legitimate store sites hard-to-detect surveillance code that covertly intercepts credit-card information. The stolen information then goes up for sale on the Internet’s black market. An individual’s user name and password to a banking site can fetch anywhere from $10 to $1,000; credit-card numbers, which are more ubiquitous, go for as little as six cents. The total value of the goods that appear on the black market in the course of a year now exceeds $7 billion, according to Internet security company Symantec.

The tightly managed criminal organizations behind such scams—often based in Russia and former Soviet republics—treat malware like a business. They buy advanced code on the Internet’s black market, customize it, then sell or rent the resulting botnet to the highest bidders. They extend the worm’s life span as long as possible by investing in updates—maintenance by another name. This assembly line–style approach to crime works: of all the viruses that Symantec has tracked over the past 20 years, 60 percent of them have been introduced in the past 12 months.

A week after the April 1 deadline, it became clear that the people responsible for Conficker had strong financial motivations. The worm downloaded a wellknown spam generator. In addition, computers infected with the worm also began to display a highly annoying “Windows Security Alert” pop-up warning every few minutes. The alerts claimed that the computer was infected with a virus, which was true enough. Yet these scareware warnings also promised that the only way to clean one’s machine was to download the $50 program advertised—credit-card payments only, please.

Ironically, routine updates could have prevented the worm’s spread in the first place. In fact, Conficker emerged a full four weeks after Microsoft released the “urgent” security patch that protected computers against it. Clearly, millions of machines were not being updated. And millions still probably are not properly immunized—a disturbing thought, considering that, even after its April actions, Conficker resumed waiting for further instructions.

--Originally published: Scientific American 300(6), 30. (June 2009).

SECTION 2

Nowhere To Hide

The End of Privacy?

by Daniel J. Solove

He has a name, but most people just know him as “the Star Wars Kid.” In fact, he is known around the world by tens of millions of people. Unfortunately, his notoriety is for one of the most embarrassing moments in his life.

In 2002, as a 15-year-old, the Star Wars Kid videotaped himself waving around a golf-ball retriever while pretending it was a lightsaber. Without the help of the expert choreographers working on the Star Wars movies, he stumbled around awkwardly in the video.

The video was found by some of the boy’s tormentors, who uploaded it to an Internet video site. It became an instant hit with a multitude of fans. All across the blogosphere, people started mocking the boy, making fun of him for being pudgy, awkward and nerdy.

Several remixed videos of the Star Wars Kid started popping up, adorned with special effects. People edited the video to make the golfball retriever glow like a lightsaber. They added Star Wars music to the video. Others mashed it up with other movies. Dozens of embellished versions were created. The Star Wars Kid appeared in a video game and on the television shows Family Guy and South Park. It is one thing to be teased by classmates in school, but imagine being ridiculed by masses the world over. The teenager dropped out of school and had to seek counseling. What happened to the Star Wars Kid can happen to anyone, and it can happen in an instant. Today collecting personal information has become second nature. More and more people have cell phone cameras, digital audio recorders, Web cameras and other recording technologies that readily capture details about their lives.

For the first time in history nearly anybody can disseminate information around the world. People do not need to be famous enough to be interviewed by the mainstream media. With the Internet, anybody can reach a global audience.

Technology has led to a generational divide. On one side are high school and college students whose lives virtually revolve around social-networking sites and blogs. On the other side are their parents, for whom recollection of the past often remains locked in fading memories or, at best, in books, photographs and videos. For the current generation, the past is preserved on the Internet, potentially forever. And this change raises the question of how much privacy people can expect—or even desire—in an age of ubiquitous networking.

Generation Google

The number of young people using social-networking Web sites such as Facebook and MySpace is staggering. At most college campuses, more than 90 percent of students maintain their own sites. I call the people growing up today “Generation Google.” For them, many fragments of personal information will reside on the Internet forever, accessible to this and future generations through a simple Google search.

That openness is both good and bad. People can now spread their ideas everywhere without reliance on publishers, broadcasters or other traditional gatekeepers. But that transformation also creates profound threats to privacy and reputations. The New York Times is not likely to care about the latest gossip at Dubuque Senior High School or Oregon State University. Bloggers and others communicating online may care a great deal. For them, stories and rumors about friends, enemies, family members, bosses, co-workers and others are all prime fodder for Internet postings.

Before the Internet, gossip would spread by word of mouth and remain within the boundaries of that social circle. Private details would be confined to diaries and kept locked in a desk drawer. Social networking spawned by the Internet allows communities worldwide to revert to the close-knit culture of preindustrial society, in which nearly every member of a tribe or a farming hamlet knew everything about the neighbors. Except that now the “villagers” span the globe.

College students have begun to share salacious details about their schoolmates. A Web site called JuicyCampus serves as an electronic bulletin board that allows students nationwide to post anonymously and without verification a sordid array of tidbits about sex, drugs and drunkenness. Another site, Don’t Date Him Girl, invites women to post complaints about the men they have dated, along with real names and actual photographs.

Social-networking sites and blogs are not the only threat to privacy. As several articles in Scientific American have already made clear, companies collect and use our personal information at every turn. Your credit-card company has a record of your purchases. If you shop online, merchants keep tabs on every item you have bought. Your Internet service provider has information about how you surf the Internet. Your cable company has data about which television shows you watch.

The government also compromises privacy by assembling vast databases that can be searched for suspicious patterns of behavior. The National Security Agency listens and examines the records of millions of telephone conversations. Other agencies analyze financial transactions. Thousands of government bodies at the federal and state level have records of personal information, chronicling births, marriages, employment, property ownership and more. The information is often stored in public records, making it readily accessible to anyone—and the trend toward more accessible personal data continues to grow as more records become electronic.

The Future of Reputation

Broad-based exposure of personal information diminishes the ability to protect reputation by shaping the image that is presented to others. Reputation plays an important role in society, and preserving private details of one’s life is essential to it. We look to people’s reputations to decide whether to make friends, go on a date, hire a new employee or undertake a prospective business deal.

Some would argue that the decline of privacy might allow people to be less inhibited and more honest. But when everybody’s transgressions are exposed, people may not judge one another less harshly. Having your personal information may fail to improve my judgment of you. It may, in fact, increase the likelihood that I will hastily condemn you. Moreover, the loss of privacy might inhibit freedom. Elevated visibility that comes with living in a transparent online world means you may never overcome past mistakes.

People want to have the option of “starting over,” of reinventing themselves throughout their lives. As American philosopher John Dewey once said, a person is not “something complete, perfect, [or] finished,” but is “something moving, changing, discrete, and above all initiating instead of final.” In the past, episodes of youthful experimentation and foolishness were eventually forgotten, giving us an opportunity to start anew, to change and to grow. But with so much information online, it is harder to make these moments forgettable. People must now live with the digital baggage of their pasts.

This openness means that the opportunities for members of Generation Google might be limited because of something they did years ago as wild teenagers. Their intimate secrets may be revealed by other people they know. Or they might become the unwitting victim of a false rumor. Like it or not, many people are beginning to get used to having a lot more of their personal information online.

What Is to Be Done?

Can we prevent a future in which so much information about people’s private lives circulates beyond their control? Some technologists and legal scholars flatly say no. Privacy, they maintain, is just not compatible with a world in which information flows so freely. As Scott McNealy of Sun Microsystems once famously declared: “You already have zero privacy. Get over it.” Countless books and articles have heralded the “end,” “death” and “destruction” of privacy.

Those proclamations are wrongheaded at best. It is still possible to protect privacy, but doing so requires that we rethink outdated understandings of the concept. One such view holds that privacy requires total secrecy: once information is revealed to others, it is no longer private. This notion of privacy is unsuited to an online world. The generation of people growing up today understands privacy in a more nuanced way. They know that personal information is routinely shared with countless others, and they also know that they leave a trail of data wherever they go.

The more subtle understanding of privacy embraced by Generation Google recognizes that a person should retain some control over personal information that becomes publicly available. This generation wants a say in how private details of their lives are disseminated.

The issue of control over personal information came to the fore in 2006, when Facebook launched a feature called News Feeds, which sent a notice to people’s friends registered with the service when their profile was changed or updated. But to the great surprise of those who run Facebook, many of its users reacted with outrage. Nearly 700,000 of them complained. At first blush, the outcry over News Feeds seems baffling. Many of the users who protested had profiles completely accessible to the public. So why did they think it was a privacy violation to alert their friends to changes in their profiles?

Instead of viewing privacy as secrets hidden away in a dark closet, they considered the issue as a matter of accessibility. They figured that most people would not scrutinize their profiles carefully enough to notice minor changes and updates. They could make changes inconspicuously. But Facebook’s News Feeds made information more widely noticeable. The privacy objection, then, was not about secrecy; it was about accessibility.

In 2007 Facebook again encountered another privacy outcry when it launched an advertising system with two parts, called Social Ads and Beacon. With Social Ads, whenever users wrote something positive about a product or a movie, Facebook would use their names, images and words in advertisements sent to friends in the hope that an endorsement would induce other users to purchase a product more than an advertisement might. With Beacon, Facebook made data-sharing deals with a variety of other commercial Web sites. If a person bought a movie ticket on Fandango or an item on another site, that information would pop up in that person’s public profile.

Facebook rolled out these programs without adequately informing its users. People unwittingly found themselves shilling products on their friends’ Web sites. And some people were shocked to see their private purchases on other Web sites suddenly displayed to the public as part of their profiles that appeared on the Facebook site.

The outcry and an ensuing online petition called for Facebook to reform its practices—a document that quickly attracted tens of thousands of signatures and that ultimately led to several changes. As witnessed in these instances, privacy does not always involve sharing of secrets. Facebook users did not want their identities used to endorse products with Social Ads. It is one thing to write about how much one enjoys a movie or CD; it is another to be used on a billboard to pitch products to others.

STRATEGIES TO PROTECT PRIVACY

The U.S. has less stringent privacy laws than do many other countries. The desire to shield people’s private lives on the Internet has prompted new thinking about how to balance openness with a need to restrict release of personal details.

Changing the Law

Canada and most European countries have more stringent privacy statutes than the U.S., which has resisted enacting all-encompassing legislation. Privacy laws elsewhere recognize that revealing information to others does not extinguish one’s right to privacy. Increasing accessibility of personal information, however, means that U.S. law also should begin recognizing the need to safeguard a degree of privacy in the public realm.

In some areas, U.S. law has a well-developed system of controlling information. Copyright recognizes strong rights for public information, protecting a wide range of works, from movies to software. Procuring copyright protection does not require locking a work of intellect behind closed doors. You can read a copyrighted magazine, make a duplicate for your own use and lend it to others. But you cannot do whatever you want: for instance, photocopying it from cover to cover or selling bootleg copies in the street. Copyright law tries to achieve a balance between freedom and control, even though it still must wrestle with the ongoing controversies in a digital age.

The closest U.S. privacy law comes to a legal doctrine akin to copyright is the appropriation tort, which prevents the use of someone else’s name or likeness for financial benefit. Unfortunately, the law has developed in a way that is often ineffective against the type of privacy threats now cropping up. Copyright primarily functions as a form of property right, protecting works of self-expression, such as a song or painting. To cope with increased threats to privacy, the scope of the appropriation tort should be expanded. The broadening might actually embody the original early 20th-century interpretation of this principle of common law, which conceived of privacy as more than a means to protect property: “The right to withdraw from the public gaze at such times as a person may see fit ... is embraced within the right of personal liberty,” declared the Georgia Supreme Court in 1905. Today, however, the tort does not apply when a person’s name or image appears in news, art, literature, or on social-networking sites. At the same time the appropriation tort protects against using someone’s name or picture without consent to advertise products, it allows these representations to be used in a news story. This limitation is fairly significant. It means that the tort would rarely apply to Internet-related postings.

Any widening of the scope of the appropriation tort must be balanced against the competing need to allow legitimate news gathering and dissemination of public information. The tort should probably apply only when photographs and other personal information are used in ways that are not of public concern—a criterion that will inevitably be subject to ongoing judicial deliberation.

Appropriation is not the only common-law privacy tort that needs an overhaul to become more relevant in an era of networked digital communications. We already have many legal tools to protect privacy, but they are currently crippled by conceptions of privacy that prevent them from working effectively. A broader development of the law should take into account problematic uses of personal information illustrated by the Star Wars Kid or Facebook’s Beacon service.

It would be best if these disputes could be resolved without recourse to the courts, but the broad reach of electronic networking will probably necessitate changes in common law. The threats to privacy are formidable, and people are starting to realize how strongly they regard privacy as a basic right. Toward this goal, society must develop a new and more nuanced understanding of public and private life—one that acknowledges that more personal information is going to be available yet also protects some choice over how that information is shared and distributed.

-Originally published: Scientific American 299(3), 100-106. (September 2008)

Stealing Secrets

by W. Wayt Gibbs

Through the eyepiece of Michael Backes’s small Celestron telescope, the 18-point letters on the laptop screen at the end of the hall look nearly as clear as if the notebook computer were on my lap. I do a double take. Not only is the laptop 10 meters (33 feet) down the corridor, it faces away from the telescope. The image that seems so legible is a reflection off a glass teapot on a nearby table. In experiments here at his laboratory at Saarland University in Germany, Backes has discovered that an alarmingly wide range of objects can bounce secrets right off our screens and into an eavesdropper’s camera. Spectacles work just fine, as do coffee cups, plastic bottles, metal jewelry—even, in his most recent work, the eyeballs of the computer user. The mere act of viewing information can give it away.

The reflection of screen images is only one of the many ways in which our computers may leak information through so-called side channels, security holes that bypass the normal encryption and operating-system restrictions we rely on to protect sensitive data. Researchers recently demonstrated five different ways to surreptitiously capture keystrokes, for example, without installing any software on the target computer. Technically sophisticated observers can extract private data by reading the flashing light-emitting diodes (LEDs) on network switches or by scrutinizing the faint radio-frequency waves that every monitor emits. Even certain printers make enough noise to allow for acoustic eavesdropping.

Outside of a few classified military programs, side-channel attacks have been largely ignored by computer security researchers, who have instead focused on creating ever more robust encryption schemes and network protocols. Yet that approach can secure only information that is inside the computer or network. Side-channel attacks exploit the unprotected area where the computer meets the real world: near the keyboard, monitor or printer, at a stage before the information is encrypted or after it has been translated into human-readable form. Such attacks also leave no anomalous log entries or corrupted files to signal that a theft has occurred, no traces that would allow security researchers to piece together how frequently they happen. The experts are sure of only one thing: whenever information is vulnerable and has significant monetary or intelligence value, it is only a matter of time until someone tries to steal it.

From Tempest to Teapot

The idea of stealing information through side channels is far older than the personal computer. In World War I the intelligence corps of the warring nations were able to eavesdrop on one another’s battle orders because field telephones of the day had just one wire and used the earth to carry the return current. Spies connected rods in the ground to amplifiers and picked up the conversations. In the 1960s American military scientists began studying the radio waves given off by computer monitors and launched a program, code-named “Tempest,” to develop shielding techniques that are used to this day in sensitive government and banking computer systems. Without Tempest shielding, the image being scanned line by line onto the screen of a standard cathode-ray tube monitor can be reconstructed from a nearby room—or even an adjacent building—by tuning into the monitor’s radio transmissions.

Many people assumed that the growing popularity of flat-panel displays would make Tempest problems obsolete, because flat panels use low voltages and do not scan images one line at a time. But in 2003 Markus G. Kuhn, a computer scientist at the University of Cambridge Computer Laboratory, demonstrated that even flat-panel monitors, including those built into laptops, radiate digital signals from their video cables, emissions that can be picked up and decoded from many meters away. The monitor refreshes its image 60 times or more each second; averaging out the common parts of the pattern leaves just the changing pixels—and a readable copy of whatever the target display is showing.

“Thirty years ago only military suppliers had the equipment necessary to do the electromagnetic analysis involved in this attack,” Kuhn says. “Today you can find it in any well-equipped electronics lab, although it is still bulky. Sooner or later, however, it will be available as a plugin card for your laptop.”

Similarly, commonplace radio surveillance equipment can pick up keystrokes as they are typed on a keyboard in a different room, according to Martin Vuagnoux and Sylvain Pasini, both graduate students in computer science at the Swiss Federal Institute of Technology in Lausanne. The attack does not depend on fluctuations in the power supply, so it works even on the battery-powered laptops you see by the dozen in any airport terminal.

Vuagnoux and Pasini showed off the feat in an online video recorded in October 2008. They are now preparing a conference paper that describes four distinct ways that keystrokes can be deduced from radio signals captured through walls at distances up to 20 meters. One of the newer methods is 95 percent accurate. “The way the keyboard determines which key is pressed is by polling a matrix of row and column lines,” explains Kuhn, who proposed (but never demonstrated) one of these methods a decade ago. “The polling process emits faint radio pulses, and the position of those pulses in time can reveal which key was pressed.”

In May of 2008 a group led by Giovanni Vigna of the University of California, Santa Barbara, published details of a fifth way to capture typing that does not require a fancy radio receiver; an ordinary webcam and some clever software will do. Vigna’s software, called ClearShot, works on video of a victim’s fingers typing on a keyboard. The program combines motiontracking algorithms with sophisticated linguistic models to deduce the most probable words being typed. Vigna reports that ClearShot reconstructs the typed text about as quickly as human volunteers do, but not quite as accurately.

It might seem implausible that someone would allow their own webcam to be used against them in this way. It is not. Gathering video from a webcam can be as simple as tricking the user into clicking on an innocuous-looking link in a Web page, a process known as clickjacking. Last October, Jeremiah Grossman of WhiteHat Security and Robert Hansen of SecTheory revealed details of bugs they discovered in many Web browsers and in Adobe’s Flash software that together allow a hostile Web site to collect audio and video from a computer’s microphone and webcam. Just a single errant click launches the surveillance.

Eye See You

Still, Backes points out, “almost all these interception methods are accessible only to experts with specialized knowledge and equipment. What distinguishes the attack based on reflections is that almost anyone with a $500 telescope can do it, and it is almost impossible to defend against completely.”

Backes, a fellow of the Max Planck Institute for Software Systems in Saarbrücken, Germany, who made a name for himself at IBM’s research lab in Zurich before entering academia, spends most of his time working on the mathematics that underlies cryptography. But every year he works on a new project with his students just for fun. This year they wrote computer code that translates an audio recording of a dot-matrix printer—the noisy variety that is still often used by airlines, banks and hospitals—into a picture of the page that was being printed at the time. Based on the success of that work, Backes’s group has been performing experiments to determine whether the method could be extended to retrieve text from recordings of ink-jet printers. “Obviously, this is much harder because ink-jets are so quiet,” Backes says.

Last year the idea for the annual fun project dawned on Backes as he was walking past the office where his graduate students were furiously typing away. “ ‘What are they working on so hard?’ I wondered,” Backes says. As he noticed a small blue-white patch in a teapot on one student’s desk and realized it was the reflection of the computer screen, the idea struck. “The next day I went to a hobby shop and bought an ordinary backyard telescope [for $435] and a sixmegapixel digital camera.”

The setup worked surprisingly well. Medium-size type was clearly legible when the telescope was aimed at reflections in a spoon, a wine glass, a wall clock. Nearly any shiny surface worked, but curved surfaces worked best, because they revealed wide swathes of the room, thus eliminating the need for a peeping hacker to find a sweet spot where the reflected screen is visible. Unfortunately, all of us who use computer screens have nearly spherical, highly reflective objects stuck to our faces. Could digital secrets be read off the eyes of their beholders?

Backes knew he would need a bigger telescope and a more sensitive camera to find out. Because eyeballs are rarely still for more than a second or so, the shutter speed on the camera would have to be fast to reduce motion blur. “For eyes, it is the brightness of the reflected image, not its resolution, that limits how far away a spy can be,” Backes says.

He bought a $1,500 telescope and borrowed a $6,000 astronomical camera from the Max Planck Institute for Astronomy in Heidelberg, Germany. Now he was able to make out 72-point text in the eye of a target 10 meters away.

He figured he could do even better by borrowing something else from astronomy: a process called deconvolution that removes blur in photographs of distant galaxies. The idea is to measure how a point of light in the original image (such as a star or a reflected status LED on a monitor) smears when captured by the camera. A mathematical function can then reverse the blurring to restore the point, sharpening the rest of the image at the same time. The deconvolution software lowered the threshold of legibility to 36-point type at 10 meters for a telescope that could easily be hidden inside a car. A van-size telescope could do even better.

Backes presented his results at the IEEE Symposium on Security and Privacy, but he already has ideas for further improvement. “A real attacker could train an invisible laser on the target,” he notes. That would enable autofocusing on the eyeball and better deconvolution of the motion blur. Spies could take advantage of software from HeliconSoft that can assemble one clear image of an object by combining many partially blurry images; only those regions that are in focus are retained. They could also exploit software for high dynamic-range imaging that uses similar techniques to create one high-contrast photograph from images shot with a variety of exposures.

A Blind Defense

Protecting ourselves against our overly communicative computers is much harder in some ways than defending against spam, phishing and viruses. There is no convenient software package one can install to dam the side channels. On the other hand, it is not clear that anyone is actively exploiting them. Backes and Kuhn say it is safe to assume that military organizations have used the techniques to gather intelligence, but they can cite no specific examples.

The blinds in Backes’s office were drawn as we discussed these possibilities, and curtains are one obvious way of frustrating a reflection thief. But Backes points out that it is naive to expect that people will always remember, or be able, to cover their windows. Although many laptop users apply “privacy filters” to their screens to protect against over-the-shoulder eavesdropping, these filters increase the brightness of the reflection on the viewer’s eyes, thus making the hacker’s job easier.

Flat-panel displays emit polarized light, so a polarizing film on a window could in principle block reflections from every screen in the room. In practice, however, this fix does not work. Small variations in the polarization angle of displays are common, and the resulting small mismatches let enough light escape that a good telescope can still make out the screen.

Compared with conventional forms of computer espionage, side-channel attacks do have a couple of major limitations, Kuhn notes. “You have to be close to the target, and you must be observing while a user is actively accessing the information. It’s much easier if you can instead convince someone to open an e-mail attachment and install malicious software that opens a back door to their entire system. You can do that to millions of people at once.”

For that reason, side-channel hacks are unlikely to become as common as spam, malware and other assaults through the network. Instead they will likely be used to infiltrate a few highly lucrative targets, such as the computers of financiers and high-level corporate and government officials. In these cases, side-channel leaks probably offer the easiest way to bypass elaborate network security systems and do it without leaving any trail that a security team could trace after the fact. Anecdotal evidence suggests such surveillance is already taking place. “Some people in investment banks cite cases where information has disappeared, and they are certain it wasn’t a traditional attack such as a software hack or the cleaning lady duplicating a hard disk,” Kuhn says. “But to my knowledge, no one has ever been caught in the act.”

--Originally published: Scientific American 300(5), 58-63. (May 2009)

Brave New World of Wiretapping

by Whitfield Diffie and Susan Landau

As long as people have engaged in private conversations, eavesdroppers have tried to listen in. When important matters were discussed in parlors, people slipped in under the eaves—literally within the “eavesdrop”—to hear what was being said. When conversations moved to telephones, the wires were tapped. And now that so much human activity takes place in cyberspace, spies have infiltrated that realm as well.

Unlike earlier, physical frontiers, cyberspace is a human construct. The rules, designs and investments we make in cyberspace will shape the ways espionage, privacy and security will interact. Today there is a clear movement to give intelligence activities a privileged position, building in the capacity of authorities to intercept cyberspace communications. The advantages of this trend for fighting crime and terrorism are obvious.

The drawbacks may be less obvious. For one thing, adding such intercept infrastructure would undermine the nimble, bottom-up structure of the Internet that has been so congenial to business innovation: its costs would drive many small U.S. In ternet service providers (ISPs) out of business, and the top-down control it would require would threaten the nation’s role as a leader and innovator in communications.

Furthermore, by putting too much emphasis on the capacity to intercept Internet communications, we may be undermining civil liberties. We may also damage the security of cyberspace and ultimately the security of the nation. If the U.S. builds extensive wiretapping into our communications system, how do we guarantee that the facilities we build will not be misused? Our police and intelligence agencies, through corruption or merely excessive zeal, may use them to spy on Americans in violation of the U.S. Constitution. And, with any intercept capability, there is a risk that it could fall into the wrong hands. Criminals, terrorists and foreign intelligence services may gain access to our surveillance facilities and use them against us. The architectures needed to protect against these two threats are different.

Such issues are important enough to merit a broad national debate. Unfortunately, though, the public’s ability to participate in the discussion is impeded by the fog of secrecy that surrounds all intelligence, particularly message interception (“signals intelligence”).

A Brief History of Wiretapping

To understand the current controversy over wiretapping, one must understand the history of communications technology. From the development of the telephone in the 19th century until the past decade or two, remote voice communications were carried almost exclusively by circuit-switched systems. When one person picked up the phone to call another, one or more telephone switches along the way would connect their wires so that a continuous circuit would be formed. This circuit would persist for the duration of the call, after which the switches would disconnect the wires, freeing resources to handle other calls. Call switching was essentially the only thing that telephone switches did. Other services associated with the telephone—call forwarding and message taking, for example—were handled by human operators.

Wiretapping has had an on-and-off legal history in the U.S. The earliest wiretaps were simply extra wires—connected to the line between the telephone company’s central office and the subscriber—that carried the signal to a pair of earphones and a recorder. Later on, wiretaps were installed at the central office on the frames that held the incoming wires. At first, the courts held that a wiretap does not constitute a search when it involves no trespass, but over time that viewpoint changed. In 1967 the U.S. Supreme Court decided in the case of Katz v. United States that the interception of communications is indeed a search and that a warrant is required. This decision prompted Congress in 1968 to pass a law providing for wiretap warrants in criminal investigations. But Congress’s action left the use of wiretapping for foreign intelligence in legal limbo. Congressional investigations that followed the 1972 Watergate break-in uncovered a history of presidential operations that had employed and, as it turned out, abused the practice, spying on peaceful, domestic political organizations as well as hostile, foreign ones. So, in 1978, Congress passed the Foreign Intelligence Surveillance Act (FISA), which took the controversial step of creating a secret federal court for issuing wiretap warrants.

Most of the surveillance of communications for foreign intelligence purposes lay outside the scope of the wiretapping law, because this activity had primarily involved the interception of radio signals rather than physical intrusions into phone systems. (When operating in other countries, American intelligence services could not place wiretaps on phone lines as easily as they could in the U.S.) Another important distinction between domestic and foreign communications surveillance is scale: inside the U.S., wiretapping has traditionally been regarded as an extreme investigative technique, something to be applied only to very serious crimes. Outside the country, though, the interception of communications is big business. The National Security Agency (NSA) spends billions of dollars every year intercepting foreign communications from ground bases, ships, airplanes and satellites.

But the most important differences are procedural. Within the U.S. the Fourth Amendment to the Constitution guarantees the right of the people to be free from “unreasonable searches and seizures.” The logic of a “reasonable” search is that law-enforcement officers must make an unprivileged observation (that is, one that does not invade the suspect’s privacy) whose results give them “probable cause” with which they can approach the courts for a search warrant. What they are not permitted to do, in either physical searches or wiretaps, is to search first and then use what they find as evidence that the search was legitimate. This procedure, however, is exactly what intelligence agents do, except that they usually do not employ their results to prosecute criminals. An intelligence officer relies on professional judgment and available information to make the decision to spy on a foreign target; the operation will then be judged as a success or failure depending on what intelligence was obtained and what resources were expended.

The rules established in FISA make three fundamental distinctions: between “U.S. persons” (citizens, legal residents and American corporations) and foreigners; between communications inside and outside the U.S.; and between wired and wireless communications. Briefly, wired communications entirely within the U.S. are protected—intercepting them requires a warrant. But radio communications that include people outside the country are protected only if the signal is intercepted in the U.S. and the government’s target is a particular, known U.S. person who is in the country at the time.

Until recently, whenever the FISA rules applied, they imposed a burden similar to that imposed by ordinary criminal law. To seek a warrant, an intelligence agency had to specify a particular location, telecommunications channel or person and explain why the target should be subject to surveillance. Operating “foreign intelligence–style,” intercepting communications and then using the recorded conversations to justify the interception, was not permitted.

Almost accidentally, the rules set by FISA included an important loophole that Congress had intended to be only temporary: radio communications involving parties who were not U.S. persons could be intercepted from inside the U.S. without warrants. At the time FISA was passed and for many years thereafter, the radio exemption was a great boon to the intelligence community. Satellite radio relays had revolutionized international communications in the 1960s and 1970s and carried most of the phone calls entering and leaving the country. Radio communications that were partly or completely among parties outside the U.S. were legally and physically vulnerable to interception by NSA antennas at places such as Yakima, Wash., and Vint Hill Farms in Virginia.

MINIMIZATION

One of the important procedural differences between law-enforcement wiretapping and surveillance for foreign intelligence lies in the practice of minimization: avoiding the collection of communications other than the targeted ones. A wiretapped phone line, for example, may be used by several people, some of whom are not the targets of the investigation.

U.S. law requires the police to listen to a tapped conversation at the same time they record it and to stop the surveillance when the subjects are not discussing criminal activities.

In foreign intelligence gathering, the minimization rules are generally not so rigid, but because so many signals can be intercepted and analyzed, far more traffic must be discarded as irrelevant.

In the 1970s a new transmission medium emerged as an alternative for long-haul communications. Optical fibers—long, thin strands of glass that carry signals via laser light—offered great ad vant ages in communicating between fixed locations. Fiber lines have tremendous capacity; they are not plagued by the quartersecond delay that slows satellite relays; they are intrinsically more secure than radio; and, for a combination of technical and business reasons, they have become very cheap. From the 1990s onward, the vast majority of communications from one fixed location to another have moved by fiber. Because fiber communications are “wired,” U.S. law gives them greater protection. The intelligence community could not intercept these communications as freely as they could radio traffic, and the FISA rules began to chafe.

A particularly sensitive issue for intelligence agencies was the so-called transit traffic. Some 20 percent of the communications carried on U.S. networks originate and terminate outside the country, moving between Europe, Asia and Latin America. Transit traffic is not a new phenomenon; it was already present in the satellite era. But under FISA rules, the interception of fiber communications at points inside the U.S. required a warrant. This requirement upset the standard processes of intelligence agents, who were unaccustomed to seeking probable cause before initiating surveillance.

At about the same time, computer-based switching systems began to replace the traditional electromechanical switches in U.S. telephone networks. This computerization paved the way for services such as automated call forwarding and answering systems, which unintentionally but effectively bypassed standard wiretapping techniques. Suppose that a caller to a wiretapped phone left a message with an answering service provided by the telephone company. If the target of the investigation checked his messages from a phone other than his own, the communication would never travel over the tapped line and thus would not be intercepted.

Congress responded in 1994 with the Communications Assistance for Law Enforcement Act (CALEA), which requires telecommunications companies to make it possible for the government to tap all the communications of a targeted subscriber no matter what automated services the subscriber uses. In addition to man dating an improvement in the quality of information that can be obtained from wiretaps, CALEA obliged telecommunications carriers to be able to execute far more simultaneous wiretaps than had previously been possible.

Tapping the Net

CALEA was passed just as large numbers of people began using the Internet, which employs a communications method that is entirely different from circuit-switched telephony. Internet users send information in small packets, each of which carries a destination address and a return address, just like a letter in the postal system. With circuit switching, a brief telephone call incurs the same setup costs as a long one, so making a call to send only a few words is uneconomical. But on a packet-switched network, short messages are cheap and shorter messages are cheaper. Web browsing is possible because Internet connections can be used briefly and discarded. Each time you click on a Web link, you establish a new connection.

In the era of circuit-switched communications, wiretapping worked because telephone instruments, numbers and users were bound closely together. A telephone was hard to move, and a new telephone number was hard to get. An organization’s messages moved on the same channels for long periods, so it was easy to intercept them repeatedly. Computerized switching and the Internet have made surveillance much more challenging. Today people can easily get new telephone numbers as well as e-mail addresses, instant messaging handles and other identifiers. And the advent of voice-over-Internet protocol (VoIP), the standard that allows the transmission of voice communications over packet-switched networks, has further decentralized control of the communications infrastructure. In a VoIP system such as the popular Skype service, for example, the setting up of phone calls and the transmission of traffic are entirely separate.

If CALEA, as interpreted literally, were applied to decentralized VoIP services, the provider would be required to intercept targeted customers’ phone calls and relay them to the government but might be totally incapable of complying with such a demand. Consider a typical VoIP call running between the laptop computers of two people, both of whom are traveling. Alice initiates the call from a lounge at O’Hare airport in Chicago, and Bob receives it at a hotel bar in San Francisco. The VoIP provider’s role in the process is limited: it discovers the Internet protocol (IP) addresses through which Alice and Bob are connected and communicates each person’s address to the other’s computer. After the setup is completed, the VoIP provider plays no further role. Instead the actual voice conversation is carried by the Internet service providers (ISPs) through which Alice and Bob access the Internet, together with other Internet carriers to which those ISPs are connected.

In this environment a government agency might have to serve wiretap warrants on many telecommunications carriers just to monitor a single target. Suppose we imagine a CALEA-style intercept regime that could capture a VoIP call. It must begin with an order to the VoIP provider targeting either Alice or Bob. When lawenforcement agents receive word from the provider that the target is engaged in a call, they must consider the IP addresses of Alice and Bob and send an intercept warrant to one or more ISPs at which the call can be intercepted. The ISPs must be prepared to accept, authenticate and implement the warrant in real time. One problem with this scenario is that only ISPs in the U.S. (and possibly some in cooperating countries) would be required to honor the warrant. A more serious difficulty is the massive security problem that such an arrangement would present. Anyone who could penetrate an ISP’s wiretap function would be able to spy on its subscribers at will.

Then and Now: Surveillance Gets Complicated

Monitoring voice communications has grown more technically challenging in recent years, requiring more simultaneous wiretaps.

Credit: George Retseck, Sun Microsystems, Neil Limmerman

CALEA recognized the difference between traditional telephony and the Internet and exempted the Internet, referred to as “information services,” from the provisions of the new law. Yet in 2004, despite that distinction, the U.S. Department of Justice, the Federal Bureau of Investigation and the U.S. Drug Enforcement Administration responded to the challenge of monitoring Internet communications by proposing that providers of broadband Internet access be required to comply with the CALEA requirements. The Federal Communications Commission and the courts have so far supported law enforcement in extending CALEA to “interconnected VoIP” (the form most like traditional telephony), relying on a provision of CALEA that refers to services that are a “substantial” replacement for the telephone system. This proposal, if adopted, would be the first step on a road leading to dangers not present in conventional wiretapping.

In particular, the government’s actions threaten the continued growth of the Internet, which has become a hotbed of innovation as a consequence of its distributed control and loose connectivity. Unlike a telephone carrier’s network, the Internet is not centrally planned and managed. The addition of a new service, such as call forwarding, in the telephone system typically takes years of planning and development. But an Internet entrepreneur can start a new business in a garage or dorm room, using nothing but a home computer and a broadband connection. If law enforcement succeeds in mandating interception facilities for every Internet carrier, the industry as a whole could be pushed back into the procrustean bed of conventional telecommunications. To incorporate extensive surveillance capabilities, new Internet services would have to be developed in long cycles dependent on federal approval. In a century in which the great opportunities lie in information-based businesses, Americans must do everything possible to foster innovation rather than stifl ing it. If we do not, we may fall behind countries that follow a different course. Such an outcome would represent a long-term threat to national security.

Another threat is more immediate. Since the collapse of the Soviet Union, no opponent has had the ability to spy on U.S. communications with anything approximating comprehensive coverage. The Soviets had fleets of trawlers patrolling both coasts of the U.S., diplomatic facilities in major American cities, satellites overhead and ground bases such as the Lourdes facility near Havana. Their capabilities in signals in telligence were second to none. In comparison, the current opponents we most fear, such as al Qaeda, and even major nations such as China have no such ability. They are, however, trying to achieve it, and building wiretapping into the Internet might give it to them. Computers would control the intercept devices, and those computers themselves would be controlled remotely. Such systems could be just as much subject to capture as Web sites and personal computers. The government’s proposed interception policies must be judged in the light of such vast and uncertain dangers.

Cyberwars

The administration of President George W. Bush relaxed some of the 30-year-old restrictions on communications surveillance mandated by FISA. In 2007 Congress, under intense pressure from the White House, passed the Protect America Act (PAA), which amended FISA by expanding the radio exemption to cover all communications. The law provided that any communication reasonably believed to have a participant outside the U.S. could be intercepted without a warrant. Given the degree to which business services in the U.S. are being outsourced to overseas providers, the new law made a large fraction of American commercial and personal telecommunications activity subject to monitoring. Congress was sufficiently nervous about this course of action that it provided for PAA to expire in 2008.

After months of controversy, Congress passed a bill fundamentally expanding the executive branch’s wiretapping authority and reducing the FISA court’s role in international cases to reviewing the general procedures of a proposed wiretap rather than the specifics of a case. Political debate over the bill, however, did not center on wiretapping authority, as one might expect for a sweeping change. Most attention focused instead on giving retroactive immunity for past illegal wire tap ping.

In early 2008 the administration offered a new rationale for expanding communications surveillance: securing the Internet. The current state of Internet security is indeed abysmal. Most computers cannot protect themselves from penetration by malware—software designed to infiltrate and damage computer systems—and a substantial fraction of the computers linked to the Internet are under the control of parties other than their owners. These machines have been surreptitiously captured and organized into “botnets,” whose computing power is then resold in a kind of electronic slave trade. In response to the failure of traditional defensive approaches, President Bush signed a national security directive in January authorizing a Cyber Initiative. Most of the initiative is secret, but its initial move —extensive surveillance of the substantial amount of Internet traffic that moves in and out of the U.S. government—is too sweeping to be concealed. To facilitate the surveillance, the administration plans to reduce the number of connections between government agencies and the Internet from thousands to fewer than a hundred, and that requires changing or retiring thousands of IP addresses. The Cyber Initiative captures the dilemma of signals intelligence perfectly. A system that monitors federal communications for signs of foreign intrusion will also capture all the legitimate communications that Americans have with their government.

Geography of Wiretapping

The Foreign Intelligence Surveillance Act (FISA), amended this year, 2008, details which communications are legally protected and which can be monitored without a warrant.

Credit: Jen Christiansen

The administration is seeking the power to intercept American communications using the same tactics long employed in foreign intelligence gathering—that is, without having to go to the courts for warrants and describe in advance whose communications it intends to intercept. The advocates of expanded surveillance have valid concerns: not only do we face opponents who are not tied to particular nations and can move freely in and out of the U.S., we also have a critical cybersecurity problem. The Internet is swiftly becoming the primary medium for both commercial and government business, as well as the preferred communications method for many individuals. Its security problems are analogous to having the roads overrun with bandits or the sea-lanes controlled by pirates. Under these circumstances, it is not surprising to find the government seeking to patrol the Internet, just as the nation’s police and armed services have patrolled the roads or the high seas in the past.

But policing the Internet, as opposed to securing the computers that populate it, may be a treacherous remedy. Will the government’s monitoring tools be any more secure than the network they are trying to protect? If not, we run the risk that the surveillance facilities will be subverted or actually used against the U.S. The security problems that plague the Internet may beset the computers that will do the policing as much as the computers being policed. If the government expands spying on the Internet without solving the underlying computer security problems, we are courting disaster.

The inherent dangers are made worse by the secrecy surrounding the government’s initia tives. One casualty of recent approaches to communications interception has been what might be called the two-organization rule. The security of many crucial systems, such as those controlling nuclear weapons, relies on the requirement that critical actions be taken by two people simultaneously. Until recently, federal law mandated a similar approach to wiretapping, allowing the government to issue wiretap orders but requiring the phone companies to install the taps. Under this arrangement, a phone company would be reluctant to act on a wiretap order it sus pected was illegal, because its compliance would make it vulnerable to both prosecution and civil liability. Eliminating the role of the phone companies removes an important safeguard. If we follow this course, we may create a re gime entirely out of view of Congress, the courts and the press—and perhaps entirely out of control.

The distance our world has moved into cyberspace in the past century is minuscule compared with the distance it will move in the next. We are in the process of building the world in which future humans will live, as surely as the first city dwellers did 5,000 years ago. Communication is fundamental to our species; private communication is fundamental to both our national security and our democracy. Our challenge is to maintain this privacy in the midst of new communications technologies and serious national se cu rity threats. But it is critical to make choices that preserve privacy, communications security and the ability to innovate. Otherwise, all hope of having a free society will vanish.

--Originally published: Scientific American 299(3), 56-63. (September 2008)

Tag–You’re It

by Katherine Albrecht

If you live in a state bordering Canada or Mexico, you may soon be given an opportunity to carry a very high tech item: a remotely readable driver’s license. Designed to identify U.S. citizens as they approach the nation’s borders, the cards are being promoted by the Department of Homeland Security as a way to save time and simplify border crossings. But if you care about your safety and privacy as much as convenience, you might want to think twice before signing up.

The new licenses come equipped with radiofrequency identification (RFID) tags that can be read right through a wallet, pocket or purse from as far away as 30 feet. Each tag incorporates a tiny microchip encoded with a unique identification number. As the bearer approaches a border station, radio energy broadcast by a reader device is picked up by an antenna connected to the chip, causing it to emit the ID number. By the time the license holder reaches the border agent, the number has already been fed into a Homeland Security database, and the traveler’s photograph and other details are displayed on the agent’s screen.

Although such “enhanced” driver’s licenses remain voluntary in the states that offer them, privacy and security experts are concerned that those who sign up for the cards are unaware of the risk: anyone with a readily available reader device—unscrupulous marketers, government agents, stalkers, thieves and just plain snoops—can also access the data on the licenses to remotely track people without their knowledge or consent. What is more, once the tag’s ID number is associated with an individual’s identity—for example, when the person carrying the license makes a credit-card transaction—the radio tag becomes a proxy for that individual. And the driver’s licenses are just the latest addition to a growing array of “tagged” items that consumers might be wearing or carrying around, such as transit and toll passes, office key cards, school IDs, “contactless” credit cards, clothing, phones and even groceries.

RFID tags have been likened to barcodes that broadcast their information, and the comparison is apt in the sense that the tiny devices have been used mainly for identifying parts and inventory, including cattle, as they make their way through supply chains. Instead of having to scan every individual item’s Universal Product Code (UPC), a warehouse worker can register the contents of an entire pallet of, say, paper towels by scanning the unique serial number encoded in the attached RFID tag. That number is associated in a central database with a detailed list of the pallet’s contents. But people are not paper products. During the past decade a shift toward embedding chips in individual consumer goods and, now, official identity documents has created a new set of privacy and security problems precisely because RFID is such a powerful tracking technology. Very little security is built into the tags themselves, and existing laws offer people scant protection from being surreptitiously tracked and profiled while living an increasingly tagged life.

Beyond Barcodes

The first radio tags identified military aircraft as friend or foe during World War II, but it was not until the late 1980s that similar tags became the basis of electronic toll-collection systems, such as E-ZPass along the East Coast. And in 1999 corporations began considering the tags’ potential for tracking millions of individual objects. In that year Procter & Gamble and Gillette (which have since merged to become the world’s largest consumer-product manufacturing company) formed a consortium with Massachusetts Institute of Technology engineers, called the Auto-ID Center, to develop RFID tags that would be small, efficient and cheap enough to eventually replace the UPC barcode on everyday consumer products.

By 2003 the group had developed a working version of the technology and attracted in vestment from more than 100 companies and government agencies. The tags’ promoters promised the tiny chips would revolutionize inventory management and counterfeiting prevention.

To kick-start government adoption of the technology, the General Services Administration (GSA), a federal bureau that manages purchasing for other government institutions, issued a memo in 2004 urging the heads of all federal agencies “to consider action that can be taken to advance the [RFID] industry.” Suddenly, virtually every agency, from the Social Security Administration to the Food and Drug Administration, began announcing RFID trials.

During the same period, similar initiatives were under way around the world. In 2003 the International Civil Aviation Organization (ICAO) , a United Nations agency that sets global passport standards, endorsed the use of RFID tags in passports. ICAO now calls for their use in all scannable “e-passports.” Today dozens of countries, including the U.S., issue e-passports with RFID tags embedded in their covers.

Since their debut, the new passports have been controversial on both privacy and security grounds. In a 2006 report one ICAO official promised that encryption measures would provide a “level of protection [that] should reassure the most anxious passport holder that his personal data cannot be read without his knowledge.”

Security experts quickly proved otherwise. In 2007 British security consultant Adam Laurie cracked the encryption code on a U.K. passport and “skimmed,” or remotely read, its personal information—while it was still sealed in its mailing envelope. Around the same time, German security consultant Lukas Grunwald copied the data from a German passport’s embedded chip and encoded it into a different RFID tag to create a forged document that could fool an electronic passport reader. Investigators at Charles University in Prague, finding similar vulnerabilities in Czech e-passports, wrote that it was “a bit surprising to meet an implementation that actually encourages rather than eliminates [security] attacks.”

Yet these demonstrated security problems have not slowed the adoption of RFID. On the contrary, the technology is being deployed for domestic ID cards around the world. Malaysia has issued some 25 million contactless national identity cards. Qatar is issuing one that stores the cardholder’s fingerprint in addition to personal information. And in what industry observers are calling the single largest RFID project in the world, the Chinese government is spending $6 billion to roll out RFID-based national IDs to nearly one billion citizens and residents.

There is an important difference, however, between other nations’ RFID-based ID cards and Homeland Security’s new driver’s licenses. Most countries’ contactless national IDs and e-passports have adopted an RFID tag that meets an industry standard known as ISO 14443, which was developed specifically for identification and payment cards and has a degree of security and privacy protection built in. In contrast, U.S. border cards use an RFID standard known as EPCglobal Gen 2, a technology that was designed to track products in warehouses, where the goal is not security but maximum ease of readability.

Whereas the ISO 14443 standard includes rudimentary encryption and requires tags to be close to a scanner to be read (a distance measured in inches rather than feet), Gen 2 tags typically have no encryption and only minimal data safeguards. To skim the data from an encrypted ISO 14443 chip, you have to crack the encryption code, but no special skills are required to skim a Gen 2 tag; all you need is any Gen 2 reader. Such readers can be purchased readily and are in common use in warehouses worldwide. A hacker or crim inal armed with one could skim a border card through a purse, across a room, even through a wall.

As of April 2008, more than 35,000 Washington State motorists had signed up for enhanced driver’s licenses, and other border states, including Arizona, Michigan and Vermont, have agreed to participate in the program. New York State will begin making the new licenses available to its residents after Labor Day.

But the possibility that the security of such cards could be compromised is just one reason for concern. Even if tighter data-protection measures could someday prevent unauthorized access to RFID-card data, many privacy advocates worry that remotely readable identity documents could be abused by governments that wish to tightly monitor and control their citizens.

China’s national ID cards, for instance, are encoded with what most people would consider a shocking amount of personal information, including health and reproductive history, employment status, religion, ethnicity and even the name and phone number of each cardholder’s landlord. More ominous still, the cards are part of a larger project to blanket Chinese cities with state-of-the-art surveillance technologies. Michael Lin, a vice president for China Public Security Technology, a private company providing the RFID cards for the program, unflinchingly described them to the New York Times as “a way for the government to control the population in the future.” And even if other governments do not take advantage of the surveillance potential inherent in the new ID cards, ample evidence suggests that data-hungry corporations will.

VOLUNTARY GUIDELINES

EPCglobal, Inc., an organization that sets standards for RFID tags, also offers principles for their use as “electronic product codes” in consumer goods.

Notice: “Consumers will be given clear notice of the presence of EPC on products or their packaging . . . through the use of an EPC logo or [other] identifier.”

Choice: “Consumers will be informed of the choices . . . to [remove or disable] EPC tags from the products they acquire.”

Education: Companies using EPC tags will “familiarize consumers with the EPC logo and help [them] understand the technology.”

Records: Consumer data associated with tags “will be collected, used, maintained, stored and protected by EPCglobal member companies in compliance with applicable laws.”

Living a Tagged Life

If the idea that corporations might want to use RFID tags to spy on individuals sounds far-fetched, it is worth considering an IBM patent filed in 2001 and granted in 2006. The patent describes exactly how the cards can be used for tracking and profiling even if access to official databases is unavailable or strictly limited. Entitled “Identification and Tracking of Persons Using RFID-Tagged Items in Store Environments,” it chillingly details RFID’s potential for surveillance in a world where networked RFID readers called “person tracking units” would be incorporated virtually everywhere people go—in “shopping malls, airports, train stations, bus stations, elevators, trains, airplanes, restrooms, sports arenas, libraries, theaters, [and] museums”—to closely monitor people’s movements.

According to the patent, here is how it would work in a retail environment: an “RFID tag scanner located [in the desired tracking location] . . . scans the RFID tags on [a] person. . . . As that person moves around the store, different RFID tag scanners located throughout the store can pick up radio signals from the RFID tags carried on that person and the movement of that person is tracked based on these detections . . . The person tracking unit may keep records of different locations where the person has visited, as well as the visitation times.”

The fact that no personal data are stored in the RFID tag does not present a problem, IBM explains, because “the personal information will be obtained when the person uses his or her credit card, bank card, shopper card or the like.” The link between the unique RFID number of the tag and a person’s identity needs to be made only once for the card to serve as a proxy for the person thereafter. Although IBM envisioned tracking people via miniature tags in consumer goods, with today’s RFID border cards there is no need to wait for such individual product tags to become widespread. Washington’s new driver’s licenses would be ideally suited to the in-store tracking application, because they can already be read by Gen 2 inventory scanners in use today at stores such as Wal-Mart, Dillard’s and American Apparel.

A tracking infrastructure will become increasingly fruitful to marketers as more people begin carrying, and even wearing, RFID-tagged items. At present, tens of millions of contactless credit and ATM cards containing RFID tags are in circulation, along with millions of employee access badges. RFID-based public-transit passes, widely used in Europe and Japan, are also coming to U.S. cities. IBM’s person tracking unit is still only a patent, but an English amusement park called Alton Towers provides a living illustration of RFID’s tracking potential. On entering the park, each visitor is offered an RFID wristband encoded with a unique ID number. As people enjoy the attractions, a network of RFID readers placed strategically throughout the park detects each wristband as it comes within range and triggers nearby video cameras. Candid footage of each individual is stored in a file labeled with the wristband ID number, then made available to the customer on a keepsake DVD at the end of the day.

Protecting the Public

If RFID tags can enable an amusement park to capture detailed, personalized videos of thousands of people a day, imagine what a determined government could do—not to mention marketers or criminals. That is why my colleagues in the privacy community and I have so firmly opposed the use of RFID in government-issued identity documents or individual consumer items. As far back as 2003, my organization, CASPIAN (Consumers Against Supermarket Privacy Invasion and Numbering)—along with the Privacy Rights Clearinghouse, the Electronic Privacy Information Center, the Electronic Frontier Foundation, the American Civil Liberties Union, and 40 other leading privacy and civil liberties advocates and organizations—recognized this threat and issued a position paper that condemned the tracking of human beings with RFID as inappropriate.

In response to these concerns, dozens of U.S. states have introduced RFID consumer-protection bills—which have all been either killed or gutted by heavy opposition from lobbyists for the RFID industry. When the New Hampshire Senate voted on a bill that would have imposed tough regulations on RFID in 2006, a last-minute floor amendment replaced it with a two-year study instead. (I was appointed by the governor to serve on the resulting commission.) That same year a California bill that would have prohibited the use of RFID in government-issued documents passed both houses of the legislature, only to be vetoed by Governor Arnold Schwarzenegger.

On the federal level, no high-profile consumer-protection bills related to RFID have been passed. Instead, in 2005, the Senate Republican High Tech Task Force praised RFID applications as “exciting new technologies” with “tremendous promise for our economy” and vowed to protect RFID from regulation or legislation.

In the European Union, regulators are at least examining the situation. The European Commission—the executive arm of the E.U.—has acknowledged the potential for serious privacy problems with RFID and opened a public comment period earlier this year. As of July 2008, when this issue went to press, recommendations stemming from the public comments were set to be released later in the summer, but expectations for any consumer-privacy regulations were low. In a March 2007 speech, E.U. commissioner for information society and media Viviane Reding announced that the commission would not regulate RFID but instead would allow businesses to regulate themselves. “I am here to tell you that on RFIDs, there is not going to be a regulation,” she said. “My view is that we should underregulate rather than overregulate so that this sector can take off.”

Unfortunately, industry self-regulation has little force when it comes to protecting the public from RFID risks. EPCglobal, the industry body that now sets technical standards for RFID tags, also produced a set of guidelines for the use of the chips in retail. The organization’s recommendations require, among other things, notice to consumers whenever products contain RFID tags—for instance, in the form of a recognizable RFID logo. Yet when Checkpoint Systems, a member company of EPCglobal, designed RFID tags to be hidden in the soles of shoes—in clear violation of the organization’s own provisions—Mike Meranda, then president of EPCglobal, told me that since the guidelines were voluntary, there was nothing he or his organization could do about it.

The Washington State Department of Licensing reassures citizens that their personal information is safe because the RFID tag in an enhanced driver’s license “doesn’t have a power source” and “doesn’t contain any personal identifying inform ation”—even though those facts have no bearing on whether the card can be used for tracking. For some people, a false sense of assurance provided by such official mollifications could be dangerous. The National Network to End Domestic Violence, a group that vocally opposes the use of RFID in identity documents and consumer products, has submitted legislative testimony describing how abusers could use the technology to stalk and monitor their victims.

Meanwhile the RFID train is barreling forward. Gigi Zenk, a spokesperson at Washington’s licensing agency, recently confirmed that there are 10,000 enhanced licenses “on the street now—that people are actually carrying.” That’s a lot of potential for abuse, and it will only grow. The state recently mustered a halfhearted response, passing a law that designates the unauthorized reading of a tag “for the purpose of fraud, identity theft, or for any other illegal purpose” as a class C felony, subject to five years in prison and a $10,000 fine. Nowhere in the law does it say, however, that scanning for other purposes such as marketing—or perhaps “to control the population”—is prohibited. We ignore these risks at our peril.

--Originally published: Scientific American 299(3), 72-77. (September 2008)

Malware Goes Mobile

by Mikko Hypponen

The day the computer security community had anticipated for years finally arrived in June 2004. I and other researchers who study malicious forms of software knew that it was only a matter of time until such malware appeared on mobile phones as well. As cell phones have evolved into smartphones—able to download programs from the Internet and share software with one another through short-range Bluetooth connections, worldwide multimedia messaging service (MMS) communications and memory cards—the devices’ novel capabilities have created new vulnerabilities. Scoundrels were bound to find the weaknesses and exploit them for mischief or, worse, for criminal gain.

Sure enough, three summers ago security experts found the first rogue program written specifi cally for smartphones. Dubbed Cabir, it was a classic proof-of-concept virus, clearly created to capture bragging rights. It caused no damage to an infected device, other than running down the phone’s battery as the virus tried to copy itself to another smartphone by opening a Bluetooth connection. The anonymous author, most likely somewhere in Spain, chose to post Cabir on a Web site rather than releasing it into the wild. But within two months other scofflaws had turned it loose in Southeast Asia. It soon spread worldwide.

Even though we had been on the lookout for viruses such as Cabir, security experts were not fully prepared to deal with it. As soon as the alert was sounded, my co-workers and I at F-Secure, a computer security firm, started inspecting the new virus, which was a type known as a worm. But we had no safe place to study it; unlike a computer virus that can be observed and dissected on a machine that is disconnected from any network, wireless malware can spread—in some cases, even make transoceanic leaps—the moment the infected phone is powered up.

So we took four cell phones hit by Cabir to the basement bomb shelter in our office building and posted a guard at the door before turning them on, lest an unsuspecting employee walk in and catch the bug. Later that year F-Secure built two aluminum-and-copper-encased laboratories, impenetrable to radio waves, to study this contagious new form of malware.

Although the initial version of Cabir was relatively innocuous, some unscrupulous malware writers rushed to modify it into forms that are more virulent and damaging, while others began crafting novel kinds of attacks. Mobile viruses on the loose now can completely disable a phone, delete the data on it or force the device to send costly messages to premium-priced numbers. Within two years the number of viruses targeting smartphones soared from one to more than 200, a rate of growth that roughly paralleled that of computer viruses in the first two years after the first PC virus, called Brain, was released in 1986.

Despite Herculean efforts to rein it in, PC malware continues at a gallop: more than 200,000 forms have been identified so far, and today an unprotected PC is often infected within minutes of connecting to the Internet. The economic costs of the 20-year onslaught have been steep, and they are spiraling higher as old-school malware written for glory has given way to a new era of “crimeware” designed for spamming, data theft or extortion.

Mobile malware, though little more than a nuisance today, could quickly escalate into an even more formidable problem than PC malware in the years ahead unless the security community, cellular network operators, smartphone designers and phone users all work together to hold it in check. The history of PC malware is humbling, but it offers lessons that will help us to anticipate some of the ways in which mobile virus writers will strike next and to take steps to thwart them.

A Rising Tide

In 1988 many computer experts dismissed viruses as inconsequential novelties. That assessment proved regrettably naive. For mobile malware, the time is now 1988, and we have a brief window in which to act to avoid repeating the mistakes of the past.

One such mistake was to underestimate how quickly malware would grow in prevalence, diversity and sophistication. Prevalence is a function of both the population of potential hosts for virtual pathogens and of their rate of infection. The target population for malicious mobile software is enormous and growing by leaps. There are now more than two billion mobile phones in the world.

It is true that the great majority of these are older cell phones running closed, proprietary operating systems that are largely immune from viral infection. But customers are quickly abandoning these devices for newer generations of smartphones that run more open operating systems, Web browsers, e-mail and other messaging clients and that contain Flash memory card readers and short-range Bluetooth radios. Each of these features offers a conduit through which malware can propagate.

Bluetooth, for example, allows certain mobile worms to spread among vulnerable phones by mere proximity, almost like the influenza virus. A Bluetooth-equipped smartphone can identify and exchange files with other Bluetooth devices from a distance of 10 meters or more. As victims travel, their phones can leave a trail of infected bystanders in their wake. And any event that attracts a large crowd presents a perfect breeding ground for Bluetooth viruses.

A particularly nasty form of Cabir, for example, spread so rapidly through the audience at the 2005 world track and field championships in Helsinki that stadium operators flashed warnings on the big screen. Most smartphones can put Bluetooth into a “nondiscoverable” mode that protects them from invasion by worms. But few users avail themselves of this feature. While giving a talk at a computer security conference this spring, I conducted a quick scan of the room and found that almost half the professionals in the audience had left the Bluetooth radios in their phones wide open. The proportion is even higher among the general population, so these devices offer a disturbingly effective vector for invisible parasites.

And this host population is growing rapidly. Smartphones got started as expensive business models, but their popularity with consumers has recently taken off. With each generation the devices accrete more PC-like functionality. At the same time that smartphones have begun sporting features such as video cameras, GPS navigation and MP3 players, their prices have dropped—subsidized in part by network operators, who hope the new capabilities will encourage customers to spend more on cellular services. Manufacturers sold more than 40 million smartphones last year, and industry analysts expect to see 350 million units in service by 2009.

In the medium term, these devices may be adopted most quickly in emerging economies, where computer ownership is still relatively low. Research by Canalys, a high-tech consultancy near Reading, England, found that smartphone sales in the first quarter of this year grew twice as fast in eastern Europe, Africa and the Middle East as they did in western Europe. Industry analysts predict that some developing nations will choose to forgo construction of a wired Internet infrastructure and will instead upgrade their digital wireless networks and promote smartphones as affordable computers. The wireless route can be much less expensive to construct and maintain (and, from a censor’s perspective, much easier to monitor and control).

If these forecasts prove accurate, smartphones could in the very near future make up most of the world’s computers. And huge populations of users who have little or no experience with computers could soon be surfing the Web and sharing files with their phones. They would present mobile malware creators with an irresistibly large and unwary target.

One lesson from PC viruses is that the bigger the target, the bigger the attraction for nefarious programmers. The vast majority of desktop malware works only on the ubiquitous Microsoft Windows operating system. For the same reason, nearly all the mobile worms and Trojan horses released so far infect the Symbian operating system, which runs some 70 percent of smartphones worldwide—including phones made by Nokia, Samsung, Sony Ericsson and Motorola. In contrast, only a few varieties of malware infect Microsoft’s PocketPC or Windows Mobile, Palm’s Treo, or Research in Motion’s BlackBerry devices. The Symbian bias partly explains why mobile malware is currently most prevalent in Europe and Southeast Asia, where Symbian is commonplace, but is rarer in North America, Japan and South Korea. Cellular operators in North America have spread their markets more equally across the various platforms. The Japanese and Korean markets were dominated for a long time by Linux-based phones, and carriers there heavily restrict the types of applications that users can install on their phones.

Carriers would be wise to begin educating cellular customers now about how to identify and avoid mobile viruses, rather than waiting until these infections become epidemic. Phone makers should install antivirus software by default, just as PC manufacturers now do. And regulators and phone companies can also help avoid the monoculture problem that plagues PCs by encouraging a diverse ecosystem for smartphones in which no single variety of software dominates the market.

A Malware Primer

PHISHING SCAM

Fraudulent Web page, e-mail or text message that entices the unwary to reveal passwords, financial details or other private data.

SPYWARE

Software that reveals private information about the user or computer system to eavesdroppers.

TROJAN HORSE

A program that purports to be useful but actually harbors hidden malicious code.

VIRUS

Originally, computer code that inserts itself into another program and replicates when the host software runs. Now often used as a generic term that also includes Trojan horses and worms.

WORM

Self-replicating code that automatically spreads across a network.

From Kicks to Crime

Diversity cuts both ways, of course. Over time malware, too, inevitably mutates into new species that attack and subvert useful software in an ever widening variety of ways. On the PC, the early viruses were eventually joined by Trojans, worms, spyware and most recently phishing attacks. Since 2003 much of the new malware appearing on PCs has been written for profit rather than for mere mischief. Organized gangs of cyber-criminals now operate all over the world. Thieves use crimeware to make money by stealing financial data, business secrets or computer resources. Spam mers assemble “botnets” of hacked machines to forward bulk e-mail and phishing scams. And blackmailers extort money with threats of digital destruction or of virtual blockades that shut down a company’s Web or e-mail servers. In some countries, cyber-criminals are virtually untouchable because authorities lack the technical expertise, resources or will to enforce laws against computer crimes.

As for-profit virus writing increases, the likelihood of severe mobile malware attacks escalates as well. After all, every phone call placed and every text or multimedia message sent is also a financial transaction. That opens up a flood of potential earning opportunities for profiteer hackers and virus authors. Computers do not have a built-in billing system; mobile phones do. The bad guys will exploit this feature before long.

Indeed, at least one already has. A Trojan called RedBrowser sends a continuous stream of text messages from any phone it infects to a number in Russia until the user disables the phone. Each message is charged at a premium rate of about five dollars, resulting in huge bills for the unfortunate victims. Some cellular carriers hold their customers liable for such unauthorized transactions, and when they do, the criminals, who own the premium number, collect the premium fees. Luckily, RedBrowser has so far only been spotted inside Russia.

Meanwhile service providers in North American markets are beginning to introduce “mobile wallets.” Customers will be able to use their phones to transfer funds from their accounts to others by sending specially formatted text messages. PayPal, a digital payments firm, offers a similar service that allows users to buy items using their phones. Such services could be of intense interest to malware authors.

With both the sophistication of mobile malware and the technological and financial capabilities of mobile phones on the rise, we will have to move rapidly in the next couple of years. Actions now could thwart mobile malware while it is in its infancy and while smartphone services are still fairly flexible in their design. But that window of opportunity will not stay open for long.

More Dangers Ahead

The reason for haste is clear when one considers all the ways that hackers could—but have yet to—wreak havoc with smartphones. On personal computers, many of the worst culprits spread via e-mail or force infected machines to spew spam onto the Internet. None of the miscreant programs released so far for smartphones capitalize on the devices’ ability to send e-mail. It is only a matter of time until malware appears that can propagate as e-mail attachments or can turn phones into spam-sending robots.

Spyware is another mushrooming problem in the PC arena, and the potential for surreptitious software on phones to destroy privacy is obvious. Only a handful of such programs have been seen as yet. One, called FlexiSpy, periodically and invisibly sends a log of phone calls and multimedia messages, both sent and received, to a third party. The eavesdropper needs to gain physical access to the phone to download and install the spying program.

It may not be long, however, before hackers incorporate this kind of eavesdropping behavior into viruses that replicate on their own. With new phones featuring voice recorder capability, manufacturers should take extra care to ensure that these features cannot easily be exploited by malware to record conversations and then beam the recordings to a snoop.

Then there is the surprising fact that not one of the more than 300 forms of mobile malware released as yet exploits programming bugs or security design flaws to insert itself into a vulnerable machine. This has long been a standard modus operandi for many PC viruses and Trojans.

So far mobile malware writers have instead relied exclusively on “social engineering”—in other words, tricking users into actively allowing installation of the malicious program on their phones. Some camouflage themselves as useful utilities or desirable games. But some, especially ones like Cabir and Comm-Warrior that spread via Bluetooth, do not. Many people accept the files even when the device warns of the security risk and gives them a chance to refuse the foreign software.

I and other researchers have asked people victimized by such viruses: Why did you click “yes”? A common answer is that they did not at first—they chose “no.” But then the question immediately reappeared on the screen. A worm, you see, does not take no for an answer, and it gives the user no time to hit the menu option to disable Bluetooth. Unfortunately, even the newest versions of most smartphones permit the kind of Bluetooth harassment that effectively denies a person use of a phone until the individual accepts the file transfer (or until the user walks out of range of whatever infected device is sending the request—although few people realize they have this option).

Staying a Step Ahead

The only hope of stopping mobile malware before it seriously degrades the utility and value of smartphones is quick and concerted action on the part of all concerned. Antivirus software now available from many companies can immunize and disinfect smartphones. Yet few customers have installed such protection. That needs to change.

Phones should also incorporate firewall software that warns the user when a program on the phone seizes the initiative to open an Internet connection. This is an especially important form of protection for smartphones that can connect to Wi-fi (also called 802.11) networks and thus directly to the public Internet. Many cellular companies aggressively filter traffic on the GPRS or UMTS data networks that their mobile devices use; open Wi-fi networks have no such protection. And while some carriers already filter their MMS streams to remove messages bearing malicious attachments, all should do so.

Some of the biggest phone manufacturers have joined the Trusted Computing Group, which has been hammering out industry standards for microcircuitry inside phones that will make it harder for malware to get at sensitive data in the device’s memory or to hijack its payment mechanisms. And Symbian recently released a new version of its operating system that does an improved job of protecting key files and that requires software authors to obtain digital certificates from the company. The new Symbian system refuses to install programs not accompanied by a certificate. Unless disabled by a user, the system effectively excludes all mobile malware discovered to date.

Governments could also play a more constructive role than they have so far. Even though most countries have passed laws against hacking both ordinary computers and the computers inside cell phones, enforcement is lax or nonexistent in most of the world. Many of the nations hit hardest so far by mobile malware outbreaks, such as Malaysia, Indonesia and the Philippines, do not always collect reliable and timely statistics that could be helpful for tracking software crimes.

For our part, my team and others in the security research community have been proactively studying Symbian and PocketPC, looking for vulnerabilities in the code and in the system designs that might afford entrée to malware. We hope to find these holes so that they can be patched before the bad guys exploit them in the inevitable next round of this constant battle.

--Originally published: Scientific American 295(5), 70-77. (November 2006)

The Ultimate Database

by Simson L. Garfinkel

A few years ago I bought a latte at Starbucks on the way to the airport, parked my car and got on a flight for the U.K. Eight hours later I got off at Heathrow, bought a prepay chip for my cell phone and went to buy a ticket for the train into London, when my credit card gave up the ghost and refused to work anymore. Not until I got back to the U.S. did I find out what had happened. Apparently, the small purchase at Starbucks, followed by the overseas purchase of the cell phone card, had tripped some kind of antifraud data-mining algorithm in my credit-card company’s computer. It tried to call me, got my voice mail and proceeded to blacklist my credit card.

What I found so exasperating about the entire experience was that the computer should have known that the person using my card in England was me. After all, I had bought my plane ticket with that same card and had flown with a major U.S. carrier. Aren’t all those databases supposed to be tied together?

Most people probably assume they are. We have come to expect from Hollywood films such as Enemy of the State and the Jason Bourne trilogy that shadowy organizations have instant access to all the databases we rely on and, with a few keystrokes, can spy on our every movement. The process of collecting information from multiple sources and merging it, known as data fusion, is supposed to create an information resource that is more powerful, more flexible and more accurate than any of the original sources. Proponents of data fusion say that their systems let organizations make better use of the data they already have; critics say that fusion threatens civil liberties by using information in ways that were never envisioned when it was first collected. Both sides assume that data-fusion systems actually work. The reality is that the systems are nowhere nearly as omniscient, as reliable or as well developed as many people think.

Out of Many, One

The technology of data fusion can trace its heritage back to the computerized matching programs of the 1970s. When Congress passed the Privacy Act in 1974, it also authorized the creation of the Federal Parent Locator Service, which now operates a giant blacklist, denying a wide range of federal benefits such as passports to noncustodial parents who are behind on their child support. Those data are fused with the National Directory of New Hires to find recently employed parents who are not up to date on their payments so that their wages can be garnished.

The term “data fusion” entered the technical vernacular in 1984, when researchers at Lockheed Martin’s Advanced Technology Center published two articles about a “tactical data fusion” system that would meld battlefield information from sensors, databases and other sources in real time for human analysts. Since then, the idea has blossomed. Bioinformatics investigators speak of genomic data fusion. The Department of Homeland Security has spent more than $250 million setting up some 58 state or local fusion centers. Nielsen, the consumer marketing company, has developed data-fusion products for identifying and targeting potential customers with specific characteristics, rather than wasting effort on the traditional scattershot approach to marketing.

But although data fusion has many faces, its use in identifying potential terrorists has stirred the greatest public debate. “The key to detecting terrorists is to look for patterns of activity indicative of terrorist plots based on observation of current plots and past terrorist attacks,” wrote Rear Admiral John Poindexter and Robert L. Popp of the Defense Advanced Research Projects Agency (DARPA) in 2006. They argued that the World Trade Center bombing of 1993 and the Oklahoma City bombing of 1995 might have been prevented if the government could have scanned commercial databases for large purchases of fertilizer by nonfarmers. But getting those purchase records and combining them with a database of farm ownership and employment records would have required unprecedented government access to private computer systems. Every transaction—and thus every person—in the country would have been monitored without probable cause. For these reasons, among others, Congress killed Poindexter and Popp’s research program, the Total Information Awareness project, in 2003.

Do Not Fold, Spindle or Mash

A wall of government secrecy does nothing to allay civil libertarians’ fears. Agencies have revealed little about the data-fusion systems that they may or may not have deployed to protect national security: they argue that the bad guys would have an easier time evading fusion programs if they knew how they work. But enough information is publicly available to indicate that data fusion poses more than just ethical and legal problems; it also raises technical issues.

Data quality is one. Much of the information in databases was originally collected for purely statistical purposes and may not be accurate enough to make automated judgments with potentially punitive outcomes. In 1994 Roger Clarke of the Australian National University in Canberra studied computerized matching programs maintained by federal and state governments in the U.S. and Australia. These systems scanned millions of records and flagged thousands of potential “hits.” But most turned out to be false positives. For example, one program for finding welfare cheats matched the employment records of the Department of Health and Human Services against the welfare rolls of the counties surrounding Washington, D.C. It generated roughly 1,000 hits, but further investigation showed that three quarters of the people identified were innocent. The benefits did not justify the costs of collecting data, training personnel and chasing down the false positives.

Many people feel that if a data-fusion program could anticipate and stop a major terrorist attack, it would be worth whatever it cost. Poindexter, a career naval officer, compared the technical problems to finding an enemy submarine in the vastness of the ocean. But finding the signatures of terrorist preparations in an ocean of data is much harder than finding subs in an ocean of water. The world’s oceans may be huge, but every spot can be uniquely identified by a latitude, longitude and depth. The data oceans are not so easily categorized. Moreover, the world’s seas are not doubling in size every few years, as the data oceans are. Much of information space is unmapped; data are spread across millions of individual computer systems, many hidden or otherwise unknown to the authorities.

Fusion is hard because we are drowning in data from a multitude of sources, all with different levels of detail and uncertainty. The real challenge in data fusion is not getting the data but making sense of them.

What’s on Your Hard Drive?

A good way to understand the data-fusion problem is to start with the information on the hard drive of your computer. Between 1998 and 2005 I did just that: I purchased more than 1,000 used hard drives on eBay, at small computer stores and at swap meets; I even scavenged some from computers left abandoned on street corners. In January 2003 Abhi Shelat, now a computer scientist at the University of Virginia, and I published a paper detailing what we found.

About a third of the drives were no longer functional, and another third had been properly wiped before being discarded. But the remaining third were a jackpot of personal information: email messages, memoranda, financial records. One drive had previously been part of an automatic teller machine and recorded thousands of credit-card numbers. Another had been used by a supermarket to submit credit-card payments to its bank. Neither drive had been properly wiped before being resold on the open market.

The tools that enabled me to search the drives are widely available and not particularly sophisticated. Police departments around the world use the same kinds of tools to recover files from computers and cell phones. Sometimes users are unaware of the digital bread crumbs they leave. Consider the case of the so-called BTK killer, who committed eight murders in Wichita, Kan., in the 1970s and 1980s, then went underground. The killer resurfaced in March 2004, sending a letter to the Wichita Eagle detailing his earlier crimes and a floppy disk with a Microsoft Word document on it to a local television station. The file contained “metadata” that linked it to a computer at a local church. Police discovered that the person who had used it was president of the congregation council—and the killer.

Making a Hash of the Files

But figuring out which documents are important and which are worthless is difficult and requires fusing outside knowledge with the information on the hard drive. For example, when I started analyzing hard drives back in the 1990s, many of them contained copies of the Island Hopper News. It seemed highly suspicious. Then I learned that this electronic newspaper was actually a demo file distributed by Microsoft with a product called Visual Studio 6.0. Had I been unaware, I might have drawn spurious conclusions about the drive’s previous owners.

The only way to screen out innocent files is to sample the world of digital documents and build a list of those that are widely available. One fast, automated way to do so is to create a so-called hash set. Cryptographic hash algorithms can assign a unique electronic fingerprint to any digital file. Two of the most popular are MD5, which creates a 128-bit fingerprint, and SHA-1, which generates a fingerprint 160 bits long. Then, instead of comparing two files byte by byte, forensics tools can examine the fingerprints.

Supported by a grant from the Department of Justice, the National Software Reference Library at the National Institute of Standards and Technology (NIST) acquires software from hundreds of publishers and reduces every file to a cryptographic hash. NIST then distributes the database, which now has more than 46 million entries, to give forensic investigators a quick and reliable way of purging files that have been distributed by software publishers—files such as the Island Hopper News—and can therefore be safely ignored. Databases available from other federal agencies include e-fingerprints of computer hacker tools and of child pornography.

But despite their utility, hash databases represent only a small sampling of all the documents out there. To augment them, I developed a technique called cross-drive analysis. It can automatically piece together information scattered across thousands of hard drives, USB memory sticks and other data sources. The technique highlights and isolates identifiers such as e-mail addresses and credit-card numbers and weights them according to how frequently they appear: presumably the more common the identifier, the less important it is. Finally, the technique correlates the identifiers across all the individual devices: if an e-mail address or credit-card number appears on only two disk drives among thousands, there is a good chance that those two drives are related.

Who’s Who?

Yet another problem for data fusers is identity. In the electronic world there may be dozens of people sharing the same name and dozens of names used by the same person. Some databanks may list Poindexter as John Marlan Poindexter or J. M. Poindexter or even misspell the rear admiral’s last name Pointexter. A person’s first name may be listed in one database as Robert, in another as Rob and in a third as Bob. A person whose Arabic name is transliterated Haj Imhemed Otmane Abderaqib in West Africa might be known as Hajj Mohamed Uthman Abd Al Ragib in Iraq.

Matching up the various names and account numbers that inhabit the electronic world with physical bodies is called identity resolution. Without it, data fusion is impossible. Curiously, a great deal of innovation in identity-resolution systems has been driven by casinos in Las Vegas. Under Nevada law, casinos are required to bar self-declared problem gamblers from playing their games. These gamblers voluntarily place their names on a list saying, in effect, “Don’t let me gamble again!” But gambling can be an illness, and some people on the list still try to sneak in by changing their name or swapping a few numbers in their birth date. Casinos are also determined to exclude suspected or convicted cheaters. And if a guest is winning large sums at the blackjack table, a casino wants to make sure that the dealer and the player are not roommates.

Accordingly, casinos have funded development of a technique called nonobvious relationship analysis (NORA), which combines identity resolution with databases of credit companies, public records and hotel stays. A NORA system, for instance, might discover that the blackjack dealer’s wife once lived in the same apartment building as the player who just won $100,000. In the 1990s software engineer Jeff Jonas developed a system that could match the names in a casino’s computers with other sources of information in a way that tolerates error, ambiguity and uncertainty. The system works by building hypotheses based on the data and then revising these hypotheses as new information becomes available.

For example, it might receive a driver’s license record for a Marc R. Smith, a credit report for a Ran dal Smith, and a credit application for a Marc Randy Smith. It might guess that the names belong to the same person—particularly if Marc R. Smith and Marc Randy Smith have the same driver’s license number and if Randal Smith and Marc Randy Smith share a phone number. But suppose new data show that Randy Smith, Sr., shares the birth date of Randal Smith but that his Social Security number differs from that of Marc R. Smith. Now the system might revise its guess, deciding that Marc R. Smith is Randal Smith, Jr., whereas Randy Smith is Randal Smith, Sr. The key to making all this work is programming the system so that it never confuses original data with a conclusion inferred from those data.

Jonas sold the system and his company to IBM in 2005. Since then, IBM has added a feature called anonymous resolution: two organizations can determine whether they share the name of one person in their respective databases—without sharing the names of all the people who do not match. The technique works by comparing cryptographic hashes instead of real names.

Privacy advocates still maintain that hashes, cross-drive analysis, anonymous resolution and the like do little to overcome their fundamental objections. After all, these systems still use personal information for purposes other than the ones for which it was originally acquired. They also make it routine to sweep up private data in a dragnet regardless of whether the people involved are suspected of committing a crime. Yet these systems generate significantly fewer false positives than did those developed in the 1980s. At some point the social benefits may come to outweigh the privacy costs of having a computer snoop through people’s records.

Putting It All Together

So just how well do fusion systems actually work? Data quality remains a serious problem. Pull your credit report from each of the nation’s three major credit-reporting agencies, for instance, and each report will probably contain errors and inconsistencies. Those data can lie dormant for years without causing much trouble. The danger arises when some newfangled algorithm reads too much into the inconsistencies.

Even when data are accurate, relationships brought to light by comparing databases may have real meaning or may be purely coincidental, as inevitable as finding two people in a room who share the same birthday. Maybe the four people who meet once a week to take a long drive are planning a crime. Then again, they may belong to a softball team and travel together to each week’s big game.

Society’s expectations for data fusion may be unreasonably high. If terrorists blend in with the population, human investigators and computers alike will be hard-pressed to find them. Most systems of data mining and fusion have some kind of sensitivity adjustment: move the slider to the left, and the system fails to find genuine matches; move it to the right, and the system makes too many predictions that turn out to be wrong. Where should the slider be set? If a system flags every third airline passenger, it will be more likely to spot a real terrorist. But it will also bring air traffic to a standstill and overwhelm law enforcement.

If a data-fusion system does not work as desired, its algorithms could be fundamentally flawed. But the problem could also be a dearth of data. Likewise, if the system is performing well, giving it more data might make it perform even better. In other words, the people building and using these systems are naturally inclined to want more and more input data, no matter how well the systems are working. Thus, data-fusion projects have a built-in tendency toward mission creep—to the consternation not only of civil liberties advocates but also of those footing the bill. In his 1994 article Clarke concluded that trade-offs “between the State’s interest in social control and individual citizens’ interest in freedom from unreasonable interference [are] being consistently resolved in favor of the State.”

What makes the public debate over data fusion so frustrating to me as a scientist is the fact that so little information has been publicly released about data-fusion systems in actual use. It hearkens back to the cryptography debates of the 1990s, when the U.S. government argued that there were good reasons for legally restricting the use of cryptography but that those reasons were so sensitive that discussing them in public would be a threat to national security. I suspect a similar debate is brewing over the government’s use of data fusion, not to mention the applications of this powerful technology in business and even in political activities. It is a debate well worth having—and having in public.

--Originally published: Scientific American 299(3), 82-87. (September 2008)

SECTION 3

The Solutions

How to Keep Secrets Safe

by Anna Lysyanskaya

Zack has decided to try out the online dating service Chix-n-Studz.com. He signs up for an account at the Web site and fills in several screens of forms detailing his personal profile and what he is looking for in a potential partner. In no time at all, the service offers him a number of possible soul mates, among them the very exciting-sounding Wendy. He sends her his e-mail address and what he hopes is an engaging opening message. She replies directly to him, and a whirlwind e-romance begins.

Poor Zack. Soon he is also getting numerous unsolicited phone calls from political action groups and salespeople who seem to know things about him, and his health insurance company is questioning him about his extreme adventure vacations; the unscrupulous owners of Chix-n-Studz have been selling client information. Then there is Ivan, a mischievous coworker to whom Zack foolishly showed one of Wendy’s e-mails. Zack does not know that several subsequent recent messages supposedly from Wendy are fakes from Ivan.

Alice, in contrast, is on cloud nine, as is her new friend Bob. The two have met through SophistiCats.com, a matchmaking service that offers all the latest cryptographic tools. Alice logs on to its Web site protected by anonymous authorization, a system that ensures no one at the service can track who she is or when she is accessing the site. SophistiCats employs software that provides “secure function evaluation” to match her profile and partner criteria with Bob’s, so no one at the service knows their information or even that she and Bob have been matched up. Imagine: a completely effective dating service that knows practically nothing about its clients!

Alice contacted Bob using a feature known as an anonymous channel, and he replied in kind—not even her Internet service provider (ISP) knows that Bob is her contact or what the messages say, and Bob’s ISP is no better informed about her. Alice’s roommate, Eve, however, does know, but only because Alice has talked about Bob and has pinned a printout of some messages above her computer. Eve could be trouble, because she is a die-hard practical joker fully capable of tapping into and altering the data flowing to and from Alice’s computer (in fact, she controls the network that connects them both to the Internet). Never fear: encryption ensures that Eve can learn nothing beyond what Alice has shown her, and the coded “digital signatures” on Alice’s and Bob’s e-mails have made it a cinch for them to spot and ignore Eve’s spoof messages.

Everything Crypto

Like Alice and Zack, most of us conduct many of our daily personal, business and government transactions electronically. We do so many things online—from staying in touch with friends to buying and selling everything, including the kitchen sink—that getting comprehensive information about most people is as easy as logging, or recording, their online activities. And for various reasons, ISPs are already logging our activities, such as which sites we have visited and when. They are not alone. Many entities we interact with online—stores, newspapers, dating sites, and the like—keep close tabs on us as well. Thus, if we value privacy, we face the challenge of how to take advantage of everything the Internet has to offer without giving up our privacy.

An amazing discovery of modern cryptography is that virtually any task involving electronic communication can be carried out privately. Many people, including the editors of most dictionaries, mistakenly think that “cryptography” is synonymous with the study of encryption. But modern cryptography encompasses much more. It provides mathematical methods for protecting communication and computation against all kinds of malicious behavior—that is, tools for protecting our privacy and security.

Suppose, for instance, that all the members of a group connected by the Internet want to compute something that depends on data from each of them—data that each wants to remain private. The data could be their vote in an election, and they want to know the outcome without revealing their individual votes. A procedure known as multiparty computation or secure function evaluation (SFE) enables them to tally their votes in such a way that each participant learns the correct output and no one can learn anyone’s individual vote—not even a coalition of malevolent insiders capable of intercepting messages on the network and substituting their own carefully crafted fake data. The SFE protocol can also provide each individual with a private output, as done by the fanciful SophistiCats service.

The basic idea behind SFE is that each participant’s inputs are split into pieces, or shares, and distributed among the others in the group. Each participant then operates on the shares under his or her control (adding them, redistributing shares of the result, and so on). Finally, the group brings the pieces together again to get the final output. No one ever has the data needed to reconstruct another person’s inputs.

It may not seem surprising that a function as simple as adding up votes can be evaluated securely, but recall what SophistiCats did for Alice: it worked out which members among its thousands of clients were good matches for her and gave her some limited information about those matches, all without itself learning anything about her profile or anyone else’s. A Big Brother organization eavesdropping on the network traffic or combing through the data on SophistiCats’s hard drives would be similarly incapable of learning anything. SophistiCats is a fictional service, but cryptography investigators have shown how to turn it into fact. Indeed, this past January, SFE was used for the real-world problem (in Denmark, at least) of setting the price for sugar beet contracts to be traded among some 1,200 Danish farmers, based on bids that they inputted privately. Through SFE we can all have the best of both worlds: the functionality that we want over the Internet without sacrificing privacy.

Although the SFE protocol makes possible a wide range of capabilities, its power and generality come at a price: it takes a large amount of computation and communication. The protocol is efficient enough for special tasks such as elections, yet it is too cumbersome to be pressed into service every time you click on a link to a secure Web page. Instead computer scientists have developed specialized protocols that are much more efficient than SFE for particular common tasks. These include:

Encryption. Neither Alice’s ISP nor Eve can decipher the messages Alice sends to Bob. The traffic between Alice’s computer and SophistiCats is secure as well.

Authentication. Alice can be sure messages come from Bob, not Eve.

Anonymous channels. Alice’s ISP cannot tell to whom she has sent the messages or that she has ever visited the SophistiCats Web site.

Zero-knowledge proof. Alice can prove to someone else that something is true without revealing what her proof is.

Anonymous authorization. SophistiCats knows that she is a member when she accesses its Web site, but it cannot tell who she is. This protocol is a special case of a zero-knowledge proof.

Secret Messages

The oldest and one of the most fundamental problems studied in cryptography is that of encryption—the problem of how to communicate securely over an insecure channel (one on which an adversary can eavesdrop). Alice wants to send a message to Bob, but Eve has control over part of the channel (through the apartment’s network) that Alice will use. Alice wants Bob, but not Eve, to be able to read the message.

In analyzing this problem, notice, first, that Bob must know something that Eve does not—otherwise Eve would be able to do whatever Bob can do. Bob’s private knowledge is called his secret key (SK). Second, notice that Alice must know something about Bob’s SK so that she can create a ciphertext—an encrypted message—specifically for Bob. If Alice knows the SK itself, the protocol is called secret-key encryption, the kind of encryption that has been known and practiced for centuries.

In 1976 Whitfield Diffie and Martin E. Hellman, both then at Stanford University, envisioned another possibility, called public-key encryption, in which Alice need not know the SK. All she needs is a public value related to the SK called Bob’s public key (PK). Alice uses his PK to encrypt her message, and only Bob, with his SK, can decrypt the resulting ciphertext. It does not matter that Eve also knows Bob’s PK because she cannot use it to decrypt the ciphertext. Diffie and Hellman proposed the public-key idea but did not know how to carry it out. That came a year later, when Ronald L. Rivest, Adi Shamir and Leonard M. Adleman, all then at the Massachusetts Institute of Technology, gave the first construction of a public-key cryptosystem: the RSA algorithm.

Their algorithm works for public-key encryption because it involves a so-called trapdoor function. Such a function is easy to compute, to produce the ciphertext, yet hard to invert, to recover the plaintext, unless a special “trapdoor” is used. The trapdoor serves as the secret key. The RSA algorithm was the first example of a function with a trapdoor property. For this work they won the 2002 A. M. Turing Award, the most prestigious prize in computer science.

The RSA discovery , hailed as a fundamental cryptographic breakthrough, fueled years of subsequent research in encryption and in cryptography more generally. Much hard work on encryption still remains, from finding new trapdoor functions, to studying the mathematical assumptions that underpin the security of a specific function, to defining precisely what is required for an encryption system to be considered secure.

Public-key encryption makes it possible to purchase things online without sending sensitive information such as credit-card numbers openly on the Internet. The customer’s Web browser plays the role of Alice and the Web site the role of Bob. More generally, https, a protocol that most browsers now support, uses public-key encryption to provide Web browsing over an encrypted channel—look for “https://” in the URL (the address of the Web site) and an icon such as a closed padlock on the browser’s status bar.

Many people also use public-key encryption for secure e-mail. Plenty of free software exists for that purpose, including the GNU Privacy Guard package (available at www.gnupg.org) first released by the Free Software Foundation a decade ago. If you do not encrypt your e-mail, over it travels across the Internet in a form that is easy to read and may remain in that form on various hard drives along the way for some time afterward.

Hi, It’s Me!

Closely associated with the problem of encryption is that of authentication. Suppose Alice receives the message “Alice, please send Eve $100. Love, Bob.” How does she know that it really came from her boyfriend Bob and was not in fact fabricated by Eve?

Just as in the encryption scenario, Bob must know something that Eve does not so that he, but not Eve, can produce a message that Alice will accept. Thus, Bob again needs a secret key. Moreover, Alice needs to know something about Bob’s SK to be able to verify that the message is from Bob. Once again, two varieties of protocol exist: secret-key authentication, more commonly known as a message authentication code, and public-key authentication, frequently referred to as a digital-signature scheme. Diffie and Hellman first envisioned digital-signature schemes at the same time that they proposed public-key encryption, and a scheme using the RSA algorithm was the first one constructed.

The chief idea is that Bob uses his SK to compute a “signature” that he appends to his message and that Alice or anyone else then uses his PK to verify that it matches the message itself. Alice knows the message must be from Bob because no one else has the SK needed to produce the valid signature.

Currently it is easy to trick an e-mail client into thinking that a message came from Bob when in fact it came from Eve. A spoofed e-mail may include fake news reports and incorrect stock quotes, tricking people to act against their best interest. But if all e-mail communication were authenticated, such an attack would be impossible: your e-mail client would digitally sign all outgoing messages and would verify the digital signatures of all incoming messages. Authentication could also combat spam by having servers reject incoming e-mail that is not authenticated by its sender. Authentication protocols did not exist when e-mail was developed in the 1970s, and many conventions from that era still prevail.

Software that everyone can use to sign their e-mail and verify signatures is freely available, for instance, as a part of the GNU Privacy Guard package mentioned earlier.

Onion Routing

By encrypting your messages, you can prevent ISPs (or any other eavesdropper) from discovering what you send and receive, but not to whom you are communicating. For example, Alice’s ISP will know if she browses an Alcoholics Anonymous Web site. Imagine if the ISP were to sell this information to car insurance companies. People would be less likely to seek help online because they would be worried that it would increase their insurance premium.

This problem could be solved with SFE: Alice’s private input would be the URL she wants to look at, and her private output would be the contents of the Web page she wants to see. Using SFE, however, would be highly inefficient. In 1981 David Chaum, then at the University of California, Berkeley, proposed a much simpler solution called anonymous channels, now also known as onion routing.

As the name suggests, Alice wraps her message in layers. She encrypts each layer (and everything inside it) with a different person’s public key and then adds that person’s address to the outside of the layer. A message from Alice to Bob could travel as follows: Alice sends the onion to Mark, who can peel off the outermost layer by decrypting the onion with his secret key. Inside, Mark finds a smaller onion and Lisa’s address. He forwards that onion to Lisa, who can decrypt it with her key, and so on. Finally, Bob receives the onion core from someone, and he decrypts it to find Alice’s message.

In practice, the intermediaries are part of a network of computers set up to handle the decryption and forwarding automatically. Ideally, each intermediary continually receives lots of onions and forwards them in random order. Even if an ISP is watching all the intermediaries at all times, it cannot tell where Alice’s message went or where Bob’s came from, provided there is enough onion traffic on the network.

Bob himself does not know who sent the message, unless Alice chooses to reveal her identity in the message. Yet even if she remains anonymous to him, he can still send her an anonymous reply if she includes a “reply onion” containing the layers of addresses and public keys needed to route a message back to her.

Alice’s and Bob’s messages can remain untraceable even if some of the intermediaries leak information about what they are doing. As more participants use this system and volunteer their computers to serve as intermediaries, it becomes harder to figure out who is talking to whom.

As with encryption and digital signatures for e-mail, free software is available for anyone to communicate over anonymous channels or to participate as an intermediary. The Onion Router (Tor) project, for instance, can be found at www.torproject.org.

Private Log-ins

Let’s say Alice has a subscription to the online magazine SophistiCat American. She connects to the magazine via an anonymous channel, logs on with her user name and password, and takes good care that all her incoming and outgoing messages are encrypted. Does that mean she can rest assured that no one will find out what she is doing online? Of course not—the magazine knows exactly what Alice is doing.

Alice might try to cover her tracks by using a pseudonym when she subscribes, but the reading habits of this pseudonymous user may quickly point to Alice’s identity. She may reveal her zip code to look at a weather forecast, type in her birth date to check her horoscope and give away her likely gender by reading about topics such as breast cancer. Those three pieces of information—zip code, date of birth and gender—are enough to uniquely identify 87 percent of the U.S. population.

Surprisingly, Alice’s problem has a cryptographic solution called anonymous authorization. Alice can prove to the magazine that she is a valid subscriber each time she accesses its Web page. Yet this proof reveals nothing about which subscriber she is—not even, say, that she is the person who accessed it a few hours earlier. The protocol is a special case of the more general zero-knowledge proof protocol.

With a zero-knowledge proof, Alice can convince Bob that a statement is true without revealing why it is true or, in fact, without revealing any extra information at all. To prove the statement “I am an authorized user of SophistiCat American,” the online magazine or a third-party service would issue a unique credential—something like a secret key—to Alice when she subscribed. Each time the magazine subsequently challenged her, she would use that key to prove she had a valid credential, without revealing the credential itself. With credentials from various authorities, Alice could provide a zero-knowledge proof of more complicated statements such as “I am an authorized user and over 18.”

The basic idea of how a zero-knowledge proof works is illustrated by the scenario described in the box on the opposite page, in which Alice proves to Bob that she has colored a diagram in a special way (technically, that she has “three-colored a graph”) without showing Bob how she colored it. Three-coloring a graph is a so-called NP-complete problem. For the present discussion, what is important about “NP-complete” is that you can pick any statement for which you have a reasonably short proof and concoct a version of Alice and Bob’s game to give a zero-knowledge proof of your statement.

The three-colorability protocol demonstrates the principles that make zero-knowledge proofs possible, but it is not very efficient in practice—similar to the way that general secure function evaluation is inefficient. Fortunately, cryptography investigators have developed similar protocols for specific kinds of credentials that can serve for efficient anonymous authorization.

Breaking the Codes

How secure is secure? When Alice encrypts a message to Bob, just how difficult is it for Eve to decipher the message? And what if Eve has some inside knowledge or opportunities to try to game the system? For instance, she may already know something about the encrypted message—say, that it is the name of a local café where Alice and Bob are going to meet in person for the first time. Or if “Bob” is a secure Web server, Eve might send it carefully chosen gibberish in place of ciphertext and, from its responses, learn clues about its secret key. A widely accepted definition of security for public-key encryption covers all those bases and requires that Eve gain not even a little usable information. Among others, the GNU Privacy Guard package passes the test.

Analyzing the security of a cryptosystem is a highly developed science. Contrary to the common perception, cryptography is not a cat-and-mouse game in which a system is presumed to be secure merely because no one has shown how to break it. Instead many building blocks of cryptography rely on well-studied mathematics problems. Cryptographers cannot prove with absolute certainty that such a cryptosystem is unbreakable, but they do prove that any algorithm to break it would also answer a fundamental question that has stymied the best mathematicians and computer scientists.

Some protocols depend only on the existence of a particular kind of mathematical function. For instance, cryptographers know how to construct a public-key cryptosystem out of any trapdoor function. Thus, if someone breaks the functions used in RSA, others that were still standing could be substituted.

Only rarely is a scheme assumed secure on a more ad hoc basis. But that is done only after hundreds of leading researchers around the world have studied the algorithm for several years. The cryptography community can only afford to carry out that process for a few critical building blocks. They then prove the security of larger systems assuming the security of the building blocks.

Showing You Belong without Saying Who You Are

A subscriber to a Web site could sign on as a legitimate, registered user without revealing any identifying information by using anonymous authorization. The Web site would not even be able to associate the user with his or her previous visits. Such a protocol is an example of a zero-knowledge proof, in which one party proves a fact without revealing anything about the proof but its validity.

Credit: Matt Collins

Cryptographic protocols can provide surprisingly versatile solutions to seemingly impossible privacy problems (such as anonymous authorization). But many of the privacy problems we face do not appear cryptographic in nature. If Alice is under constant surveillance in the physical world, it is small consolation that her online activities are secure. In London, cameras already watch public spaces in the interest of law enforcement. Perhaps, to protect privacy, building owners could administer the data from cameras on their property, and SFE could manipulate the data to, say, track suspects leaving a crime scene without storing everyone else’s activities in a central database. More generally, when privacy is threatened by a system such as public surveillance, we should ask ourselves, What problems is the system trying to solve? And can we keep our privacy by using cryptography in solving them?

--Originally published: Scientific American 299(3), 88-95. (September 2008)

Improving Online Security

by John Rennie, et al

QUIS CUSTODIET IPSOS CUSTODES? worries the classical Roman maxim: “Who watches the watchmen?” But the security vendors who stand guard over today’s networked information systems are under considerable scrutiny from their competitors, their customers, hackers and, increasingly often, governments concerned about national security. In May, 2008, Scientific American’s then-editor-in-chief John Rennie sat down in Palo Alto, Calif. with representatives from the security industry—and from some of the industries that will rely on the protections they provide—to discuss the challenges they will confront. What follows is an edited transcript of some highlights of those proceedings.

—The Editors

THE PARTICIPANTS

Rahul Abhyankar

Senior Director of Product Management, McAfee Avert Labs, McAfee

Whitfield Diffie

Vice President and Fellow, Chief Security Officer, Sun Microsystems

Art Gilliland

Vice President of Product Management, Information Risk and Compliance, Symantec

Patrick Heim

Chief Information Security Officer, Kaiser Permanente

John Landwehr

Director, Security Solutions and Strategy, Adobe Systems

Steven Lipner

Senior Director of Security Engineering Strategy, Microsoft

Martin Sadler

Director, Systems Security Lab, HP Labs, Hewlett-Packard

Ryan Sherstobitoff

Chief Corporate Evangelist, Panda Security US, Panda Security

Who Is Responsible?

The panelists agreed on certain priorities for maintaining or strengthening data security. Some of these were technological, but regulatory and legal frameworks were also crucial.

DIFFIE: The foremost influence on these things in the next decade is going to be Web services and what I call digital outsourcing. We’re going into a world where there will be a million computational services that somebody else can do for you better than you can do for yourselves. Ten years from now you’ll look around and see what we call secure computing today will not exist. So what is going to be needed is a legal framework that obliges contractors to protect the security of the information. But they cannot respond to the obligation unless the technical machinery can be developed to allow them to protect that information.

GILLILAND: Yes, but if you look at how customers are actually implementing technology today, they’re already far behind what it can do. That’s not necessarily the problem now. It’s how do we make this technology practical so that customers can actually address their own privacy issues, their own auditing processes, and manage the protection of their data for themselves to current standards, which for the most part they’re not doing today.

LIPNER: For the business customers, you want the sort of things that Art and Whit are talking about: assurance about what will be done with your data, ways to describe the restrictions on it, and so on. For the consumers, you want an environment that they trust and that just works—because a lot of the growth of the Internet and Internet business is based on consumer confidence. We need to increase that confidence and ensure that it’s justified.

GILLILAND: The interesting balance that we have to figure out is, How do you enable businesses to continue to share information as rapidly as possible so they can make good decisions and yet make that sharing simple?

The Dangerous Human Element

Users themselves can be the Achilles’ heel of security systems because of their propensities for error and their tendency (however unwittingly) to trade data safety for ease of use. As such, it falls to technology to compensate for the potential failings of users.

HEIM: We should not underestimate the human element. I liken it to driving. The reason we have controls in place such as driver’s licenses is so that people at least have a basic understanding of the rules of the road and how to operate a vehicle safely, so that we can minimize those risks. I don’t think there’s been enough educational outreach to end users on how to use their systems safely. I’m not necessarily proposing there needs to be a “cyber driver’s license,” but you know, that probably wouldn’t be a bad idea because we see that many, many of the observed problems are behavioral in nature.

DIFFIE: See, that’s exactly what would be an utterly monstrous idea. Cyberspace is the world of the future. If you don’t have a right to be there, you don’t have a free society.

ABHYANKAR: The human element is something that we can’t ignore. We recently celebrated the 30th anniversary of spam. E-mail continues to be something that gets exploited. There is a dark underbelly to technology, and the rate of innovation that the bad guys have and the social engineering techniques they have to steal your data are that much further ahead of what the good guys have. That’s something that technology alone is not going to solve.

GILLILAND: If you look at the research that we’ve been doing, around 98 percent of the data loss is through mistakes of human error and process breakdown. Being in the security industry, we’re always going to be fighting the bad guys. But the bad guys are less of the problem around data loss. Being able to steal information is always going to be a business for somebody, and you can’t ever fight all of them 100 percent. But we can stop the large percentage that is human and process error.

HEIM: We see on a day-to-day basis that if the technology organization itself can’t anticipate the needs of the individuals, in many cases they will enable themselves to get their jobs done using consumer-grade technologies.

SHERSTOBITOFF: Right. We can’t keep your information secure if you’re going to e-mail it to yourself over Gmail so that you can work from home.

HEIM: Sure, if individuals are not enabled through secure technology, they will compensate using consumer technologies, such as putting in a wireless access router or copying data to a USB drive. So there are technological challenges, but there are challenges on the economics, too. What does it take to do information technology right? To do it securely and in a manner such that people can get their jobs done and they don’t have to backdoor the process?

DIFFIE: In short, lack of features is frequently a security problem. If the system doesn’t offer you the ability to do what you need to do securely, you will do what you need to do anyway.

The Economics of Modern Hacking

Hacking is no longer the province of curious or bored programmers. The production of malicious software is now a business, and that fact profoundly changes the scope of the challenge.

ABHYANKAR: The economic model for hacking is so well established that if it were legitimate and you were a venture capitalist looking to put money into this business, you would get good returns, right? The cost of sending malicious e-mail just keeps getting driven down. And anonymity in the network makes it harder to track down the bad guys from a legal enforcement and prosecution perspective.

SHERSTOBITOFF: A lot of the activity is not really centered on the original hackers. They’re using middlemen. When you actually investigate, you end up getting to individuals—what they call “mules”—who had no awareness or knowledge that they were becoming victims of this whole scheme. We’re seeing that result as an upsurge from these Web sites that say, “I have a great job for you! Make $1,000 a week!” Law enforcement can’t get to the hacker who created the malicious software; the hacker or the attacker is long gone. The hackers don’t actually conduct the attacks; they sell these creations for money. There’s an underground economy just on sales of these attacks. You can now purchase something for $1,200 and be a cybercriminal.

SADLER: So, given that we all understand how sophisticated the bad guys have become, what level of cooperation do you think we should be employing? Because, essentially, we still all compete. We’re fragmented, and the bad guys are coordinated. And there’s plenty of evidence that these different organized criminal elements are actually trading this stuff among themselves. We don’t have that level of cooperation among ourselves.

SHERSTOBITOFF: That’s why I would advocate a vendor-agnostic approach here. To circumvent this threat takes not only a technological approach but also a community-sharing response, with research labs working together to share what they’ve seen. Because already, not all the malware samples in our labs come from our customers. We do get them from others in the industry. At the top, we’re not like bitter rivals. It’s a common problem that the industry as a whole needs to respond to.

Better Education? Or Better Design?

Perhaps surprisingly, the panelists generally foresaw few lasting improvements in data security from better educating end users: the nature of the threats changes too fast.

LIPNER: We need to take the burden of sophisticated education off the end user and get to the point where the technology is just helping the user be secure and you’re not imposing pop-up fatigue on users, because it’s counterproductive. A lot of building secure systems is about the user experience. And I think that’s gotten short shrift across the industry.

SADLER: I don’t think we should be putting emphasis on education at all. I think it’s only education in extremely general terms that will last more than six months. You look at many of the education programs around the globe, and they’re very, very short term in what they’re telling people to do. Put in place the latest antivirus, that sort of thing.

HEIM: If people really knew the consequences of installing that free animated screen-saver widget—that in essence, they are saying, “I trust the developer of this little widget with complete access to my system and all my data”—it might change the way people behave online.

SADLER: I think there is an answer, though. You train young children, when they go out, to pay attention to the neighborhoods. “These neighborhoods are kind of safe; these are not.” The equivalent on the Internet now is, we walk out with our entire bank account into the most unsafe neighborhoods, and then we’re surprised when we’re mugged. There has to be separation of concerns. You want people to be able to download the latest screen savers, but in a part of their environment that doesn’t affect their bank account.

HEIM: But when we’re dealing with large-scale infrastructures, you need to be able to rapidly apply new patches and to maintain the stability of your environment. And it’s not always clear-cut that if you apply a security patch, that you aren’t going to come crashing down.

GILLILAND: I agree there shouldn’t be some driver’s license–like certificate for using the Internet. But why wouldn’t we have basic end-user education when you walk into a company? “Here’s your laptop, here’s your PDA. I’m going to teach you the security principles for Symantec.”

SADLER: And how long do you think those principles would last?

GILLILAND: Principles can last for a long time.

DIFFIE: It depends on what they are.

GILLILAND: “Don’t open e-mail or don’t open attachments from people that you don’t know.”

DIFFIE: That’s a hopeless rule.

LIPNER: The only way you can address that is with underlying security and authentication. You give users a choice, but they have to know there are classes of things that are safe, whether it’s Web sites or attachments or executables. If you tell a user, “You have to read the code, or you have to interpret the SSL dialogue boxes,” that’s too hard. For end users, you have to provide an authenticated infrastructure that allows them to know whom they’re dealing with.

GILLILAND: End users will violate the trust, given the opportunity, without a certain amount of education. Even if a warning pops up and says, “Warning: this site appears to be dangerous,” but the site says, “Click here to see Britney Spears naked,” they will still do it. The most effective sort of virus dissemination is always social engineering. Always.

LANDWEHR: Isn’t there another way we can look at solving this? Instead of focusing so much on how to educate users about malware, we can change the rules of the game for the hackers so they’re less interested in attacking our computers, because we’re better at protecting the information that’s on them. Then if anybody steals the files that are on the disk, they’re encrypted. If someone accidentally e-mails something, it’s encrypted. If it goes anyplace that it shouldn’t, they don’t have the keys to open it.

SHERSTOBITOFF: Agreed. In the financial community, they’re taking on the evolution of out-of-band authentication [joint authentication over two independent systems, such as a networked computer and a cell phone]. Some of the higher rolling traders are getting authentication devices: smart keys, RSA tokens. Some in the financial community are also putting anomaly detection in the back ends to detect suspicious patterns and localizations. Ultimately, financial institutions are adapting their technologies and authentication mechanisms so that they basically do not invite hackers.

LANDWEHR: We’re seeing a lot of activity around smart cards. I’ve got my smart card badge here, and it’s the same badge that I use to go into the buildings that we have around the world, but it also has a PKI [public-key infrastructure] credential on it that I can use to log on to applications, encrypt business documents and digitally sign PDF forms. There’s also a PIN code that protects it, just like an ATM card. If you steal the card from me, you get a couple of guesses on the PIN code, and then it stops working.

The International Perspective

National perspectives on data security and privacy vary greatly. In many respects, the U.S. is lagging in its response to rising threats.

SADLER: I think there’s a much greater effort in France, Germany and the U.K. to educate small businesses than in the U.S. So despite my arguing against education, I think the U.S. probably has to get some basics in place for small businesses here. Also, there’s a much better dialogue among academia, government agencies and industry in Europe, particularly in the U.K. and in Germany, than in the U.S. I don’t think the U.S. shows anything like enough common dialogue among those parties.

SHERSTOBITOFF: We’re seeing task forces emerge in Europe that are dedicated to thwarting cybercrime. They’re taking an initiative far in advance. But from our talks with the FBI, it is still not there yet in this country.

LIPNER: Because there are usages and national purposes specific to Europe and the U.S. government, additional standards will be needed. I think they’ll have to be international.

GILLILAND: Obviously, there’s a ton of different privacy regulations that go on throughout Europe. Companies are trying to figure out how to adhere to some process or some policy framework that allows them to follow as many of the rules as they can. That’s the challenge that we haven’t spent a lot of time talking about here. How do people and companies that have been trying to comply with the privacy regulations prove that they have been doing it?

--Originally published: Scientific American 299(3), 96-99. (September 2008)

Can Phishing Be Foiled?

by Lorrie Faith Cranor

Over just a few weeks, I received e-mail messages from several banks warning me that my online banking services were in danger of being deactivated, from eBay telling me that I needed to change my password, from Apple complaining that I had unpaid bills for music downloads, from an airline offering me the opportunity to earn a quick $50 for filling out a survey and from the Red Cross asking me to contribute money to help earthquake victims in China. These messages were all very convincing and looked authentic. Except for the eBay message, however, they were all fraudulent e-mails known as “phish.”

Phish e-mails are constructed by con artists to look like legitimate communications, often from familiar and reputable companies, and usually ask victims to take urgent action to avoid a consequence or receive a reward. The desired response typically involves logging in to a Web site or calling a phone number to provide personal information. Sometimes victims need only click on links or open e-mail attachments for their computers to become infected by malicious software—known as malware—that allows phishers to retrieve the data they want or take control of the victim’s computer to launch future attacks. Although the details of phishing scams can vary, the result is usually the same: thousands of unsuspecting victims give information to criminals who then use it to break in to their accounts and steal their money or identities, or both.

HOW PHISHING WORKS

Phishing can take several forms, but the goal of phishers is always to lure people into giving up information by making them think they are interacting with a known and trusted company or person. Phishers are criminals seeking to profit from the information they acquire. In some cases, they also implant malicious software that controls a computer so that it can participate in future phishing scams.

Credit: George Retseck

The Anti-Phishing Working Group, an international consortium of organizations committed to wiping out Internet scams and fraud, keeps track of phishing activity, including the number of unique phishing Web sites detected every month. In 2007 monthly totals ranged as high as 55,643. During each month in 2007, anywhere from 92 to 178 different company brands were “phished”—meaning their names or logos were used to fool victims into thinking they were dealing with a trusted institution. According to research and consulting firm Gartner, an estimated 3.6 million Americans fell victim to phishing last year, leading to losses of more than $3.2 billion.

With so much at stake, the computer security community has been scrambling to develop technologies to combat phishing, such as filters for email and Web browsers that flag phishing attempts. Although such software has helped stop many attacks, phishers are constantly evolving their tactics to try to stay a step ahead of such technologies. Since phishing plays on human vulnerabilities—a successful attack requires a victim to succumb to the lure and take some action—it is also not strictly a technological problem. For that reason, my research group at Carnegie Mellon University is studying the best ways to teach people to recognize and avoid phishing scams. This research, in turn, is informing our design of antiphishing software so people are more likely to use it correctly. Because human factors are a critical element in the success of phishing attacks, we have found that they can be essential weapons to foil phishers as well.

Teachable Moments

When we began trying to understand why people fall for phishing attacks in 2004, my coworkers Mandy Holbrook and Julie Downs recruited people on the streets of Pittsburgh to interview. Most were unaware of phishing and assumed the term had “something to do with the band Phish.” Others knew about e-mail scams that used the names of financial institutions, but they did not realize that messages seemingly from retailers might also be fraudulent. Most people had little sense of how to identify a phishing e-mail and tended to rely on superficial features, such as a logo or a professional look, to determine whether it was legitimate. They also did not understand the security messages displayed by their Web browsers and did not know how to use cues in Web addresses and within e-mail messages to judge their authenticity.

SPOTTING PHISHY E-MAIL

Phishers’ preferred way to lure victims is through a mass e-mail, constructed to look like an authentic message from a well-known company. Computer users often trust such e-mails based on the presence of a familiar brand name or logo. These phishing messages do contain clues that can help identify them as fraudulent, however. Many are visible to the attentive user; others are detectable by software filters.

Credit: George Retseck

After confirming that a great need exists to educate Internet users about phishing, our next step was to review existing antiphishing training efforts to try to understand why they apparently do not work. We found a wide range of Web sites devoted to antiphishing training provided by companies, government agencies and industry associations. Some of these included a lot of technical jargon and more information than a nontechnical computer user was likely to digest. A few sites provided good background to raise awareness of the phishing threat but little in the way of actionable advice about how people could protect themselves. In fact, we found in a laboratory study that some of the best antiphishing materials in terms of raising awareness left people overly suspicious of legitimate Web sites.

Worse still, messages that companies send to their employees or customers to warn them about phishing attacks are largely ignored. We did learn, however, that it was much easier to get research volunteers to read e-mail that looks like a phishing message than to get them to read a security-related e-mail. Our studies seemed to show, therefore, that awareness of phishing in the abstract does not translate into protection but that firsthand experience with phishing could provide a powerful teachable moment.

With some of these insights in mind, members of my team, Ponnurangam Kumaraguru, Alessandro Acquisti and others, developed a training system called PhishGuru, which delivers antiphishing information after users have fallen for simulated phishing messages. The program incorporates a set of succinct and actionable messages about phishing into short cartoons, wherein a character named PhishGuru teaches would-be victims how to protect themselves. In a series of studies, we demonstrated that when people read the cartoons after falling for the simulated phishing e-mails that we sent to them, they were much less likely to fall for subsequent attacks. Even a week later our test subjects retained what they had learned. In contrast, those who read the PhishGuru cartoons sent to them by e-mail, without experiencing a simulated attack, were very likely to fall for subsequent attacks.

Extending this principle, Steve Sheng, one of my graduate students, also developed an online training game called Anti-Phishing Phil that teaches people how to identify suspicious Web site addresses while providing an experience of getting “caught” by a phisher. Players take on the role of Phil, a young fish that must examine the Web addresses associated with the worms he encounters and determine which are safe to eat. When Phil tries to bite a worm with a fraudulent address, he gets caught on a fishing hook and hauled out of the water. An older and wiser fish then appears on the scene and explains where Phil went wrong. Through both laboratory and field studies, we have shown that the game makes a significant difference in users’ ability to identify phishing sites. Comparing their performance before and after the training, we saw a drop in the number of false negatives, phishing sites mistakenly deemed to be legitimate, and false positives, legitimate sites judged to be phishing sites. The game players also outperformed participants who trained with a tutorial or with materials from other sources.

Although we have shown that we can teach people to protect themselves from phishers, even those educated users must remain vigilant and may require periodic retraining to keep up with phishers’ evolving tactics. The Anti-Phishing Working Group reported that the number of programs and Web sites devoted to infecting computers with password-stealing code jumped dramatically this year, for instance. “Spear-phishing” attacks, which are tailored to their victims, are another growing trend. These can take the form of e-mails sent to the employees of a company that appear to have come from a manager in that company, leading the employees to trust the message and open its attachment. Information available on corporate Web sites and through social-networking sites can help attackers to craft these targeted messages.

Because phishers are such determined criminals, individual computer users cannot be expected to defend themselves alone. Our group also develops automatic filters that can identify likely phishing attacks. But in this work, too, we have found that human responses can be critical to a filter’s success.

A Multipronged Defense

Many browser programs already include builtin security filters or can work with add-on programs for detecting suspicious Web sites. Yet even when antiphishing software tools are able to correctly identify phishing Web sites, they may still be ineffective if users choose to ignore their warnings. To understand why some people do not heed such security messages, another of my graduate students, Serge Egelman, sent simulated phishing e-mails to the volunteers participating in our research. When the recipients fell for the phishing messages and clicked on the links, warnings were triggered in their Web browsers. Egelman then found that all the participants who used the Mozilla Firefox 2 browser heeded the warnings, whereas those who used Internet Explorer 7 (IE7) often ignored them. We determined that the dramatic difference in the responses of the two groups was largely attributable to the fact that the IE7 users either did not notice the warning messages or confused them with less severe warnings. Microsoft appears to have learned this lesson too, and the next generation of the Internet Explorer browser, IE8, now has clearer warning messages that are similar to those shown by Firefox.

In addition to clarity, we have found that accuracy is another critical factor affecting whether users respect the warnings of automatic filters. A high rate of false positives can undermine a filter’s credibility and cause users to ignore it after a while. The antiphishing filters we tested employ a mixture of approaches to identify phishing messages and Web sites. Most commercially available tools use a blacklist of known phishing sites, for example. As new sites are reported, they are quickly added to the lists. Some tools also use a white list of known legitimate sites.

Most filters do not rely solely on such lists, however. Some analyze each Web site a user visits and apply a combination of heuristics to determine whether the site is likely to be fraudulent. A few of these are the same kinds of signals we train people to look out for, such as Web addresses beginning with all numbers or addresses that look similar to those of well-known brands. Other features the filters scrutinize include things people could not readily see; for example, the tool may take into account the age of the Web site because phishing sites are typically extremely short-lived, remaining active for as little as a few hours to days or weeks.

The time element can make a difference in the performance of the filters that rely heavily on blacklists. Our group recently tested eight consumer antiphishing programs, for instance, by feeding them fresh phishing URLs. We discovered that most of the blacklist programs caught fewer than 20 percent of the phishing sites when we tested them within minutes of receiving the URLs. After five hours, most could detect about 60 percent of the active phishing sites. The programs that used a combination of blacklists and heuristics fared much better, with one detecting almost 90 percent of phishing attacks from the beginning of our test.

Our group has been working on programs that employ machine-learning techniques to detect phishing e-mail. This is a common approach used to detect spam e-mails, but spam detectors are not very accurate when it comes to phishing messages, which generally look legitimate. A member of our team, Norman Sadeh, has been leading an effort to develop a tool, which we originally called PILFER, that analyzes e-mails for a variety of features that may be indicative of phishing. For example, phishing e-mails often contain hyperlinked text that looks like the address of a well-known Web site, but the actual embedded computer code directs users to the attacker’s site. In addition, the Web addresses in phishing e-mails often contain five or more dots and point to recently registered domain names. Not all phishing e-mails contain these features, however, and sometimes legitimate e-mails contain them as well. Researchers therefore train the program—which we have renamed Phish-Patrol—by providing it with a large collection of legitimate and phishing e-mails so it can analyze these messages and learn which combinations of features are most likely to appear in phishing emails. In our most recent experiments, Phish-Patrol was able to detect more than 95 percent of phishing messages while only triggering false positives for around 0.1 percent of legitimate messages.

We have also combined some of the features used in PhishPatrol with other approaches to detect phishing Web sites. Jason Hong has been leading our group’s development of a tool called CANTINA, which analyzes the content of a Web page in combination with other heuristics to determine whether or not the page is part of a phishing site. CANTINA first employs a wellknown information-retrieval algorithm to identify five terms that are important on a given Web page but relatively uncommon on the Internet overall. For example, on an eBay log-in page, this “lexical signature” might be, “eBay, user, sign, help, forgot.” If you were to search for these five terms using Google, the legitimate eBay login page would appear among the top search results. Phishing Web sites that have replicated the eBay log-in page are unlikely to appear because one of the criteria Google’s proprietary algorithm uses in ranking a Web page is the number of links to it from other pages on the Internet, so legitimate pages are more likely to be in the top results. This approach is not foolproof, however, especially if a legitimate site was recently created; thus, it is only one of several features that CANTINA considers in assessing a Web site.

The Evolving Threat

We in the computer security community are not the only ones continually seeking to improve our performance. As antiphishing technologies get better, attackers adapt their tactics. Phishing messages are now being sent via instant messenger and mobile phone text messaging. Phishers are using online games such as World of Warcraft and messaging features of social-networking sites such as Facebook to lure their victims. Another type of phishing attack involves setting up Wi-Fi access points in public places and spoofing (imitating) the log-in pages of legitimate Wi-Fi vendors. These attacks are used to steal victims’ passwords as well as to infect their computers with malware.

Organized gangs of phishers leverage thousands of compromised computers as launch points for their attacks. For instance, a group believed to be based in eastern Europe and known as the “Rock Phish gang” uses compromised computers to relay messages to phishing sites. It can thus send phishing messages that appear to originate from those computers, masking the Web address of the actual phishing site and making it difficult for law enforcement to find the real source of the attack.

Another evasive tactic this gang uses is a system that security experts have dubbed “fast-flux,” in which the phishers manipulate Internet domain name servers to continuously change the numerical addresses corresponding with phishing domain names.

Phishing is only lucrative, of course, if phishers have a way of converting stolen credit-card numbers and other credentials into cash. Thus, phishers often recruit “mules” by advertising for people to fill work-from-home jobs or by befriending Internet users and convincing them that the phishers need their help. Mules are often unsuspecting victims themselves, who may believe they have been employed to perform a legitimate job. Yet a mule’s real job is to transfer stolen money and to be the person who gets caught if law enforcement catches on.

By constantly improving phishing detection software and educating users about new types of phishing attacks as they are discovered, the number of phishing victims can be reduced. Coordinating international law-enforcement efforts and finding ways to make phishing less lucrative will also help. Still, phishing remains an arms race that will be hard to eliminate completely without stopping it at the source, so consumers need every form of protection they can get.

AVOID FALLING FOR PHISH

Never click on a link in a suspicious e-mail or instant message, particularly one asking for personal information. If you do business with the purported sender, open your browser and type the company’s usual Web address yourself.

Look carefully at Web addresses for subtle errors, such as “Annazon.com.” Learn to parse Web addresses for other clues to the site’s legitimacy.

If unsure of a Web site, perform a Google search for the company. The address of the suspicious site is unlikely to appear in the top results, whereas the real company Web site will.

See consumer tips and resources from the Anti-Phishing Working Group at: http://http://apwg.org/resources/overview/

Play Anti-Phishing Phil at: http:// cups.cs.cmu.edu/antiphishing_phil

--Originally published: Scientific American 299(6), 104-110. (December 2008)

Beyond Fingerprinting

by Anil K. Jain and Sharath Pankanti

If you are like many people, navigating the complexities of everyday life depends on an array of cards and passwords that confirm your identity. But lose a card, and your ATM will refuse to give you money. Forget a password, and your own computer may balk at your command. Allow your cards or passwords to fall into the wrong hands, and what were intended to be security measures can become the tools of fraud or identity theft. Biometrics—the automated recognition of people via distinctive anatomical and behavioral traits—has the potential to overcome many of these problems.

Compared with a physical token such as a bank card or with the knowledge of a secret such as a PIN, biometric traits are profoundly more difficult to forge, copy, share, misplace or guess. Indeed, they offer the only way of determining whether a person has been issued multiple official documents, such as a driver’s license or passport, under different names. Yet they are quite easy to use as proof of identity. For these reasons, biometric systems have been gaining popularity in recent years. Laptops and mobile phones that can recognize a fingerprint, for instance, are now commercially available. In some countries biometric security is employed to safeguard items such as ATM cards and passports, to determine whether a person can rightfully enter a building or to ensure that someone is entitled to welfare payments. These systems are far from perfect. But with inexpensive sensors and powerful microprocessors now available, biometric technology is certain to become more pervasive.

Measures of Man

Biometrics is not a new idea. In 1879 Alphonse Bertillon, a French police inspector, proposed a complicated system of body measurements—arm and foot length among them—to identify repeat offenders. Over the next decade British scholars established that each print of a finger exhibits a unique pattern that persists over time, setting the stage for the development of the fingerprint classification system in 1896. Shortly thereafter, Scotland Yard began collecting fingerprints left at crime scenes to pinpoint criminals. And today almost every law-enforcement organization in the world relies on fingerprints to identify wrongdoers, solve crimes and conduct background checks on people applying for sensitive jobs.

But fingerprints are not the metric of choice for every purpose; several other physical and behavioral features have also been incorporated, singly or in tandem, into ID systems. The current emphasis in biometrics is to design fully automatic systems that are extremely fast, accurate, user-friendly and cost-effective and that can be embedded in existing security infrastructures. In addition to fingerprinting, workers in the past 30 years have developed ID systems based on such characteristics as the face, hand, voice and iris (the colored part of the eye).

Biometric systems require traits with two basic features: they must be unique for each person, and they must not change significantly with time. Some traits promote relatively high accuracy, others greater practicality or relatively low cost. The choice of trait to favor as an identifier therefore depends on the goals of the ID system. No single measurement is optimal for all applications.

Consider the three most popular traits in use today: the fingerprint, the face and the iris. In addition to its use in forensics, fingerprint recognition forms the basis of automated bordercontrol systems in a number of countries. In the U.S. alone, the Department of Homeland Security’s US-VISIT program has processed more than 75 million visitors since its debut in 2004. From a commercial standpoint, one of the biggest advantages of using fingerprints is that the sensors for capturing prints are now extremely cheap (around $5) and small enough to be embedded in consumer products such as laptops, mobile phones and even flash-memory sticks. But these compact sensors have higher error rates than their larger, more expensive counterparts common in law enforcement, because they scan a smaller portion of the finger and the image they record is lower in resolution.

Face recognition is gaining popularity as a security feature for computers and mobile phones, partly because it can take advantage of the built-in cameras that are becoming ubiquitous components of these devices. ID systems based on face recognition are quite accurate when the images are captured under controlled conditions—with the subject facing forward in indoor lighting and bearing a neutral expression, for example. They falter, however, when the original image and the newer one differ because of changes in pose, lighting, expression, age, and facial accessories such as glasses or a beard. This sensitivity to routine variations is particularly problematic for video surveillance, in which subjects do not present themselves in front of the camera in predetermined poses. Perhaps within 10 years the technology will have advanced sufficiently to permit fully automated, real-time face matching in video surveillance.

As for the iris—whose complex, textured pattern is thought to be unique to each person as well as permanent—recognition is extremely accurate and swift. The subject simply looks into a scanner for a few seconds; the captured pattern is then analyzed and recorded. Matching is done by comparing a person’s bit sequence to the sequences in a database. The speed and accuracy of this approach have driven the recent development of large-scale ID systems based on the iris, including the Iris Recognition Immigration System (IRIS) in the U.K. Travelers enrolled in the system’s database can sidestep the usual immigration channels at the airport, thereby cutting down on travel wait time.

Iris recognition has its downsides, however. The method depends, for instance, on the use of algorithms that represent the random patterns in the iris as a sequence of bits—no known human experts can determine whether or not two iris images match. Hence, iris data are unsuitable for use as evidence in a court of law.

HOW THE METRICS MEASURE UP

The choice of a biometric trait or traits to use in a security system depends on the application; the strengths and weaknesses of each of the four most common biometric identifiers are summarized in the table below. For example, compared with fingerprint recognition, iris recognition allows access to the wrong people less often but currently requires larger and costlier sensors and thus cannot be as easily incorporated into a laptop or other consumer device. Experts concur that in an ideal biometric authentication system, neither the “false accept” rate nor the “false reject” rate should exceed 0.1 percent. In tests conducted by the National Institute of Standards and Technology, however, none of the systems satisfied these error rate requirements.

Credit: Lucy Reading-Ikkanda

Imperfect Matches

Developers of biometric systems face other difficulties as well. Unlike ID systems requiring a password or a physical token, biometric systems generally have to make decisions on the basis of imperfect matches. Any system of comparison can lead to two basic types of error. In a “false accept” error, the system incorrectly declares a successful match between the input pattern and a pattern in the database that does not really match it. In a “false reject” error, the system incorrectly pronounces a failed match between the input pattern and a genuine match in the database.

Experts generally agree that neither the false accept rate nor the false reject rate of a biometric authentication system should exceed 0.1 percent (that is, one mistake in 1,000 assertions of a match and one mistake in 1,000 assertions of a nonmatch). But in evaluations conducted by the National Institute of Standards and Technology between 2003 and 2006, error rates for systems based on the fingerprint, face, iris and voice—another commonly used biometric trait—all exceeded the 0.1 percent level.

Increasing the threshold score for a match can lower the false accept rates, but at the expense of increasing the false rejects. Reducing both error rates simultaneously will require developing biometric sensors that generate higher-quality images and refining the feature extractors and matchers. Designers will also need to ensure that the systems are protected against sabotage: ideally, it should be impossible for biometric data to be intercepted and reentered into the systems. And it should be impossible to tamper with the biometric hardware or software. But these kinds of attacks are common to all authentication systems, including the password- and token-based varieties, and so they can be countered with established tools of the trade. For example, cryptography can hinder hackers from intercepting, replaying or altering information.

Much more challenging is designing a secure biometric system that accepts only the legitimate presentation of traits by their owners without being fooled by doctored or spoofed traits—a plastic copy of a person’s finger, for instance. To that end, sensors that detect heat and other signs of life can help guarantee that the input to be compared does not originate from an inanimate object.

But perhaps the most effective strategy for improving the accuracy, reliability and security of biometrics is to detect multiple biometric traits or multiple instances of a trait (more than one fingerprint, for example). Reinforcing the identity of a subject through such combinations offers increasingly irrefutable proof that the biometric data are being presented by their legitimate owner and not an impostor. In fact, many passport systems are already evolving in this way. The US-VISIT program, which used to scan only two fingers of non-U.S. citizens, has started capturing all 10 fingers, and the system has the potential to assess both fingerprints and faces in the future.

The Privacy Conundrum

The use of biometrics raises important privacy concerns. Who owns the data—the individual or the service providers? Will those data be used for an unintended purpose—to deduce something about a person’s health, for instance? Biometric systems of the future will probably operate unobtrusively, capturing biometric traits without the active involvement of the user. Such stealth further confounds the privacy issue.

At present we see no concrete, viable solutions on the horizon for addressing the entire spectrum of privacy concerns. We believe these problems can be resolved through public discussion and policy making, however. They will have to be. It is only a matter of time before continued improvements to biometric tools will move them center stage in efforts to combat the rampant problems of security and identity fraud that our society faces.

--Originally published: Scientific American 299(3), 78-81. (September 2008)

Table of Contents

Living in a Cyber World

The Hacker

The Hacker in Your Hardware

Hacking the Lights Out

The Attack of Code Red

How Hackers Break In...and How They Are Caught

Attack of the Worms

Nowhere To Hide

The End of Privacy?

Stealing Secrets

Brave New World of Wiretapping

Tag–You’re It

Malware Goes Mobile

The Ultimate Database

The Solutions

How to Keep Secrets Safe

Improving Online Security

Can Phishing Be Foiled?

Beyond Fingerprinting