Cloud Hosting

Thank you

Your message has been sent.

There was an error emailing this page.

By Matt Hamblen

Senior Editor, Computerworld | Apr 11, 2017 2:37 PM PT

Dallas city officials have added extra encryption and other security measures to the outdoor warning sirens hacked early Saturday.

The hack also prompted the city to evaluate critical systems for potential vulnerabilities, City Manager T.C. Broadnax said in a statement late Monday. City officials are reviewing security for financial systems, a flood warning system, police-fire dispatch and the 911/311 system.

Broadnax told reporters separately on Monday that the hack came over a radio frequency and not over a wired computer network. The attack was "not a system software issue; it was a radio issue," he told the Dallas Observer and others.

The city believes the hack came from the Dallas area, but officials haven't detailed how it occurred. Dallas police are working with the FBI and the Federal Communications Commission (FCC) to validate what they think happened and find the source. The hack caused all 156 emergency sirens to activate for about 90 minutes, scaring some residents and doubling the number of calls to 911.

Radio security experts theorized the incident may have been a simple "replay attack" where the hacker recorded the radio signal sent out on April 5 at noon as part of a monthly test of the emergency siren system. Then, the hacker could have played that signal back repeatedly early Saturday. It would take a hacker with a software defined radio (SDR) or other off-the-shelf radio frequency test equipment to pull off the attack, said Chris Risley, CEO of Bastille Networks, a company that remediates radio frequency vulnerabilities.

Frequencies used for outdoor sirens are public and are managed by the FCC. Various security techniques, including encryption, are used to protect signals sent by radio.

Even if a "replay attack" was not used, the regularly scheduled siren test would allow an attacker to make multiple recordings of the "activate sirens" radio stream over several months and then analyze it for specific commands to trigger the alert, he added. SDRs are becoming cheaper and more capable and there is an abundance of open source software that can decode activation protocols.

Risley said other cities are probably just as vulnerable as Dallas.

The Dallas incident highlights how vulnerable and unprotected U.S. enterprises and government authorities are, said Matt Little, chief product officer for encryption provider PKWare. "Traditional security perimeters are breaking down. This attack reaffirms how necessary encryption is," he said.

Many siren systems are decades old and Dallas may have been relying on low-level encryption, perhaps even 64-bit encryption based on the Data Encryption Standard (DES) from the late 1970s, he said.

"Sirens are analogous to a lot of aging critical infrastructure that was built for high availability, and always has to be online, so security took a back seat to that," Little said.

Dallas may have decided after the hack to upgrade encryption or improve the authentication system regarding who gets access to encryption keys, Little said.

In the Dallas case, a hacker could have listened to the low-level encrypted activation signal sent to sirens for some time, then used a brute force attack to figure out the encryption key needed. "It seems to be a large brute force effort to compromise a signal tower," Little said.

In some ways, radio-controlled systems like a siren warning system with even weak encryption could actually be more secure than some Internet-connected devices with no encryption, he said. For example, unprotected cameras connected to the Internet that were attacked by the Mirai botnet were used in a coordinated D-DOS attack on Dyn servers last October. The result: widespread Internet outages.

Senior Editor Matt Hamblen covers mobile and wireless, smartphones and other handhelds, and wireless networking for Computerworld.

Sponsored Links

More:
Hacked Dallas sirens get extra encryption to fend off future attacks - Computerworld

It's a choice between privacy and law enforcement

As SC Media reported yesterday the Internet Society has called upon G20 nations to ensure ubiquitous encryption of the web.

The president and CEO of the Internet Society, Kathryn Brown, has gone on record to state that encryption should be made stronger and universal, not weaker.

Some have taken this as a call to encrypt everything online, however in her Securing our Digital Economy' statement Brown says, Strong encryption is an essential piece to the future of the world's economy and the Internet Society believes it should be the norm for all online transactions.

Brown also mentions how rather than being recognised as a way to secure online transactions, or conversations, the debate too often focuses on the use of encryption as a way to thwart law enforcement.

Which got us thinking here at SC Media UK, would it actually be technically possible to encrypt the entire web and perhaps a little more controversially could this be achieved in a way that enabled decryption to facilitate criminal and national security investigations?

Yes, we know, one country's terrorist is another's journalist, but considering the ongoing global clamour for encryption backdoors we wondered how technically feasible it might be at an internet-wide scale?

As always, we turned to the cybersecurity industry itself for some answers:

Neil Cook, chief security architect at Open-Xchange, welcomed the Internet Society comments and reckons that universal encryption should not only be possible, but mandatory for web traffic, communications and data at rest. We cannot let the actions of a small minority of people compromise the security and privacy of everyone else by weakening the encryption we all rely on to keep us safe and our data private, he says.

Which, while admirable, doesn't get us any closer to the technical feasibility point. Dan Panesar from Certes Networks ponders whether that's because it's not actually possible. In practical terms, it would need to focus on utilising secure connections to everything, rather than blanket encryption of the entire web, Panesar says. Blanket web encryption would almost create more problems than it solves, slowing the internet and causing serious functionality problems.

Chris Hodson, EMEA CISO at Zscaler, is more positive about whether it can be achieved technically. In a word, yes, he told SC Media. Though encryption remains only part of the security puzzle. Front loading the internet with the silver bullet' of encryption only serves to protect information in transit between two parties and does not maintain security hygiene overall.

As Hodson adds, encryption is only actually valid against those who shouldn't have access to data. Encrypted information is still accessible if a hack is undertaken via legit' means such as the spear-phishing of an admin account.

Mark James, security specialist at ESET, agrees that it's a nice thought but says that while in theory it would enable private communication of all personal data, in practise with so many parts operated, owned and channelled through so many gateways it's a job that's seems highly unrealistic to achieve.

Javvad Malik, security advocate at AlienVault, prefers to try and break the problem down into component parts of which, he told us, there are primarily three:

Areas of the web that absolutely should be encrypted and active efforts should be made to increase the security. For example, with it comes to online banking transactions there should be no margin for doubt.

Areas of the web that need privacy and security, but could co-operate with law enforcement without undermining the security model. For example, a cloud provider that holds the encryption keys, or that can create additional access accounts can provide access. This is more common in SaaS type scenarios.

The real pain points which involves all those apps that need to be secured and have no easy way to intercept. This is where apps like WhatsApp sit which offer end-to-end encryption and even the service provider should not be able to access the data.

Lee Munson, security researcher at Comparitech, moved on to our secondary question, that of law enforcement access to encrypted communications.

For them to gain access to encrypted traffic there would be a need to share keys which, by definition, removes the encryption, Munson explains. While this could be controlled in such a manner that no third-party gains access to those keys, experience has told us that as soon as you slip a backdoor of any kind into an encrypted medium, some unauthorised person or group will find a way to leverage it for their own purposes.

High-Tech Bridge's CEO, Ilia Kolochenko, was equally perplexed by this at a technical level. It's technically impossible to design an encryption that good guys could break, while bad guys could not, he says. Even if we do develop such an algorithm one day, the bad guys will hack the good guys and decrypt all your data.

His answer then? That we need to make a choice between privacy and law enforcement. But then again, as Javvad Malik pointed out, the way currently encryption works, I'm not aware of a way that the communication can be kept secure but access allowed; not unless the laws of mathematics can be changed

We will leave it to the Venafi chief cyber-security strategist, Kevin Bocek, to swing the debate back around to commerce and the digital economy.

Encryption is key (no pun intended) to the system of trust which underlies the security of every machine on the Internet, of that there's no doubt. There is no replacement so we really need to continue to make this system work, Bocek told SC Media.

Machines have to be able to know which machine they are taking to, they need privacy, he explained. This goes beyond enabling ecommerce and online banking all machine identities need to be protected and to do this we need encrypted and private communications.

This, argues Bocek, is why our IoT-driven future, where decisions are made and business is conducted in the cloud through machines, needs encryption. If government wants to have an e-enabled, information society of the future, he concludes, encryption is a required ingredient, not an optional one that can be picked up or put down at will.

Visit link:
Can we encrypt the web while giving governments a backdoor to snoop? - SC Magazine UK

The Internet Society has called for the full encryption of the internet, decrying the fact that securing the digital world has increasingly become associated with restricting access to law enforcement.

In a blog post aimed at the leaders of the G20 economies, ISOC CEO Kathryn Brown argues that the digital economy "will only continue to thrive and generate opportunities for citizens if the Internet is strong, secure, and trusted," adding: "Without this foundation, the global digital economy is at risk."

The G20 will meet in Hamburg in July and one of the main agenda topics is the "spread of digital technology" and its impact on economic growth. Notably, there will be a "digital affairs ministers conference" for the first time at the summit, and the importance of the topic was highlighted with a special two-day preparatory meeting last week attended by "ministers in charge of digitalization."

"Germany wants them to agree to a concrete plan one that includes affordable Internet access across the world by 2025, common technical standards and a focus on digital learning," wrote Brown at the conclusion of that prep meeting, presumably having been briefed on discussions.

The post gives some figures on the digital economy 360 million people; 28 per cent of output is digital; the internet contributes $6.6tn a year before getting to the point: interconnection and security.

"The truth is that economies can only function within a secure and trusted environment," Brown notes, "which brings us to encryption."

Internet engineers have long been strong advocates of increased online security (something that has been difficult since the internet's earliest building blocks largely ignored the idea of malicious activity), and the Internet Society reflects that belief back: "Strong encryption is an essential piece to the future of the world's economy and the Internet Society believes it should be the norm for all online transactions. It allows us to do our banking, conduct local and global business, run our power grids, operate communications networks, and do almost everything else."

Brown goes on: "Encryption is a technical building block for securing infrastructure, communications and information. It should be made stronger and universal, not weaker."

But then she also notes that in the past year, the issue of encryption has become intricately tied up with the issue of law enforcement trying to gain access to people's communications and being unable to do so.

In the lead-up to the US presidential election, the fight between the FBI and Apple over the phone of San Bernardino shooter Syed Farook became a hot topic. Politicians and law enforcement called for a backdoor (or even a frontdoor) to the latest encryption efforts, and tech companies, security bods, civil society and some federal agencies called that notion "magical thinking" because any hole introduced into encryption software is an exploitable hole that anyone can use and abuse.

Last month, the issue re-emerged following an attack in London, when the UK home secretary Amber Rudd specifically criticized Facebook-owned WhatsApp for not providing access to the app-based conversations of attacker Khalid Masood.

Just days later, EU Justice Commissioner Vra Jourov said she would introduce legislation to make it easier for law enforcement to gain access to encrypted apps' data. That followed calls from French and German ministers for ways to access encrypted comms.

However, following a now-familiar backlash to such calls from cybersecurity experts, Rudd then downplayed her call for access to encrypted communications. Jourov's department insisted she did not mean to imply the legislation would cover encryption only access to data stored in the cloud by encrypted apps (which presumably she expects to be unencrypted).

ISOC CEO Brown is not happy about how this conversation is defining the debate around encryption. "Rather than being recognized as the way to secure our online transactions or our conversations, all too often the debate focuses on the use of encryption as a way to thwart law enforcement," she complains, arguing: "To undermine the positive role of encryption in the name of security could have devastating consequences."

The Internet Society is usually diplomatic to the point of saying nothing, so when its CEO says, "we should recognize that encryption is key to the future digital economy and stop treating it as simply an obstacle to law enforcement," it is clear that the level of frustration among internet engineers is high.

Hammering the point home, she adds: "We need to deconstruct the issues faced by law enforcement and policy makers and agree together how we can achieve a trusted digital economy underpinned by encryption."

ISOC clearly sees July's G20 Summit as the best opportunity to address that concern, with Brown calling it a "turning point that should not be missed." And its position is stated simply: "The Internet Society calls for ubiquitous encryption for the Internet. We strongly believe that this is the best foundation for trust in the digital economy, and we urge the G20 nations to stand behind encryption."

Whether that technical message makes it past the politics of terrorism is going to be hard to discern, but there is little doubt that a more secure online environment is going to be a healthier one financially and ISOC and others will be hoping that money talks louder than fear.

Read this article:
Internet Society tells G20 nations: The web must be fully encrypted - The Register