Attacking Machine Learning Systems

 Considerable piece in Schneier

Just now reading, suggested ...

Attacking Machine Learning Systems

The field of machine learning (ML) security—and corresponding adversarial ML—is rapidly advancing as researchers develop sophisticated techniques to perturb, disrupt, or steal the ML model or data. It’s a heady time; because we know so little about the security of these systems, there are many opportunities for new researchers to publish in this field. In many ways, this circumstance reminds me of the cryptanalysis field in the 1990. And there is a lesson in that similarity: the complex mathematical attacks make for good academic papers, but we mustn’t lose sight of the fact that insecure software will be the likely attack vector for most ML systems.

We are amazed by real-world demonstrations of adversarial attacks on ML systems, such as a 3D-printed object that looks like a turtle but is recognized (from any orientation) by the ML system as a gun. Or adding a few stickers that look like smudges to a stop sign so that it is recognized by a state-of-the-art system as a 45 mi/h speed limit sign. But what if, instead, somebody hacked into the system and just switched the labels for “gun” and “turtle” or swapped “stop” and “45 mi/h”? Systems can only match images with human-provided labels, so the software would never notice the switch. That is far easier and will remain a problem even if systems are developed that are robust to those adversarial attacks.  ... ( Much more)

Guide to Phishing

 Been Phished? I have.   Schneier sends along a nice piece from TidBits on the topic.   A useful guide, history and much more.   Schneier's piece has lots of comments on experiences    . 

An Annotated Field Guide to Identifying Phish   in TidBits  and VentureBeat.

Do you like phish? Not the band, not tasty seafood dishes, and not the pretty tropical variety. I refer instead to the intellectual challenge of identifying phishing emails that attempt to get you to reveal personal information, often including login credentials or financial details, or entice you to call a phone number where trained operators will attempt to separate you from your money.

Phishing is a big deal, with a State of Phishing report  from security firm SlashNext claiming that there were more than 255 million phishing attacks in 2022, a 61% increase from the year before. The Verizon Data Breach Investigations Report for 2022 says that only 2.9% of employees click through from phishing emails, but with billions of email addresses available to target, the raw numbers are still high.   ... ' 

DDOS Attacks Amplified

More Dangers out there.

New Attack Amplifies DDoSes by 4 Billion-Fold

By Ars Technica, March 17, 2022

Researchers from eight organizations warn of a new distributed denial-of-service (DDoS) amplification attack that boosts DDoS volumes by a potential factor of four billion. Attackers have been using the Mitel MiCollab and MiVoice Business Express collaboration systems to launch attacks, with an amplification vector supplied by misconfigured Mitel servers.

"This particular attack vector differs from most UDP [user datagram protocol] reflection/amplification attack methodologies in that the exposed system test facility can be abused to launch a sustained DDoS attack of up to 14 hours in duration by means of a single spoofed attack initiation packet, resulting in a record-setting packet amplification ratio of 4,294,967,296:1," the researchers wrote. They suggested the attackers using this technique still seem to be experimenting.

From Ars Technica,  View Full Article   

Think of Ransomware as a Data Management Problem

As most things can be thought of.   Just reading work of Turing, Von Neumann et al, and their early work was all about how you effectively stored things and used them,  though its safety had not yet come up. 

Ransomware: Why It’s Time to Think of it as a Data Management Problem

Enrico Signoretti. Mar 23, 2022 -- Blog in  GigaOm

Over the last couple of years, ransomware has taken center stage in data protection, but very few people realize it is only the tip of the iceberg. Everybody wants to protect their data against this new threat, but most solutions available in the market focus just on relatively quick recovery (RTO) instead of detection, protection, and recovery. In fact, recovery should be your last resort.

Protection and detection are much more difficult measures to implement than air gaps, immutable backup snapshots, and rapid restore procedures. But when well-executed these two stages of ransomware defense open up a world of new opportunities. Over time, they will help defend your data against cybersecurity threats that now are less common, or better said, less visible in the news—such as data exfiltration or manipulation. And again, when I say less visible, it is not only because the incidents are not reported, it is because often nobody knows they happened until it’s too late!

Security and Data Silos

Now that data growth is taken for granted, one of the biggest challenges most organizations face is the proliferation of data silos. Unfortunately, new hybrid, multi-cloud, and edge infrastructures are not helping this. We are seeing what we might call a “data silo sprawl”–a multitude of hard-to-manage data infrastructure repositories that proliferate in different locations and with different access and security rules. And across these silos there are often rules that don’t always follow the company’s policies because the environments are different and we don’t have complete control over them.

As I have written many times in my reports, the user must find a way to consolidate all their data in a single domain. It could be physical—backup is the easiest way in this case—or logical, and it is also possible to use a combination of physical and logical. But in the end, the goal is to get a single view of all the data.

Why is it important? First of all, once you have complete visibility, you know how much data you really have. Secondly, you can start to understand what the data is, who is creating and using it, when they use it, and so on. Of course, this is only the first step, but, among other things, you start to see usage patterns as well. This is why you need consolidation: to gain full visibility.

New DDoSes Attacks Emerge

New online security issues. 

Via ACM TECHNEWS

New Attack Amplifies DDoSes by 4 Billion-Fold

By Ars Technica, March 17, 2022

Researchers from eight organizations warn of a new distributed denial-of-service (DDoS) amplification attack that boosts DDoS volumes by a potential factor of four billion. Attackers have been using the Mitel MiCollab and MiVoice Business Express collaboration systems to launch attacks, with an amplification vector supplied by misconfigured Mitel servers.

"This particular attack vector differs from most UDP [user datagram protocol] reflection/amplification attack methodologies in that the exposed system test facility can be abused to launch a sustained DDoS attack of up to 14 hours in duration by means of a single spoofed attack initiation packet, resulting in a record-setting packet amplification ratio of 4,294,967,296:1," the researchers wrote. They suggested the attackers using this technique still seem to be experimenting.

From Ars Technica   

Plausible Deniability

 Fascinating thoughts on the subject by Bruce Schneier. with considerable comment and discussion, considering about how this would be useful in multiple contexts.  And how it might be best tested in each. Below the intro, more at the link. 

Bunnie Huang’s Plausibly Deniable Database

Bunnie Huang has created a Plausibly Deniable Database.

Most security schemes facilitate the coercive processes of an attacker because they disclose metadata about the secret data, such as the name and size of encrypted files. This allows specific and enforceable demands to be made: “Give us the passwords for these three encrypted files with names A, B and C, or else…”. In other words, security often focuses on protecting the confidentiality of data, but lacks deniability.

A scheme with deniability would make even the existence of secret files difficult to prove. This makes it difficult for an attacker to formulate a coherent demand: “There’s no evidence of undisclosed data. Should we even bother to make threats?” A lack of evidence makes it more difficult to make specific and enforceable demands.   ... ' 

DDos Attack Protection

 Useful piece.  More at the link. 

Home/News/Protection from DDoS Attacks – And Why It Is Useless/Full Text

ACM NEWS

Protection from DDoS Attacks – And Why It Is Useless, By Medium.com, December 9, 2021

DDoS is a type of internet attack capable of disrupting anything from a phone booth to the Pentagon for those unfamiliar with the subject. A total of 5,351,930 DDoS attacks were recorded in Q1 2021 alone. The average attack duration was 50 minutes, representing a 31% increase.

Network engineers (like ourselves) and security engineers are responsible for defending against such attacks.Our company is mainly a developer of apps for entertainment. Until recently, there was simply no need for network expertise as such in the company.

It was some coincidence that right before my first working day, the company had been subjected to a tsunami DDoS attack (evidently as a result of some people fighting in the meme comments).

Even more surprising was the fact that the team managed to deflect the blow without any third-party assistance despite lacking any real expertise in resisting attacks like these. Regardless, we had to jump in and investigate what had happened and how to prevent it from occurring again.

From Medium.com

View Full Article

Cloud Services Attacks

The Misaligned Incentives for Cloud Security  in Schneier

Russia’s Sunburst cyberespionage campaign, discovered late last year, impacted more than 100 large companies and US federal agencies, including the Treasury, Energy, Justice, and Homeland Security departments. A crucial part of the Russians’ success was their ability to move through these organizations by compromising cloud and local network identity systems to then access cloud accounts and pilfer emails and files.

Hackers said by the US government to have been working for the Kremlin targeted a widely used Microsoft cloud service that synchronizes user identities. The hackers stole security certificates to create their own identities, which allowed them to bypass safeguards such as multifactor authentication and gain access to Office 365 accounts, impacting thousands of users at the affected companies and government agencies.

It wasn’t the first time cloud services were the focus of a cyberattack, and it certainly won’t be the last. Cloud weaknesses were also critical in a 2019 breach at Capital One. There, an Amazon Web Services cloud vulnerability, compounded by Capital One’s own struggle to properly configure a complex cloud service, led to the disclosure of tens of millions of customer records, including credit card applications, Social Security numbers, and bank account information .....  '

This essay was written with Trey Herr, and previously appeared in Foreign Policy.

The comments on this post arevery good and provoking.

Mitre's Framework for Discovering Cyberattack

Was passed this.  We worked with Mitre for Defense applications.  Seeing more examples of forward facing means of addressing threats.

MITRE ATT&CK FRAMEWORK FOR DISCOVERING CYBERATTACKERS  December 17th 2019

Cybersecurity | MITRE ATT&CK

We're happy to introduce you to a strange new ampersand-infused acronym: MITRE ATT&CK.
This framework has gained a lot of popularity in the security industry over the past year and Google Trends tells us that this keyword is red hot! But what is MITRE ATT&CK™ all about, and why should cybersecurity pros pay attention?

For those who are not familiar, ATT&CK is the Adversarial Tactics Techniques and Common Knowledge framework available from MITRE. It is a curated knowledge base of tactics and hundreds of techniques that attackers can leverage when compromising enterprises.

There are a number of ways an organization can use it, so we have developed this special edition for you with the collaboration of VMware Carbon Black, global leader in cybersecurity.

In it, you'll find a careful selection of the most relevant news from trusted leaders in the security industry, along with a workbook developed by VMware Carbon Black and that provides a starting point for organizations looking to map to the ATT&CK Framework or simply better their security posture in 3 simple steps.

We hope this issue will be a useful resource for you and your team.
Artificial Intelligence Weekly  .... "

Hacking Nuclear Plants

Good reason for very strict identification policies.  And in the meantime,  just keeping some things off the Net.

How a nuclear plant got hacked
Plugging nuclear plants into the internet makes them vulnerable targets for nation-state attack.
    
J.M. PorupBy J.M. Porup in CSOOnline

If you think attacking civilian infrastructure is a war crime, you'd be right, but spies from countries around the world are fighting a silent, dirty war to pre-position themselves on civilian infrastructure — like energy-producing civilian nuclear plants — to be able to commit sabotage during a moment of geopolitical tension.

What follows is an explanation of how India's Kudankulam Nuclear Power Plant (KNPP) got hacked — and how it could have been easily avoided  .... " 

Internet Intelligence Map Shows Live Attacks

Interesting visual, to what degree can it be used to plan for and address possible attacks?

Oracle’s Internet Intelligence Map presents a real-time view of online threats  By Kyle Wiggers in Venturebeat

Distributed denial of service attacks. Malware. State-imposed internet blackouts. It’s hard to keep abreast of every bad actor and natural disaster impacting the internet, but Oracle is making it a bit easier with the launch of Oracle Cloud Infrastructure’s Internet Intelligence Map, a real-time graphical representation of service interruptions and emerging threats.

It’s available for free starting today.

“The internet is the world’s most important network, yet it is incredibly volatile. Disruptions on the internet can affect companies, governments, and network operators in profound ways,” Kyle York, vice president at Oracle, said in a statement. “As a result, all of these stakeholders need better visibility into the health of the global internet. With this offering, we are delivering on our commitment to making it a better, more stable experience for all who rely on it.” .... '