Financial Cryptography

1st round in Internet Account Fraud World Cup: Customer 0, Bank 1, Attacker 300,000

More grist for the mill -- where are we on the security debate? Here's a data point.

In May 2009, PATCO, a construction company based in Maine, had its account taken over by cyberthieves, after malware hijacked online banking log-in and password credentials for the commercial account PATCO held with Ocean Bank. ....

There are two ways to look at this: the contractual view, and the responsible party view. The first view holds that contracts describe the arrangement, and parties govern themselves. The second holds that the more responsible party is required to be <ahem> more responsible. PATCO decided to ask for the second:

A magistrate has recommended that a U.S. District Court in Maine deny a motion for a jury trial in an ACH fraud case filed by a commercial customer against its former bank. According to the order, which must still be reviewed by the presiding judge, the bank fulfilled its contractual obligations for security and authentication through its requirement for log-in and password credentials. ....

At issue for PATCO is whether banks should be held responsible when commercial accounts, like PATCO's, are drained because of fraudulent ACH and wire transfers approved by the bank. How much security should banks and credit unions reasonably be required to apply to the commercial accounts they manage?

"Obviously, the major issue is the banks are saying this is the depositors' problem," Patterson says, "but the folks that are losing money through ACH fraud don't have enough sophistication to stop this."

And lost.

David Navetta, an attorney who specializes in IT security and privacy, says the magistrate's recommendation, if accepted by the judge, could set an interesting legal precedent about the security banks are expected to provide. And unless PATCO disputes the order, Navetta says it's unlikely the judge will overrule the magistrate's findings. PATCO has between 14 and 21 days to respond.

"Many security law commentators, myself included, have long held that *reasonable security does not mean bullet-proof security*, and that companies need not be at the cutting edge of security to avoid liability," Navetta says. "The court explicitly recognizes this concept, and I think that is a good thing: For once, the law and the security world agree on a key concept."

My emphasis added, and it is an important point that security doesn't mean absolute security, it means reasonable security. Which from the principle of the word, means stopping when the costs outweigh the benefits.

But that is not the point that is really addressed. The question is whether (a) how we determine what is acceptable (not reasonable), and (b) if the Customer loses out when acceptable wasn't reasonable, is there any come-back?

In the disposition, the court notes that Ocean Bank's security could have been better. "It is apparent, in the light of hindsight, that the Bank's security procedures in May 2009 were not optimal," the order states. "The Bank would have more effectively harnessed the power of its risk- profiling system if it had conducted manual reviews in response to red flag information instead of merely causing the system to trigger challenge questions."

But since *PATCO agreed to the bank's security methods when it signed the contract*, the court suggests then that PATCO considered the bank's methods to be reasonable, Navetta says. The law also does not require banks to implement the "best" security measures when it comes to protecting commercial accounts, he adds.

So, we can conclude that "reasonable" to the bank meant putting in place risk-profiling systems. Which it then bungled (allegedly). However, the standard of security was as agreed in the contract, *reasonable or not*.

That is, *reasonable security* doesn't enter into it. More on that, as the observers try and mold this into a "best practices" view:

"Patco in effect demands that Ocean Bank have adopted the best security procedures then available," the order states. "As the Bank observes, that is not the law."

(Where it says "best" read "best practices" which is lowest common denominator, a rather different thing to best. In particular, the case is talking about SecureId tokens and the like.)

Patterson argues that Ocean Bank was not complying with the Federal Financial Institutions Examination Council's requirement for multifactor authentication when it relied solely on log-in and password credentials to verify transactions. Navetta agrees, but the court in this order does not.

"The court took a fairly literal approach to its analysis and bought the bank's argument that the scheme being used was multifactor, as described in the [FFIEC] guidance," Navetta says. "The analysis on what constitutes multifactor and whether some multifactor schemes [out of band; physical token] are better than others was discussed, and, to some degree, the court acknowledged that the bank's security could have been better. Even so, it was technically multifactor, as described in the FFEIC guidance, in the court's opinion, and "the best" was not necessary."

Navetta says the court's view of multifactor does not jibe with common industry understanding. Most industry experts, he says, would not consider Ocean Bank's authentication practices in 2009 to be true multifactor. "Obviously, the 'something you have' factor did not fully work if hackers were able to remotely log into the bank using their own computer," he says. "I think that PATCO's argument was the additional factors were meaningless since the challenge question was always asked anyway, and apparently answering it correctly worked even if one of the factors failed. In other words, it appears that PATCO was arguing that the net result of the other two factors failing was going back to a single factor."

This problem has been known for a long time. When the "best practices" approach is used, as in this FFIEC example, there is a list of things you do. You do them, and you're done. You are encouraged to (a) not do any better, and (b) cheat. The trick employed above, to interpret the term "multi-factor" in a literal fashion, rather than using the security industry's customary (and more expensive) definition, has been known for a long long time.

It's all part of the "best practices" approach, and the court may have been wise to avoid further endorsing it. There is now more competition in security practices, says this court, and you'll find it in your contract.

---

Caveat: as with all such cases, this is a preliminary ruling, and it can be overturned including several times... before we see a precedent.

RSA Pawned - Black Queen runs amoc behind US lines of defence

What to learn from the RSA SecureID breach?

RSA has finally admitted publicly that the March breach into its systems has resulted in the compromise of their SecurID two-factor authentication tokens.

Which points to:

In a letter to customers Monday, the EMC Corp. unit openly acknowledged for the first time that intruders had breached its security systems at defense contractor Lockheed Martin Corp. using data stolen from RSA.

It's a targetted attack across multiple avenues. This is a big shift in the attack profile, and it is perhaps the first serious evidence of the concept of Advanced Persistent Threats (APTs).

What went wrong at the institutional level? Perhaps something like this:

• A low-threat environment in the 1990s
• led to success of low-threat SecureId token
• (based on non-diversified model that sourced back to a single company),
• which peace in our time translated to lack of desire to evolve in 2000s,
• and the industry grew to love "best practices with a vengeance" as everyone from finance to defence relied on the same approach.
• and domination in secure tokens by one brand-name supplier.
• Meanwhile, we watched the evolution of attack scenarios, rolling on through the phishing and breaches pincer movement of the early 200s up to APTs to now,
• while any thought & leadership in the security industry withered and died.

So, with a breach in the single-point-of-failure, we are looking at an industry-wide replacement of all 40 million SecureId tokens.

Which presumably will be a fascinating exercise, and one from which we should be able to learn a lot. It isn't often that we see a SPOF event, and it's a chance to learn just what impact a single point of failure has:

The admission comes in the wake of cyber intrusions into the networks of three US military contractors: Lockheed Martin, L-3 Communications and Northrop Grumman - one of them confirmed by the company, others hinted at by internal warnings and an unusual domain name and password reset process

But one would also be somewhat irresponsible to not ask what happens next? Simply replacing the SecureID fobs and resetting the secret sauce at RSA does not seem to satisfy as *a solution*, although we can understand that a short term hack might be needed.

Chief (Information) Security Officers everywhere will probably be thinking that we need a little more re-thinking of the old 1990s models. Good luck, guys! You'll probably need a few more breaches to wake up the CEOs, so you can get the backing you need to go beyond "best practices" and start doing the job seriously.

---

In contrast, the very next post discusses where we're at when we fail to meet "best practices!"

Declaration of Cyberwar - emerging hype cycle or growing nightmare?

Just when you thought it couldn't get any worse for infosec, there's more bad news on the horizon.

WASHINGTON—The Pentagon has concluded that computer sabotage coming from another country can constitute an act of war, a finding that for the first time opens the door for the U.S. to respond using traditional military force. ....

In part, the Pentagon intends its plan as a warning to potential adversaries of the consequences of attacking the U.S. in this way. "If you shut down our power grid, maybe we will put a missile down one of your smokestacks," said a military official.

Recent attacks on the Pentagon's own systems—as well as the sabotaging of Iran's nuclear program via the Stuxnet computer worm—have given new urgency to U.S. efforts to develop a more formalized approach to cyber attacks. A key moment occurred in 2008, when at least one U.S. military computer system was penetrated. This weekend Lockheed Martin, a major military contractor, acknowledged that it had been the victim of an infiltration, while playing down its impact.

Cyberwarfare is becoming more than just another talking point for the US Military, it's becoming a plank in government policy.

How significant is this? Well here's a data point. Lieutenant-General David Hurley has just been appointed as the new Chief of the Australian Defence Force. In a TV interview that night, he stated that one of the top four priorities for his term is cyberwarfare [1]. He called each of the other three as gamechangers (to which I concur) but did not elaborate on his one-word declaration of cyberwar.

What does that mean, other than a scurrilous lead for Australia's infosecarrazi press to follow up on? *Cyberwarfare is now top drawer stuff*. While us infosec types are scrabbling around trying to figure out what all the fuss is about (theories including:

• media hype
• excuse for new divisions,
• just new lingo for what was once known as EW or Electronic Warfare,
• a more cost-effective way to extend foreign policy, where cost is equated to dead diggers on TV,
• interference in civilian affairs,
• landgrab for the new Big Brother state,
• domestic battle with the NSA, DSD, GCHQ and friends,
• etc etc, inter alia...)

the military has put it on the agenda. On the *top of the agenda* of a force of 58,000 permanent warmakers, now with new improved government sanction to go out and bomb some electrons.

If the normally sensible Australians have bought into cyberwarfare, that means typically that the Americans are long gone down that path, and the British and Canadians have their walking shoes on as well. NATO won't be far behind, and NZ will join after their routine decade of protest.

The future of information security may well travel down a government / compliance path as we're squeezed between the 363kg gorilla of cyberwarfare on the one side, and the general incompetence of vendors on the other side. This will see all the vendors drawn over to cyberwar side, and an inevitable loss of innovative work on in the private sector. Not that we saw a lot, but there was always hope.

The end result will be more wrong threat models leading to more best practices and ultimately more compliance directed out of a military/political agenda. The compliance cycle that we saw stifling the American anti-phishing efforts will be the beginning, not the end, it will become the sad norm, not the upsetting exception.

Curiously however, there may be new common sense over on the other side of the Pacific. Lt Gen Hurley's opposite number in USA has also just been appointed as the new Chair of the Joint Chiefs of Staff:

[General Martin] Dempsey is “deeply skeptical” of technology being able to alter the basic nature of combat. He wrote recently in the introduction to the Army’s main operating concept, “We operate where our enemies, indigenous populations, culture, politics, and religion intersect and where the fog and friction of war persists.” In the end, it comes down to boots on the ground performing their jobs under competent command leadership.

His critics claim he doesn’t think as much as he should about future warfare and that he is too narrowly focused on the wars in Iraq and Afghanistan. ...

If anything's clear, the entry of the war machine into civilian cybersecurity affairs is likely to be bad news. Business and trade is far too delicate a thing to clobber with the heavy, blunt weapon of state responses. Maybe we need an old soldier to remind the futurists that war is actually a brutal thing?

No matter what the futurists have said over the last several centuries, it is always the grunts on the ground who are called upon to go in and make the job real. And it is always the people who bear the brunt of desk-flying futurists.

[1] Of the other three top priorities, one is the new fighter plane, the JSF or F35, which is Australia's largest defence purchase ever (ditto USA!). Another is the incorporation of the two new mini-carrier or logistical lift ships, which signals that Australia is going for integrated force projection, somewhat like Gen. Douglas MacArthur's island hopping in the Pacific campaign. In short, Australia is now building capacity to engage in the odd island invasion or two.

The third priority was equally big, but I don't recall it because I was too busy picking my jaw off the ground from hearing him slide that single neoligism into the middle of his conservative and comprehensive priorities.

#1 Censored Story - Dropping the Dollar

Someone pointed me to Project Censored, which has a list for the "25 top censored stories," and up there, right on top was "Global Plans to Replace the Dollar."

In July 2009, President Medvedev illustrated his call for a supranational currency to replace the dollar by pulling from his pocket a sample coin of a “united future world currency.” The coin, which bears the words “Unity in Diversity,” was minted in Belgium and presented to the heads of G8 delegations.

In September 2009, the United Nations Conference on Trade and Development proposed creating a new artificial currency that would replace the dollar as reserve currency. The UN wants to redesign the Bretton Woods system of international exchange. Formation of this currency would be the largest monetary overhaul since World War II. China is involved in deals with Brazil and Malaysia to denominate their trade in China’s yuan, while Russia promises to begin trading in the ruble and local currencies.

Additionally, nine Latin American countries have agreed on the creation of a regional currency, the sucre, aimed at scaling back the use of the US dollar.

Avid readers of FC will know this has been going on for a long time (long list here), and it's nice to see the news from the last 2 years concisely rendered.

Question of some pondering for me was, then, why is this *the number 1 censored story* ? Well, if one thinks about it some, the connection is clear.

In order to maintain the powerbase of Washington DC, the USD must remain supreme, because it is by the power of the dollar that economic force is wielded around the world, and it is the power of the dollar that buys the military machine at the pointy end of Ferguson's comment.

Except, this party's over. Outside the media eye, for a decade now, the world has been easing gently over to a multicurrency future. Here's just more latest news:

Mexico has quietly purchased nearly 100 tons of gold bullion, as central banks embark on their biggest bullion buying spree in 40 years. The purchase, reported in monthly data published by Mexico’s central bank, is the latest in a series of large gold buys by emerging market economies intent on diversifying reserves away from the faltering US dollar. China, Russia and India have acquired large amounts of gold in recent years, while Thailand, Sri Lanka and Bolivia have made smaller purchases.

*Central banks became net buyers of gold last year after two decades of heavy selling* – a reversal that has helped propel the price of bullion to a series of record highs. On Wednesday gold was trading at about $1,510 a troy ounce, down 4 percent from a nominal record high of $1,575.79 reached on Monday.

As a result of Mexico’s purchase, central banks, sovereign wealth funds and other so-called “official sector” buyers are on track to record their largest collective purchase of gold since the collapse of the Bretton Woods system, which pegged the value of the dollar to gold, in 1971. GFMS, a precious metals consultancy, had predicted that the official sector would make net gold purchases of 240 tons this year, compared with a post-Bretton Woods peak of 276 tons in 1981.

So why slap the heavy stamp of censorship on such a boring finance story? No bodies, no blood, no bombs.

Because every day this story is unknown is another day without currency flight, and another day the current regime avoids the tough questions. It buys more time for *everything else* that is going on. E.g., one supposes, Obama's efforts to balance his budget, contain inflation, withdraw forces from land wars in Asia, and other tasks in the struggle for peace.

So, it's the number one story to censor because it is the number one story to those who are in a position to censor. For the rest of us, it isn't, it's just more humdrum and drone and 1 percent this and 2 percent that.

"And," as my local TV station closes every day without fail, "that's finance."