ICS in the News: Cyber Startups on the Hunt in Security Arena

Ravi Sandhu, the executive director of the Institute for Cyber Security, was interviewed in an article on how startups are fighting the growing threat of botnets. From the article:

"It's sharing across organizations, within organizations, and increasingly through modes of sharing that people have not been classically doing," says Ravi Sandhu. "What does it even mean to secure a social network? It's not clear. Startups remain fertile ground for [these] new ideas."

As the article states, in addition to this issue, ICS concentrates on security protection for cloud computing, security startups in incubation, and better systems for the military. The article quotes other experts in the realm of startup security, and you can find the full article here.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Botnets Using Web 2.0 Sites as a Command and Control

In the last month, three botnet command-and-controls (C&Cs) have been spotted in the wild on Twitter and Google Groups. A botnet, perhaps better described as a "zombie network", is a distributed organization of programs that runs in the background of infiltrated computers (laptops, servers, cell phones, etc.) that performs tasks such as information stealing, email spamming, or other types of attacks. Usually these bots try to multiply, to remain hidden, and to scan for private data. Some are more sophisticated than others.

Usually, these bots operate on a peer-to-peer basis, but last month Arbor Networks found a botnet using a centralized C&C via Twitter and Jaiku. Once alerted, they each shut the offending account down, but just days later, a second one was found on Twitter. Meanwhile, just last week, Symantec uncovered a trojan using Google Groups as its C&C in a similar way.

Interestingly, these particular botnet C&Cs were very primitive. More stealthy approaches, such as using steganography to hide bot commands, are not as widely used (or worse, they are and haven't been discovered). With web 2.0 and social networking sites growing in popularity every day, look for more botmasters to abuse these sites in this way.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Implications of the Department of Defense Reviewing Social Network Security Implications

TechNewsWorld has an article on how the Department of Defense (DoD) will conduct an overall review of the security implications of allowing members of the military to interact with social networks. According to the article, marines have been banned from using military networks to access FaceBook, MySpace, and Twitter, while the army has complete freedom in that regard. In the meantime, the DoD will review the security risks and values of social networking sites, with a new policy expected by the end of the year.

Of course, banning only three popular social networking sites only from military networks is treating a symptom rather than a cause. As Michael Sutton, vice president of Zscaler's security research department, mentions, "Banning three social networking sites is going to have a negligible impact on network security...and in the end, you're throwing the baby out with the bath water."

This is an interesting case of threat modeling, where one wants to manage risk instead. It'll be interesting to see where the new policy goes.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Facebook Joins OpenID Foundation Board

Yesterday evening, the OpenID group announced that Facebook has joined its foundation board. If this headline sounds familiar, it is only because it is hot on the heels of Paypal joining the OpenID Foundation Board itself just a week ago.

At first, this seems to clash with Facebook Connect, which this blog discussed a month ago. The single sign-on (SSO) idea (one login for all web apps and sites) remains the same, but unlike OpenID, Facebook connect uses a centralized mechanism (namely, Facebook) to facilitate the exchange.

Facebook joining the board now adds a host of organizations that have joined its board, including Google, IBM, Microsoft, the aforementioned PayPal, VeriSign and Yahoo!. While OpenID has faced some criticisms, including its user interface experience, 2008 was a large year for it, and it looks to be building on that early into 2009. It'll be interesting to see where OpenID ends up at the end of the year.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu

Paypal Joins OpenID Foundation Board

The OpenID Foundation just announced in a statement that Paypal has joined sustaining corporate member of the Board, putting some extra muscle behind the open single sign-on mechanism. The concept behind OpenID is an intriguing one and has a lot of mainstream support, allowing anyone to act as an OpenID provider or consumer.

Its largest competition lies in Facebook Connect, which this blog discussed just last month. Facebook has the same SSO idea (one login for all web apps and sites), but uses a centralized mechanism (namely, Facebook), leading some to postulate that if it were to take off, all applications using it essentially would be Facebook apps.

SSO seems to be coming closer and closer with multiple converging models. While OpenID has the open standards behind it, a large company like Facebook with a proprietary mechanism wouldn't be the first to win such a battle.

Erhan J. Kartaltepe,
erhan.kartaltepe-at-utsa.edu