Starting an International Cybersecurity Conversation 51
crimeandpunishment writes "Every government in the world is dealing with cybercrime, but they're all doing it on their own. In the context of 'cyberwar' saber-rattling on all sides, getting governments to share information is a challenge. But an international security conference this week in Dallas is aimed at doing just that — even if only on an informal basis."
Re: (Score:3, Interesting)
Re: (Score:1, Funny)
OpenBSD could also eliminate cancer, starvation, AIDS, climate change and gay sex.
Re:OpenBSD could eliminate "cybercrime". (Score:5, Insightful)
You
Are
High
yes, OpenBSD is more secure than windows/OSX.whatever. But a lot of 'cybercrime' happens as a result of userspace. Social engineering. Fraudulent emails. You will need to fix the users.
Also, what do you do about the desktop? You can go on all you want about OpenOffice, etc, but a decade ago when Company X went with Office 97 or 2000...those alternatives did not exist. So now they have 10+ years of corporate crap and tribal knowledge built around the MS Office ecosystem, which cannot change quickly. No matter how much you want it to, it cannot/will not change easily.
Technical problem? Ok, make [your fave distro] integrate as easily as Office/Exchange/Outlook/SharePoint. Not parts of it....all of it.
Any OS can be further security-hardened though (Score:1, Interesting)
"OpenBSD is more secure than windows/OSX.whatever" - by YrWrstNtmr (564987) on Sunday May 02, @05:49PM (#32066704)
By default, perhaps yes. However, any Operating System out there today can be "security hardened" (including BSD variants such as MacOS X, because Apple themselves publish a guide for doing it that's pretty thorough & comprehensive on their website no less), including Windows, Linux (yes, even SeLinux bearing distros of Linux), MacOS X, Solaris, and BSD's other than MacOS X too. This is indicated by the existence of CIS Tool versions out there, and for each of them, and yes, it does do more to security-
PEBKC (Score:4, Insightful)
The problem exists between keyboard and chair.
An OS is only as secure as the person who uses it.
Anything else is fanboyism.
Re: (Score:2)
Oh, dear. So that excuses passwords written in cleartext and sent via email? Failure to patch systems for published, known security holes? Leaving the backup tapes in an unlocked cabinet? Using NFS to store medical data in a place with open access wireless services?
The "chair" in question is not necessarily the one the user is sitting in.
Re: (Score:2, Insightful)
Re: (Score:2)
I think the major parts of that are,
1) It wasn't high tech. This is primarily a tech site.
2) It didn't work, unless you count some smoke and getting the attention of the police.
3) It barely involved tech, unless you consider M80's and a child's clock to be high tech. If so, you don't belong here.
I could build a better bomb in my garage, but I have no reason to, and I don't really like jail. :)
I guess... who cares? (Score:5, Insightful)
All the talk about "cyberwar" is good and fine, but in the end it seems to me like it's already had a name: "security". In the end, there's very little difference between hardening a machine so chinese government blackhats don't get in, and hardening it so script kiddie asshats don't get in. Unlinke SF movies, there is no way to just type "retrieve password" on some terminal with big letters and get in a system that had no unpatched vulnerabilities to start with.
In the end, a buffer overflow is a buffer overflow, and an XSS exploit is still an XSS exploit, and files accessible by guessing the URL are still files accessible by guessing the URL. And so on. If that exploit is, well, actually exploited by a Russian government blackhat it's "cyberwar", if the exact same exploit is used by an asshat kiddie, it's just being pwned.
And it seems to me like security experts were already going to conferences and otherwise communicating with each other. Exactly what's the loss if they don't explicitly represent some government?
Imaginary problem (Score:4, Insightful)
Everybody's talking about cyberwarfare, but nobody's ever come up with an example of it. Identity theft? Viruses? malware? That's not war. War involves people being hurt -- and I mean really hurt. Not skimming a few extra bucks off the till or organized crime, which is the closest any of this has come so far.
Has anyone managed to shut off the internet? Disable emergency services (911) across the country (or even a state)? Have planes fallen out of the sky, power gone out, hospital computers taken down, or any other act that can be directly attributed to a malignant entity (as opposed to mere human error)? No. And it's not likely to happen anytime soon either.
It's just not cost effective to spend tens of thousands of dollars finding and exploiting security weaknesses in those systems when a 5 gallon tank of diesel, fertilizer, and a match can take out those same systems for a lot less cost. Cyberwarfare between countries isn't likely to happen until other, cheaper methods of warfare somehow become ineffective. At best, cyberwarfare would consist of espionage efforts and manipulating data to advance certain political goals -- and countering that threat is currently handled by the intelligence community.
Re:Imaginary problem (Score:5, Informative)
You didn't RTFA did you.
Underscoring the threats: recent attacks on Google Inc. that caused the Internet search leader to move its search engine out of mainland China, and the revelation last year that spies hacked into the U.S. electric grid and left behind computer programs that would let them disrupt service.
There's one concrete example of cyberwarfare.
I'm not even going to bother with the rest of your post.
There's just too much ignorance and "it hasn't happened yet, so it won't" thinking.
Re: (Score:2, Informative)
Well, it entirely depends on how much of the grid they would have control of and what kind of control they could gain. If this gave them control over how generators operated, or how nuclear plants operated, or how hydro-electric dams operated, then they could potentially cause floods, damage to the plant itself [by say, overdriving the plant] or just something like what happened in the Northeast US/Canada, where a small grid failure killed power to a fairly large number of people for a significant amount o
Re: (Score:3)
None of your examples have to be cybercrime related. They can easily be done by someone internally. It's more likely that kind of stuff would happen accidentally by the non-malicious staff working it. Look at the power plant incidents that have happened in the past.
As far as that goes, you could have a major impact on the power grid with some improvised explosives (or several other methods) and knowing where the high tension lines run. If the tower looks like this [wordpress.com], it isn't going to wor
Re: (Score:3, Insightful)
There's one concrete example of cyberwarfare.
... which was apparently detected and corrected.
Er, yeah, those are the only ones they can talk about, because they're the only one they want the public to know about. If a problem's been detected and the damage report isn't complete yet, or if a fix hasn't been fully implemented or even if the damage done was embarrassing... there's no way you'd want to tip your hand and let the attacker know your reaction.
And so what if they knock out a small part of the grid for a few hours or days -- What damage does that actually cause? Unless it's part of a coordinated strike, it doesn't do much.
Asked and answered. At the right moment, a power cut can be catastrophic. Perhaps military channels remain open, but if civilian channels are closed,
Re: (Score:3, Informative)
You should try to live in some of the harsh weather states, like Florida.
When I was a kid, we'd experience up to 12 hours of power outages about once a month. If it was night time, the most chaos was to look to see if the neighbors lights were on.
During (and after) hurricanes, it's a given that you will probably expect a prolonged power outage. People get along fine without the need of electricity. You'll find both LEOs and civilians directing traffic at busy
Re: (Score:3)
You should try to live in some of the harsh weather states, like Florida.
I was born in Canada, ran an ISP in the Arctic for 3 years and now live in the South Pacific, land of earthquakes, tsunamis, hurricanes and volcanoes. I've lived for extended periods of time without power, including the Great Canadian Ice Storm and the blackout of 2002.
I accept what you're saying, but my conclusions from the same evidence differ a little. What we're talking is losing power over wide areas at a crucial moment:
Re: (Score:3)
Well, from both of our observations, and from what I have seen from other people, we all survive fine.
The Northeast US gets really nasty storms (i.e., nor'easters). I was only 4 during the blizzard of 1978, but I do remember seeing ice floating in the road and our yard, and houses that had been swept out to sea. I asked my mom about it recently, and she said we were without power or gas for 14 days. Our basement (where the gas heater was) was flooded for a while, so until th
Re: (Score:2, Informative)
You're wrong. See Russia's cyberwars on Estonia [wired.com] (2nd story) [bbc.co.uk] and Georgia [nytimes.com].
Industrial espionage (Score:3)
We're mostly talking about industrial espionage here. Companies often don't buy security just like people often don't buy health insurance. China's has set an example of government backed industrial espionage, which plays a big role in their growth. So governments see this as an opportunity to provide a service.
In fact, the companies would probably learn they need good geeks eventually, unlike people and health care. Governments could help the most by explaining good people security, which I'm sure get
Re: (Score:2)
Cyberwarfare between countries isn't likely to happen until other, cheaper methods of warfare somehow become ineffective.
And how is a $569K cruise missile to destroy a powerplant cheaper than having someone hack into their systems and leave a program behind to brick the whole thing on invasion night?
Re: (Score:1)
Re: (Score:3, Funny)
"how bout the constant attacks on DOD and DOE systems from china"
How about the constant attacks on everywhere from everywhere all the time.
"that they just might lose their minds if they lost it."
So that's where the canibles in all the post apoc movies come from. They're teenagers who lost access to facebook!
Re: (Score:1)
Re: (Score:2)
My point is that "cyberwar" ,while a silly made up word that I'm fully expecting to lead to as much stupidity in the next decade as the "war on drugs" has in the last, is nothing special.
Defendin against *hackers working for your favorite hostile government* and defending against every other hacker, cracker, script kiddie or bot out there is pretty much the same.
The internet is already the a bandlands filled with bandits armed with the digital equivilent of nuklear weapons yet it's puttered along for decade
Re: (Score:2)
I get too used to the spellcheck feature in firefox.
And I'm far too used to typing nuklear rather than nuclear from visiting nuklearpower.com
Fake Conference? (Score:5, Funny)
This just totally feels like those fake conferences that were posted about recently, where people would book hotel/voucher packages online only to find out the conference itself did not even exist!
Wouldn't that be sweet irony?
Re: (Score:2, Funny)
"Cyber" (Score:4)
How long is it going to take till I can read a word starting with "cyber" without grinning? :D
Re: (Score:1)
Two points.. (Score:1)
1 - There are no real problems with information sharing if they really wanted to. The model for this that would allow control over what is shared has existed for years in the military. However...
2 - The participants are hopefully aware that part of the job is protecting themselves against the others. What one nation labels "organised crime" is for another nation simply "economic espionage". For starters, I would love to be near US customs when all these delegates arrive and are temporarily relieved of t
As many as it takes (Score:2)
I think it is the only real way to support some resemblance of good order in the Internet. I mean an international cooperation in prosecution of cyber-thieves, spammers, bot-net owners, virus writers, etc.
The ideas from IT industry can be well used in this area. For example, outsourcing. Building vast camps in the North of Russia for cyber-crimianls, sort of the New Int'l Cyber-GULAG, but this time a human one. There a camp does not need an expensive fencing and guard-towers, as there is not way to walk out