Category Archives: Ethical Hacking

Ethical hacking: The card game

Whether you are a precocious youngster brought up on classic hacking films or a seasoned professional at the top of his game, Control-Alt-Hack, which has been developed by the University of Washington, is a card game that is worth a try.

The game is based on the pursuit of ethical hacking, which is, in short, the activity that sees individuals, on behalf of an organisation, attack or infiltrate a system in a controlled way so as to establish what weaknesses there are.

Now then, we are quite sure we’ve piqued your curiosity here, so allow us elaborate further. The theme is based on the Information Security industry and attempts to paint an accurate picture of what ethical hacking, sometimes referred to as white hat hacking, is all about.

The premise is that you, along with your fellow players, work for a Hackers Inc, an elite company specialising in network security and data protection. The motto of the company, brilliant by the way, is: “You Pay Us to Hack You.”

“Your job is centred around missions – tasks that require you to apply your hacker skills (and a bit of luck) in order to succeed,” the designers of the game explain.

“Use your social engineering and network ninja skills to break the Pacific Northwest’s power grid, or apply a bit of hardware hacking and software wizardry to convert your robotic vacuum cleaner into an interactive pet toy…no two jobs are the same. So pick up the dice, and get hacking!”

It all sounds very exciting and aside from the fact that it is, in part, a game, the authenticity of it is not to be underestimated. After all, the developers, Tamara Denning, Tadayoshi Kohno, and Adam Shostack, are all computer security experts. They have wanted the game to mimic reality, and thus it has as much “juicy and accurate” content as possible.

While the developers and the university are keen to point out that it should not be mistaken for a being educational – it is, above all, designed for entertainment – the unfolding narratives of the game nevertheless reveal important information security concepts.

Consequently, it can therefore be used as an educational tool, be it in a school session informing the next generation of potential ethical hackers of some of the things they might be involved in, or as a genuinely engaging and fun way of conducting training sessions in a professional capacity.

The game might be fun and a little bit dramatic, a quasi-fictional representation so to speak, but it can be instrumental in triggering new ideas, discussion points and strategies in a decidedly novel way. In this, the efforts must be applauded. Although it is not out yet, professionals, academics and instructors can sign up here for notification.

Before go, we thought we’d elaborate on those timeless hacking movies we’ve all come across. There’s a ton, that much is true, but, for some reason, what came to mind instantly was WarGames with a young Matthew Broderick, the Net, with, well, young Sandra Bullock, and Tron, with Jeff Bridges. And yes, he is young.

Taking a leap into the unknown

Sun-Tzu, the great ancient Chinese military general and strategist, famously said: “Keep your friends close but your enemies closer.” He was a very wise man and his iconic work, the Art of War, is popular among successful politicians and businessmen and women all around the world.

We’re talking about Sun-Tzu because we speculate that Keith B Alexander, a top man at the National Security Agency (NSA), has recently brushed the dust off his version of the book and had a good peruse to explore new ideas.

His speech at the 20th annual Def Con convention, which is attended by and aimed at hackers, suggests that he’s keen on exploring non-traditional avenues to make the internet a safer place. He certainly was in an affable and accommodating mood, turning up in jeans and a t-shirt. It was a statement that said: “I’m not the enemy.”

“In this room, this room right here is the talent our nation needs to secure cyberspace,” Mr Alexander told the audience. “We need great talent. We don’t pay as high as everybody else, but we’re fun to be around.”

The appearance of a senior member of the NSA, the US government’s influential and power security agency, is unprecedented in the country’s history. His language was placatory: “You know that we can protect networks and have civil liberties and privacy; and you can help us get there.”

What he’s promoting is essentially collaboration. He’s not condoning those who engage in criminal behaviour, exploiting networks for commercial reasons or in the name of extremism, political or religious. Such individuals or groups will be found and prosecuted.

Instead, he’s after those who show a promise in this field, precocious youngsters who are bored, those who feel like they are engaging in legitimate protest – the digital manifestation of civil disobedience, for example – who can make a difference to the world if mentored.

“From my perspective, what you’re doing to figure out the vulnerabilities in our systems is absolutely needed,” Mr Alexander said.

If anything, it’s a novel approach and certainly an interesting way in recruiting talent. At a push perhaps, it also implies that there are gaps in knowledge and indeed in the number of specialists. He could certainly do a lot more to attract those who have a gift in this area by actually making an effort to improve public sector pay in this area.

Fun is great; don’t get us wrong, but everyone wants to earn a decent living. Match private sector pay and you’ll have a generation of talent doing a lot of good. Make people feel valued. Sun-Tzu knew that:

“For them to perceive the advantage of defeating the enemy, they must also have their rewards.”

A little chat about penetration testing

Like ethical hacking, penetration testing – or pen testing to use its more popular name – is a way of assessing the security credentials of a network and/or system. Not to be confused with testing whether your dried up bic biro still works, it “tests” a system’s ability to keep information and data secure by identifying weaknesses that can be exploited. Therefore, what does work is commendable, but it doesn’t figure in this strategy. Recognising what doesn’t work is the goal of pen testing.

It can be argued then that professionals with a penetration testing job adopt the purported persona of cyber criminals and hackers. To beat ’em is to join ’em, so to speak: “If I was a hacker, what would I be looking to do to infiltrate or compromise a network?”

Pen testing is a proactive strategy rather than a reactive one, its philosophy being that preventing attacks is better than cleaning up “the mess”.  And many organisations swear by it. If you can spot what your system is lacking in terms of data protection before a criminal does, well, you put yourself in the enviable position of being one step ahead of the game.

However, for all its merits and popularity, there are questions within the industry as to whether the high-tech evaluative method is running out of steam, and entering into the murky world of bubbles. Is it, argue some professionals, reaching the zenith of its powers?

Arguments about the limits of pen testing would be of that conclusion. Limit is the buzzword. For example, a pen tester is restricted in the amount of access they have to assess, geographically speaking. While an internal test can be carried out, it can’t, for example, evaluate the vulnerabilities of outside interference. Equally, local access wire points are negligible when testing via the internet. Limits, limits and limits.

In an engaging LinkedIn discussion two years ago, H Wayne Anderson, managing member of General Business Consulting, LLC, commented:  “You might develop a false sense of security from addressing the wrong vulnerabilities, since an angry, incompetent or malicious insider often poses a greater risk to your data than outsiders do.”

That said, he did concede that proper penetration testing can identify such practices, so long as it is not the “starting place” for boosting the security of any given system.

“The basics must already be in place,” he wrote. “You should have a proper, tested backup regimen, patches tested and installed up to date, properly-sanitized SQL inputs, properly configured firewalls, network monitoring, and other preventative measures in place long before you start pen testing.”

However, in an intriguing and recent article from John Yeo, director of Trustwave SpiderLabs EMEA, he revealed is optimistic about the future of pen testing, its relevance to companies big and small and, accordingly, its strength.

He points out, cannily, that penetration testing and vulnerability scanning’s relationship is often confused, therefore, one assumes, criticism of pen testing might be misleading.

“Vulnerability scanners are great at identifying ‘low-hanging’ vulnerabilities, like common configuration mistakes or unpatched systems, which offer an easy target for attackers,” Mr Yeo wrote in SC Magazine.

“What they are unable to determine is the context or nature of the asset or data at risk, but they are also less able than humans to identify unknown unknowns.”

In contrast, pen testers are much more capable of doing this. Mr Yeo elucidates that he has experience of visiting a network that has undergone an automated scan for vulnerability and still, after human pen testing has occurred, vulnerabilities have been discovered.

“By incorporating pen testing activities as part of a wider information security strategy, organisations can validate the robustness of their security controls and identify as-yet unknown risks to their business,” he concludes. “The results of a penetration test and guidance provided help organisations to better protect sensitive data from falling into the wrong hands.”

To name and shame

Let’s call it a concept. To name and shame, it goes without saying is an interesting moralistic tool, used to punish those who are purported to have committed a crime or wandered off the path that keeps society together.
Like those Ronseal adverts, name and shame does exactly what it says – in this case – on a metaphorical tin, it punishes those that affronted others by revealing what their misdemeanours were.
So, for example, earlier this month, Anne Widdecombe, the former Conservative MP, said she wants to name and shame those who get excessively drunk on the weekend and breach the peace.
“Then people going out specifically to get drunk would risk finding themselves in court on the Monday with their names and photographs in the papers,” she explained.
The idea being, of course, that having experienced public humiliation, people subsequently clean up their acts. It acts as a deterrent.
On the flip side, the argument against it is that it can be construed as a sort of witch-hunt, unjustly embarrassing people. For example, last month, students at a school in Oxfordshire went on protest after such a policy was introduced. Larkmead School felt that putting up a notice board with the photos of underperforming students. Needless to say it backfired.
In our industry, such a thing is going to be piloted by the Trustworthy Internet Movement (TIM), a non-profit, vendor neutral organisation that looks to bring innovative solutions to the many tricky problems that exist in the digital world of the internet.
What it is proposing to do is publish the names of websites that perform well in terms of security and those that fall short of what TIM deems to be acceptable. The obvious outcome, it hopes, is for those who are grace the “wall of shame” to remedy whatever security faults they have.
It aims to focus the initial testing on a website’s use of secure sockets layer (SSL) to encrypt data between a user’s web browser and the website. Or, in short, it obfuscates some of your internet traffic. As the BBC reports, it is often used to protect, for example, sensitive data that people want kept private for obvious reasons, like credit card numbers that zip along the virtual highway when people purchase goods or access a service.
The reason for choosing SSL as a barometer of a website’s security is because it is “one of the fundamental parts of the internet,” explained Philippe Courtot, founder of TIM and chief security officer at the security firm Qualys. Indeed, it’s a fair point, we can’t argue much with that.
Using ethical hacking techniques, TIM will ethically hack selected websites to gauge how secure they are, the results of which, good or bad, being published online for everyone’s perusal. The web being the web, you’ve got a global readership. This will matter. After all, when you have a rep to protect, it pays to ensure one’s name lives up to it.
Do let us know what your thoughts are on this blog and whether you think naming and shaming in this context is an innovative step forward or a sort of misadventure that might fuel animosity if anything.