U.S. Starts "Manhattan Project" on Cyber Security (Finally)

And it only took the resignation of four Cyber-Security Czars for them to get around to taking the threat seriously...

From Wired:

U.S. Has Launched a Cyber Security 'Manhattan Project,'
Homeland Security Chief Claims

SAN FRANCISCO -- The federal government has launched a cyber security "Manhattan Project," U.S. homeland security secretary Michael Chertoff said Tuesday, because online attacks can be a form of "devastating warfare", and equivalent in damage to "physical destruction of the worst kind."

Speaking to hundreds of security professionals at the RSA security conference, Chertoff cited last year's denial-of-service attacks against Estonia, and hypothetical hack attacks on financial networks and air traffic control systems, as proof that a federal strategy was needed.

"Imagine, if you will, a sophisticated attack on our financial systems that caused them to be paralyzed," Chertoff said. "It would shake the foundation of trust on which our financial system works."

...

The Bush administration's Cyber Initiative has gotten $150 million in funding for this year, and the administration is requesting $192 million for 2009.

Chertoff hopes that the government's new cyber security efforts will lead to technology breakthroughs that it can share with the private sector. Silicon Valley entrepreneur Rod Beckstrom was recently named to head that effort.

In fact, Chertoff imagines the government's cyber security center will transform its current intrusion detection system, named Einstein, into a pre-computer crime detector.

"We might have the ability to understand the signature of an attack before it is launched," Chertoff said. "I think it could become an early warning system that might be able to detect an attack before it is coming. Giving an adversary one bite at the apple before we understand the attack's meta data, or the code, is one bite too many."

One side-benefit of better cyber security is less identity and intellectual property theft...

I've been harping about the need for this for a long time. Its good to see DHS and the administration taking this seriously. The attack on Estonia as well as increased hacking by China into govt and private networks probably greatly contributed to the DHS finally taking network security seriously. I just wish that they had been more proactive in implementing this initiative. Given the amount of time it'll take the R&D people to come up with solutions our networks will continue to be vulnerable for a long while. In theory had we taken up a similar initiative shortly after 9/11 we could have already had security solutions in place by now.

However internet security tends to be reactive rather than proactive. So while I'm glad to see them finally getting the ball rolling on this I'm hoping they'll get everything up and running before the Zombies get us all.

Chinese military hacked into Pentagon

From the Financial Times:

The Chinese military hacked into a Pentagon computer network in June in the most successful cyber attack on the US defence department, say American ­officials.

The Pentagon acknowledged shutting down part of a computer system serving the office of Robert Gates, defence secretary, but declined to say who it believed was behind the attack.

Current and former officials have told the Financial Times an internal investigation has revealed that the incursion came from the People’s Liberation Army.

One senior US official said the Pentagon had pinpointed the exact origins of the attack. Another person familiar with the event said there was a “very high level of confidence...trending towards total certainty” that the PLA was responsible. The defence ministry in Beijing declined to comment on Monday.

additionally

Sami Saydjari, chief executive of Cyber Defense Agency and a former Pentagon cyber expert, warns of the potential for terrorist groups, such as al-Qaeda, to attack the financial, telecoms, and power sectors.

To underscore the threat, he notes that no cyber red team – hackers enlisted to attack systems to help identify weaknesses – has ever failed to meet its objective.

Gregory Garcia, the assistant secretary for cyber security at the department of Homeland Security, says the number of cyber incidents reported to the department’s computer readiness team so far this year is 35,000. That compares to 4,100 for the whole of 2005.

I've spoken on this before but we really need to get our ducks in a row when it comes to national network security. I know why the problem hasn't been fixed and thats cost and lack of political will. Nothing will be done until after something major happens. Unless the govt currently has some sort of network security Manhattan Project going on odds its up to the private sector to provide a solution. Needless to say a company that can provide a significantly more secure OS or an adaptive and/or reactive firewall stands to make billions. Ultimately its just a matter of time before one or the other happens.

Additionally its too easy to paint China as the villain here. Anyone capable of cracking our network could have just as easily cracked theirs and launched their attack from a compromised Chinese govt computer. Without inside confirmation that the hacking was by the PLA we'll never be one hundred percent certain. (However we have to treat the attack as though the information downloaded is in the hands of China.) We have in essence moved into an IT cold war in which an individual or group can be as much of a threat to our networks, financial sector, or infrastructure as any state. Now isn't that a comforting thought?

Dude, where's my vote?

One of my earliest posts was about the potential for voting machines to be tampered with. Now its been proven possible in CA:

University of California computer scientists have recently shown it's possible to carry out a bevy of hacks on electronic voting machines currently certified for use in the Golden State.

In reports released late last week, the researchers chronicle their five-week endeavor, at the request of California Secretary of State Debra Bowen, to exploit examine machines made by Hart InterCivic, Sequoia Voting Systems and Diebold. The same models are also in use in many other states, according to a database compiled by the Election Reform Information Project.

Their conclusion? "The security mechanisms provided for all systems analyzed were inadequate to ensure accuracy and integrity of the election results and of the systems that provide those results," wrote principal investigator Matt Bishop, a computer science professor at the University of California, Davis. More

Makes for a strong argument for paper backups even though paper ballots have been known to disappear although I will say that one million electrons are much easier to dispose of than one million voting slips. So whats the solution? There isn't a perfect one. I'm pro paper trails and I'd like for voters to be able to choose a paper ballot if they prefer. I think the only way to truly dissuade tampering with elections would be to make it an act of treason. I know that if I were dictator of America it certainly would be.

Dept. of Homeland Security Hacked 800 Times

DHS acknowledges own computer break-ins

By TED BRIDIS, Associated Press Writer

The Homeland Security Department, the lead U.S. agency for fighting cyber threats, suffered more than 800 hacker break-ins, virus outbreaks and other computer security problems over two years, senior officials acknowledged to Congress.

In one instance, hacker tools for stealing passwords and other files were found on two internal Homeland Security computer systems. The agency's headquarters sought forensic help from the department's own Security Operations Center and the U.S. Computer Emergency Readiness Team it operates with Carnegie Mellon University.

In other cases, computer workstations in the Coast Guard and the Transportation Security Administration were infected with malicious software detected trying to communicate with outsiders; laptops were discovered missing; and agency Web sites suffered break-ins.

The chairman of the House Homeland Security Committee, Rep. Bennie Thompson, D-Miss., said such problems undermine the government's efforts to encourage companies and private organizations to improve cyber security.

"What the department is doing on its own networks speaks so loudly that the message is not getting across," Thompson said.

Congressional investigators, expected to testify Wednesday during an oversight hearing about the department's security lapses, determined that persistent weaknesses "threaten the confidentiality, integrity and availability of key DHS information and information systems," according to a new report from the Government Accountability Office being released later in June.

The Homeland Security Department's chief information officer, Scott Charbo, assured lawmakers his organization was working to prevent such problems. more

Boy, doesn't that just make you feel safe? DHS is now on its fourth cybersecurity chief in six. years. That seems like a high turnover rate for such an important job. But maybe that's because they still aren't taking the threat seriously enough.

Former cybersecurity chief Richard Clarke once stated in an interview:

"We, as a country, have put all of our eggs in one basket. The reason that we're successfully dominating the world economically and militarily is because of systems that we have designed, and rely upon, which are cyber-based. It's our Achilles heel. It's an overused phrase, but it's absolutely true.

It could be that, in the future, people will look back on the American empire, the economic empire and the military empire, and say, "They didn't realize that they were building their whole empire on a fragile base. They had changed that base from brick and mortar to bits and bytes, and they never fortified it. Therefore, some enemy some day was able to come around and knock the whole empire over." That's the fear."

Take some time to read the full interview here.