Future industry: No chance for industrial pirates with highly secure networks

In the future, production facilities will be able to communicate and interact with one another, and machinery will often be remote-serviced. But no company boss wants to run the risk of opening the door to industrial espionage and sabotage with unsecure networks. A new development offers a particularly high level of security. Researchers are presenting the system at the embedded world trade fair from 25 through 27 February in Nuremberg.

Though it looks like something straight out of a science-fiction film, it will soon become a reality in the production halls of the future: products along the production lines will know where they are, which steps they have already completed, and what they still need to become a finished product. Production facilities will coordinate their work steps and exchange information with one another. There will be no need for technicians to set foot in the production halls for servicing, with machinery inspections carried out remotely instead. In a word: products and plants will be intelligent. This is also referred to as "Industry 4.0" -- meaning industry of the fourth generation, following mechanization, electrification and digitization.

There's one sticking point, though. Facilities will use a data network to communicate with one another, and even the products themselves will have to "log in." Human beings will use this network connection to control and monitor production, too -- to keep an eye on plant operation even if they don't happen to be in the production hall. On top of this, there will be remote maintenance and remote software updates. For all these functions, one thing is indispensable: secure access that keeps industrial pirates and saboteurs out. Certainly, businesses can use a normal Internet connection for this form of data traffic, securing it through a "Virtual Private Network," or VPN for short. "But there's something many people don't know: there are VPNs and there are VPNs -- and not every VPN access is secure," explains Bartol Filipovic, division director at the Fraunhofer Institute for Applied and Integrated Security (AISEC) in Garching, Germany.

That is why researchers have come up with a router that offers secure VPN access. Authorization and firewall functionalities provide additional access protection. The necessary security protocols can also be integrated directly in the industrial customer's plants and machinery. "The system is a software kit. We've already developed the basic components, and we can tailor them to fit the customer's specific requirements," Filipovic points out. The process takes around four weeks to complete. The researchers integrate simple systems at the same time, such as sensors in the pharmaceuticals industry that report filling levels or mixing ratios -- these, too, should not forward their information to unauthorized parties.

Physical protection: film sounds an alarm

On the one hand, the system protects companies from spies trying to hack their way into the network from off-site locations. On the other hand, it also outwits data thieves trying to coax secrets out of routers and circuit boards on location. A special film affixed to security-relevant casings immediately reports any attempts to unscrew the protective covering to access security-relevant data. Developed at AISEC, the film is affixed to the router casing, or directly onto the circuit boards -- the board containing key control elements such as microcontrollers, chips, diodes and other security-critical processing units -- and sealed shut at multiple points. If the router is switched off, all of the software it contains is stored in encrypted form. If it is in operation, though, it needs the decrypted program code. Each decryption key is a function of the properties of the protective film. And if these properties are changed -- by tearing open or drilling into the film to reach the circuit boards, for instance -- the film detects the attack in a few milliseconds and responds immediately: it deletes all of its unencrypted, security-relevant data.

Unauthorized intruders cannot get to the software. Data deletion is no problem for the business, however: all a company has to do is reinstall the software and affix a new protective film. "Combining software and film gives us an ideal security level," Filipovic says, "and the events of 2013 very clearly taught us just how important that can be." Secure communication software and hardware are fundamental to the evolution of production toward digitization and Industry 4.0; and protection against espionage, sabotage and product piracy is crucial to innovation and a strong competitive position.

View the original article here

FLAMING RETORT: Frankenstein Malware - the future of cyberwar, or just a catchy headline?

Over 170,000 people are part of the Sophos community on Facebook. Why not join us on Facebook to find out about the latest security threats.

Hi fellow Twitter user! Follow our team of security experts on Twitter for the latest news about internet security threats.

Already using Google+? Find us on Google+ for the latest security news.

Filed Under: Featured, Malware

A number of friends, acquaintances and readers have asked me recently about "the recent Frankenstein virus research paper thing."

Bankrolled at least in part by the US Air Force, and openly touted by its authors as "a powerful tool for active defense (e.g., offensive cyber-operations)," this internet-era Modern Prometheus story has been widely covered in the technology media, often with a degree of admiration bordering on breathlessness.

When I first heard the full title of the paper, Frankenstein: Stitching Malware from Benign Binaries, and realised that its goal was to come up with a strategy for deliberately creating malware that is harder to detect, my gut reaction was, "We don't need it, it won't work anyway, but it'll make catchy headlines."

Just how reasonable were my visceral and unscientific conclusions?

Very briefly explained, the authors, Vishwath Mohan and Kevin W. Hamlen, describe a mechanism for constructing malicious programs entirely out of code sequences which already appear in legitimate software installed on the victim's computer.

Of course, this raises the question, "Why bother?"

The authors offer an opinion on that matter, saying, "By creating new copies entirely from byte sequences obtained from benign files, we argue that it becomes significantly more difficult for defenders to infer adequate signatures that reliably distinguish malware from non-malware on victim systems."

In less orotund words, "Because it makes the malware harder to detect."

One problem I see with the Frankenstein approach - aside from my understandable objection to anything which makes harder malware easier - is that there is no reason to assume that this Frankenware will be harder to detect simply because it consists of byte sequences which already appear on the victim's computer.

In fact, its inevitably synthetic construction - knitted together as it is from bits and pieces plundered from a completely different context - may paradoxically make it easier to spot.

The object code in Frankenware, you can reasonably assume, will inevitably be of an unnatural and unusual form. It may work, but it will be weird. On that basis alone, you can envisage a practical and effective way to detect it, even without knowing or caring what it does.

And this highlights the second problem I see with the the Frankenstein approach.

Frankenware presumes that anti-virus software relies almost entirely on the static recognition of known code sequences without regard for their order or the context in which they appear, and without considering the overall effects of that code. It assumes, simplistically, that some permutation of a known-good program will, ipso facto, itself look good.

That's not correct, as far as I can see, any more than a statement which only uses words which from the Unanimous Declaration of the Thirteen United States of America will inescapably read like a unilateral assertion of political independence.

Mohan and Hamlen have based their work on the concept of gadgets, which form the basis of Return Oriented Programming (ROP).

In ROP, you rely on finding code sequences already in memory on your victim's computer and knitting them into a meaningful whole. You don't so much care what the gadgets are, but where they are - specifically, that they are already loaded into memory pages marked as executable.

You don't use the gadgets as a means of looking normal, but as a way of behaving normally.

So, borrowing the overall concept of gadgets was an interesting idea for Frankenware, but in the end, a fruitless one, because gadgets are neither necessary nor sufficient for creating hard-to-find malware.

In summary:

Gadget-built code doesn't look more natural just because it's built from strings already on your hard disk.Gadget-built code isn't harder to detect simply because the strings it uses can be found in legitimate programs.The world doesn't need more malware, and it certainly doesn't need more malware construction tools.

In short, is Frankenware which vaguely resembles existing legitimate software, in the same way that a patchwork quilt resembles a woven blanket, likely to be the basis of undetectable malware in a future cyberwar?

I doubt it.

Malware which, at first sight, is legitimate sofware (because it's digitally signed by someone you trust, or delivered officially by your service provider, for example) is in my opinion a much more serious concern.

Then again, Mohan and Hamlen had a paper accepted at the USENIX 2012 Workshop on Offensive Technology, plus a trip to Washington to present it, and I did not.

Follow @duckblog
-

View the original article here

Kids learn computer programming at Hack the Future - San Francisco Chronicle

Audrey Whitmeyer-Weathers / The Chronicle

Betsy Williams (left) helps Hanyah Zachnah learn to hack a chess game.

SAN JOSE -- Dozens of school-age kids gathered at the Tech Museum in downtown San Jose on Saturday for a day of hacking. Armed with laptop computers, the youngsters hunkered down around tables, and in bean-bag chairs on the floor, to learn from a team of veteran hackers, most of them young engineers at Silicon Valley startups.

No, they weren't learning how to break into BART's train control system, play war games on the Pentagon computers or steal credit card numbers. Hack the Future is an effort to extend the techie tradition of hacking - programmers getting together to create code, share ideas and learn from each other. It's about creating and innovating, said Joe Mathes, one of the organizers of Hack the Future, who works at tech startup SauceLabs.

"I like to think of it as two words - the scary one with people breaking into computers, that's not us," he said. "The other one is about building creative things."

Ryan Mitra, 12, of Palo Alto attended the first youth hackfest in May and has already become a veteran at explaining the difference between the two types of hacking.

"Most people think it's getting into someone's computers, hacking security," he said. "But it's really programming, making different things."

About 75 kids, in fifth through 12th grades, attended the daylong event, with about 25 tech-industry workers serving as mentors. While hackathons are typically free-form events with few rules and not much structure, this event had a little of both. At different stations, kids were encouraged to work on their own, but were able get advice or lessons when needed. They could learn how to control a robot, create their own video games or how to solder from Al Alcorn, creator of the classic Pong and regarded as the father of video gaming.

"This whole thing is inspired by a lot of young engineers wanting to share their knowledge," said Alcorn. "I'm their resident celebrity."

Among the many activities, young hackers could design their own versions of Pong, then challenge Alcorn to a game. At a chess station, kids were invited to view the source code - the programming - for a game, then change it to make the game more interesting. One boy tapped a few keys, changed all of his chess pieces to queens, then quickly won the game.

Alex Peake, the founder and CEO of gaming startup Primer Labs, had a crowd of young students eager to learn how to create their own video games.

"The reason to teach people to make video games is that everyone loves video games. Well, 97 percent of people love video games," he said. "Video gaming is the entry point into computer science, and computer science is the entry point to all science. It starts kids on the path of science, technology, math, the whole thing. It becomes cool."

Back in the corner, kids reclining on bean-bag chairs tapped away on laptops and learned to control a 5-foot-tall robot from Willow Garage, a startup that develops personal robotics software.

Akul Gupta, 11, of Cupertino created code that told the robot to raise both hands, lower the one that's touched, then raise the opposite hand high in the air and exchange a high five.

"I do programming at home," he said, "but I never got to interact with a robot at home."

Mukta Goel, his mother, described her son as "a big nerd - he likes to build things on his own." She said the event was an ideal way for kids to learn.

"They're not forced to come here," she said. "They like to come here and learn to do things from each other."

Ashna Avachat, 11, of Pleasanton learned how to build an Android application and was designing a fashion website with her 12-year-old friend, Riti Sachdeval of San Ramon.

"It's not like a classroom," she said. "You can walk around and talk to people about different things, learn things, mostly individually."

That's what Mathes likes to hear.

"Hack the Future has a double meaning," he said. "Kids are going to be the hackers of the future, but we are also hacking the future by making kids who are going to shape the future."

E-mail Michael Cabanatuan at mcabanatuan@sfchronicle.com.

This article appeared on page C - 9 of the San Francisco Chronicle

For the first time in 40 years, this two-story, 23-room home in Lower Hillsborough is on the market. .

Search Real Estate »

Charging stations that can fill the batteries of an electric car in 30 minutes or less are moving from the city to the country.

Search Cars »

Dozens of school-age kids gathered at the Tech Museum in downtown San Jose on Saturday for a day of hacking. Armed with laptop computers, the youngsters hunkered down around tables, and in bean-bag chairs on the floor,...

View the original article here