Category: IT

In July 2020, the gaming company Nintendo was compromised in a data breach that commentators described as unprecedented.

The breach, dubbed “the gigaleak,” exposed internal emails and identifying information, as well as a deluge of proprietary source code and other internal documents.  But the compromise wasn’t discovered by observing network traffic or even dark web analysis — it was first identified through a post on 4chan.

Less-regulated online spaces like imageboards, messaging apps, decentralized platforms, and other obscure sites are increasingly relevant for detecting these types of corporate security compromises. Serious threats can be easily missed if security teams aren’t looking beyond standard digital risk sources like technical and dark web data feeds.

Overlooked risks can cost companies millions in financial and reputational damage — but existing commercial threat intelligence solutions often lack data coverage, especially from these alternative web spaces.

How does this impact corporate security operations, and how can data coverage gaps be addressed?

An evolving corporate risk landscape

Security risk detection is no longer limited to highly anonymized online spaces like the dark web or technical feeds like network traffic data.

While these sources remain crucial, corporate security teams also need to assess obscure social sites, forums, and imageboards, messaging apps, decentralized platforms, and paste sites. These spaces are frequently used to circulate leaked data, as with the Nintendo breach, and discuss or advertise hacking tactics like malware and phishing.

Example of leaked data on RaidForums, a popular hacking website on the deep web—posted/discovered by Echosec Systems

Beyond malware and breach detection, these sources can indicate internal threats, fraud, theft, disinformation, brand impersonation, potentially damaging viral content, and other threats implicating a company or industry.

The rise of hacktivism and extremism on less-regulated networks also poses an increased risk to companies and executives. For example, disinformation or violence targeting high-profile personnel may be discussed and planned on these sites.

Why are these alternative sources becoming more relevant for threat detection?

To start, surface and deep web networks are more accessible for threat actors even though the dark web may offer more anonymity. They also have further reach than the dark web — a relatively small and isolated webspace — if the goal is to spread disinformation and leaked data.

Obfuscation tactics in text-based content are also becoming more sophisticated. For example, special characters (e.g. !4$@), intentional typos, code language, or acronyms can be used to hide targeted threats and company names. Adversaries are often less concerned with detection on surface and deep websites using these techniques.

Decentralization is also becoming a popular hosting method for threat actors concerned with censorship on mainstream networks and takedowns on the dark web. Decentralization means that content or social media platforms are hosted on multiple global or user-operated servers so that networks are theoretically impossible to dismantle.

CEO-targeted death threat on the decentralized social network Mastodon — discovered by Echosec Systems

While the dark web was once considered a mecca for detecting security threats, these factors are extending relevant intelligence sources to a wider range of alternative sites.

New barriers to threat detection

Emerging online spaces offer valuable security data, but the changing threat landscape is posing new challenges for corporate security. Many alternative threat intelligence sources are obscure enough that analysts may not know they exist or to look there for threats. Some surface and deep websites, like forums and imageboards, emerge and turn over quickly, making it hard to keep track of what’s currently relevant.

Additionally, many commercial, off-the-shelf APIs provide access to technical security feeds and common sources like the dark web and mainstream social media — but do not offer this alternative data. This creates a functional gap for security teams who realize the value of obscure online sources but may be forced to navigate them manually.

APIs enable security teams to funnel data from online sources directly into their security tooling and interfaces rather than collecting data through manual searches on-site.

Leaked image of a security operations Centre on social media — discovered by Echosec Systems

For most corporate security teams and operations centers, manual data gathering — which often requires creating dummy accounts — is unsustainable, requiring a significant amount of time and resources.

Efficient threat intelligence access is essential in an industry where security teams are often understaffed and overwhelmed by alerts. According to a recent survey by Forrester Consulting, the average security operations team sees 11,000 daily alerts but only has the resources to address 72% of them.

Putting aside the issue of niche data access, industry research suggests that commercial threat intelligence vendors vary widely in their data coverage — overlapping 4% at most even when tracking the same specific threat groups. This raises concerns about how many critical alerts are missed by security teams and operations centers — and how holistic their data coverage actually is, even when using more than one vendor.

Holistic APIs: The future of addressing corporate risk

How do security professionals and operations centers comprehensively access relevant data and accelerate analysis and triage? To address these issues, security teams must rethink their API coverage.

This means adopting commercial threat intelligence solutions that are transparent about their data coverage. Vendors must be able to offer a wider variety of standard and alternative threat sources than is commonly available through off-the-shelf APIs. To achieve this, vendors often must source data in unique ways — such as developing proprietary web crawlers to sit in less-regulated chat applications and forums.

When standard threat intelligence sources are combined with fringe online data in an API, analysts can do their jobs faster than merging conventional feeds with manual navigation. Analysts also get more contextual value within their tooling than viewing different sources separately. It also means that previously overlooked risks on obscure sites are included in a more holistic security strategy.

An API also retains content that has been deleted on the original site since being crawled, allowing for more thorough investigations than those possible with manual searches. This is important on more obscure networks like 4chan where content turns over quickly.

When collected and catalogued appropriately, a wider variety of online data can be used to train effective machine learning models. These can support faster and more accurate threat detection for overwhelmed security teams. In fact, some emerging APIs have machine learning functionality already built-in so analysts can narrow in on relevant data faster.

As alert volumes grow and threat actors migrate to a greater variety of online spaces, security professionals are likely to become more concerned with their data coverage — and how to integrate alternative data sources effectively into workflows…[…] Read more »….

A new frontier is taking shape where smart, autonomous devices running data on 5G networks process information that can lead to near real-time insights enterprises need.

The implementation and adoption of 5G wireless, the cloud, and smarter devices is setting the stage for advanced capabilities to emerge at the edge, according to experts and stakeholders. Communications providers such as Verizon continue to flesh out the newest generation of wireless, which promises to offer more robust data capacity and mobile solutions. In brief, the edge has the potential to be a place where greater data processing and analytics happens with near real-time speed, even in seemingly small devices. On the hardware and services side, IBM, Nokia Enterprise, DXC Technology, and Intel all see potential for these converging resources to evolve the edge in 2021 in exponential ways — if all the right pieces fall into place.

The edge is poised to support highly responsive compute, far from core data centers, but Bob Gill, research vice president with Gartner, says the landscape needs to become more cohesive.  “As long as all we have are vertical, monolithic, bespoke stacks, edge isn’t going to scale,” he says, referring to the differing resources created to work at the edge that might not mesh well with other solutions.

Gill defines the edge as the place where the physical and digital worlds interact, which can include sensors and industrial machine controllers. He says it is a form of distributed computing with assets placed in locations that can optimize latency and bandwidth. Retailers, internet of things, and the industrial world have already been working at the edge for more than a decade, Gill says. The current activity at the edge may introduce the world to even more possibilities. “What’s changed is the huge plethora of services from the cloud along with the rising intelligence and number of devices at the edge,” he says. “The edge completes the cloud.”

The focus of the evolution at the edge is to push intelligence to locations where bandwidth, data latency, and autonomy might otherwise be concerns when connecting to the cloud or core computing. With more autonomy, Gill says devices at the edge will be able to operate even if their connections are down.

This might include robots in manufacturing or automated resources in warehousing and logistics, as well as transportation, oil, and gas. Organizations will need some normalization of platforms and solutions at the edge, he says, in order to see the full benefit of such resources. “They’re looking for standardized toolsets and a way that everything isn’t a bespoke one-off,” Gill says.  This could include using open source frameworks deployed to create solutions that can be tweaked.

Gill expects there to be move toward a standardized approach in the next five years. He says enterprise leadership should ask questions about ways the edge can help the organization achieve goals while also eliminating risk. “The c-suite should be saying, ‘What is the business benefit I’m getting out of this? Is it something that’s replicable?’”

Edge mimics public cloud

Edge computing is becoming an integral part of the distributed computing model, says Nishith Pathak, global CTO for analytics and emerging technology with DXC Technology. He says there is ample opportunity to employ edge computing across industry verticals that require near real-time interactions. “Edge computing now mimics the public cloud,” Pathak says, in some ways offering localized versions of cloud capabilities regarding compute, the network, and storage. Benefits of edge-based computing include avoiding latency issues, he says, and anonymizing data so only relevant information moves to the cloud. This is possible because “a humungous amount of data” can be processed and analyzed by devices at the edge, Pathak says. This includes connected cars, smart cities, drones, wearables, and other internet of things applications that consume on demand compute.

The population of devices and scope of infrastructure that support the edge are expected to accelerate, says Jeff Loucks, executive director of Deloitte’s center for technology, media and telecommunications. He says implementations of the new communications standard have exceeded initial predictions that there would be 100 private 5G network deployments by the end of 2020. “I think that’s going to be closer to 1,000,” he says.

Part of that acceleration came from medical facilities, logistics, and distribution where the need is great for such implementations. Loucks sees investment and opportunities for companies to move quickly at the edge with such resources as professional services robots that work alongside people. Such robots need fast, low latency connections made possible through 5G and have edge AI chips to assist with computer visions, letting them “see” their environment, he says.

Loucks says there are an estimated 650 million edge AI chips in the wild this year with that number expected to scale up fast. “We are predicting [there will be] around 1.6 billion edge AI chips by 2024 as the chips get smaller with lower power consumption,” he says.

The COVID accelerator

World events have played a part in advancing the resources and capabilities at the edge, says Paul Silverglate, vice chairman and Deloitte’s US technology sector leader. “COVID has been an accelerator and a challenge as it relates to computing at the edge,” he says. Remote working, digital transformation, and cloud migration have all been pushed faster than expected in response to the repercussions of the pandemic. “We’ve gone 10s of years into the future,” Silverglate says.

That future may already be happening as Verizon sees the components of the edge coming together, says director of IoT and real-time enterprise Thierry Sender. “From a Verizon standpoint, we now have partners for enabling edge deeply integrated into our 5G network and wireless overall,” he says, “which means 4G devices get the benefit of the capabilities.” For example, Sender says for private infrastructure, Verizon has a relationship with Microsoft to deliver on compute resources that support mission critical applications large enterprises would have in warehouses or manufacturing. That ties together different bespoke solutions that enterprises use together to solve their needs.

The edge elements coming together in 2020 are building blocks for exponential change, Sender says. “2021 is the year of transformation,” he says. “That’s where a lot of the solutions will begin to truly manifest themselves.” Sender also says 2022 will be a year of disruption as industries adapt to real-time operational and customer insights that affect their businesses. “Every industry is being impacted with this edge integration to network,” Sender says.

This transformative move is well under way, says Evaristus Mainsah, general manager of the IBM Cloud private ecosystem. “What we’re seeing is lots of data moving out to edge locations.” That is thanks to more devices carrying enough compute to conduct analytics, he says, reducing the need to move data to a data center or to the cloud to process. By 2023, expect 50% of new on-prem infrastructure will be in edge locations, he says, compared with 10% now. Enterprise data processing outside of central data centers will also grow from 10% now to 75% in 2025, Mainsah says. “Think of it as a movement of data from traditional data center or cloud locations out into edges.”

There is a generation shift taking place, says Karl Bream, head of strategy for Nokia’s enterprise business, which will take some time and see more agility, automation, and efficiency. “The network is becoming higher capacity, much more reliable, much lower latency, and can perform better in situations where you’re controlling high value assets,” he says. Bream calls this an inflection point, though networks alone cannot achieve the next evolution. Data privacy and security remain concerns, he says, as many enterprises must decide if they can allow data to reside offsite.

Tradeoffs and choices

There are tradeoffs and choices to be made, but possibilities are growing fast at the edge. “We’re seeing web companies putting edge type scenarios into place to put storage closer and closer to the device,” Bream says..[…] Read more »…..

The mathematics of cryptography

Under the hood, cryptography is all mathematics. For many of the algorithms in development today, you need to understand some fairly advanced mathematical concepts to understand how the algorithms work.

That being said, many cryptographic algorithms in common use today are based on very simple cryptographic operations. Three common cryptographic functions that show up across cryptography are the modulo operator, exclusive-or/XOR and bitwise shifts/rotations.

The modulo operator

You’re probably familiar with the modulo operator even if you’ve never heard of it by that name. When first learning division, you probably learned about dividends, divisors, quotients and remainders.

When we say X modulo Y or X (mod Y) or X % Y, we want the remainder after dividing X by Y. This is useful in cryptography, since it ensures that a number stays within a certain range of values (between 0 and Y – 1).

Exclusive-or

In English, when we say OR, we are usually using the inclusive or. Saying that you want A or B probably means that you’re willing to accept A, B or both A and B.

Cryptography uses the exclusive or where A XOR B equals A or B but not both. The image above shows a truth table for XOR. Notice that anything XOR itself is zero, and anything XOR zero is itself.

XOR is also useful in cryptography because it is equivalent to addition modulo 2. 1 + 0 = 1 and 1 + 1 = 2 = 0 (mod 2) = 0 + 0. XOR is one of the most commonly-used mathematical operators in cryptography.

Bitwise shifts

A bitwise shift is exactly what it sounds like: a string of bits is shifted so many places to the left or right. In cryptography, this shift is usually a rotation, meaning that anything that “falls off” one end of the string moves around to the other.

The bitwise shift is another operator that has special meaning in modulo 2. In binary (mod 2), shifting to the left is multiplying by a power of two, while shifting to the right is division by a power of two.

Common structures in cryptography

While cryptographic algorithms within a “family” can be similar, most cryptographic algorithms are very different. However, some cryptographic structures exist that show up in multiple different cryptographic “families.”

Encryption operations and key schedules

Many symmetric encryption algorithms are actually two different algorithms that are put together to achieve the goal of encrypting the plaintext. One of these algorithms implements the key schedule, while the other performs the encryption operations.

In symmetric cryptography, both the sender and the recipient have a shared secret key. However, this key is often too short to be used for the complete encryption process since many algorithms have multiple rounds. A key schedule is designed to take the shared secret as a seed and use it to create a set of round keys, which are then fed into the algorithm that actually performs the encryption.

The other half of the encryption algorithm is the part that converts the plaintext to a ciphertext. This is typically accomplished by using multiple iterations or “rounds” of the same set of encryption operations. Each round takes a round key from the key schedule as input, meaning that the operations performed in each round are different.

The Advanced Encryption Standard (AES) is a classic example of an encryption algorithm with separate parts implementing the encryption operations and key schedule, as shown above. The different variants of AES (AES-128, AES-192, and AES-256) all have a similar encryption process (with different number of rounds) but have different key schedules to convert the various key lengths to 128-bit round keys.

Feistel networks

A Feistel network is a cryptographic structure designed to allow the same algorithm to perform both encryption and decryption. The only difference between the two processes is the order in which round keys are used.

An example of a Feistel network is shown in the image above. Notice that in each round, only the left half of the input is transformed and the two halves switch sides at the end of each round. This structure is essential to making the Feistel network reversible.

Looking at the first round (of both encryption and decryption), we see that the right side of the input and the round key are used as inputs to the Feistel function, F, to produce a value that is XORed with the left side of the input. This is significant because the output of F in the last round of encryption and the first round of encryption are the exact same. Both use the same round key and same value of Ln+1 as input…[…] Read more »….