Feds come out from hiding at hacker show
LAS VEGAS''I'm from the government, and I'm here to ask for your help,' the National Security Agency's Brian Snow last month told an audience at the Black Hat Briefings.
'A lot of you people are talented,' said Arthur Money, assistant secretary of Defense for command, control, communications and intelligence. 'Instead of hacking in, why don't you come over and protect us?'If young hackers aren't ready to sign up right away, he advised, they should at least 'think about what you're doing today that might queer the deal later on.'Money painted a grim picture of a defense community dependent on commercial products and systems that cannot deliver the information superiority on which the Defense Department bases its 21st century strategies. The Solar Sunrise attacks by a pair of teenagers in 1998 were a case in point.Solar Sunrise 'damn near brought the department to its knees; we couldn't have confidence in any of our information,' Money said.Although patches are available for the most commonly exploited computer vulnerabilities, Money blamed software developers for producing buggy products.'The software industry is driven by first-to-market,' he said. 'First-to-market means you deliver crap.'Snow, NSA's technical director for information systems security, called the current state of systems engineering 'pathetic.' NSA no longer is the sole source of approved government cryptographic and security products, but Snow said he seldom recommended off-the-shelf security products even now.'I still haven't found what I'm looking for'assurance,' Snow said. 'We do not beta test on our customers. If one of my products fails, people die.'He chided software producers for security wares that are little more than attractive nuisances, saying that users should demand performance guarantees that go beyond 'proof by emphatic assertion' from company marketers.Snow said he was looking for assurance that not only would a product work as advertised, but that a system could survive the failure or misuse of any of its parts, even when attacked.'We need to design against malice,' he said. 'Believe me, there is malice out there.'Snow was not optimistic that things would get better soon.'Through the next five-year span, I see little improvement in assurance and hence in security,' he said.If security remains poor, investigators should at least have the means to investigate the attacks, said Dominique Brezinski, a technical adviser for the CIA's In-Q-Tel technology incubator. Brezinski told the Black Hat conference there is a lot of money to be made in developing computer forensics tools for the commercial market.'Computer security sucks, still,' Brezinski said. 'Forensic tools fill the gap between what computer security should be and what it is today.'Forensic tools are used to investigate intrusions on computers or systems and to gather evidence for tracking down and prosecuting attackers. The few tools available now are geared for PCs running Microsoft Windows, but Brezinski predicted a growing commercial demand for such tools for Unix enterprise environments.The current market for forensic tools is only about $10 million a year, he said, because it is limited to the small and poorly funded law enforcement niche. He said commercial demand for forensics tools could be 10 times that, if victimized organizations would pursue civil litigation themselves rather than rely on law enforcement to file criminal charges against hackers.In-Q-Tel's mission is to foster development of commercially viable products that can be bought off the shelf by the CIA and the rest of the intelligence community.
Snake oil
By William Jackson
GCN Staff
LAS VEGAS''I'm from the government, and I'm here to ask for your help,' the National Security Agency's Brian Snow last month told an audience at the Black Hat Briefings.
More than 1,500 hackers, security specialists and systems administrators braved 110-degree-plus temperatures to attend the annual precursor to the DefCon hackers' convention. They heard what they'veheard before: Computer and network security is bad'and not getting any better.
Unlike past conferences, where government officials lurked in the shadows and hackers played 'spot the fed,' representatives of several military and intelligence organizations took the podium this year. They used the opportunity to do a little recruiting.
 | Instead of trying to beat us, join us, DOD's Arthur Money tells hackers at conference. |
Snake oil
NEXT STORY: FEDERAL CONTRACT LAW