::: Shailendra Nair :::

The Economic Development Administration (EDA) is an agency in the US Department of Commerce that promotes economic development in regions of the US suffering low growth, low employment, and other economic problems. In December 2011, the Department of Homeland Security notified both the EDA and the National Oceanic and Atmospheric Administration (NOAA) that there was a potential malware infection within the two agencies’ systems.

The NOAA isolated and cleaned up the problem within a few weeks.

The EDA, however, responded by cutting its systems off from the rest of the world — disabling its enterprise email system and leaving its regional offices no way of accessing centrally-held databases.

It then recruited in an outside security contractor to look for malware and provide assurances that not only were EDA’s systems clean, but also that they were impregnable against malware. The contractor, after some initial false positives, declared the systems largely clean but was unable to provide this guarantee. Malware was found on six systems, but it was easily repaired by reimaging the affected machines.
Ars Technica

EDA’s CIO, fearing that the agency was under attack from a nation-state, insisted instead on a policy of physical destruction. The EDA destroyed not only (uninfected) desktop computers but also printers, cameras, keyboards, and even mice. The destruction only stopped — sparing $3 million (£2 million) of equipment — because the agency had run out of money to pay for destroying the hardware.

The total cost to the US taxpayer of this incident was $2.7 million (£1.8 million): $823,000 (£550,000) went to the security contractor for its investigation and advice, $1,061,000 (£710,000) for the acquisition of temporary infrastructure (requisitioned from the Census Bureau), $4,300 (£2,870) to destroy $170,500 (£114,000) in IT equipment, and $688,000 (£462,000) paid to contractors to assist in development a long-term response. Full recovery took close to a year.

The full grim story was detailed in Department of Commerce audit released on 26 June, subsequently reported by Federal News Radio.

The EDA’s overreaction is, well, a little alarming. Although not entirely to blame — the Department of Commerce’s initial communication with EDA grossly overstated the severity of the problem (though corrected its error the following day) — the EDA systematically reacted in the worst possible way. The agency demonstrated serious technical misunderstandings — it shut down its email servers because some of the emails on the servers contained malware, even though this posed no risk to the servers themselves — and a general sense of alarmism.

The malware that was found was common stuff. There were no signs of persistent, novel infections, nor any indications that the perpetrators were nation-states rather than common-or-garden untargeted criminal attacks. The audit does, however, note that the EDA’s IT infrastructure was so badly managed and insecure that no attacker would need sophisticated attacks to compromise the agency’s systems.

This story originally appeared on ars technica

As published on http://www.wired.co.uk/news/archive/2013-07/09/us-agency-overreacts-virus

SUMMARY:
Outside an on-premise firewall, data in the cloud needs ample security protection. MIT researchers have drawn up a system to keep attackers from learning about data when it goes to and from memory.

Encryption is a critical tool for keeping data secure as it travels to and lives inside of public clouds, but when a chip needs to send or receive data stored outside its circuitry in off-chip memory, it’s possible for an attacker to learn about workloads and figure out what to target.

Researchers at MIT have been developing a system called Ascend to prevent those security vulnerabilities involving memory access, according to a Tuesday news release from the school.

Ascend does a few things to minimize the likelihood that a cyberattack could ascertain information from the transmission of data to and from memory. First off, it proposes a novel way of querying memory addresses for data:

What Devadas and his collaborators — graduate students Ling Ren, Xiangyao Yu and Christopher Fletcher, and research scientist Marten van Dijk — do instead is to arrange memory addresses in a data structure known as a “tree.” A family tree is a familiar example of a tree, in which each “node” (in this example, a person’s name) is attached to only one node above it (the node representing the person’s parents) but may connect to several nodes below it (the person’s children).
With Ascend, addresses are assigned to nodes randomly. Every node lies along some “path,” or route through the tree, that starts at the top and passes from node to node, without backtracking, until arriving at a node with no further connections. When the processor requires data from a particular address, it sends requests to all the addresses in a path that includes the one it’s really after.

What’s more, whenever a chip asks a single memory address for data, Ascend switches around the address with some other memory address.

The system also hampers efforts to read into the frequency of a chip’s requests for data in memory by sending out many periodic requests, even when the chip doesn’t actually want more data because it’s busy. This is important because a long gap between requests could indicate a particularly challenging and therefore important workload worth targeting during an attack.

This architecture “hasn’t been built yet,” said one of the researchers, Srini Devadas, a professor of electrical engineering and computer science at MIT, according to the news release. Hopefully it will be built soon, though, because cloud security is becoming a bigger deal by the day.

More companies are leaving behind on-premise applications and taking up Software as a Service (SaaS) products instead. Meanwhile providers of Platform as a Service (PaaS) and Infrastructure as a Service (IaaS) might be interested in incorporating the architecture into their servers so as to provide better security to their customers. News of cyberattacks and government snooping only amplify concerns about security on shared infrastructure, making solutions like Ascend more enticing.

As published on http://gigaom.com/2013/07/02/researchers-eye-memory-access-as-cloud-security-loophole-and-propose-a-solution/