National Cyber Security

When it comes to technology dependency and risk of legal compliance, the cloud is just like everything else

Follow @DavidLinthicum

The world of cloud computing grows like a weed in summer, and many assumptions are being made that just aren’t correct. I’ve previously exposed four cloud myths you shouldn’t believe. Now it’s time for me to climb up on my soapbox and correct a few more.

Myth 1: Cloud computing is bringing back vendor lock-in. The notion that using cloud computing features (such as APIs) created by one provider or another causes dreaded lock-in seems to be a common mantra. The reality is that using any technology, except the most primitive, causes some degree of dependency on that technology or its service provider. Cloud providers are no exception.

[ In the data center today, the action is in the private cloud. InfoWorld's experts take you through what you need to know to do it right in our "Private Cloud Deep Dive" PDF special report. ]

Here’s the truth about technology, past, present, and future: Companies that create technology have no incentive to fly in close enough formation to let you move data and code willy-nilly among their offerings and those provided by their competitors. The cloud is no different in that respect.

We can talk about open source distributions and emerging standards until we’re blue in the face, but you’ll find that not much changes in terms of true portability. As long as technology and their service providers’ profitability and intellectual property value trump data and code portability, this issue will remain. It’s not a new situation.

Myth 2: Cloud computing use will put you in jail. Yes, you need to consider compliance issues when moving to any new platform, including private, public, and hybrid clouds. However, stating in meetings that moving data and processes to cloud-based platforms somehow puts you at risk for arrest is a tad bit dramatic, don’t you think? Yet I hear that attention-getting claim frequently.

We’ve been placing data, applications, and processes outside of our enterprises for years, and most rules and regulation you find in vertical markets (such as health care and finance) already take this into account. Cloud computing is just another instance of using computing resources outside your span of control, which is nothing new, and typically both perfectly legal and not at all risky. Cut out the false drama as an excuse to say no.

This article, “2 more cloud myths busted: Lock-in and locked up,” originally appeared at InfoWorld.com. Read more of David Linthicum’s Cloud Computing blog and track the latest developments in cloud computing at InfoWorld.com. For the latest business technology news, follow InfoWorld.com on Twitter.

Symantec and VMware source-code breaches led to the companies assuring customers the leaks posed no threat. But what’s the reality?

Follow @infoworld

This week, virtualization software maker VMware acknowledged that a single file posted online came from the source code to its ESX hypervisor. Dating back to at least 2004, the source code may have come from a third party. The virtualization company assured customers that the public posting of the code did not necessarily pose a security issue.

“VMware proactively shares its source code and interfaces with other industry participants to enable the broad virtualization ecosystem today,” Iain Mulholland, director of VMware’s Security Response Center, said in a statement. “We take customer security seriously and have engaged internal and external resources, including our VMware Security Response Center, to thoroughly investigate.”

The file was posted to PasteBin earlier in April by a hacker, Hardcore Charlie, who claimed that the data came from a breach of CEIEC, the China National Electronics Import Export Corp. VMware declined further comment on the potential source of the breach.

Yet, the way the incident has played out so far mirrors the Symantec breach from earlier this year.

In January, the security firm warned customers that a third-party leak had left the source code for three products, including its pcAnywhere remote access software, in the hands of hackers. Symantec originally downplayed the danger of the breach, but subsequently found vulnerabilities that could allow attackers to compromise systems exposed to the Internet. As part of its advice to customers, Symantec urged companies to put systems running pcAnywhere behind a firewall. A subsequent scan of the Internet found that more than 140,000 systems could have been attacked using vulnerabilities in pcAnywhere software.

In Symantec’s case, the company eventually tracked the leak to a 2006 breach of its own network, not an attack on a third party. The company also revealed it had negotiated with the hacker, who used the handle YamaTough, as part of a delaying tactic in conjunction with law enforcement.

The lesson for users of VMware’s products should be to take initial statements with a hefty helping of salt. Symantec’s source code did not come from the breach of a third party, though the hacker claimed it did. It’s possible that VMware’s code may not have come from a Chinese import and export company, no matter what Hardcore Charlie claims.

The VMware source-code leak will likely have less impact on the company’s customers than the leak of Symantec’s source code had on its customers. The current version of pcAnywhere was built from the same components as the leaked code. VMware not only has significantly changed its code base in the last eight years, but is also actively pushing users to a slimmed-down version of its hypervisor, ESXi.

At least one security watcher argues that enterprises need to follow the issue closely. Eric Chiu, president of Hytrust, argues that the firms are so reliant on virtualization that the leak poses some significant risks.

“The big thing is that is highlights how important it is to secure your virtual infrastructure,” he says.

This article, “Shades of pcAnywhere in VMware breach,” was originally published at InfoWorld.com. Get the first word on what the important tech news really means with the InfoWorld Tech Watch blog. For the latest business technology news, follow InfoWorld.com on Twitter.

Glenn Mangham of York, England, said he meant no harm and hoped Facebook would let him off the hook

The hacker who stole Facebook’s source code has gone public with a deeper explanation of how he penetrated the world’s most popular social network.

Glenn Mangham, of York, England, posted a lengthy writeup on his blog and a video, saying that he accepts full responsibility for his actions and that he did not think through the potential ramifications.

[ Also on InfoWorld: Bill Snyder sees a different threat, as the Facebook-Instagram buy signals the oncoming dot-com bubble. | Keep up with key security issues with the Security Adviser blog and Security Central newsletter. ]

“Strictly speaking what I did broke the law because at the time and subsequently it was not authorized,” Mangham wrote. “I was working under the premise that sometimes it is better to seek forgiveness than to ask permission.”

Mangham implied he meant to contact Facebook once he had noticed the social networking site had observed his intrusions, which he did little to hide. He didn’t use proxy servers because he said it made auditing take longer due to the time delay between each request made to a server. He was also hoping that even when he got caught, Facebook would let him off the hook.

That didn’t happen. He was charged and eventually pleaded guilty to three counts of unauthorized access to computer material and unauthorized modification of computer data, according to The Press newspaper in York.

Mangham was sentenced to eight months in prison in February, but the sentence was reduced to four months by an appeals court earlier this month. He was then eligible for release, subject to electronic monitoring, and restrictions on his Internet use.

Mangham used a vulnerability to download Facebook’s source code, arguably the company’s most valued and secret intellectual property.

Mangham portrayed himself as a security researcher who continued to probe Facebook because he wanted to look deeper for other security issues, since most systems have “a tough outer shell and a soft inside.” He wrote that in the past he had been paid by Yahoo for finding vulnerabilities.

He said he took steps to prevent damage to Facebook’s systems, hard-coding a delay in scripts he used to extract the source code to prevent “throttling of the server and impeding its availability.”

After he knew Facebook was on his trail, Mangham wrote he “panicked because I knew how bad it looked without sufficient context.” He maintained that “almost nobody” knew he had a copy of the site’s source code, and that he kept it “physically detached from the Internet.”

“In many respects, it was better secured than the original,” Mangham wrote.

Mangham’s copy of the source code would surely have been of interest to cyber criminals who attempt to use Facebook to perpetuate scams. But he wrote he had no intention of selling the code.

“It is also worth mentioning that I had the source code for just over three weeks with absolutely nothing to prevent me from making copies and redistributing it, this was more than enough time to have caused significant damage to Facebook or to find a buyer, if that had ever actually been my intention but quite clearly it was not,” Mangham wrote.

“When you consider that the only thing that stood between Facebook and potential annihilation were my ethics then I think the fact that it’s all still in good working order should serve as some proof that I’m really not one of the bad guys,” he wrote.

Send news tips and comments to jeremy_kirk@idg.com.

One opponent has expressed worries that the bill would create a ‘Wild West of information sharing’

The U.S. House of Representatives has passed a cyberthreat information-sharing bill that critics say will give U.S. government agencies access to the private communications of millions of Internet users.

The House late Thursday voted 248-168 to pass an amended version of the Cyber Intelligence Sharing and Protection Act, or CISPA, even though the White House Office of Management and Budget has recommended that President Barack Obama veto the bill.

[ Also on InfoWorld: Find out why Robert X. Cringely says CISPA is even worse than SOPA. | Stay ahead of the key tech business news with InfoWorld's Today's Headlines: First Look newsletter. | Read Bill Snyder's Tech's Bottom Line blog for what the key business trends mean to you. ]

Civil liberties groups, including the Center for Democracy and Technology and the American Civil Liberties Union, have opposed the bill, saying it would open up Internet communications to snooping by government agencies, including the U.S. National Security Agency.

But supporters argued the bill is needed to help private companies and government agencies fight cyber attacks. “There are people today who are literally robbing the future of America” by attacking U.S. companies, said Rep. Mike Rogers, a Michigan Republican and lead sponsor of CISPA. “This is the one small thing we get to do to prepare for a bunch of folks who want to bring us down.”

CISPA now moves to the Senate.

CISPA would allow companies such as broadband providers to share customer communications related to cyber threats with a wide range of government agencies. The bill exempts private companies that share cyber threat information in “good faith” from customer lawsuits.

But the CDT and other opponents of the bill questioned whether the information sharing from private companies to government agencies would be truly voluntary, when many telecom providers bid on government contracts.

“In an effort to foster information sharing, this bill would erode the privacy protections of every single American using the Internet,” said Rep. Bennie Thompson, a Mississippi Democrat. “It would create a Wild West of information sharing, where any certified business can share with any government agency, who can then use the information for any national security purpose, and grant that business immunity from virtually any liability.”

CISPA would allow companies to share private and sensitive information with government agencies without a warrant and without proper oversight, the ACLU said in a statement.

“CISPA goes too far for little reason,” Michelle Richardson, ACLU legislative counsel, said in a statement. “Cyber security does not have to mean abdication of Americans’ online privacy. As we’ve seen repeatedly, once the government gets expansive national security authorities, there’s no going back.”

CISPA has support from several tech companies and trade groups, including Facebook, Microsoft, ATT, TechAmerica, and CTIA. For years, tech companies have complained about legal hurdles to sharing cyber threat information with each other and with the government.

The House vote was a “critical step forward” for the cybersecurity of the United States, Shawn Osborne, TechAmerica’s president and CEO, said in a statement.

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant’s email address is grant_gross@idg.com.

Sites we like

Stolen Computer Alert
How to become the world’s No. 1 hacker
Gregory Evans is the World’s No. 1 Security Consutlant

VMware ESX source code from 2003 and 2004 has been stolen and posted online

VMware ESX source code has been stolen and posted online, but the company says its virtualization platform doesn’t necessarily pose an increased risk to customers.

The stolen code amounts to a single file from sometime around 2003 or 2004, the company says in a blog post.

[ Doing server virtualization right is not so simple. InfoWorld's expert contributors show you how to get it right in this 24-page "Server Virtualization Deep Dive" PDF guide. | Use server virtualization to get highly reliable failover at a fraction of the usual cost. Find out how in InfoWorld's High Availability Virtualization Deep Dive PDF special report. ]

“The fact that the source code may have been publicly shared does not necessarily mean that there is any increased risk to VMware customers,” according to the blog written by Iain Mulholland, director of the company’s Security Response Center.

MORE: The Most Mortifying Moments in IT Security History

The code was stolen from a Chinese company called CEIEC (China Electronics Import Export Corporation) during a March breach, according to a posting on the Kaspersky Threat Post blog. The code along with internal VMware emails were posted online three days ago.

VMware didn’t respond immediately to a request for more information about the impact of the breach on customers.

Eric Chiu, president of virtualization security firm Hytrust, says it’s hard to say what VMware customers should do because there’s not enough detail about how the exposed code is being used in current products. In general, though, customers should review the security for virtual environments to address the fact that a compromised hypervisor exposes multiple virtual machines.

While the incident is reminiscent of the breach last year of RSA source code, the circumstances differ. An RSA partner was breached and that breach was used to send a malware-laced email to an RSA staffer who opened it. In VMware’s case, the CEIEC network was hacked and finding the source code was fortuitous.

This is what VMware posted in a blog: “Yesterday, April 23, 2012, our security team became aware of the public posting of a single file from the VMware ESX source code and the possibility that more files may be posted in the future. The posted code and associated commentary dates to the 2003 to 2004 timeframe.

“The fact that the source code may have been publicly shared does not necessarily mean that there is any increased risk to VMware customers. VMware proactively shares its source code and interfaces with other industry participants to enable the broad virtualization ecosystem today. We take customer security seriously and have engaged internal and external resources, including our VMware Security Response Center, to thoroughly investigate. We will continue to provide updates to the VMware community if and when additional information is available.”

Read more about wide area network in Network World’s Wide Area Network section.

Google gets praise from VRP hall of famers — but could learn a lesson or two from Mozilla

Follow @tsamson_IW

Google this week announced that in celebration of the success of its VRP (Vulnerability Reporting Program), the company has upped the bounty for reported bugs to as much as $20,000 a pop.

In a blog post, members of Google’s VRP team proclaimed that since the program launched, they have received more than 780 qualifying vulnerability reports spanning the hundreds of Google-owned services and software. What’s more, the company has paid out $460,000 to around 200 individuals.

Clearly, Google considers VRP a success. But how about the independent security researchers who’ve cashed in on it? InfoWorld reached out to three of the top contributors to Google’s VRP for their perspectives on the program: Roberto “Shotokan” Bindi, James “albino” Kettle, and Jesse Ruderman — all of whom are listed in the Google Security Hall of Fame.

Bindi credited Google for actively encouraging users to participate in a bug hunt by giving them money, bragging rights, and recognition by listing top VRP contributors in their Security Hall of Fame.

He acknowledged that ultimately Google is looking out for its own self interests in dangling bounties for bugs. But “money is still money,” he said, “and only a fool or a cracker will keep a Google bug for himself, leaving aside the award.”

Kettle, too, praised Google — as well as Mozilla, Facebook, Piwik, and Gallery – for offering bug bounties to third parties. He also gave an interesting take on another benefit: It can considerably speed up the bug-fixing process. “If a security engineer spots a vulnerability in their bank, the only safe option is to sit on it,” he offered as a point of comparison. “If they try to warn the bank, they’ll have to wade through layers of customer support just to talk to a developer, who will claim the bug doesn’t exist and/or prosecute them.”

By contrast, he said, “offering a bounty is an assurance that you can directly contact a security team who will understand what you’re talking about, won’t prosecute/threaten you, and will reward you for your efforts. People are scared to even start to learn hacking, and these bounties are an open invitation.”

“Apple, Microsoft, and Adobe notably do not offer bounties,” Ruderman pointed out. “They also seem to be slower to fix security bugs that are reported to them.”

Executive order gives U.S. government authorization to block payments to people and companies that give monitoring tech to the two countries

U.S. President Barack Obama has signed an executive order allowing the U.S. government to block the sale of any technology used to track or monitor dissidents in Syria and Iran by the governments there.

The new order, which went into effect Monday, allows the U.S. government to block the sale of IT equipment “likely to be used to facilitate computer or network disruption, monitoring, or tracking that could assist in or enable serious human rights abuses” by the governments of Iran and Syria.

[ Keep up on the day's tech news headlines with InfoWorld's Today's Headlines: Wrap Up newsletter. ]

The U.S. government must take new steps to stop the “unspeakable violence” against the citizens of Syria and the human rights abuses in Iran and other countries, Obama said Monday, during a speech at the U.S. Holocaust Memorial Museum in Washington, D.C. “National sovereignty is never a license to slaughter your own people,” he said.

Critics say Syrian President Bashar al-Assad has authorized the army there to use force against an uprising beginning in early 2011. The United Nations estimates that more than 11,000 people have died in the fighting.

The government of Iran has also used imported surveillance technologies to track dissidents there, critics say.

Obama’s executive order allows the U.S. government to block payments to any people or companies that operate surveillance and network disruption equipment for the governments of Iran and Syria or sold them that type of equipment.

“These technologies should be in place to empower citizens, not repress them,” Obama said.

The executive order is “one more step” in an effort to end the al-Assad regime, he said.

Human rights abuses in Iran and Syria “threaten the national security and foreign policy of the United States,” Obama wrote in the order. “The Governments of Iran and Syria are endeavoring to rapidly upgrade their technological ability to conduct such activities.”

Earlier this month, Reuters reported that China’s ZTE had agreed to sell embargoed computer equipment from U.S. companies to Iran, but later backed down.

Obama, during his speech, announced several new initiatives focused on preventing genocide and other atrocities. The U.S. Agency for International Development will solicit new technologies that expose human rights violations, he said.

Grant Gross covers technology and telecom policy in the U.S. government for The IDG News Service. Follow Grant on Twitter at GrantGross. Grant’s e-mail address is grant_gross@idg.com.