The Morgan Doctrine: August 2015

Friday, August 28, 2015

Cyber Privateering, Mossad Style

According to InfoWorld's 2015 Cyberthreat Defense Report (read it here), fully 25% of all companies have no plans to invest in a "Threat intelligence Service" (see p. 12). My guess is that 100% of the market would make such an investment if approached with the following communication:

Attached is our documentation of a ZERO-DAY security hole in your computer infrastructure. Also included is a patch we generated to nullify this vulnerability, including source code. A certified hard copy of this information has been delivered to your IT department, along with an offer to license the use of this patch as well as the opportunity for site licensing our automated Threat Intelligence and Patching A.I. technology. Sincerely yours, Israeli Mossad Threat Remediation Services.

So what do you think? Would your company take more than 24 hours to commit to this kind of threat intelligency service?

Thursday, August 13, 2015

Want A Built-in Virus? Then Buy a Lenovo PC!

I've been harping on this subject since 2011. Just type "supply chain" into the search box on the left and you'll get the picture.

Yesterday's U.K. Register verified why the U.S. Government (and several others around the world) prohibit their departments from buying computers made in China (read the story here). Turns out, they hide their "crapware" in Windos laptops' BIOS. This is called "roaching the supply chain," a subject on which I waxed poetic in February (see the story here).

Ahem. Is it true that Cisco routers are built and provisioned with software in China?

Taman Shud.

Wednesday, August 12, 2015

My Bet on Which Foreign Government Will Release Hillary's Emails: China, Russia, Israel, or North Korea?

Get your popcorn ready, folks. This is going to be a most entertaining election season. I've written extensively about Hillary's email server. Check out:

http://www.themorgandoctrine.com/2015/04/dear-president-putin-how-about-peak-at.html
http://www.themorgandoctrine.com/2015/04/hillary-clintons-emails-secure-aswhite.html
http://www.themorgandoctrine.com/2015/03/dear-kim-jong-un-hillarys-your-chance.html
http://www.themorgandoctrine.com/2015/04/mossad-to-release-hillary-clinton-email.html
http://www.themorgandoctrine.com/2015/03/hillary-clinton-email-server-hacked.html

The first foreign government to release them in their entirety wins a massive PR prize. So who will it be. Or, playing on my "Hu's on first" routine (see it here), Hu will be it.

Selah

Friday, August 7, 2015

Predictive Analytics From Data Exhaust: Et Tu Russia!

Sharing is caring: How the enterprise can keep pace with the hackers

Who would have thought that just one day after I predicted Russia was up to something, based upon simple data exhaust on my blog viewership, that those pesky scamps would make headlines for their attack on the Joint Chiefs of Staff emails (see the Computerworld story here)?

Wednesday, August 5, 2015

Data Exhaust: Is Russia Up To Something Soon?

With all the news about China getting Worldwide Überhacker Status, I'm looking at the top readers of my blog for the last week and note two terribly interesting things:

Russia is the most frequent visitor to my site; and
China seems to have dropped completely off the list (they're in the #3 all-time top position, just behind Ukraine and, of course, USA which is #1).

So the question is, just what is Crazy Ivan up to? For that matter, Hu's on first in China?

Watson, there's a game afoot.

Background: Welcome black hats, white hats and cyber swashbucklers

The Revolutionary War was fought, financed, and pretty well WON by bonded privateers, legalized pirates who were given Letters of Marque and Reprisal by the Continental Congress and authorized to attack, capture and monetize British ships. The purpose of this site is to explore the possibility of a modern-day doctrine much like the Monroe Doctrine, by means of which the U.S. government could legally and, more importantly, effectively stop international hackers. Current cybercrime law is not only ineffective, but downright stupid. My Linux servers are attacked hundreds of times a day (mostly from China and former USSR domains), yet if I retaliate against those servers with some creative technology at my disposal (I know some VERY smart guys), then I am in violation of federal law and subject to some onerous penalties. We need more than a new law. We need a new international doctrine. I call it The Morgan Doctrine, named after Morgan Rapier, a fictional character I've created (hey, this is my way of establishing ownership of the concept, should it ever see the light of day).

Why a new international doctrine? Simply, nothing else will work. Introduced on December 2, 1823, the Monroe Doctrine told the world to keep their hands off the Americas. Combine this with current legal thinking on "hot pursuit" of fugitives. In 1917 the US Army went into Mexico after Pancho Villa. More recently, in 1960 Israeli Mossad agents abducted Adolf Eichmann from Argentina. Granted, much of the world regards the Eichmann adventure as a violation of international law. I don't share that opinion and therefore use it as the third leg of my Monroe-Pancho-Aldof platform for The Morgan Doctrine.

If someone comes into your home and attacks or attempts to rob you, you may shoot them dead. You may do so as long as they expire on your property. But what about cyber criminals? They attack you in your home from their homes. Retaliate in kind, and you go to jail. The Morgan Doctrine states simply that if you attack my computers (or my banking assets held in US-based computers), then under a certain set of well-defined conditions, a licensed and bonded "cyber privateer" may attack you in your home country and split the proceeds with the U.S. government. For the sake of argument, let's call it a 50-50 split (heh heh).

Right now, American law enforcement is completely unequipped to deal with the sheer number international cyber hackers. Sure, I could report each of the thousand daily attacks to the FBI, as could the millions of other attackees in the USA. But the volume of such reports would make any meaningful resolution laughable. Not to mention that the FBI has no jurisdiction outside the USA. Yet to make such "enforcement" profitable to recognized (ie, "bonded" "deputized") privateers, as Heath Ledger's Joker said in his last role, "Now you're talking!" You raid our bank accounts, we raid yours. You make money from off-shore child pornography, we're going to loot your bank accounts and, with some REALLY creative black hat operations, you will be taken off the grid worldwide to the extent that you'll not even complete a cell phone conversation for the remainder of your miserable depraved life. Okay, that last part probably won't fly, but you get my drift.

The purpose of this site is to explore the mechanics, legalities and practicality of The Morgan Doctrine.

And I will be the sole arbiter of whether or not your comments get posted. As Mel Brooks wrote, "It's good to be king."