Gone Phishin' in China

Today's Network World article on phishing tactics (see it here) caused me to reminisce about the Joe Pesci and Danny Glover movie Gone Fishin'. Some "phishing" datapoints:

• Basically, the best phishing holes are in China, at least if you count up the registrars who issue phishing licenses worldwide.
• Phishing tactics give "catch and release" a whole new meaning, what with the proliferation of the 89,748 unique compromised hosting domains used.
• Phishing with dynamite is the new trend; mass break-in techniques were used in 58,100 attacks. Toss in that stick of dynamite and get out your nets as all the stunned phishees float to the top.
• Shared hosting environments have become the "Phishing boats"of choice, particularly WordPress, cPanel and Joomia installations.

Unlike the movie, though, there's not a whole lot of laughing going on, at least as long as we're constrained to play defense-only/hands-tied-behind-our-back security management. We're just dumb fish on a pond, waiting for that next stick of dynamite to knock us senseless and into the nets of phishers who, by the way, are having a lot of fun.

Infecting an Alien Architecture Now on both Nook AND Kindle devices

DESTROYING ANGEL just went live on the Nook (see here) as well as on the Kindle (see here).

I believe the hyperlinks to the 22 Principles of the Perfect Virus—as well as to music videos and movie clips—will significantly change the print publishing industry.

Infecting an Alien Architecture: DESTROYING ANGEL now available on Kindle

Order the Kindle edition for $2.99 here.

Over a decade ago, before I'd formalized the 22 Principles for the Perfect Virus, I wrote a hardcover novel about suppressed genius. I have completely rewritten Destroying Angel to apply not only that new technology, but to include ebook hyperlinks to the 22 Principles plus multi-media links to music videos and movies relevant to chapter themes (since I kept all the publishing rights, I can do that).

The main technical focus of Destroying Angel is Principle #7: Black Box Portability—what I call The Holy Grail of all virus technology—whereby The Perfect Virus can deduce a totally alien environment and adapt itself iteratively to become native to that environment, all without human intervention.

Let me know if you'd like to see Destroying Angel in other ebook formats.

Legal Justification for Killing Hackers?

A Huffington Post article (read it here) cites a report written for NATO (read original report here) opining that hackers lives may be targeted as cyberwar escalates. Called The Tallinn Manual, it contains the following disclaimer:

The Tallinn Manual on the International Law Applicable to Cyber Warfare is not an official document, but instead an expression of opinions of a group of independent experts acting solely in their personal capacity. It does not represent the views of the NATO CCD COE, its Sponsoring Nations, or NATO. It is also not meant to reflect NATO doctrine. Nor does it reflect the position of any organization or State represented by observers.

In my own humble opinion, The Morgan Doctrine stands a much better chance of deterrent success. A disproportionate and overwhelming financial response will do more to "put a check in the swing" of any cyber sportsmen than a nebulous and ill-defined bag-em-and-tag-em mentality.

Data Exhaust: Cyberwar Heating Up

Several of my Quantum Leap Buzz "tripwire" alarms went off today. Without boring you with the details, several factoids combine to reveal a seriously escalating pattern of warfare:

1. North Korea is the least vulnerable country and therefore the country with nothing to lose in a cyberwar escalation. Their attack on South Korea's infrastructure (see Time Mag story here) could be repeated in the US with much more dire consequences.
2. Computerworld reports that 3G and 4G USB modems are a security risk (see story here). Wonder why? Maybe it's because most of those branded modems are manufactured by Huawei and ZTE (yeah, do a search in the box on the left and you can see my previous postings about these companies). And as further data exhaust…
3. Most of the security appliances sold by so-called rock-solid security companies aren't so rock solid (see CIO story here). This is especially relevant given the still-unreported story of Anonymous hacking the RSA show with bogus USB thumb drives (see story here). My favorite quote in the CIO article reads:

There have been some voices that said Chinese networking vendor Huawei might be installing hidden backdoors in its products at the request of the Chinese government, Williams said. However, with vulnerabilities like these already existing in most products, a government probably wouldn't even need to add more, he said.

The final bit of "data exhaust" that proves how head-in-the-sand we are comes again from Time Magazine story on the creation of a "cyberwar rules of engagement manual" (see story here). Rules? For, like, fighting fair? Give me a break! You think Dennis Rodman's dwarf BFF in North Korea gives a hoot about rules of cyberwarfare? Or the scriptkiddies who attacked Brian Krebs (see my previous post here)?

If someone really wants to cause some damage, Katie bar the door. Spoofing a 911 call from Brian Krebs home could have been orchestrated to cause some real damage. Just about the time the SWAT team showed up, someone could have piloted a few remote control helicopters over the men with guns and dropped cherry bombs in their midst. That would have started some real shooting.

I still can't get over the utter laughability of publishing Rules for Cyber Attacks. There is only one set of rules that might come close to working in today's environment. I've drafted them and invite comments, criticisms, edits, etc. You can read my Cyber Privateer Code at…duh…www.CyberPrivateer.com.

Selah.