D-kriptik Blog

This month has certainly been interesting.

A couple of zero days in widely deployed software were discovered by virtue of active exploitation out there in the world…

An Adobe Acrobat and Reader zero day [demo exploits], with an official patch expected next month (there is an unofficial patch).

A critical vulnerability has been identified in Adobe Reader 9 and Acrobat 9 and earlier versions. This vulnerability would cause the application to crash and could potentially allow an attacker to take control of the affected system. There are reports that this issue is being exploited.

Adobe is planning to release updates to Adobe Reader and Acrobat to resolve the relevant security issue. Adobe expects to make available an update for Adobe Reader 9 and Acrobat 9 by March 11th, 2009. Adobe is planning to make updates for Adobe Reader 7 and 8, and Acrobat 7 and 8, available by March 18th.[...]

Update: Adobe has released the security updates for Acrobat and Acrobat Reader 9.

A potential Microsoft Excel zero day, with more information to be determined.

Microsoft is investigating new public reports of a vulnerability in Microsoft Office Excel that could allow remote code execution if a user opens a specially crafted Excel file. At this time, we are aware only of limited and targeted attacks that attempt to use this vulnerability.

As always, exploiting vulnerabilities for which patches are available is working quite nicely too – just look at Conficker having a ball.

Why Conficker has been able to proliferate so widely may be an interesting testament to the stubbornness of some PC users to avoid staying current with the latest Microsoft security patches  [2].  Some reports, such as the case of the Conficker outbreak within Sheffield Hospital’s operating ward, suggest that even security-conscious environments may elect to forgo automated software patching, choosing to trade off vulnerability exposure for some perceived notion of platform stability [8].   On the other hand, the density of where the vast bulk of Conficker victims are concentrated may also suggest other reasons, such as the wide use of unregistered (pirated) Windows releases, which Microsoft does not patch [9].  

Browser usability with https continues getting hammered as well.

This tool provides a demonstration of the HTTPS stripping attacks that I presented at Black Hat DC 2009. It will transparently hijack HTTP traffic on a network, watch for HTTPS links and redirects, then map those links into either look-alike HTTP links or homograph-similar HTTPS links. It also supports modes for supplying a favicon which looks like a lock icon, selective logging, and session denial. For more information on the attack, see the video from the presentation below.

The djbdns package has come under fire, of particular note.

Summary: Weaknesses in dnscache’s outgoing query management and caching policies allow an attacker to poison arbitrary DNS records in far less time than previously believed possible.
Versions Effected: All current versions of djbdns (< =1.05)

(And, now I know about zinq.)

And, to end on a lively, off-topic note, fall fashion in New York is usually a favorite of mine, and the Fall 2009 season combined that general preference with up my alley trends (already visible on the streets of New York) – comforting protective and edgier futuristic clothing, dark somber and rich powerful colors (e.g., royal blue, plum purple, forest green), playing with construction and textures (e.g., velvet, tweed, leather, satin), asymmetrical geometrical strong-shouldered architectural designs. Because of these trends, many shows had at least a few pieces that I loved, making for my much wider appreciation of the designs of a variety of designers this season. Some of my favs…

• Yet again, Proenza Schouler – This collection veered slightly softer and perhaps nodded to their earlier days, yet still maintained the edge and architecture I have come to love. In a season where those I thought would shine seemed to go astray, these guys hit the mark.
• Rodarte – This collection had singular point of view, with the same silhouette and structure throughout; however, the play with construction, textures, and even a pop of color kept it so interesting that I could not wait to see what would come next.
• Ralph Lauren – This collection was like walking out into a clean, clear, crisp fall day and inhaling deeply. I said it over and over – it feels like a breath of fresh air. The simplicity, elegance, and beauty of the clothing was remarkable.

Of course, given the trends and my high expectations, I must note there were a number of train wrecks out there too. The two main categories I saw: 1) designs that looked plain silly, gaudy, and/or obnoxious, a way too literal translation of the 1980s; and 2) designs that looked stiff, heavy, and/or just plain burdensome, too much like wearing actual medieval armor, scratchy carpeting, or sound absorbing curtains.

For a while there, it was cold in NY, seriously cold. I mean, teens F day and touching upon single digits F night with wind chills that frighten small children cold. Now we are seeing the 30’s F again. Summer.

-

So, I was reading a book from back in the early 1990’s, titled “The Political Economy of Defense” and edited by Andrew Ross, that I picked up during one of my explorations of a used bookstore. The book was more geared towards a discussion of potential research topics rather than actual research, but it did leave me with some scattered thoughts.

Update: My first “controversial” post in a while has left me talking about topics this weekend that I care little to discuss with what little I know. I now regret items 3 and 4 in the bullet points below, as my attempt to at least have a couple of bullet points more in line with the book led me down a foolish path. That said, I added one minor update to item 4 below, and that will be the extent of this post’s growth. (Ok, time to enjoy Super Bowl Sunday!)

Note: As fair warning, this post is a total ramble. And, politics is part of the topic by definition, but I endeavor to keep it politically indifferent. You may want to skip it.

This first half will be generic rambling derived from some of the books content taken mostly way out of context (I guess just wanted to jot down some thoughts on, say, gaming the system).

1. Structure influences behavior and outcomes, and vice versa.

   An example, players in a market having an oligopolistic structure tend to end up exhibiting a specific set of behaviors, and one study in the book examined the international arms market up through the 1980’s as an oligopoly. It found that while this market had some oligopolistic behaviors, it lacked others, and, overall, the structure was shifting further away from an oligopolistic market to a competitive market. Moises Naim’s “Illicit” has a description of just how far that shift has gone today.

   This suggested to me that players, people, will adapt to a structure over time, and, as I quite often see out there in the world, will likely learn ways to game the system. This adaptation to, or gaming of, the system can lead to new or unintended outcomes, perhaps beneficial, perhaps otherwise. In response, the structure will be modified to incorporate these behaviors and outcomes, perhaps encouraging them, perhaps counteracting them. And so on.

2. Radical change can cause instability.

   An example, consider “third world” countries adopting advanced industrial country technology as discussed in the book. A major problem here can be that “third world” countries typically have a labor surplus, while advanced industrial nation technology favors less labor-intensive production. Additionally, the technical skills required to use such technology tend to be possessed by a very small portion of the labor supply in “third world” countries. So, making a leap to these technologies can facilitate mass unemployment, which can lead to, say, political instability.

   Of course, this brought to mind creative destruction and entrenched players stifling innovation, but it also served as a reminder that where we are today is built upon where we were yesterday. There is a progression that provides time for adjustment to the new. (Certain potential future advances are labeled “event horizons” precisely because they are considered to involve such radical change that all the rules go out the window.)

   Peter Turchin’s “War and Peace and War” popped into my head too, in which he examines the cycles within cycles that have made for a perpetual cycle throughout world history of conflict and instability leading to peace and stability leading to conflict and instability. The general idea is that there is a coming together phase and a falling apart phase in the life cycle of empires. Within these phases, there are various cycles, which first build the propensity for collective action, and then break down the ability for collective action. And, this often seems to start at a fault line between sets of people that differ in easily identifiable (to them) ways, where by conflict between these sets of people builds internal cohesion and equality within the sets. Once this us and them conflict is resolved and the threat mitigated, prosperity generally kicks in. Over time, prosperity brings about population growth and pushes resources (e.g., food) and grows inequality, and this breaks down the internal unity and leads to internal conflict. Eventually, through cycle upon cycle, an empire is so weakened that it dissolves, often with the help of external enemies. And so on.

   However, Turchin points out the this theoretical framework may not apply to the conditions of today (e.g., food is no longer a concern in modern societies) and applauds technology, such as the Internet and, in particular, the cell phone, as breaking down hierarchy and leading to heterarchy, which changes the rules of the game. Dalton Conley’s “Elsewhere, USA” discusses some trends we see here in the, as he coins it, “neofeudal” USA, such as massive inequality coupled with a breaking down of hierarchy and the pervasiveness of ephemeral stuff for invidious (Schoeck’s “Envy” anyone?) comparison with the exception of the readily available basics, food and water.

   Anyway, coming back to the thoughts on 1, there is a sort of continuous change implied, in which the structures, behaviors, and outcomes of a system evolve over time. However, too much change too quickly can lead to instability. This seems to promote a sort of tweaking process where some stability is desired.

   Thinking of gaming the system brings security to mind. Security generally seems to follow this pattern of tweaks – attacks get better, and defenses are modified accordingly. However, when a situation of radical change occurs, the instability that results can make security objectives quite difficult to meet, even if defined objectives exist. After all, locking down a system generally requires that the system have some stability and structure. Security itself is structure, and instability breaks down structure. So, radical change can require a shift from tweaks to a wider (re)building of a security structure as areas of this new system solidify.

   This brought to mind the situation of online security in the world of the web, a world that is radically changing right here and now. The security community is scrambling to catch up, to get a foothold and (re)build structure. For example, capability systems seem to be one possible wave of this future.

   (This also reminded me of the current economic mess in the USA, where it seems that radical financial innovations (e.g., a piece of paper saying “this is an apple” held between two mirrors was somehow magically thought to be creating infinite, edible apples) combined with much (extremely leveraged) gaming of the system played a big part in the disaster that is beginning to unfold. Of course, bubbles and credit crisis are nothing new (tulip bulbs or tech, anyone?). Which, in a mindset framed by Turchin’s book, makes cycles seem to be a way of life given our current mental composition (e.g., “Choices, Values, and Frames” edited by Kahneman and Tversky, Cialdini’s “Influence”).)

This second half will be more specific rambling to a couple of topics touched upon in the book.

3. As discussed in the book, in the USA, defense spending was quite large and had little relation to economic conditions within the country. The questions of how much defense spending and how much security came down to political decision-making.

   Perhaps political decision-making is not always the most effective and efficient, but, regardless, its makes me wonder… If states must be capable of pulling together such massive amounts of resources for defense, then, other than a new hot or cold war between major players (e.g., a China-USA showdown), conflict should be quite localized and/or take the form of, say, electronic warfare, guerilla warfare, and terrorism.

   Its makes for other interesting trade-off topics too. I can see the USA as carrying a large amount of the defense costs of the whole Occident and much of the world – this gives the USA a huge degree of power in the world, but it also allows others to free ride and focus on different efforts. The opportunity cost of defense spending is something to ponder – defense research has led to technology that is adopted by the civil sector, but it is not known what the civil sector would have come up with and produced if those resources (e.g., some of the brightest out there) had not been tied up in the defense sector. And so on.

4. As discussed in the book, there was a mild consensus that defense spending can cause short term benefits (e.g., resource utilization) to a country’s economy, but long term it tends to be detrimental (e.g., decreased savings and investment in the civil sector). These detrimental economic effects might build on each other as well.

   Now, looking around, we tend to see large territories organized into nation states, and these are generally structured such that the government is the monopoly provider of defense in these territories. My rough understanding, a la papers such as Frederic Lane’s “Economic Consequences of Organized Violence,” is that the primary point of defense being a government monopoly in, say, modern democracies is to reduce the overall burden of defense costs allowing a greater focus on other productive endeavors by everyone else (although, in the USA, the rise of the military-industrial-congressional complex, as Eisenhower coined it, might serve to counter part of this point – e.g., Osprey and Comanche). In that direction, it may be that successful nations tend to be those that find ways to reduce defense costs while maintaining appropriate levels of security and stability. These cost savings can then be rolled into the other economic growth, and so, other things being equal, become a competitive advantage out there in the world market. Defense cost savings can also be devoted to other things, like social programs, such as health care.

   Update: Due to follow-up conversation, I now feel a need to point out two things.

   First, some have thought that my views of the world have shifted radically based on what is written in this post. While my interpretations of the world shift over time and the tendency is towards moderation, I have not been reborn. I just tried to remain indifferent in the post.

   Second, my choice of Lane’s simplified view of the world was quite simple – the idea of the government as a defense service provider to its clients, particularly with those clients being the people of the nation state in a modern democracy, trivially rolled back into the general bullet point. As with most costs, people want to get the most bang for their buck – so, the less clients pay for defense services, the more resources they have for other productive efforts. And, all things being equal, this becomes a competitive advantage over others that have to spend more on defense services for a similar level of security. This translates to more investment, more innovation, more exports, and, well, more capital, resources, wealth for the defense cost savers. Other things being equal, this also gives the defense service provider itself a competitive advantage over other defense service providers. The defense service provider could advance its defense services, at the same or perhaps quite a bit less cost, especially relative to its clients’ growing resources, and maybe even throw in other value add services that benefit from economies of scale. And so on.

   For a broader investigation of empire, I already noted Peter Turchin’s “War and Peace and War.” If you just want to hear a concise rain on much of Lane’s quick parade, Charles Tilly’s “War Making and State Making as Organized Crime” might be of interest. Finally, if you want to read radical theorizing about anarcho-capitalist ways of doing things in the future that may or may not result in a defense monopoly, you could check out David Friedman’s “The Machinery of Freedom.” Or, if you just want a fun work of fiction about such a future, Neal Stephenson’s “Snow Crash” is one of my favorites, and it contains one of coolest characters ever, Raven.

   This reiterates to me in yet another fashion that security is not, well, priceless.

   Thinking on this, the Internet is a new, massive territory. As it gains in popularity and power, nation states have started to partition this territory, much like the geographic boundaries in the physical world, which contain the physical infrastructure on which the Internet is built. If the rules of the real world hold here, then defense of large Internet territories will continue to move into the government arena. Which makes me wonder, perhaps ridiculously, if, as the virtual world moves much faster than the physical world and is, by nature, highly networked and interconnected, much as the real world is more and more becoming, and is even intermingling with the real world to such an extent that some boundaries are blurring between the two, the progression of the Internet could serve as a sort of virtual model for exploring the future of defense in the real world?

All in all, not much of this post really deals with the book. Ah well, I can’t imagine many made it this far anyway.