Active Defense & Deception , Anti-Fraud , Black Hat

The recent Black Hat Europe conference in London touched on topics ranging from combating "deep fake" videos and information security career challenges to hands-on lock-picking tutorials and the dearth of researchers submitting proposed briefings centered on deception technology (see: 14 Hot Sessions at Black Hat Europe 2018).

See Also: Live Webinar: Building Secure Delivery Pipelines with Docker, Kubernetes, and Trend Micro

Here are some of the many highlights from last month's Black Hat Europe 2018:

Spin-off Event

Black Hat Europe was launched by founder Jeff Moss in 2001 as a sister conference to the annual Black Hat conference, which he launched in 1997. Black Hat USA continues to run in Las Vegas every summer.

ExCeL London

This was the 17th annual Black Hat Europe, which again returned to London, following the conference having decamped from Amsterdam in 2016, seeking more space. This year's conference was held at the sprawling ExCeL convention center.

Room to Grow

The ExCeL convention center in East London offers ample space, including room to grow, over its 100-acre campus.

Destination: Docklands

ExCeL London is located on a 100-acre site on the northern quay of the Royal Victoria Dock in London Docklands, situated between Canary Wharf and London City Airport. Formerly part of the Port of London - at one time, the world's biggest port - the area has been the focus of extensive redevelopment and is well-served by the Docklands Light Railway, an automated, light metro system.

Nearly 3,000 Attendees

At this year's Black Hat Europe, nearly 3,000 attendees split their time between 40 sessions delivered by a total of 100 speakers and researchers, including sessions in the business hall.

Moss opened this year's Black Hat Europe by taking to the stage to deliver his annual opening comments. He noted that the ever-expanding quantity of attendees this year included visitors from 106 countries. He singled out 26 countries from which a single representative was attending, including America Samoa and Reunion, although as he noted, the island is technically an overseas department of France.

"Feel free to whoop when I say your country," he said.

Business Hall

The business hall played host to 67 businesses, associations and other organizations, ranging from Accenture and Agari to Yubico and ZeroFox. It also included places for grabbing coffee, purchasing official Black Hat merchandise - including hoodies for any aspiring hackers on your holiday wish lists - or attending Arsenal tool demonstrations and vendors' sessions in the various business hall theaters.

The many briefings touched on everything from steganographic disk encryption and Microsoft browser security to how to exterminate "deep fakes" as well as abuse Windows 10 security questions.

Estonia's Cyberattack Wake-Up Call

Black Hat Europe 2018 opened with a call to action from Marina Kaljurand, chair of the Global Commission on the Stability of Cyberspace.

In her keynote speech, the Estonian politician reflected that where cybersecurity is concerned, Estonia is lucky. That's because it suffered a massive, three-week distributed denial-of-service attack in 2007 that disrupted its banking sector as well as some government websites (see: Black Hat Europe: The Power of Attribution).

Marina Kaljurand brought her own bugs - a gift from staff when she served as Estonia's foreign minister - to her briefing.

While the attacks were primitive by today's standards, "they were humiliating," said Kaljurand, who was Estonia's foreign minister at the time.

The attacks also served as a cybersecurity wake-up call for Estonia's leadership and helped inform how the country would refine its pioneering and lauded e-Estonia program, which makes 99 percent of government services available digitally.

"We were lucky to have the attacks of 2007 to consider and reconsider how to continue with our e-Estonia," she said.

Unusually, Estonia can also count on its own Cyber Defense Unit, which consists of numerous citizens who don't hold government jobs and who contribute their time on weekends. "They're doing it voluntarily; they're doing it out of patriotism; they're doing it for free," she said. While that model wouldn't work for every nation, for a country as small as Estonia, she said it serves its needs well.

See the Bigger Picture

In a side interview at the conference, founder Jeff Moss, reflecting on Kaljurand's opening speech, told me that national pride and patriotism should never be overlooked in a geopolitical context, and that hacking is often only one piece of a much larger picture.

To pick just one example, he said the attacks against Estonia - roundly attributed to Russia - appeared to be in response to Estonia's plans to relocate a controversial, Soviet-built WWII statue as well as war graves.

Facial Recognition: We Don't Need No Badges

Beware the front row, at least if you're attending a briefing delivered by Cesar Jimenez and Fran Gomez of Devo.

The pair demonstrated a live tool they built to see who they can automatically recognize, based who's in their LinkedIn profiles. They accomplished that by scanning audience members to see who their software could positively match with one of their LinkedIn contacts, based only on the contact's LinkedIn profile picture.

Devo researchers Fran Gomez, left, and Cesar Jimenez

"The aim is to know who's in my LinkedIn contacts; it's better than scanning your badges," Gomez said.

The point underlying their demonstration is that it's easier than ever to subject people to facial recognition technology.

Such technology can be used for potentially good purposes. But it can also be used for purposes that might not be in an individual's best interests. For example, China is developing a controversial social credit system, which by 2020 aims to score each citizen's contribution to society in a variety of different areas.

"So, we need some defense, because this is no good for us," Jimenez said.

The researchers ran through a short list of tactics and technologies designed to fool facial recognition, including baseball caps with built-in infrared lamps designed to blind cameras, as well as using face-hiding haircuts.

"Or you can just wear a horse mask," Jimenez said. "It's dangerous, but effective."

Self-Concealing Steganography

What if you could hide whole operating systems on a hard drive? That steganographic - hiding data in plain site - goal was the focus of a briefing by Dominic Schaub, a researcher at tthe Canadian firm Discrete Integration, which has been building a suite of tools designed to bootstrap a hidden operating system, which remains hidden in the free space on a disk that regularly gets overwritten.

Schaub has designed a technique that uses error correction to restore the "corrected" data and feed it into a run-time environment (see: The Rise of Self-Concealing Steganography).

Schaub says work is continuing to finish developing the tool set. "We just wrapped up late-stage testing and are in the process of releasing Mirage, our first commercial product based on the steganographic technology," he told me.

How to Battle 'Deep Fakes'

Deep fake - or "deepfake" - videos are increasingly being used to harass or otherwise target individuals. Such videos are easy to create using freely available tools; they were initially used to swap victims' faces onto porn stars' bodies. But the technology can also be used to make political figures say things they never said or otherwise try to compromise people's reputations.

"What does it take to make a deep fake? All it takes is a gaming laptop, an internet connection, some passion, some patience, of course, and maybe some rudimentary knowledge of neural networks," said Vijay Thaware, a security researcher at Symantec, during the briefing.

Thankfully, there are a variety of tactics that can be employed to spot deep fakes, he said.

Thaware and his fellow Symantec researcher, Niranjan Agnihotri, have been developing tools that they hope social media networks will use to screen videos before allowing them to be uploaded (see: Face Off: Researchers Battle AI-Generated Deep Fake Videos).

Free Lock-Picking Tutorials

Ever wanted to learn how to pick locks? Experts from Ireland were on hand from IBM X-Force at the IBM Security booth, including ethical hacker Martin Mitchell. He regularly runs lock-picking workshops at the annual Irish Reporting and Information Security Service's IRISSCON Cyber Crime Conference in Dublin (see: 13 Scenes from an Irish Cybercrime Conference).

Mitchell's array of available locks includes "love locks" that he removed from Dublin's Ha'penny Bridge, with the blessing of the city council, because their weight can damage the structure.

MIA: Deception Tech

While the keynote speech opens the briefings, Black Hat closes with a "locknote," led by Moss, who's joined by members of the Black Hat Review Board. Together with Antonios Atlasis of the European Space Agency, Daniel Cuthbert of Banco Santander, and Veronica Valero of Cisco Systems, Moss touched on a variety of topics, including some trends the review board sees, based on its reviews of more than 1,000 submissions every year.

One interesting omission, Moss said, was the apparent lack of use of deception technology. "I never heard one speaker say: 'And then I checked the canary or, and then I [reviewed] the deception tech," he said. "Who here uses deception technology?"

Just one hand among the hundreds of locknote attendees appeared to get raised.

"Who here runs canaries?" he asked, referring to a honeypot designed to detect network intruders. Four hands were raised.

Perhaps the first rule of using deception technology is to never talk about deception technology?

Cuthbert, however, said deception technology poses many problems. "As an ex-attacker, if you breach the network, you go for the juicy network," he said.

In addition, from an administration standpoint, "the moment you throw deception tech on there, you've now got four networks," he said. "It's an overhead nightmare."

Negotiate Time for Learning

The locknote discussion touched on information security career challenges - and progression.

"Ten years ago, we were joining the industry in a different time; we were not so pressured with time; we were more relaxed, I could take a day to learn something," said Cisco's Valero. "Now, companies want you to be productive in three months, and you're just out of school."

The best solution, she said, is to find time, for example, by demanding one day per week to master new technologies or practices. "Negotiate," she said. "It's your career."

We Want Your Good Defense

From a research standpoint, one underserved area is how to craft better defenses. The conference review board members said they're keen to see more Black Hat submissions about research into top-notch defensive techniques.

"We want good defensive talks, because they're harder," Cuthbert said. "Look at HackingTeam; they were very good at breaking stuff and they got popped really hard."

Sounding a hopeful note, he suggested that defensive techniques are the new stunt hacking. "The days of popping xcalc on an internet-connected dildo are well and truly behind us," he said.

All photographs by Mathew Schwartz

Governance , Healthcare , HIPAA/HITECH

What are the top regulatory trends to look for in the healthcare sector in 2019? Here are three key issues to watch.

See Also: Live Webinar: Building Secure Delivery Pipelines with Docker, Kubernetes, and Trend Micro

The Impact of the California Consumer Privacy Act

The California Consumer Privacy Act is on track to have a significant impact on healthcare organizations and their business partners when it goes into effect in January 2020.

Although the California legislature quickly passed an amendment and technical correction that rolled back some of the act's provisions to exempt data that is regulated by the HIPAA privacy standards - sparing some healthcare organizations from the state law's requirements - the act will cover many businesses throughout the U.S. that collect the personal information of California residents through their physical or digital presence in the state.

The act gives consumers many new rights over their data and will pose real compliance challenges for companies that are covered by the law.

The California law was poorly drafted and hastily passed, with large parts containing undefined or contradictory terms. We will have to carefully monitor how the California legislature and attorney general resolve the law's conflicts and ambiguities. The business community is lobbying hard to weaken its provisions and narrow what types of businesses will be required to comply.

Action in Other States

While the United States lacks a comprehensive privacy and data security law akin to the European Union and elsewhere, states are filling in gaps with laws that deal with breach notification, data security and data disposal. But most states are not taking a sectorial approach to the type of PII that must be protected.

A number of state attorneys general are bringing enforcement actions under HIPAA and state law requirements to protect consumer information from unauthorized disclosure.

A recent Pennsylvania Supreme Court ruling could alter the landscape even further.

In a sweeping decision involving a cybersecurity incident at UPMC, a major healthcare provider in the Pittsburgh area, the court found that employers have a legal duty founded in Common Law to use reasonable information security safeguards to prevent the theft or unauthorized access to employee PII stored on its information systems. The ruling allows employees who allege to have been harmed by the breach to move forward with a lawsuit seeking compensation for damages.

We'll be watching to see if state legislatures and attorneys general continue the trend toward taking action to protect health information that would not be protected by HIPAA and enforce these requirements for data held by any entity, anywhere.

We'll also be on the lookout for lawsuits seeking to apply the Pennsylvania supreme court's legal reasoning on the duty to safeguard PII.

Modifying the HIPAA Rules

The Department of Health and Human Services' Office for Civil Rights recently issued a request for information on "Modifying the HIPAA Rules to Improve Coordinated Care" that could be the opening salvo in a coordinated effort make some changes to the HIPAA Privacy Rule.

OCR Director Roger Severino has said on many occasions that the department is looking for ways to loosen the HIPAA Privacy Rule's protections regarding when healthcare providers can disclose PHI without the authorization of the patient.

Severino and other HHS officials, including Seema Verma, administrator of the Centers for Medicare and Medicaid Services, and Don Rucker, who heads the Office of the National Coordinator for Health IT, have strongly implied that current HIPAA Privacy Rule standards limiting the breadth of disclosures allowed without patient authorization are impediments to promoting the Trump administration's vision of "transformation to value-based healthcare."

My sense is that HHS is responding to a significant push from the healthcare and tech industries to lighten up on one of the few areas in which consumers have a federally protected right to privacy and control over their personal information.

We'll see if this leads to concrete proposals that could modify the definitions of the types of PHI that can be disclosed without patient authorization to organizations that are not covered by the HIPAA rules. Another possibility is that HHS will seek to roll back or remove the standard for disclosing only the minimum amount of PHI necessary that can be shared under the guise of population-based case management or care coordination.

A Cultural Shift?

I enter 2019 with growing unease that we are witnessing a cultural shift in how the federal government looks at the comprehensive floor of privacy rights the HIPAA Privacy Rule guarantees when patients share intimate personal information with their healthcare providers.

Under the guise of removal of regulatory obstacles and decreasing burdens, weakening current HIPAA protections could have significant unintended consequences that would threaten the foundation of trust between patient and health care provider.

While I am pleased to see increased efforts by the states to fill in the gaps through their increased efforts to protect the confidentiality of personal information, their patchwork approach cannot replace a national standard.

US Senator Ron Wyden is renewing his calls for legislation banning the sale of people's private cellphone location information after yet another report of phone carriers doing exactly that.

The Oregon Democratic Senator claimed major telcos and their executives, including T-Mobile US CEO John Legere, lied to him last year when they vowed not to allow underhand private dicks, shady bounty hunters, and dodgy geezers to purchase the location information of citizens for tracking purposes.

This all comes after a report by Vice's Motherboard today showed that T-Mob, AT&T, and Sprint are still selling customer location data to third-party companies that, in turn, resell it to iffy miscreants. These buyers include bail bonds companies that pass people's details onto bounty hunters looking to track down folks who have skipped bail. It seems the data is slipping out to anyone offering cash.

In effect, it is possible for stalkers, criminals, private investigators, and other types to buy people's whereabouts from these resellers, who obtain the data direct from AT&T, T-Mobile US, and Sprint. We're told the brokers caught by Vice reselling sensitive data to undesirables have now been cut off from the carriers' info hose, though the practice of selling location records will continue.

The sale of people's location data is not a new thing, sadly. Back in the spring of 2018 it was widely documented how prison companies and other outfits were brokering the sale of customer location data from major wireless carriers. This location data can be gathered by, for instance, monitoring which cell towers phones connect to as their users travel around. Verizon, AT&T, T-Mobile US, and Sprint resell this data, and only Verizon appears to have curbed that cash cow following last year's outrage.

That stealthy tracking of cellphone subscribers led to calls for new rules that would prohibit companies from selling their user location data to any third party. Among those up in arms last year was Wyden, who floated legislation to impose penalties on carriers that sold customer data. The telcos, hoping to get ahead of lawmakers, pledged not to sell tracking data to bounty hunters, stalkers, and other dodgy characters.

With that promise now having been shown to be utter trash, Wyden this week is renewing his calls to pass legislation.

"Major carriers pledged to end these practices, but it appears to have been more empty promises to consumers," Wyden said. "It’s time for Congress to take action by passing my bill to safeguard consumer data and hold companies accountable." ®