The technology we interact with is forever becoming more ingrained within society, and because of this, exploits can be more significant than they were. Because of this, we must be constantly aware of new threats, such as Certificate Authority Spoofing, Persona Management Software, High Stealth Rootkits, potential backdoors into programs and infrastructure we all know and use, and firmware and SoC’s that betray their users when it becomes convenient for them to do so. In order to protect an organization from new threats, the technologist must be vigilant.
Recently, exploitations in Certificate Authorities are calling into question the structure of Root CA approval, and how browsers process that approval. The exploit was used upon an intermediary certificate administration account. The process that was used allowed certificates issued from this intermediate account to be seen as verified by the Root CA. This issue calls into consideration two problems with the existing model; one, centralized authority means that when any link in the chain has been subverted the entire system is compromised; two, the way this issue was handled by Comodo, the CA holder, is a prime example of security by obscurity, a failed concept which will only lead to more subversion in the future. It is clear that we will need a decentralized model which we can hold openly accountable.
Social Networks provide a catalyst for change; they have transformed the political landscape, but now, technology allows those with power and resources to have even more influence in the form of persona management software. This software allows one agent to speak with the power of a thousand unique voices, and it is the dedication with which the persona officers ply their craft which makes this so insidious. The danger here is how artificial communities and movements can influence politics, commerce, culture, and every social aspect of society. Peer pressure is an amazingly strong influence, even on people with strong will, and this fact makes this technique something to be concerned with.
Rootkits have been around for decades, but developments in spyware have realized the potential of the Rootkit in a chilling way. One of the ways you can discover some Rootkits is in the content delivery. If you are transmitting data even when you are not actively sending or requesting data, it is likely that a rootkit is sending data to a third party. Now, certain rootkits are designed to transmit their data only when the unsuspecting user is using the network directly, these programs compile data during dormant periods and then mulitplex it with user data. The data is then sent to a distributed group of intermediary dead drop servers, where the data is then intercepted by the third party. Inspecting Rootkits for forensic weaknesses and internal strategy used to be easier for researchers in a controlled environment, but now, self aware Rootkits will discover when they are in a testing environment, and attempt to communicate with their creator. This will cause danger to those unaware of the risks, and may discourage further study of these powerful creations.
Basic security is taken for granted these days. Encryption, SSH, Shadow Partitions, Salted Hash Passwords, and third-party development beholden to no-one but their user’s best interest. Certain Governments today are causing that security to come under scrutiny and restriction. Afraid of what their people might be planning, they seek to restrict their citizens freedom, choice, and security. One risk of such restrictions is that they are often exploited by malicious third-party attackers, fully aware of the imposed weaknesses and ready to take advantage. A perfect example of this issue is in the recent ruling in France to restrict hashed passwords. This ruling will make it far easier for malicious agents to intercept data, regardless of whether it allows the French government any more insight and control over their populace, it is irresponsible policy that will lead to more crime and less piece of mind for the average French citizen. Consider which developers would have reason to acquiesce to government demand; would it be one who is provided with power and influence by said government, or would it be a community developer trying to build open standards?
When choosing which product to protect yourself, it is wise to consider the origins of that product. Consider that Symantec is actually owned by Huawei, a corporation with known ties to the Chinese government. This fact calls into question the legitimacy of the Symantec and Norton lines of software. In peacetime, no-one is concerned with international development, but the Chinese are not foolish; there is nothing to stop them from weaving a kill-switch or rootkit into their code or components. Will there be mission critical government products built overseas? Probably not, but that will not stop them from destabilizing a good share of any given environment; even most luxury computers are built in China; this will give them a profound advantage should conflict arise.