General Odiermo, HKS Forum, Cyber...

I had the privilege of getting one of the very limited tickets to see General Ray Odiermo speak tonight.

Gen O is the current commander of the Joint Forces Command in Norfolk, VA. He's an impressive guy to hear speak, but more fun for me was that he speaks very passionately about Cyber!

I am a cyber guy, and work by day at the DoD Cyber Crime Center, and being the only cyber pro in my class at the Kennedy School, found this to be incredibly good stuff.

So this guy has got to be 6'5" and as broad as a bull dozer, with a rack of ribbons that pushed his combat infantry badge WAY up on his shoulder, but he speaks of Cyber like it's the next front. He's informed, smart, well spoken, and his last word on the subject --after speaking for almost thirty minutes --was that cyber is the thing. My classmates all looked at me, knowing I was the only cyber guy int he class, and knowing that I also am not afraid to speak, and they knew --we're working hard in this area. I don't talk much about what I do in class, but many know of DCISE and read our products. It's an amazing thing. Many of my classmates have even commented about how much is going on in the area. My roommate -a former P3 pilot and now Navy civilian commented that every high ranking official that comes through speaks of CYBER!

It's a good time to be a geek, and Harvard is creating in me a self-aware, bigger thinker.

I hope to be in this game for a long, LONG, time!

Jeff

Tuesday

Wow. Long day. Two case studies in Negotiations just took it out of me. We started in our "Extended SEF' groups at 8AM with classes on building teams and negotiations all day, ending with Joe Nye. Joe spoke about his book "Soft Power", hitting on global implications of the media, policy issues (i.e.: China's sensorship of the media), India, and finally, cyber.

While interesting (actually great talks) by the end of the day, after two fairly heavy interactive case studies in negotiation, and then Joe, my head is full. Thankfully we have a light reading assignment for tomorrow. I need the sleep.

That's it for now. I'm taking advantage of the light assignment and heading down!
Jeff

Saturday class! Wuhoo!

I'm a little late in posting, but wanted to get my pictures transferred over from yesterday.

So yes, we had class on Saturday. The day started with the remaining discussions of the Federalist Papers (it was kinda dry to have them read to us, but a great topic none the less). The discussions were all surrounding our founding fathers thoughts when they framed, and then tried to ratify the Constitution. The papers were actually a marketing piece put together to try and get New York to ratify the Constitution. It worked! Before heading out for a field trip, we had another class teaching politics in the federal government. The class flew by. As you might imagine, everyone had thoughts on politics. The resulting conversations made the class just fly by!

Noon brought lunch, and then we caught the "Yankee" buses for guided tours of Lexington (remember the shot heard around the world?). The minute men hadn't aged well, but were VERY good.

We got a great history lesson by these *ahem* young minute men, and then jumped back in the Yankee bus for a guided trip to Concord where we were met by the local historian, and our professor, Steve Keller. Steve had the best stories, and took us to Minuteman State Park and Walden Pond. We got a in a bit of hot water at Walden Pond because the snow limited the parkability of those big busses. It was actually kinda funny. When accosted by the short rotund woman in brown, who needed to know who to write the ticket to, he gave another professor's name (Pete Zimmerman). She was happy. We were allowed to leave. Concord was great. Below are two pictures of the monument. The park was covered in heavy melting snow making walking on the trails wet and muddy. Many of my classmates were wearing sneakers, so we didn't go far.

Dinner was at the Colonial Inn.. This is actually the original home of Ralph Waldo Emerson, but obviously dated before him. The Colonial Inn has been operational for over 300 years, and was one of the prime meeting places in Concord, MA. I think the waiter lived through the entire thing, but in the end, it turned out he'd only been with the Inn for 20 years. Regardless, he had the history lesson down pat and kept the wine flowing freely. After dinner several of us retired to the front porch for cigars before getting back on the Yankee Bus for our trip back to Soldiers Field.

Tomorrow brings our first day of negotiation class. I'm here to tell you folks, if you ever get the opportunity to come to SEF, DON'T turn it down. These guys know how do it right. This is the best training I've ever had!

Jeff

Friday... one more day to go before the weekend!

Yes, we have class on Saturday. Two case studies and then a historical walking tour of Lexington and Concord. Why you ask? We're in the modules where we're learning about the framing of the government. We spent time this afternoon in discussions of the Federalist Papers after a morning of organization building and a case study on navigating Fed politics. The lunch speaker today was Shelly Metzanbaum -the Associate Director of OPM's Performance Management program. Interesting stuff.

It was a good day. Dinner was to be in the Penthouse dining room with a guy dressed as James Madison, talking about the papers and framing of the Constitution. I bagged out. I ended up with a massive sinus headache about 2, so I figured I'd try and kick it before the walking tour and dinner out tomorrow. I held out until after the final class before dinner, then headed back.

Tomorrow should be another great day. Going to head to bed early and try and kick this headache.

Jeff

Harvard Cyber Security Symposium

Broadcast live today from 12-6:30. I'll be in class, but an interesting roundup of panelists.

http://harvardnsj.com/live/

12-1:          
"The future of the Internet" (lunchtime debate) Jonathan Zittrain, Stewart Baker

1:15-2:45:  
Privacy concerns in cyberspace: Kevin Bankston (EFF), Dr. Joel Bremmer (former NCIX), David Hoffman (Intel), Susan Landau (Harvard)

3:00-4:30:  
Defense and Deterrence in Cybersecurity and Cyber Warfare: Steven Chabinski (FBI), Duncan Hollis (Temple Univ), Martin Libicki (RAND), Noah Shactman (Wired Mag), Eric Rosenbach (Harvard)

5-6:30:       
Keynote: Steven Bradbury (DA Atty Gen, DoJ)

Enjoy!
Jeff

Harvard.. Thursday week 2

Almost half way through the program. Today was a little shorter, but even with the shorter day I ended up a little late this morning. We had a light reading day, so I spent the morning sitting at the kitchen table in the dorm reading forward. Coffee and case studies; the breakfast of champions! About 8:30 I realized I hadn't showered, was engrossed in a case about revamping the MTA, and it was time to go. By 9:00, I was FROZEN from the walk (14 deg F plus a heavy wind) to school (maybe just under a mile??).. headed straight for Dunkin Donuts and then in my seat by 9:10.. not bad, but still, I want every minute I can get out of these people and the program!

Today was a fun treat. I met with the Sr. Researcher for the Minerva project. Minerva is a DoD funded collaborative project between Harvard Kennedy School and MIT's computer science program. The program topics have a familiar ring, except for one very interesting piece (at least through my lense!). They're focusing on cyber in the horizontal as it relates to International Relations. What a concept! A DoD funded cyber project that actually considers international relations issues! I've been asked to present. Likely going to talk about challenges in the heterogeneous global corporate environment --all unclas and should add value. From my perspective, it's also a two slide talk that will last about 45 minutes, so it should be perfect. One benefit here is they use very little in the way of PowerPoint. I'm finding more value in the blackboard discussions than being preached at through PowerPoint. I'll likely do the same thing.. two slides, two sets of graphics; no text.

The day, again, was AMAZING. I can easily declare Gary Orren is by far the best professor I've ever had. I can declare that without even thinking. Gary teaches persuasion. It's a baseline program before heading into negotiation next week, but just the fact that I've now been through six sessions of the mechanics behind good, persuasive communications is something I've never had. Gary gave me new tools, and believe me, I've already started practicing in some of my emails. 

Tomorrow is another lunchtime speaker. It's on the agenda as 'special guest'. Not sure what that means, but it seems to mean that HKS doesn't want to advertise the fact that high profile guests will join us at lunch. So more tomorrow. I'm looking forward to the surprise!

Ok, time for bed. I took about thirty minutes tonight to watch some mindless television and do some reading for pleasure. I took care of tomorrow's readings this morning ;)

Jeff

It's been a hell of a week...

It's just after 10PM. I had a bourbon and cigar on my porch with my roommate (a retired Navy P3 pilot/Commander) and we just found out a classmate was selected for AF Brig General! What a night. What a day.. all of them, just packed.

Anyway, Breakfast at 7, study group from 8-9, and classes every 90, minutes until finishing with dinner and a movie that will be the subject of tomorrow's first class. Reading more case studies than I've ever read before. For tomorrow, it's a civil war case on dealing with communications/persuasion of a mutinous unit.

I've been trying hard to network as best possible with the limited free time, so tomorrow it's the Minerva project --a joint Harvard/MIT program on cyber in international relations. Additionally, have a speech on increasing the tax on cigarettes designed to practice our new persuasive speech frameworks.

This is a great education.. a once in a lifetime experience.

Ok, off to bed. I'm exhausted and have to be up and in by 8:30 tomorrow. Getting a break.

Jeff

Sunday night.. heading into week 2!

Just left Spangler. What a great place. It's the main building for Harvard Business School. The Kennedy School folks share the facility for food since the graduate dorms (apartments) are all on the HBS campus on Soldiers Field Road.

Anyway, tonight was preparing for a role playing exercise to take place on Thursday morning. I'd mentioned a class on persuasion last week. This is by far, the best class to date.. and I've only been here a week! This is probably the class I needed most, but there are more coming. This week is three more sessions on persuasive comms this week, plus (as if there needed to be a plus!) we start on negotiation! I"m telling you, these guys give us nuts and bolts 'how to' lessons to actually do better communications, and anyone who knows me will tell you it's an area I could do better. I'm filling my toolkit with everything these guys will give me!

So, favorites? Gary Orren on persuasion. Ron Ferguson taught us how to tear apart ANY statistical analysis with fool proof tips to looking at stats with a critical eye. Pete Zimmerman talks of strategy and planning, and although I see myself as a pretty savvy strategist, this guy makes me look like a rank amateur. Steve Keller is on for tomorrow for our second session on building solid performance management plans. Bottom line, this place is cool as hell!

Re the forum? Last week it was Eric Cantor and William Perry. This week we're told it's a 'special guest'. I'm told they only book three days in advance, but it's well worth sitting in seats obviously engineered for college students before the experience the middle aged spread, but it's totally worth it.

Ok all. More to come. This is a once in a lifetime experience and I've got work to do to make sure I make the most of it... although tonight did include bourbon and cigars with my new friend from the UN. He's a political analyst for the the Secretary, and is a terrific conversationist. Does this mean I've been worked over? Probably. It's a good thing I only know about broubon and cigars!

Jeff

Harvard.. Thursday

So today was probably one of the best (BEST!!!) lectures I think I've ever heard in any course.. a day full of a 43 year professor (the one who taught Obama!) talking about communications and persuasion. Gary Orren had us for a full day, with a full framework for better targeting and framing communications to persuade others (voluntarily) to change course. WHAT A DAY.

Better? It was topped off with two speakers at the Forum (Agora -- a food market by day, speaking pulpit at night)... unfiltered Q&A. Eric Cantor (http://www.majorityleader.gov/) talking on the budget. The talk was terrific, but HIV activists protested at the end and were walked out. Regardless, an incredibly civil session! Finally topped off the night with a lecture from William Perry. What a day!

Jeff

My arrival at HKS...

Shirley asked me to post pictures of my immediate arrival, so here goes... This is my little room. There's a common living room as well, but nothing special. The view from the room however is really nice. The room is on the 4th floor of a dorm overlooking Soldiers Field Road, the Charles River, and the main Harvard Campus. The dorms are shared with Harvard Business School, so who knows, I may be sharing a dorm with the next Warren Buffet! Speaking of networking, it's already starting. Had lunch with two guys also here for the Senior Exec Program --the Regional Director for the Park services from Philly, and another from the Fed Trade Commission. Great conversation over lunch.

Ok, I'm off. Need to change into a suit for opening day. We were asked to be in business attire. You know how much I hate wearing a tie, but I'll do it just this once... in case they take pictures ;)

Jeff

Another mover into the MSSP space?

Just running through my required reading. I know, it's a little late, but heck, I'm a bit of a multi-tasker, not-so-good television tonight, and I'm in between good books. Ok, not really, I'm reading "The Accidental Salesperson".. it's actually pretty good, but I've had enough for today.

Anyway, in my browsing my required reading and RSS feeds, I came across an interesting post. ADP (the payroll outsourcing company) is  advertising for forensic people for their 'converged security' practice. About five seconds of digging --http://www.indeed.com/q-Converged-Forensic-jobs.html --shows several postings for ADP's new outsourced practice. Funny, I know there's money attached. I saw something from a year or so ago that talked of $355b government spending for cyber security, but a payroll company? Wow. Talk about teaching old dogs new tricks! I'm impressed! The bigger question? Will they be successful? What exactly does ADP call 'converged'? I know what I call it, but the definitions seem to change.. infosec = cyber. What exactly does converged mean in the market today?

Jeff

On Value...

I’ve been dieting since the beginning of the year. Anyone who knows me knows I need to be on a diet, but last night, after heavy jonesing for Chinese food, I broke down and had Chinese food.

At the end of my meal I sat thinking about what I’d just eaten. The dumpings weren’t hot; the sweet and sour sauce obviously from a can (bag?); and the meal as a whole just tasteless and lacking. It was going to cost me at least an hour on the treadmill and frankly, just wasn’t worth the calories I’d eaten. On my way out the door I stopped at the register to pay. The owner asked (as they always do) how my meal was. I said nothing. She obviously saw the painful grimace in my face as I held back my criticism and pushed a little more. In a slow, and deliberate way, I explained –my dumplings were cold, my sweet and sour pork was plain, and the meal as a whole was simply lacking. The woman explained that the dumplings should have been hot, but the sweet and sour pork is “the way we do it”.

So here’s a clue. “The way we do it” means “There’s a reason you only have five people in your restaurant at the peak of the dinner hour”. “The way we do it” is directly related to the fact that you’ve got a sign on your front door announcing a price reduction on your buffet.

What’s this got to do with tech? I do consulting –not full time, but on request under the name Hammerhead Research. So this piece isn’t a plug for Hammerhead, but it reinforces a message that demonstrates exactly what I have been telling clients (and now my government bosses) for years.

1.     Know your customer.

2.     Know exactly what your customer considers valuable.

3.     Know who your competitors are, and your value proposition in relation to them.

4.     Create products that add value

5.     Don’t stray. Pick your value proposition, stick to it, and deliver it consistently.

6.     In the commercial world, target customers who both need the value you add, and have the ability to pay.

It’s a pretty simple formula actually. It took a startup failure, $800K in angel funding and being sued for me to learn this lesson in retrospect.

Two years or so ago I authored a plan for a Fortune-100 company who wanted to move from the physical security monitoring space (think ADT, but not ADT) into the computer security space. They wanted to become a global-scale managed security service provider, competing with ADT in the consumer market by integrating wireless unified threat management (UTM) devices into home fire and security monitoring systems. If a fire, flood, home invasion, or cyber bad guy set off an alarm, one of this company’s monitoring centers would be alerted. It would then be evaluated, and the analyst could make pre-determined decisions on how to react. 

To understand the customer, I researched consumer demand for information security devices. Not surprisingly, most consumers don’t know what they don’t know. Anti-virus was deemed by most to be enough. Consumers are already price conscious when it comes to home monitoring, with $25-$40 being the current market pricing.

To research the space, I studied current offerings, and gaps in current physical security and MSSP offered services. I called on (by phone and in person) customers who were showcased on potential competitor websites to find out what they liked and didn’t like about their current provider. I polled competitor salespersons about future company plans (those guys will tell you anything!). I performed this service across the spectrum of providers that might compete with the new business in this F-100.

In the end, the company decided not to enter the market. Consumers were highly price sensitive, don’t understand the need (yet), and the market fragmented by a perceived lack of value in the home monitoring market and a low opinion of the companies selling services. In my opinion, this company was smart to not become just another monitoring company. While the computer monitoring service would likely differentiate them from the rest, the value proposition wasn’t strong enough (in the customers’ eye) to generate long-term sales.

This is one example. I’ve researched and authored dozens of startup plans or turnaround studies for companies large and small who simply don’t understand the value proposition. I’m hoping the owners of that Chinese restaurant read this post.

Know your customer

Know your competitor

Know your value proposition

Deliver consistently

Repeat!

On Virtual Internet Experience and Good Hygiene...

I was reminded yesterday of my tracking of Invincea. Virtualization -great strategy! I'd like to offer a few thoughts however, as with any application, remember this.. architecture counts, as does basic system hygiene. Hygiene is the process of keeping systems up to date, patches installed, antivirus up to date, etc.  Realizing there are probably 400 things that need to be kept up to date to keep your networks from stinking like bad breath, and only one needs to go wrong to allow in hackers, System hygiene is one of the hardest things, but one of the most important things, to do. In fact, I'd argue that ensuring the basics of system hygiene are far more important than applications you might buy. Pay attention to how applications get deployed- especially virtualization, and you'll have better results in the end.

I've seen several schemes for virtulization of the users' internet experience. Please don't get me wrong. I'm a HUGE fan of the strategy --so long as it's implemented correctly. IPS alone wasn't the panacea; nor will virtualized internet experiences. How does this get accomplished? Think about the kinds of things users must (or want) to do. What things do they need to do to not feel pain of virtualization? They need to browse, share email, download. They need to move information from the virtual space (for internet use) to the corporate network. So now we've moved from the realm of a virtualized internet experience to a need to move information to and from the corporate intranet. How does this happen? Good system hygiene and architecture. The basics of defense in-depth, and dedication to keep those items clean an up to date (hygiene).

Bottom line. VCs tell startups "Sell across the street before you sell across the ocean".

I'd tell admins and CIOs, Practice good hygiene before you spend money on more advanced infosec offerings promising to stop advanced persistent threats. Ya can't get there from here.

Jeff

Bit9 (and a bit of a rant about Infosec Pros!)

I have to tell you, every now and again I get a presentation from a product vendor that just makes me go "Wow. I wish I'd thought of that!" Bit9 was one of those.

During my travels I keep hearing the name Bit9, but hadn't really been exposed to their product. I attended a conference in January where they had a booth, but I hate those things. You can never have a serious talk. I guess they are a good way to get exposed to a lot of things and then circle back, but I always try and take notes on which to circle back on, and then either forget, or end up misplacing the literature.

Anyway, I did see Bit9 during the conference but didn't get to spend any time with them. When I returned, I forgot about them, only to be reminded a couple of months ago. So I set up a time, and offered my staff a lunch 'n learn.

Bit9 is a tool used (I'm sure they have others, but I loved this one) to identify installed malware on a system. More importantly, I was surprised to see that Bit9 is the brains behind some of my other favorite tools like Mandiant's MIR and is delivered by about a dozen others providing services. Interestingly enough (maybe I hadn't looked hard enough) I was under the impression that this space was wide open for exploitation with very little competition and a reasonable barrier to entry... meaning if I went to a VC for money to build the solution, a business case could be made, and I'd have enough of a run on my competition to be able to make a few bucks before they caught up. I still think that... the market for malware identification is still wide open and the AV vendors don't seem to have a clue.

Back to the point. Bit9 backends several malware identification tools with a database in a 'cloud' (marketing speak for two datacenters in Massachusetts). Regardless, the cloud is a massive repository of unique indicators each representing specific pieces of malware. The Bit9 tech is deployed to scan an environment using a client based system which compares files on a system to those in Bit9's database. The management console was, as you'd expect, pretty. Pretty without functional does no good, but in this case, the management console was totally functional. Running in a browser, it can be operated by any SOC or remote worker.

Bottom line: If you're looking for malware identification/remediation and whitelisting tools, save yourself some time. I've heard the name from some of the best companies in the world. Bit9 appears to have something real. I'd look at them first.

[rant]
In sitting with my team (and others I've worked with), it seems vendor presentations are peppered with questions like "You do X, why don't you do Y?"

This case was no different. Scope creep in vendor presentations is easy, and often takes away from the presentation. In this case, Bit9 has some really nice tech. They found their niche, filled it nicely, and are licensing the hell out of it to others who provide services in their space. Well done. What they didn't do was lose focus on their principle value proposition... finding malware on a host.

I'd love for one magic bullet solution. I'd drop it in my environment and turn it loose. It'd solve every problem I have, and those I haven't thought of yet. My users would be happy, it'd be free, and wouldn't require any maintenance... never going to happen.

Bit9 focuses on malware. Other technologies focus on other areas. Good management finds that first thing, with that first customer and puts it out of the park. Bad management finds thousands of customers and delivers mediocre solutions. I'm with Bit9.
[/rant]

Jeff

Invicea bake-off in a large company Internet isolation strategy

I had the opportunity to speak with a colleague last week. This gentleman is the CIO for a very large company and is in the middle of a bake-off between Invicea and another virtualization offering.

I'd discussed virtualization with him previously, but not in the form you're probably thinking. This is not a datacenter reduction strategy, rather an internet isolation strategy. He's trying to figure out a way to isolate his corporate network from the open internet.

My discussion started like this... "I'm interested in understanding how the Invincea test is working for you." His response? "No virtualization offering is worth anything by itself. Let me show you the what we wanted, what we did, and the architecture that we had to build behind it." In the end, this CIO built one reference architecture in which he tested two virualization strategies. Both were intended virtualize only Internet Explorer on the desktop.

His measures of success were easy to understand and very straight forward:

1. Isolate to the greatest extend, the internet from the corporate environment.
2. Do it with the least possible pain experienced in the end user experience.

I'd had a strategy discussion with him about a year ago. We discussed several options, including other virtualization applications, but also the use of simple terminal services, as well as a more simple idea.. issue everyone an iPhone. In the end, the iPhone dog didn't hunt and was dropped for discussions of the limitations of terminal services versus the implementation of an application virtualization strategy.

They've done a great job in that year, and now have about 1200 users in the pilot. Invincea had strengths and weakenesses, as did the other product. The other product has a significant price advantage, but is a tool developed for one thing, then used in another (therefore, no support for this particular use). Invincea on the other hand is a small company and therefore, more willing to accept development money and allow this large company to shape its product strategy.

Bottom line: No one application (including this wonderfully promising tech) is the cure-all. Remember defense in depth? Invincea handles only one of those layers, but with the right architecture in place provides a truly viable option. There are others however. Don't be afraid to look around. One company I talked with was experimenting with qmu! Others, VMWare, simple terminal services, etc. Do you homework. Do the architecture. And remember, in the end, nothing's cheap!

Jeff

Killed my SafeSocial account...

Great idea, not so good execution.

SafeSocial sent me the following:

"We have some cool news for you. Your parent, JEFFERY STUTZMAN, signed you up for something called SafeSocial.

You know how sometimes the adults in your life worry about you on the Internet because stuff can happen on sites like Facebook that isn’t safe? SafeSocial is a way for your parents to protect you and keep you safe without invading your personal space too much. It will make everybody's life easier."

I thought to my self, is this in language that my kids would respond to? Maybe. Regardless, after receiving this email telling me my parent (me) had some cool news, I decided to go back and look at the results. If I'm going to pay nine bucks a month for the service it needs to provide value. In this case, even though I have a couple of social networking accounts, SafeSocial didn't really do much for me. My five day trial period was up. I'll try it again later.

If anyone else has feedback on this service, my personal opinion? It's a great idea. I'd love to see it. I probably won't pay nine bucks a month for it, but would consider say, four or five.

Thoughts?
Jeff

SafeSocial.com - Great idea! My thoughts...

I received an ad this morning for AOLSafeSocial. The idea is, parents can monitor their kids Facebook, Myspace, Twitter, etc., accounts via one portal, and the thing would both check the reputation of your child's online social network friends, and report any bad sites that your child may have been exposed to.

Having one new teen and another a bit younger, both knowing they're not allowed to have sex before their 42 (or I'm dead, whichever comes first) I had to try this.

Here's how it worked for me:

1. I clicked the AOL link which took me to safesocial.com.
2. The interface looked relatively sparse, but I did it anyway.
3. I decided that since I too have social networking memberships, I'd try it on myself first to see how it went. I added my email and name to the 'who do you want to spy on' (my words not theirs) field and clicked submit.
4. SafeSocial then sent me a link to my address telling me someone wants to monitor my social networking use. Do you really believe my 13 y/o daughter would consent to my monitoring her? (hint: not only no, but... you know the rest!)
5. Since I was experimenting on me, I clicked 'agree'.
6. Immediately SafeSocial squealed on me. It told me that I was on LinkedIn, which is not normally a site for kids. It then checked facebook and twitter.. both seemed ok (for now).

Couple of thoughts:

• My daughter will never allow my monitoring, nor should she have the option. I pay for her service, she's a minor in my charge, and I should be able to monitor without her consent. Love the idea of the service, but would have preferred to see it be more seamless.
  
• $9.99 isn't a bad price if the service actually delivers. I can say, I received multiple emails immediately upon signing on for the service.
  

Looking forward to seeing how this shakes out. My daughter is going to kill me!

Jeff

Mobile threats?

Damn! I knew I should have attended Blackhat this year!!

------------------------------------------------------------------------------------------

"It collects your browsing history, text messages, your
phone's SIM card number, subscriber identification,
and even your voicemail password." -
mobile.venturebeat.com

http://mobile.venturebeat.com/2010/07/28/android-wallpaper-
app-that-steals-your-data-was-downloaded-by-millions/

questionable Android mobile wallpaper app that collects
your personal data and sends it to a mysterious site in
China, has been downloaded millions of times, according to
unearthed by mobile security firm Lookout.

That means that apps that seem good but are really
stealing your personal information are a big risk at a time
when mobile apps are exploding on smartphones, said John
Hering, chief executive, and Kevin MaHaffey, chief
technology officer at Lookout, in their talk at the Black Hat security
conference in Las Vegas today.

"Even good apps can be modified to turn bad after a lot
of people download it," MaHaffey said. "Users absolutely
have to pay attention to what they download. And developers
have to be responsible about the data that they
collect and how they use it."

The app in question came from Jackeey Wallpaper, and
was uploaded to the Android Market, where users can download
it and use it to decorate their phones that run the Google
Android operating system. It includes branded
wallpapers from My Little Pony and Star Wars, to
name just a couple.

It collects your browsing history, text messages,
your phone's SIM card number, subscriber identification,
and even your voicemail password. Itsends the data to a web site,
www.imnet.us. That site is evidently owned by
someone in Shenzhen, China. The app has been downloaded
anywhere from 1.1 million to 4.6 million times.
The exact number isn't known because the
Android Market doesn't offer precise data. The search
through the data showed that Jackeey Wallpaper and
another developer known as iceskysl@1sters! (which
could possibly be the same developer, as they use
similar code) were collecting personal data. The wallpaper
app asks for "phone info," but that isn't necessarily a clear warning.

The Lookout executives found the questionable app
as part of their App Genome Project. Lookout is a mobile
security firm, and it logged data from
more than 100,000 free Android and iPhone apps as part
of the project to analyze how apps behave. It found that the
apps access your personal data quite often. On Android, each
user is asked if they give their permission to access an app,
but on the iPhone, where Apple approves apps, no permission
is needed.

Roughly 47 percent of Android apps access some kind
of third-party code, while 23 percent of iPhone apps do.
The executives also found that many apps use third-party
software programs to do things such as feed ads into an app.
Often, developers unquestioningly use the software
development kits of those third parties in their apps,
even if they don't know what they do. In many
cases, there is a good reason for the use of personal information.
Ads, for instance, can be better targeted if the app knows a
user's location.

Hering said in a press conference afterward that he
believes both Google and Apple are on top of policing their
app stores, particularly when there are
known malware problems with apps. But it's unclear what
happens when apps behave as the wallpaper apps do,
where it's not clear why they are doing
what they are doing.

More on Invincea

Last night I had dinner with an old friend. As often times, the conversation rolls around to information security, and the new threats. One tactic for protecting against these new threats appears to be, at least on the surface, is virtualization. How can a company remove access to the Internet while maintaining the ability of those who require access, to get it in a safe way --all without killing the user experience to the point where they'll find alternative means of gaining access.

As mentioned before, I've seen pitches from VMWare, talks on using Med-V, thin client solutions --all of whom believe they have the answer. Not sure if they do, but one thing is for sure. My friend is the Director of Information Security for a very large company and they've doing a pilot/bake-off, and this little, out of no-where company called Invincea is actually one of the companies in the bake-off. Amazing. I can't wait to hear how this goes.

... More to follow on that.

A bit of advice for Invincea? Knock this one out of the park!

I'm liking what I'm hearing about this tiny company so far. I'm going to continue to track it. If anyone from the company is reading this (Dr. G did respond directly to me yesterday), I'd love to talk to a few reference companies!

JS

Anyone ever heard of Invincea?

I hadn't until just a few minutes ago. I was performing research for a consulting job for an investor who's considering making an investment in a security company. I'll sometimes do these on the side. Anyway, in this case I happened a cross a company called Invincea --using the words in their summary:

"Developed a patent-pending, revolutionary technology for protecting computer workstations from Internet attacks."

I love these words. Nothing thrills me more than patent-pending, revolutionary technology for protecting computers from Internet Attacks! Right now, I'm typing with sweaty palms and my hearts racing because the thought of new, patent pending revolutionary new software to protect my computer workstation from Internet attacks makes me, well, downright giddy!

So I read on... at the website (http://www.invincea.com/), I found a white paper. All startups have them. I was hoping to also find a list of reference customers I might contact while contemplating this paper. You see, the company is headed by the standard board of venture capital execs, but also by Dr. Anup Ghosh. That name might ring a bell for many reasons -DARPA program manager, NSA? That said, he's a smart guy and at first glance the company looked interesting. Now, while I haven't taken the time yet to look at the patent application, just reading the whitepaper tells me a little about the product:

1. It's revolutionary (their words not mine.. I'll stop making fun of them now ok?)

2. It uses virtualized browsers

3. It captures everything that happens during utilization of the browser during an attack

4. It sends everything from the virtualized session to a database somewhere (local or, as it states, in the cloud -I'm guessing Invincea is offering a managed service as well as software?)

Thoughts:

Virtualization seems to be a great buzzword for protecting from drive-by downloaded malware. I've seen a number of vendors (most of our favorites) pitch their wares on how good their product is in protecting from these threats. Some say the product can be reset at the close of each session (actually they all say that); some talk about how the virtual wall between the child and parent operating systems can't be broken (it's true, I've heard this before). Invincea however seems to be using a honeynet process in a virualized session. I like it. If you can't beat'em, set a smart trap for 'em. It seems to me, to be the best of both worlds -protection and collection; intel gain/loss (speaking in a purely network protective context of course!). 

What's next? I'm really interested in seeing some reference customers posted on the site. I've seen presentations on the technology before it became Invincea. I had doubts at the time. It looked to me to be far to much overhead to be powered on an already overburdened laptop, but what the hell. If it works, it could be good!

Back to you Dr.~!