Tom Fox-Brewster
November 24, 2014
Want to avoid government malware? Ask a former NSA hacker
Former NSA hacker Jim Penrose has joined UK firm Darktrace. Photograph: Harley Hall Photography
Many of the brightest minds from the National Security Agency and GCHQ staff tire themselves out from long years of service, moving out into the comfort of the private sector.
Unsurprisingly, the security industry welcomes them with open arms. After all, who better to hand out advice than alumni of two of the most sophisticated intelligence agencies on the planet?
A young British company called Darktrace, whose technology was spawned in the classrooms and bedrooms of Cambridge University, can now boast a covey of former spies among their executive ranks. Jim Penrose, who spent 17 years at the NSA and was involved in the much-feared Tailored Access Operations group (TAO), is one of Darktrace’s latest hires.
Though he declined to confirm or deny any of the claims made about TAO’s operations, including Edward Snowden leaks that showed it had hacked into between 85,000 and 100,000 machines around the world, Penrose spoke with the Guardian about how people might want to defend themselves from government-sponsored cyber attacks.
Here’s one of his top tips: treat governments and criminals just the same, and don’t expect them to waste their most treasured hacker tools on you unless you’re a genuinely tasty target.
“Whether they’re cyber criminals or state sponsored actors, I think a lot of times they can get into a network using a less sophisticated approach or a variant of a known piece of malware… it’s a lower risk operationally for them,” he said.
“They don’t want to fire silver bullets unless it’s absolutely necessary; like a zero day [a previously unknown and unpatched vulnerability] or something like that, or a previously unseen piece of malware. Those are really high quality and you want to save those for a time when it’s absolutely critical.”
He advised businesses and individuals alike to imagine a thief were outside their house trying to find a way in. There’s no point wondering whether they’re “part of the police or a local gang, or even worse a foreign soldier”.
If it turns out they are a state hacker, should individuals or business owners be concerned if they’re American? “I’m not an officer of the government any more, but I would say look, if you’re really honest with yourself and really read everything that came out in the media leaks, you’ll see there’s an incredible amount of discipline around what is done with those capabilities, and that makes things bureaucratic and slow and it does serve as a protection mechanism for different companies,” said Penrose.
“It depends where you are in the world and what you’re doing and who you’re working with, there are a whole set of provisos you can put on that but all things equal, people need to be honest about it as best as they can.”
Once the hackers are inside, in most cases they’ll benefit from a lack of a quality “insider threat” programme, Penrose noted. That’s because the hackers will be able to make it look like it’s an insider job rather than an external attacker nabbing information.
The NSA itself came in for criticism for allowing Snowden, a Booz Allen-Hamilton contractor working for the agency, such extensive access to its systems, many of which were used for the surveillance programmes he exposed to the world.
Indeed, insiders can cause plenty of trouble. Talking about what Snowden did, Penrose said that the information shouldn’t have been made public so the US could carry on using its vast intelligence capabilities responsibly.
“Focus has been lost on the protection mechanisms to keep people from using the vast capabilities being exposed. There are a lot of protection mechanisms. I don’t know if that exists in all the other states that use their intelligence capability or military capability in that fashion… they certainly are incredible capabilities but they need to be used for the right purposes.”
While individuals might be wary of any advice or technology coming from the minds of ex-intelligence officials, businesses are gagging for it. Darktrace can already class Virgin Trains as a customer and it’s planning to get coverage for itsBayesian inference and machine learning-based technologies across organisations of any size, including government.
Lynch, who founded UK software firm Autonomy before it was sold to HP andbecame the centre of a major financing investigation, invested somewhere between $10m and $20m in the company. It’s also just been named enterprise startup of the year by trade publication Techworld.
Though highly complimentary of Darktrace’s technology, Andrew Tang, service director for security at IT firm MTI Technology, believes that there will be parts of the private sector that won’t want to associate with spooks after everything Snowden revealed.
“I know there would be a lot of resistance within the commercial world, if they were aware of the people in the background,” he told the Guardian.
No comments:
Post a Comment