why we must ask why

Download WHY WE MUST ASK WHY

Post on 07-Jan-2016

14 views

Category:

Documents

0 download

Embed Size (px)

DESCRIPTION

WHY WE MUST ASK WHY. Markus Jakobsson, Principal Scientist, PayPal Keynote, June 7, 2011 MAAWG 22 nd General Meeting, San Francisco, CA. Why Did the Internet Turn out as it Did?. We first designed it to provide features , then for usability . We never designed it with abuse - PowerPoint PPT Presentation

TRANSCRIPT

  • Why Did the Internet Turn out as it Did?

    We first designed it to provide features, thenfor usability. We never designed it with abusein mind. We did not try to predict the future.

    And now we are in a pickle.

    MAAWG | maawg.org | San Francisco, CA 2011

  • Predicting An Unsupervised Future

    Predicting the future is much too easy, anyway.You look at the people around you, the street youstand on, the visible air you breathe, and predict more of the same. To hell with more. I want better.

    Ray Bradbury

    MAAWG | maawg.org | San Francisco, CA 2011

  • To Hell With More. I want better.Before we can address any problem, we need to know why it occurs.Talk focus: mobile Internet. Will be huge and we can ask why before it is too late.

    MAAWG | maawg.org | San Francisco, CA 2011

  • Web/App Spoofing: Why Works?An attacker is successful ifThe victim is tricked, and as a resultThe victim acts, benefitting the attackerJakobsson/Leddy: www.spoofkiller.com

    MAAWG | maawg.org | San Francisco, CA 2011

  • Web/App Spoofing: Why Works?An attacker is successful ifThe victim is tricked, and as a resultThe victim acts, benefitting the attackerTraditional countermeasures address this part (locks, colors, warnings a user communication problem)Jakobsson/Leddy: www.spoofkiller.com

    MAAWG | maawg.org | San Francisco, CA 2011

  • Web/App Spoofing: Why Works?An attacker is successful ifThe victim is tricked, and as a resultThe victim acts, benefitting the attackerCan we address this instead?Jakobsson/Leddy: www.spoofkiller.com

    MAAWG | maawg.org | San Francisco, CA 2011

  • Imagine a World WhereGOOD SITE+NAVE USER=SUCCESSJakobsson/Leddy: www.spoofkiller.com

    MAAWG | maawg.org | San Francisco, CA 2011

  • Here is How to Do It!Jakobsson/Leddy: www.spoofkiller.comGot cert?LOG IN NOWABORTYN

    MAAWG | maawg.org | San Francisco, CA 2011

  • We are all Pavlovs dogs!Jakobsson/Leddy: www.spoofkiller.com

    MAAWG | maawg.org | San Francisco, CA 2011

  • Demo time!Jakobsson/Leddy: www.spoofkiller.comDemo produced by Hossein Siadaty

    MAAWG | maawg.org | San Francisco, CA 2011

  • Jakobsson/Leddy: www.spoofkiller.com

    MAAWG | maawg.org | San Francisco, CA 2011

  • Jakobsson/Leddy: www.spoofkiller.com

    MAAWG | maawg.org | San Francisco, CA 2011

  • Take-Home MessageJakobsson/Leddy: www.spoofkiller.com

    It is more important to understand people than to understand computers.

    MAAWG | maawg.org | San Francisco, CA 2011

  • Now: AuthenticationJakobsson/Akavipat: www.fastword.mePeople hate passwords especially on handsets

    Slow to enter and then you realize you mistyped something!

    At the same time, recall rates are low for passwords and reset is difficult / insecure / expensive

    PINs are faster but not very secure and reuse is rampant

    MAAWG | maawg.org | San Francisco, CA 2011

  • Understanding usability issuesJakobsson/Akavipat: www.fastword.me Q. Why are passwords more painful than text? A. Text uses auto-correction/completion!

    MAAWG | maawg.org | San Francisco, CA 2011

  • Understanding recall issuesJakobsson/Akavipat: www.fastword.me Q. Why are (good) passwords hard to recall? A. Good passwords are weird!(Ebbinghausen, 1885)

    MAAWG | maawg.org | San Francisco, CA 2011

  • A stab at a solutionJakobsson/Akavipat: www.fastword.mefrogfroffrofrffrof

    MAAWG | maawg.org | San Francisco, CA 2011

  • A stab at a solutionJakobsson/Akavipat: www.fastword.mefrog flat work

    MAAWG | maawg.org | San Francisco, CA 2011

  • A Look at SpeedJakobsson/Akavipat: www.fastword.me

    MAAWG | maawg.org | San Francisco, CA 2011

  • A Look at SecurityJakobsson/Akavipat: www.fastword.me

    MAAWG | maawg.org | San Francisco, CA 2011

  • Forgot your fastword? Hint: frogJakobsson/Akavipat: www.fastword.meEFFECTIVE RECALL: 0.36+(1-0.36)*0.48=0.67 . 67%

    MAAWG | maawg.org | San Francisco, CA 2011

  • Forgot your fastword? Hint: frogJakobsson/Akavipat: www.fastword.me

    MAAWG | maawg.org | San Francisco, CA 2011

  • Big-Picture Insight

    We can improve as basic things as passwords if we ask why.

    Jakobsson/Akavipat: www.fastword.me

    MAAWG | maawg.org | San Francisco, CA 2011

  • Dealing with MalwareJakobsson/Johansson: www.fatskunk.com

    Problem: Power

    MAAWG | maawg.org | San Francisco, CA 2011

  • Dealing with Malware

    Three truths: Nasty malware is activeActive routines are in RAMAlgorithms: time-space trade-off

    Jakobsson/Johansson: www.fatskunk.com

    MAAWG | maawg.org | San Francisco, CA 2011

  • Dealing with MalwareJakobsson/Johansson: www.fatskunk.comcacheRAMSwap out all programs (malware may refuse)

    monolithkernel

    MAAWG | maawg.org | San Francisco, CA 2011

  • Dealing with MalwareJakobsson/Johansson: www.fatskunk.commonolithkernelSwap out all programs (malware may refuse)Overwrite all free RAM pseudo-random content(malware refuses again)

    cacheRAM

    MAAWG | maawg.org | San Francisco, CA 2011

  • Dealing with MalwareJakobsson/Johansson: www.fatskunk.comSwap out all programs (malware may refuse)Overwrite all free RAMpseudo-random content(malware refuses again)

    monolithkernelcacheRAM

    MAAWG | maawg.org | San Francisco, CA 2011

  • Dealing with MalwareJakobsson/Johansson: www.fatskunk.comSwap out all programs (malware may refuse)Overwrite all free RAMpseudo-random content(malware refuses again)3. Compute keyed digest of all RAM (access order unknown a priori)

    monolithkernelcacheRAM

    MAAWG | maawg.org | San Francisco, CA 2011

  • Dealing with MalwareJakobsson/Johansson: www.fatskunk.comSwap out all programs (malware may refuse)Overwrite all free RAMpseudo-random content(malware refuses again)3. Compute keyed digest of all RAM (access order unknown a priori)

    monolithkernelcacheRAM

    MAAWG | maawg.org | San Francisco, CA 2011

  • Dealing with MalwareJakobsson/Johansson: www.fatskunk.comSwap out all programs (malware may refuse)Overwrite all free RAMpseudo-random content(malware refuses again)3. Compute keyed digest of all RAM (access order unknown a priori)

    monolithkernelcacheRAMExternal verifier provides this

    MAAWG | maawg.org | San Francisco, CA 2011

  • Dealing with MalwareJakobsson/Johansson: www.fatskunk.comSwap out all programs (malware may refuse)Overwrite all free RAMpseudo-random content(malware refuses again)3. Compute keyed digest of all RAM (access order unknown a priori)

    monolithkernelcacheRAMExternal verifier will time this(and check result of computation)

    MAAWG | maawg.org | San Francisco, CA 2011

  • Dealing with MalwareJakobsson/Johansson: www.fatskunk.com

    Malware has options:

    Swap out and become inactiveStay, cause delay, be detectedRefuse connection, be detectedDie and remain unnoticed

    MAAWG | maawg.org | San Francisco, CA 2011

  • After test passedJakobsson/Johansson: www.fatskunk.comScan flash for inactive malware, make secure backup to cloud, DRM, password manager, virtualized phone setup, banking app, vote casting, unlock data/apps,

    MAAWG | maawg.org | San Francisco, CA 2011

  • More detail: unlocking data/appsJakobsson/Johansson: www.fatskunk.comFLASH RAMGET KEY FROM VERIFIER.LOAD

    MAAWG | maawg.org | San Francisco, CA 2011

  • THE FUTURE MATTERS TODAYJakobsson/Johansson: www.fatskunk.com

    Anticipating problems gives us time to innovate.

    MAAWG | maawg.org | San Francisco, CA 2011

  • Why does user education fail?Contact me to talk spoofing, authentication, malware, mobile, education and why!

    MAAWG | maawg.org | San Francisco, CA 2011

    **************************************