Global Quality Journal

No Programming Language For Google Engineers

PC World:

Today's commercial-grade programming languages -- C++ and Java, in particular -- are way too complex and not adequately suited for today's computing environments, Google distinguished engineer Rob Pike argued in a talk Thursday at the O'Reilly Open Source Conference.

Pike made his case against such "industrial programming languages" during his keynote at the conference in Portland, Oregon.

"I think these languages are too hard to use, too subtle, too intricate. They're far too verbose and their subtlety, intricacy and verbosity seem to be increasing over time," Pike said. "They're oversold, and used far too broadly."

Pike detailed the shortcomings of such languages as a way of describing the goals that he and other Google engineers have for a new programming language they developed, called Go.

As an illustration of the complexity of such languages, Pike showed a few examples of C++ code. One example was of a variable declaration that stretched nearly across an entire line of the screen.

"How do we have stuff like this [get to be] the standard way of computing that is taught in schools and is used in industry?" he asked, rhetorically. This sort of programming "is very bureaucratic. Every step must be justified to the compiler," he said.

While Pike admitted that he was being somewhat facetious, he asserted that such questions still should be asked. C++ came about because of people's frustration with working with the low-level C language, and Java came about as a way to simplify C++. Over time, however, new features were added to both languages, making them more and more complex.

"Noise comes with sophistication," he said.

Pike also added that such languages were developed before the advent of multicore processing and widespread networking, so they don't easily accommodate these new environments.

Pike is not the lone Google employee expressing dissatisfaction with traditional commercial-grade languages.

At the USENIX annual conference last month, Gmail engineer Adam de Boor surprised the audience by noting that the company's Gmail service was written entirely in JavaScript, and that all of its code, around 443,000 lines worth, was written by hand.

He noted that while Java is more expressive, it is also more verbose. "At this point to me it's a matter of choice which language you use," de Boor said.

JavaScript is one of a whole batch of languages -- others include Ruby and Python -- that have been developed over the past 10 years in response to the growing complexity of C++ and Java. But while having a simpler syntax, such languages have their drawbacks as well, he argued. [Read more]

posted by: gqjournal

How Safe is SSL?

FASTCOMPANY:

E-Commerce Security Is Broken, Vulnerable, Says Hacker Conference Founder

BY Kit EatonToday

Lots of code excitement will spring from the Black Hat hacker conference this week, but already a huge controversy is erupting: Black Hat's founder thinks SSL--the security code making much of online commerce safe--is broken.

SSL, Secure Sockets Layer (and its successor Transport Layer Security) is a Net-based security protocol that ensures communications between computers is safe and unhackable--essentially so that no one can "listen in." It works like this: A server and computer connect together and say hello, digitally. This bit is unsecured. The two machines exchange a "key" which unlocks a private line that only they can communicate on.

These private exchanges are the basis of safe e-shopping, including credit card transactions. On the server side the site's owners can be certain they're speaking to a genuine customer, who's data can be trusted (to an extent).

So when Black Hat's keynote speaker Jeff Moss, founder of Black Hat and DEFCON, says that "SSL is broken," it's big news. Moss alleges that it's been 13 years since the first hacker conference, and that it's still not safe to do e-commerce. Moss wasn't much more specific than that, but the implication is that hackers can easily breach SSL, and thus expose millions of supposedly secure transactions to potential thieves. [Read the rest]

posted by: gqjournal

Brainstorming About Writing Safe Code

SDTimes:

Black Hat conference fields suggestions for software security

By David Worthington

July 28, 2010 —  (Page 1 of 3)
The Software Assurance Forum for Excellence in Code (SAFECode) engaged with developers at the Black Hat Technical Security Conference yesterday in a brainstorming session to clarify a vision for software security over the next decade.

More than 50 Black Hat attendees participated in the session. SAFECode Members include Adobe Systems, EMC, Juniper Networks, Microsoft, Nokia, SAP AG and Symantec.

The No. 1 issue was education and training, said Steve Lipner, senior director of security engineering strategy at Microsoft and SAFECode board member. The discussion focused on how to get new graduates and entry-level developers to be prepared to write secure code, or even be aware of the need to write secure code, he observed.

Some specific suggestions included adding software security classes to university curricula; getting universities to "push back" against employers that are more interested in applicants that know about new technologies but might not be able to create secure code; requiring developers to have security certifications to write code; and establishing a mindset for secure development.

"I don’t see this as very realistic," said Rex Black, president of Rex Black Consulting, a security group. "Academics telling practitioners how to do their job is not something that has traditionally gone down well in software engineering. What would be preferable, in my mind, would be for software and systems vendors to have the same kind of legal liability that vendors of other products—e.g., cars, airplanes, microwave ovens—have for the quality and safety of their products."

One attendee said that the security needs are different everywhere, and different companies have different requirements that can’t be covered in a course. Lipner said that most members on the panel have a policy in place that includes security requirements for developers.

"This would be a good thing, as would requiring certifications to test code. What’s important here is that the job market start to see value in such certifications," Black said. [Read the rest]

posted by: gqjournal

Russian Hackers Steal Check Images On A Large Scale

This is not your grand-father's check theft anymore.

Boston Globe:

Internet crooks target check images

Hackers write $9m in fakes on 1,200 accounts

By Jordan Robertson, Associated Press  |  July 28, 2010

SAN FRANCISCO — Think of it as one more reason not to write checks.

Hackers believed to be operating out of Russia have figured out a high-tech way to carry out the decidedly low-tech crime of check fraud, a computer security company says, writing at least $9 million in fakes against more than 1,200 legitimate accounts.

But these hackers got the account information in an unusual way: They broke into three websites that specialize in a little-known type of business, archiving check images online.

Check counterfeiting is a crime that savvy Internet criminals usually pass up. After all, it’s far easier for them to make money by stealing credit card numbers and online banking passwords.

The scam was discovered by SecureWorks Inc., an Atlanta computer security company. It’s working with the FBI and says the hackers have not been caught.

Retailers and other businesses use the sites to store records of all the checks they write. Check-cashing operations use them to sock away images of checks they receive. And some banks pay them to store images of customers’ checks, so the customers can see them when they log in to their online banking accounts.

The criminals downloaded all the images they could find, grabbing bank routing numbers, names and addresses, and signatures of account holders. They used the information to create their own checks with easy-to-acquire software and printers.

Because the account information is real and the victims don’t know their accounts have been compromised, the odds of the checks going through are high.

SecureWorks notified the three sites and said they have closed their security holes, but warned that the scam is ongoing and is targeting other, similar sites.

“It’s not the standard kind of criminal operation,’’ said Joe Stewart, director of malware research for SecureWorks’ Counter Threat Unit.

“Check counterfeiting is kind of old-school, but these guys have figured out how to make it highly automated,’’ he said. “They can get all this data and use that to write counterfeit checks all day long.’’ [More]

posted by: gqjournal

What's The Cost of a Security Breach?

darkreading.com:

One Breach = $1 Million To $53 Million In Damages Per Year, Report Says

New Ponemon report studies real attack cases and their financial fallout; new Digital Forensics Association study tallies five-year public breach data

By Kelly Jackson Higgins,  DarkReading
July 26, 2010
URL:http://www.darkreading.com/story/showArticle.jhtml?articleID=226200272

Organizations are getting hit by at least one successful attack per week, and the annualized cost to their bottom lines from the attacks ranged from $1 million to $53 million per year, according to a newly published benchmark study of 45 U.S. organizations hit by data breaches.

The independent Ponemon Institute's "The First Annual Cost of Cyber Crime Study" (PDF), which was sponsored by ArcSight, showed a median cost of $3.8 million for an attack per year, a price tag that includes everything from detection, investigation, containment, and recovery to any post-response operations. "Information theft was still the highest consequence -- the type of information [stolen] ranged from a data breach of people's [information] to intellectual property and source code," says Larry Ponemon, CEO of the Ponemon Institute. "We found that detection and discovery are the most expensive [elements]."

And a separate report called "The Leaking Vault" (PDF) released today by the Digital Forensics Association found that among the 2,807 publicly disclosed data breaches worldwide during the past five years, the cost to the victim firms as well as those whose information was exposed came to whopping $139 billion.

The Digital Forensics Association report says nearly half of all of the reported breaches came from a laptop, which in 95 percent of the cases is stolen. But actual hacks accounted for the most stolen records during 2005 to 2009, with 327 million of the 721.9 million covered in the report, even though hacks accounted for only about 16 percent of the data breaches.

Ponemon found that Web-borne attacks, malicious code, and malicious insiders are the most costly types of attacks, making up more than 90 percent of all cybercrime costs per organization per year: A Web-based attack costs $143,209; malicious code, $124,083; and malicious insiders, $100,300. "If you look at the actual attacks, they were found most frequently as viruses, worms, and Trojans," Ponemon says. "But in terms of each individual attack ... a SQL injection is more expensive on attack-by-attack basis."

Interestingly, botnets made up only 8 percent of the attacks, with a price tag of about $1,627. But that number could be conservative given some of the unknowns about the origins of the attacks, Ponemon says. "We think those numbers are conservative," he says. "My gut feeling is they are really more expensive."

Nearly half of all breach costs occur in detection and recovery, and the average number of days to recover and resolve from an attack was 14 days, with a cost of $17,696 per day, according to the report. But when an attack comes from a malicious insider, it takes 42 or more days to resolve.

"It seemed that the majority of the 45 organizations were random and haphazard in their approach" to the problem, Ponemon says. "They didn't have the right tools or technologies, and they didn't know what kinds of threats there were and that the actual attacks were happening" until afterward. One finding in the report gave a nod to SEIM tools: Organizations with a SIEM solution incurred 24 percent less costs of the breach than those that did not. [More]

posted by: gqjournal

What is The Cost of Cyber-risk?

Economist.com:

Cyber-risk, sure. But what kind?

Jul 15th 2010, 17:26 by B.G. | WASHINGTON

We're at the point where people clearly know they need to wear a seatbelt. I'm not sure if they've gotten to the side airbags yet.

LOU HUGHES is the chief executive of InZero, a startup that's built a little black box to put between your computer and the internet. The box opens incoming files and programmes before your computer does, leaving hackers stuck in the black box and not in your computer, where they want to be. InZero has launched an open invitation to hackers, who have thus far failed to breach the box. And Mr Hughes is taking it on tour to corporate and government information officers.

"Cyber-security" and "cyberwar" are broad words. Like "weapons of mass destruction", they describe several different distinct threats, and are often used with imprecision. Insurance companies speak of risks in terms of severity and frequency: a death from a car crash is a high-severity, low-frequency event. A fender-bender is a low-severity, high-frequency event. All efforts to reduce and insure against risk weigh severity against frequency. We buy life-insurance policies and demand side air-bags to manage the risk of a fatal accident; states enforce speed limits in part to keep first-responder costs down. (And in part to raise revenue. I'm looking at you, Delaware.)

But we also make rational choices to accept certain low-severity, high-frequency risks. Financial managers advise, unless you have money to throw around, that you keep car insurance deductibles high. It's very difficult to guarantee that you won't ding your fender in a minor accident, and cheaper to pay for the event than to hedge against it. Hedges, insurance and risk mitigation, remember, are inconvenient and expensive. Absolute security, even were such a thing possible, would mean unacceptable operating costs.

I'm thinking about car accidents because when I spoke to him yesterday Mr Hughes, a former auto executive, pointed to car safety to help me understand corporate choices about cyber security. Cars, he said, had offered unprecedented mobility, but new risks. The auto industry, recognising the risks, eventually added seat belts and made structural changes to car frames (after, he neglected to say, several decades of vigorous prodding by consumer groups). States developed driver-education programmes. Consumers demanded new features to lessen their own risk.

We are at a point, according to Mr Hughes, where corporations are beginning to see cyber-espionage as an existential risk: one of severity so high that it is unacceptable at any frequency. And he is seeing, since intrusions in 2008 at America's Central Command (and, allegedly, at Lockheed Martin) new co-operation among companies to come up with better solutions. Before 2008 corporations had been reluctant to admit weaknesses; now they're desperate to fix them any way they can. The risk profile of cyber-espionage has changed: Frequency has risen, as has the perception of severity. [Read more]

posted by: gqjournal

Computer Attack Born On the 4th Of July

AP:

Computers blamed for outages on SKorea, US websites last year repeat attacks but do no damage

SEOUL, South Korea (AP) — Hundreds of computers that helped cause a wave of outages on U.S. and South Korean government websites last July launched new attacks on the same sites, but no major interference was reported, police said Thursday.

The computers were programmed to attack every July 7, according to police, so this year's assault appeared to be a continuation of last year's, which began over the July 4 holiday weekend in the U.S. but reached South Korea on July 7.

More than 460 computers infected with malicious computer codes assaulted 25 websites, including those of the White House and South Korea's presidential Blue House, on Wednesday, said Jeong Seok-hwa, a police officer handling investigations of the cyberattacks.

Although last year's attacks were initially blamed on North Korea, experts have more recently said they have no conclusive evidence that it was behind the assaults.

The malicious computer codes, called malware, triggered denial of service attacks, in which large numbers of computers try to connect to a site at the same time in an attempt to overwhelm the server.

"But the attacks were so weak that there were no problems in accessing the sites," Jeong said.

An analysis of an infected computer in Seoul showed that it was programmed to attack every July 7 and the malware used was identical to that used last year, said Hyun Jae-sub, another police official. In other words, the computers apparently attacked again this year because last year's malware hadn't been removed, not because another assault was launched.

Hyun said the attacks were traced to computers that participated in last year's attacks and still were infected. He said about 270,000 infected computers were involved in the original assaults. [link]

posted by: gqjournal

Intuit's Outage Strands 300,000 Customers

MercuryNews.com:

Intuit encounters challenges in shifting to Web-based services
By Rocelle Garner
Bloomberg News


When a power failure knocked out Intuit's servers last month, the outage did more than strand 300,000 customers. It showed the challenges in shifting from selling shrink-wrapped software to Internet-based services.
Under Chief Executive Officer Brad Smith, Intuit is aiming to get more than 75 percent of sales from Web-based services and software by 2015. To do that, he plans to continue a run of Internet acquisitions. Smith's also developing new features and investing in operations to prove that Intuit, best known for its TurboTax and Quicken, can run a reliable online service.
"We don't have the luxury of going down," Smith, 46, said from Intuit's headquarters in Mountain View. "We are required to be available 24/7, and we're doing everything we can to make sure it doesn't happen again."
Smith, working with Intuit's chief technology officer and chief information officer, is analyzing what went wrong in June and working out procedures to avoid future outages. The company also is making its data centers more efficient, in part by shutting down smaller offices and concentrating more of its operations in a state-of-the-art, 240,000-square-foot facility that it built in Quincy, Wash.
Intuit now gets 60 percent of its revenue from online products, up from less than half before Smith took over in 2008. That's come at a price: During the past three years, the company has spent about $300 million on equipment and networking costs, primarily for the new data center. [Read more]

posted by: gqjournal

MA Secretary of State Accidentally Released Data On 139,000 Investment Advisers

Office of Secretary of State is uncharacteristically full of excuses. Would they take such excuses from a company under their investigation? Don't bet on it.

Boston Globe:

State’s error unveiled Social Security numbers

Data sent on 139,000 investment advisers

By Todd Wallack, Globe Staff  |  July 6, 2010

The Massachusetts secretary of state’s office, which is charged with enforcing financial rules for investment companies, accidentally released confidential personal information earlier this year on 139,000 investment advisers registered with the state.

The data, including the advisers’ Social Security numbers, were on a CD-ROM sent to IA Week, an investment industry publication that had requested public information from the Securities Division, which Secretary of State William F. Galvin oversees.

IA Week had asked for a list of registered investment companies. The Securities Division responded by sending a list of individual investment professionals.

In addition to their names and Social Security numbers, this list included their dates and locations of birth, height, weight, hair color, and eye color.

“It’s a pretty big mistake,’’ said Carl Ayers, IA Week’s publisher. “It’s pretty shocking, because it’s such a large number of people.’’

IA returned the database to the Securities Division in June and wrote about the episode last week.

Brian McNiff, a spokesman for Galvin, said a new employee erred by not deleting the Social Security numbers and other information that is normally withheld. McNiff said IA Week returned the CD-ROM with a letter stating it had not made any copies of the data, so the state has no reason to think anyone was harmed.

“It’s an unfortunate mistake,’’ McNiff said. “It obviously was not done according to [standard] practice.’’ [link]

posted by: gqjournal

Massachusetts Data Privacy Law: Will Industry Comply?

Darkreading.com:

...The logical part of my brain loves that the Massachusetts privacy law tasks companies with understanding their data security risks. Risk is something they understand. The regulation specified that you will build a security plan around challenges specific to your organization's risk, looking at both the data and systems that manage data. There is no encryption loophole for companies to excuse sloppy security. They will have a tough time blaming data theft on product vendors if they select the wrong product or scapegoat IT if they do not respond to discovered risks. I think this law makes meaningful advancements in data security requirements, and I like to think that companies that make money from personal information should have some custodial responsibilities to the safety and security of other people's information.

So I was thinking, "Great, I'll write a justification piece for database security." In practice, social security numbers, driver's license numbers, passwords, and other personal information are being stored in relational databases. 201 CMR 17.00, HIPAA, and many of the regulations don't call out database security specifically, but relational databases are the primary storage management system for this data. My intention when starting this blog post was to outline a plan to understand risk, and outline how auditing, assessment, DAM, encryption, access controls, and application programming can be applied to meet different threat types. I may still do that, but the question remains whether companies will actually take action to understand the risks. Is this law actually a business driver?

If you want to see a security program outline for meeting Massachusetts data privacy standard 201 CMR 17.00, then I would be happy to post here on the blog. (Let me know via the "Comments" box below).

But I think a discussion about whether this law will be taken seriously needs to happen before we decide how to comply.

Adrian Lane is an analyst/CTO with Securosis LLC, an independent security consulting practice. Special to Dark Reading. 

[link]

posted by: gqjournal