Darwin & Security:

What Evolution Tells Us About the Past and Future of Security

Paul Kocher | Cryptography Research, Inc. | 04/09/08, 8-8:50am | Session Code: EXP-201

[Image shows a sequence of figures evolving from a quadrupedal form to a bipedal human-like form, with the final figure carrying a box]

<signature> Kader

CRYPTOGRAPHY RESEARCH

RSA CONFERENCE 2008

The slide presentation from RSACONFERENCE 2008 discusses the theory that analyzing how attacks and defenses evolve together can lead to better predictions compared to focusing on isolated events. The slide is from Cryptography Research.

RSACONFERENCE2008

Brief introduction

• Focus on real-world cryptographic systems
– Systems, architectures, protocols (SSL 3.0…)
– Organization & management challenges in security

• Highly technical team
– High-assurance emphasis
– Customers: Financial, technology, entertainment, pay TV, communications, anti-counterfeiting

• R&D-based business
– Services: Design, implementation, evaluation, education
– Licensing: Tamper-resistance/DPA, secure ASIC technologies
– Systems designed by CRI engineers protect >>$100B annually

CRYPTOGRAPHY RESEARCH
3

RSACONFERENCE2008

In this talk, I’ll explore security as an evolutionary
process between attacker and defender

– How defensive measures influence attacks
– How attackers gain advantages by manipulating our
defensive strategies and perceptions of risk

But first a quick look at what’s missing from
traditional (non-evolutionary) perspectives…

CRYPTOGRAPHY RESEARCH
4

Key points about traditional security emphasis:

*   Focus: Vulnerabilities.
*   Evaluations: Checking for vulnerabilities.
*   Attacking: Exploiting vulnerabilities.
*   Responding: Patching vulnerabilities.
*   Engineering: Introducing vulnerabilities.

Lists of security updates for Windows (XP, Media Player) are visible.

Cartoon depicts developers in factories emitting vulnerabilities (waste) behind a fence labeled "Engineering in progress" while users are at a house with the sign "No Peeking Behind This Fence - Software Engineering in Progress!". The quote says that the person is "making great progress - I've cleaned up almost a dozen buckets out of your back yard!".

- Slide: RSACONFERENCE 2008 (Cryptography Research logo)

- Problem (left box)
  - Two independent security reviews:
    - Review #1 finds 16 bugs
    - Review #2 finds 15 new bugs + 2 that were also found by #1 (so Review #2 total = 17)
  - All found bugs get patched before shipping
  - Question: assuming all bugs equally easy to catch, how many unpatched bugs are expected in the shipped product?

- Solution (right box)
  - Let total bugs = B
  - Probabilities: Review #1 finds 16/B, Review #2 finds 17/B
  - Expected overlap = B * (16/B) * (17/B) = 2
  - Solve: (16*17)/B = 2 → B = 16*17/2 = 136
  - Slide shows Unfixed bugs = B − 16 − 15 = 103 (boxed)
  - Note: arithmetic check: 136 − 16 − 15 = 105 (discrepancy with slide’s 103)
  - Caveat on slide: if some bugs are harder to detect, true number is larger.

RSA CONFERENCE 2008

The basic evolutionary cycle...

<signature> New defense
Prey (aka defender)
Predator (aka attacker)
New exploit

Predators & prey must adapt or die.

– Prey die off if they cannot find a workable defense

– Predators die off if they can't find workable attacks

(although the predators doing pretty well these days...)

8

Cryptography Research

Title: An example… website blacklisting

- Websites serving exploits get blacklisted
  - Blocked sites don't propagate malware very well
  - Selection pressure: attacks that lead to rapid blacklisting are less fit

- What are obvious responses?
  - Infect legitimate (e.g., whitelisted) sites to make them serve malware
  - Prevent blacklisting services from detecting the malware

Key entities:
- Event: RSA Conference 2008
- Organization/logo: Cryptography Research
- Slide number: 9

<table><tr><th>RSACONFERENCE 2008</th></tr><tr><td>An example... website blacklisting</td></tr><tr><td>⚫ "random js" attack</td></tr><tr><td>- Installed on ISP web servers that are serving multiple domains
- Dynamically embeds malicious javascript into webpages
- Serves out an updateable cocktail of exploits (13 as of Dec. 2007),
which install a nasty data-harvesting Trojan
- 10,000 legitimate domains hosting the attack
-The attack is only served out once per visiting IP address
(Source &amp; for more information, see: Finjan MCRC MPOM report, Jan. 2008)

Widespread use of blacklisting has <u>caused</u> adversaries to:
...focus more on compromising legitimate websites
...use code morphing to randomize their malware
...limit infection attempts to conceal machines serving out malware</td></tr><tr><td>10
CRYPTOGRAPHY RESEARCH</td></tr></table>

Key details from the image:

*   **Title:** Evolving resistance
*   **Concept:** Breakable security responses work like antibiotics
*   **Analogy:** Antibiotics resistence shown via Petri dish test.
*   **Another concept:** Classic Prisoners' Dilemma
*   **Event:** RSACONFERENCE 2008
*   **Company:** Cryptography Research

<table><tr><th>RSACONFERENCE 2008</th></tr><tr><td>On-line piracy: Past evolutionary steps</td></tr><tr><td>• Original problem: Distribution of pirated content</td></tr><tr><td>• Original response: Prosecution</td></tr><tr><td>Evolutionary sequence:</td></tr><tr><td>• Attack #2: Distribute circumvention tools instead pirate copies</td></tr><tr><td>. Response #2: Digital Millennium Copyright Act (1998)</td></tr><tr><td>⋅ Attack #3: Napster</td></tr><tr><td>. Response #3: Litigation (Napster shut down 2001)</td></tr><tr><td>• Attack #4: Grokster &amp; others test the lines of legality</td></tr><tr><td>Response #4: MGM v. Grokster (Grokster shut down 2005)</td></tr><tr><td>• Attack #5: Rise of BitTorrent</td></tr><tr><td>Response #5: Attack trackers (torrent.is, Demoniod, OINK.cd... in 2007)</td></tr><tr><td>Attack #6: Trackers in "safe" jurisdictions; trackerless protocols</td></tr><tr><td>DMCA BitTorrent ➡
Brokster</td></tr></table>

Title: On-line piracy: Predicting future evolution

Driving factor:
- Communication & storage advances (vertical arrow)

Current efforts by rights holders:
- Laws requiring increased responses by ISPs
- Increased prosecution of individuals
- International legal efforts (e.g., vs. The Pirate Bay)

Which will lead to increased:
- Funding of legal counterattacks (e.g., Sweden’s Pirate Party)
- Decentralized, anonymous, encrypted file‑sharing systems

Which will lead to:
- Efforts to increase penalties for those who get caught (e.g., mail theft)
- Dramatically increased effort to flood pirate networks with fake files to degrade user experience

Which will lead to:
- Sympathy campaigns for targets
- Public‑key reputation systems to authenticate posted files

Slide: RSA Conference 2008 — slide 13.

<table><tr><th>RSACONFERENCE 2008</th></tr><tr><td>Pay TV signal theft...</td></tr><tr><td>. Another interesting case study:</td></tr><tr><td>Long history of co-evolution</td></tr><tr><td>- Sophisticated participants</td></tr><tr><td>- Broad range of strategies attempted</td></tr><tr><td>- Significant attacks are visible</td></tr><tr><td>New defense</td></tr><tr><td>Prey Predator
(aka defender) (aka attacker)</td></tr><tr><td>New exploit

CRYPTOGRAPHY RESEARCH</td></tr></table>

RSA Conference 2008 presented on Pay TV signal theft.
*   Popular channels like HBO and ESPN aren't legally available in Canada, resulting in a black market.
*   "vcipher" raid recovered $13M (CDN) cash/checks/bonds + 10,000 access cards + guns. Estimated revenue: $10M/year.
*   Attacks spill back into the US market, causing extreme pressure on technical systems.

<table><tr><th>RSACONFERENCE 2008</th></tr><tr><td>Pay TV signal theft...</td></tr><tr><td>Numerous examples of evolutionary sequences:</td></tr><tr><td>- Analog traps, DISCRET, OAK, EBU... attacked using pirate boxes</td></tr><tr><td>- VideoCipher II, VideoCipher II+ ... attacked by VMS &amp; other attacks
- VideoCrypt:
⚫ First 5 card gens: Limit voltage/current on 21V external prog pin
• 6th card gen: PIC-based message blocker ("Kentucky Fried Chip")
⚫ 7th card gen: PIC16C84-based blocker/emulator ("Ho Lee Fook")
• 7th card gen: PC-based emulator by Markus Kuhn
8th card gen: Abandoned. (Same as 7th with different keys)
⚫9th card gen: Phoenix programs (record &amp; replay activations)
⚫ 9th card gen: Full emulator cards ("battery cards", Dallas 5002FP)
9th card gen: SEASON programs
⚫10th card gen: Phoenix programs, battery cards
11th card gen: Replaced (reason unknown)
⚫12th card gen: (migration to new architecture)

CRYPTOGRAPHY RESEARCH</td></tr></table>

Title: Pay TV

- Key points:
  - Tradition of high hopes then disappointment
    - New products were expected to work, but didn't
    - Each product generation addressed the previous failure, not necessarily logical predictions about future risks
    - Risks hidden until commercial exploits arose
  - Humans instinctively obsess over measures to fix past failures
    - Good vs animal predators
    - Not against agile attackers

- Prominent question (boxed): "Q: If attacks were less visible, would the first card generation have ever been replaced?"

- Metadata / entities:
  - Event: RSACONFERENCE2008 (top-right)
  - Organization/logo: Cryptography Research (bottom-left)
  - Slide number: 17

Title: Detectability & Information asymmetries

- As defenders, we optimize based on what we know
  - Defending is much harder if we don’t know the attack
  - Smart adversaries hide information
    - Unnecessarily visible attacks (e.g., viruses/worms that replicate in the wild) are generally the stupidest
  - Example: information theft for insider trading
    - Detected attacks = stopped and/or prosecuted
    - Strategy: stealth + narrow targeting
      - Ex: anti‑virus/blacklisting software is useless

- Defender uncertainty:
  - "Am I dangerously exposed… or overly paranoid?"

Metadata:
- Event/header: RSACONFERENCE2008
- Organization logo: Cryptography Research
- Slide number: 18

Key information from the image:

**Title:** Revisiting the cycle...

**Entities:**

*   Prey (aka defender)
*   Predator (aka attacker)
*   New defense
*   New exploit

**Cycle Outcomes:**

*   Attacker gains if the response takes longer.
*   Defender loses if there is no effective fix.
*   Defender loses if the attack is catastrophic.
*   Defender loses if no response because the attack is not detected.
*   Defender wins if attacker fails.
*   Defender wins if no attack attempted.

**"Success" is measured:**

*   Defender: Cost of defense vs. reduction in loss.
*   Attacker: Cost/risk of attack vs. benefits.

**Conference:** RSACONFERENCE2008

- Title: "A zero-sum game?"
- Main idea: When attackers are thriving, the burden is felt disproportionately by some targets
  - Attackers pick easiest victims
  - If one target becomes harder to catch, predators switch to easier prey
  - Attackers expect changes and diversify (Pay TV, credit card fraud, bogus checks, drugs, weapons...)
- Consequence #1: Security improvements offer a double reward — eliminate the problem and competitors face extra predation
- Consequence #2: Benefits are local, not systemic — fraud is redistributed; impact on the predator is often small (the delta between the original attack and the next-best alternative)
- Image caption: "Hungry lions stalking zebra and impala in the Okavango Delta"
- Notable entities: Cryptography Research (logo); slide number 20

Key information:

The image suggests that the long-term survival of prey species depends on evolving as predators become more effective. It also includes the text "[We're the prey]". There are images of different animals such as zebras, deer, hippopotamus, elephants.

Text (centered, large): 
- "How can we manage the evolutionary process to reduce long-term risks?"

Layout:
- White horizontal banner across center with the question text.
- Photographic collage background in top and bottom thirds.

Key visual elements (wildlife imagery, approximate identifications):
- Top strip: zebra, rhinoceros, hippopotamus, goat/sheep.
- Bottom collage: elephant, antelope/gazelle, buffalo, deer/antelope, other savanna animals.

<signature> 2006 2007 2008
VULNERABILITIES
PATCHED

Koch

"If the bad guys appreciated how much effort we put into patching, do you think they might stop compromising our system?"

23

<table><tr><th>RSACONFERENCE 2008</th></tr><tr><td>Evolving faster &amp; better...</td></tr><tr><td>Genetic improvements happen gradually
- Less fit organisms don't propagate</td></tr><tr><td>• A few species specialize in a much faster
way to adapt
- Learning</td></tr><tr><td>24
CRYPTOGRAPHY RESEARCH</td></tr></table>

The image shows a slide presentation with the title: "Address information asymmetries that limit evolution." It is from the RSA Conference 2008. The slide number is 25, and it is presented by Cryptography Research.

Title: Attackers hide information to prevent good strategic decisions

- Many examples
  - Britain & US lives sacrificed to keep Germany from knowing the Enigma was broken
- But adversaries often leave hints…
  - Germans knew U‑boat losses were inexplicably high, but had too much faith in the Enigma
  - Is card use at certain merchants linked to subsequent fraud?
  - Is stock trading correlated to pending M&A announcements?
  - Are solicitations from customers being sent to addresses in your mailing list?
  - (Tricky to distinguish clever inferences from stolen info!)
- Visuals / metadata
  - Image: Enigma machine (top-right)
  - Logos: Cryptography Research (bottom-left), partial "RSA" (top-right)
  - Slide number: 26

Title: Example #1: Academy screeners…

- Purpose: Academy members need to see movies to vote.
- Problems:
  - Rampant piracy of screeners.
  - Too expensive & difficult to make uncopyable.
- Solution: Forensic marking
  - Unique identifying marks in each original.
  - Enables tracing copies to the Academy member.
- Outcome: Extra information forced predators into the open
  - Movies still get pirated, but sources are shut down quickly (and prosecuted when appropriate — e.g., Russell Sprague).
  - Result: Piracy from Academy screeners is now largely self-limiting.
- Visual: photo of a DVD screener (top-right).
- Entities: Academy members, forensic marking, Russell Sprague, Cryptography Research (logo).

<table><tr><th>RSACONFERENCE 2008</th></tr><tr><td>Example #2: Honeypots, etc.</td></tr><tr><td>• Problem: How to tell if outside attackers have breached
a network
- Approach: Put a honeypot on the network that will tempt
adversaries who have breached the perimeter &amp; alert you
• If it is raided: proof something is horribly wrong
⚫ Useful datapoint (though not conclusive) if not breached</td></tr><tr><td>Related approaches for other problems, e.g.:
- Tempting URL in comments in sensitive source code
- Traceable addresses in mailing list copies</td></tr><tr><td>28
CRYPTOGRAPHY RESEARCH</td></tr></table>

Key details:

*   "Allocate resources to maximize the ability to evolve - and limit adversaries' ability"
*   RSA Conference 2008.
*   Cryptography Research.
*   Page 29.

How should resources be allocated?

- Option #1: Invest in many incremental responses
  - Each provides some temporary relief… but will never "win"
  - Pros: Disrupts pirate viewers, low-cost, easy to develop
  - Cons: Gets broken quickly; continuous investment required

- Option #2: Invest in a major defensive upgrade
  - The best strategy if the attackers can be driven away to other targets
  - Pros: Potential to fundamentally change the situation
  - Cons: Long lead time, more expensive, requires skilled engineering

- Game theory problem — right answer depends on risk model
  - Non-evolutionary models biased toward incremental approaches
  - Evolution-aware models tend to favor decisive efforts, if available
    - Iterative processes train adversaries + can increase attacker profits (= stronger attacker next time)
    - If attacker dies or specializes in other prey, a broad range of risks decrease (e.g., if attack infrastructure is dismantled, it won't be there to exploit future vulnerabilities)

Slide metadata: RSACONFERENCE2008 (top-right); Cryptography Research logo (bottom-left); slide #30 (bottom-right)

<table><tr><th colspan="3">RSACONFERENCE 2008</th></tr><tr><td colspan="3">Contrasting strategies we've built and deployed</td></tr><tr><td><u>Self-Protecting Digital Content</u></td><td></td><td><u>CryptoFirewall</u></td></tr><tr><td>• Renewable anti-piracy system:
Enable defenses to evolve
- Integrates security software
with content
-Each disc/title carries security
code for its own playback
- Enables new discs to carry
new countermeasures
- Complements (imperfect)
defenses
- Deployed in Blu-ray (BD+)
red
2007

Mac
CRYPTOGRAPHY R</td><td>•</td><td>Tamper-resistant silicon core:
Goal to completely end attacks
- Typically manufactured as part
of a larger ASIC
-Intra-chip security perimeter:
secure even if rest of chip fails
- Far stronger and more cost-
effective than general purpose
chips (e.g., smart cards)
-50M+ pay TV chips deployed</td></tr></table>

*   RSA Conference 2008
*   "Utilize indirect information effectively."
*   Cryptography Research
*   Page 32

**Organizational Perspective:**

*   How well does your organization learn from past failures?
    *   Example: airplane crashes
    *   Good example: FAA
    *   Mediocre: TSA
*   Immediate causes are usually obvious.
    *   A specific vulnerability
    *   Patching the immediate cause wastes a valuable opportunity
*   The proximal and root causes are most important.
    *   Poor communication between engineering groups?
    *   Critical design tasks performed by unassisted novices?
    *   Insufficient security budget?

Cryptography Research logo is visible at the bottom.
Image includes an object that reads "EVAFORTAFUR DE VOL".

<table><tr><th>RSACONFERENCE 2008</th></tr><tr><td>Organizational perspective</td></tr><tr><td>Different organizations have different problems
Smaller organizations
Challenges tend to be lack of infrastructure, resources
Bigger organizations:
⚫ Can develop internal expertise by exposing a few people
to problems across the organization
⚫ ... but tend to overload people with policies &amp; politics
⚫ ... and consequences of failure are larger</td></tr><tr><td>34
CRYPTOGRAPHY RESEARCH</td></tr></table>

RSA Conference 2008 presentation.
Title: Consistency vs. flexibility.
Key points: Policy compliance issues and the balance between security policies and common sense. Mentions ISO 9000, SOX, and HIPAA.
Cryptography Research logo on the bottom left. Slide number 35.

<signature> Krocher

"Look at the bright side. The total network meltdown will free the IT department to focus on our core mission: audit paperwork."

36

*   Text: "Put yourself in the adversary's shoes"
*   RSA Conference 2008
*   Cryptography Research logo
*   Page 37

Key information from the image:

*   Title: Think a few moves ahead.
*   How will the adversary respond?
    *   What will be the new optimal strategy for the adversary?
        *   Will this be better or worse for me than the old attack?
    *   Will the adversary give up? Attack the competition?
*   How will the my organization respond to the updated attack?
    *   Will people be surprised? Upset?
    *   Do we have the next response planned? How long will it take to roll out? What will it cost?

Title: Trying on a black hat

- Internal "black hat" security brainstorming
  - Identify how your team would attack your own systems if they were disgruntled employees, competitors, extortionists, etc…
  - If an attack succeeded, what signs could observe that would suggest a breach?
  - What defensive upgrades could address the risks? If these were deployed, how would adversaries adapt?

- Offer small prizes for the best insights
  - Goal: Encourage team to stop focusing on the why systems are strong, and instead ask how they can be made to fail

Other visible items:
- Header: RSACONFERENCE2008 (top-right)
- Logo: stylized black hat (top-right)
- Logo: Cryptography Research (bottom-left)
- Slide number: 39 (bottom-right)

RSACONFERENCE2008

Closing thoughts

CRYPTOGRAPHY RESEARCH
40

Title: On "Intelligent Design"

Main points:
- Question: Can intelligent people build a complex system and get it right?
  - Answer: Doubtful — examples: Windows, Linux, FreeBSD, etc.
  - Reason: too many interactions; too complex to secure reliably.
- Yet we can build complex systems that can evolve in response to new threats
  - Examples: Windows Update, SPDC
- Conclusion (large text): "Perhaps our best hope is to harness evolutionary processes to create systems that meet our needs…"

Inset box (top-right) text:
- "This textbook contains material on evolution. Evolution is a theory, not a fact, regarding the origin of living things. This material should be approached with an open mind, studied carefully, and critically considered

<table><tr><th>RSACONFERENCE 2008</th></tr><tr><td>A thought experiment on factoring...</td></tr><tr><td>If we want to evolve the ultimate factoring algorithm...</td></tr><tr><td>①Create a random algorithm</td></tr><tr><td>②Create some medium-sized random test integers</td></tr><tr><td>③Test whether if algorithm can factor the test integers
quickly</td></tr><tr><td>If not, randomly modify the algorithm and go to step 2.
→ Stop</td></tr><tr><td>Even a completely dumb process will eventually stumble
upon the optimal factoring algorithm, but smarter
approaches should yield results faster</td></tr><tr><td>42
CRYPTOGRAPHY RESEARC</td></tr></table>

- Type: stylized spiral/galaxy-like diagram with concentric rings and a bright central core.
- Prominent label: "RSA 2008" (white text) with a white arrow pointing to an outer ring (lower-right area).
- Header (outside/above image): "RSACONFERENCE 2008"
- Faint overlaid text (partially obscured): 
  - "the ultimate cryptanalytic m..."
  - "a sim[ulation] that implements basic s[?] t[?]..."
  - "ve complex entities that study the code"
  - "when they find the answer, stop the simulation"

RSA CONFERENCE 2008

[Image shows a line of stick figures walking, with the last figure carrying a laptop]

Kater

For a copy of my slides:

Paul Kocher

paul@cryptography.com

We're hiring... Ask me or visit

CRYPTOGRAPHY RESEARCH

www.cryptography.com/jobs