The Black Liszt

Cybersecurity is Almost Impossible to Achieve -- Here's Why

As with most computer software issues, cybersecurity is badly misunderstood by the vast majority of people, including, sadly but as usual, most computer professionals. The result of this is that the vast majority of people have wrong ideas about the source and methods of security breaches and how they can be prevented. Unfortunately, sometimes these wrong ideas have major consequences.

A Typical Phishing Attack

Phishing is a kind of attack on a user by a bad guy. The bad guy sends the target an email that contains something to tempt the target to click on it. Clicking on the hyperlink is like a fish biting the bait on the hook -- you're caught!

I've been the target of a slew of phishing attacks in the last couple of months. Here is a typical email I've received:

 

What a scary email! It's to me, from my company's email administrator, and I'd better do something about it!

An amazing number of recipients of such an email would have clicked on the red "Resolve Errors Now" box. I wouldn't because:

• I know that my email admin person's domain is not "team-admin.net"
• There are multiple suspicious minor grammatical errors.
• Why would the final line be a copyright?

And many other reasons.

I went to the trouble of digging a bit. I exposed the URL at the hyperlink I was supposed to click and copied it. Here is the place I would have gone had I done what the phisher intended me to do:

Yup, it's a one-time domain set up by the phisher with the information about who I was so that the right next hacking steps could be executed -- that's the string after the question mark. This is not an amateur phisher!

There are more where that came from.

The email above was hardly an isolated example. Just yesterday I received an email from someone I knew at another VC firm, asking me to click to download an important document. Half an hour later, I got a legit email from the firm's admin saying sorry, the sender's account was hacked, please don't click on the email, and if you did, you may want to change all your passwords.

Here is another I recently received, apparently from DHL instead of apparently from my email administrator:

Yes, the place they want you to click is totally bogus -- and bonus points for doing an exceptional job mimicking DHL!

Cybersecurity Experts Know all about Phishing Attacks!

Sure they do. It's on everybody's list, and they all put "solutions" in place. Solutions that don't work.

A colleague of mine has been a top tech executive in major financial institutions. He told me how none of the anti-phishing solutions work because too many valid emails end up in the "spam" folder, and/or too many phishing attacks are passed through as OK. If users know there's a phishing filter in place, they tend to assume that every email in their inbox is OK, and click away, making the problem worse.

The executive tried phishing education for users. He ran several different kinds of education, and sent test phishing emails to people as tests of the education. Net result: no form of education improved the practical willingness/ability of users to notice and avoid clicking on phish attacks. Conclusion: highly paid office workers are too stupid to be educated on this subject.

The Place of Phishing Attacks in Cybersecurity

Regardless of your familiarity with computer security, I suspect you've got the image nearly everyone has about it -- an image that is like a medieval castle with high walls and ponderous, thick gates that are heavily guarded. It's all about those evil bad guys roaming around out there, always probing for ways to get around the gate or over the wall to get inside and wreak havoc.

This is a fun image, and accurately reflects something which is part of the truth. Phishing attacks, along with insiders who have become bad guys, are an important part of the rest of the truth. While there are "solutions" to phishing, they're mostly badly-performing filters that dump loads of emails into a "spam" folder, many of which are perfectly legit. Making you manually go through it anyway. What's the point?

Phishing and bent insiders are the poor step-children of cybersecurity, always acknowledged as being part of the family, but surviving on hand-me-downs and left-overs as best they can. This in spite of the fact that they continue to be the source of the most flagrant "breaches" of security we know about! High-end retail stores and even libraries have had working solutions to this kind of problem in place and working since before computers were invented, but there's something about being a fancy-shmancy computer science cybersecurity expert that prevents such solutions from being considered.  Among other things, check out:

https://www.blackliszt.com/2017/05/computer-security-problems-solutions.html

Conclusion

The image of bad guys cackling in distant, dark rooms lit with screens, as they manage increasingly devious attacks against the walls and defenses of the innocent computer systems of the world continues to cause regulators, cybersecurity experts and the other grandees of computer administration to ignore the real threats -- the ones that work, the ones that actually lead to failures of computer security. It's hard to grasp the full extent of combined stupidity, self-satisfaction and blindness that leads the ongoing non-response to bad actors recruiting insiders to do their work for them.

 

Take-aways from the 2019 Edition of the Money 2020 Conference

The 2019 US edition of Money 20/20 is a wrap. All of us who attended are recovering – and digesting.

Money 20/20 is now an established event – even though the first one was just seven years ago, in 2012! You might think it would be getting stodgy and repetitive by now, with bosses sending their underlings. Not so! Among the over 7,000 people attending were an amazing number of top, big-company executives – along with hundreds of startups, investors, and companies ranging from emerging to established. All the tech firms you’d expect also attended.

So what happened? Anything new? Big themes? Here are a couple:

Entrepreneurs

The startup energy was amazing, partly because there were literally hundreds of startups in attendance, many in little booths, many participating in the events and meetups that were organized for them and the larger groups – investors, partners and buyers – who want to know what’s going on. There’s no way I’m going to pick a couple as examples of the hundreds, but as a test, I’d suggest you come up with a couple ideas you think are novel, walk next year’s show, and see how novel your ideas really are. Unless you’re incredibly better than most, you’ll find a startup with your idea – and if not, maybe it’s your time to start a company!

The Feedzai Financial Crime Summit

We’re glad to be investors in Feedzai, and amazed at the sub-conference they’ve run the last couple of years. It’s too bad Agatha Christie couldn’t attend this year to help solve financial crimes, though the stellar crowd recruited by Feedzai did a fine job of it. The top person from Microsoft described how he spends nearly $1 Billion a year on cyber-security, with competing teams of hackers and defenders, and much else.

With so much of money being electronic and transactions being conducted on phones and computers, the silent, remote hacker is indeed the modern equivalent of Willie Sutton – whose answer to why he robbed banks was simple – because that’s where the money is. Now that the money is in computers and transmitted by electronic networks, that’s where the money is, and there was a great deal to be said about this ongoing battle between good guys and bad guys – and the rapidly escalating arms race that makes the outcome of any one battle so uncertain.

It’s clear that this topic will continue to grow in importance in coming years.

Cryptocurrency and blockchain

There was a whole track devoted to this hot topic, and some time on the big stage. In particular, David Marcus, the leader of Facebook’s Libra cryptocurrency effort, had the center seat of the giant center stage to himself, answering softball questions from a moderator. His smooth explanations acknowledged the widespread attention and questioning the Libra effort has engendered, while giving comforting answers and putting a calm, confident face on the effort.

There was quite a contrast between all the sessions devoted to this subject and what you saw on the show floor, which wasn’t much. Given that Money 20/20 is a show about payments, and given that cryptocurrency is, after all, a kind of currency, it’s natural there should be widespread interest in the topic, fueled by a generous portion of FOMO. There are lots of efforts and noise on the subject, but still not much evidence of real action. Everyone follows and will continue to follow the high-profile Facebook Libra effort with interest.

New Technologies: AI and ML

AI and ML continue to be the buzzwords nearly everyone wants to be associated with, in one way or another. This was particularly remarkable when you walked the show floor, with a high fraction of the booths claiming leadership in these subjects. Given the arcane nature of the underlying technology and the widely diverse technologies that are reasonably described as AI or ML – combined with the fact that most peoples’ eyes quickly glaze over when a nerdish person tries to explain what makes one of the dozens of machine learning algorithms different from another – it’s clear that the marketing person has an impossible task, and most of the show attendees have a challenge figuring out which approach is better than the others.

Nonetheless, this is one of those cases where the hype is clearly justified. For example, Feedzai is catching more of the bad guys than its direct competitors because its technology is just plain better, even though the others arguably also use AI/ML.

Eventually, people will figure out that this has happened before. It’s like decades ago, when a few leading companies claimed to be better than the competition because … they used computers! Yes, those incredibly advanced things that no one really understands. It wasn’t long before everyone first claimed to be using them, and then, eventually, everyone still in business was actually using computers! This year’s Money 20/20 clearly demonstrated that we’re still in the intermediate stage, in which the claims to be using AI/ML are widespread, and the reality is still in catch-up mode. We’ll know we’re really there when it’s just assumed – if you’re still in business, you must be using AI/ML; the only question is, who does it better. We’re getting there!

Lending, payments, banking

The show contained an amazing demonstration of continuing innovation in making it easier for people and businesses to send money, get money and borrow money. The days of checking that you’re properly dressed and groomed for your important meeting with the bank lending officer are long gone. Even the days of filling out forms, not just on paper, but also on the computer. As ever-growing portions of your financial history are stored and available in various online repositories, the job is mostly making sure you really are who you say you are. Once that’s settled, a couple simple actions on your phone are increasingly sufficient to get, send and borrow money, cheaply and quickly.

We saw an array of companies from point products to comprehensive, one-stop services, coming ever-closer to making every aspect of banking as quick and painless as messaging on your phone. The competition is fierce. It’s enough to make you wonder why the big banks survive. But all the big-name players are in the game and were at the show as well, with their own approach to making transactions as easy and efficient as possible for consumers and merchants. While everyone likes convenience, change isn’t particularly convenient; the big institutions have most of the customers and aren’t going to give them up without a fight. So they’re offering their own brands of ease and convenience to their customers. It was all on display at the show, and it’s clear that the war for the customer is far from over.

Regulation

As one of the most regulated industries, payments is doing an amazing job of innovating while avoiding the long arm of the bureaucratic enforcers. This is partly because regulation technology is advancing, as we saw at the show. But it’s got a ways to go. Automating regulation is a bit like teenagers eating vegetables – they respond to parental demands, but it’s not the first choice. As regulators continue to ratchet up the stakes and catch up to modern technologies, this is a field that continues to grow in importance at Money 20/20, both in the speakers and the exhibits.

Money 20/20

Next year will be 2020. Will this show be re-named Money 20/30? Or will moving towards 20/20 vision be the metaphor that justifies sticking with the name? Regardless of the name, the show will go on. It’s the one place you can go and see everyone who is anyone, and everyone who wants to be someone, all in one place in a short period of time. We’re already looking forward to next year.

Facebook’s Libra is not a Cryptocurrency

“Everyone” says that Facebook’s Libra is a cryptocurrency. Long before Libra had been imagined, Bitcoin pioneered and established the brand new world of cryptocurrency. Bitcoin created the category, and has always been its leading exemplar. The white paper by the still-unknown Bitcoin creator and inventor spelled out his design goals and the main aspects of Bitcoin that supported those goals. Once you read and understand what cryptocurrency is, it becomes very clear that, whatever Libra may be, it is NOT a cryptocurrency. To claim that it’s a cryptocurrency is like claiming that a locked desk drawer is a bank vault – yes they both have keys and are supposed to keep things safe, but other than that…

Satoshi, the brilliant creator of Bitcoin, designed a currency that involves cryptography. If you want to be extremely loose, you could say that Libra is the same thing, because it’s also a currency that somehow involves cryptography. But that’s like saying that the thing you use to “buy” properties and hotels in the board game Monopoly is “money.” Try depositing some of it at an ATM and see how far you get.  Let’s explore the basics of what makes a cryptocurrency the way Bitcoin is a cryptocurrency.

First and foremost, there’s the concept that in Bitcoin, no one is in charge. How can you possibly make a computer system that works, does lots of computing, keeping lots of financial transactions and makes sure everyone’s account balance is correct … without anyone being in charge?? These things are hard to do when someone IS in charge! There’s quite a bit involved in making this happen, as I illustrate here, but here are some of the key points:

• Anyone who wants to can sign up to be a “miner,” who are the folks that make Bitcoin work.
• A miner has to put money into buying fast computers, running the mining software, and connecting with all the other miners to share work.
• Miners get new transactions that Bitcoin users want to perform and “make them happen.”
• This means that miners race each other to solve complex problems involving cryptography, the net result of which is a new page (block) of transactions that have been vetted, and “locked” by crypto-key.
• Every piece of work a miner does is paid for by newly-minted Bitcoin – the miners are paid with Bitcoin!
• Miners are highly incented to do the work and do it right, because they want to get lots of Bitcoin, and they want Bitcoin to continue to be viable.
• Miners come and go as they see fit – no one “approves” them, literally no one’s in charge.
• Miners can be anywhere, in any country.

Big corporations and regulators don’t like the unsupervised free-for-all of Bitcoin. They like to control things. And that’s exactly why Bitcoin was invented – to escape the control of a central authority but still have a system that works. It’s a brilliant concept, and Bitcoin’s success shows that it works.

Along comes Facebook and Libra. Facebook is ambitious. They keep trying to invent new things. They mostly fail when they build things themselves, so they buy companies instead. Facebook would LOVE to buy Bitcoin – but it’s not for sale, because no one owns it – darn! They’re forced to try to build it. But being a big corporation, they just can’t stop themselves from building their version of Bitcoin in a style that makes them comfortable – violating every single core principle of Bitcoin – the original cryptocurrency – along the way!

Here’s what Facebook is doing with Libra:

• In Bitcoin, literally no one is in charge. With Libra, Facebook is designing and building it. Facebook is in charge and owns it.
• Facebook has gone to considerable lengths to create the illusion that it’s not in charge with this fake Swiss-based consortium of prestigious companies that supposedly control things. Either way, some combination of big name-brand companies are in charge, which is pretty far from Bitcoin’s really-truly NO ONE is in charge.
• Just like Facebook owns and controls all the computers that run Facebook, Libra will own and control all the computers that run Libra in a private data center. To all the corporate computer types, this is a good thing, but it totally and completely violates a core principle of Bitcoin, leaving it open to the same kind of insider corruption that all such places are rife with. It’s also a silly idea, as explained here. Microsoft and Intel explain the issues here.
• One of the less pleasant side effects of Bitcoin’s miners and what they do with cryptography is the fact that “proof of work” takes time. It’s a cornerstone of getting all these strangers to play nice and do good things, but it takes a number of minutes to complete a transaction. To Facebook, this is unacceptable. So they’ve blithely discarded the key cryptographic cornerstone of Bitcoin, and replaced it with some light-weight encryption, so they can still say they’re a “cryptocurrency,” even though they’re not.

There’s more to be said, but that should be sufficient to make the basic point that Libra is a cryptocurrency the same way my cousin, who is sometimes allowed to sing in bars, is an opera singer. My cousin likes to think she is, and I’m nice to her. But she’s never so much as attended a performance at the Metropolitan Opera in New York, much less appeared on stage in front of an audience. Similarly, Facebook’s Libra likes to think it’s a cryptocurrency even better than the original, Bitcoin, but it swore off the core principles of Bitcoin from the start, and doesn’t deserve to be called by the same terminology.

Note: This was originally posted at Forbes.

Computer Science is Propaganda and Computer Engineering is a Distant Goal

To call what is taught in the “computer science” departments of universities a “science” is a mind-game to get everyone involved to believe that what is taught meets the normal criteria for being a “science.” It doesn’t come close. Well, you might say, some of those departments are more humbly and accurately called “computer engineering.” True. At some point in the distant future, what is taught in computer engineering might rise to the level of what is taught in, say mechanical or electrical engineering. Until that goal is in sight, it would be more accurate to call the classes something like “Fads, fashions and sects in computer software practice.”

Physics, Chemistry and Biology

I hope we can all agree that physics, chemistry and biology are sciences. It wasn’t always that way! They have only gotten to be sciences after long struggles. Physics started emerging about 400 years ago, chemistry a couple hundred years ago, and biology just in the last 150 years or so. In each case, they are studies of reality, with generally accepted statements of how that reality works, as shown by many experiments. In each case, they advance by someone making a hypothesis that can be dis-proven by experiment. If the hypothesis is supported by experiment, more tests are done by many people to refine it, and then it becomes part of the accepted science. Sometimes a new hypothesis contradicts something that’s accepted, but more often refines it – for example, the best way to understand most of Einstein’s work is that it refined Newton’s for special, highly unusual cases. In the vast majority of cases, you can safely use Newton’s laws of motion without being concerned about relativity theory.

How does Computer Science stand up to these paragons of science?

Right away, there's a problem. It's this thing called evidence. You know, like when Newton comes up with his law of gravity, how well does it predict how gravity works? Experiments! Evidence! Same with Einstein's relativity theorem -- no one believed it until crucial experiments proved it. In medicine there are studies that are peer-reviewed and published with results. This is called “evidence-based medicine.” You would think there would be the equivalent in software, wouldn’t you? Check out the link -- doesn't exist.

The problem is deeper than no evidence, which by itself would be enough to prove it's not a science. In physics, you learn the rules of matter, energy and motion. In chemistry, you learn first of all, the periodic table of elements, and then all the molecules into which they assemble themselves and how they interact. In biology, you learn about all the living things, from viruses, through plants and animals. What’s the equivalent in computer science? You can say, “oh, it’s the science of computers;” except that physics, chemistry and biology are things that exist in the world. Humans didn’t create them. Computers are 100% human creations, no less than spoons and baseballs. There is no science of spoons – there is a bit of history and a range of modern methods and styles of making them, just like computers. Until we decide that it’s OK to create an academic deparstment of Tablecloth Science, we should be able to agree that there is no such thing as Computer “Science.”

How did it happen that loads of departments with courses about obviously bogus Computer “Science” come to be?

The innocent explanation is that, in the early days, computers were closely related to math, and were seen basically as giant programmable calculators. In fact, the word “computer” was originally the name of a person, almost always female, who “computed” the answers to math problems. While math isn’t a “science” in the normal sense of the word, it is a kind of pre-existing non-physical reality that, in ways and for reasons that have never been explained, pervades and underlies everything about us and the world we live in. It’s the grounding of all of science. Computers were often studied by the math people in academia, and the precision naturally associated with computers seems to justify the association with science.

But in the end, computers are just fancy machines that people design and build to do stuff. How would you feel about “Refrigerator Science?” Refrigerators are great, and I like what they do. The advances in Refrigerator Science since we used to call them “ice boxes” is amazing. Uhhh, maybe not.

The less innocent explanation is that everyone involved realized that no way is there such a thing as computer science, if we’re at all serious about the term “science.” But there’s no doubt that it makes everyone involved feel better about themselves, so as propaganda, “computer science” gets an A+.

OK, OK, We’ll call it Computer Engineering

Many places do call it Computer Engineering. Is that any better? Think about mechanical engineering, for example. Let’s look at my favorite example of building bridges. I’ve gone into huge detail about the differences between bridge-building in peace and war and how it applies to software.

Let’s step back and compare the normal peace-time bridge engineering project with the normal computer software one. At the outset, they seem pretty similar. They start with requirements, then an overall design, then build, testing and inspection and finally production. In fact, many engineering-type methods are used in software, including project management.

For bridges, it works out pretty well. Bridges get built and work, 24 by 7, year after year, with routine maintenance. There are exceptions, but they're rare. Software? Not so much. Just to hit some highlights, the problems include:

• Bridge-building project management methods are sound and generally produce reasonable results. Software project management methods don’t work
• Bridges are generally built in-place, so installation is an integral part of the build process. Installing standard software is a nightmare
• Once built, bridges work. Software QA is broken
• Bridges just keep working. Software is full of horrible bugs
• No one stealthily sneaks onto bridges and steals the cars that are on it. Software is full of horrible security holes
• Bridge-building is driven by solid, proven engineering practice, backed by scientific principles. Software is driven by fashion instead of sound practice

Given all this, I guess we can still call it Computer Engineering. But to be fair, we should have it on probation, and call it “Computer Sadly-Deficient Engineering” until it rises to the level of mediocrity -- which it may, with some luck, someday achieve.

Is there any value in Computer Science?

Yes, there is value in Computer Science. Some of the value is real. For example, I greatly respect Donald Knuth and the study of algorithms, for example. The trouble is, this kind of thing is a tiny part of what software developers do when building code. There is also some value in learning the basics of how to write code, and a degree in CS continues to be a help in getting a job -- even though it shouldn't be.

Computer Scientists have sometimes acknowledged there are serious problems. For example, there was a big conference to address the “crisis in software” … in 1968! What did they do? They promoted “structured programming” and decided that the essential “go to” statement was evil.

In the end, the value of much of Computer Science, apart from things like studying algorithms, should be forming the basis of producing good software that works. Here is how that's working out.

Conclusion

Computer Science is not a "science." Not close. To call it science is propaganda, fraud, ignorance, whatever. Computer Engineering is another matter. Computer Engineering, both as taught and as practiced, is horrible. The methods, largely lifted from other disciplines, just don't produce good results most of the time. There isn't even a movement that recognizes this and agitates to fix it!

Happily, the solutions -- good computer engineering practices -- exist and have been proven in practice, many times over by different groups in different times and places. I have discussed what I know of these methods extensively in this blog and in books. Top programmers discover large parts of them on their own, and use them to achieve stellar results -- outside the purview of corporate types, regulators and bureaucrats. For entrepreneurs versed in these methods, it's a serious competitive advantage, while the crippled, lumbering giants of software shuffle along.

Microsoft And Intel Detail The Deep-Seated Problems With Blockchain

Both Microsoft and Intel are big supporters of blockchain. They think it's going to be "bigger than the internet," contributing trillions of dollars to the economy before long. At the same time, they spell out the overwhelming obstacles blockchain must overcome to reach this pinnacle of achievement. Guess what, surprise surprise, the special version of blockchain created by Intel and Microsoft is indispensable to solving the problems and achieving success!

You can see their deep thinking here and here. Before diving in, I'd like to point out that the custom, private blockchain they advocate is a contradiction in terms, as I illustrate here -- even if they implement what they claim perfectly, it will still be a joke.

Here are a few of the little obstacles that blockchain has to overcome before becoming acceptable for enterprise use, according to Microsoft and/or Intel:

• Performance: Normal blockchain performance is a few transactions per second. "Reed said the trusted execution environment of Intel SGX enables Coco to deliver a novel consensus mechanism that can deliver up to 1600 transactions per second..."
• Confidentiality:Normally, everything on a blockchain is public information.  "Microsoft uses Intel Software Guard Extensions (Intel SGX) to protect the Coco Framework. Reed said the trusted execution environment of Intel SGX ...  helps Coco transactions remain confidential among blockchain participants."
• Governance: With a normal public blockchain, no one is in charge. This doesn't come close to meeting enterprise requirements. Microsoft's private blockchain enables classic management, access controls and all the rest.
• Processing power:Intel says "Public cryptocurrency blockchains require huge amounts of energy to verify transactions through node consensus. Analysts have estimated a single bitcoin transaction can require as much energy as the average American home uses in a week."

The other big vendors, like IBM with its team of 1,500 people working on its Blockchain effort, have similar stories about what's wrong with Blockchain and why you should use theirs. When you add it all up, it does make you wonder about this revolutionary new technology, and exactly why important new initiatives should depend on this brand-new, largely untested code that obviously was not built with practical, enterprise use in mind.

This was originally posted at Forbes.