Sniffing out the cyber Hannibals
Cyber profiler Max Kilger.
"Hannibal Lecter would make a great colleague if he didn't have that nasty habit of eating people," says Max Kilger, social psychologist for the Honeynet Project.
Kilger is expounding his particular passion: criminal profiling. Not the traditional sleuthing employed in The Silence of the Lambs, but the cyber kind.
"It's Clarice Starling meets the Matrix," he says.
Kilger is a member of the Honeynet Project, a non-profit research body of US security professionals determined to find out as much as they can about the so-called Black Hat community and how it works.
The members of Honeynet are volunteers and have been at the job since late 1999. All their research is open-source and shared with the security community.
Honeypots act like bait or decoys, helping network administrators detect anyone "sniffing" their network.
Organisations spend enormous amounts of time trying to secure their systems and log suspicious activities, but they admit they are fighting a losing battle. Few have adequate resources to trawl though the gigabytes of data they get, and staff are constantly trying to keep security patches up to date and firewalls strong. Honeypots can provide them with a very different kind of weapon.
"There's been an incredible technical investment in cybercrime, but how much is asking who are the bad guys, what are they after?" Kilger says.
He believes that by maintaining enforcement and other legal types of pressure on the Black Hat community, it makes it harder for them to organise, co-ordinate activities and form alliances. But to do this you need to understand what motivates them. And once you've worked this out, you have a better chance of identifying them.
Kilger is co-author of a book titled Know Your Enemy.
He says motivation is one of the key elements in gaining an understanding of why individuals and organisations are turning to computer crime.
He identifies six basic motivations, drawing on an original FBI acronym related to espionage - MICE - money, ideology, compromise and ego.
Kilger's cyber version is MEECES: money, entertainment, ego, cause, entry to social group and status.
Security professionals can use the motivations as a guide to the potential behaviour of network invaders and can help policy makers in deciding how best to protect the nation's most vital systems.
Historically, intelligence about attackers has been limited to the tools they use. Now the members of the Honeynet Project are intent on providing greater insights into their motives; how they communicate; when they attack systems; and their actions after compromising a system.
Cyber profiling isn't easy. Kilger describes the non-virtual world as full bandwidth, allowing for complex and rich communications, whereas the digital world is a much smaller bandwidth environment that yields fewer clues.
"Criminal activity is much harder to detect in this context. The only witnesses are machines," Kilger says.
"The good news is that humans are still in the loop of computer crime. They are out there writing malware and creating viruses."
And, he notes, the Black Hatters are tremendously social, providing profilers with some useful paths for investigation.
"They form social groups in which status is involved and personal characteristics often persist," Kilger says. "Their weakness is in their myth of invulnerability."
Kilger draws parallels between this new area of profiling and what most of us who watch and read crime thrillers know as traditional profiling. But while Kilger finds plenty of useful areas of comparison, he also finds that some of the techniques and assumptions of the science of profiling have changed in its transition to the digital world.
For its part, the Honeynet team is making use of real systems that have been compromised in the wild by the Black Hats.
Honeypots are essentially emulators, tricking the sniffer into discovering, for example, a fake FTP server and in the process divulging the authentication credentials used and even which accounts have been compromised.
Because it's a virtual FTP server, there's no operating system and no way that an attacker could use the honeypot to take over the network.
Kirby Kuehl, an information security engineer with Cisco Systems and member of the Honeynet Group, is interested in what happens within companies.
He says organisations typically focus on external threats, ignoring the powerful advantage of insiders and former insiders in the cyber crime stakes who can leverage their existing credentials and knowledge of systems with devastating results.
"They know the location of valuable resources such as financial data and employee records and can be aware of company security weaknesses and defences," he says.
Their motives can simply be financial gain but, in the case of a disgruntled employee, is more likely to be sabotage.
Kuehl warns that there are legal implications in tackling such assaults.
"Care must be taken in handling forensic data - best consult the legal department before running an insider honeypot," he says.