Translator: Daniel Balton Reviewer: omar idmassaoud
Almost all of large companies
and the majority of small businesses
are now offering web services to their consumers.
So doing these interactions,
we are sharing a lot of data about ourselves.
Oftentimes it's quite sensitive data.
So the question arises:
how well are these companies actually safeguarding our information?
So in this talk, I want to discuss some insights
of a project I've been jointly working on with doctoral candidat,e Mingyi Zhao,
on sharing some insights about this particular question.
At the same time, I'm also trying to assess a potentially powerful pathway
to improve that insecurity.
But first the bad news:
RAND researcher, Sasha Romanosky, has recently published an overview
about publicly disclosed information security breaches.
And what he found was that over the last 10 years,
there has been a steady increase of these breaches,
which can only partially be explained
by newly emerging transparency enhancing laws.
Moreover, what we also observe
is that this likely under-appreciates the true scale of the problem,
because still many breaches are not disclosed,
and many breaches are just not detected at all.
To illustrate this, let me cite the figure
that was recently used by Satya Nadella,
the new CEO of Microsoft, who said that it takes businesses
on average 230 days to detect a security breach.
But still this does not include the kind of breaches
that you don't know about at all.
So the scale at which your data is stolen,
at which our data is stolen, is staggering.
Just during this talk, which will last about 10 minutes,
50,000 consumer records will be stolen and transferred
to cybercriminal marketplaces.
Why is computer security so hard or why is it so fragile?
There are large numbers of reasons of which I can only cite a few.
The first one is, well, we are actually one of the reasons.
We are demanding ever more complex,
ever more interactive services
but it is just very hard
to develop programs with tens of millions of lines of code
without any kind of security problems attached to them.
At the same time, we also have from an organization perspective,
to be extremely vigilant and defend ourselves at many fronts.
On the other hand, attackers can pick and choose;
they can cherry pick where to attack, when to attack, and they do so.
Let me illustrate this problem of this well motivated,
well capable attacker by using a quote from Rob Joyce,
the Chief of Tailored Access Operations from the NSA.
Recently he gave a presentation and he said,
"The mindset is clearly articulated in this way.
We are going to be persistent;
we are going to keep coming and coming and coming."
So there are a lot of different technical problems
that we have to address, but in addition, there are also incentive problems.
So cyber-security is very costly,
investing in protection is very costly.
At the same time, it's very hard for all of us
to assess whether a company has actually done so.
So after a breach takes place
you can ask yourself the question, right,
"Has the company actually followed
all the widely accepted security standards?
Or have they been very inadequately prepared?"
This problem is likely, for all of us , completely indistinguishable.
So what we need, given just this sub-selection of reasons,
is really a multifaceted approach to address security.
And one thing that I want to focus on
is a potentially powerful role of external security researchers
which are trying to collaborate these companies.
These so-called "white hat researchers"
are independently researching the websites of major businesses,
and also smaller businesses trying to find vulnerabilities
and if they're found, submitting them to the organizations
in anticipation that they are addressed and fixed.
And if this process repeats over and over again,
then we are hoping that at the end of the day,
actually the security of this particular entity will be improving.
What we are specifically doing
is to look at two bounty marketplaces of web discovery platforms
that are located in different places of the earth.
One is HackerOne which is US-based;
it follows a particular pattern in the sense
that organizations approach HackerOne
to build a better discovery program for them.
On the other hand we have Wooyun,
where any hacker can submit any kind of vulnerability
about any of organization in the world.
The program or participation model of Wooyun is much broader in this sense.
So, given these two datasets of these matching markets
where organizations and white hats are meeting,
we are then trying to understand
what kind of impact these white hat researchers
have on the security of organizations.
We are also trying to understand
whether they actually make life harder
for the black hat researchers that you're trying to preempt.
On the other hand there's also the question
what we can get out of it as consumers.
So on a very high level we can already observe
that these are very active platforms.
There are thousands of white hats
contributing tens of thousands of vulnerabilities.
We see some differences with respect to the scope
of how many organizations are affected which can be explained
by these participation rules that I previously explained.
What is common about both platforms
is that white hats are contributing a large amount
of really high value findings; severe vulnerabilities
that are likely preempting major security breaches down the road.
So what I want to do in the following
is to delve a little bit deeper into the data
to give you some additional insights about how these marketplaces actually work.
So one high level insight is that on HackerOne,
a large amount of bounties are actually paid
to these white hat researchers,
and if you actually crunch the data very carefully,
then you can see that an increase of $100
in the expected rewards indeed do have a positive contribution
in the sense that three more vulnerabilities will have
on average found for this particular program.
So that's good.
At the same time, we also see on HackerOne,
and mostly on Wooyun, a lot of programs that do not pay bounties at all.
And we still see there that white hat researchers
do a lot of work and submitting a large number of different vulnerabilities.
So money matters, but equally, there are a lot of reasons
that motivate white hat hackers to do the job.
Another issue that we find interesting
is to explore the different behavioral patterns
of these white hat researchers and what we see here
is that on the one hand we have white hats
that focus very closely on one organization, and in that sense,
very closely complement the security teams of this particular company.
On the other hand, we have those who are more focused on specific vulnerabilities
but cover a vital reach of different organizations, which is also important
because we often do not have these communication channels
between the companies to exchange information.
Another issue is:
should we focus mostly, actually, on the most prolific kind of researchers?
Or, does it also matter that we have a large amount
of researchers that are in this kind of long tail of the productivity curve,
and maybe just submitting two, three, or four vulnerabilities over multiple years?
And what we found here is actually, yes,
it matters quite a lot because this long tail
actually covers also a much larger reach of different organizations.
For example, less popular websites.
At the same time, they uphold the same kind of standards
when it comes to the quality of the submissions.
We have an equal percentage of these high severity publications
that are coming from those individuals.
A more contentious topic in this white hat community,
or on the community of these platforms is the matter of rediscovery.
So on HackerOne over 22% of the submitted reports
are actually duplicates of previously submitted reports.
And to some degree, of course, this raises a question
of how inefficient, actually, these marketplaces then are.
Let me illustrate that with an example from Facebook.
Last year, Facebook released a new Web Messenger app
that actually included an implementation mistake
with respect to a particular security feature.
And within minutes of releasing this particular application,
15 different white hats
had already submitted a vulnerability report about it.
So rediscovery can be happening very quickly
and it can be a very powerful mean.
The thing that we want to focus on is to use this kind of data
to better understand also what the likelihood is
that we rediscover a breach or that we rediscover a vulnerability
that is already known by black hats,
and potentially already actively exploited, right?
For this kind of purpose, this data can be very valuable.
Finally, the question arises:
what kind of impact do actually this vulnerability discoverers have,
on the security of the website?
And what we see here is on HackerOne, for the majority of programs,
we see a declining trend in terms of the vulnerabilities found
for each organization.
On the other hand, on Wooyun, we see an increase in trends.
So what does it mean?
Given these different participation patterns,
our explanation is that indeed
the organizations are better prepared on HackerOne.
After all, they asked for the involvement of the white hat researchers.
So likely, there's better integration between the teams
that internally are responsible for security
and the external white hat researchers.
On the other hand, on Wooyun we see the opposite.
We see that there are a lot of companies
are coerced to participate through the submissions of white hat researchers,
but they are not prepared, and likely also don't have similarly high standards
when it comes to the internal security teams.
What is the take-away from that?
This background of platforms are relatively novel,
but given the data, we can already make a fairly positive assessment;
in the sense of how powerful they are,
in terms of harnessing the community of external security researchers
and making valuable contributions.
But it's also important that we encourage businesses
to actually actively collaborate with them so that they are the best.
Otherwise lots of submissions would fall flat.
At the same time, it is necessary
to then also preempt the activities of black hats.
What we are also doing is to work on making the information
that we are collecting presentable and informative
for you, as consumers, so that down the road
we can actually make better choices
and this is, after all, very important.
Thank you very much.
(Applause)