STE WILLIAMS

Google has discovered unauthorized digital certificates being used for several Google domains.

According to a blog on the Google website, the certificates were issued by an intermediate certificate authority (CA) linking back to ANSSI, a French certificate authority.

“Intermediate CA certificates carry the full authority of the CA, so anyone who has one can use it to create a certificate for any website they wish to impersonate,” the blog states.

Google immediately updated Chrome’s certificate revocation metadata to block the intermediate CA, and then alerted ANSSI and other browser vendors.

“ANSSI has found that the intermediate CA certificate was used in a commercial device, on a private network, to inspect encrypted traffic with the knowledge of the users on that network,” the blog states. “This was a violation of their procedures and they have asked for the certificate in question to be revoked by browsers.”

Google said the incident “represents a serious breach,” and the search engine company is still considering what other actions may need to be taken.

Have a comment on this story? Please click “Add a Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/end-user/google-reports-unauthorized-digital-cert/240164601

Email delivery: Hate phishing emails? You’ll love DMARC

A Chinese hacking group managed to penetrate the networks of five European Union member states in advance of last year’s G20 Summit in a likely bid to lift data on the Syrian crisis, according to FireEye.

The security firm told Reuters it monitored the classic targeted attack campaign for around a week in late August 2012, ahead of a summit dominated by the escalating civil war in Syria.

During that time spear phishing emails with malicious file attachments with titles such as “US_military_options_in_Syria” successfully breached the systems of five unnamed foreign ministries, it said.

Unfortunately the hackers jumped to another CC server shortly before the September summit, losing their tail, but FireEye said it believed they were just about to begin exfiltrating data.

The group, nicknamed “Ke3chang”, has apparently been around for several years although this represents its official public outing. It’s suspected it may have previously targeted the G20 Finance Ministers meeting in Paris in 2011.

FireEye researcher Nart Villeneuve told the newswire that pretty compelling evidence links the group to China, including the language used on the CC server and the type of machines the group employs to test its malware.

However, as always, there are no hard links back to the Chinese government, which maintains it is a victim and not a perpetrator of cyber crime – even post-Mandiant’s APT1 revelations.

What the US, and the info-security community, really needs is a whistleblower behind the Great Firewall to even things up a bit. ®

Quick guide to disaster recovery in the cloud

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/12/10/china_hacking_g20_syria_ke3chang/

Email delivery: Hate phishing emails? You’ll love DMARC

Cybercrooks have created an improved version of the Dexter point-of-sale malware that’s being blamed for slurping the credit and debit card details of holiday shoppers.

A new version of Dexter, first discovered by security researchers Seculert about a year ago, has been planted on 31 infected point-of-sale terminals, located in restaurants and famous shops in various major cities of the US, according to infosec start-up IntelCrawler.

The criminals behind the attack are using StarDust, a modified version of the earlier Dexter malware that takes features from other malware strains including BlackPOS and VSkimmer. StarDust (aka Dexter v.2) has been offered for sale on underground hacking forums since August. The new variant is capable of extracting credit card data from the RAM of compromised devices or by key-logging, as well as by capturing and exfiltrating internal network traffic, according to IntelCrawler. Data is sent via FTP to hosts based in Russia.

“Approximately 20,000 credit cards may have been compromised via this Stardust variation and evidence has been sent to the card associations to determine the points of compromise”, said Dan Clements, president of IntelCrawler.

The problem is far from confined to the US. Security researchers at Arbor Networks have been independently documenting the same threat. They note some infections in the US but a much greater number in the world’s eastern hemispheres, as explained in a map and blog post here.

Point-of-sale malware is not unprecedented. One previous well known case involved the infection of 150 terminals at Subway sandwich shops. What sets the latest version of Dexter apart is its in-depth “knowledge” of the workings of PoS applications such as Clearview PoS.

It’s unclear how the Dexter malware gets itself onto infected systems. Curt Wilson, a senior research analyst with Arbor Networks, does however have a few theories about how the Windows-based malware is spreading.

“The exact method of compromise is not currently known, however PoS systems suffer from the same security challenges that any other Windows-based deployment does,”Wilson writes. “Network and host-based vulnerabilities (such as default or weak credentials accessible over Remote Desktop and open wireless networks that include a PoS machine), misuse, social engineering and physical access are likely candidates for infection.”

”Additionally, potential brittleness and obvious criticality of PoS systems may be a factor in the reportedly slow patch deployment process on PoS machines, which increases risk,” he added. ®

Quick guide to disaster recovery in the cloud

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/12/10/dexter_pos_malware/

Email delivery: Hate phishing emails? You’ll love DMARC

In yet another washup from the Snowden revelations, the developers of FreeBSD have decided to take several steps backwards in their crypto work, to stop using hardware random number generators (RNGs).

The two hardware RNGs singled out by the FreeBSD developers in this post are Intel’s RDRAND (in Ivy Bridge processors), and VIA’s Padlock.

The decision was made at the FreeBSD Developer Summit, held in Malta in September, but the decision to pull the hardware RNGs didn’t attract any attention at the time.

“For [FreeBSD] 10, we are going to backtrack and remove RDRAND and Padlock backends and feed them into Yarrow instead of delivering their output directly to /dev/random. It will still be possible to access hardware random number generators, that is, RDRAND, Padlock etc., directly by inline assembly or by using OpenSSL from userland, if required, but we cannot trust them any more”, the post states.

One solution on offer from Polish developer Pawel Jakub Dawidek, the post states, is to use the time it takes to attach devices at boot time, and feed these numbers into /dev/random: “it turns out that one can get about 4 good bits of entropy from each device”.

Among the many things Edward Snowden’s documents have suggested is that the NIST’s crypto standardisation efforts were nobbled by the NSA. This confirmed long-standing knowledge that the Dual Elliptic Curve Deterministic Random Bit Generator is weak, leading to RSA abandoning it in September.

Not everybody believes that RDRAND falls into the same category. Linus Torvalds, for example, dismissed concerns about the instruction, telling the author of an online petition to yank the command from Linux “we actually know what we’re doing. You don’t”.

In that debate, Torvalds pointed out that RDRAND isn’t the only source of entropy for values streamed into /dev/random in a Linux implementation.

Last year, this paper was published by Cryptography assessing Intel’s approach, and giving it a pass mark. The Register has approached Intel for comment. ®®

Quick guide to disaster recovery in the cloud

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/12/09/freebsd_abandoning_hardware_randomness/

Email delivery: Hate phishing emails? You’ll love DMARC

Users of the CyanogenMod alternative Android firmware gained additional security on Monday, thanks to the integration of Open WhisperSystems’ TextSecure protocol.

Founded by security researchers Moxie Marlinspike and Stuart Anderson, Open WhisperSystems develops security software that can encrypt voice-over-IP (VoIP) telephone calls and SMS/MMS messages.

Android device owners can install the company’s TextSecure SMS security software by downloading it from the Google Play store. But the company announced on Monday that the CyanogenMod project is also shipping the technology baked into its firmwares by default, beginning with current nightly builds of version 10.2.

With TextSecure as part of the default CyanogenMod SMS software, users can choose any SMS app they want and enjoy secure messaging to other TextSecure-enabled devices automatically, whether they are running the software on Android or iOS.

“If an outgoing SMS message is addressed to another CyanogenMod or TextSecure user, it will be transparently encrypted and sent over the data channel as a push message to the receiving device,” Marlinspike explained in a blog post. “That device will then decrypt the message and deliver it to the system as a normal incoming SMS.”

In the event that the device does not support TextSecure, on the other hand, the messaging layer will fall back to an ordinary, unencrypted SMS channel.

The in-firmware version of the tech supports all of the features of the standalone TextSecure app, including its key exchange protocol and support for multiple cryptographic algorithms.

According to the CyanogenMod team, the code is being integrated with the version 10.2 nightly builds as a trial balloon, but if all goes well, it will be baked into all future builds of CyanogenMod 11, as well.

Marlinspike praised the firmware team’s willingness to include the technology on Monday, saying that doing so took “a substantial commitment of time and resources.”

“Their genuine resolve to protect their users from large-scale dragnet surveillance is truly remarkable in a world where most companies are instead angling to collect as much information about their users as possible,” Marlinspike wrote.

Versions of the CyanogenMod firmware with TextSecure built in are available for a variety of devices via the project’s download site. ®

Quick guide to disaster recovery in the cloud

Article source: http://go.theregister.com/feed/www.theregister.co.uk/2013/12/10/cyanogenmod_to_integrate_textsecure/

A zero-day vulnerability remains private and unknown to the affected software vendor and its users for an average of 151 days.

And on any given day, knowledge of some 85 zero-day flaws are available from boutique exploit providers, according to new analysis of the growing market for these vulnerabilities. Boutique firms, which sell their vulnerability finds to companies and governments, are able to offer more than 100 exploits a year, according to Stefan Frei, research director at NSS Labs, who has written a new report on just how pervasive and available these “known unknown” zero-day flaws actually are.

And these estimates, according to Frei, are on the low-end of the actual numbers. The operations of cyber criminals and nation-state’s zero-day activities are not fully known. “This is really a minimum estimate,” says Frei, who conducted his analysis using publicly available information.

“Using data from known exploit programs or boutique vendors like VUPEN and putting them all together and connecting the dots — it’s astonishing what you get,” he says.

Take the NSA’s 2013 budget of $25 million for the purchase of exploits, Frei says. Given that the market price for an exploit ranges from $40,000 to $250,000, this could result in 86- to 541 additional “unknown known” bugs per day floating around, according to his calculations.

The price for a particularly valuable zero-day bug in some cases is even higher: “Some are $500,000 or even $1 million,” Frei says.

A wave of vendors, the most conspicuous being Microsoft, have launched bug bounty programs over the past year or so to attempt to encourage responsible disclosure by researchers and to try to compete with the black market underground for bugs. But with legal zero-day vulnerability providers such as VUPEN Security, also in the mix, bug bounty programs still face stiff competition.

“They cannot compete,” Frei says.

[Microsoft and Facebook co-sponsor community bug bounty program that pays researchers for flaws found in popular open-source software and in Internet protocols. See New Bucks For Bugs Program Focuses On Open-Source Software, Internet Infrastructure.]

Frei crunched the numbers from two major commercial vulnerability purchase programs at iDefense and TippingPoint’s Zero Day Initiative from when they were launched in 2002 and 2005, respectively, through September of this year. The two programs in all purchased nearly 2,400 bugs, Frei found, and the timeframe between purchase and disclosure of the flaws was 133 for iDefense and 174 for ZDI.

And drilling down for the years 2010, 2011, and 2012, he found the two companies had published some 1,026 vulnerabilities. “On any given day during those three years, the VCP and ZDI programs possessed 58 unpublished vulnerabilities” affecting Microsoft, Apple, Oracle, or Adobe, the report says.

Boutique vulnerability providers such as VUPEN Security and ReVuln, NetraGard, Endgame Systems, and Exodus Intelligence, sell subscriptions that include 25 zero-day flaws per year for $2.5 million. Frei says such pricing has cracked the monopoly of nation-states as the main customers of these bugs.

Nation-states are still major buyers, however. “They [the boutique vendors] saw a drop in purchases on the government side” during the U.S. government sequester, he says. But that just means “they sell to the others die more,” he says.

Jarno Limnell, director of cyber security for McAfee’s Stonesoft, says the report is a grim reminder that there are plenty of unknown threats circulating below the surface. “That’s very scary,” he says of the findings. “We also have to keep in mind that a lot of issues are happening in the Internet that we are not even aware of.”

The problem then is that some organizations just focus on what is known. “You need to understand the importance of these unknown [threats] and increase resilience for these kinds of threats,” Limnell says.

Frei’s full report is available here (PDF) for download.

Have a comment on this story? Please click “Add Your Comment” below. If you’d like to contact Dark Reading’s editors directly, send us a message.

Article source: http://www.darkreading.com/vulnerability/hacking-the-zero-day-vulnerability-marke/240164591

Early on in NSA-gate, Microsoft was looking at a laundry list of headlines concerning its collusion with US intelligence operations.

One example is the headline of The Guardian’s public-relations-cringe-worthy coverage: “Microsoft handed the NSA access to encrypted messages” with the bulleted subheads below:

• Secret files show scale of Silicon Valley co-operation on Prism
• Outlook.com encryption unlocked even before official launch
• Skype worked to enable Prism collection of video calls
• Company says it is legally compelled to comply

So last Wednesday, Microsoft pledged to encrypt just about everything, enhance code transparency, and bolster legal protection for customers’ data.

Brad Smith, Microsoft General Counsel Executive Vice President, Legal Corporate Affairs, wrote in the posting that government snooping potentially now constitutes an “advanced persistent threat”, on par with sophisticated malware and cyber attacks.

He said that Microsoft is “especially alarmed” at the notion that governments are trying to get around online security:

Like many others, we are especially alarmed by recent allegations in the press of a broader and concerted effort by some governments to circumvent online security measures – and in our view, legal processes and protections – in order to surreptitiously collect private customer data. In particular, recent press stories have reported allegations of governmental interception and collection – without search warrants or legal subpoenas – of customer data as it travels between customers and servers or between company data centers in our industry.

If true, these efforts threaten to seriously undermine confidence in the security and privacy of online communications. Indeed, government snooping potentially now constitutes an “advanced persistent threat,” alongside sophisticated malware and cyber attacks.

In light of the allegations, Microsoft announced that it’s decided to push three things: expanding encryption across its services, reinforcing legal protection for customers’ data, and enhancing software code transparency so customers can rest easy in the knowledge that their products do not contain back doors.

On the encryption front, it plans to strengthen lockdown of customer data across its networks and services, including Outlook.com, Office 365, SkyDrive and Windows Azure.

Specifically, it said:

• Content moving between customers and Microsoft will be encrypted by default.
• All of the company’s “key” platform, productivity and communications services will encrypt customer content as it moves between its data centers.
• Microsoft will use what it calls “best-in-class” industry cryptography to protect these channels, including Perfect Forward Secrecy (which Google has been using with Gmail and Google Docs since 2011; Twitter’s been using it since November), and 2048-bit key lengths.
• All of this will be in place by the end of 2014, and Microsoft says much of it is effective already. To wit: “Office 365 and Outlook.com customer content is already encrypted when traveling between customers and Microsoft, and most Office 365 workloads as well as Windows Azure storage are now encrypted in transit between our data centers.”
• Microsoft will also encrypt customer content that it stores. In some cases, such as third-party services developed to run on Windows Azure, the choice will be left up to developers, but Microsoft will offer the tools to allow them to get it done.
• The company says it’s also working with other companies across the industry to ensure that data traveling between services – from one email provider to another, for instance – is protected.

As pointed out by Electronic Frontier Foundation’s Kurt Opsahl, the absence of Skype from Microsoft’s list of encryption promises is a notable omission.

An excerpt from an email he sent to TechCrunch:

I agree that Skype’s absence here is extremely interesting and concerning. … Microsoft, as the owner of Skype, has totally failed to be transparent about this and it’s not surprising that users and security experts come to believe that it has something to hide.

A Microsoft spokesperson told TechCrunch that Skype isn’t excluded, per se; it just wasn’t mentioned because Microsoft didn’t feel the need to mention all products.

As The Center for Democracy and Technology’s Joe Hall explained to TechCrunch’s Gregory Ferenstein, real transparency from Microsoft means nothing less than independent review from people with recognised security chops who’ve vetted Skype’s cryptographic methods and implementation:

I think Microsoft must be very transparent to make encryption in Skype meaningful. … That means detailing the way Skype works technically, and demonstrating that independent review from folks respected by the security community have examined Skype’s cryptographic methods and implementation and said good things about it. Hopefully then anointing it as robustly ‘end-to-end.’ (Meaning only the parties at the ends of the conversation have access to the communication).

Ferenstein asked Microsoft about this type of independent review, but the spokesperson declined to address the issue.

As it now stands, Silent Circle offers encrypted voice, in addition to video, text and file transfer.

But at a starting price of $9.95/month, it can’t compete with Microsoft’s free Skype service, unless you put a price on the assurances of privacy you get from encrypted end-to-end calling.

As far as Microsoft’s pledge to get transparent with its code, the Free Software Foundation (FSF), for one, questioned the logic of trusting the Very Not Free Software maker.

From a statement made by FSF executive director John Sullivan following Microsoft’s announcement:

Microsoft has made renewed security promises before. In the end, these promises are meaningless. Proprietary software like Windows is fundamentally insecure not because of Microsoft’s privacy policies but because its code is hidden from the very users whose interests it is supposed to secure. A lock on your own house to which you do not have the master key is not a security system, it is a jail.

If the NSA revelations have taught us anything, it is that journalists, governments, schools, advocacy organizations, companies, and individuals, must be using operating systems whose code can be reviewed and modified without Microsoft or any other third party’s blessing. When we don’t have that, back doors and privacy violations are inevitable.

These are just some of the voices questioning Microsoft’s recent anti-NSA stance.

Microsoft’s announcement on Wednesday is, of course, public relations gold, surely meant to put a bandage on the company’s NSA-headline-savaged hide.

But the move to encryption and openness still sounds like it’s also a rational reaction to public outrage.

Maybe the public should keep up the outrage.

Maybe if enough people scream about the government’s trampling on the privacy of innocent people, more companies will embrace customer data privacy and defend it as fiercely as if corporate lives depended on it.

Follow @LisaVaas

Follow @NakedSecurity

Microsoft logo courtesy of IVY PHOTOS / Shutterstock.com

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/qMez8B-5Pjk/

Without going into detail, US President Barack Obama has said that he’ll propose “some self-restraint” to the National Security Agency (NSA) in order to rein in rampant snooping.

In an interview with Chris Matthews recorded for MSNBC’s “Hardball” on Thursday, Obama defended the intelligence agency, saying that it’s keeping its nose clean at home, at least:

The NSA actually does a very good job about not engaging in domestic surveillance, not reading people’s emails, not listening to the contents of their phone calls. Outside of our borders, the NSA’s more aggressive. It’s not constrained by laws.

The president pointed to an outside panel that he set up to look into how the government was collecting surveillance data in the big-data era.

In the fall, he said that the Feds were undergoing a complete review of how US intelligence operates outside of the country.

The findings are due to Obama by 15 December.

But he’s already set to rein in the NSA, he says (if self-restraint can actually be considered a curb of powers, that is):

I’ll be proposing some self-restraint on the NSA and to initiate some reforms to give people more confidence. … [given that US persons] rightly are sensitive to needs to preserve their privacy and to maintain internet freedom, and so am I.

The Hardball interview came on the heels of last Wednesday’s revelations that the NSA is tracking hundreds of millions of mobile phone locations worldwide, feeding a massive database full of people’s location and relationship data at the rate of nearly 5 billion records every day.

During the interview, Obama asserted that “we do have people who are trying to hurt us,” but added that with oversight from Congress and from the Foreign Intelligence Surveillance Court (FISC), which oversees requests for data from intelligence agencies, security needs can be balanced with privacy rights.

Many now view that balance as completely askew. Is there any self-restraint the president can propose to the NSA that will redress it? Any limits or increased oversight?

Kevin Bankston, policy director of the New America Foundation’s Open Technology Institute as well as a privacy and digital-rights lawyer and advocate, thinks not.

As he told US News, there’s little short of an end to the NSA’s bulk data collection that could fix this mess:

Rather than allowing the NSA to engage in mass surveillance to collect everyone’s data and then decide who to target, the president should ensure that the NSA engages only in targeted surveillance; that is, first, deciding who to target and then collecting only their data.

True leadership in this moment would be for President Obama to say to the American people and to the rest of the world, ‘I am putting an end to the NSA’s bulk collection programs, because it is contrary to the American way to treat every person who uses the telephone or the internet like a terrorism suspect.’

In the meantime, a number of proposals aiming to increase transparency and oversight of the NSA have been put forward by members of Congress, including the Freedom Act in the House and Senate, which would end bulk data collection.

Do any of these proposals – legislation that attempts to curb the NSA’s data collection and/or propose new oversight, whatever self-restraint Obama proposes – stand a chance when it comes to reining in surveillance run amok?

Or would it require a full stop to bulk data collection? Do you think that intelligence operators are even capable of stopping the use of the powerful analytics tools they’ve created?

Is the lid off of this Pandora’s box for good, to the detriment of privacy?

Your thoughts are welcome in the comments section below.

Follow @LisaVaas

Follow @NakedSecurity

Image of Obama courtesy of Filip Fuxa / Shutterstock.com

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/DMph9QOXTLY/

Eight of the world’s leading technology companies have come together to call for a change in the way the US government conducts surveillance.

The companies – AOL, Apple, Facebook, Google, LinkedIn, Microsoft, Twitter and Yahoo – have created an alliance known as Reform Government Surveillance.

The group is asking the world’s governments to reassess intelligence gathering practices following the leaking of various documents by whistle-blower Edward Snowden.

These leaks have, according to Microsoft’s Brad Smith, lessened people’s trust in technology. Smith said, “People won’t use technology they don’t trust. Governments have put this trust at risk, and governments need to help restore it.”

The Reform Government Surveillance group has written to President Obama and Congress, arguing that current surveillance practices undermine individual freedoms, as protected by the US Constitution.

An open letter from the group recognised the need for domestic security measures but questioned the extent to which governments go in their collection of information:

Dear Mr. President and Members of Congress,
We understand that governments have a duty to protect their citizens. But this summer’s revelations highlighted the urgent need to reform government surveillance practices worldwide. The balance in many countries has tipped too far in favor of the state and away from the rights of the individual — rights that are enshrined in our Constitution. This undermines the freedoms we all cherish. It’s time for a change.

The tech coalition also requested changes be made to future surveillance, saying that:

We urge the US to take the lead and make reforms that ensure that government surveillance efforts are clearly restricted by law, proportionate to the risks, transparent and subject to independent oversight.

The group’s campaign is not limited to simply writing a letter though. It has also defined five reform principals that it believes governments need to adopt:

1. Limiting governments’ authority to collect users’ information – Sensible limitations should be employed in order to protect user privacy. Governments should cease bulk data collection and limit information-gathering to specific cases and in compliance with the law.
2. Oversight and accountability – Intelligence agencies should be subjected to more checks and balances to ensure compliance with the law. Additionally, reviewing courts should be independent and important decisions should be made public in order to provide accountability.
3. Transparency about government demands – Governments should be far more forthcoming in disclosing the surveillance techniques they employ so that meaningful debates can take place in respect of the scope and power of such programs. Companies should disclose information about government requests to their users.
4. Respecting the free flow of information – Governments should allow the free flow of information between countries without any form of hindrance or requirements for service providers to maintain infrastructure within a particular country’s borders.
5. Avoiding conflicts among governments – There should be a better framework to facilitate data requests between different nations and other legal jurisdictions. To this end, the coalition suggests that some sort of treaty could be designed that would govern such requests in a robust and transparent way.

In many ways I applaud this move from some of the world’s largest technology companies but I can’t help but wonder if there is a touch of hypocrisy about this campaign?

When I read a quote from Mark Zuckerberg, Facebook’s CEO, in which he said …

Reports about government surveillance have shown there is a real need for greater disclosure and new limits on how governments collect information

… I wondered if perhaps many of the principles put forth by the Reform Government Surveillance group could also be applied to at least some of the companies present in this alliance. After all, the likes of Facebook and Google are not adverse to collecting copious amounts of data about our lives.

For now, I’m not sure which concerns me the most – being spied upon in the name of national security or being spied upon in the name of consumerism.

Follow @Security_FAQs

Follow @NakedSecurity

Image of conference room courtesy of Shutterstock.

Article source: http://feedproxy.google.com/~r/nakedsecurity/~3/AY2yG2ASiHw/

CAMBRIDGE, Mass., (Dec. 9, 2013) — Raytheon BBN Technologies and GrammaTech, Inc. are collaborating on a $4.8 million contract award under the Defense Advanced Research Projects Agency’s VET program. Raytheon BBN Technologies is a wholly owned subsidiary of Raytheon Company (NYSE: RTN)

The VET (Vetting Commodity IT Software and Firmware) program seeks to help U.S. government agencies address the threat of malicious code and hidden “backdoor” access in commodity IT devices. Mobile phones, network routers, computer workstations and other networked devices can be secretly modified to function in unintended ways or spy on users. The funding was awarded Sept. 26, 2013.

Under the program, GrammaTech and Raytheon BBN intend to develop tools and techniques to enable organizations to inspect the software and firmware that exist inside such network-enabled devices and protect them from attack. Raytheon BBN Technologies plans to develop techniques that enable analysts to prioritize elements of software and firmware to examine for hidden malicious functionality.

GrammaTech plans to develop the tools that actually examine the software and firmware to allow analysts to demonstrate that they do not have exploitable security vulnerabilities.

“Our scientists are developing new technology that aims to advance the state-of-the-art for analyzing machine code,” said Tim Teitelbaum, Ph.D., GrammaTech chief executive officer. “We are leveraging these advances to create a tool that could confirm the absence of broad classes of vulnerabilities.”

“The U.S. Department of Defense relies on equipment with components manufactured all over the world,” said Jack Marin, Ph.D., vice president for Cyber Security at Raytheon BBN Technologies. “Any backdoors, malicious code or other vulnerabilities hidden in those components could enable an adversary to do serious damage, including the exfiltration of sensitive data and the sabotage of critical operations. The VET program seeks to enable DoD analysts to vigorously vet software and firmware devices before they are connected to our critical networks.”

About GrammaTech: GrammaTech is the leading developer of software-assurance tools and advanced cyber-security solutions. Originally founded at Cornell University, GrammaTech’s software analysis solutions are used by software developers worldwide, spanning a myriad of industries including avionics, medical, industrial control, and other applications where reliability and security are paramount. With both static and dynamic analysis techniques that analyze source code as well as binary executables, GrammaTech provides superior static analysis for better software. For more about GrammaTech, visit us at www.grammatech.com.

About Raytheon: Raytheon Company, with 2012 sales of $24 billion and 68,000 employees worldwide, is a technology and innovation leader specializing in defense, security and civil markets throughout the world. With a history of innovation spanning 91 years, Raytheon provides state-of-the-art electronics, mission systems integration and other capabilities in the areas of sensing; effects; and command, control, communications and intelligence systems; as well as a broad range of mission support services. Raytheon is headquartered in Waltham, Mass. For more about Raytheon, visit us at www.raytheon.com and follow us on Twitter @Raytheon.

Article source: http://www.darkreading.com/government-vertical/dod-selects-raytheon-and-grammatech-to-d/240164578