Voice of the DBA

Tag: security

  • Using AI for Security

    AI (Artificial Intelligence) systems and technology has been all over our industry for the past year or so, ever since ChatGPT released the initial public version in late 2022. It seems that there is a lot of hype around the possibilities, with plenty of excitement and skepticism, depending on who is talking about the tech. However, there do seem to be some places where the technology is working well, and security is one of them.

    There is an article about how Microsoft is using AI to help spot ransomware, which seemed to have run rampant a few years ago. It’s still around, though it seems fewer exploits are being publicized. That might be because systems are better protected, perhaps there are fewer attacks (unlikely), or maybe more organizations are getting better at covering up their issues. They might be better prepared to restore backups or quicker to pay a ransom.

    In any case, Microsoft is exploring machine learning (ML, a subset of AI) to detect patterns and behaviors that can indicate a ransomware campaign is starting on a system. Looking through logs of activity for unusual behavior is something ML might be much better at, or faster at, than humans.

    I certainly know that if I were running queries that might look at my activity on systems, taking a guess about whether or not the activity this week is “regular” and matches patterns from last week is hard. Often exact matches of activity patterns cause lots of false positives if they are too tightly written. If we loosen the parameters too much, we miss potential attacks. A fuzzy view of the pattern is needed, something ML is good at detecting. After all, we need to look at all activity from all users, and determine if Steve’s activity this week is different than last week, and at the same time, is Grant’s activity unusual and a sign that his account is compromised?

    Some humans are very good at spotting patterns in activity, but only at a limited scale. We get tired, our minds wander, and we can’t only focus on looking for patterns in log files. We’ll get bored, distracted, and start to make mistakes. AIs don’t get tired, and while they might miss some anomalous activity, and certainly will report plenty of false positives, humans can focus on this subset of reports and perhaps partner with AIs to do a better job helping secure our systems.

    I lean towards the idea that AI technology will help us better spot malicious activity in the tremendous amount of data we capture about our networked systems when humans are attempting to hack us. What I’m not sure about is how well criminal actors will use AI tech to further disguise their activity. I can certainly see a future where lots of AI bots battle each other at blinding speed while humans watch and hope the defenders manage to outwit their attacking AI opponents.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

  • Ransomware vs. AI

    Ransomware has been a growing and shrinking problem in the modern world. Every time I think that some new defenses and protections are preventing ransomware from being a problem, I see another issue. Recently, I saw Subway got hit with with an attack and a few friends have recently noted their companies were restoring systems after a portion of their network was locked down.

    With the advent of Rasnsomware-as-a-service, where criminals deploy software and then sell access to others, better detection and protection become more important. As with any software, criminal human operators will use the ransomware software in different ways. That means that we don’t necessarily have a simple threat that can be easily programmed against with anti-virus technology.

    Microsoft has been using AI technology to help them track and combat ransomware campaigns. Since there are similarities between how ransomware is used by different individuals and how it appears in systems, AI technology can be helpful here. There aren’t the same simple signatures on files that we’ve seen in the past with viruses, but rather more complex patterns. Humans might discover how ransomware appears in their environment with lots of knowledge on what their network ought to look like, but this pattern matching across many different networks and organizations is something that AI/ML might do quicker and at scale. Once successful, ransomware can be hard to recover from, so early detection is important.

    In the article, it seems that Microsoft is capturing lots of traffic and analyzing it for patterns, with multiple types of anomalous activity, and then aggregating this across devices to guess whether this is an attack or not. In some of their testing, they find the ability to stop an attack with only a few percent of assets getting encrypted. That’s not perfect, but better than finding 90% of your nodes are encrypted over morning coffee.

    I suspect this is just the latest escalation in cyber attacks and defenses. I’m sure that hackers will come up with new and novel ways to cause problems, but I do think that this is a place where AI, especially ML, technology can be useful to provide better security. I also think that database technology, especially graph queries, is particularly helpful here. I hope we learn more about how they are building protections as I think this is likely a great data analysis story.

    Once again, the database is critical to making software better because all of that data has to be stored and queried somewhere.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

  • Building CyberSecurity Skills with an Advent Challenge

    I’ve been working on the Advent of Cyber challenge this December. It’s more of a walkthrough of some puzzles than it is solving them yourself, but it has given me a brush up on some skills and helped me learn some basics of how people in charge of (or looking to break) security look at the world. Plus it’s been a little fun with a silly storyline each day.

    The first challenge starts with a chatbot and trying to social engineer answers out of it. This was interesting to me, even though it was likely (hopefully) not a representative example of how AIs would work in most systems. However, it got me to think more about how I pose questions to an AI and how I can grow my prompts. The neat thing about AI is that you don’t have to ask the perfect question and then re-ask the same question with more info to get an answer. The AI keeps context in a conversation, which is way more powerful than previous Q&A search systems.

    The second day was Python and Jupyter Notebook basics, which were a nice refresher for me on a couple of concepts, but not that interesting. However, the third day introduced some password-cracking tools, the fourth day added other ones, and a few subsequent days showed some software that is devious in how it can be used to penetrate security. Other challenges have me the chance to brush up on Linux and network skills I hadn’t used in a long time.

    The SQL Injection module (day 10) is well done, and I might recommend most developers go through that to see why their easy, convenient build-a-sql-string-to-execute code is an incredibly bad idea. It’s also why they can’t also use stored procedures as built-up batch commands. Use the stored procedure objects to execute with named parameters.

    The idea of using a little plot and story, with a simple challenge to teach some skills is a good one. I’ve been lucky in my career to be exposed to a lot of different technologies and ways of working with systems. I’ve set up bridges, routers, and firewalls. I’ve had to get network links and cables to work and talk with different protocols, including configuring T1 connections. I’ve built machines, dealt with different types of local and remote storage, and had to program and administer systems at all levels of the OSI model. Does anyone remember that?

    This was a fun break from work, doing a module or two every other day, remembering there are a lot of complexities to our systems outside the database, or outside the application software. It’s also reminded me of all the different ways that security can be breached.

    Take the challenge and learn some new skills. I think many of you will learn something and you might enjoy yourself along the journey.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.

  • Breaking Biometrics

    In the movies, when someone needs to bypass some sort of fingerprint biometric system, they use tape to lift a fingerprint, or in the more gory films, cut off a body part. In any case, there have been a lot of attempts to replicate this in the real world. Sometimes these work, though the consensus is modern hardware isn’t as susceptible as older hardware. I don’t know if that’s true, but I did see an interesting look at the main three sensors used in most laptops.

    All the laptops had their authentication bypassed, though not with any fake biometric device, but rather with attacking the actual communications between the sensor and the OS. There’s a great report from two people who were asked by Microsoft to evaluate the security of the top three sensors. It’s a fascinating look at how the hardware and software of the OS are set up to provide secure authentication and how both can be fooled.

    Some of the problems are users not enabling features and some are that manufacturers aren’t understanding or implementing the secure protocols from Microsoft. I both get how this happens and I feel it’s not acceptable. Certainly someone might read a spec and not completely understand it, even across a team of people. However, for vendors, this can’t be something they don’t have researchers, pen testers, or some security professional examine. Hardware vendors spending money designing these devices ought to include the money for a few people to try and break the security before they are sold.

    At least for security features.

    I like the enhancements made with multi-factor authentication, and I appreciate biometrics as a convenient way to access things. At the same time, I want to be able to trust them. The efforts made by the researchers are pretty high, not something that someone in a coffee shop can do in 5 minutes while you go to the bathroom. At least, apart from the Surface. It appears that one can be quick.

    At the same time, if you lose your laptop, within hours someone can break past the biometrics with a man-in-the-middle attack. Even if you’ve encrypted the disk, your data can be accessed since this attack gets the OS to authenticate them.

    Security is tricky, but I don’t plan on disabling my fingerprint scanner. However, if I were carrying around data that was more important than the work I do now or data worth a lot of money, I don’t know I’d ever enable biometrics.

    Steve Jones

    Listen to the podcast at Libsyn, Spotify, or iTunes.