president [at] whitehouse [dot] gov
Interesting article from Freakonomic. The article mentions research that supports the use of email for the President of the United States.
One of the arguments in favour of using email was the reduction of the “Mum effect” - an observed behaviour that people spread bad news easier via electronic medium (ah, that’s why this would happen).
What about the security implications of the President having an inbox? The President’s inbox would probably become the holy grail for hackers and and a more worthy cyber jihad target than the previous DDoS attempt. What could we do to protect the world’s most wanted inbox?
- Social engineering would work? (such as this)
- Malware/exploits would get through?
- What about spams, hate mail?
The fact is that the US president would probably have one of the most effective “firewalls” in the world - crops of secretaries who would read his email, sort and prioritise and print them out on paper. Just as letters and parcels would be opened by staff in case there is a mail bomb.
This transfer of medium is probably one of the more effective ways of isolating threats from critical systems (for example, our Linux Malware Honey Pot has a printer attached to it as one of the ways to log information - it is a noisy line printer for the extra retro factor).
But vulnerabilities in applications used to read the email (e.g. Word for document attachments or the email client itself) would still be a threat. Although isolated from the President’s machine - compromising a member of staff’s machine at the White House open doors to other attacks. This is where Buffer overflow detection would be one of the possible solutions. Using virtualization and reimaging techniques to implement “Disposable security” could be useful as well.
Or safer yet, strip all attachments and only accept plain-text emails to minimize the attack vector. This could be enforced at the gateway, together with the spam filtering and content scanning.
Of course, not everybody can afford to hire secretaries as Cyber bodyguards to protect them. So we, at SophosLabs, will throw our own body in the line of fire instead, protecting the innocent whenever they call upon us.
(Note: There had previously been an official US President’s email address - see National Archives and Records Administration.)
Posted on December 10th, 2007 by Boris Lau, SophosLabs, UKFiled under: General
Windows 7 security - A great leap forward or business as usual?
