Why is it important?

A Zero-Knowledge Proof (ZKP) is a protocol that verifies whether certain knowledge exists without revealing it. In a ZKP two parties perform an exchange where one party proves to the other party that they know a secret without giving away any sensitive information about the secret. If an adversary were to sit in the middle and listen to the exchange, they would not learn the secret or any other information that could lead them to infer the secret. This is because the only information verified by a ZKP is that the proving party knows the secret. The verifying party does not learn what the secret is and cannot obtain or reconstruct the secret in any form.

In a world of password-based authentication and digital privacy, this could be a game-changer to modern cybersecurity. Many methods in cybersecurity involve addressing problems like:

• How do I enroll in services without entering sensitive information?
• How do I prove my identity without giving away my social security number?
• How do I protect my password from hackers on the internet?

ZKP has the potential to solve these problems and others by allowing services to verify necessary information without the user ever disclosing it. This removes the concern of third-party services storing sensitive information in a database, and the user does not need to send it over an unsecure network.

How does it work?

Suppose there is a $100,000 prize to anyone who can find an algorithm that solves a specific type of puzzle. Peggy claims that she has found such an algorithm, but she doesn’t want to give it away in case someone else claims the prize money. Let’s assume that so far no one other than Peggy has been able to come up with a solution. How does Victor verify that Peggy has found an algorithm?

Victor can perform a Zero-Knowledge Proof by generating a random variation of the puzzle and sending it to Peggy. Let’s assume that Victor does not know the solution beforehand but can easily verify if Peggy’s solution is correct (e.g. you can verify a Sudoku puzzle by checking that all rows and columns add up to 9). If Peggy truly knows an algorithm, she can fill in the puzzle and return the answer to Victor. Then, he can confirm that her solution is correct. But what if he is unconvinced? What if Peggy guessed the solution? Then, Victor can repeat the exchange and send another randomly generated puzzle and Peggy can provide him with another solution. With each iteration, the likelihood that Peggy guessed the solution multiple times in a row decreases exponentially. Victor can continue to challenge Peggy with puzzles until he is convinced that she must know an algorithm and it is highly improbable for her to have guessed correctly so many times. Note that by filling in the puzzle, Peggy is not giving away her algorithm, and by receiving the solution Victor cannot presume how Peggy came up with her answer. Thus, Peggy’s secret, the algorithm, remains confidential.

This is just a simplified example of how ZKP can be used to verify a condition (e.g. Peggy knows an algorithm), but how can this be used in cybersecurity? Computers today can perform ZKPs by repeating a series of mathematical tests (i.e. “validating the puzzle”). If Victor prompts Peggy with a “puzzle” or any sort of question like “Do you know the password?”, Peggy’s answer is obscured by a mathematical function. What Peggy sends Victor is not her answer, but something that is mathematically derived from her answer, thus hiding the original answer. With each iteration, the probability of Peggy repeatedly guessing the correct answer decreases. Some ZKPs also insert a small amount of randomness into each exchange to ensure that the same answers don’t produce the same results for following iterations.

How is it secure?

The highlight of ZKP compared to other security protocols is that anything sent across the network or stored in a database cannot be used to recreate the secret. It is infeasible to reverse engineer Peggy’s obscured answer to obtain the original answer because the obscured answer was derived using a special class of mathematical one-way functions that cannot be solved with modern computing. Knowing the outputs of these functions is currently not enough to reconstruct the inputs. A fundamental part of ZKP’s security is also tied to the number of “puzzles” or challenges Victor sends. Suppose there were 10 possible answers to each puzzle. Peggy would have a 1/10 chance of guessing the right answer on the first exchange, a 1/100 chance of guessing two right answers in a row, and a 1/1000 chance of guessing three right answers in a row. This pattern continues with every iteration until Victor decides that it is effectively impossible for Peggy to have guessed each correct answer. Notice that with each iteration the probability that Peggy guessed each answer approaches zero but will never reach it [Figure 1]. We must decide on a cutoff point that is close enough to zero that we are confident that Peggy could not be so precise without knowing the secret. As the number of possible answers for each challenge increases, the cutoff point is reached with fewer iterations.

Figure 1: The probability that Peggy will guess the answer for each iteration if there are 10 possible answers.

he most egregious security breaches in recent United States history were the direct result of the actions of individuals with both insider access and malicious intent. Some of these security breaches, namely the Manning and Snowden incidents, caused detrimental damage that the United States is still recovering from. Though devastating, these attacks were not executed by individuals with profound technological ability or intellectual prowess but by individuals with an aptitude for technology, network access that spanned far beyond the scope of their job requirements, and a sour attitude toward the United States and its operations.

Investigation of these incidents revealed ample evidence of the actors’ negative sentiments toward the United States – information that was known and in some cases, broadcasted publicly long before the insider attacks occurred. Records have also shown that, for both Chelsea Manning and Edward Snowden, questions of mental fortitude and disregard for proper operating procedures and the chain of command have been present throughout their professional careers.

Analyses of these attacks and statements made by their perpetrators have revealed that their success did not come from meticulous planning or novel methods of exfiltration but from the victims’ failure to adhere to fundamental principles of cybersecurity, a generally loose culture surrounding security, and a lack of tools to monitor internal network traffic. Improving upon these three concepts would have prevented these detrimental insider attacks and can prevent similar breaches from occurring in the future.

he Manning incident involved the unauthorized release of sensitive information pertinent to the wars in Iraq and Afghanistan and a host of international diplomatic relationships. Found guilty of multiple violations of the Espionage Act in 2013, Private Chelsea (formerly Bradley) Manning collected troves of sensitive data, personnel lists, and diplomatic cables for the benefit of and, in some cases, at the behest of WikiLeaks. At the beginning of her military career, Manning recounted to known hacker Adrian Lamo her hardships in finding commonality between herself and other service members, her overall failure to assimilate into the Army culture, and her sympathies for terrorist actors. Manning also reportedly “lashed out at fellow soldiers” soon after basic training, and her direct supervisors voiced concerns about whether she would be able to handle the mental stress of combat deployment. However, these concerns did not prevent Manning from having access to sensitive networks and using that access to carry out her now infamous data exfiltration campaign.

The prevailing factor in the success of Manning’s exfiltration tactics was the loose security culture surrounding the sensitive networks and their resources. In the presence of other network operators, Manning was able to download “thousands of classified significant activities (SIGACTS)” pertaining to Iraq and Afghanistan to a CD. Her ability to collect this data on a physical medium prompted more exfiltrations in a similar fashion, sometimes for the benefit of Julian Assange and WikiLeaks. In fact, Manning found the security culture to be so relaxed that she created a tasker on her DoD workstation that reminded her to acquire the Global Address List from the United States Forces-Iraq Microsoft/Outlook Server (USF-GAL), a trove of 74,000 email addresses. As a further testament to the loose security culture in Manning’s operating environment, she told Lamo that transferring data to unmarked CDs was actually quite common within the workspace, claiming “we transferred so much data” and that “everyone did” participate in data transfer this way.

Manning has actually credited this loose culture with providing her the opportunity to perform this massive amount of data extraction, as other network operators were often preoccupied with their own precipitous activities in the workspace. Manning has cited “weak servers, weak logging, weak physical security, weak counter-intelligence, [and] inattentive signal analysis” as the main contributors, the “perfect storm” to the success of her attack. The lack of both proper access controls and an internal traffic monitoring system also aided Manning in this campaign of information leakage.

For example, Manning often reached data that existed outside the scope of her operations using her credentials alone. Manning was also able to introduce third-party software called “wget” to her workstation, which she used to download hundreds of thousands of diplomatic cables, some of which eventually fell into the hands of WikiLeaks operatives. Had any sort of traffic monitoring system been in place, this anomalous insider behavior, including the introduction of outside software and unusual download patterns, would have been easily detected.

hen considering the circumstances of the Snowden attack, many parallels can be drawn to the Manning situation. Leading up to Edward Snowden’s infamous data exfiltration campaign against the NSA, Snowden experienced clashes with direct supervisors and repeated failures to assimilate with his coworkers, similar to Manning’s struggles in the Army. While Snowden was working for the CIA in 2007, Snowden’s immediate supervisor recounted his unwillingness to “recognize the chain of command” and inability to “embrace the CIA culture.” While this alone may not have provided sufficient cause for concern about Snowden, current evidence suggests that Snowden fabricated portions of his education and work experience. This information was not revealed when he was employed by a major defense contractor for the NSA, as Snowden’s background investigation was “incomplete.” This unfinished background check failed to verify a self-reported “past security violation” and was unable to develop sufficient character witnesses. Had this investigation into Snowden’s history been completed, his consistent problems with leadership, failure to adopt working cultures of U.S. agencies, and untrustworthy character would have been revealed, possibly preventing him from receiving the clearances that proved integral to his attack.

In addition to this undiscovered information about his past, Snowden’s job position provided him with top-secret clearance and wide-reaching access within NSA networks – access privileges which already far exceeded the requirements for him to fulfill his job responsibilities. Snowden eventually went on to employ social engineering tactics to persuade other employees to provide him with their credentials, allowing him access to previously unavailable data and projects. Snowden utilized this all-encompassing, unmonitored network access to download data en masse. From secret NSA project files to data within the personal storage drives of other NSA employees, Snowden performed actions that should have been leagues beyond his access capabilities.

Not only were Snowden’s privileges too extensive, but there were also no mechanisms in place to monitor unusual traffic, such as mass downloads of unrelated files or accessing the personal data storages of others, despite former NSA technical director Bill Binney asserting that it was possible for this technology to be in place long before Snowden worked there. Beyond these oversights pertaining specifically to the network, Snowden lived mostly in Honolulu at the time and found himself at an advantage with his physical location. He often accessed the NSA network remotely, via a “thin-on-thick” machine, during hours in which on-site NSA employees had already finished work for the day. Outside individuals operating within the NSA network with near unlimited access, no oversight, and no other employees to interact with capitalizes the necessity of an in-house traffic monitoring system. But, according to Binney, this is unlikely to happen due to the security culture within the NSA. “Spies don’t want to be spied on,” Binney affirmed in a 2014 NPR interview, also suggesting the NSA has no plans to practice in-house traffic monitoring in the future.

lthough these incidents were unrelated, they were detrimentally successful in exploiting the same weaknesses. Security culture, or the attitude surrounding security of data and assets amongst its day-to-day operators, was largely exploited by Manning. Manning leveraged a relaxed security culture to collect data from sensitive networks on CDs. Manning then took this data and uploaded it to her own personal computer before handing it over to WikiLeaks. Despite exfiltrating this data during the day and in plain sight, not one question was raised about Manning’s actions.

Both Manning and Snowden found success in the lack of thorough investigation of their personal histories. Concerns of Manning’s mental fortitude, inability to assimilate with other service members, and regular conflicts with other soldiers were hardly considered before access to sensitive networks was given to her. Likewise, Snowden’s own problematic history was not analyzed before his attainment of top-secret security clearance and unfettered access to the NSA internal network. Snowden’s general disrespect for authority, history of support for actors like Manning, previous security incidents, and untrustworthy character were nonfactors in the decision to allow Snowden unmonitored access to the internal network of the NSA.

Manning and Snowden both benefitted from the lack of a monitoring system, which enabled them to collect colossal amounts of data in short periods of time. The lack of monitoring also enabled them to reach data that did not pertain to their day-to-day operations and, in the case of Manning, install an unauthorized application that allowed WikiLeaks operatives access to information within SIPRNet. Snowden saw optimal assistance in the oversight of his access privileges, which “far exceeded the access required to do his job,” and from coworkers who were vulnerable to his social engineering efforts. This fact coupled with the lack of internal monitoring and Snowden’s regular network access outside of normal working hours allowed his exfiltration campaign to carry out flawlessly. These factors that contributed to the successes of both Manning and Snowden stem from systematic problems within the current culture surrounding our security.

n the aftermath of these incidents, analyses have revealed the lack of technical complexity and relatively straightforward attack methods. These attacks found their successes in exploiting weaknesses in the practice of fundamental principles of cybersecurity. Cutting-edge data analytics or a top-notch AI solution will have no chance of stopping the next Manning or Snowden if they have already been given the access needed to haul the servers out of the building. The next major insider breach will be stopped by individuals and community – individuals who practice security and a community that promotes and discusses the importance of it. Becoming brilliant in the basics of security, promoting a healthier security culture, and engaging the community will counter insider threat before it has a chance to begin.