The document discusses cybersecurity threats and how quantum technologies may help address them. It summarizes that while bad cyber actors have not yet won, they are ahead of the curve. Encryption protects against most threats, and quantum cryptography can protect against threats from quantum computers by providing future-proof security. For a truly secure future, standards, best practices, and ongoing technology development are needed to transition from currently unsafe cryptography to quantum-safe and quantum-based solutions.

1. Have the Bad Guys Won the Cybersecurity War…
and Does Quantum Help or Hurt…
Andrew Hammond
MagiQ Technologies, Inc.
andrew.hammond@magiqtech.com10/09/15 1

2. MagiQ Technologies Company History
• Founded in July 1999 to commercialize quantum information technologies
• Headquartered in Somerville, MA
• Always looking for new hires
• Awards
• Scientific American “Business Leader” in computing - Scientific American 50
• IEEE Spectrum’s “Top Ten Companies to Watch for Next 10 Years”
• World Economic Forum (Davos) Technology Pioneer
• Business Strategy
• MagiQ is leveraging research funding to develop portfolio of commercial products
• MagiQ is building a broad portfolio of intellectual property: 50 patents pending/issued
• Quantum Product Line
• Q-Box for test beds
• QPN – Quantum Private Network
• Focus was on developing patents portfolio for the long term
• MagiQ launched first commercial quantum device in 2003 – shipping QPN 8505 today
• Funded by DARPA and IARPA to develop Quantum Computer Toolbox
• Important customers:
10/09/15 2

3. Cyber and Cryptography
• Cyber technologies are omnipresent
• Cyber threats are growing more numerous and more
sophisticated
• Cybersecurity is a growing and fundamental part of safety
and security of individuals, organizations, and society
• Cryptography is a foundational pillar of cybersecurity
• Cryptography allow us to trust untrusted communication
systems
• Encrypting data greatly reduces risk of cyber threats
• Sony
• Office of Management and Budget
• Most cryptographic algorithms are based on a computational
assumption
Quantum Threat and Defense
• Quantum computer threatens those computational assumptions
• Quantum computer is much more probable in the short to mid term
because of advances in science and engineering
• Quantum cryptography protects from that threat
• Quantum safe cryptography and quantum cryptography together
provides future proof security
• Quantum cryptography will eventually provide quantum Internet
• Satellites in LEO can distribute keys anywhere
• Ground based repeaters
• How do we evolve from unsafe crypto to safe and secure?
• Standards
• Best practices
• Ongoing technology development and adoption
• Quantum requires us to reinvent our cryptographic infrastructure
• Quantum safe is necessary to be cyber safe
Abstract
10/09/15 3

4. Agenda
• Cyber Crime Threat Profile
• Case Study: CozyDuke
• Persistence of threat
• Exfiltration
• Breaches by
• Organization
• Size
• Source
• Type
• Time
• Cost
• Large Organizations do not encrypt
• Quantum Cryptography and Computing
• History of Crypto
• Black Swan
• Quantum Crypto
• Post Quantum Crypto
• NSA’s Plans
• Summary
10/09/15 4

5. Bad Guys in the Good ‘Ol Days…

6. Bad Guys Today…

7. Threat Profile

8. • 2013 discovered by Kapersky and F-Secure…Miniduke was switched to
CosmicDuke
• Russian based
• Funded for long term …history of five years
• Probably works for or is approved by Russian government
• Targets enemies of Russia
• government
• diplomatic
• energy
• telecom operators
• military, including military contractors
• individuals involved in the traffic and selling of drugs
• hit the White House and State Dept
• Sophisticated and ongoing
Case Study of Hacking Group:
CozyDuke (aka CozyBear, CozyCar, or
OfficeMonkeys)

9. CosmicDuke 2014/2015 Advanced Persistent
Threats and Advanced Evasion Techniques
• Persistence
• Backdoor capable of stealing various types of
information
• Spoofs popular applications and designed to run in
the background
• Starts via Windows Task Scheduler, via a
customized service binary that spawns a new
process set in the special registry key, or is
launched when the user is away and the
screensaver is activated.
• Reconnaissance
• Files based on extensions or file name keywords
• Keylogger
• Skype password stealer
• General network information harvester
• Screen grabber (grabs images every 5 minutes)
• Clipboard grabber (grabs clipboard contents every
30 seconds)
• Microsoft Outlook, Windows Address Book stealer
• Google Chrome password stealer
• Google Talk password stealer
• Opera password stealer
• TheBat! password stealer
• Reconnaissance (cont’d)
• Firefox, Thunderbird password stealer
• Drives/location/locale/installed software harvester
• WiFi network/adapter information harvester
• LSA secrets harvester
• Protected Storage secrets harvester
• Certificate/private keys exporter
• URL History harvester
• InteliForms secrets harvester
• IE Autocomplete, Outlook Express secrets
harvester
• Exfiltrate
• data via FTP
• Direct TCP connection and HTTP session via
Winsock library
• HTTP session via Urlmon.dll
• HTTP session via invisible instance of Internet
Explorer as OLE object
10/09/15 9

10. Top Breaches 2015 by Organization
• High number of
discrete records
impacting many
individuals
• Files if encrypted
would not be useful to
hackers
• Across private and
public sectors
Source: http://www.breachlevelindex.m/pdf/Breach-Level-Index-Report-H12015.pdf
10/09/15 10

11. Biggest Data Breaches
Source: DataBreaches.net, IdTheftCentre, press reports Research: Miriam Quick, Ella Hollowood, Christian Miles, Dan Hampson
http://www.informationisbeautiful.net/visualizations/worlds-biggest-data-breaches-hacks
• Data breaches by size:
• Ongoing threat
• Large impacts
• Economic
• Home Depot
• Privacy
• Ashley Madison
• National Security
• US Office of Personnel
Management

12. Breaches by Source and Type
Source: Breach Level Index, http://breachlevelindex.com/pdf/Breach-Level-Index-Report-H12015.pdf
• Type of Breach Incidents
• Identity theft (information that can be used to masquerade as someone)
• Financial access (bank account credentials, credit card data)
• Existential data (information of national security value or threatens business
survival)
• Account access(username/passwords to social media, websites, etc.)
• Nuisance (email addresses, affiliation, ect.)
• Identity theft the largest problem by size
• Existential data the biggest impact
• Number of Breach Incidents
• Malicious outsider
• Accidental loss
• Malicious insider
• Hacktivist
• State sponsored
• Malicious outsider largest problem by size
• Malicious insider might have biggest impact because of greater access

13. Breaches Over Time
•Malicious outsider breaches on the rise
•Other breach types pretty constant
• Accidental loss
• Malicious insider
• Hacktivist
• State sponsored
Source: Breach Level Index, http://breachlevelindex.com/pdf/Breach-Level-Index-Report-H12015.pdf
10/09/15 13

14. Breaches by Industry
Source: Breach Level Index, http://breachlevelindex.com/pdf/Breach-Level-Index-Report-H12015.pdf
• Breaches by industry
• Healthcare and Government lead number of records breached
• Note Technology industry’s large number of records breached
vs. size of industry
• Breaches over time
• Breaches in Financial Services and Government are growing
faster than other categories

15. Types of Attacks
Source: DSCI-Data Security Confidence Index http://www2.safenet-inc.com/dsci/DSCI-Report-EN.pdf
• Attacks have become sophisticated
• Attackers have become professional organizations who gain expertise and
resources overtime
• Black market for attack software is highly organized and even convenient
• Types of attacks are varied, mutating, and evolving
• Definitions are based on what respondents perceive
• Analysis on respondents’ organizations’ most recent perimeter security breach,
asked to respondents whose organization experienced a breach (499 respondents).

16. Cost of Cybercrime and as a Percentage of
GDP
Source: McAfee and Net Losses: Estimating the Global Cost of Cybercrime
Economic impact of cybercrime II
Center for Strategic and International Studies
June 2014
• Estimated cost of cybercrime is $445 billion per year to the worldwide economy
• US government estimated cost at $1 trillion-probably to high
• Cybercrime about the same cost as worldwide narcotics and car crashes
• Transnational crime and pilferage are larger problems
• Theory is problem needs to rise to 2% of GDP for society to take proactive action

17. Large Organizations do not Encrypt
• 86% of respondents said less than 10% of data was
encrypted during last breach
• 1,000 security and IT executives in the U.S., UK, Europe,
Middle East and Asia-Pacific.
• Industries
• financial
• services
• Healthcare
• Manufacturing
• public sector
• telecommunications
• Utilities
• Retail
• Construction
• Insurance
• legal
• “Thinking about your organization’s most recent breach,
what percentage of the breached data was protected by
encryption?”, asked to respondents whose organization
experienced a breach (499 respondents)
Source: DSCI-Data Security Confidence Index http://www2.safenet-inc.com/dsci/DSCI-Report-EN.pdf10/09/15 17

18. Quantum

19. Unanticipated Advances in
Cryptography
In history, every advance in code-making has been defeated by advances
in code-breaking with disastrous consequences to users.
German Enigma Machine
10 million billion possible
combinations:
Looked unbreakable
Allied code-breaking
machine “bombe”:
Enigma broken
10/09/15 19

20. • Event
• You wake up tomorrow morning and _____has a fully functional quantum
computer
• You thought Snowden was bad
• Fact
• Quantum computing can efficiently break:
• RSA
• Discrete logarithm problem: Diffie-Hellman key exchange
• Elliptic-curve cryptographic systems
• “If a quantum computer is ever built, much of conventional cryptography will fall
apart!” (Brassard)
• Impact
• All national security cryptographic infrastructure is compromised
• No secrets from our adversaries
• Destabilizing between nation-states
• All trust zones that allow for commerce are disrupted
• Massive fraud
• Denial of service attack to the economy
• Economic transactions would grind to a halt
Thought Exercise

21. • The term "cryptopocalypse" was probably first coined at the Black
Hat USA information security convention in 2013.
• A talk presented by four security and technology experts at the show
explored cryptographic weaknesses and attempted to answer the
hypothetical question: "What happens the day after RSA is broken?"
• RSA is a widely used public-key cryptosystem used in digital
signatures.
• The answer, they determined then, was: "almost total failure of trust
in the Internet," for one thing. The reason? Almost everything we do
on the Internet is in some way protected by cryptography.
• The speakers urged a move to stronger systems to thwart attacks
against this backend security that we use for emails, banking, and a
lot of other things.
Cryptopocalypse or Black Swan
Source: Patrick Nelson, Network World, Aug 21, 2015

22. Weaknesses in Existing Cryptography
• Security based on mathematical difficulty to break
• Intruder is not detectable, leaves no fingerprints
• Vulnerable to improvements in algorithms and hardware, including but not limited to a quantum computer
• Solving of mathematical algorithms
• New Cryptanalysis attacks
• Increases in computational power
• Hardware improvements
• Encrypted data captured today may be readable in future
• Networks are easily tapped
• Data is readily stored in large volumes for big data applications and in the cloud
• Many organizations need to secure data communicated today for the long term
• Cryptographic keys are changed infrequently making brute force attacks easier
• Unauthorized access to network and cryptographic parameters and equipment
• Hackers
• Key couriers
• Maintenance personnel
• Social engineering
• Disgruntled employee
• Contractor
• US businesses lose over $500B/year in sales because of economic espionage (US Government)
10/09/15 22

23. Why Quantum Cryptography
• Key distribution with “perfect security”
• Invented > 20 years ago
• Components are now available
• Feasible with today’s level of technology
• Based on quantum physics of single photon
• not mathematical assumptions
• Future-proof technology
• Immune to increase of computing power or algorithms
• No need for upgrades with QKD
• Symmetric Key Encryption
• Provide real-time intrusion detection, identifying the exact location of eavesdropping
devices
• One Time Pad Encryption with Quantum Key Distribution provides provably unbreakable
security
Eve
QKD
Alice - Intrusion alert!
QKD
Bob - Intrusion alert!
10/09/15 23

24. Quantum Key Distribution
• Properties of photons change if they are observed
• QKD systems detect intruders using polarized state of photons that travel through optical lines
• By analyzing the error rate, MagiQ’s QKD hardware can absolutely detect if the key has been viewed by
an Eve intercepting the optical signal
• Node-pairs can reach a distance of over 100km, which in conjunction with cascading, will enable
deployment over a long-distance optical network

25. • There are current limitations in Quantum Crypto deployments
• Distance is limited to 100km
• Can daisy chain trusted nodes
• Standards
• FIPs is the most important in the US
• Some industry work ongoing
• Positives
• Key rates have gotten faster
• Detectors have gotten more sensitive
• Line card form factor
• Possible optical chip design
• Low Orbit Satellite
• Unlimited distance
• Europe and China are putting up satellites
• Quantum Repeater
• Some years away
• China leading the charge
• Beijing to Shanghai network
• Satellite going up
• US is probably behind
Quantum Cryptography State of the Art

26. General Characteristics of Fiber-Based
Commercial QKD Systems
• Telecom fiber for quantum channel
• Photon phase encoding
• Pulse repetition rate ~ 1 MHz
• Distance ~ 100 km
• Integrated Ethernet encryption/VPN Subsystem
• Typical Architecture
QKD
VPN
Key Mgmt
Sys
Mgmt
10/09/15 26

27. • Development of Quantum Computer resistant crypto
• Lattice-based public-key cryptography-short or close vectors in lattices.
• Multivariate public-key cryptography-nonlinear multivariate equations over finite fields.
• Code-based public-key cryptography-decoding linear codes, for example, Goppa-codes.
• Hash-based signatures-finding collisions of cryptographic hash functions.
• Quantum Cryptography
• Random Number Generation
• Quantum Key Distribution
• Possibly Hybrid Approach of QKD and Post-Q Algorithm
Post Quantum Cryptography

28. NSA Plans for Post Quantum Cryptography
• Snowden discloses NSA working on a quantum computer…”Penetrating Hard Targets” project
• “a cryptologically useful quantum computer”
• “Owning the Net,” is using quantum research to support the creation of quantum-based attacks on
encryptions like RSA
https://www.washingtonpost.com/apps/g/page/world/a-description-of-the-penetrating-hard-targets-project/691/
“It is important to note that we aren't asking vendors to stop implementing the Suite B algorithms and we
aren't asking our national security customers to stop using these algorithms. Rather, we want to give
more flexibility to vendors and our customers in the present as we prepare for a quantum safe future.”
https://www.nsa.gov/ia/programs/suiteb_cryptography/
10/09/15 28

29. • The bad guys have not won…but they are ahead of the curve
• Encryption protects against most threats
• Quantum Crypto can assist as a part of a layered approach to defense
• Quantum Crypto can protect against Quantum Computing
• Cyber technologies are omnipresent
• Cyber threats are growing more numerous and more
sophisticated
• Cybersecurity is a growing and fundamental part of safety
and security of individuals, organizations, and society
• Cryptography is a foundational pillar of cybersecurity
• Cryptography allow us to trust untrusted communication
systems
• Encrypting data greatly reduces risk of cyber threats
• Sony
• Office of Management and Budget
• Most cryptographic algorithms are based on a computational
assumption
Quantum Threat and Defense
• Quantum computer threatens those computational assumptions
• Quantum computer is much more probable in the short to mid term
because of advances in science and engineering
• Quantum cryptography protects from that threat
• Quantum safe cryptography and quantum cryptography together
provides future proof security
• Quantum cryptography will eventually provide quantum Internet
• Satellites in LEO can distribute keys anywhere
• Ground based repeaters
• How do we evolve from unsafe crypto to safe and secure?
• Standards
• Best practices
• Ongoing technology development and adoption
• Quantum requires us to reinvent our cryptographic infrastructure
• Quantum safe is necessary to be cyber safe
Conclusion: Have the Bad Guys Won the Cybersecurity War…
and Does Quantum Help or Hurt…
Cyber and Cryptography
10/09/15 29

30. Back Up Slides
10/09/15 30

31. Tools for Security Breach
• Optical Taps
• May be easily created using common maintenance equipment that can
be purchased legally and cheaply worldwide
• Allow unfettered access to all voice and data communications
transiting an optical fiber
• Are not detectable in today’s optical networks
• Packet-Sniffers filter out specific packets based on header and
store and analyze the data

32. Opportunities for Security Breach
• Carrier Equipment Locations
• Central Office
• Co-located leased space
• Carrier Hotels (“60 Hudson Street”)
• Commercial Office Buildings
• Office Building Wiring Closets
• Outside Plant Equipment Huts
• Personnel access
• Network Access Concerns
• Undetectable Fiber Taps
• Fiber Cross Connects Patch Panel
• Network Probes
• Out of Band Management
Network
• Monitoring Access Ports
• Local DTE Access Ports
PPoorrtt AA PPoorrtt BB AAnnaallyyzzeerr
OOuutt IInn OOuutt In Out A Out B

33. Recent News: Ecosystem is Developing
10/09/15 33

34. Quantum Computing Startups

35. • "Encryption and anonymity, separately or together, create a zone of privacy to
protect opinion and belief"
• The tools to bestow such protection are essential, it says, given the "unprecedented
capacity" governments, companies, thieves and pranksters now have to interfere
with people's ability to express themselves.
• Lacking such tools, it adds, many people will be unable to fully explore "basic aspects
of their identity" such as their gender, religion, ethnicity, origins or sexuality.
• The software acts as a "shield" for opinions against external scrutiny - a fact that is
"particularly important in hostile political, social, religious and legal environments",
says the report.
• "States should not restrict encryption and anonymity, which facilitate and often
enable the rights to freedom of opinion and expression.“
BBC News/May 2015 http://www.bbc.com/news/technology-32916002
Report of the Special Rapp, Special Rapporteur on the promotion and protection of the right to freedom of opinion and expression, David Kaye May 22, 2015
http://www.ohchr.org/EN/HRBodies/HRC/RegularSessions/Session29/Documents/A.HRC.29.32_AEV.doc
Encryption Important to Free Speech Says UN
Report