Slashdot Mirror
Reflections on Brilliant Digital: Single Points of 0wnership
nweaver writes "Some reflection on Brilliant Digital's plans shows that they have inadvertently created a Single Point of 0wnership: a single machine or small group of machines which, if succesfully attacked, can be used to gain effective control of the Internet. The implications are rather scary: Even if you never touched KaZaA, your systems may be affected if someone manages to attack Brilliant Digital's update service. Who needs a Warhol Worm?".Updated by HeUnique: use these instructions to remove the Brilliant part.
Here at work I pointed a couple of coworkers toward the previous articles on Kazaa. There response you might ask?
As long as I can get good download speed and have a large mp3 base what do I care?
Does this type of thinking occure elsewhere? I thought I worked with some bright people but they seem to think of their machines as black boxes and if they work great.
sigh.
If I were only smart enough to accomplish the things I dream about.. Or maybe too dumb to care.
MS has been doing this for years, many tools check for updates and install them.
I noticed Need for Speed Porsche did this too.
These friendly autopatchers could all be hacked.
This is a serious risk with new subscription based services too.
Maybe we could "attack" everyone with outlook express/IE patches, so we finally stop recieving all those self forwarding worms in our e-mail.
The difference is: we TRUST the owners of the root servers to keep their systems secure. The owner's of KaZaA don't have the same track record.
From the article the other day on root DNS servers.
Story
For the "internet" to be greatly affected multiple root servers must be brought down.
"The DNS is built so that eight or more of the world's 13 master root servers would have to fail before ordinary Internet users started to see slowdowns, according to John Crain, manager of technical operations for the Internet Corporation for Assigned Names and Numbers (ICANN)."
If I were only smart enough to accomplish the things I dream about.. Or maybe too dumb to care.
I think I understand their plan now:
1. Plant studip spamware on a gazillion computers worldwide
2. Head for a small island state somewhere in the middle of the Pacific Ocean and start blackmailing governments the world over by claiming to "0wn j00r 1nt4rw3b!". A gazillion children addicted to warez, pr0n and AIM complain to their respective parents, who demand action from their governments. Governments pay up.
3. Profit!
Then again, governments do have armies with guns and ships and stuff so things might get messy in the process. *shrug*
perhaps the whole situation isn't as bad as it seems. having read the article, one would realize that the author only hypothesizes on whether or not the network is secure. brilliant could have implemented all the things that he questioned as insecure. this is not a review of their technology, but rather a blatant guess at how their technology will work.
With the ability to remotely control a user's computer built into Windows XP in order to provide "tech support", isn't a good portion of the world already vulnerable to a well-written worm? See "Remote Assistance" at http://www.microsoft.com/windowsxp/home/evaluation / eatures.asp.
libertarianswag.com
You know, EULA or not... what Kazaa did is slimy. VERY slimy. They decieved people into installing something and giving up something they know people will not realize they are giving up. It is deception, whether it fits the legal definition or not.
I'm realistic... most people do not know or care of the difference, but they should.
So my question is...
What can we realistically do in order to force a bit more honesty in software providers?
True, (and belive me this is hard for me to say this next sentence...) I put more trust in Microsofts updater than Brilliants ... ick I cant belive I just said that :)
As such, all three proposed usages: Secure and secret storage, secure and secret computation, and secure content delivery, are all inherently flawed.
This is all to true. Therefore, given Brilliant digital's wicked corporate pedigree, we conclude that they must have a secret, sinister master plan that they're not telling us about.
They've been clever enough to use evil plans as a smokescreen - the plans they've described are just wicked enough that you might believe that they really are brilliant digital's brilliant evil plan. This means that the real evil plan must be extra... brilliant.
Basically, we can divide the possible real evil plans into three categories:
1) Defense related. They're going to hack into NORAD, and hold the world hostage from skull island. The fact that this is physically impossible (because NORAD isn't connected to the public 'net, and so on) never stops Dr. Evil, so it shouldn't be a hindrance for Brilliant Digital.
2) Biblical. Enumerate the billion secret names of god, conjure forth their lord and master, Satan himself. You all saw Warlock, right? Like that.
3) Astrononomical. I know that if I had the computing power of fiteen million consumer level CPU's at my disposal, I'd use it to pull the moon into the earth. 'nuff said.
Either way, we're talking countdown to doomsday, here, and only one man can stop them. I hope Brilliant Digital CEO Kevin Bermeister's mistress is played by Zhang Ziyi; she is so hot.
The good and new comes from no quarter where it is looked for, and is always something different from what is expected.
So you want security through obscurity?
/. place the story on the front page, Nicholas Weaver is essentially forcing the people behind Brilliant Digital to fix their security problems ASAP.
If this guy figured it out, don't you think there's at least a moderate chance, that some |33 h@x0r figured it out as well?
By going public, and as a neat bonus having
If they chose not to do anything, Brilliant can't claim, that they didn't know about it, if/when some |33 h@x0r hijacks 2 million computers and wreaks havoc on every single US government site just for fun, and they will (at the very least should) be held accountable as aiding and abetting terrorist activities, by not fixing the problems when they had the chance.
Security through obscurity is like not telling the world about AIDS. There's no cure for AIDS, so there's no need to tell people to be carefull, because that would not cure AIDS.
We do not live in the 21st century. We live in the 20 second century.
How does it affect me, when I haven't installed the program?
The answer to this question is painfully simple: You are connected to and attempting to use the same network. Internet users, slashdot readers especially, should appreciate the effect that(tens/hundreds of) thousands of "other people" can have on such a network.
" You're telling me that if they get hacked, the entire Internet is at the mercy of the hackers. Why is that?"
Because, the actions of millions of compromised machines have the ability to bring internet traffic to a standstill. millions of boxes, spread throught the world all participating in a coordinated DoS attack, would be, as the article states, "unstoppable"
Comments should be like skirts. Short enough to keep your attention, but long enough to cover the subject
Actually, I would hope this does happen. Why? Because it would put the frightners on FUTURE SPYWARE being installed and FORCE a GOOD SELF-DISCLOSURE POLICY STANDARD.
It would kill EVERY SPYWARE ON THE PLANET.
----- Whats wrong with this picture? http://www.revoh.org:1234/whatswrong
Just to make people aware that the trojan is also distributed with other FastTrack browsers such as Grokster. It is not just confined to KaZaa. I've never downloaded or installed KaZaa but I am running Grokster (with the spyware removed and dummy cydoor dll in place) and I was infected as well. If you're running Grokster check out your Windows directory. If there's a folder in there called BDE and you aren't running the Borland Databse Engine then you're infected as well.
Input error. Replace user and press any key to continue.
What about the Red Hat Network? I subscribe 'cause it makes my job as admin SOOOO much easier - but the RHN largely consists of servers with BIG, FAT PIPES.
(Who'd use RHN over a modem line!?!?)
Seems like this also might be an excellent point from which to launch a big DDOS attack, no? How closely does RH watch their servers?
I have no problem with your religion until you decide it's reason to deprive others of the truth.
You're absolutely on-target with that assertion.
I tend to look at our internet and our computing power on the level of 'health.'
Software designers should understand that they aren't just writing programs any more. We're not building new calculators with cool new functions. We're writing a great deal of software that interacts with a public network that affects the lives of everyone either directly or via the health of business and information exchange.
Business and commerce are now more tightly bound to our ability to exchange, gather and disburse information as a commodity.
I'll use Microsoft as an example but it's not limited to Microsoft... Cisco could easily be used as an example of a "responsible player" but I'm illustrating an "irresponsible player" at the moment.
Microsoft in putting out unstable software on the server side (and putting out clients that include servers to unaware owners) has severely affected the health of our public internet and I believe they should be held liable and responsible for their negligence on the matter. There is no law that says "you're a criminal if you write bad software" but there is law that says you are criminally responsible if, through negligence, have endangered public security. And in that respect, Microsoft should be held as criminally responsible for their negligence. And no amount of EULA protection should be allowed on this matter.
I suggest that Cisco wears a white hat in this simply because of reputation. They are not known for their security problems. They are not known for having 'viruses' or being vulnerable to attacks. Of course they are vulnerable. Of course they have bugs and weaknesses. But due to the fact that they are both huge and still manage to remain 'untargetted' is some indication that they are taking their public responsibility seriously and are successful at it.
If Microsoft behaved more like Cisco in that respect, I think the world would still be in love with Microsoft today though not nearly as appreciated because it's not in out nature to appreciate, but to find fault and hate.
Early 90's, the (usenet) world was shocked by the fact that somebody abused the network to send spam.
Early 00's, the (slashdot) world is shocked by the fact that people don't care about installing spyware / trojaned software.
Be afraid, be very afraid.
bash$
Why would you expect that? Recall that Windows Update got infected with Code Red, even though a security fix was available a month earlier...
To within half a percent, pi seconds is a nanocentury. -- Tom Duff
Since installing Ximian is "conveniently" performed by running "lynx -source http://go-gnome.org | sh" (as root, of course), what happens when someone registers go-gnom.org or similar typos? (Credit to my brother for thinking of that one.)
Now I did issue the above command, but ensured that the DNS records were compliant and my local DNS server reported the same distant end IP as the authoritative one for the domain, but I doubt many folks do the same.
Also, when installing packages via RedCarpet (again, has to be done as root), what are the cryptographic signatures checked against? (Note: I haven't even researched this. Just typing off the top of my head...) I would hope that the proper response from GPG is hard-coded in the red-carpet binary...
Basically, I think that a lot of new update technologies are vulnerable to this - from windowsupdate.microsoft.com as mentioned in the article to more trusted (by this community, anyway) sites. Semi-automatic updating is great, but it still takes people at the keyboard to think before they do something. Not likely to see a widespread change in that mentality for some time to come.
Well, the guy is most certainly smarter than me. I do respect him. However, rant is rant, despite the velvet on the emperor's robe. The whole text is nothing more than a rant, and conjecture. I hope his thesis papers are not written this way. It is sad when people, with good intentions, discredit themselves in this way. People don't know what they don't know. and nobody knows anything about Brilliant's sneak-ware. For him to create a thought-experiment of what he believes to be true(or false), and rant about it, doesn't afford him any credibility. So until he actually disassembles the Kazza sneakware, there is nothing to write about. The only good part of the text is his questions to ask about Kazza. The rest is hot air.
It isn't a lie if you belive it.
....too bad I can't mark this one as insightful... 'cause you're right. I hadn't really looked at it that way.
We do tend to idealize the past beyond its reality. Still... apathy harms.
Today everyone, no matter how smart, is submerged in a tide of information. The only way to survive and get anything out of it is to filter it. But how should one construct the filters???
Don't pat yourself on the back too hard, just because you understand computers. There's a lot more to this civilization than computers. And the rest is just as important.
All I've been able to do is demarcate a small area that I try to understand, and try to find other people that I trust to understand other areas for me. I don't know of a better method, even though that one is clearly flawed. Note that this is the same technique that almost all people adopt.
One of the critical flaws in the process is:
How does one choose trustworthy authorities? I sure don't have an answer. The best I can do is pick people that I don't know to be wrong for reasons that are unknown or unacceptable to me. This isn't great, but it's something. One of the good points about this system is that it distributes authority (I see centralized authority as inherently evil: consider that the central authority will have the same limitations [mentioned above] as anyone else, and the people that the central authority chooses to trust will have every motivation to give self-serving advice [as long as they aren't caught at it.])
I think we've pushed this "anyone can grow up to be president" thing too far.
Instead of following HeUnique's instructions to get rid of Kazaa's spyware, try this:
;P
DON'T INSTALL IT TO BEGIN WITH.
tempest303, continuing his crusade to troll people that think fair use means never paying for media.
The Free desktop that Just Works
There's no need to take over the Brilliant servers. An attacker should be able to do it all from any suitably modified Brilliant client.
If someone writes an effective Brillant-based attack, it might contaminate most of the clients in a very short period of time. And most of them woudn't even notice, until it was too late.
Brilliant isn't exactly a tech-savvy company, either. Their previous business was producing hip-hop videos. They have 18 employees. Plus one software consultant. (Read their SEC filing.) They have no track record of producing secure systems. They make no claim that their product is secure against external takeover. And they don't have enough assets that if they screw up, they'll be able to pay for the damage.
If you have responsibility for any computers that do anything important, scan them all for this program immediately, remove it, and block it at your firewall.
It's possible that the Brilliant "projector" is so secure that it can't be used as a pathway for an attack. But without independent verification of its security, it has to be viewed as highly dangerous. All it takes is a buffer overflow and some carefully crafted "ad content" to use this as a virus distribution system.
Some of the same potential vulnerabilities apply to other peer-to-peer systems. Netnews/NNTP, for example. But Netnews is typically run on UNIX machines under its own userid, so even if an exploit in it exists, it can be contained within the Netnews world. And it's a mature system; the obvious holes were plugged long ago. Most of the other peer-to-peer systems, like Gnutella and Freenet, are pull-type systems; they only bring in content when the client asks for it in response to a user request. That slows down propagation and associates it with specific content, like an ordinary virus. But Brilliant, from their description of what they do, pushes automatically and peer to peer. That's much more dangerous.