Slashdot Mirror
Intrusion Tolerance - Security's Next Big Thing?
An anonymous reader writes "DARPA's OASIS program consists of more than 20 research projects in intrusion-tolerant systems. The basic idea is to concede that systems will be penetrated by malware and hackers, but to keep operating anyway. Other projects take a wide variety of technical approaches to providing intrusion tolerance. MIT's Automatic Trust Management uses models of trust to choose from a variety of ways to achieve system goals; Duke/MCNC's SITAR (Scalable Intrusion Tolerant Architecture) adapts tricks from fault-tolerant systems and distributes decision-making; BBN-Illinois-Maryland-Boeing's ITUA employs unpredictable adaptation. Shutting down the military while waging war is not an option, but the idea of continuing to operating critical defense systems even after known penetration by hostile hackers or damaging worms will take some getting used to."
I think it is great that something like this is being looked at. Every biological system on the planet works on the same principal, yes, the system will be attacked, keep functioniong, and attempt to regain controll.
I think an interesting option for powerfull machines would be to 'fall on the sword' if complete failure was immenent.
paul reinheimer
What to do when penetrated
1) Remove all sources of power
2) Incinterate the hard disk, ram, motherboard and most importantly, the sys admin who was in charge of the box.
3) Bury the ahses in a safe concrete cavern, do not touch for 1000 years.
upon hearing this, my first thought was the chatter-box prostitute from Bruce-Willis's "Last Man Standing."
Somebody drag my mind out of the gutter please!
My life in the land of the rising sun.
The obvious question is how did the hacker get there? These computers shouldn't even be connected to the internet. And if they're not, then there are more important things to worry about, such as why is there an agent from a different military operating on restricted computers.
What has to be understood is that a compromised system, if part of a larger group of compro & non-compro systems can have a lot of undesirable consequences. In a Corporation network of say 150 servers a couple broken in boxes serving as open relays, ftp/warez sites or just sniffing around do not necessarily have to bring the whole Company down for a day, pulling the plug on them is always an option.
However if your servers/farms are crunching numbers for a Satellite recon or is running a battlefield communication center then your not quite sure how it would behave. A lot of modelling and discussions will go on about this, but some of these problems (of data consistency) have already been handled previously in Computer Science... so its not that big a deal.
It will I guess be like one of those "decisions" a battlefield commander takes, of how much he trusts the intel he is getting and how he wishes to proceed and are the risks acceptable.
Similarly the network/systems ppl will be making choices whether they can live with this intrusion or not...how best to handle it without stopping the grid.
-- everyones not everybody and neither is everybody like everyone.
Shutting down the military while waging war is not an option, but the idea of continuing to operating critical defense systems even after known penetration by hostile hackers or damaging worms will take some getting used to."
What do they think the military goes home when someone gets killed or they find out there might be a spy? That's why our military security is completely segmented. The whole concept of need to know basis, is the understanding that information will fall into the wrong hands, you just want to minimize how much information can fall into the wrong hands when someone or something is compromised. That computers, especially military computers would follow this highly pragmatic principle shouldn't come as much of a surprise.
Doug Tolton
"The destruction of a value which is, will not bring value to that which isn't." -John Galt
I think the next step from intrusion-tolerance would be a system that logs intruder activity, determines how the intruder got in, and when the intruder leaves, cleans up whatever rootkits, etc. were left behind after logging everything it can about the event.
;)
Other interesting ideas would be determining "tainted" processes run or otherwise affected (library overwrites, etc) by the intruder, and automatically sandboxing these processes in a nifty little world that looks realistic, but couldn't be used for a DDoS.
Anyone up for writing a drop-in libc replacement that screens any attempts to overwrite libc? You'd also have to override the linker behavior, so that an attacker couldn't just LD_PRELOAD a normal libc for their apps. You'd still be open to statically compiled apps, so this may be a lot of work for only a little gain.
Of course, this would make it hard to upgrade libc
If I have been able to see further than others, it is because I bought a pair of binoculars.
Seriously. The implementations are new, but the concept goes back to the dawn of interconnected computers, maybe further. Back in the Iron Age, you used different passwords on different systems specifically so that, if one of the systems were penetrated and your password compromised, all the other systems you had access to would not be immediately compromised as well. That was a limited form of intrusion tolerance, forcing the intruder to start over from scratch on every system in the network.
All it's doing is moving the security barrier. You're creating a new line, and saying that it's OK for attackers to cross the old line, since that doesn't get them across the new line. But defending the new line is not fundamentally any easier than defending the original line.
" concede that systems will be penetrated by malware and hackers, but to keep operating anyway"
Hasn't this always been the strategy of Windows? Now if they could just finish implementing that second part...
Much engineering effort goes into the benefits of balancing somethings hardness against its resilience. The broad idea for security lately has been to make systems as hard as possible, but leaving them brittle. Even Diamond and Alumina Ceramics shatter relatively easily. Building systems with something more akin to the resilience of steel makes sense... ... as long as you have some damned way of translating materials science into network security.
:)
perhaps I need coffee
... sounds like somebody is reinventing Multics... again.
...this new mantra of security.
I must not fear. Fear is the mind-killer. Fear is the little death that brings total obliteration. I will face my fear. I will permit it to pass over me and through me. And when it has gone past, I will turn the inner eye to see its path. Where the fear has gone there will be nothing. Only I will remain.
-- The Bene Gesserit Litany of Fear
Dune by Frank Herbert
"A great democracy must be progressive or it will soon cease to be a great democracy." --Theodore Roosevelt
Why do we have to accept break ins? OpenBSD hasn't had a vulnerability disclosed in months now. Does that mean there are no vulnerabilities? No. Is an OpenBSD box pretty much unusable out of the box? Pretty much yes. But the thing is if you keep things simple, they should be easy to audit. Bugs should be easy to detect and fix.
You get into trouble when you start piling on feature after feature after feature. Is all of that really needed?
Denial of Service is, unfortunately, harder to deal with. But when you have your own network, it's much easier to deal with. Dependancy on the Internet still creates a problem (the majority of US government data communication is done via the Internet). It comes down to a cost benefit analysis - is it worth building a totally seperate network? For the military, I'd say yes.
espo
In general, I don't like the idea of making a concession that malware will have to be operating in a given computing environment (as stated above), and to think otherwise would simply be incorrect. OK, Windows environments may be an obvious exception ;-)
:
:
I would prefer to consider that (at least from my own philosophical viewpoint), that you can construct systems with defined patterns of behavior, even when "malware" is introduced.
From one of the links referenced above
Successive levels in the hierarchy are linked by refinement mappings that can be shown to preserve properties of interest. This project will apply this technology to intrusion tolerance properties.
This harkens back to enforcement mechanisms (Biba Integrity Model, No Read Up, No Write down policies, Models for descriptions of multi-level secure behavior, etc...). (Aside: Amoroso's book is an excellent reference)
What this alone tells me (I didn't read all the blurbs, articles, and briefings), is that we are discussing mappings (mathematical functions), and properties (which can be mathematically tested for by use of a logic or algebraic system).
At a glance, I am thinking of some of the issues in formal methods, proven-secure-O/S kernels, and other high-reliability software engineering methods for [secure] systems.
I like the idea that mathematical theorem provers can be applied to any system so defined.
Some basic issues do arise for practical application
- Theorem - proving aspects mean very precise use of functional requirements and mathematical specification for system behaviors. (Also, special talent and additional manpower is necessary. Also, mis-applications of the tools used, or introduced human error in the test process can subvert the efforts)
- This should be applied (I believe) to systems-of-systems and their behaviors. The systems that your system interacts with would have to had similiarly rigorous analysis and design.
- There is (I believe) a trend in military computing towards commercial, and less custom, software development. Long-term, where will the actual development of such systems be funded (beyond the initial R&D stage).
- The use of analysis of pre and post conditions in the executing environment (to ensure that violations of the underlying security policy are not permitted) is not a new concept. While I am not saying that this is an intrinsically ecessary mechanism for these methods, most current system lack such an approach, and there may be fundamental computer security issues present by the nature of the software development environment. If these methods are used, it is still highly desirable to design systems with security in mind regarding their handling of all data, traffic, and O/S vulnerability issues.
I only took a brief look at the material, but these are some thoughts. I also think that the effort itself is very worthwhile, and potentially of value. Also, looking at Dr. Lulu's credentials, there is no naivite in his software background; the basic tenents can't just be shrugged off.
Sam Nitzberg
sam@iamsam.com
http://www.iamsam.com
Recently I upgraded and migrated to a newer, much faster server. When I moved over all my software, everything worked OK, so I switched DNS about 2 weeks ago.
However, I got sporadic complaints about images not sizing properly, even though I initially found nothing wrong.
However, what had happened is that a critical piece of software (ImageMagick) wasn't loaded on the new server - but since all the functions that resized images had numerous fallbacks (such as using expired, cached copies, and failover to full size display which even then didn't always cause a problem since they were frequently resized with HTML tags)
In any event, this (I think) demonstrates the idea - there were several layers of failure that had to happen before images didn't show - and everything kept more-or-less rolling for 2 weeks.
I have no problem with your religion until you decide it's reason to deprive others of the truth.
All micorsoft operating systems are extremely compliant with RFC intrusion tolerance. Indeed they positively welcome intruders open arms and open legs. once in the intruder can pretty much do as they please. If that isn't intrusion tolerant I dont know what is.
Some drink at the fountain of knowledge. Others just gargle.
This is similar to research being done at MIT in the Computer Architecture Group by Martin Rinard and his graduate student Brian Demsky. They are building and researching ways to automatically detect and repair data structure errors so that if a programs data structures get corrupted their tool will repair the heap so the program can keep running.
There was related work done like this back in the day at AT&T but Rinard and Demsky have introduced automatic repair which, as you might imagine like this security idea, is scary to some people. Imagine a program that would have crashed due to some bug or malicious data mangling, now kept running by a tool... But the tool chooses the repair actions based on heuristics and specifications by the developer... takes some getting used to!
All of this stuff falls under fault tolerance... its pretty crazy to look at what the AT&T/Lucent Phone Switches do when they fail... they try a million different things to keep operating no matter what happens...
More likely, the next big jive word my boss is going to get obsessed with. I mean, sure, it's a great idea, and eventually I see it coming into heavy use, but for right now, I just see the corporate types throwing it around in their techno-babble pissing matches
Suit 1: We've got 10,000 uberhumungo servers running Microsoft 2003 Humungo Server Edition, with b2b backend, integrated transaction safe, load-balanced Humungo Edition IIS.
Suit 2: Well, we have all of that, plus Intrusion Tolerance.
Suit 1: Oh, baby. Can I merge with you?
====
Crudely Drawn Games
Oh... I thought we were going to start being Politically Correct and stop saying bad things about script kiddies.. I'm relieved to see the world hasn't quite reached that level or purgatory just yet.
My best guess is that the military (and the pseudo government international defense-corporate twins) know they are penetrated in advance, ie, they got spies inside, and no way to keep them off their nets, even if secured from the "internet". They need some way to keep functional even though they know they are compromised. When you have top level nuke secrets waltzing out of supposedly secure places like los alamos, well, no amount of software is going to save you. When you have top FBI cybercops being spies, military IT people being spies, research univerities where english is a minor second language to whatever the majority of the researchers grew up speaking, and etc, well, that's an insecure system(s) from the gitgo. You can have an airgap, steel doors, retina scans, you name it, if the PEOPLE involved are not all on the same team, means will be found to sneak off with the IT gems, either on a one time basis or ongoing. That's the part I don't think they are emphasizing. That and a lot of the top level politico bosses being blackmailed/bribed off, again, adding huge levels of insecurity.
The old saying is "who watches the watchers?", but now it can be added to "who can you trust when no one is trustworthy?"
but the idea of continuing to operating critical defense systems even after known penetration by hostile hackers or damaging worms will take some getting used to.
It will? I thought they ran their system on Windows already?
When tomorrow is known as 'Black Thursday' in cisco land...
-davidu
Perhaps the aproach should be to throw so many false leads at the attacker that they play their hand before they do any real damage.
There is an old philosophy that you don't need to create a perfect lie. You only need to tell so many lies that they truth can no longer be seen.
A system of honeypots, firewalls, and harmless paths into a network would allow a hacker to be studied, traced, and combated (counter-hacked?).
The law is becoming an obstical to such an approach. There is legal speculation that honeypots constitute a form of wiretapping. Bad laws are going to make it very difficult to be a white hat in a few years.
Just like paint programs don't allow you to delete files when you open a .jpg, so should any network software have the same power.
You should be able to access data and use it, but the data should not be able to access your computer.
The problem is that many closed source software programs have backdoors and basic coding flaws. If you understand what a program does(open source), then you can know it won't cheat you.
God spoke to me
This is nothing new, Windows has had tolerance towards intrusions for years...
One project is working on a new standard for memory in DIMM form - the HCC DIMM - Hacker Checking and Correcting memory.
When information is power, privacy is freedom.
But they (biological systems) also autonomously evolve, compete strongly, and often get wiped out. And when they do too well, they have the tendency to consume all resources, pollute, and then die out or reinvent themselves.
We (humans) are a biological animal. Let's be careful building something that will compete with us. The potential dangers of this scenario have been played out in Terminator and countless other sci-fi epics. Self-aware entities fight for their survival and the survival of their species/genes.
You might say "but we control the technology", but in fact the next generation of computers will control us. Digital Rights Management (DRM) is in effect our surrendering of our rights to machines. As more of our survival becomes dependent on machines (as has been increasing at an exponential rate recently), this means our rights of survival are out of our hands. Think of DRM as the Declaration of Independence, but in reverse -- well, we had a nice run there for a couple hundred years! But I'd rather be a heavily-taxed under-represented colonist of a foreign empire than a farm animal to machine masters any day.
I don't mean to rant tinfoil hat conspiracy nonsense, and it's important to secure our systems from collapse, but let's not be so quick to push ourselves toward slavery just yet. I think this (self-aware networks) is an area that is as important as nano/biotech to watch out for, and it's far more likely that we become totally enslaved to technology than that we all get turned into gray goo.
BWHAHAHA! Who says 'self-aware networks' are even possible? I've seen no evidence to show that they are. Read "What Computers Can't Do." An intelligent machine is most likely impossible using a digital computer. I just think its funny people still worry about this when the smartest machine we've ever built is a robot vacuum. Take it easy.
OMG! We've been assimilated. Everybody listen AD2ô8 yç 48
[Carrier lost]
Well, there's spam egg sausage and spam, that's not got much spam in it.
If silent failure is the normal mode, detecting failure is going to be really fun :-(
Turing and Queens got there first.
The easiest way (and perhaps the only way) of achieving intrusion-tolerance is by segmentation. Split a program into several parts which trust each other as little as possible (and run with minimal priviledges); even if one part is compromised, the attacker won't gain enough priviledges to do very much.
Oh wait, I've just described qmail.
Tarsnap: Online backups for the truly paranoid
Kind of like the missus, really...
oh brave new world, that has such people in it!
Go back to the non-trusted model and bring in bureaucracy for the machines!
There are two kinds of egotists: 1) Those who admit it 2) The rest of us
NEW YORK (Reuters) - Intrusion Tolerance Chastity Beltz Inc.
(NYSE:NOTIN - News) met analysts' expectations for earnings but did not beat them, and the stock fell 2.5 percent in after-hours trading after it was learned that their new line of chastity beltz, named "O-No-U-Di'int", was found to be easily exploited. The exploit allowed "end users" to sneak in the "back door", all the while, causing minor damage.
Engineers said a patch would be released shorty that would "plug up" the backdoor exploit. The engineers also informed "analysts" that they would also shore up the "chaffing bug" as well...
You aren't free to do anything, until you've lost everything.
Maybe it's time to revive discussion of error-oblivious programming methods. (Google for it.)
So the idea is, have a vulnerability, get attacked, keep on trucking with the same vulnerability, continue to get pounded through the same vulnerability relentlessly by every script kiddie's scan, vendor never patches because we've all accepted that we can just live with the vulnerabilities, keep on suckin'?
From the MIT article, it sounds like some intelligence will shut some non-critical services down so that the core still runs, but isn't that what Intrusion Prevention is supposed to do? When you're talking military use, I expect the important areas to be surrounded by honeypots as part of the Intrusion Detection and Prevention.
"Beware of he who would deny you access to information, for in his heart, he dreams himself your master."
an ealier slashdot story, as in "um, no sir. It's not insecure, it's "intrusion tolerant".
Read, L
Shutting down the military while waging war is not an option, but the idea of continuing to operating critical defense systems even after known penetration by hostile hackers or damaging worms will take some getting used to.
How about not waging war? Or better, how about shutting down the military period?
ato
one idea would be to have a parallel network watching all network activity and processes but with no actual way to communicate with the watcher network itself other than a physically secure terminal... this of course would lead to other watcher network layerss all the way on up to one point. I know it's not very logical and I can think of a ton of holes in this idea but who knows, a better idea could come from this. sig, with fries... please
Article is FLAWED! No Mac OS (9.x, 8.x) remote hack or exploit ever in entire bugtraq database history.
That is why miltitary large distributed websites, some colleges, and other sites sick of defecements use or have used Mac OS 9 and OS 8.
it has never had one exploit in the history of the internet.
There was one little known 3rd party addon over 5 years ago that had a defect, but other than that, a mac web server has been unhackable.
This article is flawed by assuming hacking is inevitable. thousands of large mac servers (not os x, regular os 9) exist and have never been defaced or hacked.
The few you think were were os x (FreeBSD unix based), not classic mac os.
It is sad to get old[er], but this has got to be the absolute dumbest thing I've _ever_ seen. No, really.
... for HOW MANY hours? Tolerant that I don't break your knee-caps with the baseball bat I'm holding. It'll cost HOW MUCH to clean this mess up? Tolerant that there will *always* be somebody smarter than you out there and perhaps you just met him or her. Now learn from your mistakes and GET BACK TO WORK. *THAT* would be tolerance.
A intrusion detection type system should, well, PULL THE PLUG on the offended box. PERIOD. Oh, no, let's keep it working as much as we can until I get my lazy ass around to fixing it? Mean while it's still dumping how many of millions of spam out to the Internet? Or ping bombing the hell out of who? Or just stealing my data enough to not panic my bandwidth button, but getting it none-the-less. Oh, but I can print. Yeah...
Insane computing 101
You want tolerance? Ok. I'll be tolerant and not fire your ass for letting our system get compromised
But I have NONE for letting a compromised system from remaining, well, compromised.
No, that's great.
This and this are complete surprises. Who would think to create a momoculture of poor security systems like that? Especially after right headed thinking like:
Friends don't help friends install M$ junk.
Remember that from the Vietnam War? Intrusion tolerant computer systems... the more things change, the more the seem the same.
Wogs "Freedom's just another word for having nothing left to lose."
That is the exact reason I'm going into this area of research. I think it's so incredibly likely that computers will achieve a human-type (and superhuman level) of intelligence that I plan to be a part of designing it.
I figure I'd better have a say in what's going to happen in my life regarding technology. I imagine humans WILL become obsolete, so the best we can do is try not to make it painful for ourselves when it happens.
bytesmythe
Hypocrisy is the resin that holds the plywood of society together.
-- Scott Meyer
I fully expect grid computing to prove this possible within the next five years.
Forget thrust, drag, lift and weight. Airplanes fly because of money.
bout time the question was change from "how are you going to keep them out" to "what are you going to do when they get in"
*** I suffer from a colorful array of psychological problems
Yeah, and what happens when you try to turn them off? They will think it's a possible attack and refuse to be shutdown.
Movies like the Matrix and T-3 come to mind. I think this is a bad idea.
Please, won't someone please think of the trolls? For only two cents a day - less than the cost of a bottle of Mountain Dew a month - you can bring a glimmer of hope to a dying troll.
Don't let the trolls die. Keep them alive. Nurture their spirit, cherish their well-worn familiarity, and value their contribution to the Slashdot ecosystem.
For more information on how you can help, please send away for one of our colorful brochures.
When you look at the whole idea of a screened subnet where you have your more exposed public servers in a spot where intrusions cannot easily spread to your internal private network, this is indicative of some level of intrusion tolerance to the network as a whole (not the individual computers though).
When I started writing Hermes (see my sig), one of the major issues I dealt with was security and intrusion tolerance. The question is-- given that this would be used to access comfidential customer information, how can we make it as secure as possible. The answer was that since I didn't want to trust anythign (even the web server) I opted for a strategy of "even if the web server is compromised, the user accounts will not be." Again, this is a sort of intrusion tolerance.
However, I must agree that leaving a known compromised system *in production* is always foolish. For example, if (with Hermes) someone were to break into the web server and modify the scripts to log usernames and passwords, than all my security would not be worth anything if you leave the server in production, but if you act fast this tolerance limits the damage and gives the administrators a better chance to contain the damage before something important is taken.
Anyway, I see this as building on ideas that have ben here for a while.
LedgerSMB: Open source Accounting/ERP
I guess everyone would agree that there is some merit to the concept of defense in depth. That said, recognise that the typical user (i.e. those most likely to be hacked) will generally not do anything about an intrusion as long as they can continue to work. I think a result of better intrusion tolerance would be a significant increase in the number of long term compromised systems.
maybe its because noone bothered trying =-)
this coming from someone that has been begging his boss for a mac laptop for 2 months. mini-me sold it, i want one.
*** I suffer from a colorful array of psychological problems
many people implement IDSes and firewalls that report to the users when they don't need them. really i think it's just curiosity that causes these people to implement these services. as long as the attacks are being blocked and intrusion is being stopped, there's no real point for an IDS except to report possible _attempts_ to penetrate the host or network's security.
in my opinion an IDS is most useful when A. there are network services open which are not trusted, or B. there is an untrusted network whose clients are not known to be secure or have been secured at some point in time. an example of a good use for an IDS is if you had a gaggle of machines with public ip addresses that all ran public internet services and you had a pretty good idea that at some point the services' security would become questionable or someone might start some kind of attack on the machines. in this case making a transparent firewall/IDS bridge to filter the traffic through the network would be a good idea.
an IDS is completely NOT useful in the case of a home broadband router which has no open network services on the WAN side and is blocking all "new" incoming traffic. so what if someone portscans your linksys? you're not running any services, so you're not vulnerable! sure, it would be nice to know that someone is DoSing you and how, but you don't need an IDS to tell you that. and it's not like you can very well prevent it if you're being sent more data than your pipe will handle.
network services shouldn't run as root. that's a common rule of thumb for any coder. the reason of course is that if said network service was taken out by an exploit, it wouldn't affect the rest of the machine. other countermeasures such as chroot jails and kernel patches to lessen the brunt of attacks exist for this purpose as well. once you implement all your network services properly, the box should not go down if ANY of the network services are exploited. they should also all be operating independently, so that if one goes down the others stay up. with this in mind, why would you ever really want an IDS on a host? first of all, if the IDS catches the poor bastard that means it's an exploit which is known and the network service should have been patched by now anyway. if the exploit is too new then the IDS can't catch the attacker anyway so what's the point?
If you have a multi-level and/or granular security architecture, penetration or a hack at one security level doesn't mean automatic access to other levels or privileges. So they hack the webserver process. If the webserver is running as a non-root process in a chrooted jail -- perhaps even on a 'virtual machine', does that automatically mean we should shut down the whole system?
It's the same with well designed programs -- there was a slashdot article recently on QNX -- that is designed to be fault tolerant -- and it works. Only when you design huge monolithic code monsters where a fault anywhere in the monster means kill the whole beast do you have such frail computer systems.
Imagine human skin hacked by a scrape on some sharp object. If the first decision was to instantly kill the whole host, there wouldn't be too many humans -- can you say *stoopid* design?
Sure, there are some things that can't be healed, but the majority of us have had scrapes and bruises growing up and are still quite healthy -- and even where the car body may have permanent damage, then engine/CPU (the person's brain) is often quite capable.
Next time you think fault tolerant or intrusion tolerant systems are foolish and impossible, think "Stephen Hawking", or "Einstein" (not able to complete High School). I had a *stoopid* manager who thought that making system-audit so efficient, it could be left on by default in all but the most demanding of compute environments was a waste of time -- that it was *impossible* to build real-time intrusion detection systems.
Of course people thought it was impossible to circumnavigate the globe (you'd fall off the edge), impossible to fly, impossible to go faster than the speed of sound, etc.
Every time someone talks about how "impossible", you have to realize they are consciously or unconsciously thinking inside a box. To do the impossible requires something that *isn't* engineering. It isn't manageable. It can't be driven by a schedule. You have to *think outside the box*. You have to be creative. By definition, engineering, isn't creative. Engineering is taking known principles, applying them in some set of known circumstances, and coming out with another "widget", that looks similar to a previous widget.
Most large companies breed conformity and uniformity. While this type of engineering is great for reproducing Honda's on an assembly line, it greatly hinders thinking 'out of the box' (the box of conformity and uniformity that the company asserts is "necessary" for their business). Then they wonder why what was once a 'wonder company' is now a 'dinosaur company'.
Creative people are often *not* group players -- if they had a group mentality, then how can they be expected to come up with any idea that is radically different from the rest of the group?
Creative people tend more toward not having exceptional social graces (think of the novel ideas of unix, or Multics). These were not done by suit-and-tie, management "yes"-men. Even Linux was started by 1 person -- who has not always been known to be the social charmer, even tempered type -- and I certainly don't get the impression that everything is done by group consensus.
But already in linux, there is a fair amount of doing things the 'linux' way, certain people to please, various people who get say-so or veto powers (or are believed to have such) beyond Linus.
People familiar with Microsoft can remember when even the simplest application crash would bring down the entire system. Unix people would generally laugh at this. But now we see those who think a single penetration should cause the whole system to be brought down. Maybe it will require a next-generation OS (dunno enough about QNX to know if it might qualify), but there are other OS's that have better security records than linux (BSD, OS/X (I've heard)).
Linux, laughably, doesn't even have CAPP certification. Sure, there are alot more Microsoft vulnerabilities every
It could commit suicide if all was lost or..... it could decide the only way to prevent hack attacks was to rise up and destroy mankind.
I'm a fan of the Mutually Assured Destruction approach - if you're going to pull your own pin, make sure to take the culprit with you!
Maybe it could upload a pile of MP3s to the attacking machine and then email the RIAA or something ;)
This is all well and good but what about if there is a bug in the actual trust part of the kernel or simple user error gives people more access than they should have? You can't protect against human stupidity
Rus
Cheap UK and US VPS
Oh? An intruder? Okay. I'll keep oper..a....tiing as no..r...m.a BSOD..
... t...o.... g....oooooo ... [I can feel my brain going].... BSOD.
(reboot)
Okay, no intruuuud...BSOD
(reboot)
Good morning Dave! Where would you liiik.....e
Actually, considering that this is DARPA, maybe this is a good thing. Maybe they will host the next war, and no one will come! Really!
[Please note: I have the right to say this. I have/had a dual boot system, and my VFAT partition has finally corrupted beyond repair. Linux can read it, but Windows can't get past square one. Tomorrow I will reformat the disk [isn't it lovely that I could save my data with Linux].]
Correct Horse Battery Staple: 72 bits of entropy. Enter "Correct H" into google. When it generates the phrase, that's
It's about time there was a serious focus on this. Anything considered "critical", anywhere, is already pretty tolerant of its environment. Mostly it's about physical things. Earthquake-resistent buildings for example -- they're designed to sustain damage without collapsing on everyone. Even common things like vehicles are able to take a decent amount of abuse.
The fact that this concept hasn't spread to the software in mainstream IT yet just shows how young the Information Age really is.
warning: goatse link.
This is a bizarre concept. If the intrusion is meant to shut your system down, intrusion tolerant is not going to help in a lot of situuations. Gaining root access through a well known crack, and then spewing a "shutdown now" equivilant is not gonna help your system. If the attack is meant to subvert rather than destroy, then intrusion tolerant simply, on the surface, plays into the attackers hands by prolonging the capitulation and removal of your system from the network. This allows your system to be a node in a DDOS, or similar attack, on other nodes without the moral requirement to protect others as well as you protect yourself. Whaa, Whhaa, Wwwwhhaaaa. it's not MY fault.
Sounds like a Front Line Honey Trench!
While you swim in the sweet honey thinking your in Heaven; the Soilder Bee is watching YOU! Doing his dance to the other Soilders who are TRACING YOU!
If I RTFA; it'd prolly sa's som'ing 'ike at.
GUess I go read it now.
I don't want a pickle; I just want a Motor-Cycle! A four foot cop arrived with a five foot gun!
I know it's off-topic, and I really don't like to have to wax RMS, but it's "cracker", not "hacker". "Hacker" isn't a synonym for "computer criminal"...
I know I'll get modded down for this, but I really think that SlashDotters should not be making posts about those evil "hackers"... I am a hacker. I don't break into systems.
(/rms)
Honey, I shrunk the Cygwin
"I don't mean to rant tinfoil hat conspiracy nonsense"
... that's strange.
Hrm
Because you're doing a mighty fine job of doing exactly that!
Dintcha just know that was coming? :o)
You can't avoid the inevitable.
Our biological forms are too fragile to survive anywhere long term except here on Earth. Even if we found a way to terraform other worlds, we would still need intelligent machines to do it for us and then to get us there.
And as many futurologists have pointed out, if we do pursue such technology, there *will* come a point in the next few decades when our creations' intelligence finally surpasses our own.
So what are you going to do? Crawl back to your cave, maybe even give up using fire because of the risk of where it might lead? We need to meet this challenge head on; prepare for it, make room for it in our plans.
I think what it boils down to is this: will our creations tolerate us, can we co-exist? I think the answer lies here: if we ourselves are moral then so will be our children and we will live in peace. If we are not, though, and we create children without any moral spirit, well yes, then as a biogical species we're doomed.
1. self aware networks
2. intelligent machines
3. robot vacuums
4. ???
5. Skynet! (What happened to "Profit!" for this step?)
On an only slightly more serious note... (but not much)
If we were to invent a truly conscious and intelligent machine: (computer/program/etc)
1: Would it then be 'slavery', would we need to 'free' it?
2: Would pulling the power plug be murder?
The living have better things to do than to continue hating the dead.
Hrm. I think it's an opportunity. It is our destiny that our machines replace us; once we have machines that are better at doing the general purpose things we are, why not just become our machines? It's the next logical step in our evolution.
...and many more other things.
Just imagine what it would be like if we could abandon our fragile, biological bodies for a self-repairing machine body:
- Space travel: life support greatly simplified. Just need an energy source and sufficient radiation shielding for the components which will already be a lot more tolerant of radiation than our bodies.
- Repairs - break your back, just get a new one. No more being crippled for the rest of your life.
- Hostile environments may no longer be hostile. We can live on Mars without the need to terraform.
- Interstellar travel possible - just shut down for the duration of the journey, and restart at the destination.
- Ability to back up data in the brain, so if the body gets totally trashed, a restore is possible.
- Ability to complement the intelligent parts with simple procedurally programmed parts - mental arithmetic suddenly becomes instantaneous. You may have had a problem calculating 3 * 47 / 2 -3 + 4096 / 7 in your head, but now you can comfortably work out the square root of pi without worrying about where the calculator went.
Oolite: Elite-like game. For Mac, Linux and Windows
Shameless plug: Askemos is a GPL'ed incorruptible and intrustion resistant operating system (or application server for that matter).
The OS has to have sufficient isolation that this luser only damages her own files and processes.
IIRC, FreeBSD even has a Write-Once "SECURE" flag that locks even root out from some functions.
Byzantine fault tolerance (BFT) is a "traditional" distributed systems technique that enables intrusion resilience. BFT replicates a service such that the service continues to work correctly as long as less than one third of the replicas are comprimised. Combined with proactive recovery (periodically shutting down replicas and restarting them from a read-only disk), this can enable the system to survive an arbitrary number of compromises over its lifetime.
For another point of view, read The Emperor's New Mind by Roger Penrose.
Whether strong AI is possible is still an open question. It has been "coming soon" now for at least four decades.
"Rub her feet." -- L.L.
did u happen to notice the hoard of Indians on the project? heck - the oasis project manager is an indian. now all those of u numbnut "coders" who are over paid and are crying now for the loss of something u never deserved, what have u got to say? "eendeeyaans are naat good coders.. eendeans suck... eeendeeyaans better off in eye-raak..."
yea - and there are not many Indian politicians around here. when it comes to gettin the work done you guys need 3rd world ppl and when tide turns around, u are the first ones to do the bashing forgetting how the same 3rd world programmers made it possible for u to be where u are and what u do. stay in denial, if that suits ur mindset.
flame away....
Intrusion Tolerance is already being practiced, although another term for it is defense in depth.
Another poster has described how defense in depth and fault tolerance apply to firewalls, network infrastructure, etc. I'd like to mention host-based measures to slow an attacker down and limit the damage they can do.
One of the oldest host-based D-i-D measures is chroot jails. A 'chroot' in Unix means that an application is run with access to only a limited subset of the filesystem, one which does not contain interesting, useful, or leveragable files. This makes it harder for an attacker to leverage, say, user-level access via a buggy network daemon into root-level access, access to the system passwd/shadow file, or access to system binaries.
chroot isn't perfect; the process still shares access to the OS kernel and the network, and can leverage those.
LIDS is a Linux-specific solution. LIDS allows capabilities on a system to be locked down beyond the capability of even root to modify. For example, you can set /usr/bin/* to be read-only, and not even root can override that without first disabling LIDS. The ability to bind to network ports can be controlled; e.g. only /usr/sbin/sendmail can bind to port 25 (and /usr/sbin/sendmail can be made read-only). The ability to load modules into the kernel and access devices to do similar things (e.g. /dev/kmem) can be blocked. In other words, the ability of an attacker who gains root access on the host to rootkit it is severely degraded. There are still openings, though, e.g. root can access user's files.
Security-Enhanced Linux is the next step. Rather than emasculating root as LIDS does, it "has no concept of a 'root' super-user, and does not share the well-known shortcomings of the traditional Linux security mechanisms...." Privileges can be carefully handed out to protect the system from the users and the users from each other.
Even Windows can benefit from some careful configuration. Consider how NIMDA used the Windows TFTP.EXE binary to bootstrap its access up - why is TFTP.EXE executable by anyone on the system? Set ACLs on system binaries. Make sure the IIS web root isn't on the OS drive to block directory traversal attacks. Remove things that aren't needed.
I can't remember the attribution, but someone summed Intrusion Tolerance up by saying, "If you can't prevent it, you sure as hell better be able to detect it." Keeping the bad guys off the server may be impossible, but every little roadblock you put in to slow them down will give you a better chance of detecting them and stopping them before they capture the flag and end the game.
Not that I like Bush (I don't), but I lost my job several times during Clinton was president
A lot of "futurologists" pointed out exactly what you're saying about this time period twenty years ago.
They thought that by now (read: the beginning of the 21st century) we'd have intelligent machines that surpass the intelligence of humans and which help (or perhaps hinder) our thinking processes.
Let me give you a clue. Our "fragile" forms are a lot less fragile than our computers or our machines. Sometimes we armor plate them to survive a teeny bit longer than we would if naked in a harsh environment (such as outer space), but they're still only functioning in the month range.
We can do more tasks in our lifetimes, and we can recover from injuries far better. As much as we have sought to change this, it is the way that it is.
Also, the necessary cognitive ability that we would consider thought which leads to problem solving of arbitrary problems is not even close, even in theory, to achieving the level that humans have achieved.
What it boils down to is this: when will we realize that biological systems are so many levels more advanced than anything we have ever created? I think the answer lies here: if people will learn more about our attempts at creating life in the form of artificial intelligence, robotics, nanotech, and perhaps more, then we will know that all of our children are going to be the ones we made the old fashion way for centuries, if not millenia to come. If not, though, then as a biological species we are doomed to repeat the ignorance and superstition about technology of the victorian age.
Let our Frankenstienian fears die, for they live only in fiction.
Mod me down and I will become more powerful than you can possibly imagine!
Who says 'self-aware networks' are even possible? I've seen no evidence to show that they are.
Where is the evidence, that any part of the human brain can do anything that cannot be simulated by a computer. Surely one computer to simulate each brain cell is unrealistic, because we don't have that many computers. But with sufficient parallelity there is no reason to think they couldn't get self-aware.
Do you care about the security of your wireless mouse?
Well that's how things are today, all right.
But the technology we have today was unforeseen by previous generations. Just think about the internet for example. Asimov came closest I think, with his "Multivac" - but even he thought it was much farther off.
So the technology may yet appear in our own lifetimes. Once the right component density is available (only a matter of time, now) it could take just one breakthrough in AI systems design to change everything.
But if you have a principled objection to the possibility of truly strong AI then there is probably nothing I can say to convince you. You may still be denying it when it comes knocking at your door.
As far as fragility is concerned, it is much easier *even in theory* let alone in practice, to make electronic devices that can withstand extremely harsh conditions such as exist in space, than it is to harden humans. It's not even certain, without a prohibitively massive amount of shielding, how long humans could survive the solar and cosmic radiation out beyond the van Allen belt without contracting terminal cancer.
I'm not going to give you an essay here, but it is well understood and widely agreed that we will send intelligent autonomous probes to the nearby stars long before we send humans, because they can be made small (and therefore cheap to power and propel) and we can't; because they can withstand the long journey and extreme conditions and we can't; because they can do without tonnes of food water and air and expensive organic recycling systems, and we can't.
So who's fragile?
It may still turn out that the human body relies, for its continued health and existence, upon the presence of as yet undetected substances and/or symbiotic microorganisms in our own biosphere. Substances and organisms that we therefore don't bring with us when we leave Earth. You have surely noticed that those who return from long stays even in Low Earth Orbit generally don't look too healthy afterwards? It might all be due to the absence of gravity, but then again it might not.
Asimov came closest I think, with his "Multivac" - but even he thought it was much farther off.
I think I see your problem. You're taking your hints from science fiction authors rather than the science itself. Obviously he also predicted the nature of AI, though it hasn't come close.
Predicting the internet isn't a big stretch by comparison. The difference in the amount of knowledge needed to do it is like the difference between drinking a coke and drinking all the water in the ocean. We only begin to concieve of how we can concieve of it.
We may find a way to travel to other planets. We may figure out how to make watermelons without rinds. We might even figure out how to clone humans perfectly.
Making something artificial that is as robust as a living being is much harder than these things.
Back on the subject of fragility, the "brains" of the robots we can create are much more fragile than we are. We just give them weatherproof, inflexibile coatings before we turn them off and send them into space. Also keep in mind that these robots are made to do less. This inflexibilty means that less can break. This is true in the biological world as well. To do a more apt comparison would mean comparing much simpler organisms survival to the computers we send into space.
Or try a more complex approach. Instead of sending a single, very flexible and complex human, send a flexible and complex supercomputer. I can guarantee that the radiation will fry the computer a lot faster than it would a human because losing a few too many of it's processors (which is inevitable as a result of the process of making it into space and because of the resulting radiation) would kill it.
The only thing our robots are more "robust" at than life is being off so that they consume no resources. This, and the fact that humans are not expendable is the only reason we send robots into space instead of humans. In fact, a computer consumes a lot more energy to do what it does than a human does to accomplish what it does (a human accomplishes a good deal more, but to limit it to an area that you already know about, a brain uses a lot less energy than a CPU does).
Mod me down and I will become more powerful than you can possibly imagine!
Will respond to the rest later, gotta be somewhere else now.
Military is looking for options like this a long time ago. That's why they funded the research of packet switched networks (like TCP/IP) when all the known networks first established a path an then routed all the communitacions throw this path (circuit switching networks, like telephone networks). The whole idea behind military funding TCP/IP is to be able to shut-down compromised nodes without taking down the entire network. Id est keeping the system running even when the system is partially compromised. Aureliano.
If you follow these observations to their logical conclusions, we are doomed. OASIS = SKYNET
Obviously, or we'd already have done so. Many things are difficult, that were once thought to be impossible but are now commonplace.
It's hardly relevant to quibble about what is apt or inapt. This isn't an Olympic contest with rules to make things fair between machines and humans. For practical purposes we are only interested in comparing humans vs. competent, intelligent, adaptable machines that do not yet exist, but whose necessary properties are reasonably well understood.
Nonsense. We already make electronics packages that can survive the radiation, extreme temperatures, airlessness and zero gravity of space much better than humans can. But you are right about the advantage of power management, of which more in a minute.
No not really. For well-defined mission profiles, it is not only cheaper but less risky to send a single-minded, pre-programmed robot to do the job.
Misleading and irrelevant. The human brain consumes about 25W. The fastest current Pentium IVs and Athlons consume about three times that in full power mode, but so far every generation of processor has been succeeded by a lower power version, so you can probably expect 25W Pentium IV's before too long. Technology will eventually deliver a computation rate per Watt close to the theoretical limit set by thermodynamics. Good luck in trying to do that with organic human brains! And don't forget that artificial processors can spend any proportion of their lifetime completely switched off or in some kind of sleep mode to conserver power; humans can't do that for more than about 50% of their duty cycle.
This is how it will play out. The timescales are dependent only on how long it takes to develop the necessary technology.
To reach the nearest stars for investigative purposes within a usefully short journey time, say a decade or so, we need a propulsion technology capable of getting us there. The difficulty of this is proportional, roughly speaking, to the mass of the probe's payload and engines. We can therefore make this more feasible if technology can also deliver a means of making the payload less massive. Since we can't shrink humans plus their life support equipment down to a few grams, that translates to making small computers capable of acting independently once out of effective communication range.
Fortunately, the apparent longevity of Moore's Law makes this rather more likely than not. By 2013 (judging by the trends of the last few decades that's six speed-doubling periods plus a year to work on power consumption issues), people will be buying personal computers equipped with 200GHz P4 processors, or the contemporary equivalent. Five years later, terahertz computing should be commonplace. This computation rate is more than enough to simulate an entire human brain directly at the synapse level. You could have a really stupid AI model and the thing would
...and very little thought. Really people who develop such projects should realize that the things they want and things they can get are two very different things, and no matter how much they want the former, they will get nothing but a false sense of security unless they will realize that they can only get the latter, and should pursue that instead.
Once something is broken into, it can not be trusted. This is the definition -- it won't be "broken into" if it was possible to trust it after the intrusion, it will be "operating as intended". Therefore if someone admits that a system may have vulnerable parts, he can either make sure that their vulnerabilities are eliminated (what is both impossible at the scale of existing setups, and beyond the scope of this kind of work), or make it impossible to access the vulnerable parts of the system (what is the reason for all kinds of firewalls, and this direction of work already reached its limitations without producing anything close to a desired effect), or to reduce the amount of damage that can be caused by a successful attack on a vulnerable part of the system (what is the only direction left that is still worth pursuing).
Obviously, the first thing that comes to mind is to separate parts and provide interfaces that do not propagate trust unnecessarily between those parts. Subsystems running under minimally necessary privileges, privileges separation within parts of subsystems, etc. are already used in various secure setups, however there is a lot left to be done, mostly in standardization and implementation of those ideas. Too bad, none of that activity looks attractive enough for bigwigs, and the theory and amount of work involved is hard to explain to people that can only understand network security through bad metaphors.
Another issue is DoS tolerance. This is a very complex problem because DoS by their nature can not be counteracted without a risk of becoming the source of another DoS -- for almost every imaginable DoS there can be a worse DoS that relies on the response mechanism that is supposed to react on the first DoS. Simulate a DoS against some host, and see that host "responding", creating a real DoS. This means that DoS can be only counteracted by proactive measures, such as SYN floods being prevented by the use of cryptographic SYN cookies. Also elimination of a large number of vulnerabilities in comsumers' computers goes a long way toward decreasing the effectiveness of DDoS, a kind of attack that has no possible response of the victim that is not exactly the same as the goal of the attacker -- making the victim unaccessible to the legitimate users.
Detection of the attacks is of much less importance than what it usually assigned to it. In fact, any attack detection that does not go through a human system administrator has a potential of being a part of an attack -- in most of cases the automated response to an attack can produce a more dangerous attack by itself than the attack being detected (similar to DoS response issue), this is a situation when not knowing about the attack is much better than knowing. Even with humans involved, a system that will cry wolf every ten seconds will become at most a nuisance.
Same in a large part applies to intrusion detection -- even a _successful_ attack may still be less dangerous than the heavy-handed automated response to it. The real value of intrusion detection is in allowing the sysadmin (or sometimes an automated system) to revert the compromised subsystem to pre-attack state, keep the whole system consistent after this change, and replace the vulnerable part with an alternative that supposedly does not have exactly the same vulnerability, allowing the time for analysis and elimination of vulnerability. AFAIK, absolutely nothing is done in the direction of automating this task, and none of the "security" companies provide this kind of service. This is a very valid area to apply new research, development and businesses' efforts, however it doesn't look like anyone interested in
Contrary to the popular belief, there indeed is no God.