Slashdot Mirror
Internet Security: Where Do We Stand
buxton writes "The Economist is running an interesting story which overviews the current global situation on internet security in hackers, terrorism, worms & virii, Microsoft's 'monoculture', and a bunch of other interesting points. Some nice suggestions made by big names in the software industry have been included, such as creating more easily traceable methods of people (i.e. trying to eliminate online anonimity) as a method of preventing hackers. One suggestion which I thought was partictularly interesting involved a bounty system whereby a price would be put on 'hacker's heads', incentivating other hackers to go after them and bring them forward."
Isn't teaching people how to defend themselves using free open source software better than talking about the best way to start up a posse?
With just IPTables and SpamCop configured properly most of these security problems disappear.
More likely random people will try to frame someone else as a "h4x0r" and claim a bounty. It's not like there can be a solid proof for most of the activity that happens over the network -- say, I have a log indicating that someone president@whitehouse.gov (PTR record and ident say so!) tried to login as scott/tiger to my Oracle server. Now what?
Contrary to the popular belief, there indeed is no God.
And people are starting to understand it.
The Internet is not a planned system. It grows and connects like a natural system obeying laws such as Zipf's Law.
When it comes to security, the best model for what is going on in the Internet is also an organic model, namely the naturally occuring phenomenon of parasites, and the way these evolve in any real or simulated ecology.
I've gone into boring detail in my journal.
My opinion is that until we use natural models, and learn from them, we will not be able to stop the rising tide of parasitical code that infests the Internet.
"Monocultures" are a large part of the problem, and the Economist rightly argues that opening the Windows source code to third parties would create more variety and thus more security. But I think we have to go much further, towards systems that actively evolve to protect themselves against parasites.
I've been criticised for saying this by people who say "it's just a metaphor, it does not mean anything". This is untrue: it is a model, one that we can use to understand what the heck is going on: what are the dynamics behind the process, what are the weaknesses of today's infrastructure, and what are the best solutions.
Let me summarize this one more time: The internet behaves like an ecology, obeys the same laws as natural ecologies, falls prey to the same problems as natural ecologies, and if we want to create structures that survive these problems, we must understand things in terms of an ecology, not a planned design.
Ceci n'est pas une signature
Pay low-life a lot of money to catch other low-lifes. Yeah right.
Imagine this: your little sister sits in front of her computer, ready to send the latest pix of her little doggy to your grandma.
Five cops burst through the door and arrest her for spreading that noxious "I love goatse.cx!" virus. Yes, that virus. The one that installs a spambot on your Windows machine.
Her crime? She clicked on that little "Rudolph the red-nosed reindeer e-postcard" that was sent to her by the nice girl she chatted with yesterday.
End result? '000s of $$$ spent in legal fees and millions of dumb IIS/Exchange servers crashed all over the world. And one very rich bastard, laughing all the way to the bank for denouncing an innocent.
Thank you, The Economist. Great idea.
Here is my offer: banish Microsoft products everywhere. Replace with medium- (Linux) to high-security (OpenBSD)OS everywhere and watch the [virus|worm] problems disappear. Oh, and make spamming a crime punishable by public castration. That should do the trick.
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
I think MS and most other s/w firms like to have a 'recurring income model' for s/w, rather than a one-time fixed income model. It follows therefore, that some 'value' has to be delivered to the customer, to justify the expenditure.
For an OS and Office writer, which is what MS basically is, it helps to dedliver this 'value' in terms of Service Packs and bug fixes for problems it was responsible in creating, and which it is morally obliged to undertake for free, rathre than for an annual 'Subscription (Dis)Advantage Agreement'.
Thus, it is more crucial to know of MSs plans, rather than where we stand currently - while discussing this topic of security. If MS gets away with Palladium, they might actually write secure code; if Palladium fails to take off, users will have to live with these worms and security hazards.
Which is why I posted this earlier, and got modded Flamebait!!
" Where does Microsoft want us to go tomorrow? (Bankrupt, yes,.. that sems to be the answer).
Whereveer we stand now, we stand naked - ready for exploitation; the situation isn't changing fast, either."
If you keep throwing chairs, one day you'll break windows....
Are you so niave as to not realise that in our increasingly totalitarian world, these are all detriments.
How do you think John Ashcroft feels about people who percieve the US as having an "overbearing government" being able to speak out anonymously and with impunity?
Hasn't he gone on record about his views on that?
And as far as whistle-blowers go; no corporation considers whistle blowing to be a Good Thing, and therefore if they were presented with that angle of online anonymity they would probably pony up Even More Money to fight it.
So, in short, the reasons you cite are the reasons why online anonymity is now a thing of the past.
-
One suggestion which I thought was partictularly interesting involved a bounty system whereby a price would be put on 'hacker's heads', incentivating other hackers to go after them and bring them forward.
If anyone thinks this will work, then I feel sorry for them. Hackers by and large aren't going to rat on each other. There's one really good reason -- if the one they ratted on finds out who they are, or his/her friends find out, then the rattee is going to be in deep doodoo fast. Facing this, they'll just take the route of least resistance and easy moolah and rat out innocents or even set up innocents and report them.Think about it, how hard is it to infect the average joe's computer with a trojan, worm or virus? History (heck, recent history in fact) shows us that it's not terribly hard. For some of these worms/etc. that come out, you don't even have to click on anything to get infected! So it'd be easy as pie to set someone up. Just infect their machine with a trojan, make their machine do Evil Things (tm) while they're actually active on it, cover your tracks, and report. Law enforcement tends to be overexuberant on catching cyber evil-doers, and there's a more than fair chance they won't dig deep enough to notice the tracks the hacker left on the innocent guy's computer.
And to be honest, they probably won't get the chance to. How many average joes out there have done something not-so-legal? Probably a lot, it seems everyone and their brother's wife have illegal software of some sort to hear people casually talk about it. I've heard customers at Wal-mart ask employees if they can install ___ software on more than one computer. (Often it's anti-virus software they're asking about ironically.) When average joe is faced with getting in trouble for the stuff he knows he's done wrong, he'll probably cop a plea bargain to avoid that coming to light. And law enforcement will go along, after all it will look like a win for them on the public relations front.
For those that will scream that law enforcement wouldn't do these things, I can only tell you that I hope you never get to find out first-hand just what they will and won't do. I had the misfortune and it was a real eye-opener. I prefer not to go into specifics, but I will say that before my experience I never believed any of the supposed "conspiracy theories"/etc. about how bad law enforecment and/or the FBI/etc. were. Now I think they're all dead on.
Bottom line, putting out bounties on cyber-criminals would result in many innocent victems, and probably very very few real criminals being caught.
"Security" doesn't have anything to do with anonymity or not. Think of it this way - anonymity doesn't make a bank more or less secure. You could be famous and rob a bank. What recognition gives is not preventative; it is only reactive. It allows you to go after someone after they have done something you don't want them to do.
Some would argue that this is a deterrent to "security violation" since it would be known that if you do something you're more likely to be caught. However, for those apt to try and perform a "security violtation", this just adds to the mystique, honor, whatever. Except for the truly insane, who just don't care. For most people, non-anonymity is just an annoyance because they wouldn't do anything wrong in the first place.
The question for the computing world then needs to become which stance to take. It seems the "don't do things unless I tell you it's OK" is infeasible since we know that people will do things they know aren't OK. Then the question must be what kind of walls to put up. Most "security" issues today are because the walls are insufficient, not because we can't go out and catch the people coming into the barn and stealing the chickens.
And why are the walls insufficient? Well, the fundamental problem is that usually a breach is something that is allowed to happen but by someone who shouldn't be allowed to do it. This is why people are clamoring for identity validation and all that jazz, but we are fast learning that identiy is not even sovereign in this world; at least not in a non-morally-ambiguous way (i.e., biometrics).
I must admit that I don't have answers to the questions of security, because whenever you allow people to do something, there is always a possibility that it will be abused. And in a world where (at least in the USA) people are taught more and more that they are not responsible for their actions (if this were not the case, we would have far fewer lawsuits) security will not be solved by any technical means.
"There are a dozen opinions on a matter until you know the truth. Then there is only one." - CS Lewis (paraprhase)
The key point is that the Internet is not just a million computers, it is a zillion computers plus a zillion people.
It's the people and their ways of using the Internet that turn it into a natural ecology.
Laws are not the answer: it will just create a criminal underground. You cannot legislate against human nature - look at the "war on drugs".
Tighter security is not the answer: every lock designed by a human can be picked by a human.
Open source is not the answer: any suitably complex system, transparent or not, will have security flaws, usually at the user interface point (think: weak passwords).
Security patches are not the answer: parasitical code can spread many times faster than any human reaction time.
I believe the answer is that computer systems will have to evolve something similar to an immune system, based on recognising friend-or-foe, and capable of regular pseudo-sexual exchange to scramble the locks against parasitical code that has adapted. Finally, it is likely that parasitical code will eventually be co-opted (just like the bacteria in our guts) into less harmful roles.
To put this into context: the wars in your intestine started with the very first life forms and have been one of the basic engines of change in evolution for 3.5 billion years (along with climate change). I believe we're only at the very first stages of this process with the Internet, but inevitably we will follow a similar route.
Anyhow, I will be long dead before this actually happens. It's just idle speculation.
Ceci n'est pas une signature
The real problem is that social research has shown that incentives simply do NOT work. In fact, adding rewards has been shown to reduce the number of people that get turned in compared to when no intervention is used at all. A real solution would focus on determining and eliminating the intrinsic motivators fueling the hackers. For a good overview/compendium/analysis, read Punished by Rewards: The Trouble with Gold Stars, Incentive Plan$, A's, Praise, and Other Bribes by Alfie Kohn
One of the growing problems is the large base of broadband-connected (cable, DSL) users that ISPs insist on putting on dynamic IP address pools. We all know that there is no technical advantage to the dynamic IP addresses, since practically everyone is connected 24/7 (this is not the same situation with dial-in modem pools, where dynamic IPs are the best way to go).
If ISPs allocated static IP addresses to all their cable/DSL customers, we would see tremendous security gains because customers' addresses would stand still while they are tracked down.
Perhaps it's time to see some government regulation that requires that an ISP that provides broadband services where customers are connected more than X% of the day has to provide a static IP address. ISPs like to provide dynamic addressing because they have a persistent fear of people 'running their own servers' (bullshit), plus they can sell static IP addresses. Their approach is detrimental to general Internet security.
Imagine if there was a type of cheap cell phone service designed to facilitate outgoing calls only, accomplished via a dynamic origin phone number (that changed daily), making nearly impossible to have someone phone you back. Don't you think such a phone would be a huge source of all kinds of abuse? That's what ISPs are making possible by dynamic IP addresses on broadband customers. These hosts become rogue, because they are moving targets.
Let's see, a bounty for the head of the cracker who did the deed.
Let's say I am really, really good.
Let's say that the cracker who did the deed is really, really good and very dangerous.
Let's say that the bounty is really, really high.
Let's say that there is another cracker, call him "stooge," who is really good, somewhat dangerous, but not as good or dangerous as am I.
I want the bounty, I can very effectively frame stooge, who is pretty darn good, but framable, and not so dangerous.
or i can go after someone who is much better and more dangerous.
Looks like all a bounty system would do is incentivize crackers to do very effective jobs of framing innocent, less effective, hackers.
The Economist should know more about Economics.