Slashdot Mirror
Internet Security: Where Do We Stand
buxton writes "The Economist is running an interesting story which overviews the current global situation on internet security in hackers, terrorism, worms & virii, Microsoft's 'monoculture', and a bunch of other interesting points. Some nice suggestions made by big names in the software industry have been included, such as creating more easily traceable methods of people (i.e. trying to eliminate online anonimity) as a method of preventing hackers. One suggestion which I thought was partictularly interesting involved a bounty system whereby a price would be put on 'hacker's heads', incentivating other hackers to go after them and bring them forward."
Isn't teaching people how to defend themselves using free open source software better than talking about the best way to start up a posse?
With just IPTables and SpamCop configured properly most of these security problems disappear.
These ideas of eliminating online anonimity need to be offset against the benefits this anonimity brings. It has been a huge boon for political activists in countries with "overbearing" governments, for whistleblowers in all nations, and for all sorts of other reasons.
...
To quote an article I wrote on this some time ago:
"During the Kosovo conflict in 1999, a sixteen-year old ethnic Albanian girl, nicknamed "Adona", began an e-mail correspondence with a junior at Berkeley High School, America. She wrote of Serbian forces holding her village to ransom, killing journalists and community leaders, raping women, and finally of her friends and family deserting the village
Because of the anarchistic, anonymous nature of the Internet, the Serbian authorities could do nothing to stop this flow of information between its citizens and the outside world, which meant that it could no longer censor all information. This not only gave the people of Kosovo who had some access to these Internet organisations hope and a sense of purpose during the conflict, but helped the international community better understand the circumstances in Kosovo during and after the conflict.
"
"incentivating"
Some mornings it just doesn't seem worth it to gnaw through the leather straps. -- Emo Phillips
It is one or the other. It is impossible to increase security without reducing anonimity. Internet has been hailed for its anonimity, and it is a thing that should be kept. But on the hand it also lacks the possibilities (with the current email protocol) to increase ones security with a reduction of anonimity. For example, there is not yet a possibility to only receive email from people that have revealed their identity with a trusted third party. I am affraid that is mainly a problem of legacy that a secure email protocol has not been deployed yet.
But this is slashd... oh, you meant metaphorically.
More likely random people will try to frame someone else as a "h4x0r" and claim a bounty. It's not like there can be a solid proof for most of the activity that happens over the network -- say, I have a log indicating that someone president@whitehouse.gov (PTR record and ident say so!) tried to login as scott/tiger to my Oracle server. Now what?
Contrary to the popular belief, there indeed is no God.
Seriously. For more information than you ever wanted to know about why "virii" is incorrect, please see here.
Thank you.
"Avoid employing unlucky people - throw half of the pile of CVs in the bin without reading them." -- David Brent
I find it funny that I've never seen an article which correctly uses the terms 'hacker' and 'cracker'. This one included, although they don't even mention 'cracker'.
We're gonna have squads of mercenaries trolling the internet picking off script kiddies (and probably bystanders too) while the real crackers continue to be dicks, and the real white-hats get picked off by the posses.
Only in a Slashdot fantasy can a Slackware install turn into several hours of sex . . . . .
And people are starting to understand it.
The Internet is not a planned system. It grows and connects like a natural system obeying laws such as Zipf's Law.
When it comes to security, the best model for what is going on in the Internet is also an organic model, namely the naturally occuring phenomenon of parasites, and the way these evolve in any real or simulated ecology.
I've gone into boring detail in my journal.
My opinion is that until we use natural models, and learn from them, we will not be able to stop the rising tide of parasitical code that infests the Internet.
"Monocultures" are a large part of the problem, and the Economist rightly argues that opening the Windows source code to third parties would create more variety and thus more security. But I think we have to go much further, towards systems that actively evolve to protect themselves against parasites.
I've been criticised for saying this by people who say "it's just a metaphor, it does not mean anything". This is untrue: it is a model, one that we can use to understand what the heck is going on: what are the dynamics behind the process, what are the weaknesses of today's infrastructure, and what are the best solutions.
Let me summarize this one more time: The internet behaves like an ecology, obeys the same laws as natural ecologies, falls prey to the same problems as natural ecologies, and if we want to create structures that survive these problems, we must understand things in terms of an ecology, not a planned design.
Ceci n'est pas une signature
Bounties are not incentives to play nice, they don't stop crime. They only make it easier for payback. Seriously, how is that gonna stop anyone from defacing a website or wiping someone's hard drive ? It can only help bringing online miscreants to justice, and that ultimately amounts to more litigation, not more security.
Maybe we deserve this world ?
No clever ideas like this are, were, or ever will be a suitable substitute for implementing real security. People need to wake up and realize that "hackers" are successful because peole still prefer convenience above all else.
For one, we still have this serious problem of people using software that is fundamentally insecure (Outlook, IE, ISS, Windows, etc). Nobody seems to be getting the point that Microsoft products fail utterly at meeting any of Microsoft's promises about security.
Of course, I would venture that is not even the biggest problem. People refuse to use strong passwords (or at least change them regularly). Software is not kept updated on servers (I recognize that free and open software like Linux is insecure if you're behind the times). Services are kept wide open so that nobody has to go searching for access (think file shares). Nobody uses encryption (viruses and spam would cease if company mail servers required valid PGP signatures from employees on emails before they got delivered),
There's so much that needs to be done. The above is hardly an exhaustive list (nor was I making an attempt to create one), but nobody seems interested in taking a crack at what really matters. Instead most seem to be more interested in silly ideas like "hacker bounties" which would be utterly ineffective against a group of people which do not seem to fear consequences for their actions.
Cure the sickness; don't treat the symptoms.
Join Tor today!
You forgot about claiming a Microsoft tactic that's been floating around the past few weeks as "interesting":
:)
One suggestion which I thought was partictularly interesting involved a bounty system whereby a price would be put on 'hacker's heads', incentivating other hackers to go after them and bring them forward.
Not to mention the crackers/hackers thing which has already been mentioned
Isn't eliminating online anonimity practically impossible? What about cybercafes, for instance? (Although not big in the USA, cybercafes are one of the main ways to access the internet in many poorer countries)
Secondly, supposing you did manage it by imposing some kind of draconian laws i.e. you have to log on at all cybercafes with some universal ID. Then wouldn't identity theft become an even bigger problem - i.e. hackers would pinch other peoples identities to hack.
While total security will never be achieved, I feel that there are efforts that can be made to minimize the effects of hackers.
The internet will never have total security. There will always be ways around any programing that was made. There will always be bugs, loop-holes, etc. We are not perfect in our ability to program, and subsequently are coding is not perfect.
But with this being said that doesnt mean that we cant do anything to help protect ourselves. We can make effective practices of protecting systems by physical methods. If you dont want people to hack your system dont connect it up to the internet. While I know that those nuclear technicians love to surf the web while at work, but that doesnt have to be the same system that runs the reactor.
Virus writers will always exist, just like music sharing, and ads. The key is just how you will negate their effects.
30% Troll, 50% Underrated, 10% Interesting
Score:5, Troll
Microsoft is far behind in the security world. Their "Security is #1" is just bull to make people feel better about using Windows.
If Microsoft is so secure, how come it:
1. doesn't support APOP in outlook [express]?
2. doesn't support IPsec tunnel?
3. still supports Frontpage?
4. doesn't let you see whats going on (netstat on unix shows process related to the socket opened, windows does not)
on and on..
Why is the only way to somewhat-secure Windows limited to buying third-party apps?
Pay low-life a lot of money to catch other low-lifes. Yeah right.
Imagine this: your little sister sits in front of her computer, ready to send the latest pix of her little doggy to your grandma.
Five cops burst through the door and arrest her for spreading that noxious "I love goatse.cx!" virus. Yes, that virus. The one that installs a spambot on your Windows machine.
Her crime? She clicked on that little "Rudolph the red-nosed reindeer e-postcard" that was sent to her by the nice girl she chatted with yesterday.
End result? '000s of $$$ spent in legal fees and millions of dumb IIS/Exchange servers crashed all over the world. And one very rich bastard, laughing all the way to the bank for denouncing an innocent.
Thank you, The Economist. Great idea.
Here is my offer: banish Microsoft products everywhere. Replace with medium- (Linux) to high-security (OpenBSD)OS everywhere and watch the [virus|worm] problems disappear. Oh, and make spamming a crime punishable by public castration. That should do the trick.
The right to offend is far more important than the right not to be offended. (Rowan Atkinson)
Uh, so what you are saying is that could just as well shut down the whole justice system, because the threat of jailtime for rape doesn't prevent rape? The threat of getting punished for illegal actions is highly preventive!
See if you can get the most bounty on your head! Open to script kiddies everywhere!
Donte Alistair Anderson Roberts - hi son!
Karma: Chameleon
Bounty system, wow, that's a brilliant idea.
Instead of hacking systems, hackers can instead hack systems, frame teenage kids, and make money! Sweet!
---
I support spreading santorum
If the government can do it, why couldn't a cracker?
- viri
- virii
- viriii
- viriv
- virv
- virvi
- virvii
- virviii
- virix
- virx
(nicked)Justin.
You're only jealous cos the little penguins are talking to me.
I think MS and most other s/w firms like to have a 'recurring income model' for s/w, rather than a one-time fixed income model. It follows therefore, that some 'value' has to be delivered to the customer, to justify the expenditure.
For an OS and Office writer, which is what MS basically is, it helps to dedliver this 'value' in terms of Service Packs and bug fixes for problems it was responsible in creating, and which it is morally obliged to undertake for free, rathre than for an annual 'Subscription (Dis)Advantage Agreement'.
Thus, it is more crucial to know of MSs plans, rather than where we stand currently - while discussing this topic of security. If MS gets away with Palladium, they might actually write secure code; if Palladium fails to take off, users will have to live with these worms and security hazards.
Which is why I posted this earlier, and got modded Flamebait!!
" Where does Microsoft want us to go tomorrow? (Bankrupt, yes,.. that sems to be the answer).
Whereveer we stand now, we stand naked - ready for exploitation; the situation isn't changing fast, either."
If you keep throwing chairs, one day you'll break windows....
"I'm kind of a fan of eliminating anonymity," says Alan Nugent, the chief technologist at Novell, a software company, "if that is the price for security."
On the surface, this is a sensible statement, but this is the kind of thinking which must be debunked at all costs. What is needed are systems which allow anonymity where it is valuable and eliminate it where it is not.
Just as in the real world, we have the option of using our credit cards to buy groceries, and cash to buy or anti-government literature, the internet needs security where security is important and must still provide anonymity where users judge it to be important to them. To say it is impossible to provide both shows a failure of imagination on the part of the commentator.
Enforcing security by exposing everybody to scrutiny denies us freedom. Don't let it happen. Chose the right to be an anonymous coward, if that's what your subject demands.
Actually, it will make the situation worse. think about it - right now you have a (fairly small) group of serious crackers who know that the best way to keep on doing what they do is to STFU and make sure nobody else finds out about them, and you have the much larger group of wannabes and s'kiddies who try to inflate their own ego by public boasts. Now, what happens when you put out a bounty? Well, the vocal one start to get caught or they learn to keep their gob shut. Some of them will stop and move to something else, but some will stay and increase the size of the silent cracker group... and before you know it you wind up in the same situation as modern medicine and antibiotics: your miracle cure has made the problem worse by encouraging the growth of resistant strains of cracker....
Wouldn't it also be an incentive to manufacture false evidence so you can frame somebody up & collect the $$$
Trust no one
If I had a DeLorean... I would probably only drive it from time to time.
-
One suggestion which I thought was partictularly interesting involved a bounty system whereby a price would be put on 'hacker's heads', incentivating other hackers to go after them and bring them forward.
If anyone thinks this will work, then I feel sorry for them. Hackers by and large aren't going to rat on each other. There's one really good reason -- if the one they ratted on finds out who they are, or his/her friends find out, then the rattee is going to be in deep doodoo fast. Facing this, they'll just take the route of least resistance and easy moolah and rat out innocents or even set up innocents and report them.Think about it, how hard is it to infect the average joe's computer with a trojan, worm or virus? History (heck, recent history in fact) shows us that it's not terribly hard. For some of these worms/etc. that come out, you don't even have to click on anything to get infected! So it'd be easy as pie to set someone up. Just infect their machine with a trojan, make their machine do Evil Things (tm) while they're actually active on it, cover your tracks, and report. Law enforcement tends to be overexuberant on catching cyber evil-doers, and there's a more than fair chance they won't dig deep enough to notice the tracks the hacker left on the innocent guy's computer.
And to be honest, they probably won't get the chance to. How many average joes out there have done something not-so-legal? Probably a lot, it seems everyone and their brother's wife have illegal software of some sort to hear people casually talk about it. I've heard customers at Wal-mart ask employees if they can install ___ software on more than one computer. (Often it's anti-virus software they're asking about ironically.) When average joe is faced with getting in trouble for the stuff he knows he's done wrong, he'll probably cop a plea bargain to avoid that coming to light. And law enforcement will go along, after all it will look like a win for them on the public relations front.
For those that will scream that law enforcement wouldn't do these things, I can only tell you that I hope you never get to find out first-hand just what they will and won't do. I had the misfortune and it was a real eye-opener. I prefer not to go into specifics, but I will say that before my experience I never believed any of the supposed "conspiracy theories"/etc. about how bad law enforecment and/or the FBI/etc. were. Now I think they're all dead on.
Bottom line, putting out bounties on cyber-criminals would result in many innocent victems, and probably very very few real criminals being caught.
"Security" doesn't have anything to do with anonymity or not. Think of it this way - anonymity doesn't make a bank more or less secure. You could be famous and rob a bank. What recognition gives is not preventative; it is only reactive. It allows you to go after someone after they have done something you don't want them to do.
Some would argue that this is a deterrent to "security violation" since it would be known that if you do something you're more likely to be caught. However, for those apt to try and perform a "security violtation", this just adds to the mystique, honor, whatever. Except for the truly insane, who just don't care. For most people, non-anonymity is just an annoyance because they wouldn't do anything wrong in the first place.
The question for the computing world then needs to become which stance to take. It seems the "don't do things unless I tell you it's OK" is infeasible since we know that people will do things they know aren't OK. Then the question must be what kind of walls to put up. Most "security" issues today are because the walls are insufficient, not because we can't go out and catch the people coming into the barn and stealing the chickens.
And why are the walls insufficient? Well, the fundamental problem is that usually a breach is something that is allowed to happen but by someone who shouldn't be allowed to do it. This is why people are clamoring for identity validation and all that jazz, but we are fast learning that identiy is not even sovereign in this world; at least not in a non-morally-ambiguous way (i.e., biometrics).
I must admit that I don't have answers to the questions of security, because whenever you allow people to do something, there is always a possibility that it will be abused. And in a world where (at least in the USA) people are taught more and more that they are not responsible for their actions (if this were not the case, we would have far fewer lawsuits) security will not be solved by any technical means.
"There are a dozen opinions on a matter until you know the truth. Then there is only one." - CS Lewis (paraprhase)
The gist of Mr Geer's argument is that Microsoft has over the years created "unacceptable levels of complexity" in its computer code. It has done so because its main objective has been to lock users into its software by tying the Windows operating system together with applications such as Word, Explorer and Outlook...
Not surprisingly, Microsoft bristles at this line of thought. The only reason the firm has been bundling the operating system with applications is that customers want it to, says Mike Nash, a Microsoft executive in charge of security issues. He finds it "personally insulting that people think our motivation is anything else."
Oh, puh-leeez, give me a break! When was the last time that Microsoft asked customers about what new features they wanted in Windows and the answer came back: "Make the code bigger, slower and more complicated. And this thing with the DOJ, mke sure that you build the browser right into Windows. And more viruses; I love them viruses!"
For years now, Microsoft has been blaming the users for demanding the poor design decisions that have made Windows the mess that it is. Truth is, Microsoft stopped caring about what users want many years ago; all they care about is what Microsoft wants. As long as they keep their current mind-set, the Internet in general, Windows in particular, will be a vast playground for script-kiddies, spammers and thieves. No "bounty" will ever do as much as a few intelligent decisions in the design process at Microsoft.
The key point is that the Internet is not just a million computers, it is a zillion computers plus a zillion people.
It's the people and their ways of using the Internet that turn it into a natural ecology.
Laws are not the answer: it will just create a criminal underground. You cannot legislate against human nature - look at the "war on drugs".
Tighter security is not the answer: every lock designed by a human can be picked by a human.
Open source is not the answer: any suitably complex system, transparent or not, will have security flaws, usually at the user interface point (think: weak passwords).
Security patches are not the answer: parasitical code can spread many times faster than any human reaction time.
I believe the answer is that computer systems will have to evolve something similar to an immune system, based on recognising friend-or-foe, and capable of regular pseudo-sexual exchange to scramble the locks against parasitical code that has adapted. Finally, it is likely that parasitical code will eventually be co-opted (just like the bacteria in our guts) into less harmful roles.
To put this into context: the wars in your intestine started with the very first life forms and have been one of the basic engines of change in evolution for 3.5 billion years (along with climate change). I believe we're only at the very first stages of this process with the Internet, but inevitably we will follow a similar route.
Anyhow, I will be long dead before this actually happens. It's just idle speculation.
Ceci n'est pas une signature
And if TCPA does have centralised control, you have the problems of total monitoring, proprietary lock-in and the erosion of usage rights for digital media.
There is a parallel with existing firewalls - they can increase security by blocking certain content (e.g. RPC exploits using port 135), but trusted web traffic with IE-exploits or virus-laden emails usually sail through.
Well, I just checked, and it appears that the threat of jailtime did not stop rape completely in the US.So it is not that preventive, eh ? My point is that instead of trying to punish more and more it might be a good idea to start using carrots instead of getting a bigger stick.
A crime is the result of motivation and occasion. Instead of trying to extinguish motivation through fear of jail (which does not stop crime entirely) why not add other methods, or work on preventing occasions (transparent societies) ?
Besides, if you think the whole justice system isn't there mainly to bring vengeance to victims and their relatives, you need to go watch A Clockwork Orange.
Maybe we deserve this world ?
But why, in the first place, did those computers have outside access? Or rather, entry points.
If a computer is controlling a really important piece of hardware (nuclear plant, anyone?), I sure hope it is NOT connected to ANY outside network, for whatever reason. And if it is, the one who decided it was a good idea should be held responsible for whatever happens, and lose his job, get a big fine that will make sure he will NOT EVER make the same mistake... Maybe this way security will be a level higher.
Tsuyoikoto ha taisetsu da ne, dakedo namida mo hitsuyousa (Strength is an important thing, but tears too are necessary)
Virii is a perfectly cromulent word.
"Sic Semper Tyrannosaurus Rex."
maybe incentivizing was what the submitter was after. Oh, and by the way, don't rag on someone for not "no"ing the right word to use if you can't do it yourself ;)
do not read this line twice.
The real problem is that social research has shown that incentives simply do NOT work. In fact, adding rewards has been shown to reduce the number of people that get turned in compared to when no intervention is used at all. A real solution would focus on determining and eliminating the intrinsic motivators fueling the hackers. For a good overview/compendium/analysis, read Punished by Rewards: The Trouble with Gold Stars, Incentive Plan$, A's, Praise, and Other Bribes by Alfie Kohn
One of the growing problems is the large base of broadband-connected (cable, DSL) users that ISPs insist on putting on dynamic IP address pools. We all know that there is no technical advantage to the dynamic IP addresses, since practically everyone is connected 24/7 (this is not the same situation with dial-in modem pools, where dynamic IPs are the best way to go).
If ISPs allocated static IP addresses to all their cable/DSL customers, we would see tremendous security gains because customers' addresses would stand still while they are tracked down.
Perhaps it's time to see some government regulation that requires that an ISP that provides broadband services where customers are connected more than X% of the day has to provide a static IP address. ISPs like to provide dynamic addressing because they have a persistent fear of people 'running their own servers' (bullshit), plus they can sell static IP addresses. Their approach is detrimental to general Internet security.
Imagine if there was a type of cheap cell phone service designed to facilitate outgoing calls only, accomplished via a dynamic origin phone number (that changed daily), making nearly impossible to have someone phone you back. Don't you think such a phone would be a huge source of all kinds of abuse? That's what ISPs are making possible by dynamic IP addresses on broadband customers. These hosts become rogue, because they are moving targets.
Is this really the president of one of the largest network security companies in the market claiming that not one company in Checkpoint's 90% market share was affected by MSBlaster?
Bzap's argument is a prime example of the poorest form of debating technique ever. He takes the argument completely out of context and then throws it into the highly emotionally charged arena of "rape". I'll say one thing about this argument and then get back to topicality: No one likes to admit it but everyone knows that there are cases where the accusation of rape was completely unjustified and made with an ulterior motive of political revenge or monetary greed.
Back to the idea of offering bounty incentives for capturing malicious hackers.
No one likes to admit it but everyone knows that there will be cases where the accusation of malicious hacking will be justified completely by falsified evidence and will be made with an ulterior motive of political revenge or monetary greed.
This is precisely why vigilantes are also seen as criminals under our legal system.
+++ATHZ 99:5:80
use a homonym!
Just another proletarian malcontent.
Let's see, a bounty for the head of the cracker who did the deed.
Let's say I am really, really good.
Let's say that the cracker who did the deed is really, really good and very dangerous.
Let's say that the bounty is really, really high.
Let's say that there is another cracker, call him "stooge," who is really good, somewhat dangerous, but not as good or dangerous as am I.
I want the bounty, I can very effectively frame stooge, who is pretty darn good, but framable, and not so dangerous.
or i can go after someone who is much better and more dangerous.
Looks like all a bounty system would do is incentivize crackers to do very effective jobs of framing innocent, less effective, hackers.
The Economist should know more about Economics.
Please point at the part of my comments that state my opposition to existing justice system. Oops, there aren't...
I never said we should get rid of jails, I said we needed to explore methods of preventing crimes instead of limiting ourselves to punishing crime by increasing/adding jail time (I am not formally against it, but I think it will inevitably reach an efficiency limit anyway). Some people think transparent societies are one such prevention method. Some people disagree, others propose to tag everyone with RFIDs or to brainwash people into valuating virginity, etc...
And you did not get my point about A Clockwork Orange, which actually shows that the lack of a punishment for crimes does not work either.
Maybe we deserve this world ?