Slashdot Mirror
The Next 50 Years of Computer Security
wbglinks writes "An informative interview with Linux guru Alan Cox, with an emphasis on Linux and security. Alan will be the keynote speaker at EuroOSCON this October." From the article: "It is beginning to improve, but at the moment computer security is rather basic and mostly reactive. Systems fail absolutely rather than degrade. We are still in a world where an attack like the slammer worm combined with a PC BIOS eraser or disk locking tool could wipe out half the PCs exposed to the internet in a few hours. In a sense we are fortunate that most attackers want to control and use systems they attack rather than destroy them."
This reminds me of a conversation I had with my business partner regarding computer security:
Imagine a hacker group that offered to protect your system against other hackers. In exchange for x% of your computer cycles, x% of your HDD space, a predetermined number of pop-up ads, etc., the group would guard your computer against others attempting to compromise it for its own use. The group would connect to your system from the internet, install their rootkits, and regularly scour your system looking for intruders, which they would zealously remove. Because they would be paid in computer resources (disk space, cycles, etc.), it would be in their best interests to keep your system as free from other parasites as possible. In much the same way as the bacteria growing in our mouths prevent them from being colonized by other, much more harmful bacteria, the group would defend its box against intruders.
Just an idea...thought I'd throw it out there and see what the Slashdot crowd thought of it (be gentle ^_^).
____
~ |rip/\/\aster /\/\onkey
[...] at the moment computer security is rather basic and mostly reactive.
OpenBSD has been proactive since Day 1. And, really, can anyone speak authoritatively on computer issues 5 years in advance let alone 50?
If I drank a strong tea brewed from Theo de Raadt's toenail clippings I could glean knowledge from perhaps a couple of days in the future, but beyond that you're getting into the realm of Xenu.
Trolling is a art,
Seems to be the classic 'sleep with the devil' scenario. The problem occurs when the hackers, over time, want more than you want give/barter with.
-Valiss
I can't see how anyone can claim to know what is going to happen in the next 50.
The controls that an organization would need to put in place to avoid being utterly exploited in such a scenario are pretty much the same controls needed to manage systems securely in the first place. So as a thought experiment, this is useful. As an actual practice, forget it.
Parity: What to do when the weekend comes.
"In a sense we are fortunate that most attackers want to control and use systems they attack rather than destroy them." - however in a sense we are unfortunate that they generally take control of them to destroy someone elses computer, it just depends on how selfish you are.
Matthew Grint Midnight Artists
Sounds like a classic protection racket to me.
This last area is very important. We know the theory of writing secure computer programs. We are close to knowing how to create provably secure computer systems (some would argue we can--e.g. EROS). The big hurdles left are writing usable, managable, provably secure systems, and the user.
It may be possible to establish "limited" proofs of security which are tightly defines in small areas but a provably secure operating system is impossible. It's impossible on so many levels that I expect that Alan Cox doesn't understand the issues deeply enough.
There are a number of problems with creating a secure operating system. One is the amount of code it takes. You can't create a security proof on huge volumes on code. Hundreds of lines? probably. Thousands of line.. maybe.. hundred of thousands? no chance.
The next problem is that we haven't figured out a way to make security modularise. You can't say "method 1 is secure, method 2 is secure therefore using method 1 after method 2 is secure. It just doesn't work like this. You can put two secure pieces of code and get insecurity. This means you have to treat the whole operating system as one huge program all of which needs to be proven secure.
The third problem is that even you establish a proof of security this still isn't enough. Your proof is based on some formalisation of the language but the compiler itself might be buggy (either by accident or on purpose) and might compile in a way that breaks your proof. Ouch! cuO
Too often we strive to absolutes in security. Security is not binary. It is not a zero or one but a complex set of trade-offs and risk mitigation.
Simon.
"City hall" in German is "Rathaus" Kinda explains a few things......
cos if they actually destroyed them, then people would take proper care... apparently, it's quite normal for people to view their ms-windows boxes filling up with vermin etc. as just a fact of computer life... they only do something when they can't get online anymore... and then it now appears cheaper to buy a new box than get the damned thing fixed properly...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
.
Professor Frink: Well, sure, the Frinkiac-7 looks impressive, don't touch it, but I predict that within 100 years, computers will be twice as powerful, 10,000 times larger, and so expensive that only the five richest kings of Europe will own them.
I'm a big tall mofo.
In 50 yrs I'm going to assume that IPv6 (or v7,8,9) has taken over the world. Wouldn't that do a lot for basic internet security? No more scanning and rooting boxen.
As for stuff like BIOS erasers and disk locking tools, e-mail will no longer be a useful attack vector due to filtering. The again, nothing can defeat stupidity.
Disclaimer: IANAL
[Fuck Beta]
o0t!
"In a sense we are fortunate that most attackers want to control and use systems they attack rather than destroy them."
Of course, we will have to worry about the attackers that inadvertently destroy systems while trying to control them.
I'm afraid I can't let you do that, Dave...this virus is too important for me to let you jeopardize it.
He who knows best knows how little he knows. - Thomas Jefferson
"Yes, Mr Sarbanes Oxley Auditor, I exposed my entire desktop computing infrastructure to a group of self-proclaimed hackers so they could uninstall spyware for me. Great idea, huh? Huh? Hey! Come back! I haven't told you about the foxes guarding the corporate henhouse yet."
I have a better idea. Swap some other commodity (like, say, money) for the same service, and call it an MSSP.
as the number of new computer users increases, their average level of intelligence decreases. same thing happens when it comes to IT professionals, sorry to say.
Extrapolating recent trends, Pokemon will be President of the United Corporations of America. The United Middle East will be America's closest friend. Together, we will have obliterated the EU. No one will care about poverty and disease in Africa.
Computers will be so small, they'll be ingestable, with music players and cell phones being implanted in teeth. But DRM will be so pervasive that the RIAA will be allowed to inspect your mouth with toothpicks. The weakest link in computer security will still be the human being.
The REAL jabber has the user id: 13196
What you do today will cost you a day of your life
There are a large number of problems with your suggestion. I will outline only one.
... and then six months later your computer will be part of a gigantic DDOS or some other illegal act so large it will attract the FBI's attention. From here there are two possibilities. Possibility one is, the people you've been contracting with here are a legitimate business, in which case the FBI will get their contact information from you and have them arrested. Possibility two is, the people you've been contracting with here are not a legitimate business, in which case the FBI will arrest you for conspiring with an organized crime group. We can assume no group even remotely competent enough to even get into this hypothetical security "protection" business in the first place would be stupid enough to let possibility one happen. This leaves possibility two. See the problem?
One problem is that your suggestion is wholly founded on the assumption of computational resources being valuable. This is to an extent incisive, since you have realized that the reason why the formation of zombie networks has increasingly become the endgoal of worms and such is that there is commercial value in those networks' computational resources. But this breaks down when you start to think about what they use those computational resources for.
Computational resources, by themselves, aren't particularly valuable or hard to obtain; even bandwidth resources are beginning to become expendable if you're smart about how you use them. Your average PC is absolutely awash in power it doesn't need. 20 years of "your computer is obsolete as soon as you buy it" has crashed out into "your five-year-old computer technically isn't obsolete yet". People who used to buy supercomputers often now just buy cheap PCs and leash them together. Anybody who just has a legitimate need for a lot of computation these days can most easily obtain this through totally legitimate channels.
The reason why hackers, worm-builders, spyware peoples, etc obtain their resources through illegitimate means (like worms) is because they have illegitimate intents for those resources. They don't so much want 20% of the resources of a PC, they want 20% of the resources of a PC that can't be traced back to them. This is because once they have these resources, they're going to be using them for things like, warez. Sending spam without compliance with local laws. Hosting dubious and virus-like spyware. Extorting businesses for money in exchange for not launching DDOS attacks against them. If you willingly give these people 20% of your hard drive and CPU they aren't going to be using it for things like 3d rendering or protein folding; if that was all they wanted, they wouldn't need to be using hacker methods to get it in the first place.
Instead, if we go by your scenario, you'll give them 20% of your hard drive, CPU and bandwidth; they will protect you from the other hacker groups; everyone will be happy;
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
"In a sense we are fortunate that most attackers want to control and use systems they attack rather than destroy them."
This is not necessarily a good thing. I've read that Ebola and other very nasty diseases don't spread as far as they might, because they wipe out their carrier population too quickly. As opposed to HIV, which has time to slowly spread out. If an infected PC self-destructed after one round of outbound spreading, then it's not going to be continually spewing the junk like they do today.
Such a virus would burn through the supply of unprotected PCs quickly, and then go away.
If we could eliminate all users, the internet would be much safer! All joking aside, what it comes down to is this: As long as there is information people want to protect, there is going to be someone who wants to read it, distribute it, sell it (?). Let's play a mental game.. Suppose we come up with a truly proactive system to protect a home PC (which are mainly target to be zombies against riper targets). All a hacker need to do is purchase a copy (or download it from IRC or some file-sharing service) and keep trying their virus or exploits against their own system on their own network until it works. Now you're still going to be dependent on the old reactive system of doing things to patch your brand new proactive system. Until we change the way we think about network security and adopt more distributed solutions to this problem, it's going to very difficult to stop these people. In my opinion, it's going to take a completely different way of thinking about networking which, sadly, probably won't happen until some new technology necessitates it.
Government's view of the economy: If it moves, tax it. If it keeps moving,regulate it. If it stops moving, subsidize it.
The problem is that the hacker would be using your computer resources for other illicit purposes, such as hacking computers belonging to other businesses. It would solve your problems at the expense of others. And imagine the liability of having their attacks traced back to your computers.
It would be no different than giving guns to thugs to protect your business. When they do finally get busted, the FBI will find your fingerprints on the guns.
A worm which would spread fast like slammer and destroy infected machines after a short time is actually benevolent. It will destroy only machines that would otherwise be used as spam zombies. The day after the outbreak the internet would be clean again!
Patents Drive Free Software as Hurricanes Drive Construction Industry
A group of whitehat extremists may become tired of lusers that don't patch their systems, and decide that they don't deserve to use the internet.
They then launch their virus and destroy on all non-patching infidels.
What, it could happen.
Um, dude, about those gates. We had to remove them because they were interfereing with us getting in and out of the city to rape and pillage in our 20% of Rome. Oh, and by the way, we decided that we would rather rape and pillage in the 20% of Rome that contains the forums. Raping and pillaging in the slums wasn't working.
Yours truly,
The Visigoths.
From the summary...
In a sense we are fortunate that most attackers want to control and use systems they attack rather than destroy them.
Personally, I find it unfortunate. We would be more fortunate if the attackers did seek to destroy. I'd rather irresponsible people's computers were fried than to get tons of spam and viruses sent by them.
Yeah. The problem is when they decide you need more "fire insurance."
... but it would be pretty interesting days to live in for a time. Just imagine the circus! =)
;-)
Then again, it might just be good for us who run not Windows. I mean, most important servers and the like aren't running Windows anyway, and those who do are probably pretty well firewalled. So we'd have the internet all to ourselves - probably the only thing I'd notice for quite some time is a shorter "Online Buddies" list.
Now, if we had the games, imagine those ping times!
Spine World
*Workable means you can do this in finite time.
1) For each function, determine the preconditions, postconditions and the formal description of that function.
2) For each of the derived specifications, modify the specifications to be robust (ie: no invalid states are possible).
3) For each subunit of code that is referenced outside of the unit it is within, add mandatory access controls with a default of "deny", except for the mandatory access control system's check access function which should have a default access of "accept", and the bootstrap code which should have no access controls as the MAC system won't be running at the time.
4) MAC systems should be heirarchically defined in terms of linking a set of users to a set of rights those users can have. You then have as many mappings of this kind as you need. But because it is heirarchical, an application run by another application cannot assign rights it doesn't know about, nor can it assign rights to users it doesn't know about. An application accessed by paths with different rights must associate the rights to the path used to connect to it and define those as the superset of rights that path has when calling sub-components.
Oh, and MAC system interaction should follow the paradigm laid out under the Bezantine General's Problem - in other words, MAC systems should distrust each other enough that they can detect any MAC system that turns traitor.
5) MAC should apply to EVERYTHING. The network, memory pools, swap space, shared memory, everything. No resource should have permit access rights by default and no resource should allow unconstrained access granting. The resource should be able to control who can be granted access, so no one central system hands out access.
6) Remote connections (via any kind of connection outside of the defined physical machine) should be secure channels (host authentication, user authentication and data validation) and should have access rights limited to the subset of rights allowed to both remote connections, the remote host and the user who is performing the access. This is in addition to any constraints imposed by the application being connected to or any access rights it inherits (and is therefore limited to).
7) As part of 5, no "superuser" account should exist. Administrator accounts should only be permitted to administer, they should not be permitted to do anything else. There would be no "root" account, for example.
8) Once the specification has been hardened as above, it then needs to be re-implemented as code and then the code must be formally verified against the specification for correctness.
The first consequence of all of this is that paths would be very tightly constrained, making any kind of breaking out of the box about as close to impossible as you can get.
The second consequence is that because all access control is independent (but heirarchical), breaking the security of one module won't affect the security of anything else and won't grant any rights in excess of the subset defined by the intersection of the rights allowed by the path of connection, the broken module, the module then accessed and the broken module's rights within the module then accessed.
The third consequence is that, because the default is "deny", nothing can do anything not explitly authorized by the entire chain of connections.
Could this be done in Linux? Sure. If you add the kernel, X, KDE/QT, Gnome/Gtk, the GNU suite, etc, together, you're probably talking a billion lines of code. One million coders could probably do this entire eight-step lockdown over the whole of that codebase in a year, maybe two. There are more than a million coders o
It's a small world and it smells funny; I'd buy another if it wasn't for the money; Take back what I paid (SoM)
"In a sense we are fortunate that most attackers want to control and use systems they attack rather than destroy them."
Right, but I really don't see too much of a difference between a computer under the control of a hacker or hacker group and a destroyed computer, because either one makes a computer unusable for your average end user.
It's an exhaustive effort to get rid of hackers once they're in since they install all kinds of nasty software, so for people who don't know much except their computer is doing something weird and they're having their identity stolen, etc etc, they just throw it out and get a new Dell. I am not saying this applies to every user that doesn't know much about computers but I have seen it over and over again with friends, family, family friends, you name it.
So bottom line is, for a lot of people who have no expertise with computers, destruction of a computer due to hacking OR having the computer infected and controlled by hacker groups means you get rid of it, in which case there's not much difference between the two, since it leads to the same result.