Slashdot Mirror
The Next 50 Years of Computer Security
wbglinks writes "An informative interview with Linux guru Alan Cox, with an emphasis on Linux and security. Alan will be the keynote speaker at EuroOSCON this October." From the article: "It is beginning to improve, but at the moment computer security is rather basic and mostly reactive. Systems fail absolutely rather than degrade. We are still in a world where an attack like the slammer worm combined with a PC BIOS eraser or disk locking tool could wipe out half the PCs exposed to the internet in a few hours. In a sense we are fortunate that most attackers want to control and use systems they attack rather than destroy them."
[...] at the moment computer security is rather basic and mostly reactive.
OpenBSD has been proactive since Day 1. And, really, can anyone speak authoritatively on computer issues 5 years in advance let alone 50?
If I drank a strong tea brewed from Theo de Raadt's toenail clippings I could glean knowledge from perhaps a couple of days in the future, but beyond that you're getting into the realm of Xenu.
Trolling is a art,
I can't see how anyone can claim to know what is going to happen in the next 50.
The controls that an organization would need to put in place to avoid being utterly exploited in such a scenario are pretty much the same controls needed to manage systems securely in the first place. So as a thought experiment, this is useful. As an actual practice, forget it.
Parity: What to do when the weekend comes.
"In a sense we are fortunate that most attackers want to control and use systems they attack rather than destroy them." - however in a sense we are unfortunate that they generally take control of them to destroy someone elses computer, it just depends on how selfish you are.
Matthew Grint Midnight Artists
Sounds like a classic protection racket to me.
This last area is very important. We know the theory of writing secure computer programs. We are close to knowing how to create provably secure computer systems (some would argue we can--e.g. EROS). The big hurdles left are writing usable, managable, provably secure systems, and the user.
It may be possible to establish "limited" proofs of security which are tightly defines in small areas but a provably secure operating system is impossible. It's impossible on so many levels that I expect that Alan Cox doesn't understand the issues deeply enough.
There are a number of problems with creating a secure operating system. One is the amount of code it takes. You can't create a security proof on huge volumes on code. Hundreds of lines? probably. Thousands of line.. maybe.. hundred of thousands? no chance.
The next problem is that we haven't figured out a way to make security modularise. You can't say "method 1 is secure, method 2 is secure therefore using method 1 after method 2 is secure. It just doesn't work like this. You can put two secure pieces of code and get insecurity. This means you have to treat the whole operating system as one huge program all of which needs to be proven secure.
The third problem is that even you establish a proof of security this still isn't enough. Your proof is based on some formalisation of the language but the compiler itself might be buggy (either by accident or on purpose) and might compile in a way that breaks your proof. Ouch! cuO
Too often we strive to absolutes in security. Security is not binary. It is not a zero or one but a complex set of trade-offs and risk mitigation.
Simon.
cos if they actually destroyed them, then people would take proper care... apparently, it's quite normal for people to view their ms-windows boxes filling up with vermin etc. as just a fact of computer life... they only do something when they can't get online anymore... and then it now appears cheaper to buy a new box than get the damned thing fixed properly...
Donald 'Duck' Dunn: We had a band powerful enough to turn goat piss into gasoline.
.
There are a large number of problems with your suggestion. I will outline only one.
... and then six months later your computer will be part of a gigantic DDOS or some other illegal act so large it will attract the FBI's attention. From here there are two possibilities. Possibility one is, the people you've been contracting with here are a legitimate business, in which case the FBI will get their contact information from you and have them arrested. Possibility two is, the people you've been contracting with here are not a legitimate business, in which case the FBI will arrest you for conspiring with an organized crime group. We can assume no group even remotely competent enough to even get into this hypothetical security "protection" business in the first place would be stupid enough to let possibility one happen. This leaves possibility two. See the problem?
One problem is that your suggestion is wholly founded on the assumption of computational resources being valuable. This is to an extent incisive, since you have realized that the reason why the formation of zombie networks has increasingly become the endgoal of worms and such is that there is commercial value in those networks' computational resources. But this breaks down when you start to think about what they use those computational resources for.
Computational resources, by themselves, aren't particularly valuable or hard to obtain; even bandwidth resources are beginning to become expendable if you're smart about how you use them. Your average PC is absolutely awash in power it doesn't need. 20 years of "your computer is obsolete as soon as you buy it" has crashed out into "your five-year-old computer technically isn't obsolete yet". People who used to buy supercomputers often now just buy cheap PCs and leash them together. Anybody who just has a legitimate need for a lot of computation these days can most easily obtain this through totally legitimate channels.
The reason why hackers, worm-builders, spyware peoples, etc obtain their resources through illegitimate means (like worms) is because they have illegitimate intents for those resources. They don't so much want 20% of the resources of a PC, they want 20% of the resources of a PC that can't be traced back to them. This is because once they have these resources, they're going to be using them for things like, warez. Sending spam without compliance with local laws. Hosting dubious and virus-like spyware. Extorting businesses for money in exchange for not launching DDOS attacks against them. If you willingly give these people 20% of your hard drive and CPU they aren't going to be using it for things like 3d rendering or protein folding; if that was all they wanted, they wouldn't need to be using hacker methods to get it in the first place.
Instead, if we go by your scenario, you'll give them 20% of your hard drive, CPU and bandwidth; they will protect you from the other hacker groups; everyone will be happy;
Irritable, left-wing and possibly humorous bumper stickers and t-shirts
>
> And once you let someone compromise your system, you'll never be able to fully trust it again. It's about the stupidest idea yet in computer security. The only reason it wasn't on that list of "top six stupid things" the other day is because it's not an adopted practice, and isn't taken seriously.
Is that not the functional specification for Windows Update? ( Ha ha, only serious.)
For that matter, is that not the functional spec for every automatically self-updating piece of software?
Your machine is as trustworthy as those you permit to administer it. To the extent that you install auto-updating software, your machine is only as trustworthy as the authors of that software.
I'm highly confident that when my cron job asks apt-get to phone home, the maintainers of $MY_PET_DISTRO won't take advantage of the opportunity to place anything nasty on my machine.
I'm somewhat confident that Microsoft isn't going to auto-disable even pirated Windows installations, nor to install a RIAA/MPAA sniffing trojan as part of its updates - at least, not without providing a few weeks of warning.
I had so little confidence (as a matter of personal opinion) that the auto-updating and installation of DRM/software subscription services from www.steampowered.com, that I never purchased Valve's Half-Life 2. (If you trust Valve, hey, go for it -- but Steam is, IMO, fundamentally no different than having companies like EA and Adobe decide to outsource the management of "licencing component services" to organizations like Macrovision and the BSA. Would you like to get your "security components" from DRM providers?
And finally, I'd have no confidence whatsoever in any machine that was required, as part of the Homeland Cybersecurity Act of 2012, to download security updates from updatefarm.cybersec2012.gov.
On that scale, I'd place the original "cracker group" (perhaps affiliated with the Russian mafia) installing its own rootkits as somewhere between "less trustworthy than Steam, but more trustworthy than bsa.org".
But there's fundamentally no difference between any of these options.
"In a sense we are fortunate that most attackers want to control and use systems they attack rather than destroy them."
This is not necessarily a good thing. I've read that Ebola and other very nasty diseases don't spread as far as they might, because they wipe out their carrier population too quickly. As opposed to HIV, which has time to slowly spread out. If an infected PC self-destructed after one round of outbound spreading, then it's not going to be continually spewing the junk like they do today.
Such a virus would burn through the supply of unprotected PCs quickly, and then go away.
A worm which would spread fast like slammer and destroy infected machines after a short time is actually benevolent. It will destroy only machines that would otherwise be used as spam zombies. The day after the outbreak the internet would be clean again!
Patents Drive Free Software as Hurricanes Drive Construction Industry
A group of whitehat extremists may become tired of lusers that don't patch their systems, and decide that they don't deserve to use the internet.
They then launch their virus and destroy on all non-patching infidels.
What, it could happen.