Slashdot Mirror
Dan Geer On Trusting PCs In Botnets
walk*bound writes "In an essay published by ZDNet, security scientist Dan Geer has an interesting proposal for e-commerce sites to evaluate the trustworthiness of clients that try to connect. Assume that end users either always say 'Yes' or always say 'No' to security dialog boxes. Then make the decision one of two ways: 'When the user connects, ask whether they would like to use your extra special secure connection. If they say "Yes," then you presume that they always say "Yes" and thus they are so likely to be infected that you must not shake hands with them without some latex between you and them. In other words, you should immediately 0wn their machine for the duration of the transaction — by, say, stealing their keyboard away from their OS and attaching it to a special encrypting network stack all of which you make possible by sending a small, use-once rootkit down the wire at login time, just after they say "Yes."'"
for Sony, for one. Yep, can't say enough good things about root-kitting your customers...
The cesspool just got a check and balance.
Where's the Monty Python foot icon? This has to be a joke.
"A week in the lab saves an hour in the library"
BTW, I think this is an interesting essay in the sense that it dares suggest that users are mostly responsible for the security of their computers, not Microsoft. The vast majority of people who have 0wned machines are in that state because they did something they shouldn't have. There's no coding around that, I think. Unless we deny users the right to use their computers... or educate them.
The twitter monologues. Click on my homepage and be amazed.
The premise is flawed. Just because someone wants extra security doesn't mean they always click yes to questions. Maybe they just want extra security.
A better test would be to popup 'would you like a free ipod'. Having pointed this out, I do have to add: this is a retarded idea.
Not Meta-modding due to apathy.
A dialog pops up asking "do you want to use a secure connection or not" on your internet stock-buying site.
I would assume that any reasonably secure computer user would.... say yes? I mean, I suppose this approach would work if you assumed *everyone* either always said yes or always said no... but what about people who pay attention to what URL they are at (yes, this is *really* the site I want to buy stocks from) and *read* the prompt (yes, I would like to use a secure connection). You've just root-kitted (well, tried to rook-kit(heh, root-kit as a verb)) your most secure and computer-savy users. They aren't going to like it.
If my trusted e-commerce site decided to give me a root-kit or take control of my keyboard/mouse... well they wouldn't be *my* trusted e-commerce site anymore. Now, if you have a security dialog that anyone actually reading *wouldn't* agree to this approach might work, as the *only* ones who agreed would be the ones who automatically say "yes."
So yes, instead of taking a little loss on people who got tricked into buying someone else a stock you should *obviously* try to trick and "0wn" your clients for agreeing to a reasonable proposition ("would you like to use a secure connection with your trusted e-commerce site"). That is *clearly* the best approach.
Does a line appended to your comment give your post meaning in and of itself, or only in relation to those without?
Is there anyone else here who read the summary and thought "What the fuck?!"
The game.
Only a half-flawed premise. You're right in that the variable isn't "yes" or "no". I'd suggest that there is a variable that can be measured, and it's the time delay between display of the warning and user-response.
The guy who clicks "yes" in less than 500 milliseconds + (2 * latency_between_You_and_Client) can be assumed to be pwn3d. He clicks "Yes" to everything.
And the guy who clicks "no" in the same interval is just as likely to be pwn3d. He clicks on everything.
The only secure systems are run by people who take at least 5000 ms (5 seconds) to go "Huh? WTF?" and make a choice. They're the ones who can't be (immediately) assumed to be pwn3d.
If I read such a message and parse it as "WTF? That's not a valid request by any server I understand for the use of a secure protocol! IT'S A TRAP!", and click "No", I'm paranoid enough that I'm not likely to be pwn3d. Similarly, if I read such a message and parse it as "WTF? I have no idea what wrapper he's using around HTTPS, SSH, sftp or whatever, but that's gotta be from some kind of wrapper!", I'm also thinking hard enough that I'm not likely to be pwn3d.
If I offer you a virus and you happily run it because you think it will give you more security, I think that's a reasonable test to see whether or not you're likely already infected with a virus (because even if you weren't, you are now).
How we know is more important than what we know.
I have to say (and I know I'm putting my karma in front of the firing squad here), this kdawson guy really knows how to pick em...honestly, it seems that every time an off-topic, ridiculous, or horribly misleading tagline enters the front page, all I need to do is look up from the painful summary paragraph and there is good ol' posted by kdawson, smiling down from above.
I think the dialog box should say, "Would it be alright to install a root-kit on your machine?".
The ones who say "Yes" to that are justifiably pwned. Everyone else is reasonably trusted and left alone. It's a good filter!
licet differant, aequabitur
Have you considered the possibility that someone has broken into the stock buying site and now would like to get into your banking site? Maybe because, I don't know, they think you might have *more* money in your bank account that the stock buying site doesn't have access to and they'd like that money too? Honestly, if your stock buying site tells you that you need more security than your browser supplies and asks that you download some random piece of software that you can't even inspect to ensure is not malware, then say no.. otherwise you're most likely installing a key logger as the stock buying site would have to be pretty dumb to think asking people to run arbitrary code is a good thing.
It's like people who ask you to run an ActiveX control because it is "more secure". They're obviously idiots and you should take your business elsewhere.
How we know is more important than what we know.
Really, why should the test be the user's reply to a question? If you can install your rootkit on the users machine simply because they've visited your website, and you believe your users visit websites that are not yours, other sites can and probably have installed their rootkits. So what you should really do is quietly test to see if you can install your super secure rootkit, and, if so, do it. If you can't install it, they're probably safe to do business with.
Seriously, using user behavior to assess security risk isn't a dumb idea. But the way this essay frames it is just silly. With the number of assumptions he's made (about user behavior, having a super "rootkit" that can defeat all others, etc.) he might as well go the whole nine and just own everyone he can.
.sig: file not found
...overlook the obvious case that most people just want the functionality a website offers, and hence will accept installations and such to obtain it. Most people really do not understand what is at risk when installing something from a third party, but then again, most really do not care. If at the end of the day they end up getting screwed, they'll call a lawyer.
Maybe instead of chronically pointing to the stupid lusers, we in the IT industry should shoulder the blame for the apathy out there concerning computer security. Should we really expect everyone to have to run a 5 stage security check on every "piece of shiet" website someone interacts with?
What have we in IT provided the users to diminish the need for everyone having to become a security expert?
Opinion:=TMyOpinion.Create(Me);
A few of the commentators on \. have managed to translate the editorial into a proposal that actually might make some sense, but reading it as written, the proposal is the worst, most idiotic analysis I've heard today.
http://www.geoffreylandis.com