Slashdot Mirror
Inside The Twisted Mind of Bruce Schneier
I Don't Believe in Imaginary Property writes "Bruce Schneier has an essay on the mind of security professionals like himself, and why it's something that can't easily be taught. Many people simply don't see security threats or the potential ways in which things can be abused because they don't intend to abuse them. But security pros, even those who don't abuse what they find, have a different way of looking at things. They always try to figure out all the angles or how someone could beat the system. In one of his examples, Bruce talks about how, after buying one of Uncle Milton's Ant Farms, he was enamored with the idea that they would mail a tube of live ants to anyone you asked them to. Schneier's article was inspired by a University of Washington course in which the professor is attempting to teach the 'security mindset.' Students taking the course have been encouraged to post security reviews on a class blog."
This article just confirms my belief that a good security professional needs to have destructive mindset. You need to feel the urge to abuse the system as soon as you have seen it. I was not good at it, quit security research to join development!
It seems like ever since Bruce left the cryptography world for general security consulting, he's become less interested in giving useful advice and more interested in self-aggrandizing.
I couldn't help but wonder how you reconcile your security mindset with an open wireless network at home. A while ago you proposed an open network in the name of politeness http://www.schneier.com/blog/archives/2008/01/my_open_wireles.html
Such a personality may be disastrous in many other cases but works well when it comes to security work.
And remember that most computer viruses in the beginning weren't really malicious - they just were there "because I can". Even those cases has to be taken into account by security people.
If builders built buildings the way programmers wrote programs, then the first woodpecker would destroy civilization.
You can get a port-a-potty delivered without ever providing positive identification. You don't even have to pay for it until it shows up, and they'll happily deliver while you're at work. They're quite used to people preparing to have renovations done by contractors.
Of course, I would never decide someone else needed a port-a-potty on their front lawn. But, much like the ants, it's something you can't help but notice if you have the right mindset.
Anyone can do what Bruce implies only "special security people" can do. It's just that most people don't because there is no incentive to. You might as well announce that your special security mindset has noticed how easy it would be to go into restaurants and put poison in the salt shakers. Hell they are wide open! What were the salt shaker designers thinking of! But of course normal people are just not interested in doing that.
"Don't belong. Never join. Think for yourself. Peace." V.Stone, Microsoft Corporation
RTFA! "There's nothing magical about this particular university class; anyone can exercise his security mindset simply by trying to look at the world from an attacker's perspective."
"I have downloaded hundreds and hundreds of records, why would I care if somebody downloads ours?" Robin Pecknold
"This kind of thinking is not natural for most people. It's not natural for engineers. Good engineering involves thinking about how things can be made to work; the security mindset involves thinking about how things can be made to fail"
In my opinion, good engineering involves thinking that things _will_ eventually fail, how it can be made to fail _safely_ if possible and figuring out what the acceptable risk is given the cost. Modern engineers don't normally design stuff to last for 1000 years (some of it might last that long - distribution curves and all that).
I do crypto for a living .... my bank really really wants me to to use their web banking service - but I have a dilemma - is it safe? if I try and break their security to test them a couple of things might happen: if it's any good they'll catch me and I might go to jail .... if it's crap there's no point in me using their service - so I can't win and can't use their service
I used to look forward to reading what he had to say - in the 1990's. Now when I see these articles about what the almightly Bruce Schneier says I cringe. He did some decent work, but I think the main reason for his high profile comes from a book which was essentially a derivative of several other classic tomes in cryptography, like Stinson. For me, he has become the Dvorak of security.
Bruce Schneider Facts
The last time someone tried to look into Bruce Schneider's twisted mind, the Big Bang happened
My instincts on this are more of "how would a criminal or terrorist" behave in this setting" because I grew up in a law enforcement family (both parents plus extended family). I've made a few "regular people" upset in the past by pointing out the idiocy of their evacuation plans to them in pointed detail. One example comes from high school when the school shootings were just starting to disappear from the news.
Our school gets a bomb threat, and the teachers and administrators are freaked out. They move us all, I kid you not, to the football field where we are fenced in by chain link fence, about 1/3 of which is covered by barbed wire. So I point out to my history teacher, one of the only genuinely intelligent public school teachers I have ever met that we had been corralled into an enclosed area, surrounded by strong sniper nests (there were many points where a shooter with a 30.06 and a few mags could have unloaded with impunity), and that ironically, if there were a bomb, and the person who planted it were clever, they'd have put it under the bleachers where about 200-300 of us were sitting.
He nodded his head in agreement that were this a real thing, we'd probably be fucked because of our administrators' plan, but the one or two regular teachers not far away who overheard acted like I was the real danger for pointing out what should been "the obvious" about this plan. Me? I'd have called in the buses, and shipped everyone off property to be safe right away.
While I agree with many points of the article - specifically that a security professional must have an unusual mindset - I am troubled that the examples leave out the cost-benefit analysis. As an example, the article correctly points out the vulnerability associated with picking up "your car" from a service department. All you need is a last name, no ID. This is an obvious vulnerability. On the other hand, the service department is motivated to make the process as streamlined as possible for its customers. Demanding IDs, etc., will slow down the process. The more cumbersome the process, the more likely customers are to use a competitor. Therefore, they need to trade security with cars to the cost of loosing customers.
I am reminded of the time that I test drove a new car. All the dealership wanted was a photocopy of my driver license, and they let me drive the car off the lot for an extended test drive. Since driver licenses are relatively easy to fake, I wondered how often cars are stolen. I asked, and was told they are stolen on occasion, but insurance covers it. My point, they did the cost-benefit analysis, and decided on an insecure method.
Seriously: I agree with a lot of what he has to say. I am amazed at the number of programmers who do not follow Henry Spencer's 6th commandment for C programmers - check function return codes, they simply assume that it will work correctly.
If something can go wrong - it will, and often at the most inconvenient time.
I do this all the time... I actually am quite surprised at the number of everyday things that have such simple flaws.
In the hospital waiting for my wife the other day, I watched a mailwoman with a big trolley full of mail, sorted into departments, insert several people's medical records into the trolley and then walk off out of sight through locked doors (which were opened by her tapping the glass and standing to one side) leaving the mail unattended. It wouldn't take much to a) gain access to the baby ward that is supposed to be secure by posing as a mail woman or b) stealing someone medical records just by knowing they were in hospital that day and one department that they would have to visit.
The other, from working in schools, comes from the Tesco Computers For Schools voucher scheme. For every £10 spent in a supermarket, customers get a flimsy paper voucher that they can give to the schools (only schools) who, when they have a few thousand, can trade them in for a free computer or computer hardware. Most people just throw them away, and I actually collect hundreds from the floor outside shops on my way home.
First, the vouchers are simply printed pieces of paper - there isn't any security on them at all. The only "barcode" is always "1234567890X" and every piece of paper is identical - it's also just cheap, bog-standard paper. Secondly, the schools can collect amazing numbers of vouchers just by running campaigns or by collecting harder, so there are schools that collect 5 vouchers one year and 50,000 the next. Thirdly, the vouchers are *not counted* at the other end. They are weighed approximately (if at all - I don't believe that Tesco's actually weight millions of vouchers each year and worry about the accuracy). I always wonder how much it would cost to print, say, 10,000 identical vouchers of your own to the same standard compared to the cost of a video-editing PC and lots of educational software supplied with it. Or to try your luck by declaring false numbers of vouchers and thereby learn the accuracy that they measure to (yes, you TELL Tesco how many you have, you can even do that online, and then send them off later to be "verified").
That, and working in IT in a school means I'm always looking for ways into the building, past staff, into the computer systems, etc. Some schools are amazingly lax while others are like Fort Knox.
I have written a long long reply to his article at my blog (no ads, etc.)
Short summary:
In my opinion, security in real life is not about "what can go wrong". It is about "how often and how much can it go wrong and am I prepared to handle those cases". In short it is more about how to calculate risks accurately and knowing when to take them.
Sadly the world we live in today has massively overestimated the possiblity of problems and hugely inflates the effects they will have (in the tiny percent of occasions when they happen). I think this is a side-effect of improved communications: we all get to hear about the 1 in a million disaster stories, but never about all the other times, when everything goes right. This leads us to think that problems are more common than they actually are.
The great thing about being a security professional is that you can never be proved wrong. If you claim a security hole and it is never exploited, no-one will say you're wrong - just that it hasn't been exploited yet. If we beleived everything these guys say, no-one would ever do anything as we'd all be too scared. Personally I think we should avoid the obvious problems, get on with our lives and accept that on a few, very few, occasions we might have to spend a little time sorting out a problem.
politicians are like babies' nappies: they should both be changed regularly and for the same reasons
Over the Christmas holidays, when work is always slow, I have a long habit of putting on my hacker hat and seeing what our vulnerabilities are. I think every developer owes it to their sanity to do this regularly. You will find so many opportunities for SQL Injection--no matter how careful your developers are--and Cross-Site Scripting and just a bunch of other holes. You do not want to be in a conference room some day explaining to your boss's boss why your program allowed a hacker to gain access to the company's systems through your app. This is a no-brainer.
One example used was getting the car from the repair shop, with just a last name.
Where I get my car serviced, I know both guys who might be behind the desk, and they both know me, my wife, and son. They won't hand over the car keys on just a last name. Which brings it all back to a frequent point of Bruce's writings - all of the security razzle-dazzle in the world doesn't make a bit of difference compared to a knowledgeable person in the right spot.
The living have better things to do than to continue hating the dead.
Good engineers need to look for how things can fail, too. They need to look for small parts that children may swallow, weak latches that can allow lids to fall open, weak load-bearing structures... how the environment can make their products fail. They need to look for how things can be made to fail, as well, because the hostile human element is always part of the environment... the same factors that make someone a good engineer make them a good security expert.
The problem isn't that good security professionals have a different mindset from good engineers, it's that both good security professionals and good engineers are rarer than people think, and that engineers are not as often held responsible for how their stuff fails when someone gains an advantage by deliberately making them fail.
As in many other areas of life, I try to ask myself, WWFD? What Would Feynman Do?
I described this as "PsychLim: naive to criminal mindset, -10" on a Champions character I played back in the day.
Constitutionally Correct
Speaking of security analysis, there are scripts from 9 different domains on that page, none of which are required to read the article. WTF. Thank god for noscript.
Give me Classic Slashdot or give me death!
Without disagreeing with anything at all the article, I'd like to raise the point that an awful lot of things have no security, or very porous security.
What saves society is three things.
First, mischief and curiosity aren't a powerful enough motivator to create a real problem. I don't know whether Schneier ever sent live ants to strangers... or how many Slashdot readers will try it... but most likely not very many.
Second, for most security holes it is difficult to think of a way to make money from the exploits.
Third, even if you can make money, it's even more difficult to find a way that will make significant amounts of money and to repeat the exploit often enough to make a living wage, without being caught.
Case in point: newspaper vending boxes which allow you to pay for one newspaper and access a whole stack of them. If you have a "security mindset" (or even if you don't), it occurs to you that you could pay for one and take two... or ten... or the whole stack. And, indeed, you can. The problem is that it doesn't benefit you to get more than one newspaper. So, can you take two and sell the extra? Maybe. Net profit $0.50. Could you take the entire stack out of the machine and dress up as a street vendor and sell them on a street corner? Maybe. Net profit $25. Could you do it more than half-a-dozen times? Probably not.
How about self-checkout lines in supermarkets? You can buy produce at them, and the produce isn't bar-coded. So, you can buy orange bell peppers at $3.99 a pound, put them on the scanner scale, and enter the code for green peppers at $1.69 a pound. Most supermarkets seem to rely on someone at a nearby counter keeping an eye on the self-checkout lanes while doing other things, and they don't usually come over unless a customer calls or the machine goes into an error state. Again, it's hard to see how you can make money, rather than saving a little on your grocery bill... and if you managed to do this to the extent where you were stealing hundreds of dollars, I think your chances of being detected get to be high. (I'm thinking of people who got caught recently pasting barcodes for two-dollar items over things like boom-boxes and DVD players...).
"How to Do Nothing," kids activities, back in print!
When investigating/examing internal controls over cash, you use the same idea.
How can you get money out of the system?
If you can find it, so can someone else.
...I would keep my AP open simply to provide a path of least resistance to the internet. I'd configure it behind a router that would block a healthy number of outgoing ports to prevent network abuse (making it difficult to run port scans, use SMTP, spew worms or other exploits, etc.). I might leave it open for P2P, but set reasonable QoS restrictions on traffic. I could let guests or passersby use that AP without much fear of their security competence. I might keep logs, but I'd prefer not to unless legal counsel indicated that I'd be subject to ISP recordkeeping requirements for providing an open AP (with the rationale being that if I don't monitor or log, the access would be anonymous and it would be up to someone else to put the pieces together if they were investigating wrongdoing). I'd have my wired network on the other side of that router (or maybe throw a second router into the mix). If I needed to access files on my wired network from a wireless client, I'd probably VPN to it through that open AP. That would make the public AP portion of my network useful for the primary reason someone might want to trespass, but would give me enough control to direct that trespassing in a direction that wouldn't put my private network's defenses in the sights of much of anyone. There wouldn't be all that much of a reward for attacking my private network at that point, if someone wants internet access, they could just take it, and I'd make sure it would take more effort to get past my private defenses than curiosity or the chance of possibly acquiring personal information would be impractical.
I don't understand if you are joking or logically chalenged.
For example its even safer to try the joy of capital punishment legal execution is just one in 5,647,247.
Factoring large primes isn't difficult. It's impossible.
A prime is a number that cannot be factored.
Sounds like you've been learning your security from Bill Gates.
In times of universal deceit, telling the truth gets you modded -1 Troll
So studying the security as it relates to computer science is certainly worthwhile, and computers complicate security signifigantly; largely due to the lack of rigor and quality endemic in the software and hardware industries today.
- "History shows again and again how nature points out the folly of men" -- Blue Oyster Cult, 'Godzilla'
In the forward of the great book Why Buildings Fall Down, Matthys Levy tells the story of an elderly relative. When she was presented with Levy's previous book about how buildings stay up, said she would rather know why they fall down. Levy's book is a good read for security people and almost everyone who works in systems and networks.
Engineers mindset is "If it ain't broken, don't take it apart to find out why!"
Good security is based upon reality and common sense. Common sense is a function of having common knowledge.
This had me flashing back to elementary school arithmetic. It happened to me a hundred times. The textbook showed an equation and made a statement about it. The textbook showed another equation and made a statement about it. Then the textbook showed a third equation and asked "What can we say about this equation?"
My answers always started the same way. "It's printed in ink on paper." I don't really think that the textbook author expected people to do anything other than to extend whatever line of reasoning had been presented in the previous examples (and I always got around to that) but the open-ended question "What can we say about this equation?" always struck me as license to comment on the clarity of the typesetting or anything else.
My teachers thought I was weird.
Later in life, I became involved in competitive pistol shooting. I loved the rule books. They were just collections of hidden loopholes begging to be found. And then came the problems. In some sports it was called the "engagement" rule. In others, it was the "spirit of the rules" rule. They were all the same sort of thing - a way to say you couldn't do anything unexpected. If you looked at a practical defensive scenario and found some completely whacky way to beat it by, say, running between cover in an odd sequence, you'd be found guilty by the officials of "failure to engage" the scenario. No points for you. A guy I knew had trouble seeing sights too close to his face but the rules forbid changing the sight radius (distance between the sights) making it impossible for him to move the rear sight further from his face. He responded by cantilevering both sights forward so that the sight radius stayed unchanged but both sights were now completely forward of the muzzle. It was perfectly legal under the rules as written but his pistol was declared illegal because it violated the "spirit of the rules."
What amazes me is the hostility this mindset engenders. I'm not shy about saying that I love to parse out the rules and find advantages. I'm not shy about saying that a "spirit of the rules" rule is really just saying "You're not allowed to be smarter than the people writing the rules and running the match." The reaction I get is flaming on message boards and accusations of poor sportsmanship. There are actually people out there who want to punish innovation; at least, that's the way I look at it.
"Thinking different" makes people feel threatened and act nervous and hostile. I don't understand that. Am I weird, or are they?
As copyright owner of this comment, I authorize everyone to defeat any technological measure which limits access to it.
You don't have to have a destructive mind. Look at any mathematician, that's exactly what they do, find the exceptions to the "rule" and they don't call it a rule until they prove that there are no exceptions. That's why mathematicians are gret security guys. This reminds me of these jokes: http://math.arizona.edu/~mcleman/MathJokes.html
I've seen several posts on here (like yours) suggesting that paranoia is a source of the security mindset.
I'm sure it is in some people, but it's not in me. The motivator in me is a desire to cause a bit of troublemaking. Enjoying seeing institutions have egg on their face when I point out they have a lousy design/lame thinking.
I don't know what motivates Schneier but if anything he has much more "anti-paranoia" than anything--he spends more time debunking security fears than actually talking about potential exploits.
I like your example, but I have known people to routinely purchase a newspaper from a rack, and then place the entire stack of papers on top of the rack as a gift to passersby. Check out Steal This Book by Abbie Hoffman.
Perhaps some conscientous person who was going to purchase a paper might put in a quarter and replace the rest of the stack. I never saw that and I must admit that at the time, it didn't occur to me.
Assembly is the reverse of disassembly.
It takes a "thief" to catch a thief. You need to think, eat, breath and live that mindset. Doesn't mean you are one, but you need to understand the drives and if possible, understand and replicate the emotional drives that give forth the cognition of breaking into somwhere. I guess at the end of the day this is profiling based on one archtype.
The Tao that can be named is not the Tao
I think you're misunderstanding those statistics. They say nothing about the number of drivers, which is also important!
I'm not saying that motorcycles are riskier, because I don't know how many drivers there are of each. I'm just saying that the risks could still be disproportionate if the odds are that high even when many fewer people actually ride motorcycles given on my drive, motorcycles are less than 1% of traffic. So, if their odds of dying are that high even though they are that few, it may still be more dangerous to ride one.
... to sit in front of the front gate and smoke the first 40 kids who come out of it. Now, fast forward to the next day: "You KNEW there was a TERRORIST IN THE NEIGHBORHOOD and you LET OUR CHILDREN GO OUT THE FRONT GATE?!?" Instant loss of job at a minimum.
This is why we have elaborate terror defense scenarios: because if the scenario didn't work, well then, it is that wily terrorist's fault. If an improvised plan doesn't work, then it is fault of whoever was on the scene at the time.
(Interesting question: what would happen to the security professional who said "Assuming an armed assault on an American public school, significant student fatalities are inevitable. We should accept their inevitability and try to rescue as many students as possible rather than using loss-prevention policies which increase the likelihood that the loss will be total.")
Help poke pirates in the eyepatch, arr.