[Full-Disclosure] Security & Obscurity: First-time attacks and lawyer jokes

From: Peter Swire (peter_at_peterswire.net)
Date: 09/02/04

  • Next message: Peter Swire: "[Full-Disclosure] Security & Obscurity: physical-world analogies" 
    To: "'Dave Aitel'" <dave@immunitysec.com>
Date: Thu, 2 Sep 2004 12:24:29 -0400

    Dave Aitel wrote detailed comments, which I appreciate, and I respond to
    some of them here. Others in the threads have made some similar
    comments.

     
    > As the Japanese Proverb says, "Only painters and lawyers can change
    > black to white."
    >
    > What are your goals with this paper? If you seem to have gotten a
    mostly
    > hostile response, than keep in mind that this is a ten year old debate
    > in this, and other on-line forums, and that despite your previous
    "White
    > House Privacy Czarness", you don't have any information security
    > background.

            I plead guilty to being a lawyer and law professor, who has
    practiced law, worked in the government, and taught for a bunch of
    years. Small measures of self-defense on my lack of infosec background:
    (1) I've taught semester courses on the Law of Cybersecurity twice in
    the past two years. (2) I presented earlier versions of this paper
    before technical audiences that included Bruce Schneier, Matt Blaze, and
    lots of other IT experts and stayed up late at night trying to learn
    from them. (That doesn't mean they agree with the paper, but a lot of
    earlier flaws have been fixed.). (3) In government, I worked daily with
    the people in OMB who were responsible for computer security for the
    federal government. (4) For the past couple of years I have been on the
    Microsoft Trustworthy Computing Academic Advisory Board, with IT experts
    including Eugene Spafford and a bunch more. That has immersed me in a
    lot of security discussions, and I have continued to talk with many Open
    Source programmers as well.

     In addition, legal academia often provides a lot of
    > background for actual law. The laws (DMCA, etc) in this area are
    > horribly dysfunctional, and if based on "research" such as your paper,
    > only going to get more so. Furthermore, these awful, but well meaning
    > laws directly impact the freedom of many people, hinder business, and
    > generally cause misfortune even to the causes they claim to provide
    for,
    > such as "Homeland Security (tm)".
    >
    > If, as is suspected, you are trying to begin a legal framework for
    > future laws which will put penalties on the disclosure of certain
    kinds
    > of information, or the groundwork for a government agency to mandate
    > information security on private citizens, than you can expect a long
    and
    > bloody fight in this, and every other arena.

            My belief is that the Department of Homeland Security and the
    current Administration generally have gone far overboard in their
    insistence on secrecy. The paper, by clarifying the military/intel
    assumptions, seeks to show the relatively limited set of conditions
    where the secrecy approach holds true in a networked world. Readers of
    FD understandably are concerned that I am a secrecy nut, but in the
    policy debates I am in fact much more likely to be supporting the
    Freedom of Information Act and other openness initiatives than I am to
    support secrecy and over-classification. More at
    http://www.americanprogress.org/site/pp.asp?c=biJRJ8OVF&b=180516 and
    http://www.americanprogress.org/site/pp.asp?c=biJRJ8OVF&b=180251 .
     
    > The flaw in your specific example [about a software program freezing
    up it is attacked] is that every program can be run as
    > many times as you need to "attack" it. You would never need more than
    > one copy.

            First, there are times when you cannot attack the program over
    and over. For instance, you may not have the ability to access the
    software over and over again, such as when it is running on someone
    else's system and you don't have continuous access. Second, other
    persons on FD have written to me privately about self-modifying code
    that would render Dave Aitel's point untrue. With that said, the
    example could be better written.

            Much more importantly, though, is that Dave accepts one of the
    fundamental points of my paper in trying to refute it. He says "every
    program can be run as many times as you need to attack it." Exactly!
    The big difference between physical and computer security that I
    emphasize is the number of attacks. Dave emphasizes the number of
    attacks. Hey, it's a unifying principle that even lawyers and
    non-experts can understand in the future! (See separate post today on
    why the analogy between physical and cyber security is useful.)

            A theme of the paper: when attacks are closer to first-time
    attacks (when they have high uniqueness), then secrecy can be an
    effective tool. When there is low uniqueness, security through
    obscurity is BS. And many, many cyberattacks fall into the second
    category.

     
    > The paper goes into some sidetrack about people trying to find the
    > hidden gems in video games - an activity that may or may not have
    > something to do with computer security, but is clearly irrelevant
    > ("fluffy") in this context.

            My students love the video game part when they read it -- it
    helps them see the similar patterns of cyberattacks, physical attacks,
    and video game "attacks."

     
    > Also, the paper doesn't do a good job of proving that the Efficient
    > Capital Markets Hypothesis is relevant to the discussion. It's clearly
    > true that attackers will gain a lot from disclosure, but the Open
    Source
    > model doesn't care, because they only have one way to fix their
    software
    > - disclose bugs. The paper even goes so far as to say the ECMH
    probably
    > doesn't apply. But if it doesn't apply, why mention it? (page 30
    implies
    > that the paper was simply suggesting it as an area for further
    > "research", but that would make a better footnote than paper section).
    > Adding to the fuzzyness feel is the way the paper reaches for an
    analogy
    > in another social science, and fails.

            Some discussion on FD and elsewhere assumes that vulnerabilities
    will be found very, very efficiently -- if the flaw is there, then it's
    a matter of only a short wait before someone finds the flaw. In talking
    with people who write software, however, I was repeatedly struck by
    their observation that it takes considerable hard work and expertise to
    find new vulnerabilities. The ECMH discussion gives reasons for
    thinking that vulnerability discovery will, in some settings, be less
    instantaneous than many seem to have assumed.

            Peter

    Paper at http://papers.ssrn.com/sol3/papers.cfm?abstract_id=531782

     

    _______________________________________________
    Full-Disclosure - We believe in it.
    Charter: http://lists.netsys.com/full-disclosure-charter.html

  • Next message: Peter Swire: "[Full-Disclosure] Security & Obscurity: physical-world analogies"

    Relevant Pages

    • Re: Paranoia is the new Black
      ... turn you in to Homeland Security!! ... enforcers who teach their congregations to "obey the government." ... The video to your right is a shocking KSLA news report which confirms ... government in the event of a declaration of martial law. ...
      (alt.gathering.rainbow)
    • Re: Pelosi & Reid Will Not Like Progress Cited in Iraq Quarterly Report
      ... This is from 4 pages, less than 10 percent, of the report. ... Reid has called General Petraeus a liar for saying progress had been made in Iraq, and more recently he has called Petraeus and outgoing chairman of the Joint Chiefs,Marine Gen. ... Assessment of the Security Environment— ... the frequency and intensity of attacks on the ...
      (soc.retirement)
    • Re: Pelosi & Reid Will Not Like Progress Cited in Iraq Quarterly Report
      ... This is from 4 pages, less than 10 percent, of the report. ... Reid has called General Petraeus a liar for saying progress had been made in Iraq, and more recently he has called Petraeus and outgoing chairman of the Joint Chiefs,Marine Gen. ... Assessment of the Security Environment— ... the frequency and intensity of attacks on the ...
      (soc.retirement)
    • Re: Cracking WEP and WPA keys
      ... SecurityFocus wi-fi security mailing list. ... >>802.11G PCMCIA card, and the Linux server was running Samba to talk to ... >>Audit your website security with Acunetix Web Vulnerability Scanner: ... Cross site scripting and other web attacks before hackers do! ...
      (Pen-Test)
    • RE: Vulnerabilites in new laws on computer hacking
      ... This damages all security professionals. ... Vulnerabilites in new laws on computer hacking ... "advanced societies" will have no clue about how remote computer attacks ...
      (Bugtraq)