Full Disclosure mailing list archives
Re: need help in managing administrators
From: "Dude VanWinkle" <dudevanwinkle () gmail com>
Date: Wed, 5 Dec 2007 22:45:39 -0500
On Dec 5, 2007 5:44 PM, <Valdis.Kletnieks () vt edu> wrote:
On Sun, 02 Dec 2007 20:04:42 EST, Dude VanWinkle said:Anyone who was a security expert 30 yrs ago should be ridiculed. Their job description was "I inspect all 5 & 1/4 disks that get mailed to us" and should be a reason NOT to hire them :-PAnybody who doesn't know the history of security well enough to know what was going on 30 years ago deserves to be ridiculed.
You are right, thanks for all the careful planning and well thought out infrastructure. I mean, who could have thought that the ability to reach into the homes of every tom dick and harry as well as every company on the planet would be used for swindling cash?
Here's a classic paper (the original Multics vulnerability analysis by Karger and Schell): http://www.acsac.org/2002/papers/classic-multics-orig.pdf
Thanks for the link. Good info to have, even today (which is what I have a problem with).
From the Link:
http://www.acsac.org/2002/papers/classic-multics-orig.pdf -------------------------- The internal controls of current computers repeatedly have been shown insecure though numerous penetration exercises on such systems as GCOS [9], WWMCCS GCOS [8, 18], and IBM OS/360/370 [16]. tems and cannot be corrected by "patches", "fix-ups", or "add-ons" to those systems. Rather, a fundamental re- implementation using an integrated hardware/software design which considers security as a fundamental re- quirement is necessary. In particular, steps must be taken to ensure the correctness of the security related portions of the operating system. It is not sufficient to use a team of experts to "test" the security controls of a system. Such a "tiger team" can only show the existence of vul- nerabilities but cannot prove their non-existence. -------------------snip---------------- So you knew this 30 years ago, and didn't change squat, and we are still dealing with it now. How fuscking hard is it to design a system with separate processors|memory for command|data channels? Sheesh, way to invalidate my comment Valdis. (O_o) --------------------snip---------------- Unfortunately, the managers of successfully penetrated computer systems are very reluctant to permit release of the details of the penetrations. Thus, most reports of penetrations have severe (and often unjustified) distribu- tion restrictions leaving very few documents in the public domain. Concealment of such penetrations does nothing to deter a sophisticated penetrator and can in fact impede technical interchange and delay the development of a proper solution. --------------------snip---------------- Nice way to work on this one as well. I have a better idea, lets lock ourselves up in an ivory tower and just bitch about it for decades to each other while simultaneously and obfuscating our proprietary knowledge while hoarding it. Then we can wait and say "I told you so" when a worm hits, or critical infrastructures are compromised. That ought to pass the time... --------------------snip---------------- A system which contains vulnerabilities cannot be protected by keeping those vulnerabilities se- cret. It can only be protected by the constraining of physi- cal access to the system. --------------------snip---------------- All of the pdf you sent is very valuable and accurate information, of which I have no problem with. But it should be the "history of computer security" class from 19[8|9]6 in college that taught me this, not the "Unethical Hacking" class from Immunity Inc. taught in 2007.
Here's their 30-years-later retrospective: http://www.acsac.org/2002/papers/classic-multics.pdf
Lemme guess, nothing changed?
Executive summary: We've learned somewhere between diddly and squat from 30 years of experience.
Yeah, thanks a lot for that. You know that it would have been a lot easier, as a close knit group of programmers and developers to edit things vs.. the refitting of an infrastructure, that if it were to go down today, would take the economies of all industrialized nations on the planet. But thats OK, Hopefully future technologies invented will learn from the massive mistakes of your generation. Like Paper Accounting Systems, the Phone, Fax Machines, etc, the internet was rife with abuse. Future technologies that enable people to reach people or count dollars will hopefully be engineered to be Secure.
From the analysis or days past, maybe this is a limitation of the
profit driven security model (which seems to be purely reactionary) and I am just a hate filled moron, angry at the past for creating the present. There is probably some truth to this (as I am hate filled and moronic) What do i care? The less secure the Technology, the easier my job is.... Still I can't help feeling that in 1976 (the year I was born, so I don't have much personal experience to go on) you could have said "yeah boss, this computer thingy will have 4k of ram, hand-woven in India, cost 2 million dollars, and oh yeah, it won't run without separate command and control channels, that would have driven up the price to 4 mil for 4 k ram and two processors, and the higher-ups would'nt have the knowledge to know this wasn't a necessary expenditure for "blocking solar flares from corrupting your data".
Incidentally, Karger&Schell is the "unnamed Air Force document" that Ken Thompson references as the source for his Turing Award lecture: Thompson, K., "Reflections on Trusting Trust", Communications of the ACM, Vol. 27, No. 8, August 1984, http://www.acm.org/classics/sep95/ Ridicule these guys at your own peril. You can count me out, my personal timer is currently sitting at 29 years 10 months.. ;)
Yeah, don't come to me for a Job.... but if you guys are hiring.. ;-)
Incidentally, 30 years ago, the 5.25" disk was still well in the future - even the 8" floppy was relatively new.
Someone pointed out to me that in an offline email. Also my comment was rude and nieve. Its easy to sit back and say "those people who came before me didn't knwo much about X" is kind of a cop out. Usually History and learning progress to the point that those who first discovered the knowledge are loong gone before the revisions are made. Now History happens so fast that we still have to deal with you fusckers while we are learning from your mistakes and dealing with their consequences.... I blame computers and those that invented them for this ;-) -JP<whew, if feels good to let that out, Doc> _______________________________________________ Full-Disclosure - We believe in it. Charter: http://lists.grok.org.uk/full-disclosure-charter.html Hosted and sponsored by Secunia - http://secunia.com/
Current thread:
- Re: need help in managing administrators, (continued)
- Re: need help in managing administrators Valdis . Kletnieks (Dec 02)
- Re: need help in managing administrators T Biehn (Dec 02)
- Re: need help in managing administrators T Biehn (Dec 02)
- Re: need help in managing administrators Valdis . Kletnieks (Dec 02)
- Re: need help in managing administrators Paul Schmehl (Dec 02)
- Re: need help in managing administrators Dude VanWinkle (Dec 02)
- Re: need help in managing administrators T Biehn (Dec 02)
- Re: need help in managing administrators Dude VanWinkle (Dec 03)
- Re: need help in managing administrators Valdis . Kletnieks (Dec 05)
- Re: need help in managing administrators T Biehn (Dec 05)
- Re: need help in managing administrators Dude VanWinkle (Dec 05)
- Re: need help in managing administrators Valdis . Kletnieks (Dec 05)
- Re: need help in managing administrators Dude VanWinkle (Dec 05)
- Re: need help in managing administrators Valdis . Kletnieks (Dec 05)
- Re: need help in managing administrators Dude VanWinkle (Dec 05)
- Re: need help in managing administrators Nick FitzGerald (Dec 05)
- Re: need help in managing administrators Valdis . Kletnieks (Dec 05)
- Re: need help in managing administrators T Biehn (Dec 05)
- unsubscribe full-disclosure Makousky, Steve C (Dec 03)
- Re: need help in managing administrators happy nino (Dec 05)