Re: [ISN] How To Save The Internet

[Jason Coombs]

InfoSec News wrote:
> Forwarded from: security curmudgeon <jericho@attrition.org>
> Cc: sberinato@cio.com
> ... Big load of crap ...
> : http://www.cio.com/archive/031505/security.html
> : BY SCOTT BERINATO
> : serial numbers and control their distribution. James Whittaker says
> : programmable PCs are dangerous, so why not treat them like guns?

jericho@attrition.org wrote:
> In 2001, 2002, 2003 and 2004, how many deaths were attributed to
> computers?

Programmable PCs *are* dangerous, but only to themselves and other
programmable PCs that aren't operated by skilled people who know how to
defend against the execution of unwanted machine code.

The problem with programmable PCs is that they execute machine code
without considering whether any of the instructions are desired by the
owner of the CPU. A no execute (NX) stack and heap [1] is a step in the
right direction, but everyone in the computer industry who has given
this any thought already knows that the core problem with computer
security is that our CPUs make no effort to restrict the execution of
machine code to that very small subset of all possible machine code
which constitutes the code that the owner of the CPU desires it to run.

Until this security defect is solved, we will still have problems caused
by rampant technical bugs in our programmable PCs. Insecure software
would not be a threat except in rare circumstances if there were only a
way for our CPUs to be configured to execute *only* the insecure
software that we desire, and block anything else that is added to our
boxes by buffers, bullies, or buffoons.

If anyone really cared about solving this core security problem with
computing today, it would be solved in just a few months. We would then
be left with all of the wonderful array of security problems that are
caused by human behavior (theft, misuse, physical intrusion,
eavesdropping, scam artists, etc) and these are problems we can all live
with in relative harmony [7].

The marketplace is not demanding this solution, and it appears from the
noise of the media and marketing and PR machines of our revered industry
leaders that nobody is even trying to build awareness of the problem
much less devise and deliver solutions.

Programmable CPUs are not suitable for use in data communications
devices without hardware defenses that restrict the machine code
instruction sequences that the CPU will accept. Programmable CPUs are
barely suitable for anything without this simple security addition.

We're all so busy pushing bits around urgently we've forgotten to care.

CIO should be ashamed to be perpetuating the pointless and fraudulent
business ideas of an industry addicted to extracting profit from victims
by causing them unnecessary problems and then selling inadequate fixes.

Sincerely,

Jason Coombs
jasonc@science.org


[1] MSDN Security Developer Center: Execution Protection
http://msdn.microsoft.com/security/productinfo/XPSP2/memoryprotection/execprotection.aspx

[7] Why Was Intel a No-Show on No Execute?
http://www.eweek.com/article2/0,1759,1599193,00.asp

[David Gillett]

Jason Coombs [mailto:jasonc@science.org] writes:

<snip>
> ... the core problem with computer
> security is that our CPUs make no effort to restrict the execution of
> machine code to that very small subset of all possible machine code
> which constitutes the code that the owner of the CPU desires
> it to run.

<snip>

> If anyone really cared about solving this core security problem with
> computing today, it would be solved in just a few months.

Just one of the myriad of security issues that we're grappling with
are the various rights of the owner of the CPU, the *operator* of the
CPU, and the owner of the *data*, each of whom may have a more or less
legitimate say in what code actually gets executed. Far too many folks
have already "solved" this problem incorrectly for me to believe that
the "just a few months" solution you envisage will actually be correct.

David Gillett

[Jason Coombs]

RGF2aWQgR2lsbGV0dCB3cm90ZToNCj4gYXJlIHRoZSB2YXJpb3 VzIHJpZ2h0cyBvZiB0aGUgb3du
ZXINCj4gb2YgdGhlIENQVSwgdGhlICpvcGVyYXRvciogb2YgdG hlDQo+IENQVSwgYW5kIHRoZSBv
d25lciBvZiB0aGUgKmRhdGEqLA0KPiBlYWNoIG9mIHdob20gbW F5IGhhdmUgYSBtb3JlIG9yDQo+
IGxlc3MgbGVnaXRpbWF0ZSBzYXkgaW4gd2hhdCBjb2RlDQo+IG FjdHVhbGx5IGdldHMgZXhlY3V0
ZWQuDQoNCk5vbnNlbnNlLiBBYnN1cmQsIHJpZGljdWxvdXMgbm 9uc2Vuc2UuDQoNClRoZXJlIGlz
IG9ubHkgb25lIHBhcnR5IHdobyBoYXMgYW55IHNheSBvdmVyIH doYXQgY29kZSBnZXRzIGV4ZWN1
dGVkIGJ5IGEgQ1BVOiB0aGUgb3duZXIgb2YgdGhhdCBwaHlzaW NhbCBwcm9wZXJ0eS4NCg0KRXZl
cnlvbmUgZWxzZSBjYW4gZ28gZmx5IGEga2l0ZS4NCg0KVGFrZS B5b3VyIGludGVsbGVjdHVhbCBw
cm9wZXJ0eSBmYW50YXNpZXMgYW5kIHlvdXIgaGVhZHkgbGVnYW wgY29uY2VybnMgdG8gbGF3IHNj
aG9vbCwgdGhleSBoYXZlIG5vIHBsYWNlIGluIHNlY3VyaXR5IH RlY2hub2xvZ3kuDQoNCkdpdmUg
bWUgYSBjb21wdXRlciB0aGF0IGlzIGRlZmVuc2libGUsIHNvIH RoYXQgKm15KiBpbnRlbGxlY3R1
YWwgcHJvcGVydHkgYW5kICpteSogcGVyc29uYWwgbGVnYWwgbG lhYmlsaXR5IGV4cG9zdXJlIChi
b3RoIGNpdmlsIGFuZCBjcmltaW5hbCkgY2FuIGJlIGRlZmVuZG VkLCBhbmQgc3RvcCB0cnlpbmcg
dG8gZ2l2ZSBtZSB0aGUgYWJpbGl0eSB0byBjb250cm9sIG90aG VyIHBlb3BsZSdzIGNvbXB1dGVy
cyBhbmQgaW1wb3NlIG15IGludGVsbGVjdHVhbCBwcm9wZXJ0eS CTcmlnaHRzlCBvbiB0aGVtIGJ5
IGZvcmNlLg0KDQpUaGUgbW9yZSB5b3UgdHJ5IHRvIHN0dWZmIE ludGVsbGVjdHVhbCBQcm9wZXJ0
eSBkb3duIHBlb3BsZSdzIHRocm9hdHMgYXMgdGhvdWdoIGl0IG lzIJNQcm9wZXJ0eZQgdGhhdCBn
cmFudHMgaXRzIJNvd25lcpQgcmlnaHRzIGVxdWl2YWxlbnQgdG 8gcmlnaHRzIG9mIHJlYWwgcHJv
cGVydHkgb3duZXJzaGlwLCB0aGUgY2xvc2VyIHlvdSBwdXNoIH VzIHRvIGEgY29tcGxldGUgYWJh
bmRvbm1lbnQgb2YgYWxsIElQIHByb3RlY3Rpb25zLg0KDQpJbn RlbGxlY3R1YWwgcHJvcGVydHkg
b25seSBoYXMgdmFsdWUgYXMgbG9uZyBhcyBJIGNvb3BlcmF0ZS B3aXRoIHlvdXIgYmVsaWVmIGlu
IGl0cyB2YWx1ZS4NCg0KVGFuZ2libGUgcHJvcGVydHkgaGFzIH ZhbHVlIGJlY2F1c2UgSSBjYW4g
c21hc2ggeW91ciBoZWFkIGluIHdpdGggaXQsIHdoZXRoZXIgeW 91IGJlbGlldmUgaW4gaXRzIHZh
bHVlIG9yIG5vdC4gR2V0IGEgY2x1ZSwgcGxlYXNlLiBZb3Uncm UgYSBkYW5nZXIgdG8gb3VyIGNv
bGxlY3RpdmUgZnV0dXJlIGFzIGEgY2l2aWxpemF0aW9uLg0KDQ pSZWdhcmRzLA0KDQpKYXNvbiBD
b29tYnMNCmphc29uY0BzY2llbmNlLm9yZw0KDQo=

[Thor]

So I take it those weren't "Crunch Berries" in your cereal this morning? A
bit over the top, man... Comments in-line:

> David Gillett wrote:
>> are the various rights of the owner
>> of the CPU, the *operator* of the
>> CPU, and the owner of the *data*,
>> each of whom may have a more or
>> less legitimate say in what code
>> actually gets executed.
>
> Nonsense. Absurd, ridiculous nonsense.
>
> There is only one party who has any say over what code gets executed by a
> CPU: the owner of that physical property.
>
> Everyone else can go fly a kite.
>
> Take your intellectual property fantasies and your heady legal concerns to
> law school, they have no place in security technology.

The reason we have security technology *in the first place* is because the
masses DO NOT have any say in what code gets executed by the CPU's they own
in real life. While I may conceptually agree that we *should* have the
exclusive control (but I'm still out on that- I'll have to give it more
thought) that is not the way it plays out every day. If this were the case,
many reading this message would not have the jobs they have now.


Intellectual property is not a fantasy- you're making it sound like your
stance is that since I own a CPU, I can run whatever code I want regardless
of whether I own the right to that code or not- and that just scratches the
surface of the implications you make here... I normally try to understand
your mindsets as I respect your points of view (though they are often
contrary to my own) but this one is kind of out of left field. You are
(seemingly) dismissing a host of copyrights, privacy rights, etc that may
be present based strictly on the ownership of the CPU. If I take your point
incorrectly, please don't "smash my head with it," but rather try to
articulate it in a more civilized manner that promotes the intelligent
exchange of ideas.

> Give me a computer that is defensible, so that *my* intellectual property
> and *my* personal legal liability exposure (both civil and criminal) can
> be defended, and stop trying to give me the ability to control other
> people's computers and impose my intellectual property “rights” on them by
> force.
>
> The more you try to stuff Intellectual Property down people's throats as
> though it is “Property” that grants its “owner” rights equivalent to
> rights of > real property ownership, the closer you push us to a complete
> abandonment of all IP protections.

If this came from someone else, I would not hesitate to say that they were
totally full of shit. You were clearly set off by Gillett, but you can't
possibly be suggesting that physical possession or ownership of some
asset/object obviates the rights that others may have to that property
(directly or indirectly) or that it absolves you from responsibility in the
manner in which you choose to use that
property, can you? You're a smart man, and I have to assume that I'm
missing something-- I'd appreciate it if you would take a moment to
elaborate on this particular point.

> Intellectual property only has value as long as I cooperate with your
> belief in its value.

No, sir. IP has value as long as everyone else believes in its value. More
specifically, IP has value as long as a judicial body exists to uphold laws
drafted by a legislative body whose determinations are accepted by everyone
else whether they really "believe" in the specific value or not, but who do
so because they trust in the operation of the overall system. Much like how
we all trust the operation of the code we run on our systems.

> Tangible property has value because I can smash your head in with it,
> whether you believe in its value or not. Get a clue, please. You're a
> danger to our collective future as a civilization.

Come on, Jason... Totally uncalled for, and a completely unworthy response
for a man of your intellect. The real danger to our future as a
civilization is when men and women who are in a position to share their
gift of logic and perception opt out in favor of belligerence.

T

>
> Regards,
>
> Jason Coombs
> jasonc@science.org
>
>

[Arndt.WA@forces.gc.ca]

Jason Coombs wrote:
>
> David Gillett wrote:
> > are the various rights of the owner
> > of the CPU, the *operator* of the
> > CPU, and the owner of the *data*,
> > each of whom may have a more or
> > less legitimate say in what code
> > actually gets executed.
>
> Nonsense. Absurd, ridiculous nonsense.
>
> There is only one party who has any say over what code gets
> executed by a CPU: the owner of that physical property.
>
> Everyone else can go fly a kite.

Hold on. If you're dealing with a large company or government
department, who "physically owns" the computer in question,
you can't tell me that they're going to micromanage exactly
what goes on with that system. They'll delegate the authority
off to someone who'll actually run the equipment. That sounds
like an "*operator* of the CPU" to me...
>
> Take your intellectual property fantasies and your heady
> legal concerns to law school, they have no place in security
> technology.

I don't read "intellectual property" anywhere in David's
position at all. He quite rightly separates the three obvious
stakeholders in any computer system, be it a desktop or a huge
data storage facility.

When you're dealing with a system that's primary function is
serving up reams of data (say a database), the access to that
data will involve someone running "code" (read: an application).
This access cannot be controlled solely by the maintainer of the
computer(s) and other equipment that make up the DB. Similarly,
isn't going to be the DBA, who's role is to maintain the data
contained in the DB, either. In this example, a user running
queries against that DB is exercising control and most certainly
has a "say in what code actually gets executed" as a result. I
don't think I need to point out that this user could even be
someone external to your organisation, but I will anyway...
>
<Snip out Intellectual Property driven rant>

I'm not trying to flame or troll here. I just think that in
the world we live in now, where computers (and the CPUs they
contain) are "operated" by various stakeholders, it is a hard
sell to say that only one entity controls the resources in
question. As the "owner" of the CPU, you might be able to say
when it will be available (NO, I don't like you. Power off),
but this won't help the bottom line. Same thing with an the
folks assigned the role of "operator" - they're there to enable
the business, not impede it. Users, be they your own or the
customers your system is designed to serve, will always get
a say. The issue here, as I see it, is to properly govern how
the rights assigned.

Like it or not, we're all here to ultimately make the end users
happy. Besides, isn't security supposed to support and improved
your operations? Your approach would, IMHO, do the opposite...

Alex Arndt
CISSP, GCIA

[Derek Martin]

--JcvBIhDvR6w3jUPA
Content-Type: text/plain; charset=iso-8859-1
Content-Disposition: inline

On Wed, Mar 23, 2005 at 11:24:14AM -0500, Arndt.WA@forces.gc.ca wrote:
> > Nonsense. Absurd, ridiculous nonsense.
> >
> > There is only one party who has any say over what code gets
> > executed by a CPU: the owner of that physical property.
> >
> > Everyone else can go fly a kite.
>
> Hold on. If you're dealing with a large company or government
> department, who "physically owns" the computer in question,
> you can't tell me that they're going to micromanage exactly
> what goes on with that system. They'll delegate the authority
> off to someone who'll actually run the equipment. That sounds
> like an "*operator* of the CPU" to me...

But the operator, in his professional capacity, is acting as an agent
of the corporation, and has a legal and professional obligation to
make decisions based on what the company has outlined in its policy.
That is, insomuch as he may decide what can or can't be run, he's
acting with the authority of the company, and on behalf of the
company. In other words, for purposes of deciding what is being run
on the computer, he IS the company.

Many operators are not in a position to make such decisions. Their
job is only to see that the company's assets are being used in
accordance with company policy. Failure to do so CAN result in
termination (even if it usually doesn't)...


--
Derek D. Martin
http://www.pizzashack.org/
GPG Key ID: 0x81CFE75D


--JcvBIhDvR6w3jUPA
Content-Type: application/pgp-signature
Content-Disposition: inline

-----BEGIN PGP SIGNATURE-----
Version: GnuPG v1.2.1 (GNU/Linux)

iD8DBQFCQePiHEnASN++rQIRAmP5AJ91uAUuhstV8xGUEJA9Zd PEpFNm5ACcCx3u
mQ8IiXTa5kbZrP3tL2zugFc=
=AUbi
-----END PGP SIGNATURE-----

--JcvBIhDvR6w3jUPA--