Maggie's Farm

We are a commune of inquiring, skeptical, politically centrist, capitalist, anglophile, traditionalist New England Yankee humans, humanoids, and animals with many interests beyond and above politics. Each of us has had a high-school education (or GED), but all had ADD so didn't pay attention very well, especially the dogs. Each one of us does "try my best to be just like I am," and none of us enjoys working for others, including for Maggie, from whom we receive neither a nickel nor a dime. Freedom from nags, cranks, government, do-gooders, control-freaks and idiots is all that we ask for.

Our Recent Essays Behind the Front Page

Much Sorry with Delays
Birth, Death and All That Stuff in Between
How to Honor Labor Day, Every Day
My Yom Kippur Miracle (Repost from 2010)
Good intro to fly casting
Peach update, with pie
NYC update
Easy for you to say: To the elites on mass immigration
For NYC on 9/11, Sailors' Snug Harbor
Pickled Peaches
Water Shoes
Labor Costs in U.S.
Your "identity"
Good news about The Great Courses
Uses of Hot Pepper Jelly/Sauce, Chutneys, and Jams
A Saturday Drive to Litchfield County, CT
How to Pick a Kayak
Civilized: Fruit forks and knives
Loads of kayaking on Cape Cod
Psychology Experiments' Questionable Results

Categories


All categories

Quicksearch

Links

Blog Administration

Open login screen

RSS Readers

Add to Google

Subscribe with Bloglines

Monday, May 26. 2014

Why software security is crappy


About internet security, government spying, etc: Everything is Broken. He begins:



 Once upon a time, a friend of mine accidentally took over thousands of computers. He had found a vulnerability in a piece of software and started playing with it. In the process, he figured out how to get total administration access over a network. He put it in a script, and ran it to see what would happen, then went to bed for about four hours. Next morning on the way to work he checked on it, and discovered he was now lord and master of about 50,000 computers. After nearly vomiting in fear he killed the whole thing and deleted all the files associated with it. In the end he said he threw the hard drive into a bonfire. I can’t tell you who he is because he doesn’t want to go to Federal prison, which is what could have happened if he’d told anyone that could do anything about the bug he’d found. Did that bug get fixed? Probably eventually, but not by my friend. This story isn’t extraordinary at all. Spend much time in the hacker and security scene, you’ll hear stories like this and worse.


Posted by The Barrister in Hot News & Misc. Short Subjects, Our Essays at 13:07 | Comments (5) | Trackbacks (0)

Trackbacks
Trackback specific URI for this entry

No Trackbacks

Comments
Display comments as (Linear | Threaded)

That's why putting everything on the cloud seems inane.
#1 Mark on 2014-05-26 14:00 (Reply)
I hope he did more than just throw the hard drive in a bonfire. If anyone wants information off of it, they can probably still get some of it.
#2 Jack Walter on 2014-05-26 16:12 (Reply)
Once upon a time, when my old government organization's office computers were 1MB Wang workstations tied to a network, I got curious and changed one letter in a DOS command, and found myself in root on our base-level system!

Fascinated, I ran a directory command, and wound up with a link to root on our major command's network. And that gave me the access to the password and user ID file for every base in the command. I printed out the listing for my unit, and the command's computer admins.

I went into our local system, and gave myself the user rights I needed to do my job - not just those the local computer admins thought a lowly clerk needed. (Government superiority complex: You are smarter than anyone who receives less pay than you. Your intelligence is based on your pay grade.)

However, after thinking about it, I wound up shredding the listing and never admitted to anyone that I'd once owned root on an entire major air command.

It's a common fault, though. Government filters for web access look for keywords in English. They never consider that those who speak another language have free rein on images and documents they can view, sites they can visit, etc.

Before I retired, I showed a computer system administrator that I could access any number of verboten porn sites, email systems and other websites, simply by searching for them using a different language. He was totally shocked, but said he would direct what he'd seen up the ladder for the big computer administrators to consider...
#3 Grumpus on 2014-05-26 17:01 (Reply)
I don't know what he has against C language.

As Mike Lesk put it, strong typing is for weak minds.

The structure is in your head, not in the language.
#4 rhhardin (Link) on 2014-05-26 18:14 (Reply)
" Spend much time in the hacker and security scene, you’ll hear stories like this and worse."

And the vast majority of those are teenage kids bragging about things they think they should have been able to do to be a "1337 k3w1 hax0r".
#5 J.T. Wenting on 2014-05-26 23:02 (Reply)

Add Comment
(Your e-mail will not show in your comment)

By commenting on this site you agree to the site rules listed here. Email
addresses will not be displayed and will only be used for email notifications.

Quick reference guide: [i] italics [/i], [b] bold [/b], [u] underline [/u],
[url] (web address) [/url]. More tips here.

Enclosing asterisks marks text as bold (*word*), underscore are made via _word_.
E-Mail addresses will not be displayed and will only be used for E-Mail notifications.

To prevent automated Bots from commentspamming, please enter the string you see in the image below in the appropriate input box. Your comment will only be submitted if the strings match. Please ensure that your browser supports and accepts cookies, or your comment cannot be verified correctly.
CAPTCHA

BBCode format allowed
 
 
A Chris Southern Consulting website.