Schneier on Security

SteveJ • April 25, 2008 6:51 AM

@Brandioch:”The code is 100% available. Maybe your problem is that you do not understand what “security” is.”

No, my ‘problem’ (if it really is a problem) is that I’m not inclined to spend my time looking for vulnerabilities in Ubuntu. I have other code to be bug-checking.

You seem to believe that the reason I have not cracked your personal machine has something to do with the security of the OS you run.

I assure you that it does not. You could be running unpatched WinXP with all services turned on and an animated dancing bear on your website singing a “please crack me” song, and I still wouldn’t crack you.

So your continued state of uncracked-by-me, proves nothing. It is a red herring. And you know it.

However, there was a guy on an earlier post on this blog, saying that given sufficient resources he could crack anyone. For reasons which weren’t entirely clear to me, he felt that for it to be a fair test, the victim had to fund the attack, although I don’t believe he was a professional pen tester. Still, maybe you and he should link up, because you can’t both be right.

SteveJ • April 27, 2008 8:33 PM

@Brandioch: “Post the IP address”

Heh. I see that the rules change if anyone shows even rhetorical interest in your game. Your machine is proven to be “secure” by the indisputable fact I haven’t cracked it, remember? I don’t remember you posting your IP address to make your “proof” work. Ever heard of Calvin-ball?

“If it takes a million years to crack a message encrypted with blowfish (of a sufficient key length), then that message is “secure” from that attack. So your claim about “not having time” only supports my position”

If you actually think that my claim about me ‘not having time’ to hack your box is comparable to me ‘not having time’ to brute-force blowfish, then it’s starting to become clear how it is that in your private universe, you’re the only person who understands security.

To recap: You’re probably right that I don’t have time to crack your box. I claim that in any case I do not in fact have the inclination to crack your box. You think I’m maybe lying about that, because I’m anonymous, which makes a huge pile of no sense: if we actually knew who each other were, then I might conceivably think there’s something on your box worth having. But we don’t, so I don’t.

Anyway, let’s just agree that for some reason, I don’t spend my time cracking either Ubuntu systems in general, or yours in particular.

I also don’t spend my time brute-forcing blowfish. However, unlike brute-forcing blowfish, other people do spend their time successfully cracking Ubuntu. Principally Ubuntu developers and security researchers. Spotted the difference from blowfish yet?

The reason your machine isn’t cracked (although I note that the only evidence I have of this is the assurance of some anonymous posting on an Internet forum, so for all I can “bank”, you were rooted long ago) is that it has nothing on it of sufficient value to cause any of the numerous people capable of cracking it, to choose to do so. Time and effort have very little to do with it, since the Ubuntu release team could crack your box with minuscule expenditure of either. What it would cost them is the risk of being caught. What they’d gain is nothing of any value to them. That’s “understanding security”.

Sure, your machine is secure for its purpose – I never said otherwise. What I said, is that your security has little or nothing to do with whether you have open ports or not. You could run dozens of services on Ubuntu and it still be as secure as you need to be. You could somehow become the target of an unscrupulous Ubuntu expert or insider, in which case your machine would no longer be secure even with no ports open.

Anyhow, your box has a rather different state of security, from the state of blowfish that (as far as we know or suspect, at the moment and for the foreseeable future with known computing methods) there does not exist anybody in the world who can brute-force it.

Spotted the difference from blowfish yet? It’s that difference which is why we don’t liken crypto algorithms to operating systems. And why over here in the real world, we don’t assume that, just because some anonymous person who doesn’t know or care who you are, does not deign to hack your box, that your box must therefore be “secure” (whatever you think that means).

“Time + Effort == Security”

Ah, that’s what you think it means. Since the SI units of time are seconds, and since I assume you wouldn’t quote an equation that wasn’t physically consistent, I guess the dimensions of security are seconds too. You’re right, I don’t understand security – I thought the SI unit was the schneier (symbol Sn). “Block port 80 inbound and we’ll have ourselves a 15 kSn box here”, we say around the office.

“Automated attacks will crack an unpatched WinXP box on the Internet in 5 minutes. That is NOT “secure”.”

Agreed. That’s, like, a few mSn at best, or equivalently 157s of time plus half a “round tuit” of effort.

So if unpatched WinXP is “not secure”, and your machine avoids one of its most egregious problems, does this again “prove” the uncrackability of your machine? Why do you need two proofs – you already have that I haven’t hacked it?

In any case, the fact that open ports expose exploitable flaws in unpatched WinXP says nothing about whether ports need to be closed in Ubuntu. It’s good practice to keep the attack surface to a minimum, and hence not to run unnecessary services, and Windows violates that (or arguably it has a funny idea of “necessary”). Why does this make you think that not running services is somehow a critical part of Ubuntu’s security? Do you think that if Ubuntu by default ran an echo server on port 7, that it would no longer be “secure”, because it has an open inbound port?

@Kilgore: “You really want to ruin it?”

He’s not ruining it, is he? There’s discussion above of Bruce’s post, plus a couple of us are bear-baiting. If anyone else doesn’t like it, I’ll happily stop: if we don’t actively disagree, Brandioch will just assume that means everyone thinks he’s right.