Schneier on Security

Dirk Praet • December 25, 2010 12:16 PM

It would seem that at least some scenario writers have grown beyond the nonsense of “The Net” (1995), miracle cryptographic chips (“Sneakers”, 1992) and killer viruses (Independence Day, 1996 e.a.) . Inside job with an USB-stick (Wikileaks), targetting Menwith Hill (Echelon ?) and the power grid, using a worm (Stuxnet), executing a DDoS attack … All of these give the scenario a certain salonfähigkeit and credibility to the layman.

Then again, way too much unlikely stuff in here.

1. Don’t know about the US, but as pointed out by Clive, the UK power grid may just be a bit more resilient than depicted in here.
2. “Suddenly terrorists, criminals and enemy agents could talk and email without fear of being overheard”. Anybody assuming any such party is not already using publicly available crypto today ?
3. In spite of the general tendency to move from proprietary controls and communication protocols to tcp/ip, it’s a fallacy to assume that everything is transparantly interconnected, let alone connected to the internet. Anyone who has ever done work for the military is aware of that. Getting away with data the way Bradley Manning supposedly did is one thing, injecting code into systems may prove a hell of a lot more difficult.
4. A DDoS carried out from one central location ? Can’t imagine anyone doing it like that because it defeats the entire idea behind a DDoS attack. This is definitely for plot/drama’s sake only.

Some additional ideas:

1. One might wonder about the size of the payload of the worm(s) used to wreak havoc on all these different systems. I’m assuming it must be the size of M/S Office, implying thorough knowledge, multiple known vulnerabilities and exploits for each targeted system and application. Even if the payload could gain sufficient access privileges to actually run, within a well-secured network, monitors should be picking up suspect behaviour quite rapidly, cutting off infected systems and network segments in no time.

2. “Cyber warfare” as a prelude to a global thermonuclear apocalypse sounds a bit incredible. Unless you think in terms of an end-times scenario – as Mr. Ahmadinejad allegedly is – there is exactly nothing to gain from it but mutual annihilation. In Islamic eschatology, Armageddon wil happen, but it’s outcome is unsure. Final victory will only come after Armageddon, when Isa (Jesus) returns to earth, fighting the anti-christ (Dajjal) together with the Mahdi. In the case of a global thermonuclear Armageddon, there just may be little left for the anti-christ to rule, nor for Isa and the Mahdi to save. Probably not entirely what the Prophet had in mind.

Anyway, looking forward to the movie with Angelina Jolie and Jason Statham in the leading roles. I think it’s gonna be most amusing, and hopefully will contain some real-life stuff such as the SSH-exploit used in one of the Matrix movies.