Computer Forensics in Fiction
New television show—CSI: Cyber. I hope they have some good technical advisers, but I doubt they do.
Comments
Anura • May 13, 2014 12:59 PM
This is from the same show that said “I’ll create a GUI interface using Visual Basic, see if I can track an IP address!”
Christopher • May 13, 2014 1:23 PM
They get the extra pixels for their “Zoom and Enhance” pictures from the same alternate universe that supplies Bruce Banner with the extra mass required to become The Hulk.
uh, Mike • May 13, 2014 1:43 PM
He’s using triple-ROT13, so it’s going to take me awhile to decrypt.
Eugene Bogorad • May 13, 2014 1:45 PM
What original CSI did was raise the anticipated threshold of proof. It was way about reasonable, but good for defendants. Juries now expect DNA etc, which is unavailable in most cases.
If this show effectively kills malicious “forensic” prosecution of digital “crimes” – well, heil CSI 🙂
Dave • May 13, 2014 1:53 PM
There are some people who will claim that CSI grew the STEM enrollments at colleges and universities. Maybe a show like this will bring enough realism to drive infosec topics to kitchen table conversations. I see this as a win for our industry. There are few places and careers that they make TV shows about, we’re now going to be in that club.
Anura • May 13, 2014 2:23 PM
Speaking of CSI’s enhance, this is a great spoof from Red Dwarf: Back To Earth.
Toomas • May 13, 2014 2:36 PM
I am quite sure there will be a lot of epic cockups on this TV show. Can’t wait to see this and laugh my *** off.
1) They will probably use IPv8 to discover “dark web” hosts. If someone doesn’t know what IPv8 is then here is a bit to read – http://www.infiltrated.net/rfc246810.txt
2) They will have no problems accessing magical IP’s – http://i.imgur.com/zRtGbPp.jpg
3) They will have epic programming skills – https://www.youtube.com/watch?v=hkDD03yeLnU
Anura • May 13, 2014 2:43 PM
RE: IP Addresses… Maybe someone will learn about the TEST-NET IP Ranges:
The blocks 192.0.2.0/24 (TEST-NET-1), 198.51.100.0/24 (TEST-NET-2), and 203.0.113.0/24 (TEST-NET-3) are provided for use in documentation.
All of these appear to be valid addresses, without being obvious private IPs.
watcher • May 13, 2014 2:50 PM
@Thoomas
The out of range IP addresses are there so they don’t accidentally use any real address exists or might in the future. They do similar to fictitious telephone numbers in the media. Remember the prefix 555.
This is a show I might watch just for the fun factor and the drinking game let us spot the errors.
Nicholas Weaver • May 13, 2014 3:22 PM
It will be bad. Admittedly we hate-watch the original CSI Colon (gotta pronounce : to get the effect), and saw the backdoor pilot. Ridiculously bad.
So bad that although they could probably use a good technical adviser, the backdoor pilot is such it would be hard to get a technical adviser to be willing to have their name in the credits.
However, I have a pseudonym or three that would work, so if they want a technical adviser and they contact you, feel free to forward them to me.
0x4209 • May 13, 2014 3:54 PM
It’s almost impossible for them to do things accurately. It’d be brief descriptions with the ‘talent’ actor cut out of episodes for long period to simulate the hours, days, weeks, or months it takes to find zero-days in IDA and other RE tools..
RSaunders • May 13, 2014 5:00 PM
@ 0x4209,
That’s the problem with all the CSI/L&O shows. Police work takes a long time and most of it is spent waiting for things you can’t make faster. “Rush” DNA takes 4-6 weeks and “rush” toxicology 10-14 days. The show has to be over in an hour. That means we have to leave stuff out to save time.
Ever wonder why the Star Trek series invented the “transporter”? Certainly it wasn’t because turning a 100kg human into energy was a safe thing to do (e=mC^2). It was because nobody would want to watch walking down to the shuttle bus, getting in, flying to the planet surface, finding a place to part, etc.
While Eugene Bogorad raises some good points on the impact on our legal system, I’m more troubled by the effect on our news system. Something big happens, all networks are streaming the police press conferences in real-time, 24/7. What does the first news conference say “We don’t know much yet.” and so on for a week or so. In between, the lack of actual news facts does nothing to keep the newsies from spouting any random theory that pops into their head as “well maybe it’s X”. At least with computers, they don’t know enough jargon to say anything. Fill everybody up with out vocabulary, let them hash/randomize the meanings, and we’ll need to start all over again to be able to talk to each other.
Do we really want what Person of Interest did for the intelligence community?
Natanael L • May 13, 2014 6:17 PM
@RSaunders: Actually, the Star Trek transporter was introduced because it was too expensive to build a set with shuttles and showing them land. They needed another method of transport that was cheaper to render.
bcs • May 13, 2014 8:03 PM
The CSI et al. drinking metrics:
Step 1: Watch the show. Drink a shot each time someone spots a technical flaw or factual error. Take a sip for anything that’s highly dubious or unlikely.
Step 2: Sober up and see how many minutes of the show you can reconstruct from memory.
Step 3: Watch it again and see how many minutes of it you need to get enough clues to solve the mystery.
If step 2 is usually less than step 3 (or 3 is longer than the whole episode): black list the show.
randomjnerd • May 13, 2014 9:00 PM
This from a series that in the same episode showed oil sinking in water, and electrocution with a whopping 12 volts on dry skin.
Anura • May 14, 2014 12:07 AM
@Nicholas Weaver
So bad that although they could probably use a good technical adviser, the backdoor pilot is such it would be hard to get a technical adviser to be willing to have their name in the credits.
I prefer to think that they do have knowledgeable technical advisers, but that they are jerks.
Geep • May 14, 2014 1:19 AM
ENHANCE!
Clive Robinson • May 14, 2014 3:56 AM
Hmm, it had Patricia Arquette in the “one off” I hope her performance was better than in the 2000 film Little Nicky [1] for which she was nominated for the Golden Raspberry worst supporting actress…
With regards “Cyber” the original NCIS has always rated high on the “no way no how” factor, requiring a lot of suspension of disbelief to get through half the episodes (@Nick P and I have joked on it on this blog in the past).
That said us “law abiding” non US citizens in the EU who don’t want a “You’ve been a naughty downloader letter” will either have to pay a Kings Ransom to the Murdoch Evil Empire or wait a couple of years to watch it. By which time technology might have surpassed the fiction 😉
[1] A film that’s so excrutiatingly bad it actualy rates as worth watching on TV…
Clive Robinson • May 14, 2014 4:12 AM
@ uh, Mike
He’s using triple-ROT13, so it’s going to take me awhile to decrypt.
Are you aware of the latest patch to quintiple-ROT13? Apparantly it’s designer Li O’Ekans claims it doubles the security margin of triple-ROT13.
kronos • May 14, 2014 8:09 AM
What is more fun than watching NCIS/CSI type shows and finding the goofs is when you are watching with a group of people and there just happens to be experts within that group from various technical fields. It is especially fun (I am redefining ‘fun’ here) when you have a cop, a medical person and a computer person. But it can be a learning experience even though it takes most of the enjoyment out of TV shows.
I suspend most of my belief for cop and medical shows. I can’t stand lawyer shows for some oddball reason – probably because I have actually spent time in real courtrooms.
Lynn Gwist • May 14, 2014 8:29 AM
The “cyber” non-word again. I give up.
John Campbell • May 14, 2014 8:36 AM
So, what’s the theme music?
IIRC, listening to some of these CSI series, they were using music from The Who.
I joked, some time ago, that, by the time they got to CSI:Cleveland or CSI:Accounting (Forensic accounting) that they’d be down to using The Who’s “Momma’s got a squeeze box”.
I can imagine, for Cyber, them using some of the music from “Transformers”… though… are they step-up or step-down?
And, now a joke for electrical engineers: Resistance is futile… but impedance can be fun!
Chris S • May 14, 2014 10:50 AM
Re: theme music
CSI: Des Moines — “I Can See For Miles”
(ok, it’s a stereotype)
Horatio • May 14, 2014 9:09 PM
Eric, I think this man has been hashed [puts on glasses, backs out of the shot] YYYYEEEEEAaaaaaaaahhhh!
dot tilde dot • May 15, 2014 2:25 AM
must be xterms and joysticks all the way to the bottom. i drink a shot every time someone pronounces csi without the colon. sugar in the morning!
.~.
Ben Cheam • May 28, 2014 5:38 PM
I watched the pilot episode last night and notice they got an Australian actor to play the tech support person. Does the FBI hire Australians?
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
Chelloveck • May 13, 2014 12:56 PM
There was a recent CSI episode that acted as an introduction to the new show. The networking is every bit as realistic as the zoom-and-enhance image processing technology CSI is known for.