L0pht’s warnings about the Internet drew notice but little action

The more I think about this story, the dumber it seems to me.<p>The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge&#x27;s testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popular applications, universal deployment of TLS in financial applications, chaos ensues anyways.<p>What, exactly, would be different if people <i>had</i> &quot;listened&quot; to the L0pht? Would we have S-BGP? DNSSEC?<p>The simple fact is: in 1998, when this happened, <i>nobody knew how to fix any of the problems</i>. If we had known, we&#x27;d have been doing that. There were still servers in 1998 that used deslogin.<p>I&#x27;m very happy that a bunch of people I like got to put their handles on nameplates and get recorded testifying to dummies in Congress. I do not, however, think it was an event with much meaning.<p><i>Later.</i><p>I think it&#x27;s literally the opposite of the gist of this story. Everything is much, much better than it was in 1998. We have made surprising progress, and addressed security problems with an improbable seriousness:<p>1. Most new software is no longer shipped in C&#x2F;C++.<p>2. The devastating bug class introduced with new languages (SQLI) was, for public-facing software, ratcheted back from &quot;universally prevalent&quot; to &quot;rare&quot; within a decade.<p>3. 3 billion Internet users all run software that downloads unsigned code in a complex, full-featured language with a dizzying variety of local C library bindings, right off web pages, executes it locally, and it&#x27;s <i>a news story</i> when Pinkie Pie wins Pwn2Own with a working reliable Chrome clientside.<p>4. Anyone who wants strong crypto can have forward-secret elliptic-curve DH AEAD transports with a config file tweak on their servers.<p>5. Microsoft went from MSDOS levels of security to &quot;you can live like an investment banker if you can reliably produce a couple Windows exploits a year&quot; levels of security, again inside a decade.<p>6. Despite its emergence as an entire new category of computing platform, with its own new feature set, the most popular mobile OS has --- it appears --- zero effective malware outbreaks.<p>7. Remember Sendmail? Remember BIND? Probably only if you&#x27;re a security nerd. The last working SSH vulnerability was how many years ago?<p>As usual: everything&#x27;s amazing and nobody cares.

l0pht is a successor to Cult of the Dead Cow, which goes back to the 1980s.[1] Their &quot;Tao of Buffer Overflow&quot;[2] is still a good read.<p>The two big problems in computer security used to be Microsoft and C. Amit Yoran said that publicly when he was Homeland Security&#x27;s head of computer security. That made him unpopular, and he resigned in 2004. Yoran was then replaced by a Cisco lobbyist who kept his mouth shut. (Yoran did OK; he&#x27;s now the CEO of RSA.)<p>[1] <a href="http:&#x2F;&#x2F;www.cultdeadcow.com&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.cultdeadcow.com&#x2F;</a> [2] <a href="http:&#x2F;&#x2F;www.cultdeadcow.com&#x2F;cDc_files&#x2F;cDc-351&#x2F;" rel="nofollow">http:&#x2F;&#x2F;www.cultdeadcow.com&#x2F;cDc_files&#x2F;cDc-351&#x2F;</a>

Rather encouraging to see mainstream media describe hacking accurately: &quot;...insights about how various systems worked — and in some cases could be made to do things their creators never intended. This is the essence of hacking. It is not inherently good or evil. It can be either, or in some cases a combination of both, depending on the motives of the hackers.&quot;

<i>The Internet itself, he added, could be taken down &quot;by any of the seven individuals seated before you&quot; with 30 minutes of well-choreographed keystrokes.</i><p>If this wasn&#x27;t exaggeration, we should study the fortunate circumstances by which this calamity has been avoided for 17 years.

It was an exaggeration.<p>But it is certainly not especially hard for _governments_ to take down the net in their own country and in many cases reduce the degree of interconnectedness with other countries so far as to effectively take down large chunks of the Internet. The problem is that we do not truly have a network, instead we have a tree structure connected to a very small number of fat pipes. As originally envisaged the internet would be resilient in the face of the failure of one route because there would be many alternative routes but that is not what we have today.<p>This is a much bigger threat than the cracking of individual machines.

The title picture is wonderful.

The picture is worth a million dollars. Especially their nameplates, and the way they&#x27;ve dressed but are still very clearly pure fucking hackers, just by the looks on their faces. I want this framed.

&gt; Even today, many serious online intrusions exploit flaws in software first built in that era, such as Adobe Flash, Oracle’s Java and Microsoft’s Internet Explorer.<p>Isn&#x27;t that like saying &quot;Many accidents happen to models of cars first built during that era?&quot; Just because they debuted then doesn&#x27;t mean they are substantially, or even remotely the same thing. How many complete rewrites of Internet Explorer have we had since then?

There&#x27;s two fundamental systemic blockers to investment in information security.<p>The first is a problem is with incentives over time. (The same thing happened with global warming, with overfishing, with deforestation, with cyber privacy rights, etc.) The problem is that the immediate incentives do not align with the long term incentives. If the country that can cut down the most forest or burn the most oil is the one that wins, relative to the other, a global race for power projection - no country will want to perform in the short term what it must in the long term.<p>Alas, today the short term incentives in software and hardware development are mostly the same. The security community has long preached that built in security as a crucial and fundamental engineering design goal. Today, as it has been for decades before, software is not competitive if it has security built in. It raises the costs of development and it slows production and building security awareness into every developer would require years of additional professional experience or schooling: building in security is a competitive disadvantage.<p>The second problem is that everyone&#x27;s threat model is different:<p>- Consumers want their computers to run quickly and do not want their information or identity stolen. They want to have convenient and reliable control over the privacy of their online interactions - from the public and from law enforcement.<p>- Industry does not want to spend more time and treasure creating fewer visible features. Their existential threat model is losing their business by being too slow at production. Corporations are also scared dumb of having a SONY-style or Target-style breach.<p>- Government wants to be able to peek into all communications of everyone including its citizens. It wants to be able to hack into other countries - both their industrial and their government sectors - and those of private foreign citizens. It does not want the same to be true in reverse.<p>It&#x27;s also true that the types of systems used by the military are different than those used in industry which are further different than those used by consumers. Where do you allocate investment in security? Consumer internet browsers? Virtualization for enterprises? Network intrusion detection for corporate LANs? Access control for government systems? Which do you prioritize? (Granted, its true that some technologies are shared between these classes, such as web browsers)<p>What&#x27;s happening right now is that the discussion about threat model is being negotiated (though not in those conscious terms). Governments make their case about national security - how they need backdoors - and how they would like computer security to work. Security professionals - many of them private citizens - have separate threat models and can&#x27;t agree with government. Individual citizens want privacy - and can&#x27;t agree with government or industry. Industry wants to get customer and competitor data but also doesn&#x27;t want to leak their own.<p>To the degree that the threat models are compatible, some level of real investment can be made (today there do happen to be large scale efforts to mitigate cyber security risks - particularly threat intelligence sharing programs).<p>Yet fundamental contradictions in threat models will keep the direction of security in limbo and worse if some threat model &#x27;wins&#x27; it will comes at he expense of the others. Government&#x27;s goals, even in so labeled &#x27;free&#x27; countries, are disaligned with their citizens on threat model. Government goals themselves are further internally contradictory, as they would like computer networks to be both secure and insecure (giving birth to phraseology such as &quot;NOBUS&quot;).<p>Today not only are we not able to secure the internet and computer systems, we still don&#x27;t really know what a secure internet would mean.

long hair: hacker credibility +1<p>beard: hacker credibility +1<p>nickname&#x2F;handle: hacker credibility +1<p>glasses: hacker credibility +1<p>suit: hacker credibility -1