Slashdot Log In
Inside The Twisted Mind of Bruce Schneier
Posted by
Soulskill
on Fri Mar 21, 2008 04:15 AM
from the it's-dark-in-here dept.
from the it's-dark-in-here dept.
I Don't Believe in Imaginary Property writes "Bruce Schneier has an essay on the mind of security professionals like himself, and why it's something that can't easily be taught. Many people simply don't see security threats or the potential ways in which things can be abused because they don't intend to abuse them. But security pros, even those who don't abuse what they find, have a different way of looking at things. They always try to figure out all the angles or how someone could beat the system. In one of his examples, Bruce talks about how, after buying one of Uncle Milton's Ant Farms, he was enamored with the idea that they would mail a tube of live ants to anyone you asked them to. Schneier's article was inspired by a University of Washington course in which the professor is attempting to teach the 'security mindset.' Students taking the course have been encouraged to post security reviews on a class blog."
Related Stories
Submission: Inside The Twisted Mind of Bruce Schneier by Anonymous Coward
[+]
Your Rights Online: Securing Your Notebook Against US Customs 1021 comments
Nethemas the Great points out a piece from Bruce Schneier running in the UK's Guardian newspaper with some tips for international travelers on securing notebook computers for border crossings. A taste of the brief article:
"Last month a US court ruled that border agents can search your laptop, or any other electronic device, when you're entering the country. They can take your computer and download its entire contents, or keep it for several days. ... Encrypting your entire hard drive, something you should certainly do for security in case your computer is lost or stolen, won't work here. The border agent is likely to start this whole process with a 'please type in your password.' Of course you can refuse, but the agent can search you further, detain you longer, refuse you entry into the country and otherwise ruin your day."
This discussion has been archived.
No new comments can be posted.
The Fine Print: The following comments are owned by whoever posted them. We are not responsible for them in any way.
Full
Abbreviated
Hidden
Loading... please wait.
Destructive mindset (Score:5, Insightful)
Re: (Score:2)
Re: (Score:3, Funny)
Re:Destructive mindset (Score:4, Insightful)
I would not say a destructive mindset but rather an inquisitive one - that asks "What possibilities does this open up and how can I use this to other ends?"
The challenge is to turn that mindset to productive, rather than destructive ends.
Speaking as one who has done that work; a little paranoia is a good thing as well; because some people are out to get you (and even more are just plain stupid enough to do a dumb thing).
Parent
Re:Destructive mindset (Score:5, Insightful)
I think it's got more to do with awareness and analysis than destructivness.
I remember some years ago now gently trying to persuade a colleague that it was inappropriate to have forwarded the infamous Craig Shergold [wikipedia.org] chain e-mail. Despite widespread publicity, the colleague absolutely refused to believe that there could be anything amiss and insisted I was being mean and cruel to deny the child (even by then cured and in his late teens) his "dying wish" and denounced my callousness to other co-workers.
There's an advertisement for an animal welfare organisation on British TV at present with pictures of pathetic looking dogs who have been badly beaten ("it's the worst case I've ever seen" says the voice-over) or "used as an ashtray". Finally, at the end of the advertisement the confession, "these are not real cases" - followed with a demand for money anyway, now the viewers have been "softened up".
Being a sucker for a sob-story isn't "constructive"; knowing that it can be exploited for social engineering isn't "destructive" - unless you regard human gullibility as a postive trait - though it sure can make you unpopular!
Parent
Re: (Score:3, Insightful)
Re: (Score:3, Insightful)
Re:Destructive mindset (Score:4, Funny)
Parent
Re:Destructive mindset (Score:4, Funny)
Parent
Re:Destructive mindset (Score:5, Funny)
Hashes collide because they're swerving to avoid Bruce Schneier.
And more:
http://geekz.co.uk/schneierfacts/ [geekz.co.uk]
http://geekz.co.uk/schneierfacts/facts/top [geekz.co.uk]
Parent
Re:Destructive mindset (Score:5, Insightful)
Implementing security procedures is not at all glamorous, and does not require more than understanding the system to which they apply. Writing security procedures in such a way that they will be difficult to abuse requires a twisted mind. Doing it correctly, so the procedures properly balance security and availability, requires a mind that is twisted and straight at the same time.
Parent
Re: (Score:2)
Don't comment when you obviously with that statement showed you have only a little bit of an idea about cryptography.
Re:Destructive mindset (Score:4, Insightful)
Parent
Re:Destructive mindset (Score:5, Informative)
I could probably invent a reasonable public key algorithm with a maths textbook to hand - but no way could I invent a good symmetric crypto algorithm. Symmetric crypto relies on scrambling things up in a way it can't be unscrambled easily. You have to know a *lot* about cryptanalysis to even begin designing one, and you can still become vulnerable to a surprise attack. There is no general way of mathematically proving that how you are doing the scrambling is secure in any way - only that it is resistant to all the known attacks so far.
Parent
Disappointing (Score:3, Interesting)
Re: (Score:2, Insightful)
Re:Disappointing (Score:5, Insightful)
Parent
Re:Disappointing (Score:5, Insightful)
Things that you may think are obvious are just not to most people. He's trying to reach normal people, business leaders, politicians - people who don't get it, or still think security is just boring techy stuff that doesn't work very well. He's trying to show it's also a mindset, a way of seeing the world, that anyone can understand. I think he's doing pretty good, but again, we are not his primary audience.
Parent
Re:I have to agree (Score:5, Insightful)
You cringe because he keeps saying the same things over and over again.
He keeps saying the same things over and over again because people keep making the same dumb mistakes over and over again.
Parent
In security (Score:4, Interesting)
Such a personality may be disastrous in many other cases but works well when it comes to security work.
And remember that most computer viruses in the beginning weren't really malicious - they just were there "because I can". Even those cases has to be taken into account by security people.
paranoia yes ..... (Score:3, Insightful)
Re: (Score:3, Interesting)
Re:In security (Score:5, Insightful)
I did in-house beta testing for a time, and used to really piss off the developers because I had a knack for knowing what they weren't planning for. I wasn't so much looking for security holes, but rather ways to crash the app. (which probably many of which were exploitable) A classic I heard was a developer submitting a bug report for "program crashes when it says Press Any Key and you press letter A". The developer called her back to his cubicle, why did you press "A"??? She said her name was Alice, and it said press ANY KEY so she hit "A". "But you're not SUPPOSED to hit "A", you're SUPPOSED to hit the space bar!" At which point the other developer stood up from his cubicle and said "oh? I thought it meant RETURN?" This perfectly illustrates how persistent assumptions are in coding. Not only are they all making assumptions, but they aren't even making the same assumptions.
That's the sort of testing I did. Deleting the last element in a list, Select all in empty lists, saving a form before completing it, entering a 200 character filename for save, taking advantage of assumptions that the user knew what they were doing and would not ask the program to do something that was certain to produce undesirable results.
Parent
Re:In security (Score:4, Funny)
Parent
Re:In security (Score:4, Funny)
Do you really want a user program hooking into trapping the ctrl-alt-delete sequence? I thought not.
Being pedantic, since the tester appears to be so, "any key" does not imply "any combination of keys", either.
I test by hitting the reset button, after all it can be considered a key too, just not a 'key' on the keyboard...
If I was the company, instead of changing the message, i would have modified the tester's behaviour, perhaps with a hammer if necessary...
Parent
Ant farms are nothing. (Score:3, Interesting)
You can get a port-a-potty delivered without ever providing positive identification. You don't even have to pay for it until it shows up, and they'll happily deliver while you're at work. They're quite used to people preparing to have renovations done by contractors.
Of course, I would never decide someone else needed a port-a-potty on their front lawn. But, much like the ants, it's something you can't help but notice if you have the right mindset.
Is this mindset really special? (Score:4, Insightful)
Good engineering (Score:4, Insightful)
In my opinion, good engineering involves thinking that things _will_ eventually fail, how it can be made to fail _safely_ if possible and figuring out what the acceptable risk is given the cost. Modern engineers don't normally design stuff to last for 1000 years (some of it might last that long - distribution curves and all that).
Re: (Score:3, Insightful)
Murphy [wikipedia.org] was an engineer after all.
Bruce Schneider Facts (Score:2)
The last time someone tried to look into Bruce Schneider's twisted mind, the Big Bang happened
You're damn right, most people don't get it! (Score:5, Interesting)
Our school gets a bomb threat, and the teachers and administrators are freaked out. They move us all, I kid you not, to the football field where we are fenced in by chain link fence, about 1/3 of which is covered by barbed wire. So I point out to my history teacher, one of the only genuinely intelligent public school teachers I have ever met that we had been corralled into an enclosed area, surrounded by strong sniper nests (there were many points where a shooter with a 30.06 and a few mags could have unloaded with impunity), and that ironically, if there were a bomb, and the person who planted it were clever, they'd have put it under the bleachers where about 200-300 of us were sitting.
He nodded his head in agreement that were this a real thing, we'd probably be fucked because of our administrators' plan, but the one or two regular teachers not far away who overheard acted like I was the real danger for pointing out what should been "the obvious" about this plan. Me? I'd have called in the buses, and shipped everyone off property to be safe right away.
Re:You're damn right, most people don't get it! (Score:4, Insightful)
And then the snipers would shoot them as they were packed like sardines into the busses. Me, I would pull one of 50 cards with random "evacuation plans" out of a hat and did what it said on the card. I'd include an "ignore the bomb threat" card in there as well.
Parent
Re:You're damn right, most people don't get it! (Score:4, Insightful)
Much like the pre-2001 response of "we'll sit and wait for the hijacking to end," bomb threats are dealt with as if the threat is honest. Once somebody has a case of a bomb under a bleacher to remember, we may act differently.
Security tends to be reflexive.
Parent
Re:You're damn right, most people don't get it! (Score:5, Insightful)
Parent
Re: (Score:3, Funny)
Me? I'd have called in the buses, and shipped everyone off property to be safe right away.
And then what happens when the busses drop below 55mph?
Article leaves out cost benefit analysis (Score:5, Insightful)
I am reminded of the time that I test drove a new car. All the dealership wanted was a photocopy of my driver license, and they let me drive the car off the lot for an extended test drive. Since driver licenses are relatively easy to fake, I wondered how often cars are stolen. I asked, and was told they are stolen on occasion, but insurance covers it. My point, they did the cost-benefit analysis, and decided on an insecure method.
There's a fine line (Score:4, Interesting)
Sadly the world we live in today has massively overestimated the possiblity of problems and hugely inflates the effects they will have (in the tiny percent of occasions when they happen). I think this is a side-effect of improved communications: we all get to hear about the 1 in a million disaster stories, but never about all the other times, when everything goes right. This leads us to think that problems are more common than they actually are.
The great thing about being a security professional is that you can never be proved wrong. If you claim a security hole and it is never exploited, no-one will say you're wrong - just that it hasn't been exploited yet. If we beleived everything these guys say, no-one would ever do anything as we'd all be too scared. Personally I think we should avoid the obvious problems, get on with our lives and accept that on a few, very few, occasions we might have to spend a little time sorting out a problem.
Re: (Score:3, Informative)
Consider the National Safety Council's Odds of Dying [nsc.org] page. According to them, one has a 1 in 73,085 chance of dying in a motorcycle accident while there's a 1 in 19,216 of dying in a motor vehicle accident as a car occupant.
However, motorcycles are perceived ( at least by people I know, obviously a small sample ) as more risky because "people die riding those". Obviously that happens, but not
Re:There's a fine line (Score:4, Informative)
Saying "jumping off the top of a building with piano wire wrapped around your neck" is much, much safer than being a passenger in a care because, hey, your chances of dying that way are only 1 in 492,593,129. That number just tells you how often death happened while doing that; without the vital piece of information about how many times it was attempted without dying, you don't really know anything of interest.
Parent
Developers: Put On Your Hacker Hat! (Score:3)
The necessary human element (Score:4, Insightful)
Where I get my car serviced, I know both guys who might be behind the desk, and they both know me, my wife, and son. They won't hand over the car keys on just a last name. Which brings it all back to a frequent point of Bruce's writings - all of the security razzle-dazzle in the world doesn't make a bit of difference compared to a knowledgeable person in the right spot.
Good engineers look for failure too. (Score:3, Insightful)
The problem isn't that good security professionals have a different mindset from good engineers, it's that both good security professionals and good engineers are rarer than people think, and that engineers are not as often held responsible for how their stuff fails when someone gains an advantage by deliberately making them fail.
As in many other areas of life, I try to ask myself, WWFD? What Would Feynman Do?
Scripts (Score:3, Insightful)
Making money by breaching security isn't easy (Score:4, Insightful)
What saves society is three things.
First, mischief and curiosity aren't a powerful enough motivator to create a real problem. I don't know whether Schneier ever sent live ants to strangers... or how many Slashdot readers will try it... but most likely not very many.
Second, for most security holes it is difficult to think of a way to make money from the exploits.
Third, even if you can make money, it's even more difficult to find a way that will make significant amounts of money and to repeat the exploit often enough to make a living wage, without being caught.
Case in point: newspaper vending boxes which allow you to pay for one newspaper and access a whole stack of them. If you have a "security mindset" (or even if you don't), it occurs to you that you could pay for one and take two... or ten... or the whole stack. And, indeed, you can. The problem is that it doesn't benefit you to get more than one newspaper. So, can you take two and sell the extra? Maybe. Net profit $0.50. Could you take the entire stack out of the machine and dress up as a street vendor and sell them on a street corner? Maybe. Net profit $25. Could you do it more than half-a-dozen times? Probably not.
How about self-checkout lines in supermarkets? You can buy produce at them, and the produce isn't bar-coded. So, you can buy orange bell peppers at $3.99 a pound, put them on the scanner scale, and enter the code for green peppers at $1.69 a pound. Most supermarkets seem to rely on someone at a nearby counter keeping an eye on the self-checkout lanes while doing other things, and they don't usually come over unless a customer calls or the machine goes into an error state. Again, it's hard to see how you can make money, rather than saving a little on your grocery bill... and if you managed to do this to the extent where you were stealing hundreds of dollars, I think your chances of being detected get to be high. (I'm thinking of people who got caught recently pasting barcodes for two-dollar items over things like boom-boxes and DVD players...).
I always thought I was just weird (Score:3, Interesting)
My answers always started the same way. "It's printed in ink on paper." I don't really think that the textbook author expected people to do anything other than to extend whatever line of reasoning had been presented in the previous examples (and I always got around to that) but the open-ended question "What can we say about this equation?" always struck me as license to comment on the clarity of the typesetting or anything else.
My teachers thought I was weird.
Later in life, I became involved in competitive pistol shooting. I loved the rule books. They were just collections of hidden loopholes begging to be found. And then came the problems. In some sports it was called the "engagement" rule. In others, it was the "spirit of the rules" rule. They were all the same sort of thing - a way to say you couldn't do anything unexpected. If you looked at a practical defensive scenario and found some completely whacky way to beat it by, say, running between cover in an odd sequence, you'd be found guilty by the officials of "failure to engage" the scenario. No points for you. A guy I knew had trouble seeing sights too close to his face but the rules forbid changing the sight radius (distance between the sights) making it impossible for him to move the rear sight further from his face. He responded by cantilevering both sights forward so that the sight radius stayed unchanged but both sights were now completely forward of the muzzle. It was perfectly legal under the rules as written but his pistol was declared illegal because it violated the "spirit of the rules."
What amazes me is the hostility this mindset engenders. I'm not shy about saying that I love to parse out the rules and find advantages. I'm not shy about saying that a "spirit of the rules" rule is really just saying "You're not allowed to be smarter than the people writing the rules and running the match." The reaction I get is flaming on message boards and accusations of poor sportsmanship. There are actually people out there who want to punish innovation; at least, that's the way I look at it.
"Thinking different" makes people feel threatened and act nervous and hostile. I don't understand that. Am I weird, or are they?
Re:Open network ? (Score:5, Insightful)
So, let's say you keep your wireless system closed. What happens when someone cracks the encryption key and gets access anyways? What happens when an internet bot net gets turned on your router because someone found a vulnerability in it? Lots of people kept secured computers before home routers and NAT became a real necessity. Doing so hasn't really gotten that much tougher. Just more constant.
My real guess, though, is that he keeps the wireless and wired networks separated. Internet->wifi AP ->wired router+NAT+firewall-> computers. Given that he's a pro, the wifi AP and wired router might not even be connected to each other at all.
Parent
Re: (Score:3, Funny)
> behind with the knowledge that the wireless system is wide open.
You're thinking like an engineer: "How is this supposed to work?"
Try thinking like an enemy: "How could this be exploited to harm Bruce Schneier?"
The most obvious thing is to get a rental car, drive it through some mud until the plates aren't legible, and sit across the street from the guy's house and use his wireless network for... nefarious purposes. Sendi
Re: (Score:2)
Re: (Score:2, Interesting)
Re: (Score:3, Informative)
You've got to be kidding. Maybe it's not natural for most software "engineers", but I bet it's pretty natural for engineers in general.
Indeed.
I was tempted to take issue with Bruce on that point. After I cut my programming teeth in classified research I built a career in automobile automation engineering. I was ALWAYS looking