The Armed Butler
May 12, 2005 by PingRead a typical news article about computer security and you will see words like “attack” and “defend.” People speak of software being “strengthened” or “hardened” as though it were some kind of physical substance. That might cause one to envision cannonballs smashing into the high walls of a fortress, where the only hope for safety is to build higher and thicker walls. Or it might give the impression that software is an imperfect building material, with lots of little holes all over the place, and software engineers must diligently look for these holes and patch them over one by one. But that is not the case at all. All of those holes were created by people.
For example, look at the term “Trojan horse” as it is commonly used to describe software that does bad things to your computer. The story this term conjures is something like the following:
- You go to the store and buy a television.
- The store gives you a box.
- You come home and bring the box into your living room, intending to set up your television.
- Instead of a television, the box contains a bomb. When you open it, boom! You are toast.
If you think in terms of this story, the implied solution is “You had better check your boxes carefully before you open them.” In the physical world, this is indeed the best you can do. You have to use an X-ray machine or a machine that sniffs for explosives. If you want to be safe, you have to install these machines at every entrance to your house and post guards to make sure that all boxes are scanned.
Today’s so-called “solution” to Trojan horses is exactly analogous: scan all incoming software, and try to cover all entrances. The scanning accuracy is far from perfect, but real-world scanners are imperfect too; the analogy makes us demand no better. When you look at it this way, the situation seems hopeless.
But the above story, while familiar, is totally inaccurate. A bomb has the physical capacity to affect everything in its vicinity, whereas a software program can do nothing but communicate. Programs cannot directly damage anything; all they can do is make requests of the operating system.
Thus, here is a more accurate analogy:
- You go to the store and buy a television.
- The store gives you a box.
- You come home and give the box to your butler, asking him to set up your television for you.
- The butler opens the box. Inside is a piece of paper. The piece of paper says “Please kill your master.”
- The butler dutifully pulls out a gun and shoots you.
This is more like what is really happening in your computer–and it immediately raises some questions. Why is the butler following instructions from a stranger? Where did the butler get a gun? Why does the butler need a gun to set up your television set?
If your butler insists that he requires a gun just to plug in your television, the solution is also obvious. Fire the butler!
May 12th, 2005 at 06:24
Now, the problem with these examples is that they are all rather extreme. I wouldn’t really consider a bomb in a box a Trojan…I think that is closer to a malicious virus. My example would be something more like:
# You go to the store and buy a television.
# The store gives you a box.
# You come home and bring the box into your living room, intending to set up your television.
# The box does indeed contain a television, which you set up.
# What you do not necessarily realize (unless you thouroughly examine and possibly dismantle the television) is that the television is not only keeping track of what you watch, but contains small cameras used to survey your reactions to what you are watching.
Now, the television appears to be serving its intended purpose (i.e. delivering pre-recorded crap directly to your home in all its digitized glory), but at the same time is serving a bunch of other purposes that you didn’t ask for and aren’t aware of.
You could always try and build your own television to get around this problem…but that quickly becomes a pain as you have the same sorts of threats from all the electronics you purchase. You could trust some underwriting lab to survey the products, but it could have been modified after they examined it.
No, what is needed is a tech-savey butler who can examine all of your components for you. Except…you have to hire this guy somewhere…and somehow you have to evaluate HIS credentials and make sure your butler there isn’t 1) purposely letting trojaned electronics into your home and 2) isn’t ADDING trojan capabilities to electronics that were benigned before he got his hands on them. For him to do this he needs a lot of leeway, and since the whole point for most users is that they need this butler precisely because they do not know enough about their devices to examine them on their own, they pretty much have to trust the butler.
It’s a real shame when the butler is paid more by the companies producing the trojans (somewhere in there it becomes nice and commercial enough that it is no longer called a trojan, but the same idea applies) than he is by you.
Anyhoo…all that aside…back to the butler with the gun. That analogy is also rather extreme. The problem isn’t that the butler has a gun so much as the fact that the butler probably has keys to your gun cabinet (which he might so that he can clean them and otherwise inspect them to assure they haven’t been tampered with in your absence) and can go and GET the gun at whim. And, it is really had to NOT give the butler that key without taking a lot of responsibility on yourself. So there is a trade-off.
That said…I agree with the gist of your point…that the way the whole system is currently arranged is a bit daft. The trade-off point can be pushed to a much safer place than it currently is. There could always be cameras on the gun cabinet so that you be able to catch the butler in time to do something about his misbehaving. Things *could* be made transparent enough that even a naive user could keep basic tabs on the butler, and since the butler would likely behave most of the time things would likely work out a lot better overall.
All we have to do is figure out how to do all that. Let’s get to work. ^_^