It’s all just a matter of time and accessibility and everything today is breakable in the short term future…

June 26th, 2008 Drazen Drazic Posted in Bad Developers, Bad Stuff, Dumb Security, Industry Specialists Talk, Research, WTF, cyber crime |

By YanaBanana and Drazen Drazic

Not talking about a new theory here but maybe some points worth discussion. Starting ramble:

With the increase in technology becoming more accessible and affordable to the masses, we face a good deal of unseen or unintended consequences on security in general.

Eg; Insurgencies in countries such as Iraq where homemade rockets are used, are getting more sophisticated. If anyone has ever tried to build a rocket (not the WMD type), (like myself), you will find that it is surprisingly hard to get it to fly straight. With processors/microcontrollers getting cheaper and more accessible, it’s relatively easy to make extremely good guidance systems now to attach to your homemade rocket - ready to fire at any target you wish.

Now apply this kind of thinking to something less bodily harm inducing such as GSM cracking. Not long ago, it was extremely expensive to get any sort of decent RF equipment to sniff GSM traffic, and then the computing power to actually break the poorly designed encryption (A5/1 and A5/2).

Present day, what you need is a relatively inexpensive FPGA and the help of rainbow tables (http://www.hackaday.com/2007/08/11/cccamp-2007-gsm-a5-cracking). Now all you need to do is sit outside any business and listen to their conversations in real time, (or any business competitors).

This applies to any technology that has previously been unable to be examined by the public. We’re seeing the same scrutiny to a lot of wireless devices in the past couple of years as the price of the technology has dramatically dropped. I’m picking on wireless examples here because they’re easy. The point I’m making here isn’t that the GSM encryption is crap but rather to promote the fact, that by making technology more accessible, it has a lot of unintended consequences.

The Internet started out like that, under the assumption that only a few people could get online and get connected to each other. All technological advancements have started with functionality and features as drivers. Recent ones have been introduced well after security was considered a major issue (and we should have known better), and we knew that we were developing everything on the Internet - on a system and protocols that are inherently insecure.

We’re not changing. We are not learning from the lessons of the past. More short and long term pain to come - no doubt about that, regardless of what the major security vendors feed us. Name a few new technologies today that we have faith and trust in that are secure now, and we believe will continue to be. Any in the former category at all before the latter is even questioned?

So they [vendors] talk about “clouds”, hitting the bad guys “at the source”, and a plethora of other BS plans that have no substance to them whatsoever.

Any solutions to even basic security issues need a starting point and a significant change to current thinking and even then, it will takes years to see the impacts of this. (I don’t want to say paradigm shift :-)).

But, we’re not seeing anything changing right now. We’re hearing talk and that’s about all! We’re not seeing new thinking and radically new implementation of security into technologies being released! So how can we honestly expect anything is going down a path of effective and significant change? There is nothing in the near future but more pain, but most of us know that already.

</rambling>