<!DOCTYPE HTML PUBLIC "-//W3C//DTD HTML 4.01 Transitional//EN">
<html>
<head>
<meta content="text/html; charset=UTF-8" http-equiv="Content-Type">
<title></title>
</head>
<body text="#000000" bgcolor="#ffffff">
Hi all,<br>
<br>
I scanned over that article. It's both interesting and frightening. I
found the summary section, quoted below, to be most interesting.<br>
<br>
<quote on><br>
<br>
The moral is obvious. You can't trust code that you did not totally
create yourself. (Especially code from companies that employ people
like me.) No amount of source-level verification or scrutiny will
protect
you from using untrusted code. In demonstrating the possibility of this
kind of attack, I picked on the C compiler. I could have picked on any
program-handling program such as an assembler, a loader, or even
hardware microcode. As the level of program gets lower, these bugs will
be
harder and harder to detect. A well installed microcode bug will be
almost
impossible to detect.
<p>After trying to convince you that I cannot be trusted, I wish to
moralize. I would like to criticize the press in its handling of the
"hackers,"
the 414 gang, the Dalton gang, etc. The acts performed by these kids
are
vandalism at best and probably trespass and theft at worst. It is only
the
inadequacy of the criminal code that saves the hackers from very
serious
prosecution. The companies that are vulnerable to this activity (and
most
large companies are very vulnerable) are pressing hard to update the
criminal code. Unauthorized access to computer systems is already a
serious crime in a few states and is currently being addressed in many
more
state legislatures as well as Congress.
</p>
<p>There is an explosive situation brewing. On the one hand, the press,
television, and movies make heroes of vandals by calling them whiz
kids.
On the other hand, the acts performed by these kids will soon be
punishable by years in prison.
</p>
<p>I have watched kids testifying before Congress. It is clear that
they
are completely unaware of the seriousness of their acts. There is
obviously a cultural gap. The act of breaking into a computer system
has to
have the same social stigma as breaking into a neighbor's house. It
should not matter that the neighbor's door is unlocked. The press must
learn that misguided use of a computer is no more amazing than drunk
driving of an automobile.
</p>
</quote off><br>
<br>
Remembering what we learned in kindergarten, or preferably before
kindergarten, would help: you don't violate another person's body,
space, property, rights; because it's wrong, because you hurt the other
party in some way, and / or cost them money, or just scare them. You
don't violate their computer or their car either, whether or not you
can. If you do violate those things, you're subject to get punished.
We, as a culture, have to resume teaching our children basic values of
right and wrong and hold them to those standards before they get to the
criminal level. I especially like the last paragraph of the quote.<br>
<br>
I listened to the audio book of Kevin Mitnick's Ghost In The Wires. It
was a truly scary tale of what a malicious cracker can do. It was
fascinating from a technological point of view. It was scary from a
social point of view. While he's since turned over a new leaf and is
apparently a white hat, perhaps as long as he gets paid to be, he did
much harm on the way from being a black hat to becoming a white hat.
Some may mention that he restrained himself and didn't, for example,
steal millions of credit card numbers, even when he could. That's all
well and good, but he still hurt people, and companies; and that's
wrong. This activity is not the type of thing that should be
glamorized or idolized. It should be condemned.<br>
<br>
And yes, the companies that are vulnerable to attack SHOULD do security
audits and tighten up their defenses.<br>
<br>
Ron<br>
<br>
<br>
On 9/7/2013 10:26 AM, Boris Borisov wrote:
<blockquote
cite="mid:CABo2fvBjdb+qrv4vVMSwnO_OaZLSdiqrYRA==-xH72wPJwc48g@mail.gmail.com"
type="cite">
<div dir="ltr">
<div><a moz-do-not-send="true"
href="http://cm.bell-labs.com/who/ken/trust.html" target="_blank">http://cm.bell-labs.com/who/ken/trust.html</a><br>
<br>
</div>
This story really makes your head spinning ...<br>
</div>
<div class="gmail_extra"><br>
<br>
<div class="gmail_quote">On Fri, Sep 6, 2013 at 5:17 PM, Jim Kinney <span
dir="ltr"><<a moz-do-not-send="true"
href="mailto:jim.kinney@gmail.com" target="_blank">jim.kinney@gmail.com</a>></span>
wrote:<br>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<p dir="ltr">I think the Intel compiler will make the kernel but
it's closed source.<br>
It's not in RedHat's best interest to ship a trojaned compiler but I
don't know who does 3rd party checks of their binary. This underscores
the need to not use binary blobs in kernel code.</p>
<div class="gmail_quote">
<div>
<div class="h5">On Sep 6, 2013 3:33 PM, "Michael B. Trausch" <<a
moz-do-not-send="true" href="mailto:mbt@naunetcorp.com" target="_blank">mbt@naunetcorp.com</a>>
wrote:<br type="attribution">
</div>
</div>
<blockquote class="gmail_quote"
style="border-left: 1px solid rgb(204, 204, 204); margin: 0pt 0pt 0pt 0.8ex; padding-left: 1ex;">
<div>
<div class="h5">
<div bgcolor="#FFFFFF" text="#000000">
<div>On 09/06/2013 12:25 PM, Jim Kinney wrote:<br>
</div>
<blockquote type="cite">NSA started the selinux process but does
not participate any more.</blockquote>
<br>
I'd make a crack about checking out the compiler, but we have more than
one.... no, wait, wait, just one compiler that can compile Linux.
Hrm...<br>
<br>
<a moz-do-not-send="true"
href="http://cm.bell-labs.com/who/ken/trust.html" target="_blank">http://cm.bell-labs.com/who/ken/trust.html</a><br>
<br>
— Mike<br>
<br>
<div>-- <br>
<table border="0">
<tbody>
<tr>
<td> <img
src="cid:part1.08090804.02090800@techstarship.com"
alt="Naunet Corporation Logo"> </td>
<td> Michael B. Trausch<br>
<br>
President, <strong>Naunet Corporation</strong><br>
☎ <a moz-do-not-send="true" href="tel:%28678%29%20287-0693%20x130"
value="+16782870693" target="_blank">(678) 287-0693 x130</a> or <a
moz-do-not-send="true" href="tel:%28888%29%20494-5810%20x130"
value="+18884945810" target="_blank">(888) 494-5810 x130</a><br>
FAX: <a moz-do-not-send="true" href="tel:%28678%29%20783-7843"
value="+16787837843" target="_blank">(678) 783-7843</a><br>
</td>
</tr>
</tbody>
</table>
</div>
</div>
<br>
</div>
</div>
<br>
</blockquote>
</div>
</blockquote>
</div>
</div>
</blockquote>
<br>
<br>
<pre class="moz-signature" cols="72">--
(PS - If you email me and don't get a quick response, you might want to
call on the phone. I get about 300 emails per day from alternate energy
mailing lists and such. I don't always see new email messages very quickly.)
Ron Frazier
770-205-9422 (O) Leave a message.
linuxdude AT techstarship.com
Litecoin: LZzAJu9rZEWzALxDhAHnWLRvybVAVgwTh3
Bitcoin: 15s3aLVsxm8EuQvT8gUDw3RWqvuY9hPGUU
</pre>
</body>
</html>