6 ms·

It's time to admit that computers connected to the internet can not be secured. Even if the entire operating system is vetted and locked down, and only vetted

by rapjr9 6y ago

It's time to admit that computers connected to the internet can not be secured. Even if the entire operating system is vetted and locked down, and only vetted and audited apps are run on the system, there will always be zero day exploits. Science has come up with no possible way to provably secure network connected computers. So do not trust them any more. Please prove me wrong, but I doubt you can. The most trusted computers in the world have repeatedly been hacked. And even if you could make a secure computer, people can not be trusted because there is always some way to compromise them. Maybe the best we'll ever be able to do is assume a system will eventually be compromised and concentrate on minimizing damage and fast recovery. Removing the incentive to compromise computers could be a solution, but that seems even less likely given our million year history.

jshawl 6y ago
To be fair you have the burden of proof by asserting "computers connected to the internet can not be secured."
- nobody9999 6y ago
  >To be fair you have the burden of proof by asserting "computers connected to the internet can not be secured." How so? In fact, competent InfoSec folks will tell you that you should assume that "if you connect a device to the Internet, eventually it will be compromised." That's not to say a device will be compromised, but making such an assumption, given the history of Internet connected devices is an eminently reasonable one. I've yet to see any formal proof that computers connected to the Internet can be secured. If you have, please link a reference. I'd love to see it.
  - kfrzcode 6y ago
    Extraordinary claims require extraordinary evidence. But even ordinary claims require ordinary evidence. The burden of proof is on the claimant, not the defendant. I believe that's the point parent was addressing.
    - nobody9999 6y ago
      >The burden of proof is on the claimant, not the defendant. I believe that's the point parent was addressing. Absolutely. I was pointing out that in this specific case (whether or not devices connected to the internet can be secured), the converse is also true.
- rapjr9 6y ago
  It's an open problem in science to prove security of a network connected computer. It's well known.
  - alanbernstein 6y ago
    Really? What's that problem called? As you stated it, it seems too vague to be considered "open" or "closed".
    - rapjr9 6y ago
      Provable Security: https://en.wikipedia.org/wiki/Provable_security https://en.wikipedia.org/wiki/Provable_security If you read that article you'll see that current approaches don't even attempt some kinds of proofs such as proof of security against side channel attacks. It goes by other names as well such as proof of code correctness: https://www.schneier.com/blog/archives/2009/10/proving_a_compu.html https://www.schneier.com/blog/archives/2009/10/proving_a_com... A major problem with current attempts at proofs is you can at best create a proof based on a system specification and what you want it to be secure against, which basically means you have to already know all possible attacks including zero day attacks. So far the field has resulted in nothing practically useful as far as I know. Homomorphic encryption might be close to being practical for a limited set of problems and could be provably secure for a limited set of attacks, though I don't know if anyone has attempted such a proof yet.
      - alanbernstein 6y ago
        Thanks. That sounds about as fruitful as I would have guessed.
vecinu 6y ago
You bring up a very good point and it's worth reiterating that the Kremlin reverted to use paper instead of computers to discuss sensitive topics. [1] I wouldn't be surprised if any network connected device is vulnerable to being exploited, even if not directly connected to the internet, by association of other devices on the network. [1] https://www.usatoday.com/story/news/world/2013/07/11/russia-spies-nsa-typewriters-documents-computers/2508751/ https://www.usatoday.com/story/news/world/2013/07/11/russia-...
nobody9999 6y ago
>It's time to admit that computers connected to the internet can not be secured. That ship sailed a long time ago. It was normal back in the 1990s for InfoSec folk to assume that "if it's connected to the Internet, eventually, it will be compromised." The goal (then, as now) is to implement layered (defense-in-depth) mechanisms to deter such activities -- at perimeters, network and systems infrastructure platforms and software implementation. This is (and has been for a long time), a well-defined, although usually poorly (if at all) implemented set of processes and procedures. The levels of complexity for Internet resources have vastly increased over the past 25 years. Info Security techniques have advanced as well, but again are often poorly or not at all implemented. However, far too many organizations implement a "Skittles" type defensive posture rather than defense-in-depth posture. There are a variety of reasons for this: 1. Those responsible are ignorant of good security practice; 2. Those responsible are aware of the risks, but ignore it as it negatively impacts profit; 3. Those responsible are aware of the risks, but implement inadequate defenses because of the impact on time-to-market and/or profit. 4. But the most egregious offenders are software developers, who often just bolt on weak security measures or just ignore security altogether, rather than design with security as a primary consideration. There are other reasons, but those are the big ones, IMHO.
- rapjr9 6y ago
  True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to security researchers say for years that there was no point in trying to address APT's because they were just impossible to stop. Now APT methods are public knowledge and being used in common attacks. Some types of APT attacks are still too costly to be widely used, but some that used to be considered very sophisticated (like hiding an MCU in a computer cable) are not. The reasons you list for a weak defense posture don't really apply to a government. Also the GAO has issued a constant stream of reports saying US government agencies have poor security. It was likely only a matter of time before something like this incident happened. Similarly it's probably only a matter of time until the IRS, Social Security, and other agencies are successfully attacked on a large scale.
  - 6y ago
A_non_e-moose 6y ago
> It's time to admit that computers connected to the internet can not be secured. Iranian centrifuges were air-gapped (ie no internet connection) and they still got hacked by Stuxnet via USB. https://en.m.wikipedia.org/wiki/Stuxnet https://en.m.wikipedia.org/wiki/Stuxnet We are well past the point where even stuff that's not connected to the internet can not be secured.
- manquer 6y ago
  I am bit skeptical of the accidental USB insertion story. A secure air gapped network won't have open USB ports . Only privileged users who know what they are doing should even have access to a port. .
Beached 6y ago
there is a saying in infosec, "not if, but when". no one is under the dissolution that we can keep a network perfectly safe, we just implement layers to mitigate damage
arendtio 6y ago
I think it is just a problem between theory and practice. In theory it is possible, but in practice it has proven to be so hard, that I am not sure if there ever was or will be a secure computer that is connected to the internet. Another problem is that the complexity in modern systems is increasing and designing secure systems on top of complexity is next to impossible. I think Unikernels have a good chance of delivering secure systems from a software perspective, but it seems even modern hardware has enough vulnerabilities to thwart those plans.

by rapjr9 6y ago

jshawl 6y ago

To be fair you have the burden of proof by asserting "computers connected to the internet can not be secured."

nobody9999 6y ago
>To be fair you have the burden of proof by asserting "computers connected to the internet can not be secured." How so? In fact, competent InfoSec folks will tell you that you should assume that "if you connect a device to the Internet, eventually it will be compromised." That's not to say a device will be compromised, but making such an assumption, given the history of Internet connected devices is an eminently reasonable one. I've yet to see any formal proof that computers connected to the Internet can be secured. If you have, please link a reference. I'd love to see it.
- kfrzcode 6y ago
  Extraordinary claims require extraordinary evidence. But even ordinary claims require ordinary evidence. The burden of proof is on the claimant, not the defendant. I believe that's the point parent was addressing.
  - nobody9999 6y ago
    >The burden of proof is on the claimant, not the defendant. I believe that's the point parent was addressing. Absolutely. I was pointing out that in this specific case (whether or not devices connected to the internet can be secured), the converse is also true.
rapjr9 6y ago
It's an open problem in science to prove security of a network connected computer. It's well known.
- alanbernstein 6y ago
  Really? What's that problem called? As you stated it, it seems too vague to be considered "open" or "closed".
  - rapjr9 6y ago
    Provable Security: https://en.wikipedia.org/wiki/Provable_security https://en.wikipedia.org/wiki/Provable_security If you read that article you'll see that current approaches don't even attempt some kinds of proofs such as proof of security against side channel attacks. It goes by other names as well such as proof of code correctness: https://www.schneier.com/blog/archives/2009/10/proving_a_compu.html https://www.schneier.com/blog/archives/2009/10/proving_a_com... A major problem with current attempts at proofs is you can at best create a proof based on a system specification and what you want it to be secure against, which basically means you have to already know all possible attacks including zero day attacks. So far the field has resulted in nothing practically useful as far as I know. Homomorphic encryption might be close to being practical for a limited set of problems and could be provably secure for a limited set of attacks, though I don't know if anyone has attempted such a proof yet.
    - alanbernstein 6y ago
      Thanks. That sounds about as fruitful as I would have guessed.

vecinu 6y ago

You bring up a very good point and it's worth reiterating that the Kremlin reverted to use paper instead of computers to discuss sensitive topics. [1] I wouldn't be surprised if any network connected device is vulnerable to being exploited, even if not directly connected to the internet, by association of other devices on the network. [1] https://www.usatoday.com/story/news/world/2013/07/11/russia-spies-nsa-typewriters-documents-computers/2508751/ https://www.usatoday.com/story/news/world/2013/07/11/russia-...

nobody9999 6y ago

>It's time to admit that computers connected to the internet can not be secured. That ship sailed a long time ago. It was normal back in the 1990s for InfoSec folk to assume that "if it's connected to the Internet, eventually, it will be compromised." The goal (then, as now) is to implement layered (defense-in-depth) mechanisms to deter such activities -- at perimeters, network and systems infrastructure platforms and software implementation. This is (and has been for a long time), a well-defined, although usually poorly (if at all) implemented set of processes and procedures. The levels of complexity for Internet resources have vastly increased over the past 25 years. Info Security techniques have advanced as well, but again are often poorly or not at all implemented. However, far too many organizations implement a "Skittles" type defensive posture rather than defense-in-depth posture. There are a variety of reasons for this: 1. Those responsible are ignorant of good security practice; 2. Those responsible are aware of the risks, but ignore it as it negatively impacts profit; 3. Those responsible are aware of the risks, but implement inadequate defenses because of the impact on time-to-market and/or profit. 4. But the most egregious offenders are software developers, who often just bolt on weak security measures or just ignore security altogether, rather than design with security as a primary consideration. There are other reasons, but those are the big ones, IMHO.

rapjr9 6y ago
True. However, now that APT tools have been leaked to the world I think I can still argue that even layered defenses are no longer sufficient. I listened to security researchers say for years that there was no point in trying to address APT's because they were just impossible to stop. Now APT methods are public knowledge and being used in common attacks. Some types of APT attacks are still too costly to be widely used, but some that used to be considered very sophisticated (like hiding an MCU in a computer cable) are not. The reasons you list for a weak defense posture don't really apply to a government. Also the GAO has issued a constant stream of reports saying US government agencies have poor security. It was likely only a matter of time before something like this incident happened. Similarly it's probably only a matter of time until the IRS, Social Security, and other agencies are successfully attacked on a large scale.
- 6y ago

A_non_e-moose 6y ago

> It's time to admit that computers connected to the internet can not be secured. Iranian centrifuges were air-gapped (ie no internet connection) and they still got hacked by Stuxnet via USB. https://en.m.wikipedia.org/wiki/Stuxnet https://en.m.wikipedia.org/wiki/Stuxnet We are well past the point where even stuff that's not connected to the internet can not be secured.

manquer 6y ago
I am bit skeptical of the accidental USB insertion story. A secure air gapped network won't have open USB ports . Only privileged users who know what they are doing should even have access to a port. .

Beached 6y ago

there is a saying in infosec, "not if, but when". no one is under the dissolution that we can keep a network perfectly safe, we just implement layers to mitigate damage

arendtio 6y ago

I think it is just a problem between theory and practice. In theory it is possible, but in practice it has proven to be so hard, that I am not sure if there ever was or will be a secure computer that is connected to the internet. Another problem is that the complexity in modern systems is increasing and designing secure systems on top of complexity is next to impossible. I think Unikernels have a good chance of delivering secure systems from a software perspective, but it seems even modern hardware has enough vulnerabilities to thwart those plans.