4 ms·

A history of Internet security

17 points by bootload 11y ago

bootload 11y ago
great shot of rtm leaving court in '88 cf: Morris Worm
tptacek 11y ago
This is... not great (for instance: it culminates in "car hacking"). How could you make it better? I'd suggest adding: * This is inside baseball, but Lopatic's NCSA httpd exploit in '95, which inspired 8lgm's Sendmail 8.6.12 exploit, which in turn kicked off the modern era of software security. * The Mitnick/Shimomura Saga in summer '95, which surfaced TCP sequencing and provoked the eventual adoption of SSH. * The first major distributed denial of service attack (probably around '99). * The Summer Of Worms (Slammer/Blaster/Welchia in '03), which pivoted Microsoft from security-oblivious desktop software vendor to the middle of the enterprise security industry. * The release of Metasploit at Black Hat in '03. * Roughly the same time period: Tor. * The AT&T "Room 101" NSA monitoring fiasco. * Something like TippingPoint's Zero Day Initiative, or some other appropriate example of an early vulnerability market, in '06-'07. * You think, maybe, just maybe, Snowden is meaningful to Internet security?
- adventured 11y ago
  The famous 2002 Bill Gates "Trustworthy computing" memo. http://windowsitpro.com/security/complete-text-bill-gates-trustworthy-computing-memo http://windowsitpro.com/security/complete-text-bill-gates-tr...
- contingencies 11y ago
  * First widely distribute trojans (Backorifice, etc.) * Spoofing (before decent intermediate router policies, and with predictable TCP sequence numbers in early TCP stacks) * TCP-half open portscanning (Assange's 'strobe' tool) * Major developments in covert OS detection * All major OS default daemon/config remote bugs * Host-based and network-based IDS (Snort, etc.) * SATAN * Era of people mass-migrating from Windows to Mac and Linux * Microsoft finally releasing a malware removal tool * First consumer firewalls * UPnP deployment for home routers * Major cable breaks * Major routing glitches * The many blows to trust in SSL certificate infrastructure * The devops era (immutable infrastructure and the beginnings of 'security as a process' popularization)
secfirstmd 11y ago
Would make for a very interesting book. (If there isn't one available already)
bgilroy26 11y ago
I just finished reading The Cuckoo's Egg today it's about security in the days of Arpanet et al (1986). It was a little goofy and it has a lot of human interest stuff in it to make it more of a story, but I liked it. I can't remember life before everyone was on dialup Internet, so it was very informative to me. pg shows up as a student in a tiny aside at the very end! Story summarized here: http://en.m.wikipedia.org/wiki/The_Cuckoo%27s_Egg http://en.m.wikipedia.org/wiki/The_Cuckoo%27s_Egg ACM article covering the story's events (May 1988): http://dl.acm.org/citation.cfm?id=42412&dl=ACM&coll=DL&CFID=679765795&CFTOKEN=71360838 http://dl.acm.org/citation.cfm?id=42412&dl=ACM&coll=DL&CFID=...

17 points by bootload 11y ago

great shot of rtm leaving court in '88 cf: Morris Worm

This is... not great (for instance: it culminates in "car hacking"). How could you make it better? I'd suggest adding: * This is inside baseball, but Lopatic's NCSA httpd exploit in '95, which inspired 8lgm's Sendmail 8.6.12 exploit, which in turn kicked off the modern era of software security. * The Mitnick/Shimomura Saga in summer '95, which surfaced TCP sequencing and provoked the eventual adoption of SSH. * The first major distributed denial of service attack (probably around '99). * The Summer Of Worms (Slammer/Blaster/Welchia in '03), which pivoted Microsoft from security-oblivious desktop software vendor to the middle of the enterprise security industry. * The release of Metasploit at Black Hat in '03. * Roughly the same time period: Tor. * The AT&T "Room 101" NSA monitoring fiasco. * Something like TippingPoint's Zero Day Initiative, or some other appropriate example of an early vulnerability market, in '06-'07. * You think, maybe, just maybe, Snowden is meaningful to Internet security?

adventured 11y ago
The famous 2002 Bill Gates "Trustworthy computing" memo. http://windowsitpro.com/security/complete-text-bill-gates-trustworthy-computing-memo http://windowsitpro.com/security/complete-text-bill-gates-tr...
contingencies 11y ago
* First widely distribute trojans (Backorifice, etc.) * Spoofing (before decent intermediate router policies, and with predictable TCP sequence numbers in early TCP stacks) * TCP-half open portscanning (Assange's 'strobe' tool) * Major developments in covert OS detection * All major OS default daemon/config remote bugs * Host-based and network-based IDS (Snort, etc.) * SATAN * Era of people mass-migrating from Windows to Mac and Linux * Microsoft finally releasing a malware removal tool * First consumer firewalls * UPnP deployment for home routers * Major cable breaks * Major routing glitches * The many blows to trust in SSL certificate infrastructure * The devops era (immutable infrastructure and the beginnings of 'security as a process' popularization)

secfirstmd 11y ago

Would make for a very interesting book. (If there isn't one available already)

bgilroy26 11y ago

I just finished reading The Cuckoo's Egg today it's about security in the days of Arpanet et al (1986). It was a little goofy and it has a lot of human interest stuff in it to make it more of a story, but I liked it. I can't remember life before everyone was on dialup Internet, so it was very informative to me. pg shows up as a student in a tiny aside at the very end! Story summarized here: http://en.m.wikipedia.org/wiki/The_Cuckoo%27s_Egg http://en.m.wikipedia.org/wiki/The_Cuckoo%27s_Egg ACM article covering the story's events (May 1988): http://dl.acm.org/citation.cfm?id=42412&dl=ACM&coll=DL&CFID=679765795&CFTOKEN=71360838 http://dl.acm.org/citation.cfm?id=42412&dl=ACM&coll=DL&CFID=...