What does it take to write a novel book on computer security?
Or rather, what does it take to write a novel on modern computing?
A young yet highly experienced author with talents in many areas
including many aspects of computing, mathematics, and electronics (and
perhaps a hobby in
robotics),
as well as other seemingly unrelated interests
(including, let's say, fatalistic erotic
photography),
and indeed with a talent and desire to write.
Once upon a time in a dark and largely unexplored forest, the magic
chemistry of (brain cell) trees gave birth to a bit of information,
only to let him sail his way down a quick river, into the vast sea (of
the Internet), and ultimately find his new home, grave, or maybe a
place in a
museum.
And so the tale begins. Whether our little bit is good or evil, at a
young age he will reach the stream flowing into a shiny castle made
out of white-colored foil (yet regarded by many as a black box).
He will pass through the entrance and approach the counter to
check in. If he weren't so naive and short-sighted, he could notice
a group of evil-looking bits staring at the counter from a distance,
taking note of the time bits check in and out; he would have no choice
but to proceed to sign in, though.
Once rested, our hero might be asked to team up with his siblings
or to join a group of other bits and bitesses, and together they would
pack their bodies tightly onto a used inflatable boat. A careful bit
could notice bits of garbage (or is that garbage?) in the boat,
presumably left by a previous group.
Observing the traffic lights and squeezing through traffic jams, our
bits enter a safe harbor and sail to the wharf. Will they be seen
from nearby castles and lighthouses? Will someone track the traffic
light switches to determine just when our group sailed? Will someone
turn on lights at the wharf and take pictures? Will those other evil
bits assume the identity of ours and sail away to the sea first?
Our bits wouldn't know.
And so they change boats at the wharf and sail to the sea . . .
The journey of our pet bits proceeds, with many dangers yet to come.
No, Michal's book does not hide technical detail behind a fairy tale as I
have above. Rather, while a very entertaining read, it gets
all the facts straight and promptly gives answers to most challenges
introduced at the beginning of each chapter.
Silence on the Wire is unique in many aspects, but two stand out:
First, it provides in-depth coverage of almost all essential stages of
data processing that enable today's "internetworking" - from a
keypress to the intended end result of that keypress. Second, it outlines the
largely overlooked, under-researched, and inherent security issues
associated with each stage of networking and with the process as a
whole. The security issues covered serve well to demonstrate the art of
vulnerability research from both the attacker's and the defender's
perspective, and will encourage further research on the part of the reader.
Clearly, a computer security book can't be comprehensive. In SotW,
Michal has provocatively chosen to leave out all the well known yet
highly dangerous and widespread vulnerabilities and attacks being
discussed and worked on today by most in the information security community.
He will teach you about subtle keystroke timing attacks, but you will not be
reminded that "trojan horse" software with key logging
capabilities is currently both more common and easier to use than any of
such attacks could ever be.
Why mention keystroke timings while leaving the trojans out? Because
timing attacks are largely underappreciated and misunderstood even by
information security professionals, whereas trojans are a widely known
and obvious threat. Vulnerability to timing attacks is a property of the
design of many components involved, whereas to implant a trojan requires
either a software bug or an end-user error.
Similarly, and with few exceptions, you won't find the slightest mention
in SotW of the widely exploited software bugs - or even generic
software bug classes such as "buffer overflows." If you are not
already familiar with the common computer security threats and would like to
gain that knowledge, you will need to accompany yourself on your journey
through this book with the perusal of less exciting material available
on the Internet and in other books, and in particular with material
pertaining to the specific operating systems that you use.
Why study silence, you may wonder - isn't that a nothing? Yes, in a
sense. A zero is a nothing in that sense, too. But it is also a number,
a concept we cannot really understand the world without.
Enjoy the silence - the best you can.
Alexander Peslyak
Founder and CTO
Openwall, Inc.
better known as
Solar Designer
Openwall Project leader
January 2005
