Harvey Newstrom wrote:
> Spike Jones wrote,
> > As I viewed downtown Manhattan from the air this week,
> > I pondered the terrorist threat of an internet worm designed
> > to crash the whole net, bringing down email, everything.
>
> To be honest, it's a big mystery why this hasn't happened. So many
> political and extremist groups have used worms to attack the net that such
> events are conspicuously absent right now. The only theory that makes sense
> to me is that such small fry fear being associated with the big terrorists
> and they are all lying low right now.
I've got a theory of my own that seems to fit the facts:
Only those trained (formally educated or self taught doesn't matter, so
long as the skills are there) in a field of expertise have the
capability to exploit it for great harm, in most of the nightmare
scenarios being floated around (cyber-war, mass-scale bio/chem attacks,
et cetera). However, those same people are also largely those who
personally benefit from positive employment of said knowledge.
For example, say you were a biotech expert. You could develop a black
market plague, reaping several million dollars and eternal secrecy (and
all the extra effort your future life will require because of it), not
to mention the possibility that the plague will mutate and infect you
and your loved ones. Or, for about the same effort, or you could
develop a miracle drug and reap several billion dollars and much fame
(which will mostly fade over time, returning your life to normalcy if
you so wish). Those who do the most damage are by and large those
uneducated in the system, and routed by more competent people...or even
those who are just as uneducated, but whose initial inclinations are
not as mischevious.
There's a reason that script kiddies grow up to become white hat
security consultants.
Additional fact: there are such things as virus and worm proof systems.
They often require proper use, to avoid trojans and such getting into
the system; in fact, often times the difference between a secure system
and an insecure system is mostly how it is used, as opposed to the
software (though selecting software that does not, for instance,
automatically run email attachments does help).
If I may say so, I am composing this email on such a system right now.
It's an ordinary Win98 box, but it is configured to be inaccessible
from the outside world: I can send email out and get it from my server,
but any new sockets coming in are denied. Any email with an executable
attachment (which includes Office files) is deleted instead of invoked.
Javascript is off unless I want it on, and then only while I visit a
specific, trusted site. Et cetera.
Critical systems are not always as secure, but most of them tend to be
this way. The businesses that run them lose large amounts of money if
their customer-serving boxes ever get compromised.
This archive was generated by hypermail 2b30 : Sat May 11 2002 - 17:44:13 MDT