I recently worked with a UNIX security expert setting up a small pile of servers. We hired him to handle the total system security of the servers, as those servers would be charged with storing highly sensitive customer data. The vendor for this data had very strict requirements regarding how we were allowed to store this data. The requirements (something similar to PCI Level I) were dictated in a 40-page document, where one of the rules required a monitored camera to be shining directly on the primary database server at all times.
My job was relatively easy as I had to hire someone to secure the servers, not do the work. I happily found a crack-shot security guy who had done large installations at maximum security. And he didn’t disappoint. I know my way around UNIX systems pretty well, but he worked magic I’ve surely never seen.
One of the last things he did was install an intrusion detection system. That is, a system that monitors all interesting system activity and sends out (a lot) of email about everything it notices. Change a UNIX config file? Get an email. Add a user? Get an email. Issue a command as root? Get an email. Needless to say, I started getting a lot of email.
At one point during our discussion about the system, I asked him why we had the system at all. I mean, if this guy was so good (and to this day, I still believe he is), an intrusion detection system is sort of like a prenuptial agreement. You get one in the event of something bad happening, but at the same time, you can’t really get one without admitting you expect something bad to happen.
Wasn’t his system secure? Did he personally think he left a hole somewhere that would allow a hacker to access it?
He responded that he was 100% confident that the system was as secure as possible after his work. He left no holes and patched all known vulnerabilities. He followed his declaration that, of course—regardless of all that—the system can still be broken into. His response was utterly matter-of-fact. Of course, a break-in was still possible—even likely.
I suppose this wasn’t a huge surprise. Despite locking the doors to our houses and cars, we still have alarm intrusion detection systems that detect entry. No one is foolish enough to think a car or house door lock keeps out a real thief. A reasonable defense after that is to get immediate notification when an intrusion occurs. Another reasonable defense that many people follow is to hide valuables. You typically don’t leave your stash of cash on your dresser—you hide it somewhere. In your sock drawer or under your mattress. But typically, even though you have a front door lock and maybe an alarm system, it’s prudent to add time and difficulty to a prospective thief’s job.
After some more discussion, my security guy invited me to attend Defcon, a yearly security/hacker conference held in Las Vegas. I was intrigued and agreed. When I went to pre-register online, I found out that there wasn’t any such thing. There was no pre-registration; there was only on–site registration. And there were no credit cards—cash only, $120.
I arrived early at the convention and gave a nice lady my $120. In return, she gave me an anonymous badge. She didn’t want my name, address, or email. Everyone at the convention was to remain as anonymous as they wanted to be. The convention itself was jam-packed. Wall-to-wall humans were mostly in black T-shirts with typically funny hacker slogans on them.
In one room, they had situated five teams with networked computers in a competition where they simultaneously defended their servers and attacked the other teams’ servers. Another room had a large projected screen showing people’s passwords at the convention that sent them unencrypted over the wireless (I shut off my laptop and phone for the rest of the weekend). They showed the iPhone hack that could own a remote iPhone with a single sent SMS message. I saw talks on hacking websites with request forwarding and one by an MIT student that beat stock spammers at their own game.
Needless to say, the folks at this conference weren’t messing around. To this day, I discuss with developers the appropriateness of code obfuscation. Obfuscation technology has come a very long way past simple identifier renaming. These days, it’s more about things like control-flow obfuscation and opaque predicates. Their argument usually revolves around some variation of “If an expert really wants your code, they’re going to get it.”
I couldn’t agree more. In fact, after attending Defcon, I believe it even more. The only place I start to disagree is when they contradict themselves with solutions that they think will work. If your code is reachable, in any form, by users, it’s vulnerable. Software-as-a-service is often cited as safe. I wouldn’t have needed to hire a security expert if that were true. And he wouldn’t have told me point-blank that no matter what you do, an expert can hack your server.
Protecting your software is not a 100% sure solution because there is no solution. It’s about throwing as many obstacles as possible in the way of attackers. Like I said, your front door lock doesn’t have a prayer for stopping a thief, but for some reason, you still always lock your door. Alarm systems don’t stop thieves; they just let them know they’ve only got a few minutes to do their job. Hidden valuables will be found, but hiding them just makes the job harder.
The name of the game is risk and reward. Simple security measures by you that cause significant headaches for attackers are what you’re looking for. Obfuscation makes deciphering your IP harder. Software tampering detection lets you know someone is tinkering with your application. By nature, attack surfaces start pretty significant. The best you can do is reduce that area as much as possible.