Security and Privacy in a Networked World/For introduction: broomsticks, hackers and crypto

Some glances on history

The broomstick at the door

This is a practice still alive in remote places - someone leaving home would leave a broom at the door to denote people being away; he/she knows that people would understand and honour the privacy of the home. Now, compare to (for example) a typical modern insurance contract...

Sometimes history makes interesting twists - while the Soviet Army was an infamous pillager and defiler (anyone who has seen the derelict military installations in Estonia can tell you this), they are actually to thank for preserving West Estonian islands. All coastal regions were declared border zones that needed special permits to enter (locals were given an exception). While the army did their share of defilement there too, the islands were saved from large hordes of tourists. The nature of the islands was mostly preserved - until the opening of the area to public brought the onslaught of tourists which has started to take a visible toll by now.

Similar things are also seen in the history of technology

Hackers and passwords

Hackers: The Heroes of the Computer Revolution by Steven Levy is a fascinating book telling the story of early computing pioneers at the Massachusetts Institute of Technology. The term 'hacker' originally meant (and for many serious IT people, still does) not a criminal, but rather a passionate fan of technology able to innovate and think with his/her own head.

The original MIT hackers shared all the resources (they were scarce as computing was taking its first steps: today's watches have more computing power than computers of the day). When the management of MIT introduce passwords on computers, they were seen as an obnoxious intrusion by"suits" rather than a security measure. Levy also describes how Richard M. Stallman, one of the early hackers (who later went on to found the Free Software movement) used to approach users and say 'I see you chose the password [such and such]. I suggest that you switch to the password "carriage return". It's much easier to type, and also it stands up to the principle that there should be no passwords.' According to him, 1/5 of the users complied with the idea.

However, eventually the opposite was made necessary by the changing world.

Back then,

• computers were rare and expensive - although the multitude of administrative and bureaucratic barriers kept many interested people from using them, it also kept off most of the malicious people (just like it was in Estonian islands)
• the selected few who had access to computers, had much better knowledge on them than today.

We may compare it to the sailors' proverb: in old times, ships were wooden and men were made of iron - nowadays, we have iron ships and wooden men

Today, in the Western world, nearly everyone can have a computer - http://thehomelessguy.blogspot.com/ is a nice example. It is possible to pull an old laptop literally from a trashcan, plug it in at some public place, and use the local public wireless connection to get online. However, the bad side of mass access and ubiquity is easy to spot as well:

• many "interesting" business models - "Pecunia non olet" (money does not smell) is a famous quote by Roman Emperor Vespasian who taxed public toilets in Rome. Vespasian would have probably loved Internet...
• a lot of bad guys - while shady people have always been around, now they are provided with a new arena that is perfect for swindling. Posing as someone else is easy, as is disappearing (no need for smoke powder and other ninja stuff).
• even more well-equipped fools - probably the worst problem of the three. Today's Pentium IV has lots of more computing power than early pioneers even dreamed about (Bill Gates: "640kB of memory ought to be enough for everyone"). Yet, a teenager or a drunk driving a top-level Porsche or Ferrari is much more dangerous than when sitting in a VW Bug...

And there is no good immediate solution.

While the Stallman's story above is interesting, it only had a very limited impact. Yet, almost the same result in a remarkably larger scale was achieved by Microsoft with Windows 95 and 98.

Why Windows gets hit

Early versions of MS Windows (and before them, MS-DOS) were single-user systems with no passwords used. Win 95 introduced a primitive, token password system which in fact did not protect anything but the user's desktop image and icons – it was trivial to bypass the password by pressing "Esc" and getting access to a generic desktop.

The result was a whole generation of ordinary computer users who saw passwords as a mere nuisance. Even when Microsoft's security started to improve a bit (mostly by Windows 2000), the mindset of users was already messed up.

People ask "Why do the bad guys target MS?" - computer malware is overwhelmingly a MS Windows phenomenon (even if some bad things exist for MacOS X and Linux too). While Microsoft advocates usually point to the largest market share (biggest target), the real reason is likely elsewhere - the biggest resource of clueless users ready to be exploited (the system vulnerabilities help but are often not needed at all). Or let's look at stereotypes: Linux is used by nerds. Macs are used by hipsters. Windows is used byAunt Millie (as this is what she got from the store with her new computer).

Security vs privacy

More than often, two extremes of the same scale:

• top security, no privacy: Soviet Russia
• top privacy, no security: pre-9/11 New York

The main point is to find the suitable balance - good security is invisible.

However, today's security (not only in IT!) is further complicated by various contradicting factions in the field, e.g. antivirus companies depend on ample presence of viruses (McAfee, Symantec, Sophos would be really unhappy if all malware was suddenly gone)

Two industries

One of the worst plagues of the 21st century computing is the possibility of perverted business models - a large spectrum of activities ranging from just obnoxious marketing ("I know you like to surf hunting pages, so I will advertise you rifles, boots and backpacks") to the malware industry specializing on theft and hijacking (keylogging etc). The main problem is the difficulty in removing the stimuli - e.g. e-mail spamming is highly profitable to this day.

Coming to another industry, a story goes on two doctors, father and son: "Dad, you treated Mr. Smith for seven years. I solved his problem in two months!" - "Son, I used his money to pay for your education."

Security has been paid for throughout the ages. And it was understood very early that

• security is about selling a safe feeling
• it is wise to keep potential threats at bay, not eliminate them - thus ensuring that there is work for tomorrow as well

Hiding the messages: a brief look at cryptography

Early days

Encryption (hiding the meaning of messages) has a long history, traces of it go back to Ancient Egypt. An example of an early device used in Greece to transmit hidden messages was the scytale - a stick with a strip of parchment wrapped around it. The message was written along the stick, the parchment was then unwound and sent with a courier. The receiver had to have a stick with the same diameter to rewind the parchment and read the message.

The first ciphers used were simple substitution ciphers like the Atbash cipher - the first letter from the alphabet was substituted with the last, the second one with the second last one etc (i.e. A=>Z, B=>Y, C=>X etc). Another well-known example is the Caesar cipher that replaces each letter with a letter 3 (or other number) positions later in the alphabet (i.e. A=>D, B=>E etc). This kind of cipher has enough possible combinations, but it can be solved knowing the frequency of letters in a language and possible combinations of letters.

The following generation had variable alphabets - at first only a handful of recurring alphabets, later all alphabets were different.

The Vigenère cipher

The number of alphabets is equal to the number of letters in the main (language) alphabet. Each of the used alphabets starts with a different letter. E.g.

U S I P N A M S …
B I U E R K A S ....
T O J S I N E R …
…

The key consists of the first letters of alphabets, e.g. U B T E R O F H … The first letter of the message is encrypted using the U-alphabet, the next one with B-alphabet, etc.

One-time pad ciphers

Were widely used during the World War II - in principle, this cipher is impossible to open when used properly. However, proper use has been hindered by various circumstances.

An example: the message is "Meeting at Akadeemia tee 3-307 on Feb 3, 2014 at 16.00".

• The code (let us suppose that 25 is the code for Akadeemia tee): 25 33 07 03 02 20 14 16 00.
• The key (one-time pad): 33 23 98 54 01 83 22 43 66
• The encrypted message: 58 56 05 57 03 03 36 59 66

The recipient will substract the pad from the encrypted message (in case of going negative, add 100 to the initial value). Sometimes information is also divided in a non-standard way, e.g. the 3-307 becomes 33 07 here.

However, there were practical problems with the one-time pads. First, generating unique keys in large numbers was difficult. A typical Soviet-style laissez faire - some pages of code books were duplicated to make things easier - brought along the Venona project (1942-45) that allowed British secret services to read Soviet messages for several years. Also, the length of the message was limited to the end of the key. And there was a strict rule that was however not always followed - any messages sent encrypted were never to be sent in plain text (even if the content of the message lost all value meanwhile).

Everyday crypto today

The most common (also used by e.g. Estonian ID card infrastructure) are the PKI (Public Key Infrastructure) solutions. When A sends a message to B, he/she would use B's public key and send the message. B would then decrypt the message with his/her private key. Digital signatures work in a similar manner: A would send a message encrypted with his/her private key. Upon receiving it, B would decrypt it with A's public key - the fact that the message was legible also proves its authenticity. A third component of PKI are certificates which assure the validity of public keys.

Concluding remarks

• Security is a moving target – what's valid today might not be tomorrow
• There is no 100% security
• Security and privacy may be exclusive sometimes but not always
• Don't be a champignon (kept in dark, fed on shit)

Links and additional reading

• BENSON, Robert L. (2001). The Venona Story. Fort George G. Meade, MD: National Security Agency, Center for Cryptologic History. http://www.nsa.gov/about/_files/cryptologic_heritage/publications/coldwar/venona_story.pdf
• LEVY, Steven (2001). Hackers, Heroes of the Computer Revolution. New York, NY: Bantam Doubleday Dell Publishing Group. Two first chapters are available at http://www.gutenberg.org/etext/729
• SCHNEIER, Bruce (2006). Applied Cryptography: Protocols, Algorithms, and Source Code in C. Second Edition. Wiley.

Study & Blog

• Find and describe two historical security cases/stories (preferrably related to IT and/or cryptography) - one which fully applies also today, and another that certainly does not (but may have been valid in its days - similarily to the Stallman case described above).