Legal Disclaimer

"...For Dummies" is a registered trademark of Wiley Publishing, Inc. Wiley has not given authorization for this title, nor is it associated in any way with the Wiley (nee IDG Books, nee Hungry Minds) series "... for Dummies."

October 01, 2006

Like a Moth to the Moon

Every couple of years I have a day where I 'wake up', or gain a higher level of understanding of the stakes to what it is that I'm up to at the present. This weekend was one such time.

sdcc.jpg
San Diego Convention Center: Home of Toorcon 2006

This weekend, I went to Toorcon, a little itty bitty west coast computer security conference that annually holds a lot of the talks from DefCon, but without the oppressive crowds, the Vegas lights, nor the latchers-on. I'd say it's about my speed.

There are a lot of kooks in the computer security field, and they're the first to admit that they're kooks. My kind of people. I came to remember a time when I was having fun breaking systems, instead of doing the impossible task of trying to fix them.

Cory-Doctorow.jpg
Not a kook: Cory Doctorow delivering the keynote

I became interested in computer security after I rooted myself -- I wrote a simple helpdesk software that took email, used procmail and a perl script to stuff it into a database, and then used a web interface to read it and allowed users to "take" emails for themselves, out of the untaken email list. I worked for CIT at the time, and the tool was to be used by our whole group to track helpdesk email.

Something strange happened while testing. I was forward-copying all of the normal helpdesk email from my mail account to my script, just for testing. One of the emails only got partially entered. Like, the data just got cut off. Oddly, it happened at a semicolon. Curious, did that actually work? I sent an email with "hi;drop table foo;" as the body, and sent it. My database disappeared. "Wow, this is fucking cool!" A few weeks later, I started working for the Center for Systems Assurance at the university, amazed at my newfound powers of examination.

Since then, I've been working on the seemingly impossible task of making toaster ovens out of computers, so that users can't send any data they're not supposed not, and worse so that really clever evil users can't send any data they're not supposed to. It's an impossible task, or at least an intractable one. Nobody is patient enough to make a toaster oven for our users (which is what we really need, if we want to limit them to using toaster oven functions). I'm remembering why I want to go back to grad school -- it's a lot more fun to break the toaster than it is to make it. Modus tolens over modus ponens, which is great because that's what the scientific method is all about.

"it's a lot more fun to break the toaster than it is to make it."

Right on! I like breaking things..

Posted by: Laura on October 4, 2006 11:12 AM

Post a comment










Please enter the number above into the box below.









Further back...

Archives