October 01, 2006
Like a Moth to the Moon
Every couple of years I have a day where I 'wake up', or gain a higher level of understanding of the stakes to what it is that I'm up to at the present. This weekend was one such time.
| San Diego Convention Center: Home of Toorcon 2006 |
This weekend, I went to Toorcon, a little itty bitty west coast computer security conference that annually holds a lot of the talks from DefCon, but without the oppressive crowds, the Vegas lights, nor the latchers-on. I'd say it's about my speed.
There are a lot of kooks in the computer security field, and they're the first to admit that they're kooks. My kind of people. I came to remember a time when I was having fun breaking systems, instead of doing the impossible task of trying to fix them.
I became interested in computer security after I rooted myself -- I wrote a simple helpdesk software that took email, used procmail and a perl script to stuff it into a database, and then used a web interface to read it and allowed users to "take" emails for themselves, out of the untaken email list. I worked for CIT at the time, and the tool was to be used by our whole group to track helpdesk email.
Something strange happened while testing. I was forward-copying all of the normal helpdesk email from my mail account to my script, just for testing. One of the emails only got partially entered. Like, the data just got cut off. Oddly, it happened at a semicolon. Curious, did that actually work? I sent an email with "hi;drop table foo;" as the body, and sent it. My database disappeared. "Wow, this is fucking cool!" A few weeks later, I started working for the Center for Systems Assurance at the university, amazed at my newfound powers of examination.
Since then, I've been working on the seemingly impossible task of making toaster ovens out of computers, so that users can't send any data they're not supposed not, and worse so that really clever evil users can't send any data they're not supposed to. It's an impossible task, or at least an intractable one. Nobody is patient enough to make a toaster oven for our users (which is what we really need, if we want to limit them to using toaster oven functions). I'm remembering why I want to go back to grad school -- it's a lot more fun to break the toaster than it is to make it. Modus tolens over modus ponens, which is great because that's what the scientific method is all about.







by reid
on October 01, 2007
by reid
on July 17, 2005
"it's a lot more fun to break the toaster than it is to make it."
Right on! I like breaking things..
Posted by: Laura on October 4, 2006 11:12 AM