Creeva’s World 2.0

Pic­ture taken from here

Yes­ter­day I was talk­ing with my thir­teen year old brother.  He told me about how he was going to setup a web­site for this girl he knows.   He was going to con­fig­ure it so you couldn’t take the images off the page and use them some­where else.    I explained that it truly couldn’t be done.

To get into a quick side note, if you have images on your site and I want to copy them, don’t bother it’s triv­ial.  I will just pull them out of my browser cache and viola — there I have your images.  Just because you thought you were “Uber Cool” because you used JavaScript to dis­able right click­ing and sav­ing the images doesn’t mean your images are secure.   If you go even more “l33t” and try to use a flash slideshow pro­gram attempt­ing to lock it down fur­ther, a quick screen shoot and a copy paste into MS Paint will still get me that image if it’s so cool I must have it for my per­sonal col­lec­tion or to dis­play on my web­site.  Any­thing that can be seen or heard will always be open attack in one form or another — smell and touch we will even­tu­ally come for you.

The main ques­tion in the title stands, if you can’t bypass it is it secure?  The answer should always be no — there is no unbreak­able form of secu­rity.  Given enough time and effort any secu­rity in the world can bypassed. Given enough expo­sure at Def­con and unlim­ited hot pock­ets any­thing is vul­ner­a­ble. Just because you, your­self can’t not fathom a way to bypass the secu­rity you have put into place doesn’t mean that it’s the top of the line.   There is always some­one smarter then you.  Even if you are the indus­try expert in cryp­tog­ra­phy and think you are secure because of some great pass­word sys­tem you came up with, doesn’t mean your sys­tem can’t be infil­trated from a phys­i­cal attack.

Let’s go into a real world example

I’m some­one who doesn’t really use the dead­bolt in my house (my wife does for any­one get­ting ideas).  Why don’t I?  It’s pas­sive self assur­ance against an attack that’s improb­a­ble.  Locks can be picked fairly eas­ily, either through skill or the advent of “bump­ing”; this makes locks for all intents and pur­poses use­less right?  Well not quite, to pick a lock it takes effort time and expo­sure to being caught (yes even in the case of using a bump key which isn’t nearly as notice­able).  A lock is a good first round bar­rier to keep peo­ple out as a casual deter­rent.   If a door is lock most peo­ple won’t progress much fur­ther.  For some rea­son even mild deter­rents will keep most peo­ple hon­est.  This doesn’t mean that you house is secure.

If I was going to rob your house, I’m not going in the front door.  Iron­i­cally no one puts dead­bolts on their back doors.  So if I’m going to pick a lock (I’m too lazy and I would more likely kick the door in any­ways) I would imme­di­ately be pick­ing your back door instead of your front door.   Does this mean putting a dead­bolt on your back door will make you secure?  No actu­ally I’m more likely to go in through a win­dow in the back or side of your house.   Do you have a secu­rity alarm?  Well that’s another deter­rent, but still doesn’t really buy you secu­rity.   If I’ve tar­geted you and you have some­thing I really want I would just sit in the bushes out­side your win­dow and watch you enter in your key code.

So now you’ve put bars on all of your win­dows, put your alarm code num­ber pad in a place that can’t be seen from a win­dow, put dead­bolts on your back door, put door jams on all your doors to make them resis­tant to being kicked in, so now your secure right?  Well do you have a garage door opener?  For a fairly cheap price I could use a scan­ner to get the fre­quency that allows me to open your garage door.   You go away for the week­end I can open your garage door, pull inside, close the garage door and then pro­ceed to ran­sack all your expen­sive tools and pos­si­bly gain entry to the house if I want to risk the alarm.   Your neigh­bors aren’t likely to notice that if I pull in at 1 AM.

If you are inter­est­ing you can be tar­geted, it’s all the mat­ter of effort some­one wants to put into an attack.  Most peo­ple don’t have a secu­rity mind set so they assume they are secure because it will keep them out.  Unfor­tu­nately it doesn’t work that way.   Secu­rity, espe­cially home secu­rity requires a lit­tle bit of trust in what effort your fel­low man doesn’t exceed the effort it takes to steal your stuff.

I’ll give one more example:

When I start work at my new job they were talk­ing about the screen­saver pol­icy at work which was fif­teen min­utes.  It was a writ­ten pol­icy but they planned to put in a win­dows pol­icy to enforce it.   I stated that such poli­cies are hard to enforce since soft­ware to emu­late ran­dom key presses are easy to get (I used one in my pre­vi­ous job so I could watch movies on flights with­out hit­ting the key­board myself).  You would think that I just gave nuclear launch codes to the Rus­sians — I kind of defeated his logic with a triv­ial bypass.

Wis­dom in secu­rity is gained when you real­ize that all you can really do is best effort.  Noth­ing is truly secure, nor will it ever be.  Trust while being the anti-thesis of secu­rity plays an impor­tant role.  You place safe­guards into effect up to and past the amount of trust you have in the users access­ing what­ever you are try­ing to pro­tect.  With each safe­guard that goes into place the like­li­hood of being attacked drops, that doesn’t mean it’s secure, it just means you have mit­i­gated some of the risk.  Once peo­ple start to under­stand this wis­dom and the logic behind it, they will actu­ally be more secure, the irony of it all.

It’s not because I’m older or more knowl­edge­able, it’s because I have wis­dom when it comes to secu­rity.   Even for things I don’t know how to com­pro­mise I know attack vec­tors and likely tar­gets.   I can’t crack high end com­put­ers or pick dig­i­tal locks, but I know how I would attack them, which gives me an area for how I can defend them.  I don’t need to know how to break or bypass some­thing to know it’s inse­cure.  Like I’ve said it’s a mat­ter of know­ing every­thing that can be built up can be torn down.