Subject: [FFML] Re: Plug Out - revised [CotS][Lain][spamfic]
From: Maciej Zenczykowski
Date: 5/5/2003, 6:57 PM
To: Peter Townsend
CC: <ffml@anifics.com>


Okay, a major virus/computer rant ahead, skip it if you don't feel like it
:)

Oh, if only removing a virus was that easy - unplug a PC from the network
and press the reset button... I have a friend who only last night had to
repartition and format three drives to get rid of one... Maybe switching the
infected systems off and switching to backups would be better...

Actually - it is - if you are on a military vessel with military hardware
than a reboot is done off of hard media (ie R/O) - the operating system
and all important files are kept on R/O media (might be flash, but
reflashing it requires _physical_ intervention (i.e. someone has to flick
a power switch)).  So a system reboot is physically equivalent to
switching to a backup - all files on R/W media are timestamped and if you
simply request a deletion of all files modified in the last 5 minutes (or
whatever) than you are free of the virus.  (The timestamps are done by
hardware - so they can't be hacked).  Only then do you permit the use of
this R/W media.  All in all this can be done very quickly.  If this is a
military vessel than it is bound to have backups (come on - the Abh's
enemies would have surely attacked through viruses if it was so simple).
The basic truth is that breaking into / infecting a home computer system
(or even a commercial one) is trivial - while military systems are another
matter.  Sure a virus _just_ _might_ damage/render inoperable unimportant
system elements but it will not compromise battle worthiness (unless we
assume the millions of Abh engineers/programmers are complete idiots).  So
you might end up with being unable to find/play your favorite movie/song,
because it was deleted, but you'll still have helm control and targetting,
communication, etc...  On the other hand there might always be holes in
the system - on the practical side finding such holes is practically
impossible without the source code (or at the very least the binary file)
because you would have to literally test trillions of combinations (and
you are limited by the speed of the computer being attacked) - i.e. if you
know nothing about the system then how will you realize that sending the
message 'aadshfg442efkhas' will cause an unauthorized login - you'd have
to check all 20 byte sequences.  This is pretty much what security
breaches look like on unix nowadays - someone sits down with the source
code - finds a bug - and realizes that sending this and this and this will
cause the code to overflow (or whatever) in a specific way, which will
cause something to happen etc.  In fact it is a lot easier to crash a
system then to infect it (a crash only requires the overflow to happen -
an infection requires the overflow to happen in such a way that program
control is transferred to your handcrafted code).  Even then all you've
gained is control over one process, which in properly protected systems
(not win) means that you are able to do whatever that system does (i.e.
you gained control of sound communications via compression codec Z in
sector 54 - so you can corrupt or modify or listen in on all other
communications in sector 54 utilizing compression codec Z).  Sure it is a
start - but it is not much use.
Basically the point is that without info on the inside composition of the
system breakins are virtually impossible - it's like trying to steal a
book titled 'english title' from a japanese library when you don't know
japanese (in a library you might actually find an english index - you
won't find an guide to the Abh computer systems written in Modern-day
computer 'speak').  Now if Lain actually had access to the programming
before she launched the attack - then and only then - she might be able to
cause some slight damage (a reboot would still cure it, and it would still
work in a matter of minutes (i'd guess 45 seconds tops)).  And yes cutting
all external communications (actually only to the planet) would act like a
complete firewall.

Yes viruses are powerful and can be a real pain.  However protecting
against them is really simple (it is! it's peoples stupidity which is
responsible for 99.9% of virus infections).  Take a look at mainframe
Unices, or Linux, FreeBSD - how many viruses are there written for them?
none, only a handful (I know of 3) of worms (which at best infect a single
users account).  Sure this is due to a couple reasons:
a) a lot more intelligent users
b) less effort (because it's harder) put in by the virus makers
c) up until recently a lot less machines
d) a lot less spreading around of binary only software (it is harder to
infect a source code distribution :) )
e) etc...

Not to mention that there simply is no such thing as a universal virus
(all _true_ viruses get in through security breaches - these are hard to
find and work on specific systems (i.e. method A works on system running
this processor this operating system, with this version and revision and
this software, with this version)).

Even if a system can execute arbitrary code (universal translator, etc...)
than even if this code is a virus - then you end up with a single process
which is consuming processor cycles and doing pretty much nothing (all you
need to do is kill it, and it will likely be killed by the kernel if it
uses to much CPU or RAM, etc...).

This is why pretty much the only really useful hacker based military
attacks are scrambling signals, causing confusion, attacking
commercial/home users (i.e. not military targets) and causing denials of
service.

The current proliferation of viruses/worms is due mostly to microsoft and
the complete lack of security in DOS (okay it wasn't supposed to have any)
and Windows + the tendency of people to share binary files.  However even
then you still need to have a good deal of info on windows (or Word if you
are writing a worm) to create a virus - Lain doesn't possess this
knowledge on the Abh systems (or does she?).

It is a common misunderstanding that viruses can get in through anything.
There needs to be a hole - and a normal communications channel is not a
hole (unless the data is compressed and there is a bug in the compression
codec and you know what this bug is and you prepare a message which will
make use of this bug, again requires prior in-depth knowledge of the
computer system and software you are up against).  If the only thing done
with this data is it is sent to a digital/analog converter and then to the
speakers (i.e. it isn't compressed) then you will do absolutely nothing
(you might, if you're lucky cause the speakers to overload, but even that
is doubtful - since there are usually hardware protections against such
happenings (since they sometimes happen naturally in buggy programs ;) ).

Okay I think I've made my point clear, and I'm not quite sure if this is
on topic or not... so I'll add a C&C fragment - I don't think Jinto should
explain to Lafiel what a virus is - if she's got a command position she is
bound to know at least as much as he said (if not more).

Oh - I just realized something.  Viruses (biological) exist in nature.
But do human viruses attack monkeys - yes but very very few, mammals -
even fewer, plants - none that I know of, bacteria - even less likely?
And these are all (complex computer) systems based on the same processor
and operating system (Carbon + Amino Acids).  The Abh computer system
would be like a Silicon + Beta Bases when compared to Earth's computer
systems.  The stuff would be so incompatible that pretty much the only
thing which would work would be analog audio.  Hell, even American TV
signals are NTSC while in Europe there is PAL or SECAM - that's three
slightly incompatible systems right there for analog video signals.  When
we start off with digital systems the room for incompatibilities is even
bigger.  It's like running a Commodore 64 program on an x86 Windows
machine without an emulator - no way in hell is it going to work.  Take a
look at how many video codecs there are - how many graphics file formats
there are.  We can't get our terran formats to work nicely with each other
- there is no way a digital link to an alien civilization will work
right off the bat, unless the alien civilization is much more advanced and
has some sort of 'universal digital computer code translator', which would
probably amount to running an emulator of human computers on the Abh ship,
and a break in would only compromise the simulation (i.e. zero losses).

Even with an infinetely powerful computer system, when breaking into
another computer system you are still limited by this new systems speed -
and the faster the system the more complex it is and the more
possibilities require checking, and this grows way faster than the systems
speed (i'd say the number of possibilities grows exponentially, while the
speed grows linearly - since a twice as fast computer can deal with twice
as much data, which has twice as many bits, which is _waaaaay_ more then
twice as many possibilities, so the faster the computer the harder it
actually is to break in (without knowing specifics about the systems
internals)).

Ahh, I'm rambling...

"While you had a com blackout I ordered the fleet to block all access
from outside. We checked the local broadcasts of the planet. It seems
A foolproof solution... Almost as good as TURNING OFF THE FREAKING MODEM.
Why more people, supposedly experienced 'hackers', don't think of that in
movies and such, I don't know...
Yap, this always bugs me as well.

this Lain is using some global computer network called "Internet". She
constantly tries to hack into our systems."
the fact that it is called the Internet is kind of pointless information,
I don't think Jinto would mention it - who cares what it's called - it's a
big computer (for Earth) computer network...

"Girls fall into three catergories. Those who want to kill me, those who
want to sleep with me, and the rest haven't met me yet."
Sure enough - but the three categories sometimes overlap...

Cheers,
MaZe.


             .---Anime/Manga Fanfiction Mailing List----.
             | Administrators - ffml-admins@anifics.com |
             | Unsubscribing - ffml-request@anifics.com |
             |     Put 'unsubscribe' in the subject     |
             `---- http://ffml.anifics.com/faq.txt -----'