Cybersec Canon Ep 4. The Cuckoo’s Egg - Chapter 9-12. Variety in Software Solutions
In the book Cliff Stoll makes the case for a diverse software ecosystem. But now, it seems like there is more consolidation and standardization than variety.
“If everyone used the same version of the same operating system, a single security hole would let hackers into all the computers. Instead, there’s a multitude of operating systems: Berkeley Unix, AT&T Unix, DEC’s VMS, IBM’s TSO, VM, DOS, even Macintoshes and Ataris. This variety of software meant that no single attack could succeed against all systems. Just like genetic diversity, which prevents an epidemic from wiping out a whole species at once, diversity in software is a good thing.”
Stoll, Clifford. CUCKOO'S EGG (pp. 57-58). Knopf Doubleday Publishing Group. Kindle Edition.
Chapter 9 - Cliff talks a bit about Berkeley life and about Martha (his girlfriend) and Claudia (their roommate). On Wed, Sep 17, Cliff notices that the previous night, someone was unsuccessfully trying username/password combinations and wonders if there is another hacker. Later, the hacker uses Sventek login and uses Kermit to upload a Trojan horse program (or a mockingbird program as Cliff called it) to steal passwords. It fails because it is designed for AT&T Unix, not Berkeley Unix. The hacker returns to check the file where passwords should have been copied to and finds it empty. He tries the program a few times, gives up, deletes the file and goes away.
Cliff calls the file transfer program Kermit, as the Esperanto of computers. Back in the day (2000s), Java had the reputation of being able to run across platforms. It was marketed as though it would magically work across platforms, but one had to compile the program into bytecode, and the specific machine had to have the OS-specific JVM installed.
Chapter 10 - The Tymnet traces led them to Oakland’s Bell telephone exchange, but to have a phone trace, they needed a search warrant. Cliff asks Lee Change the trace specialist at Pac Bell but he says he would not help without a warrant. Sandy Merola, who worked for Roy Kerth, discovers that if you log in from Berkeley library’s public PCs, it would dial Tymnet. They decide to check the library computers when the hacker next logs in. The hacker logs in at noon and Sandy goes to the campus library but finds no one there. So that becomes a dead-end.
The mention that phone lines can be traced only when they are connected, reminded me of many spy-thrillers where this was an essential plot element.
Chapter 11 - They finally get the search warrant. They start the trace when the hacker logs in and finds that he logs off immediately. Cliff finds that it is probably because the system operator was seen online and the hacker knows their names/logins by now. So he calls them and asks them to use different pseudonyms. They trace the call to somewhere on the East Coast, possibly Virginia. Cliff says his sister lives there, but this could not be from her. Later, Cliff finds out that though the hacker appeared with Sventek’s login only for 15 mins, he was on the system for over two hours. He was using other dormant accounts - Mark, Goran & Whitberg. He had tried to access three Air Force systems through Milnet using Whitberg’s account and read a few scientific papers.
Two weeks already passed. Cliff had only one more week. I wonder if this would even be possible in modern times. One thing is, when an intruder is detected, usually they are shut down. But there could be hackers exploiting zero-day vulnerabilities and investigators following their trail.
Chapter 12 - Cliff gives a short history of the Internet and its evolution from ARPANET. He compares the Internet to the highway traffic system - which works most of the time but has traffic jams, areas with short-term planning, etc. He finds the hacker attempting to access White Sands Missile Range (WSMR) and tells Roy who says that they should alert the authorities immediately. They call the FBI, who turn their backs again since millions of dollars or classified information is not involved. After a few tries, Cliff finally gets on a conference call with Special Agent Jim Christy of the AFOSI (Air Force Office of Special Investigations) and Major Steve Rudd of the Defense Communications Agency. Cliff calls White Sands also and finds out that they are connected to Anniston base that the hacker had logged in to earlier.
Loved this quote - “Like Einstein’s universe, most networks are finite but unbounded. There’s only a certain number of computers attached, yet you never quite reach the edge of the network. There’s always another computer down the line. Eventually, you’ll make a complete circuit and wind up back where you started.”
Also liked this quote that Cliff had attributed to Nancy Fischer - “To her , the Internet wasn’t just a collection of cables and software. It was a living creature, a brain with neurons extending around the world, into which ten thousand computer users breathed life every hour.” Wow!
—
Afterthoughts
Cliff’s quote “Just like genetic diversity, which prevents an epidemic from wiping out a whole species at once, diversity in software is a good thing” reminded me of the recent Crowdstrike issue1 where a bug in software update caused chaos with many airports, healthcare systems, financial companies not being able to operate due to windows terminals having a blue-screen-of-death. Is there software diversity now? Or has the industry consolidated in the decades past the Cuckoo’s Egg period? There are so many more companies and software fields now but for major things, there seems to have been consolidation - major mobile OSs are iOS and Android, major desktop OSs are Windows and macOS, major web browsers are Chrome and Edge, and so forth. So I’m not so sure. It seems like there are millions of different software tools but it also seems like there is a lot of consolidation. Something to think about.
https://www.computerweekly.com/feature/CrowdStrike-update-chaos-explained-What-you-need-to-know