[Music]
good morning everyone and welcome back
to
the talks for linux conference 2022
um it is first up this morning we have
casey schofler
who will be speaking about security
community expressed as too many venn
diagrams
and
i do enjoy a good venn diagram so i'm
pretty excited for this one
so casey chauffeur founded the smack
project in 2006 after an especially
heated debate with the se linux
developers on a topic now long forgotten
he has been developing secure operating
systems since the late 1980s starting
the system that became trusted solaris
and architecting trusted iris he was the
technical editor for the influential
posix p
103.1e
tc why did i leave that in for the
spoken one uh security draw standard he
is currently working on the linux
security module infrastructure so um
casey will be taking questions after the
talk if there is time left so um please
everybody if you've got questions for
casey during the talk
post them in the questions tab at the
top of the chat in venulis
note that your questions may not appear
right away because it is moderated i or
one of the other volunteers will approve
them
and then at the end of casey's talk at
this time i'll pass them on to casey so
thank you very much for speaking for us
today casey all over to you
thank you
um
my name is casey shelfler i've been
working in the
security community for some time i've
been developing kernels since the 1970s
i've been working in security as as we
mentioned since the the mid 80s and i'm
the author and maintainer for the smac
linux security module
so i want to put a little bit of context
in place for the talk today and
the first thing i want to talk about is
community now
you've heard a lot of talks so far
in the the conference about communities
uh and the technical definition of a
community is people with something in
common
but we really want to talk about
community
in terms of not only do the people have
something in common but they communicate
with each other about it
if you don't
communicate you don't really have
community
uh
next
thing tricky finger
computer security
a feeling of safety around and about
computers
there are lots of technologies involved
in computer security but it really is
about how you know security is how you
feel about it
and
the feeling of safety is
very important in a lot of aspects
and then the third thing is a venn
diagram
venn diagrams were invented in 1880
by john van and one wonders how people
described
relationships between sets of things
before they had venn diagrams now the
other thing the venn diagrams have
actually
been very useful for is that
it introduced the concept of
visualizing
data and
it's been
we look at it now it's like well of
course it's simple it's obvious but this
is a very new thing not that long ago
1880 was not yet not prehistoric times
so we're going to start off with a story
i like stories so this story is about
the birth of a community
and it takes place or at least it starts
in europe in the middle of the 20th
century
at that time right around 1944
the most prominent people
given that the
the world was essentially at war
there were soldiers politicians spies
and and there were mathematicians who
you might not normally think in in terms
of
being the same august uh entities as
these
other groups but we'll just describe
that a little bit now
among the politicians there were also um
some
some of the
members of politicians but there were
also spies who were politicians and
there were soldiers who were politicians
uh
some and there were some politicians who
were acting as soldiers as well so
there was some overlap
the set of people who were politicians
include some soldiers and some spies
well
on the other side of the diagram here we
have the mathematicians and
in the mathematicians there's a subset
who are the cryptographers
now the cryptographers are very
specialized mathematicians and they
specialize
in
numerical
methods to obscure data and make it
difficult for somebody who you don't
want to read it to look at it
uh cryptographers are very very
important in in this in this time
because
um
cryptography is a munition or used as he
used as a component of warfare
and there's a lot of warfare going on so
you need so you have have a good amount
of cryptography and some of the
cryptographers were actually soldiers
and
some soldiers were drafted into
cryptography if they showed a
mathematical bent
and all part of this whole global
brouhaha that's going on
and of course you always have spies and
spies are you know some of your soldiers
are spy some your spies are soldiers
even have spies where politicians
uh
politicians don't like to think about
that very much but it
it does occur so
we have this this special group of
cryptographers working um in the
military
for military purposes uh
lots of information that goes on
among in between soldiers you don't want
your opponents to see or even your
politicians sometimes
so we have this this group here
which are
the military intelligence community or
at the time they would call that the
security community
now about this time
there's a major development
that actually has
has a
very important impact on
the development of
of the world that we live in right now
and that is that the cryptographers
started making machines to help them
with their
cryptography uh the famous enigma device
that the uh
the german
army used to transmit information was an
example of a mechanical one
but code breakers started to create
machines that would actually help them
break codes
that were being used to protect
information
and these are the first actual
serious users of what we would call
today a computer
so
what that's saying is that the computer
the computer community began in the
security community
maybe not what a lot of people want to
hear but
very very important
to the the advance of the security
community and the computer community
so just a little bit later getting to
about 1950.
um
we have our cryptographers they're using
their their computers uh to do their
their cryptographic uh
encoding decoding
but we also have a bunch of people who
are
experimenting with digital electronics
analog electronics have been a lot been
around for quite some time radio signals
morse code voice signals even primitive
television
not say that it ever got over being
primitive but um
are these are people who are doing
research into what you can use digital
electronics for
and
they discovered that one of the things
you can use digital electronics for is
calculations
and they're getting all excited about
this because now they can do
calculations
much faster than they've ever been able
to do them before if you've ever seen a
picture of a babbage engine
which was a calculating machine the
intricacy of
the mechanics of that are prohibitive in
in a mass kind of production but with
the electronic one they could do their
digital uh computations and everything
this was really great
well of course you can't do this under
under government funded grants at a
university
uh without the cryptographers
noticing it and saying hey you know we
can
replace some of our analog
mechanical devices with electronics and
we'll bring these people into our
community
so now we have a an expanding
cryptographic community
that includes
includes digital electronic as well as
their mechanical things and
the community is all all very happy um
and this is about the state of this of
the the computer community
until about 1955
in 1955 ibm introduced the series 700
which was the first
commercially viable and commercially
accepted
electronic computer
and
all of a sudden we had this enormous
community computer community and only a
so a small subset of it was the
cryptographers
and at this point in time
what one of the most important things
about
security and about computers
is that
security means cryptography in the
computer world
because that
is the
derivation so where it all came from
anytime you're talking about security in
the computer world you're talking about
cryptography it's not like you've got a
bunch of people sh well what you've got
yeah and up until about 16 1969 what
you've got is a bunch of isolated
computers
com the community involved is
sharing
stories about how their computer
failed or how they come up with a new
program
uh but there's a little bit of
communication some articles and some in
in journals
but really it's pretty well isolated
uh
there's not a lot of communication
between computer users um these are
expensive device again they're expensive
advice devices
and they're not being and it
is a privilege to be able to you
actually use one
and then in 1969
they introduced arpanet
arpanet was the first major computer
network
uh
it allowed
department of def
amer u.s department of defense
contractors and
grant especially grant holders
to exchange information
and to provide that information make
that information readily available to
the funding government agencies
and this was
a major advance because instead of
computing in isolation you collaboration
was now actually something you could do
electronically
now what what was important to the
arpanet though it's like you know
arpanet's is kind of a new thing well
consider that the backbone of the
arpanet
was 56 kilobits
uh
and
that
if you're trying okay 60 50 kilobits
that's about the same speed as the dsl
line that i'm giving this presentation
over
uh
and
to connect to the arpanet you would call
it on the phone
and that might mean a rotary dial
and you could get anywhere from
in 300 to 9600 bits per second on the
phone line
between your computer and the backbone
and you are paying polls for the
telephone calls
now
in 1969
phone calls were not cheap
you know we think of phone calls now as
being essentially free
there weren't they actually cost real
money and you had to do real accounting
on on that
so
what
what really was important to the arpanet
and to making the arpa network
successfully
was speed
you had to have
fast data communications you had to do
everything you possibly could to get the
bits from your machine to the arpanet as
quickly as possible so you could hang up
and save some money
and
so in support of this they the internet
protocol was was developed a five-layer
stack
uh with application applications at the
top and hardware at the bottom and
several
interesting
divisions in the middle
it was
optimized to make this trend make this
um the process of getting the
information from here to there as fast
as it as the hardware
would allow it to do
now
security as again security talk right
well
you had a private government network
you weren't allowed to use the arpanet
unless you had a dod department of
defense
contract that you were
that you were
supporting
you had unique identifiers you were
calling it on the telephone your
telephone number was available if
if
your telephone number was available
um and the internet protocol is re as
originally conceived you bought
your internet your ip address
you paid money for it
and it could be tracked back to you
all right
and because we're security and security
means encryption we're going to bolt
we have mechanisms to bolt encryption
on the bottom so
if you want to hook up your device to
another device you can put a
cryptographic
encoder between them
if you want your your application to
talk to the other application on the end
or if you want to do authentication you
do that up at the top of the application
layer and
the stack isn't impacted by it it's you
know perfect completely your choice
and that works just great
yeah every yeah
it's policed it's maintained and
everybody's happy right and the people
who again the people who are not
supposed to be on the airplane people
who don't have any have business being
there
aren't allowed on
well sometime around 1982 and
exactly when will
when that occurred will vary depending
on exactly who you talk to
the arpanet morphed into the internet
now the internet
[Music]
has a higher speed backplane
backbone
very different mechanisms to communicate
to it
um
but it's available to everybody
so the security aspects of the internet
a little bit different from our banette
first off it's not a private government
network everybody's allowed on there's
nobody policing it
your unique identifiers well in order to
provide
access to
to the general public and
lower cost
institutions
you're not calling
into the backbone you're calling into an
internet service provider who's actually
connected up to the backbone
and they don't want to to
pay for all these
internet addresses that they're that
they would have to so they've
implemented protocols that cheat
so that they can actually
use one internet address
to get to the isp and then
lie about things going out to the the
individual users
so you've lost also that but
the bolt-on encryption is still there
so if you want to have encrypted
communications between your machine and
the and your internet service provider
you can still do that
uh nobody's doing it though
um
and you're you can do encryption in your
applications although that does make it
difficult to be
make them generally available
so
okay the security story is
not really very very clean here
and what did this lead to
well
um first first thing it led to was the
cuckoo's egg
cliff stole
an astronomer
who had
was working as a system administrator
was assigned the task of finding the bug
in the accounting software because they
were always like three or four cents off
and after about a year's work it turned
out that what was really going on is
this the accounting software was just
fine
it's just that there was somebody out on
the internet
who was
contacting their mach their machines
and using them for other purposes to
which they weren't authorized
and it was difficult to track them now
because
again there's nobody policing it and
there really
isn't any way to just easily tell where
things are coming from
so
that was that was the first thing here
then the next thing that came along
um was the morris worm
more mr morris
happened to have a little program it was
supposed to self-replicate slowly and
see if it could find other places to go
and
um
you know
replicate itself on other computers and
then find it information about where i
might go from there and do the same and
just kind of slowly
um take over the entire world well there
was a bug in the program
there was a bug in the in the rate
limiting that it that it was supposed to
be doing and as a result pulling it
ended up just about everywhere
now
how did this come about
well
uh probably the big reason is that
um
without any kind of
identification of who's using the using
the network where things are coming or
who who it's coming from
you first off you well you have an
activity which is
touted as a very good thing
but at the same time you don't have
responsibility which is not such a good
thing and that led to our people
initially we called them crackers and
then they got called hackers because
people who could who it was assumed the
people who were clever using computers
we're going to be doing bad things
uh this rolled into the term black hat
as opposed to the
from the western movies the
the bad guys always were the black hats
the good guys were the white hats uh
currently i think we're
pretty well uh
using the term bad actor to
identify this this individual
but the reality is we
because you can't track them down
and you don't know where they are
they're everywhere
all right so
we have this horrible state of of things
on on the internet here where um
security is just kind of out of control
but fortunately um
there are still people who are who are
looking at security from a slightly
different angle
and that's the angle of access control
access control um
is starting to become more at this time
starting to become more and more of an
issue
because you've got people sharing big
expensive machines
and
more and more people are getting access
because more and more people are
figuring out fun things to do with
computers
uh and in some cases people are using
sensitive information uh
best example of this i know of is
a site where they're do using super
computer to do weather forecasting
and
weather forecasting is
generally safe information for people to
have
but it can be very sensitive if
if your navy for example
is doing weather forecasts on a
particular location because that might
give
some of your adversaries information
about
where that navy might be performing you
know might be having
maneuvers or might be planning to
to do an invasion
any of a number of things so
there's sensitivity there
and again computers are still expensive
at that point
and so you've got
people sharing them so you want to have
some access control
involved
now of course
the people are looking at access control
are going to look at the state of the
art of security at that point
and state of the art is what's in
arpanet which is to both secure both
cryptography on the side
because i remember at this point we're
still thinking that um
[Music]
security means cryptography
now you want to make it optional because
in a lot a lot of cases
you don't really need this if we've got
one person using the computer you don't
need the access control if you've got 10
people you probably do
and you want to hope nobody notices
which is
just kind of another way of saying you
don't want it to have a lot of
significant impact on the performance of
of the system
or the usability of the system so the
obvious um if you want to do a security
feature the obvious thing to do is
you're going to bolt access control on
the side rather than cryptography and
then
do the other other things right so
uh
does this work
well
of course we're going to bring our
security people there's our
cryptographers in and ask them how we're
going to do this oh
sorry sorry
so and there are a variety of things
oh boy
oh yeah i got a hit you know what i got
ahead of myself here i'm sorry okay so
and we're gonna
because there are different ways people
are going to want to use computers we're
going to use different kinds of access
control policies we're going to make
them discretionary where you can decide
who gets to look at your data you can
make a mandatory where you don't get to
decide it's based on what clearances you
might have uh we're going to define that
you need privileges to override the
policy and we're going to do do
something a little bit different this is
something that hasn't been done before
and that is we're going to ask for
assurance
that your system actually works the way
you say it does now why are we going to
going to start doing this we're going to
start doing this
because computer companies are notorious
for saying for saying oh yes our
computer does that
even when it doesn't so
the people in the government are
starting to say fine
these are the kinds of things we want
you to do in order to prove to
demonstrate to us
that your secure system actually will
will
protect
the
the data that we've
that we consider to be sensitive
and so assurance let us
let immediately to the the notion of
process-based assurance
process-based assurance which was
manifest in the capability maturity
model just
simply says that
because
you can tell us good things about how it
is you go about developing your code and
verifying your code
[Music]
we're going to trust you
relatively straightforward but um but a
lot of people really grabbed onto this
and ran with it so we had this community
of
assurance and process management
people
which led to another community
which is the agile programming community
where after several years of dealing
with
the government
inspired notions of
how you should be doing software
development
there's a rebellion
kind of an anti-community a
we don't want to be part of the
uh
classical assurance community we want to
do things differently we want to do
things our way we want to
you know we want to interact with each
other we don't want to write big big
hairy documentation we just want to make
sure that the code works
so
as a result of
the the
the security community coming up with
process
in excess
the
develop
another part of the development
community rebelled and created this
other community which is the agile
programming community and
that's why it's like
we're talking about community here after
all
um
so back to access control you called in
the cryptographers and said all right
how are we going to do this you know we
want to separate this information uh
we want to make it easy for people to
use the computers and have
have their information safe from each
other
and the cryptographer said well we've
got a few issues here the first one is
that a lot of information is born
sensitive
if somebody comes up with a new idea on
how to make
nuclear weapons explode faster and
brighter
uh governments generally want that
information to be held very secretive
but you don't think and you can't write
in
in encrypted form you have to have the
data before you can encrypt it and if
you have the data and it's not encrypted
so that it can be encrypted then it's
accessible and you've failed your access
control
um and then once
once you've encrypted it you can't use
it until you decrypt it and there are of
course
exceptions to this
and cryptography is expensive
it
um
you want to use the most expensive
cryptography you can afford to
because your adversary is going to apply
as much resources they can to break it
so if you don't spend more money
encrypting
your
your data
then your adversary is willing to spend
to decrypt it you lose
so that wasn't going to work
so what was going to work well
we're going to have to have put access
control in in the scope and in the
context of an operating system
or a computer system in the in whole and
you've got file systems and memory
management enterprise communication and
you've got device drivers and you've got
all kinds of other interesting
networking all kinds of other
interesting aspects of the system that
you're going to have to do something
with
no simple solution
okay well how are we going to go about
doing this because when you actually
look at how much it's going to be you're
going to have to be be touching
virtually every aspect of your system
so first thing you're going to do of
course you're going to call in your
cryptographers because they're your
security people and
although they can't actually help
directly very very much oh
yeah some in some
minor minor areas
um
but they're not going to be able to make
the whole thing oracle the next thing
you need somebody to come and make it
give you a security model so you can
tell whether you've actually implemented
something or not
you're going to get some system
developers and what actually happened in
in the
1980s
a lot of the computer vendors went to
their development groups and said hey
who wants to work on this
and the senior people said uh i don't
want to work on that
that's scary um
and so an awful lot of
younger less experienced developers
stood up and said this is an opportunity
for me to actually make an impact i'm
going to
going to go for this this sounds like a
really good idea
the government wanted to see a lot see a
lot of validation done
uh so if you're going to add a whole lot
of new new security features you're
going to need some validators to do it
and then the question went out well
who knows about yeah who's been working
with this who's been working with
with
these kind of secure security things
who's got experience with
um
looking at
the systems from the viewpoint of the
people who are going to be breaking into
it well
are bad actors we're going to pull them
in too
um
because they know a lot of stuff about
this
that the rest of us don't and especially
we're junior a lot of junior people here
we need need some guidance
um
they also brought in the system
administrators because everybody
realized that these are these were the
poor assads who were going to actually
have to make these things work
in the real world and they're gonna have
yeah they've been
they've been uh fighting with the bad
actors for a long time so let's bring
some of them in too
and we've got these weird people called
the virus i'm calling the virus hunters
because throughout this whole thing
you've got
people inspired by the morris worm who
are putting bits of code out onto onto
the internet
that are gathering information and
sending it back to
back to a common place and gathering
information like credit card numbers and
the like and so you've got this whole
industry this that's popped up
that's doing nothing but tracking down
bad
bad stuff out on the internet now it
turns out
that
um
well
okay so
that was about so we've got all these
people well it turns out
um that uh there's a considerable amount
of overlap between the people who are
bad actors and the people who are system
administrators
uh at the very least from the community
standpoint
they they share a common interest which
is using systems to which you do not you
do not have necessarily have legitimate
access or defining how to keep how to
identify people who have legitimate
access so there's there's a significant
overlap there now the virus hunters
there
there was at least one company who i i
won't mention by name
that was notorious for
finding viruses
30 days after um
after
well
their antivirus found viruses almost
exactly 30 days after they they were
introduced into
into the marketplace or into add onto
the internet so there's a lot of
speculation they were writing the
viruses putting them out
um and then discovering them and
charging people for the for the
privilege so
yeah there was a little bit of bad
acting going on there
and then of course our system developers
and our validators
started working with the bad actors
because they
they're able to see
how much
knowledge there was how much innovation
there was
and
to be honest if you want to actually
you know
yes
understand and make sure that what
you're doing is actually going to work
you want to make sure that the people
who
are good at breaking it
are involved and so that you can
actually get them stumped
one of the the bright spots on this
though
is one of the techniques that that the
bad actors have been using
for a long time to to break into to
figure out how to break into something
called fuzz testing
all validators
are starting to are looking at this and
going wait a second we can use that to
test all kinds of things not just
whether you can you know whether there's
a stack overflow in here i can use that
just kind of to to wang it you know to
to bang at the system
and see what else breaks well now we're
using fuzz testing to define just about
everything
but as it turns out from the again from
the standpoint of the community
what we find in here is yeah who really
is the linchpin you know who really is
the the
the binding force between
within the security community
well it turns out it's the bad actor
the bad the bad actor is the heart of
the community in that that is the it's
the commonalities it's that which
which brings it together
we would like that not to be the case we
would like
there to be
a more positive message there but the
reality is this is where
the community
actually
comes together
now i'm going to going to uh
to pop off onto another another little
added note here this is one of my
favorite
government intervention things
community issues why is it that the
linux community in particular is so so
aggressively global
well one of the reasons why
was that early on in the
the linux world
the us
had very strict laws about cryptography
and the exportation of cryptographic
algorithms
and
it's applied even to open source so
um technically if you
had some cryptographic uh
algorithms
and you shared them with somebody who
was
uh not a u.s citizen not authorized to
see them you could go to jail now this
is true whether you were an american
citizen or not
so
there was a lot of concern among
european developers especially crypto
developers of crypt cryptography
who were starting to make them available
open source
i make it open source
i go to america
and i read my paper and they arrest me
hmm not a good idea
so
that led to
one of the earliest uh
major
events in
the lynx world was the autolytics
symposium
it was very accessible to people in the
u.s but it was also accessible to people
outside the world and this was a very
this was a globalization
it
took
american leadership
out of the equation made
it had to be global
because in order to actually
get the people who were involved to
participate you couldn't do it in the
u.s
now
i promise some predictions in my my
abstract and so i should probably
actually uh make a few okay my first
predict prediction is that the security
community will make will remain
fractious and diverse
there are a lot of things that people
consider security it's a lot of things
people consider important
and
we still have the bad actors out there
we have corporate bad act we have
companies that do nothing but try to
break other people's systems
both officially and and not officially
and
all kinds of ideas as to how security
should be done
because the computer i'm presenting on
now is
20 20 000 times faster
than
the vax 1178 than than the machines that
were being used at the time of the
morris worm
the security community's issues will
continue to be user experience
making a delightful user experience for
computer security
hasn't been achieved yet
it's one of my my goals somehow my
dreams but we'll see
performance is always going to be a
problem because
everybody knows that security makes
things slower
whether that's true or not and new
technologies
when we go to yeah
when somebody introduces tri-state
memory um
how are we going to have row
sledgehammer are we going to have row
steam hammer what kind are we going to
have what kind of problems are we going
to have with that
people introduce new technologies all
the time without
doing serious consideration of the
security implications
okay and finally there's a whole lot of
things i
couldn't get to today
containers virtualization static
analysis
back porting supply chain artificial
intelligence and privacy
artificial intelligence and privacy are
a wonderful combination
we could talk talk for days about that
and a whole bunch of other things that
i'm just sorry i couldn't get to today
but anyway thank you very much um i
think i might have actually have a time
for a question or two
betsy just don't mute you mike right
it's gonna happen i did it once
yesterday i did it again today okay so
we do have a few questions we probably
only have time for one maybe two um
so the current top voted question is
what's the suggestion to the software
testers how should we validate security
software
how to revalidate
how should we validate security software
we should read the documentation
and
read the
first off get the documentation if it
hasn't been written hit people very
hit people very um
lovingly but not but firmly
to get the documentation
and then
when you have that documentation as to
how it's supposed to work then you can
decide whether or not it does work
fair
uh docs are critical
all right so
we've got a question that received an
awful lot of votes very quickly
what do you feel is the biggest draw for
bad actors these days and it's my
current approach
money is
yeah okay makes the world go around hey
um and
the second part of the question is is
the current approach of bug bounties
enough to combat those attractions bug
bat bounties are a really bad idea
bug batty bug bounties um encourage
people
to
do two things first off they encourage
people to go looking for things
and if they can't make enough money have
if they find something and they can't
make enough make a significant amount of
money exploiting it
uh then they can make some money
on a bug bounty the problem with bug
bounties is that
they encourage people
to
be sneaky
rather than
i would much rather have people say
i don't wanna
i don't want you to i'm not gonna pay
you for a bug i'm gonna pay you for a
patch to fix the bug
that makes sense
that that makes sense
reward the actual improvement that's
correct
okay
so we are out of time casey um thanks so
much i know the audience appreciated
your talk uh and your beautiful diagrams
and illustrations
um so
there were still a few questions left um
in there are you happy to head over um
to the post talk text chat i will do
that right now excellent so the
volunteer team will copy the questions
over to the post talk chat kaya theatre
channel in venulis uh thank you very
much casey um we now have a very short
break everyone and we'll be back in 10
minutes
bye