Anthrax Letters

Are you a terrorist?

"You can't provide application-layer security at the transport layer, any more than Christopher Reeve can eat solid food!"

Quote:

Original post by ChaoticCanuck Personally I think it is as funny as hell, and communicates the danger fairly effectively, after all, there is no real way to detect the exploit without opening the TCP/IP packet payload, nor was there a way to detect anthrax in the existing postal system when that incident occurred. Too tacky? Too fresh in peoples minds?

Well, if you're going to show this to a lot of people I wouldn't be surprised if some got offended. It's still a relatively recent event. Then again, that goes for a lot of things.

BradDaBug: by the USA-DoJ standards, yes. That is why I will never transit the United States again in my life. Too many security researchers get screwed over because of things like DMCA or stupid little regional laws like the fact that having a book means I match a profile.

Sneftel:
Yes, but the problem is that managers need to be slapped around with it in a way that scares the hell out of them. The whole point of this is to impress managers with the idea that security failures in an organization are not technical failures, but human failures.

Over and above that, I intend to tell the managers that it is directly their faults for not putting in the effort required to understand the required security controls to protect thier assets. Expecting technologists to effectively communicate business requirements below the CSO level without support from management is bogus.

Perhaps talk about mailbombs instead of anthrax. All the scariness, with none of the Gitmo-DHS-Terror-Level-Orange nastiness.

mail bombs are usually packages, and further more there are a large number of technical controls that can be used to test for mail bombs. Testing for biomatter such as viruses or bacteria is much more difficult without the ability to inspect the object in detail.

Further more, the objective is to illustrate a payload that seems normal but contains a malicious payload; for example, a mail-bomb is very likely to be accidentally detonated, or potentially mis-fire. The reason the anthrax example appeals to me is because it is a close analog for a buffer overflow or sql injection. It is a completely inert object until some poor subject without the ability to resist attempts to do something with it.

Quote:

Original post by Sneftel "You can't provide application-layer security at the transport layer, any more than Christopher Reeve can eat solid food!"

I imagine he can't, since he's dead =) Anyways, for me, I wasn't too severely affected by it, so I would probably laugh. Dunno about others, though. I mean, if you make the joke at any time, you'll probably get an angry rant at some point. I think most people would take it with a sense of humor, though.

People died from those anthrax letters, so it's probably not a good idea - unless you want to have the potential to upset people. You might also attract attention from the Department of Homeland Security ... I know that sounds paranoid, but those guys are far more paranoid than me. They've investigated people for far less.