The Cuckoo's Egg

by Clifford Stoll

Collect raw data and throw away the expected. What remains challenges your theories.

The daemons themselves are just programs that copy data from the outside world into the operating system—the eyes and ears of Unix. (The ancient Greek daemons were inferior divinities, midway between gods and men. In that sense, my daemons are midway between the god-like operating system and the world of terminals and disks.)

The cuckoo lays her eggs in other birds’ nests. She is a nesting parasite: some other bird will raise her young cuckoos. The survival of cuckoo chicks depends on the ignorance of other species.

The astronomer’s rule of thumb: if you don’t write it down, it didn’t happen.

IOTTMCO.” Intuitively obvious to the most casual observer.

everyone used the same version of the same operating system, a single security hole would let hackers into all the computers. Instead, there’s a multitude of operating systems: Berkeley Unix, AT&T Unix, DEC’s VMS, IBM’s TSO, VM, DOS, even Macintoshes and Ataris. This variety of software meant that no single attack could succeed against all systems. Just like genetic diversity, which prevents an epidemic from wiping out a whole species at once, diversity in software is a good thing.

“Our software is fragile as well—if people built houses the way we write programs, the first woodpecker would wipe out civilization.”

The hacker didn’t succeed through sophistication. Rather he poked at obvious places, trying to enter through unlocked doors. Persistence, not wizardry, let him through.

The NSA listens rather than talks.”

The place to booby-trap software is where it’s distributed. Slip a logic bomb into the development software; it’ll be copied along with the valid programs and shipped to the rest of the country. A year later, your treacherous code will infest hundreds of computers.

“Any system can be insecure. All you have to do is stupidly manage it.”

1. How was the penetrator tracked? 2. What auditing features exist? 3. How to audit someone with system-level privilege? 4. Supply technical details on how to penetrate computers. 5. How were passwords obtained for the Livermore Crays? 6. How were super-user privileges obtained? 7. Did the penetrator guard against detection?

That’s the problem with talking about security problems. If you describe how to make a pipe bomb, the next kid that finds some charcoal and saltpeter will become a terrorist. Yet if you suppress the information, people won’t know the danger.