Silence on the Wire
Michal Zalewski
Editor
William Pollock
Copyright © 2005
All rights reserved. No part of this work may be reproduced or transmitted in any form or by any
means, electronic or mechanical, including photocopying, recording, or by any information storage or
retrieval system, without the prior written permission of the copyright owner and the publisher.
No Starch Press and the No Starch Press logo are registered trademarks of No Starch Press, Inc. Other
product and company names mentioned herein may be the trademarks of their respective owners.
Rather than use a trademark symbol with every occurrence of a trademarked name, we are using the
names only in an editorial fashion and to the benefit of the trademark owner, with no intention of
infringement of the trademark.
The information in this book is distributed on an “As Is” basis, without warranty. While every
precaution has been taken in the preparation of this work, neither the author nor No Starch Press, Inc.
shall have any liability to any person or entity with respect to any loss or damage caused or alleged to
be caused directly or indirectly by the information contained in it.
No Starch Press
DEDICATION
For Maja
Foreword
What does it take to write a novel book on computer security? Or rather, what
does it take to write a novel on modern computing?
A young yet highly experienced author with talents in many areas including
many aspects of computing, mathematics, and electronics (and perhaps a
hobby in robotics), as well as other seemingly unrelated interests (including,
let’s say, fatalistic erotic photography), and indeed with a talent and desire to
write.
Once upon a time in a dark and largely unexplored forest, the magic chemistry of (brain cell) trees
gave birth to a bit of information, only to let him sail his way down a quick river, into the vast sea (of
the Internet), and ultimately find his new home, grave, or maybe a place in a museum.
And so the tale begins. Whether our little bit is good or evil, at a young age he will reach the stream
flowing into a shiny castle made out of white-colored foil (yet regarded by many as a black box). He
will pass through the entrance and approach the counter to check in. If he weren’t so naive and short-
sighted, he could notice a group of evil-looking bits staring at the counter from a distance, taking note
of the time bits check in and out; he would have no choice but to proceed to sign in, though.
Once rested, our hero might be asked to team up with his siblings or to join a group of other bits and
bitesses, and together they would pack their bodies tightly onto a used inflatable boat. A careful bit
could notice bits of garbage (or is that garbage?) in the boat, presumably left by a previous group.
Observing the traffic lights and squeezing through traffic jams, our bits enter a safe harbor and sail to
the wharf. Will they be seen from nearby castles and lighthouses? Will someone track the traffic light
switches to determine just when our group sailed? Will someone turn on lights at the wharf and take
pictures? Will those other evil bits assume the identity of ours and sail away to the sea first? Our bits
wouldn’t know.
And so they change boats at the wharf and sail to the sea . . . The journey of our pet bits proceeds,
with many dangers yet to come.
No, Michal’s book does not hide technical detail behind a fairy tale as I have
above. Rather, while a very entertaining read, it gets all the facts straight and
promptly gives answers to most challenges introduced at the beginning of
each chapter.
Silence on the Wire is unique in many aspects, but two stand out: First, it
provides in-depth coverage of almost all essential stages of data processing
that enable today’s “internetworking”—from a keypress to the intended end
result of that keypress. Second, it outlines the largely overlooked, under-
researched, and inherent security issues associated with each stage of
networking and with the process as a whole. The security issues covered
serve well to demonstrate the art of vulnerability research from both the
attacker’s and the defender’s perspective, and will encourage further research
on the part of the reader.
Clearly, a computer security book can’t be comprehensive. In SotW, Michal
has provocatively chosen to leave out all the well known yet highly
dangerous and widespread vulnerabilities and attacks being discussed and
worked on today by most in the information security community. He will
teach you about subtle keystroke timing attacks, but you will not be reminded
that “trojan horse” software with key logging capabilities is currently both
more common and easier to use than any of such attacks could ever be.
Why mention keystroke timings while leaving the trojans out? Because
timing attacks are largely underappreciated and misunderstood even by
information security professionals, whereas trojans are a widely known and
obvious threat. Vulnerability to timing attacks is a property of the design of
many components involved, whereas to implant a trojan requires either a
software bug or an end-user error.
Similarly, and with few exceptions, you won’t find the slightest mention in
SotW of the widely exploited software bugs—or even generic software bug
classes such as “buffer overflows.” If you are not already familiar with the
common computer security threats and would like to gain that knowledge,
you will need to accompany yourself on your journey through this book with
the perusal of less exciting material available on the Internet and in other
books, and in particular with material pertaining to the specific operating
systems that you use.
Why study silence, you may wonder—isn’t that a nothing? Yes, in a sense. A
zero is a nothing in that sense, too. But it is also a number, a concept we
cannot really understand the world without.
Enjoy the silence—the best you can.
Alexander Peslyak
Founder and CTO
Openwall, Inc.
better known as
Solar Designer
Openwall Project leader
January 2005
