Tuesday, June 03, 2008

Integrity

One thing that continually amazes me about Hollywood, I guess about their writers, is that they sometimes choose the most idiotic, but convenient plot devices because it saves them the effort of actually thinking about something.  In this case what I am talking about is the infamous "back door". 

You know what I'm talking about:  a hacker mysteriously manages to access a top secret application through a simple userid and password that he hard coded into the application when he built five years ago.  You can imagine the sort of code that he put into the application:

if userid = "Fred" and password = "flintstone" then
access = "SuperAdmin"
endif

The trouble is most access systems work this way.  Any access system for a top secret application is not going to use something that the programmer wrote because they want it to be more secure than what they're paying this guy who is later going to hack into their system.

But the thing that annoys me most is the idea that this is commonplace in the IT industry.  I have never written such code for a production application, neither do I know of anyone who has written such code.  I've been involved with systems that dealt with hundreds of millions of dollars in payments, yet there were no secret back doors into the system.  I am annoyed by the fact that Hollywood, and the image they present of the IT industry, is that of a bunch of cowboys with no integrity.  Why don't they show social engineering in action?

Hacker: Excuse me, ma'am, but I'm from the IT department and we've noticed that there is a problem with your ID.  Could you please tell me your password and when we've resolved the problem we'll reset your password and you can go back to your job.

Social engineering is by far the easiest way to gain access to a system because people fall for the lines quite easily.  If you don't believe me just look around and you'll see stories about hundreds, thousands of people who have fallen for the Nigerian 419 scam.  So instead of showing how innocent people can be easily duped they decide to show that the bad guy was evil long before the movie started.  Yeah, like I'm evil.

No comments: