2009-02-22
Internet scale security: the impact of cheapness
Ten years ago or so, mass login and password guessing attacks were essentially a non-issue; old news, an attack whose time had passed not only because everyone knew how to counter them but because they had such a low payoff that no one bothered doing the tedious work (and if someone did, you pitied them).
Then the Internet happened and everything changed. Suddenly mass password guessing attacks were not a theoretical issue; instead, they were cluttering up your logs every day. This happened not because mass password guessing had gotten any more effective and successful, but because the Internet had made it dirt cheap. If you were a cracker with a bunch of compromised machines that you weren't doing anything particularly important with, starting up a brute force ssh scanner cost you essentially nothing and might get you a nice payoff.
Or in short: cheapness makes low-probability and even low-payoff mass attacks worthwhile, and the Internet has delivered cheap computing to attackers. These days, lots of cheap computing.
(In the larger scale of things, this is nothing new; probably everyone has heard the stories of bank frauds that involved taking the fractional cents on various interest payments, known as salami slicing.)
This means that you need to design security differently when you are designing a system on the Internet. At Internet scale, computing is cheap and readily available, and attacks are almost certainly cheap to mount; either they can be automated or they can be contracted out to low-wage places, making all sorts of things feasible that would normally be too much effort if done by hand by the primary attacker. And as we've seen with spam, if you can be exploited, sooner or later you will be; obscurity is not a defense if you have something that attackers want.
(One corollary is that you need to worry about even low-payoff attacks if they can be done against you in mass, and they probably can be. See, for example, this.)