I'm rereading The Cuckoo's Egg by Cliff Stoll (1989) as one of my sources for a research paper to complete in an Intro: History of Science & Technology course. It's one of my favourite books as it encapsulates many challenges of security, while outlining the astrophysical, and scientific approach to research.

Book: https://www.simonandschuster.ca/books/The-Cuckoos-Egg/Cliff-Stoll/9781668048160

TL;DR

Book Summary

The Cuckoo's Egg details how the Stoll, while trying to track down a 75-cent accounting discrepancy, ended up chasing down a cyber espionage hacker by treating it as a research project. As Stoll is an astrophysicist, he recorded each event in a logbook, questioned "but how could this happen..." from a physical systems perspective, and tested his hypothesis along the way. He weaves in his personal life to give a voice to the various ethical, and legal challenges he wrestles with regarding citizen privacy, security, and trusting authorities.

Echos Of Present Challenges

The book brings up the topics relevant today, that can make you incredibly sad still exist 35 years later.

  • operating system security defaults are shipped disabled, and up to the users to

  • hackers going unnoticed in environments

  • brute force login attempts

  • default username/passwords never being changed

  • arrogance that security practices are so high that there's no way to be breached, and therefore refusing to ask "what if.."

  • silo'd organizations provide methods of detection being ineffective (e.g. long-distance phone call charges, to shadow IT concerns of oversight)

  • home computers not having passwords; this is something that many people are struggling with the change

  • "I have nothing worth hacking" mentality that allows hackers to bypass geofencing by targeting small businesses

  • general population securing physical assets more than their digital privacy and documents.

  • the digital space isn't the same as geographic space; laws require international collaboration for enforcement.

  • building computer algorithms and models for sifting through large data sets.

  • Inherit trust in system calls and inter-system access

  • Concerns that the NSA allows vulnerabilities to be in the wild for exploitation under the assumption that only they know the vulnerability

Topics I Love

Since I love physical systems, talk to people about security, and study astrophysics there are some topics dear to my heart in this book.

Physical Systems

Physical systems is something I spend a lot of time discussing when it comes to IT. The main consequences of physical systems are:

  • propagation: nothing happens instantaneously. Stoll uses this do estimate distance to the hacker. Many of my conversations are centred around immediate action, and how that's impossible (infiltration -> ransomware, detection, etc.)

  • uncertainty: you will never have 100% certainty. Forget it. Stop making this a target. Instead, what can you do to increase your certainty, and what tradeoffs exist? (e.g. snapshot scan targets more frequently or gather logs and spend compute time/resources on correlation, etc.)

Trust, Ethics and Authority

Stoll highlights the different perspectives towards individual privacy rights and digital systems.

  • He wonders if monitoring individuals on computers is an invasion of privacy, but also notes that the super user of the computer has full access to the files of all users.

  • He has concerns with trusting government officials, and realizes that they are mostly other human beings. This clashes with his ideological environment that is very distrustful of government agencies.

  • He details discussions with others who understand the success of the computer network depends on user trust. People have to trust the system integrity to use the system. Hackers break that trust relationship.

Research-Focus

The idea to keep an open mind and focus on research is always refreshing. You can go back through the logbook and data with different hypothesis as new questions or challenges to your initial assumptions arrive.

  • You don't know where research will take you, but stay open and keep wondering.

  • I have "I Wonder..!" from Blippy Wonders (TV; 2021-2023) in my head; always question how could something happen rather than dismissing it.

  • Keep a logbook for my local lab so I remember what I was doing alter!

AI: Hilarious Historical Note

While discussing the hacker going through the Berkley lab, Stoll notes that accessing the artificial intelligence area wasn't very exciting because artificial intelligence was "archaic".

For those who want a decent overview of the history of artificial intelligence and a reflection of our understanding of human intelligence evolution, I recommend A Brief History of Intelligence by Max Bennet (2023).

Book: https://www.harpercollins.ca/9780063286375/a-brief-history-of-intelligence/