OK. So he isn't as handsome as Russell Crowe in The Insider, even as purposely messed up in
makeup, hair and clothes as Crowe was in that movie (but more on his acting ability, later). He doesn't have
the financial acumen of those testifying in Congress against Enron - though I'm not sure that is a
disadvantage these days. He doesn't even have the easily recognizable target for his revelations that the
classic whistleblower has. There is no specific government body or company - though some would dispute
this, he really is an equal opportunity whistleblower - for his disclosures to embarrass. But as with most
whistleblowers, he has a virtual target firmly planted on his back, and there is no shortage of potential verbal
shooters.
The whistleblower in question is Steve Gibson of Gibson Research (www.grc.com). His original
claims to fame were his breakthrough disk diagnostic and repair program, SpinRite, and the column he used
to write for InfoWorld. More recently, he has become known for security programs such as ShieldsUP! and
LeakTest, and especially for his outspoken manor, as he unhesitatingly reports the results of his security
research, regardless of whose toes he steps on - hence the target on his back.
Gibson made an appearance at an APCU (Association of Personal Computer Users - www.apcu.org)
at the Wilmette Public Library on Saturday, March 16, 2002. Luckily the APCU invited guests for the event,
so I was privileged to be able to attend the meeting.
I first encountered Gibson years ago at a distributor's trade show in which he acted out the parts of
the components of a disk drive in order to explain how SpinRite works. I'm not sure that even Russell Crowe
could have presented it better, and I'm sure that Crowe couldn't have written his own script.
Revealing security weaknesses in software has made him an anathema to development companies,
particularly Microsoft, which has attracted security-related complaints almost as if it was asking for them,
as well as the makers of personal firewall software. The extreme negative response that he has received for
his revelations seems to follow the old 80/20 rule, with 80% of the criticism coming from the point of view
of vested interests - from the vendors involved - and 20% sprouting from what seems like nothing less than
a massive attack of damaged egos - from various security analysts and experts.
The vendors want to destroy Gibson's reputation in order to diminish what they portray as his
"attacks" on them. The analysts and experts don't like someone horning in on their field who, at least on the
surface, lacks their "serious" credentials in security.
The news from the dark side is even worse, though it still follows the 80/20 rule. 80% of the hackers,
crackers, or whatever you want to call them, are angry because Gibson is trying to get people to take security
seriously, which would certainly reduce, if not eliminate their source of fun. The other 20% of them, in
different type of ego hit, are greatly offended that he revealed that there are libraries of mix and match kits
that allow them to create criminal programs (viruses, trojans, etc.) without any particular skill, thereby
robbing them of the "glory" of their exploits. (He calls these "Drag and Drop Viruses.)
The result of these offenses against the criminal element is an ongoing series of DOS (Denial of
Service) attacks on Gibson's Web site. Even as he began his speech for the APCU, he explained that word
had gotten out that he would be out of town and that his site was currently under attack. Without easy access
to his personal contacts within his ISP (Internet Service Provider), his staff back in the office couldn't
effectively ward off the attack.
Gibson was gracious enough to start of the day by participating in the open forum that preceded his
speech by supplying some of the answers to questions posed by the members. Naturally, some of the
questions drifted toward things like SpinRite and security.
In his speech, Gibson first talked about his early academic and personal history with electronics and
eventually, computers. Considering the high level of computer expertise among the APCU members, it was
obvious that the audience could relate to his background.
He made his distaste for the old saw "all software has bugs" quite clear, backing it with examples
of software that doesn't have bugs. Gibson obviously doesn't tolerate programming incompetence well.
He talked about his differentiation of the use of a PC as either toy or tool. As a toy, you could
download and experiment with every untested and potentially buggy or dangerous program you could find.
As a tool, you should lock down the PC as much as possible and only run software that you absolutely know
is reliable. (The audience contributed several Microsoft jokes at this point.)
Gibson also spoke of his doubts about Microsoft's security proclamations. In particular he noted the
declaration by a Microsoft representative that he knew that Windows XP was totally secure because they had
run it through a very thorough automated security testing routine and that the testing program had certified
the operating system as secure. This was shortly before the weekly (and seemingly unending) security hole
announcements about XP started coming through. (Oops!)
He feels that Windows 95 and its descendants were explicitly designed to overwhelmingly favor ease
of use (or at least Microsoft's definition of that term, which isn't necessarily what actual users think) over
security. While the two characteristics aren't absolutely diametrically opposed, one often precludes the other.
Gibson's final comment was about Microsoft's misguided attempt to defray what amounts to invalid
criticism about Windows lack of raw sockets capability (an obscure diagnostic tool that turns out to be
absolutely heaven-sent for hackers). Microsoft was told that Windows was wimpy because "real" operating
systems have that capability. That's nonsense! Microsoft reacted by adding raw sockets to Windows XP,
effectively, just to look cool - only they added it unprotected, while other operating systems restrict access
to administrators. We'll see how many millions of dollars companies and organizations lose over the next
few years in nearly untraceable DOS attacks facilitated by this added feature.
After that, Gibson headed home so he could get his Web site back up. Such is the life of a
whistleblower.
