E.T. phreak home

Man those dorks at the SETI project. You gotta wonder if they even did a threat model against the very adversies they are trying to find. They didn't even consider the fact that the Earth could be 0wned if E.T. decides to send malicious data to exploit the SETI clients that are running on the critical infrastructure around the world over the Internet. Or at least, that's what Richard Carrigan, a particle physicist at the US Fermi National Accelerator Laboratory in Illinois, thinks.

Today I saw this 'newsworthy' (*snicker*, must be a slow news day) drivel from a few different sources. First it hit Infosec News where a science correspondant discussed a report written by Mr. Carrigan entitled "Do potential Seti signals need to be decontaminated?". Dr Carrigan wants the SETI scientists to build safety features into their network to act as a quarantine so any potentially damaging signals can be trapped before they infect the internet.

What was more interesting to me though was a blog response by David Bianco on the matter. I think he sums it up elequantly when he states that:

The closest star is about 4.5 light years away from Earth. Assuming that we broadcast complete technical details of the x86 architecture and an entire copy of the Windows OS, along with a comprehensive set of security bulletins and an SDK, the necessary roundtrip time for data travelling at the speed of light would mean that by the time the "exploit" could arrive here, we'd be about 9 years further on. Let's see, 9 years ago, we'd all have been running NT 4 and Windows 95. Good luck trying a Win95 overflow on my XP system! The offsets are wrong now, and new security technologies exist now that weren't dreamed of then (like the non-executable stack). What will we have 9 years from now? I don't know (and neither do the aliens), but I do know the aliens don't stand a chance.

Security is about risk mitigation, not risk avoidance. Worrying about E.T. would be one of the last risks on my mind when I should more worry about the script kiddie that will use a vulnerability in one of those SETI clients to exploit the next nuclear power facility. Don't laugh... I've seen SETI clients in the most secure of places where they shouldn't be.

So stop the presses!! E.T. may be phreaking you soon!