On Thu, 28 Jul 2005, Daniel Weber wrote:

> I've seen a lot of classification schemes proposed on Bugtraq in the
> intervening years, some of them quite good. (Search the archives for
> "taxonomy" or "classification".) But unless they are -very- simple to
> use, they won't be taken up by the community. If you can come up with
> a single word that imputes the concept of "malicious data that I can
> easily get onto the victim's machine and in front of the victim's
> eyes but requires him to run it," that would be a great step forward.
>
> Simplicity is key. (Unlike this posting, which I did not have time
> to make shorter and simpler.)
>

(Apologies for the late reply, I've only just caught up on this thread)

Would that it were that simple. Then there would not be debates. You've
somewhat captured the intuitive idea with your long phrase, that being
that these exploits require user intervention of some fashion to succeed.
Were I to take a real world phrase and apply it to the cyber realm, the
closest that comes to mind is "booby trap", but this does not lend itself
well to conveying the consequences of triggering a trap. Nor do I like
applying classifications such as "remote to user" to exploits involving
user interaction, as this phrase does not distinguish between automated
attacks and those requiring user intervention, even though it does convey
some of the requirements and consequences of the attack.

Realistically, these types of attacks encompass multiple components such
as the delivery vector (e.g. webpage, email), level of user interaction
(e.g. regular use of program, clicking attachment) and consequences (e.g.
privileges obtained). A simple classification scheme along the lines of
"remote to root" is not well suited to conveying all these details. From a
modeling standpoint, breaking the attacks down into its components makes
sense, but that is not always as useful from a user standpoint. The user
might be more concerned about distinguishing exploits that can occur
during normal use from those which require more social engineering as the
former implies little to no user control over the risks (other than
patching when a patch is available of course). Academically however, these
might just be two branches rather far down on a taxonomy tree. So, I
suppose it has to be asked if we just want catchy phrases to impress upon
the user the severity of an issue so they patch or if we want an academic
classification scheme. The two aims do not always align.

Melissa

[ reply ]