WISE GEN and The IT WISE GEN and The IT Revolution*Revolution*Prof. Kamakoti, IIT MadrasProf. Kamakoti, IIT Madras

*All characters and entities in this presentation are imaginary.

TTT: Buy a Photocopy TTT: Buy a Photocopy MachineMachine

TTT Releases a TenderTTT Releases a Tender

StatementStatement Quotations invited for Quotations invited for

Photocopy machines Photocopy machines with speed at least 60 with speed at least 60 copies per minute, copies per minute, duplex, at least three duplex, at least three year warranty, year warranty, discounted cartridge discounted cartridge cost, ethernet-Wifi-USB cost, ethernet-Wifi-USB interface. interface.

Quotations ReceivedQuotations Received

Vendor Name Description of Item

Cost Remarks

ABC Ltd. 60 pages per minute, duplex, 3 year warranty

Rs. 1,50,000 2 extra Cartridges free

DEF Ltd. 60 pages per minute, duplex, 3 year warranty

Rs. 1,76,000 Ten extra cartridges free

GHI Ltd. 60 pages per minute, duplex, 3 year warranty

Rs. 1,80,000 Twelve Cartridges extra

JKL Ltd. 60 pages per minute, duplex, 3 year warranty

Rs. 1,30,000 Replace cartridge every 15 days for next 3 years

Tender OpeningTender Opening

The Purchase CommitteeThe Purchase Committee Technical committee Technical committee – –

Machine is an elephant – Machine is an elephant – cartridge is the food to it. cartridge is the food to it. The latter costs heavily.The latter costs heavily.

Finance Committee Finance Committee – – Recurring expenditure is Recurring expenditure is very high and we have to very high and we have to somehow bring it under somehow bring it under control.control.

An Oldy: DEF is servicing us An Oldy: DEF is servicing us for last two decades, very for last two decades, very reliable, can we consider?reliable, can we consider?

An youngy: What is there to An youngy: What is there to service in a photocopy service in a photocopy Machine? Use your common Machine? Use your common sense.sense.

Vendor Name

Description of Item

Cost Remarks

ABC Ltd. 60 pages per minute, duplex, 3 year warranty

Rs. 1,50,000

2 extra Cartridges free

DEF Ltd. 60 pages per minute, duplex, 3 year warranty

Rs. 1,76,000

Ten extra cartridges free

GHI Ltd. 60 pages per minute, duplex, 3 year warranty

Rs. 1,80,000

Twelve Cartridges extra

JKL Ltd. 60 pages per minute, duplex, 3 year warranty

Rs. 1,30,000

Replace cartridge every 15 days for next 3 years

Happy JKL!!!!Happy JKL!!!!

Old machine at CTO’s office moved Old machine at CTO’s office moved to Canteento Canteen

New Machine installed at CTO’s New Machine installed at CTO’s officeoffice

JKL did excellent service checking JKL did excellent service checking the machine and replacing the the machine and replacing the cartridge every 15 days.cartridge every 15 days.

Process setup for shutting down the Process setup for shutting down the machine for 30 minutes every 15 machine for 30 minutes every 15 days for maintenance.days for maintenance.

Recommended for Best Practices Recommended for Best Practices vendor award for JKL at DIOklub vendor award for JKL at DIOklub meet for customer friendliness, meet for customer friendliness, cartridge re-use by re-inking it cartridge re-use by re-inking it (Green) and donating to (Green) and donating to Government schools (CSR).Government schools (CSR).

Bad Luck – TTT!!!!!Bad Luck – TTT!!!!!

Started losing Tenders – al most all of Started losing Tenders – al most all of them in the next quarterthem in the next quarter

Share prices fell drastically.Share prices fell drastically.

Only sustainable (no money demand) Only sustainable (no money demand) equipment was the photocopier as they equipment was the photocopier as they need not even buy a cartridge.need not even buy a cartridge.

End of TTT!!!!!End of TTT!!!!!

Management met and broke Management met and broke their head – How can this their head – How can this happen?happen?

No clue No clue

“ “Economic Untimely” rated Economic Untimely” rated TTT as “Does not know how to TTT as “Does not know how to do business”do business”

So CLOSE TTT operations.So CLOSE TTT operations.

Employee Employee CompensationCompensation

Employees can take home their computers Employees can take home their computers and any other items they feel could be of use and any other items they feel could be of use to them at nominal cost.to them at nominal cost.

This shall reduce disposal cost This shall reduce disposal cost

Employee “WISE GENE” decided to take the Employee “WISE GENE” decided to take the photocopy Machine, as she wanted to setup a photocopy Machine, as she wanted to setup a photocopy shop. photocopy shop. It was a HUGE one, so she wanted to dismantle It was a HUGE one, so she wanted to dismantle

it.it. She called JKL and they “promptly replied” – She called JKL and they “promptly replied” –

CALL Registered, possible date of visit – within CALL Registered, possible date of visit – within next 32 days!!!next 32 days!!!

WISE-GENE tried dismantling it at office and WISE-GENE tried dismantling it at office and when she removed the cartridge – it fell down when she removed the cartridge – it fell down and broke.and broke.

When the Cartridge When the Cartridge broke!!broke!!

There were two items

inside it – a microcamer

a and microfilm

WISE GENE was curious. A print of the microfilm revealed that images of all papers that were photocopied using the machine were stored in it.

This explained the FALL OF TTT!!!!

JKL – leaked all the tender documents photo-copied in the CTO’s office to TTT’s competitors, using the micro camera and micro film fixed in the cartridge once in every 15 days when they LEGALLY removed the cartridge.

The Legal BattleThe Legal Battle

TTT sued JKL – paid lot of lawyer feesTTT sued JKL – paid lot of lawyer fees

Court Proceedings:Court Proceedings: JKL: My Lord “ we removed the cartridge based on TTT’s JKL: My Lord “ we removed the cartridge based on TTT’s

purchase condition. We promptly gave the same for re-inking. purchase condition. We promptly gave the same for re-inking. We did not give to competitors of TTT.”We did not give to competitors of TTT.”

TTT: They did not inform us that there is a camera inside the TTT: They did not inform us that there is a camera inside the Cartridge.Cartridge.

JKL: Camera is an additional backup mechanism used in case JKL: Camera is an additional backup mechanism used in case of destruction of records and is used for surveillance of of destruction of records and is used for surveillance of unauthorized photocopying. We have mentioned this in page unauthorized photocopying. We have mentioned this in page number 342, section 169.1.4 of “Additional advanced number 342, section 169.1.4 of “Additional advanced Features booklet” which can be downloaded FREE from our Features booklet” which can be downloaded FREE from our website. A link to this is mentioned in Section 721.3.4, page website. A link to this is mentioned in Section 721.3.4, page 423 of “Advanced features booklet” which can also be 423 of “Advanced features booklet” which can also be downloaded FREE from our website and is in turn referred in downloaded FREE from our website and is in turn referred in page 22 of the User Manual shipped with the product. page 22 of the User Manual shipped with the product.

The Legal BattleThe Legal Battle

Court Proceedings:Court Proceedings: TTT: My Lord “ We do not put everything in one TTT: My Lord “ We do not put everything in one

manual and put only the essential features. manual and put only the essential features. Else, it will confuse the customer”Else, it will confuse the customer”

The Judge did not have any option but to The Judge did not have any option but to dismiss the case in favour of JKL, with an advice dismiss the case in favour of JKL, with an advice to TTT to be careful in the future which any way to TTT to be careful in the future which any way it had lost.it had lost.

Once the judgment came, JKL sued a Once the judgment came, JKL sued a defamation case on TTT for questioning its defamation case on TTT for questioning its integrity.integrity.

Modern IT InfrastructureModern IT Infrastructure

Extremely Complex SystemsExtremely Complex Systems Entire CSE curriculum tightly Entire CSE curriculum tightly

coupled with each othercoupled with each other Hardware, Operating Hardware, Operating

Systems, Application Systems, Application SoftwareSoftware

Database, Web TechnologyDatabase, Web Technology NetworkingNetworking

95+% Outsourced model95+% Outsourced model IT aids business and is NOT IT aids business and is NOT

the business itselfthe business itself

IT-head ResponsibilitiesIT-head Responsibilities

Hardware SelectionHardware Selection

Software SelectionSoftware Selection

Vendor SelectionVendor Selection

Gave a clue on Hardware/Vendor selectionGave a clue on Hardware/Vendor selection

Can I continue with my story?Can I continue with my story?

WISE GEN – Next StepWISE GEN – Next Step

WISE GEN joined the IT wing of a Public WISE GEN joined the IT wing of a Public Sector company.Sector company.

To her “fortune” they wanted to buy a To her “fortune” they wanted to buy a Photocopy machine and she was in the Photocopy machine and she was in the committee.committee.

She shared confidentially her experience with She shared confidentially her experience with the other committee members.the other committee members.

The committee decided to place order with The committee decided to place order with the vendor who is “TRUST WORTHY”. the vendor who is “TRUST WORTHY”.

Next StepsNext Steps

Audit asked them to define “TRUST”Audit asked them to define “TRUST”

Mathematical Properties that could help any Mathematical Properties that could help any definitiondefinition Reflexive – TRUST is NOTReflexive – TRUST is NOT Symmetric – TRUST is NOTSymmetric – TRUST is NOT Transitive – TRUST is NOTTransitive – TRUST is NOT Context Independent – TRUST is NOTContext Independent – TRUST is NOT Invariance with time – TRUST is TEMPORALInvariance with time – TRUST is TEMPORAL

No convincing definition for TRUSTNo convincing definition for TRUST

Next StepsNext Steps

Experts Broke their head to arrive at a SPEC so that Experts Broke their head to arrive at a SPEC so that XYZ Ltd – the TRUSTED vendor – alone can quoteXYZ Ltd – the TRUSTED vendor – alone can quote

This is the spec – Photocopy machine, duplex, 60 This is the spec – Photocopy machine, duplex, 60 pages a minute, weighing 67.28435 Kgs and pages a minute, weighing 67.28435 Kgs and dimension 19.22” X 20.45” X 72”. The vendor dimension 19.22” X 20.45” X 72”. The vendor should have a branch office 4.6324 kilometer from should have a branch office 4.6324 kilometer from the premises of installation.the premises of installation.

XYZ knew it alone can satisfy the SPEC and quoted XYZ knew it alone can satisfy the SPEC and quoted 7.2 Lakhs for a 1.2 lakhs machine – the COST OF 7.2 Lakhs for a 1.2 lakhs machine – the COST OF TRUST. No negotiation with L1.TRUST. No negotiation with L1.

WISE GEN felt very bad and quit.WISE GEN felt very bad and quit.

The Next CompanyThe Next Company

WISE GEN joined another private Ltd. company, WISE GEN joined another private Ltd. company, RRR, wherein all IT services were outsourced.RRR, wherein all IT services were outsourced.

There was a major breakdown of IT servicesThere was a major breakdown of IT services

The Network team blamed the Hardware Team, The Network team blamed the Hardware Team, which blamed the Software Team, which which blamed the Software Team, which blamed the Database team, which blamed blamed the Database team, which blamed back the Network team. back the Network team.

The management decided that in the next AMC The management decided that in the next AMC all services shall be given to the same vendor all services shall be given to the same vendor so that there is a single point of responsibility.so that there is a single point of responsibility.

VVV gets the Jackpot!!!VVV gets the Jackpot!!!

Next year VVV was selected to handle ALL IT Next year VVV was selected to handle ALL IT operations in the organization.operations in the organization.

The hardware, networking, software were The hardware, networking, software were under the single supervision and control of under the single supervision and control of VVV.VVV.

Even if RRR wants data they have to ask VVV Even if RRR wants data they have to ask VVV for it.for it.

RRR – Bad LuckRRR – Bad Luck

RRR started losing tendersRRR started losing tenders

Started moving towards bankruptcy.Started moving towards bankruptcy.

WISE GEN first checked the Photocopy WISE GEN first checked the Photocopy machine, and also started looking closely at machine, and also started looking closely at what major IT changes happened.what major IT changes happened.

She started looking closely at VVV. She started looking closely at VVV.

Her luck, she was reminded of a presentation Her luck, she was reminded of a presentation by VVV on a recent set of hard disks by VVV on a recent set of hard disks purchased and installed.purchased and installed.

What did the Vendor What did the Vendor SaySay

We are a HIGH AVAILABILITY disk system vendor.We are a HIGH AVAILABILITY disk system vendor.

Description of “availability” -Description of “availability” - You will get a Fed-Ex carrying a diskYou will get a Fed-Ex carrying a disk You go an open the disk rack and find a red-color You go an open the disk rack and find a red-color

light burning on top of one disk. light burning on top of one disk. Remove that and replace with this disk.Remove that and replace with this disk.

How this is possible?How this is possible? While installing disk we asked for 24 X 7 supportWhile installing disk we asked for 24 X 7 support The disk installation process, “registers” disk with The disk installation process, “registers” disk with

the vendor site and keep sending “health” the vendor site and keep sending “health” information.information.

WISE GEN’s WisdomWISE GEN’s Wisdom

What is this information – What is this information – The manual tells “Health” and the information is encrypted The manual tells “Health” and the information is encrypted The disk vendor introduced by VVV alone knows the key to decrypt.The disk vendor introduced by VVV alone knows the key to decrypt. WISE GEN found the size of “Health” information to be too large and WISE GEN found the size of “Health” information to be too large and

asked for clarification with VVV.asked for clarification with VVV.

On investigation she found that confidential information was On investigation she found that confidential information was sent in encrypted form to VVV for leak to competitors.sent in encrypted form to VVV for leak to competitors.

Since all the infrastructure were maintained by VVV, it could Since all the infrastructure were maintained by VVV, it could create necessary rules in (network) firewall and also configure create necessary rules in (network) firewall and also configure hardware accordingly so as to send such large packets carrying hardware accordingly so as to send such large packets carrying confidential information.confidential information.

The Gopalakrishna Committee (RBI) guidelines for IT The Gopalakrishna Committee (RBI) guidelines for IT infrastructure management in Banks advices different vendors infrastructure management in Banks advices different vendors for different components of the IT infrastructure. for different components of the IT infrastructure.

WISE GEN as CIOWISE GEN as CIO

Management appreciated WISE GEN’s Management appreciated WISE GEN’s presence of mind and made her the CIO.presence of mind and made her the CIO.

The company that quarter was making a loss. The company that quarter was making a loss.

15 minutes before it was announced on the 15 minutes before it was announced on the web, around 3 million shares were sold by web, around 3 million shares were sold by shareholders.shareholders.

This created suspicion and WISE GEN was This created suspicion and WISE GEN was asked to investigate.asked to investigate.

WISE GEN’s WISE GEN’s InvestigationInvestigation

The only medium through which one can leak The only medium through which one can leak information is through the web.information is through the web.

The web admin is locked inside the office The web admin is locked inside the office without mobile or telephone connection, without mobile or telephone connection, while he is uploading the results.while he is uploading the results.

How did information leak?How did information leak?

Web screen shorts Web screen shorts

Page at 2:15 PM Page at 2:45 PM

WISE GEN checks the WISE GEN checks the SourceSource

<!DOCTYPE html><html><body bgcolor="#bbddff" VLINK="#ffaa00"><font="arial">

<center><h1> Management Tasks </h1> <BR><BR>

<table border="#ffffff"><TR><TD> <h3> Task-id </h3> </TD><TD> <h3> M-001 </h3> </TD></TR><TD> <h3> Description </h3> </TD><TD> <h3><li> Ensure Updating of lab web-page every Monday or the next working-day following Monday, if latter is not a working-day. The date in the lab home-page should reflect the update. <BR><BR><li> Requests for Updates shall be sent to you from lab membersand you must acknowledge all requests AFTER the update is done, to therespective members so that they can check if the update is doneproperly to their satisfaction. This Acknowledgement shall go with anupdate-id.<BR><BR>

<html><body bgcolor="#bbddff" VLINK="#ffaa00"><font="arial">

<center><h1> Management Tasks </h1> <BR><BR>

<table border="#ffffff"><TR><TD> <h3> Task-id </h3> </TD><TD> <h3> M-001 </h3> </TD></TR><TD> <h3> Description </h3> </TD><TD> <h3><li> Ensure Updating of lab web-page every Monday or the next working-day following Monday, if latter is not a working-day. The date in the lab home-page should reflect the update. <BR><BR><li> Requests for Updates shall be sent to you from lab membersand you must acknowledge all requests AFTER the update is done, to therespective members so that they can check if the update is doneproperly to their satisfaction. This Acknowledgement shall go with anupdate-id.<BR><BR>Source at 2:15 PM Page at 2:45 PM

Who was the Culprit?Who was the Culprit?

The culprit was the Web admin.The culprit was the Web admin.

At 2.15 PM he has started uploading the result At 2.15 PM he has started uploading the result and he knows the content.and he knows the content.

He told his accomplice at 2.15 PM if you see a He told his accomplice at 2.15 PM if you see a <!DOCTYPE html> <!DOCTYPE html> in the first line it is in the first line it is PROFIT and else it is LOSS.PROFIT and else it is LOSS.

In this case it was a LOSS.In this case it was a LOSS.

The external world can check this out using The external world can check this out using “View Source”. “View Source”.

The web-admin can legally edit this. The web-admin can legally edit this.

Reactions to FraudsReactions to Frauds

All the three stories were reactions to frauds All the three stories were reactions to frauds and in no way could have prevented the and in no way could have prevented the fraud.fraud.

Why can’t we be proactive?Why can’t we be proactive?

Reason is WE DO NOT KNOW THE THREAT Reason is WE DO NOT KNOW THE THREAT MODEL.MODEL.

Why is it so?Why is it so?

Computing system is nothing but layers of Computing system is nothing but layers of virtual virtual machinesmachines..

High Level programming

Compiler Application Programs

Assembly LanguageLevel

Operating Systems

Microprogramming

Digital Hardware

You do not care

Beyond programming languages

Beyond Compilers

Beyond OS routines

Beyond Micro Architecture

How Prevalent is the How Prevalent is the problemproblem

Select 100 COTS/open source Select 100 COTS/open source applications packages randomlyapplications packages randomly Packages with dead code 79 packagesPackages with dead code 79 packages Packages with unwanted code (backdoors, etc.) 23 Packages with unwanted code (backdoors, etc.) 23

packagespackages Packages with suspicious behaviors 89 packagesPackages with suspicious behaviors 89 packages Packages with possible malicious code 76 Packages with possible malicious code 76

packagespackages Known worms, Trojans, rootkits, etc. 21 packagesKnown worms, Trojans, rootkits, etc. 21 packages Possible worms, Trojans, rootkits, etc. 69 packagesPossible worms, Trojans, rootkits, etc. 69 packagesSource: Reifer Consultants presentation at Oct 2007 DHS SwA ForumSource: Reifer Consultants presentation at Oct 2007 DHS SwA Forum

Borland Interbase 4.0, Borland Interbase 4.0, 5.0, 6.0 (2001)5.0, 6.0 (2001)

Hard-coded username Hard-coded username ““politicallypolitically”” with the with the password password ““correctcorrect”” allowed remote access allowed remote access

Credentials inserted into the database at Credentials inserted into the database at startupstartup

Support for user-defined functions equates to Support for user-defined functions equates to administrative access on the serveradministrative access on the server

Undetected for over Undetected for over seven yearsseven years

Opening the source revealed the backdoorOpening the source revealed the backdoor

At the end of this presentation M/s. VVV wanted to take Prof. Kamakoti to court for using their name in his story.

Prof. Kamakoti says he has indeed wrote on the screen “ALL characters and entities used in this presentation are imaginary”

Where did he?

IN HIS VERY FIRST SLIDE

WISE GEN and The IT WISE GEN and The IT Revolution*Revolution*Prof. Kamakoti, IIT MadrasProf. Kamakoti, IIT Madras

*All characters and entities in this presentation are imaginary.

SLAs and License TermsSLAs and License Terms

Key points in SLAs and License Terms are in Key points in SLAs and License Terms are in fine printfine print..

By not reading these in full customers get By not reading these in full customers get trapped and could potentially be sued for trapped and could potentially be sued for illegal usage.illegal usage.

I am yet to see an SLA with a penalty clause I am yet to see an SLA with a penalty clause relating to performance, leave alone security.relating to performance, leave alone security.

LOOOOOOOOOOOONG WAY to GO……..LOOOOOOOOOOOONG WAY to GO……..

A tough road ahead – In next 10 years either the world would be happy with Computers calling them the eighth wonder of the world OR they curse the CS and EE guys – why the hell you invented one. The former will happen if we could deliver the necessary security, else the latter is inevitable.