1

A long time ago people talked about the Harvard architecture, which had the program separate from the data. Similarly, if the software of a server was not modifiable (burned in to a crystal or something - note: hypothetical, do not attack this premise) and it came out of the box with no root user and no way to add or change anything (except data), we would have a sort of "appliance" that worked like any other piece of familiar hardware, and could not be commandeered.

Does anyone do this now and if not, is there a technical reason why not? Basically I am proposing a throwaway device that perhaps does not even store the data in itself, but only controls access to a separate disk farm or something. If something goes wrong, you unplug it and plug a new one in and keep going, like RAID for the server itself.

|improve this question
  • These systems are still susceptible to 'Hacking' (in this case meaning, Making a system or apparatus do a function it was not designed to do) This could mean that the System does something the desgners did not intend to do, or possibly even worse, leak (parts of) the data. – LvB Mar 10 '16 at 14:31
  • Yes, there could still be software flaws. I think the biggest problem with general-purpose computers is that they are, well, general purpose. Maybe if they did a lot less, then they would be more secure. I never worry about my toaster being taken over by terrorists, or the computer in my car engine (I think it is unmodifable and is not connected to anything). When all else fails, lower your expectations. Back when there were modems, there was a proliferation of options and settings, when all that we really wanted was a little box that did the job. Why didn't someone realize that? – user82913 Mar 10 '16 at 15:01
  • 1
    In fact your car already has the critical mass in software and computing power that this is an issue. Your toaster probably does not even have a 'computer' inside it so nothing to go wrong on that end. – LvB Mar 10 '16 at 15:04
  • @LvB is my car computer accessible without breaking in to the car physically? If not, is this any worse than damaging the car in any other way? The computer does not seem to pose a unique vulnerability there. I never hear about accidents caused by car computers being hacked by people in Romania. – user82913 Mar 10 '16 at 15:06
  • 2
    Yes some are accessible from the 'outside'. There are some rumored cases of people infecting cars with 'malware' when there being serviced. Some cars have a 'phone home' function that has been used in a proof of concept to hack a car remotely. And most importantly there can be no physical evidence of these actions beeing done to the system (outside of validating the software physically, as in read the chip through external means) – LvB Mar 10 '16 at 15:11
2

This would prevent the server from executing code that was written by an attacker, that does seem like a good idea, but another problem remains. You'll have to include some software in the beginning, when you create the server. Every piece of software has a fault somewhere, no matter how many tests you go through. If you write this software to the server and 2 months later, an exploit is found where the attacker doesn't inject code (since that is not possible by premise) but rather uses existing code in the software to break something, by sending data the coder did not expect. Since your server code can't be changed you now have no way of applying the security patch.

|improve this answer
  • Pop the ROM out and put an updated one in? Is this any worse than what we have now? – user82913 Mar 10 '16 at 14:57
  • this would require you to manually put more hardware you had to aquire in to every server in your company, and that for every tiny software update. I'm not sure how economic that is, since (watch out - personal opinion upcoming!) most threats for servers nowadays are using unintended control flow in the existing code rather than running malicuous code. – Pascal Sommer Mar 10 '16 at 15:06
  • 1
    So the real problem is poor software quality rather than "hacking" per-se. – user82913 Mar 10 '16 at 15:15
  • 1
    @nocomprende Indeed. The vast majority of website defacements, website malware infections or website data thefts are made possible by vulnerabilities in the web applications, not the webserver or operating system. – Philipp Mar 10 '16 at 16:38
  • @Philipp Weld it all down. ROM for all, and all for ROM. Done. – user82913 Mar 10 '16 at 18:30
2

There are many commercial Harvard architecture machines, for instance Microchip's PIC series.

Making a static embedded system is certainly possible.

That said, PICs etc, often have a way to modify their own flash, and for convenience often use that to include a bootloader to allow reprogramming without special hardware.

Really, a Harvard architecture isn't really a requirement. Mostly what you need is Read Only Memory to hold the program. Many systems used to use z80's and '86 micros running out of ROM.

That's not to say that there might be some sort of exploit that could make a Von Neumann architecture jump into RAM. But there's nothing intrinsic about Harvard that makes it resistant to Return-Oriented Programming exploits either

|improve this answer
  • So there is probably not a perfect way to prevent the sort of problem I am envisioning. OK, well this is a proper technical answer, thank you. – user82913 Mar 10 '16 at 15:19
0

You can actually do it. Theres multiple ways to accomplish it: Either you use PXE boot to boot a image, that is then loaded into RAM using a virtual RAM disk. Or you do the same thing using local read-only media.

This of course means the server can be modified during operation, because that is required for server to operate (it must keep states and such in memory, store variables in memory and such), but the advantage is that any changes a attacker does on the server is never written anywhere permanent, so a simple reboot of the server will guranteed flush any changes the attacker made.

Running a server this way, and also configuring it to reboot lets say once a day to clear out any damage, is a very effective way to prevent any exploitation. Running without a root account is generally not recommended, you need services to use a root account to set up low ports and such.

|improve this answer
  • This is a good technical answer which proposes a workable solution. Thank you. Any idea why it is not widespread? – user82913 Mar 10 '16 at 19:47
  • The main thing is because this would make it very hard to administrate, becasue everytime you want to update the server, for example exploits and such, you would have to rebuild the image. Same if you want to change configuration and such. But this is a very common and widespread solution used in for example public computers/kiosk/internet cafés where local users are untrusted and might wreck havoc. Then the computer is also regularly rebooted to clean off any damage its users has done. – sebastian nielsen Mar 10 '16 at 19:52
-2

No. If I was motivated $$$ enough I could hack your Impervious Server.

https://security.stackexchange.com/a/117045/9640 mentioned that "You'll have to include some software in the beginning, when you create the server." and that is certainly a weakness, but for the sake of this answer let us assume the software has no weakness.

A computer contains an array of physical switches (think light switch) that can be in one of two positions (think on or off). This is not a metaphor. There really is an incredibly large number of incredibly small switches in your computer.

The switches determine the state of the computer. From time to time, cosmic radiation will flip a switch. This happens incredibly rarely and when it does happen, usually there are checksum procedures that detect and fix the error, but this is how "true" computer errors happen.

It will be a challenge for me - but doable with sufficient budget - to hit your impervious server with the right kind of radiation to change its state to "pwned by me."

|improve this answer
  • 1
    This attack scenario is not in any way realistic under real-world conditions. – Philipp Mar 10 '16 at 16:36
  • @Philipp I agree it is not a very realistic attack, but if someone is marketing an "Impervious Server", I am wondering how they are going to defeat this attack. – emory Mar 10 '16 at 16:41
  • Isn't there an "adjacent row attack" or something where you cause a repeated pattern of writes to memory which can flip a bit? I remember how the Apollo Guidance Computer and even the early Space Shuttles used core magnetic memory to be impervious to cosmic rays, etc. Now we would use redundant processors. Have 5 of them, what the heck, have 100 processors. Or how about the old story that the US embassy was being irradiated with microwaves by the Russians? They were trying to flip bits in people brains, I guess. Hey, just nuke the server from orbit. Done. – user82913 Mar 10 '16 at 18:34

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy