If it’s wrong to think about hacking the Lunar Reconnaissance Orbiter, I don’t wanna be right.
A friend sent me a link to a project related to the Lunar Reconnaissance Orbiter which seems to be intended to drum up some sort of “support” for the LRO project. How sending your name to the moon is supposed to support the LRO project I don’t know. I suppose it’s at least as effective as signing a petition. I assume that they are loading the names submitted into the NASA equivalent of a thumb-drive and strapping that puppy on the LRO somewhere… I imagine zip-tied to a landing strut or something.
Now, my first thought was: I wonder if one could enter a name that would cause a buffer overflow on the web-form and initiate some form of SQL injection attack, then leverage that to gain control of the Lunar Reconnaissance Orbiter after launch. It’s worth noting at this point that I have neither the inclination, knowledge or ability to perform such a hack… I can’t really even confirm that a SQL injection attack on the server would work. My point is that I thought of it. Bruce Schneier wrote an article about the Security Mindset that made me realize that not everyone looks for the worst case scenario. I’m an engineer and engineers generally only care about making the process work, and truly that is very often more than enough for me, but I am also an employee in a very secure facility where security is paramount. I work in an environment where the users cannot be trusted, by policy. Sometimes it’s tough for me to convince others of the things I see as possible security holes because they truly do not see the possibility of users exploiting them.
I do not think that people are inherently un-trustworthy. I simply trust that there are some people bloody-minded enough in the world to seek out, stumble upon, be shown and then exploit any weakness in any system.
