Hollywood Computer Security: Access Control
Computers in the movies are always capable of the most absurd things. They all seem to be connected to everything. The strategic defence computer in War Games was connected to the public telephone service, for no readily explained reason.
It’s apparently undisputed that shop ordering systems, airline booking databases and school grades are all directly accessible from the outside. So I’d like to dispute this. No They’re Not.
Now that I’ve got that off my chest we can move onto something less obvious.
The Ineffectiveness of Passwords
Doing whatever you want with a Hollywood computer seems to be largely about knowing the right username and password. But don’t worry: There’s Always A Back Door.
But even if the programmer hasn’t created a hardwired password with the name of his son (War Games), which somehow managed to slip past the exhaustive code review process for a military contract, you can bet that it won’t take long to brute force.
Brute force password cracking is where you start off at the beginning of the alphabet and go through all possible combinations of characters: ‘a’, ‘b’, ‘c’, … ‘aa’, ‘ab, ‘ac’, … ‘ba’, ‘bb’, ‘bc’, … and so on for a very long time. Of course you also have to check numbers, upper and lower case characters and random punctuation marks. It’s a hard job and there’s never any indication that you’re close. It’s often possible to cut down the time by using a dictionary of common passwords - which is why people are told to choose difficult passwords!
But in the movies, it’s all a lot simpler. All Hollywood computers play the password equivalent of the ‘Hot or Cold’ game, and will tell you if you have a character correct. This dramatically cuts down on the time it takes to break into a machine. When was the last time your computer told you that you had a wrong character in the third letter of your password but that everything else was correct? Yeah, exactly. Security systems are not that dumb.
The truth of the matter is that the computer doesn’t know what character you got wrong. That’s because the password stored on the hard drive is scrambled up and can’t be retrieved. The computer then scrambles what you typed in with the same technique and compares the two scrambled passwords. The scrambling is one-way only. There is no way of decrypting the passwords.
At least we can be thankful they’ve abandoned the ‘over-ride’ button. I seem to recall that one appeared in The Net. What use is a security system where you can opt-out of being asked for security details? There really is no such thing as the all-access backstage pass. Honestly.
Encryption Stuff
As some of the technology becomes more commonplace, elements of reality start to pepper plots and dialogue. Naturally these real-world references are not going to be used in the right places but at least it shows the writers are doing a modicum of research.
For instance, counter-terrorist extraordinaire, Jack Bauer, has been known to decode the Blowfish encryption algorithm. And Blowfish actually exists! It’s not as simple to break as Jack Bauer makes out, but that’s Hollywood for you.
Even more disturbing is the atrocious use of cryptography in Swordfish. The computer geek character is asked to break into the US Department of Defense in less than sixty seconds. (While being distracted by Halle Berry.) Suprisingly, he doesn’t manage… well, not on the first attempt anyway.