Read “Why Cryptosystems Fail (PDF)” by Ross Anderson. This paper is about a philosophy of cryptosystem design, with a focus on their use in financial institutions and particularly in ATM (Automated Teller Machine) networks.
- Skim the abstract, introduction, and conclusion first, because they will help you to focus on the parts of the paper that support the author’s main claims.
- Section 3 is devoted to examples of ways in which ATM networks could fail or have failed. This part of the paper is very entertaining, but it can be difficult to keep the big picture in mind while reading about the individual exploits and problems. Pay attention to the section headings (which you may wish to skim before diving into the text) in order to keep your bearings. For each incident, before moving on, spend a few moments thinking about the lessons that it teaches and how the problem could have been avoided.
- Sections 4 and 5 conclude with a broader discussion.
- As always, you should read critically and be on the lookout for additional gems and for arguments that are missing or whose framing de-emphasizes certain points.
As you read, think about how this paper relates to other papers we’ve read in 6.033, despite the fact that we’ve covered nothing else on ATM networks.
Questions for Recitation
Before you come to this recitation, write up (on paper) a brief answer to the following (really—we don’t need more than a couple sentences for each question).
Your answers to these questions should be in your own words, not direct quotations from the paper.
- In your mind, what is the root cause of the majority of the attacks detailed in Section 3?
- Pick one of the attacks. How was that root cause exploited in that attack?
- Why wasn’t the attack prevented in the first place? What could have been done to prevent it, if anything?
As always, there are multiple correct answers for each of these questions.
