A Data Breach in Who-ville

This holiday season, however, after a year of nasty data breaches, it feels appropriate to take Dr. Seuss’ How the Grinch Stole Christmas[2] and analyze it with some of the basic questions we ask during a data breach.

• By Tyler Reguly
• Dec 22, 2017

It’s impossible to say for certain, but I suspect that when Theodor Geisel published his first Christmas related book in 1957 and Dave Shackleford published a whitepaper[1] in 2012, neither of them expected to be referenced alongside each other. This holiday season, however, after a year of nasty data breaches, it feels appropriate to take Dr. Seuss’ How the Grinch Stole Christmas[2] and analyze it with some of the basic questions we ask during a data breach.

Since we don’t know exactly where Who-ville is, perhaps it exists on a circuit board and those wrapped Christmas gifts represent folders and files, after all it’s likely the first recorded use of “heap overflow.” Instead of the lyric stating, “Your soul is an appalling dump heap overflowing with the …”, perhaps it actually reads, “Your soul is an appalling dump. Heap overflowing with the …” This means that it’s quite possible that Who-ville is simply down the information superhighway from the Game Grid.

Since the Grinch successfully pulls off his attack, let’s take a look at Shackleford’s ‘Top Five Questions to Answer After a Security Breach.’

What Systems and Data Were Affected?

The stockings were the first thing to go. “Pop guns! And bicycles! Roller skates! Drums! Checkerboards! Tricycles! Popcorn! And Plums!” Ultimately, every festive item was taken from every resident of Who-ville. He picked their houses clean and all of their food, taking even crumbs from a mouse. At one point, the Grinch even destroys data, ripping out the magnetic tape from its casing. There’s no need to assume that Who-ville is digital, we’re seeing a physical representation of data loss.

How Did They Do It?

This is where a lax approach to security came back to bite the people of Who-ville in the bottom. The Grinch managed to bypass security with a ladder and exploit the vulnerable chimney for entrance. In other cases, he was simply able to pass from building window to building window by conveniently placed ropes used to string up decorations. In technical parlance, the rope could represent shared credentials or an already established SSH tunnel between the hosts. This is where simple patches like a chimney cap or closed windows could have prevented the majority of the loss.

Who Did This to Us?

As outsiders watching the situation unfold, we know who the culprit is… The Grinch and his accomplice Max. In his whitepaper, Shackleford suggests determining the category of the attacker with three sub-questions:

Is the event externally or internally based?

This one appears obvious on the surface. It was an external attack, as the residents of Who-ville were left with nothing after an attacker entered their village. It is possible, however, that this may be considered a joint attack. “If you see something, say something” is a popular phrase utilized for a number of purposes, so you have to ask yourself, “Why didn’t Cindy-Lou Who say something when she saw ‘Santy Clause’ taking the tree?” Perhaps this attack wasn’t as external as Dr. Seuss would have us believe.

What is the attacker’s motivation?

It’s definitely interesting to watch an attack from the outside as we have explicit knowledge of this. The Grinch hates Christmas (perhaps due to his heart being two sizes too small). His goal was to prevent Christmas and avoid the singing and noise that would befall his ears on Christmas day.

Where is the attacker located?

Again, simple to see, Mt. Crumpit. Having an attacker this close and having such lax security could make it tempting for repeat attacks to occur.

Is It Really Over?

Ultimately, The Grinch returns the assets but instead of being prosecuted under the Computer Fraud and Abuse Act, he’s invited to dinner. Not only does he join the people of Who-ville at a large dinner, he actually gets the honor of carving the rare Who roast beast. The Grinch joining them could be considered unusual system activity. Perhaps he’s actually positioning himself as an insider threat for future attacks

Can It Happen Again?

This is where Shackleford suggests a few steps to minimize the risk of the breach happening again:

• Know and understand what is running in the environment and how it commonly behaves.
• Go over the root cause again.
• Reconstruct events.
• Remediate security controls and improve user training.

Unfortunately, the residents of Who-ville clearly don’t care about this list. After the breach occurs, they simply go about their daily lives. Sure, there are no presents to open and there’s definitely no food to eat, but they still gather outside to ring the Christmas bells and sing a song. Without patching the chimney and windows or determining if Cindy-Lou represented a threat, they are left with a high likelihood of a repeat occurrence. This likelihood is increased as they allowed the attacker to embed himself within in their community.

While Geisel wrote How the Grinch Stole Christmas as a criticism of materialism and consumerism in the 1950s, it serves as a decent parable for data security in modern era. Data breaches often occur due to lax security within an enterprise and all-too-often consumers behave as the residents of Who-ville did after learning of the breach… simply carrying on with their lives without a care to what’s been lost. Unfortunately, we never got How the Grinch Stole Christmas 2, so we’ll never know if their naiveté caught up with them, but we can watch similar events unfold with the next major data breach.  Regardless of what happens, I think we can all agree that hackers are “a three-decker sauerkraut and toadstool sandwich with arsenic sauce.”