A Data Breach in Who-Ville

A Data Breach in Who-ville

This holiday season, however, after a year of nasty data breaches, it feels appropriate to take Dr. Seuss’ How the Grinch Stole Christmas[2] and analyze it with some of the basic questions we ask during a data breach.

It’s impossible to say for certain, but I suspect that when Theodor Geisel published his first Christmas related book in 1957 and Dave Shackleford published a whitepaper[1] in 2012, neither of them expected to be referenced alongside each other. This holiday season, however, after a year of nasty data breaches, it feels appropriate to take Dr. Seuss’ How the Grinch Stole Christmas[2] and analyze it with some of the basic questions we ask during a data breach.

Since we don’t know exactly where Who-ville is, perhaps it exists on a circuit board and those wrapped Christmas gifts represent folders and files, after all it’s likely the first recorded use of “heap overflow.” Instead of the lyric stating, “Your soul is an appalling dump heap overflowing with the …”, perhaps it actually reads, “Your soul is an appalling dump. Heap overflowing with the …” This means that it’s quite possible that Who-ville is simply down the information superhighway from the Game Grid.

Since the Grinch successfully pulls off his attack, let’s take a look at Shackleford’s ‘Top Five Questions to Answer After a Security Breach.’

What Systems and Data Were Affected?

The stockings were the first thing to go. “Pop guns! And bicycles! Roller skates! Drums! Checkerboards! Tricycles! Popcorn! And Plums!” Ultimately, every festive item was taken from every resident of Who-ville. He picked their houses clean and all of their food, taking even crumbs from a mouse. At one point, the Grinch even destroys data, ripping out the magnetic tape from its casing. There’s no need to assume that Who-ville is digital, we’re seeing a physical representation of data loss.

How Did They Do It?

This is where a lax approach to security came back to bite the people of Who-ville in the bottom. The Grinch managed to bypass security with a ladder and exploit the vulnerable chimney for entrance. In other cases, he was simply able to pass from building window to building window by conveniently placed ropes used to string up decorations. In technical parlance, the rope could represent shared credentials or an already established SSH tunnel between the hosts. This is where simple patches like a chimney cap or closed windows could have prevented the majority of the loss.

Who Did This to Us?

As outsiders watching the situation unfold, we know who the culprit is… The Grinch and his accomplice Max. In his whitepaper, Shackleford suggests determining the category of the attacker with three sub-questions:

Is the event externally or internally based?

This one appears obvious on the surface. It was an external attack, as the residents of Who-ville were left with nothing after an attacker entered their village. It is possible, however, that this may be considered a joint attack. “If you see something, say something” is a popular phrase utilized for a number of purposes, so you have to ask yourself, “Why didn’t Cindy-Lou Who say something when she saw ‘Santy Clause’ taking the tree?” Perhaps this attack wasn’t as external as Dr. Seuss would have us believe.

What is the attacker’s motivation?

It’s definitely interesting to watch an attack from the outside as we have explicit knowledge of this. The Grinch hates Christmas (perhaps due to his heart being two sizes too small). His goal was to prevent Christmas and avoid the singing and noise that would befall his ears on Christmas day.

Where is the attacker located?

Again, simple to see, Mt. Crumpit. Having an attacker this close and having such lax security could make it tempting for repeat attacks to occur.

Is It Really Over?

Ultimately, The Grinch returns the assets but instead of being prosecuted under the Computer Fraud and Abuse Act, he’s invited to dinner. Not only does he join the people of Who-ville at a large dinner, he actually gets the honor of carving the rare Who roast beast. The Grinch joining them could be considered unusual system activity. Perhaps he’s actually positioning himself as an insider threat for future attacks

Can It Happen Again?

This is where Shackleford suggests a few steps to minimize the risk of the breach happening again:

  • Know and understand what is running in the environment and how it commonly behaves.
  • Go over the root cause again.
  • Reconstruct events.
  • Remediate security controls and improve user training.

Unfortunately, the residents of Who-ville clearly don’t care about this list. After the breach occurs, they simply go about their daily lives. Sure, there are no presents to open and there’s definitely no food to eat, but they still gather outside to ring the Christmas bells and sing a song. Without patching the chimney and windows or determining if Cindy-Lou represented a threat, they are left with a high likelihood of a repeat occurrence. This likelihood is increased as they allowed the attacker to embed himself within in their community.

While Geisel wrote How the Grinch Stole Christmas as a criticism of materialism and consumerism in the 1950s, it serves as a decent parable for data security in modern era. Data breaches often occur due to lax security within an enterprise and all-too-often consumers behave as the residents of Who-ville did after learning of the breach… simply carrying on with their lives without a care to what’s been lost. Unfortunately, we never got How the Grinch Stole Christmas 2, so we’ll never know if their naiveté caught up with them, but we can watch similar events unfold with the next major data breach.  Regardless of what happens, I think we can all agree that hackers are “a three-decker sauerkraut and toadstool sandwich with arsenic sauce.”


  • Maximizing Your Security Budget This Year

    7 Ways You Can Secure a High-Traffic Commercial Security Gate  

    Your commercial security gate is one of your most powerful tools to keep thieves off your property. Without a security gate, your commercial perimeter security plan is all for nothing. Read Now

  • Protecting Data is Critical

    To say that the Internet of Things (IoT) has become a part of everyday life would be a dramatic understatement. At this point, you would be hard-pressed to find an electronic device that is not connected to the internet. Read Now

  • Mobile Access Adoption

    Smartphones and other mobile devices have had a profound impact on how the world securely accesses the workplace and its services. The growing adoption of mobile wallets and the new generation of users is compounding this effect. Read Now

  • Changing Mindsets

    We have come a long way from the early days of fuzzy analog CCTV systems. During that time, we have had to migrate from analog to digital signals. When IP-based network cameras arrived, they opened a new world of quality and connectivity but also introduced plenty of challenges. Thankfully, network devices today have become smart enough to discover themselves and even self-configure to some degree. While some IT expertise is certainly required, things are much smoother these days. The biggest change is in how fast security cameras and supporting infrastructure are evolving. Read Now

Featured Cybersecurity


New Products

  • 4K Video Decoder

    3xLOGIC’s VH-DECODER-4K is perfect for use in organizations of all sizes in diverse vertical sectors such as retail, leisure and hospitality, education and commercial premises. 3

  • HD2055 Modular Barricade

    Delta Scientific’s electric HD2055 modular shallow foundation barricade is tested to ASTM M50/P1 with negative penetration from the vehicle upon impact. With a shallow foundation of only 24 inches, the HD2055 can be installed without worrying about buried power lines and other below grade obstructions. The modular make-up of the barrier also allows you to cover wider roadways by adding additional modules to the system. The HD2055 boasts an Emergency Fast Operation of 1.5 seconds giving the guard ample time to deploy under a high threat situation. 3

  • PE80 Series

    PE80 Series by SARGENT / ED4000/PED5000 Series by Corbin Russwin

    ASSA ABLOY, a global leader in access solutions, has announced the launch of two next generation exit devices from long-standing leaders in the premium exit device market: the PE80 Series by SARGENT and the PED4000/PED5000 Series by Corbin Russwin. These new exit devices boast industry-first features that are specifically designed to provide enhanced safety, security and convenience, setting new standards for exit solutions. The SARGENT PE80 and Corbin Russwin PED4000/PED5000 Series exit devices are engineered to meet the ever-evolving needs of modern buildings. Featuring the high strength, security and durability that ASSA ABLOY is known for, the new exit devices deliver several innovative, industry-first features in addition to elegant design finishes for every opening. 3