Dan Farmer

Background

Dan Farmer, born April 5, 1962, is an American computer security researcher and programmer regarded as a pioneer in the development of vulnerability-scanning tools for Unix systems and networks. As a computer science student at Purdue University in the late 1980s, Farmer was influenced by the atmosphere surrounding the 1988 Morris Worm, an incident that drove broad interest in the fledgling field of computer security. Purdue's Gene Spafford, one of the era's leading computer security researchers, supported Farmer's early work.

COPS: an early vulnerability scanner

In 1989, while still a student, Farmer released the Computer Oracle and Password System (COPS), a suite of small, specialized scripts designed to check a Unix system for common security weaknesses, such as poor file permissions, weak passwords, and misconfigurations. COPS was among the first publicly available tools built specifically to automate the detection of security flaws on a running system, and it helped establish the vulnerability-scanner concept that Farmer would return to a few years later on a larger scale.

SATAN and its controversy

In 1995, Farmer partnered with Dutch programmer and physicist Wietse Venema, already known for writing TCP Wrapper, to build the Security Administrator Tool for Analyzing Networks, or SATAN. Released publicly on April 5, 1995, SATAN scanned networked systems for known vulnerabilities and reported them through a web-browser interface, a novel and unusually accessible design for a security tool at the time. Farmer and Venema included a command called "repent" that could relabel the program as "SANTA" for administrators uncomfortable with its original name.

SATAN drew intense mainstream attention, including coverage in PC Magazine, Newsweek, and Time, largely because critics feared that a free, easy-to-use scanner would just as readily assist attackers as defenders. The tool drew scrutiny from the United States Department of Justice, and Farmer's employer at the time, Silicon Graphics (SGI), fired him over the release. Sun Microsystems, where Farmer had previously worked, later rehired him, reflecting a more measured industry view once SATAN's actual function as a defensive audit tool, rather than an automated break-in kit, became clear.

The Coroner's Toolkit and forensic discovery

Farmer's later collaboration with Venema shifted from finding vulnerabilities before an attack to reconstructing what happened after one. The two developed The Coroner's Toolkit (TCT), a suite of Unix programs for post-mortem forensic analysis of compromised systems, first presented publicly around 1999. TCT could recover deleted files, analyze file timestamps, and otherwise help investigators reconstruct an intruder's actions, and it became an influential reference point for digital forensics tooling; it was eventually succeeded by The Sleuth Kit, whose authors credited TCT as a direct predecessor. Farmer and Venema documented their forensic methodology in the 2005 book Forensic Discovery.

Other work and legacy

Farmer also co-developed the Titan vulnerability scanner with Brad Powell and Matt Archibald, presented at the USENIX Large Installation System Administration (LISA) conference in 1998, and later co-founded the security company Elemental Security, serving as its chief technical officer. His work and the SATAN controversy were profiled in Scientific American's 1997 feature "From Satan to Zen." Farmer's career illustrates a recurring tension in computer security: tools built to help administrators find their own weaknesses can just as easily be read as instructions for attack, a debate that continues to inform how researchers and vendors think about releasing dual-use security software.

Timeline

• 1962-04-05Dan Farmer is born.
• 1989As a Purdue University student, Farmer releases COPS (Computer Oracle and Password System), an early Unix vulnerability-scanning toolkit, with support from professor Gene Spafford.
• 1995-04-05Farmer and Wietse Venema publicly release SATAN (Security Administrator Tool for Analyzing Networks), a widely publicized network vulnerability scanner.
• 1995Silicon Graphics fires Farmer over the SATAN release; Sun Microsystems later rehires him.
• 1997Scientific American profiles Farmer and the SATAN controversy in the article "From Satan to Zen."
• 1998Farmer, with Brad Powell and Matt Archibald, presents the Titan vulnerability scanner at the USENIX LISA conference.
• 1999Farmer and Venema present The Coroner's Toolkit (TCT), a Unix post-mortem forensic analysis suite.
• 2005Farmer and Venema publish the book Forensic Discovery, documenting their approach to computer forensics.