SANS Institute Warns of Attack Shift 80
JamesAlfaro writes "SANS warned of the switch to attacks on applications and network devices in its annual publication of the Top 20 vulnerabilities on Tuesday. The annual SANS Top 20 highlights holes in software programs that are considered the most serious for security professionals. Microsoft shares the spotlight this year with Symantec Corp., Cisco Systems Inc., Oracle Corp. and others, after a year in which warnings about vulnerabilities in antivirus and computer backup software and the surprise publication of information on a hole in Cisco Systems' IOS (Internetwork Operating System) made headlines."
Interesting article, but... (Score:4, Insightful)
New shift? (Score:3, Funny)
And here I thought that..... (Score:4, Funny)
Re:I believe it: OS' are getting solid (Score:3, Interesting)
Nor would I agree with "today's modern OS' are pretty damn secure/solid as well as stable." There have been far to many worms, etc. Also, I *really* wish Microsoft would get their browser out of the OS. Yet another unpatched, zero-day, control of system exploit was announced today.
Re:I believe it: OS' are getting solid (Score:1)
My post was made from having read the book, as I replied above. When the event actually happened, I was a Unix user, not any sort of coder, beyond a bit of shell scripting. I had no security responsibilities. In 2000, when I read the book, there was little point in researching the root cause--it had long since been patched.
"P.S.=> Now, if you don't like that? Disprove what
Re:I believe it: OS' are getting solid (Score:1)
BTW, I'm not a network admin. But I have enough sense to listen to them, not trash them. They're in the trenches every day, and have valuable insights. Sometimes the critical bit of info you need. Thank $DEITY not all coders came from your ranks, and now feel that they are somehow above them. In fact, *none* of the better coders I know have your attitude.
To make it very clear, I do code. In a dozen languages or so. You accuse me of not knowing much ab
Re:I believe it: OS' are getting solid (Score:1)
and
"Here's some reference material for you, a quote from a review (since you don't have this novel apparently)"
Yes, I own the novel. Read it years ago. Just dragged it from the shelf again, and found the reference to a permissions problem. I have the 2000 printing of the Pocket Books edition. In that edition, the explanation starts on page 27. From there to the end of the expl
Re:I believe it: OS' are getting solid (Score:1)
I don't care what OS you use. I prefer Linux on the desktop, because I'm more used to it, and more productive in it. On the server, I use it a lot, and OpenBSD on rare occasions. If I have to, by the nature of the job, I'll use Solaris or HP-UX. I have little exposure to AIX. I own Microsoft Windows and Office, and use them when I have to. That's actually pretty frequently, as the
Symantec (Score:4, Interesting)
That must be embarrassing for a company that sells security products themselves.
Re:Symantec (Score:4, Insightful)
No, that must be profitable.
Quis custodiet ipsos custodes? (Score:2)
Re:Quis custodiet ipsos custodes? (Score:3, Informative)
Interesting theory but the product in question, Veritas BackupExec, is not a security product. To Symantec's credit this is a software product they purchased but it still has the Symantec name on it.
Nothing is perfect. (Score:2)
Re:Symantec (Score:1)
Link to list (Score:5, Informative)
Re:Link to list (Score:3, Funny)
shares? (Score:5, Funny)
Microsoft shares? Did I read that right?
Re:shares? (Score:2)
I think they meant "chairs".
Re:shares? (Score:2)
Yep. And you get one of your own for (at the moment) $27.91 [google.com].
Re:shares? (Score:1)
You shall not pass! (Score:2)
Coding practices (Score:5, Insightful)
From the article: "You could be the most secure operation in the world, but if you have applications that were developed using bad coding practices, you're open to exposure," said Braunstein.
While this is true, it is also possible that software developed with good coding practices can still have vulnerabilities -- because some things you just can't predict or determine. All you need to do is overlook one itty bitty thing and it becomes a weak link, but I still wouldn't call it "bad coding practices".
Re:Coding practices (Score:4, Interesting)
You know how the people who make airplanes avoid this type of situation? They double-check. They triple-check. They fire people who can't do a good job and hire ones who can. They actually, you know, *try*. Can you honestly say the same thing for the average coder?
If you have a network app, and it accepts a finite language of bytes, just how hard is it to secure this? Not very hard. Either you can do it, or your app is too complex, and you need to simplify it.
I don't think software with security holes should *ever* be "the norm". That's a dangerous way of thinking. It just makes software worse and worse. I have no problem with calling any software with holes the result of "bad coding practices". Including my own.
Every single time a flaw is discovered, it's a failure. It's not business as usual. Just because it happens a lot in our industry doesn't change that.
Re:Coding practices (Score:2)
As one who is currently building and airplane, I'd like to say that this is only Step 1.
Step 2. You devise back-up systems, or design the system so that a failure is contained and won't matter. The electric trim system is backed up by a manual trim system. If the alternator fails, you have enough battery to run at least 3hours (time
Re:Coding practices (Score:2)
You show me code that the output of which can't be predicted or determined, and I'll show you evidence of a bad coding practice.
Did I say the output of code couldn't be predicted? I just said "some things" can't be predicted -- because your software will be used in ways or environments or in conjunction with things completely outside your frame of reference. And while all your output may be perfectly valid, there may be vulnerabilities that never existed in your sandbox, in fact should not be possible,
Re:Coding practices (Score:3, Interesting)
Bad coding can take on many forms. The single hardest thing to get people to do is sanity-check data. I work in Perl and I swear by the -T switch (taint mode) because it forces me to verify that data passed in from the real world is in fact valid and doesn't contain any surprises. Now mind you, it can lead to some ugly-looking regexs, but if you're writing a CGI that calls fo
Re:Coding practices (Score:1)
In other news... (Score:5, Funny)
Sharp criticism for this product inspired Sony to offer $sys$CounterAttack, $sys$Peekaboo, and $sys$Shields to private induhviduals and security experts.
A $sys$spokes-person for Sony, who wishes to remain anonymous, says these products are the precurser to the $sith$ branded products that will ensure peace and justice in the galaxy.
Re:In other news... (Score:2, Insightful)
As much as I laughed at your post, i remembered that "microsoft and symantec were consulted to ignore the rootkit," meaning they knew damn well what it was and their lawyers advised them to feign ignorance for fear of fisticuffs with Sony.
Now Microsoft and Symantec are going to hang out together and tell us what the new threats are? I wish I could be there to voice concerns over the "private backroom deal for corporate interests" attack vector. It's an
Hey! The sky is falling! The sky is falling! (Score:4, Insightful)
I kind of see this ongoing "reporting" on internet security much like the Global Warming issue. There's lots of coverage, lots of angst, but it doesn't seem to generate any or enough action to proactively prevent eventual disaster (not making any endorsement or criticism about the Global Warming debate, btw).
There isn't a day that goes by where there isn't yet another major publication with yet another major story about yet another major security glitch with yet another major application from yet another major vendor. Frustrating.
In comparison and contrast to the GW issue, however, I think it's empirically clear the threat is real and eventually there will be (but I hope not) some catastrophic event with the internet. Yet the IT world strolls along day to day, without much really actively happening to prevent serious down-the-road problems. I attribute that partially to:
No solutions here -- keep nudging clients, friends, consumers to try alternative potentially "better" IT solutions, maybe it WILL get better before a major catastrophe... sigh.
Re:Hey! The sky is falling! The sky is falling! (Score:1)
The global warming threat is far from confirmed. There is overwhelming evidence to the contrary. And there have been catastrophic events to the Internet (not including the AOL invasion (ok, karma whore cheap shot. Laugh, it's supposed to be funny)). Remember Slammer, Melissa, and a handful of other fast moving worms that took out large portions of the network for several hours at a time? That was pretty catastrpohic. However, let's also remember that
Re:Hey! The sky is falling! The sky is falling! (Score:2)
I think if you'd read my post, you'd see I explicitly stated:
I was merely mentioning the behavior of the general populace is similar around both ongoing debates.
As for your contention that the internet catastrophe's have already happened, you pointed out some things that created inconvenience for many, but the net effect of those "events" were hardly catastrophic as you astutely pointed out in your next (but contradicting your po
Re:Hey! The sky is falling! The sky is falling! (Score:2, Interesting)
"Yet the IT world strolls along day to day, without much really actively happening to prevent serious down-the-road problems."
You say this as though there is some dereliction of duty among the IT folks. There are people (http://www.antiphishing.org/ [antiphishing.org], http://www.openantivirus.org/ [openantivirus.org]) working on these things. In their spare time too--right? It's quite apparent that your gripe is with M$ and the the general population that has bought into the monopoly, but there's only so much you can do with 6 billion Elvis
Re:Hey! The sky is falling! The sky is falling! (Score:2)
In comparison and contrast to the GW issue, however, I think it's empirically clear the threat is real and eventually there will be (but I hope not) some catastrophic event with the internet.
Well, I'd say we've either already had those catastrophes, or the Internet isn't vulnerable to what we think of as a catastrophe. When I think of catastrophe, I think of something that happens in a short period of time and causes wisespread damage that takes months to cleanup.
So.. either the various virus outbreaks, p
Yes, but I'm safe (Score:5, Funny)
Thank goodness I'm protecting my well-patched XP system with Norton and a Linksys router, so I'm safe!
This levee is rock-solid baby!
Get the actual report here (Score:5, Insightful)
This is the first year that they are pulling out specifically application and network devices/software. However, to anyone who reads Bugtraq [neohapsis.com], Full Disclosure [neohapsis.com], or VulnWatch [neohapsis.com], this is incredibly old news.
I suspect that the new attention is partly due to marketing and partly due to better tracking facilities by ISC.
Seems pretty generic (Score:1)
Nice to see, though, that the only Unix problems they talk about are misconfigurations. This isn't really accurate, but nice to see anyway.
What about Chinese attacks? (Score:4, Interesting)
Who's behind these attacks and what's being done to put an end to them? I'm tired of seeing Slashdot headlines about "poor Chinese people behind the Great Firewall" when they don't seem to be having any trouble hammering on my SSH door.
Re:What about Chinese attacks? (Score:1)
Over the past couple of days however, I have been watching my firewall logs, and 99.8% of dropped packets are from the Middle East or Asia. Out of those they seem to be split 10/90 - 10% are spam that take advantage of the messenger service in Windows, and the other 90% are worms targeting exploits foun
Re:What about Chinese attacks? (Score:2)
Re:What about Chinese attacks? (Score:1)
argh (Score:1)
Re:What about Chinese attacks? (Score:2)
Re:What about Chinese attacks? (Score:1)
Guess it depends on the net block you are on.
I have heard that most attacks orginate in the US. and use other servers as proxies. But I have no real evidence.
Re:What about Chinese attacks? (Score:3, Informative)
On linux, I use iptables with some rate limiting rules on "NEW" connections to only allow x number of connections per y minutes from any host:
That pretty much stops any brute force attac
Re:What about Chinese attacks? (Score:1)
Time the attack shifted to the CEO's office (Score:4, Interesting)
One way of reducing the risk of vulnerabilities is to impress on those who'd exploit them that they are highly likely to be caught and if caught will get shitcanned bigtime. I'd wager that the top 100 bad boys in Europe and the USA could be put out of action in a week with a combination of legal moves and political lobbying. It always puzzles me why the combined weight of the IT industry and all its billions are completely unable to do this. Maybe they figure that if you've already got the reputation of a dung-encrusted fly you won't sink any lower if you look the other way, sigh and pass the buck to the little guy at the end of the chain while getting on with the day job of busting grannies for drm violations and trying to patent air.
I'm grateful for these reports from SAN and others. They remind me that IT industry deserves no support at all until it is prepared to take responsibility for the consequences it creates.
Re:Time the attack shifted to the CEO's office (Score:1)
I think this is one of the messages that SANS is trying to get out - that these vulnerabilites are TREATED like weather by many companies and are NOT controlled in a systematic way.
So, SANS releases a very famous list of the "top 20 volnerabilities" this quarter - its a well thought out and well researched list. I think your beef is unjustified, I say with respect.
SANS (Score:3, Interesting)
There is a huge unaddressed problem here... (Score:2, Interesting)
The problem is that many of the vulnerabilities have been sitting there for YEARS before they're discovered by the establishment. Take Blaster for example... how long wa
Correlates with earlier research (Score:2)
A different view (Score:2)
What worries me is the ability of attackers to do real-time attacks on a service. To hit a system that they k
attack shift? or change in strategies? (Score:5, Interesting)
IMO hardware vulns are best used to extort businesses, and are no good for terrorism. The DOS, which used to be seen as a tool for revenge, is now used as a tool for extortion. Being able to shut down some business' router, and keep it down, is in the end far more effective than trying to build a small army of bots to packet flood the same router. Master Sun Tzu reminds us: "Therefore those who win every battle are not skillful... those who render others' armies helpless without fighting are the best of all."
That's the science of Internet Warfare.
Attack Shit? (Score:1)