Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×

Why All The Hype About 0day? 85

Posted by Zonk from the look-backwards dept.
nuthinbutspam writes "Michael Sutton has up an interesting post on the security vulnerabilities that we really need to be concerned about. According to Sutton, it's not the new ones that are scary, it's the old ones that have long since been forgotten. He illustrates his point by walking through an example where he uses Google and Yahoo! to identify 50 web servers that are wide open to attack. The list includes an ivy league school, various colleges and a company traded on the NYSE. Sobering stuff."
This discussion has been archived. No new comments can be posted.

Why All The Hype About 0day? More

Why All The Hype About 0day?

Comments Filter:

  • All security is important (Score:5, Insightful)

    by Tyger ( 126248 ) on Friday September 01, 2006 @05:26PM (#16027344)
    I think that qualifies as a well duh. If you haven't secured yourself against old vulnerabilities, worrying about zero-day vulnerabilities won't do you much good. On the other hand, if you're on top of security, staying in touch with the latest vulnerabilities has some real value. It's common sense. To use a bad analogy, if someone is suffering from a hear attack, you don't stop treating them because you notice they have a scratch that needs a bandage.

    • Phrased slightly differently ... (Score:5, Insightful)

      by khasim ( 1285 ) <brandioch.conner@gmail.com> on Friday September 01, 2006 @05:32PM (#16027376)
      If you, as the admin, haven't secured your systems for KNOWN vulnerabilities, then you probably aren't one of the people concerned about 0 day exploits.

      On the other hand, those of us who DO secure their systems ARE concerned. And rightfully so.

      • Re: (Score:2)

        by Tyger ( 126248 )
        I'd go so far as to say that those who actually follow zero day vulnerabilities (When they are still zero day, before the media hype starts) probably have their systems secured. It's the people who read about it in a trade rag or on a website and jump on the bandwagon that are the dangerous ones.
      • Let's all pat ourselves on the back for doing our jobs.

        And curse the miscreants who are now mere irritants to those of us who do, many of whom are inside the castle walls.
      • ....would work to keep a tool kit of their own "zero-day" exploits handy for that day when they need or want to gain access to something in particular where the admin is doing the work of applying patches.

      • Re: (Score:1, Interesting)

        by Anonymous Coward
        I'm suprised that nobody has caught the fact that this could very well be flawed research, after all it's a blog post and not a whitepaper.

        If I went around the day that Microsoft released the August patches I'd probably find that most if not all of the computers I was able to check were in fact *not* patched. Now, checking a few days later, or to cover those that wait a week or even a month I'd probably find a much larger number that are patched. I'd also probably find those pesky Ivy Leauge computer n

    • Re:All security is important (Score:5, Insightful)

      by LurkerXXX ( 667952 ) on Friday September 01, 2006 @05:59PM (#16027507)
      No kidding. Shocker. He found some machines at Universities, etc, that hadn't been patched in a long time.

      How is that surprising? Does he think that never does some department set up a small server for itself, then in a couple years, the person admining it leaves, and since the machine is still 'working', people continue to let it run/use-it. After a while, running with no admin, it gets way out of date on patches and is vulnerable to anybody. Happens all the time. And it's got absolutely nothing to do with an active and competent admin worrying about 0-day exploits on the boxes that they ARE taking care of.

      • Re: (Score:2, Insightful)

        by vmfedor ( 586158 )
        So you just assume all those exploitable machines are "junk" machines that are left running in a closet somewhere? I would never want you to administer *my* network, bub. What if one of those junk machines could be exploited to give access to the more useful machines in the network? Or what if they weren't junk machines at all? If the admins of that network can leave easily exposed machines running what kind of security model do they have anyway? And if those machines are vulnerable to those old exploi

        • Re: (Score:3, Insightful)

          by LurkerXXX ( 667952 )
          Wow, insulting me because I said it was no suprise. Who pissed in your corn flakes?

          I didn't say every machine was a 'junk' machine, but if you have any experience at Universities, you often will see departments 'doing their own thing' when it comes to departmental servers, where the IT department of the University is not involved in their administration at all other than supplying an IP-address/DNS. The IT department's 'security model' is usually for machines directly under their control. Not the computer

  • Wrong Perspective (Score:5, Insightful)

    by 99BottlesOfBeerInMyF ( 813746 ) on Friday September 01, 2006 @05:33PM (#16027379)

    Michael Sutton has up an interesting post on the security vulnerabilities that we really need to be concerned about. According to Sutton, it's not the new ones that are scary, it's the old ones that have long since been forgotten.

    The old ones may be the most worrying to people tracking security in general. They are not, however, the most worrying to those of us looking to secure our own networks, since we know how to stop them. It is a matter of control. I can patch and Firewall, and ACL away any old worms and detect them if they get through. I might be helpless, however, if a new, zero day worm hits.


    • Zero-day exploits also, after time, become old ones ;) They also caused hassle for home users a year or so ago when their newly unboxed Windows XP SP1 box to the internet and get hit with Sasser before the Windows Update site even loads....
      • just a hint have a SP2 patch cd and a current copy of autopatcher + your "toys" disc on you when you bring a unknown state computer online.

        Hint don't connect the network cable until you have finished all of your cds

    • Re:Wrong Perspective (Score:5, Insightful)

      by Aadain2001 ( 684036 ) on Friday September 01, 2006 @06:09PM (#16027554) Journal
      Don't forget, no matter how much you firewall or patch or try to secure your systems and network, you can never truely protect yourself from an uniformed user. All it takes is one user getting their personal laptop infected and putting it back on the corporate network for it to attempt to spread. And all it takes for the it to take hold in the network is a couple of developement boxes that some group has forgotten about for a few years and forgotten to patch. And while your most important systems remain protected, worms and viruses can still cause havok by flooding the network, sending out bogus emails, etc. And then you have to take time off your projects and track down those old boxes and deal with their owners. So yes, while old problems are not hard for you to protect against, never forget the other person who doesn't know how to protect themselves and how they can still effect you.

      • Re:Wrong Perspective (Score:5, Funny)

        by djmurdoch ( 306849 ) on Friday September 01, 2006 @06:36PM (#16027656)
        Don't forget, no matter how much you firewall or patch or try to secure your systems and network, you can never truely protect yourself from an uniformed user.

        You're right. These days those uniformed users don't even need warrants.
        • LOL, yet another case where a built-in spell-checker (ala Gmail) would be very helpful on /.

          • Re: (Score:3, Funny)

            by sgbett ( 739519 )
            Why so? Was uniformed spelled wrong? ;)

          • Re:Wrong Perspective (Score:5, Funny)

            by EvanED ( 569694 ) <evaned&gmail,com> on Friday September 01, 2006 @07:49PM (#16027980)
            Eye halve a spelling chequer,
            It came with my pea sea,
            It plainly marques four my revue
            Miss steaks eye kin knot sea.

            Eye strike a key and type a word
            And weight four it two say
            Weather eye am wrong oar write
            It shows me strait a weigh.

            As soon as a mist ache is maid
            It nose bee fore two long
            And eye can put the error rite
            Its rarely ever wrong.

            Eye have run this poem threw it
            I'm shore your pleased two no
            Its letter perfect in it's weigh,
            My chequer tolled me sew.

      • Re: (Score:3, Insightful)

        by ezratrumpet ( 937206 )
        Sometimes all the protection is on the ethernet connection, leaving one or more drives unprotected. A malicious user with a floppy or a thumb drive can make short work of a network through those holes.

  • simple (Score:4, Funny)

    by scenestar ( 828656 ) on Friday September 01, 2006 @05:33PM (#16027380) Homepage Journal
    Release The exploit in a form so easy even the most assbackwards 13 yearold skiddie can use it on his Dell.

    Just wait and see how long it takes before it gets patched.

  • *sigh* (Score:3, Funny)

    by hnile_jablko ( 862946 ) on Friday September 01, 2006 @05:36PM (#16027400)
    *looking at watch waiting for compulsory relation to terrorism analogy and the ubiquitous overlord welcoming*
    Please troll me up, I am aching for some negative karma.
  • Either you care or you don't and get abused and will take your responsibility when your machine is being abused to abuse other machines.
    Take your pick.

    • Re: (Score:3, Funny)

      by dhasenan ( 758719 )
      Or you don't care and you deny responsibility when your machine is being abused. That's the most popular way.

  • Security is simple (Score:4, Insightful)

    by ZorbaTHut ( 126196 ) on Friday September 01, 2006 @05:44PM (#16027444) Homepage
    The most dangerous vulnerabilities are the ones people don't know about. Whether that's because they haven't learned yet or because they've forgotten is immaterial.

    That's why Step 2 of making a truly secure network is to assume "everything I have done so far is wrong and my server is slightly less airtight than a block of swiss cheese infested by cheese-eating termites".

    • Re:Security is simple (Score:5, Funny)

      by Kesch ( 943326 ) on Friday September 01, 2006 @05:52PM (#16027482)
      ... assume "everything" I have done so far is wrong and my server is slightly less airtight than a block of swiss cheese infested by cheese-eating termites.


      You just HAD to drag the French into this.
    • The parent is totally correct. I guess step 3 would be running every tool that you can think of to test for vulnerabilities (after you have assumed everything you have done is wrong and have patched/locked down everything to the most restrictive policies possible whilst still allowing the system to function). As most people know, nessus [nessus.org] is one of the best programs for vulnerability testing.
      That just leaves step 1?
      • Step 1 would be to secure everything as well as you can. :)

        (Within reasonable limits based on cost and accessibility, of course.)
      • I guess step 3 would be running every tool that you can think of to test for vulnerabilities

        Whoa, slow down there. If I've learned anything from reading Slashdot, it's that step 3 is always "Profit!". Clearly, since your step 3 is NOT "Profit!", you've made some kind of mistake. Might want to look into that.

  • Ivy League school was Harvard (Score:4, Informative)

    by TornSheetMetal ( 411584 ) on Friday September 01, 2006 @05:47PM (#16027453)
    Following direction on the site, it was a wiki at Harvard with the remote vunerability:
    http://hcs.harvard.edu/~freeculture/wiki/index.php /Special:Version [harvard.edu]

    • Re: (Score:2)

      by Kesch ( 943326 )
      Odds are an MIT student has already read this and Harvard is about to get 0wn3d in a creative and hilarious way.

    • Re: (Score:3, Interesting)

      by Fnkmaster ( 89084 )
      Which is on a random guy's personal site on the Harvard Computer Society web server, run by a volunteer student group. Nothing really to see here.

      Any school that has an area where any student can put up arbitrary PHP code is going to have tons of sites with vulnerabilities.

      It's not on an official school server, and presumably the hosting on such sites is set up with sufficiently tight permissions to prevent any serious damage from being done if people run arbitrary, crappy PHP code.

      Nuff said on that vulner

      • Re: (Score:2)

        by jZnat ( 793348 ) *
        Well, it's an Ubuntu box, and MediaWiki 1.5.0 is running on it along with an old version of PHP 5.0 and an ancient version of MySQL.
    • Sure 'nuff. HCS gets hacked occasionally, usually because our users toss up insecure stuff and then don't patch it. Free Culture ought to know better though, they have a lot of computer geeks in there, including half the HCS board.

      We'll get it patched at some point, probably in a few weeks when school starts. Right now we can't patch it because we're running an ancient MySQL, and we can't patch that because we'll have to migrate all the databases, and we're too lazy to do that (plus, if it fucks up there

  • warez (Score:1, Funny)

    by d0hboy ( 679122 )
    When I read this headline I thought it was talking about 0-day warez.

  • "Zero day" is a marketing gimmick (Score:4, Insightful)

    by Anonymous Coward on Friday September 01, 2006 @06:24PM (#16027615)
    The term "zero day" refers to the amount of time between a patch being available and an exploit being in the wild. That's all fine and dandy except it propagates the idea that exploits are never in the wild before a patch is available. It's not the "zero day" exploits that have me worried--it's the "negative three months" exploits.

    I have been in a meeting with a Microsoft security "expert" who seriously claimed that exploits are only be produced by reverse-engineering Microsoft's patches, and that the primary risk is that the time it takes to reverse-engineer a patch is decreasing. If that was really true, Microsoft could stop all exploits immediately by never releasing any more patches. The primary risk is that there's a flaw in the software, obviously, and the clock starts ticking the moment people start using the buggy software, not the moment Microsoft tells us to patch it.

    However, admitting that Microsoft is REACTING to hackers rather than the other way around makes them look kinda dumb. Thus the "zero day" myth.

    • Re: (Score:1, Insightful)

      by Anonymous Coward
      I always thought "zero day" referred to the time between a theoretical exploit becoming known to the security community, and when a viable attack is created.

      Normally you have some lag in there... People hear there's a weakness in some piece of software, and it takes the black hats a few days to come up with a way to attack that weakness. In the mean time folks are scrambling to harden their systems against the coming attack...security companies and software vendors are (supposedly) working on a patch...

    • Re: (Score:1)

      by fritzk3 ( 883083 )
      ...and here I was, thinking that this headline was referring to something else "0-day"... good old 0-day WAREZ!

  • Our little secret (Score:2, Insightful)

    by Plutonite ( 999141 )
    If you are in charge of an important network, you are always afraid.

    There are many things that can keep you comfy, like daily updates and 24/7 monitoring of advisories, but the professionals do not always submit their findings. Security gurus submit holes as part of their work or to get their name known or to make a point..but many will stay in the dark. The really serious ones will always have their own unreported set of vulns in various platforms, 99% of the time these are buffer overflows at the kernel l

  • Damn! (Score:1, Funny)

    by uberphear ( 984901 )
    So the article isn't about warez? Damn.. I was looking for teh l337 DDL linkz!1. Guess I should stop going by the titles...
  • I install security updates as I see the initial advisories posted. If you don't install them right away, they won't get installed and you will end up with situations where old vulnerabilities don't get patched. An old vulnerability got me once and I will do my best not to let that happen again.

  • It's a fundamental problem of the "security biz" (Score:2, Interesting)

    by Anonymous Coward
    A big portion of "0days" is the marketing hype and power. You can trade them, you give yourself street cred if you have some. It's a geek thing. Back in the day, there were virus exchange BBSes (yeah, you had to use a phone and dial up) and they'd let you download viruses until your heart was content but you had to upload one first. Some wanted a new one that couldn't be detected before they'd give you respect.

    Think about it, how do you get famous in security? You break something. Further, a lot of

  • "Looking backwards"? This story is a journal from nuthinbutspam (999551). Not only are Slashdot editors apparently publishing journals, but we're almost up to a million registered Slashdotters (and an infinitude of infinitesimal ACs). And the warning signal for the E6 milestone is "nuthin but spam".

    The future's so bright, I gotta wear shades of Max Headroom [google.com].
  • JohnnyIHackStuff is almost nonresponsive.

  • Now let's see a well written journal entry. (Score:3, Insightful)

    by kinglink ( 195330 ) on Saturday September 02, 2006 @01:28AM (#16028771)
    Hey zonk if you have a quota and need to fill it just by posting random journal entries, try posting one that doesn't used a bastardized form of a word like "0day". That was made for warez, not exploits.

    Btw the NYSE company isn't even named it coudl be any entertainment company from Universal studios to a small IPO that is making a casual game for people that costs 2 dollars, as well as single computer on a lan. With no meantion of if these are "honey pots" which will get people's attention but it will actually have no access to the real network since it's segregated.

    I think slash dot needs to stop posting "news that's not news" and start pointing "news that matters" again.
  • It surprises me that we are still having these kinds of security problems.

    A lot of it is due to to poor configuration conventions that continue to this day. This involves running servers as root, and a system setuid root programs, such as X. I am quite perplexed that simple steps have not been taken to remedy these problems, such as by running X under its own user and only giving that user access to the video hardware that X needs to run.

    Setuid root is a problem since if there is a vulnerability in a server

Slashdot Top Deals

"Tell the truth and run." -- Yugoslav proverb

Close