Living In an Unsecured World 112
GhostX9 writes "Charlie Miller, Accuvant Principal Research Consultant and keynote speaker at NATO's recent International Conference on Cyber Conflict, speaks with Alan Dang of Tom's Hardware about living in an unsecured world. He goes over his recent MacBook battery exploit and the challenges of computing security in the upcoming future. Quoting: '[W]hat we can do (and this is the approach the industry is sort of taking) is make it so hard and expensive to pull off attacks that it becomes economically infeasible for most attackers. ... The way we make it more difficult is to reduce the number of vulnerabilities and ensure users' software is up to date and "secure by default." Also, make the OS resilient to attack with things like stack canaries, ASLR, DEP, and sandbox applications so that multiple exploits are needed. We also need to better control the software loaded on our devices (i.e. Apple's App Store model). So, instead of having to write a single exploit, it takes three or four in order to perform an attack. This means most attackers won't be able to pull it off, and those who can will have to spend much more time working it out.'"
Unsecured world? (Score:5, Interesting)
When, if ever, has the world been secure?
Mankind is flawed, you cannot patch this flaw. You can only mitigate the flaws.
Re: (Score:2)
"It only takes one."
Doesn't matter how much time you spend hardening your system. If there is a single exploit in your system every piece of malware will use it.
I always raise an eye brow to "The less vulnerabilities we have, the more secure we are." It's not like you need to double root a system. One root kit is enough.
Re: (Score:2)
Yes, but the more vulnerabilities there are the quicker it is that an attacker is going to find it and the more kits that can root the system. Sure one vulnerability is enough, but the fewer there are the more they're going to need to want that particular machine to actually finish up.
Re: (Score:3)
Targeting Humans (flawed) is the quickest and easiest way to exploit a system. This is Mitnick 101. It is why Nigerian scams and click loaded malware works, even to this day.
Re: (Score:2)
Doesn't matter how much time you spend hardening your system. If there is a single exploit in your system every piece of malware will use it.
Not true. Like the joke goes, I don't need to outrun the "bear", I only need to outrun the majority...
Re: (Score:2)
We may have never achieved security, but we have always sought to increase it.
The sky is falling? (Score:1)
Re: (Score:1)
Would you feel so secure with your windows if anyone from anywhere in the world could break them? If they could break yours and thousands of others automatically with the same amount of effort? If it would take a team of experts months of effort to track down a single perpetrator - assuming he screwed up along the way?
Or would you accept that there's an inherent danger when an attacker has physical access to your windows, but try to make remote/anonymous window-breaking as difficult as possible?
My analogy
Re: (Score:2)
Re: (Score:1)
Absolutely, and it should (and probably will) be run very differently in the future.
I just wanted to point out that the idea that windows and the internet have two very different risk profiles, and it's ludicrous to dismiss efforts to improve internet security because "people have windows"
Re: (Score:3)
A vulnerability we should have to deal with no longer!
Sincerely,
The Year of Linux on the residential exterior
Re: (Score:3)
A vulnerability we should have to deal with no longer!
Sincerely, The Year of Linux on the residential exterior
This is /. I'm guessing most people here already don't have windows. Basements rarely do.
Re: (Score:2)
Windows 7 on my desktop, laptop, and netbook. Despite the historic opinion of Windows around here, 7 provides a very solid, stable, and importantly, a usable desktop environment.
Re: (Score:2)
I make do with live emperor penguins embedded into the walls!
Sure, they're angry, they smell bad and they don't let in any light, but it makes attackers think twice!
In a world without (Score:2)
In a world without MSWindows, who needs MSWalls?
Security through obscurity (Score:2)
Re: (Score:2)
I think he's implying something more along the lines of exploit vectors.
For example, if a successful exploit requires that the user simultaneously download and run a malware app while an already installed app is opening an external connection while at the same time an inbound connection attempt is made, your chances of being infected drop quite a bit and the work needed to pull it off as a malware author goes up, possibly to the point where it's no longer worth it in most cases. It also perhaps increases th
... like Apple's App Store model (Score:3, Insightful)
No Thanks.
Re: (Score:2)
Re: (Score:2)
indeed. When I saw this quote:
... all I could think was, 'No, more like the Linux RPM/Deb model that's only been around for... what? a couple of decades? And which offer far better prices, control and access to the market. So much so that, for all its popularity, Apple's Store is -at best- a pale approximation of a viable software management model."
An even more restrictive model (Score:2)
If the app store is the best model they can think of, then time to hand in the fricken geek badge.
They could have proposed an even more restrictive model, namely that of video game consoles. One can't even get started developing for a console unless affiliated with an established company with "industry experience" (that is, having already published a commercial game on another platform).
Re: (Score:1)
When I saw the quote, I was reminded of those politicians who want us to give up our freedom ‘to make us secure’. I think he can stick his app store where the backlight don't shine.
Re: (Score:1)
"far better prices" (Score:2)
'No, more like the Linux RPM/Deb model that's only been around for... what? a couple of decades? And which offer far better prices, control and access to the market.
If by "far better prices" you mean zero as the only available choice, then how are people supposed to cover the cost of developing high-quality video games or tax preparation software [pineight.com]?
Re: (Score:2)
If by "far better prices" you mean zero as the only available choice, then how are people supposed to cover the cost of developing high-quality video games or tax preparation software [pineight.com]?
By running their own repo/PPA, or paying someone else to broker that service, and only allowing access to paying customers.
To be perfectly clear: I'm not saying you have to use only your distro's repositories. I'm saying that the Debian/RedHat repo model is a way, way better example of secure software delivery than the Apple App Store.
Re: (Score:2)
Not necessarily. It means actually spending money to do QA, uniting developer teams, using fuzzing to explore hacking your own code, and low-hanging-fruit examinations of your code. For a long time, certain OS versions just didn't do any of that.
Operating systems were designed for geeks, not civilians. Civilians have money; so the scammers wrote exploit code for profit. Child's play script kiddy junk. Real coders got involved and went for bigger money. Now it's out of control, and Anonymous and LulzSec make
captain overlooking the obvious (Score:2)
This means most attackers won't be able to pull it off, and those who can will have to spend much more time working it out
So the theory is that making systems harder to hack will dissuade hackers, thus making all computers secure forever. It's too bad this is such a novel theory and no one's ever tried to harden existing systems against hacking otherwise we might have some empirical evidence to support his plan.
Oh what's that? The entire history of hacking is one of ever more elaborate and clever security precautions being overcome by ever more elaborate and clever hackers? One side cannot ever declare victory and rest on i
Re: (Score:1)
Re: (Score:2)
Oh what's that? The entire history of hacking is one of ever more elaborate and clever security precautions being overcome by ever more elaborate and clever hackers?
You forgot the part where they just wrap their malware in a 'Free B00b1es' screensaver and people download and install it for them.
Re: (Score:2)
You forgot the part where they just wrap their malware in a 'Free B00b1es' screensaver and people download and install it for them.
I think that's what the reference to Apple's App Store was intended to fight. One has to social engineer not only the user being attacked but also Apple.
Re: (Score:2)
It does work, the problem is that you have to really secure the applications not kinda sorta secure them. And in practice folks rarely manage to secure them enough to remove the profit motive from breaking in.
Re: (Score:2)
Of course there are two types of black hat hackers. One group, the private enterprise, distribute their attacks so that they kind hide their criminal activities behind the activities of script kiddies. The other type the government professionally paranoid black hat hackers tend to keep their attack secret until they use them of course corruption in those organisations means attack methods can leak out.
I wonder how many out in the wild attacks had their origins in the offices of the professionally paranoi
Re: (Score:2)
As much as I like BSD and use Linux, it's not inherently anymore secure in that respect. Somebody does still need to go through the code and audit it. And not just one somebody, really a whole team of somebodies doing it regularly.
In practice though, I've never worried about software that I install in that respect because I have means of securing the system beyond just trusting my sources.
Re: (Score:1)
it's not inherently anymore secure in that respect
It isn't and it even introduces a single point of maximum vulnerability (1. crack the repo, 2. ???, 3. profit!). However, compared to having to hunt for programs on-line it is inherently more secure. You might take your programs from download.cnet but all they do is run a virus scanner. A recent article [slashdot.org] about 'open source' software being bundled with malware makes me glad I can do apt-get install with less worry.
audits? Did I hear someone say openbsd? (Score:2)
Almost all major distros have audit processes of some sort. That's the only reason we have not already seen rogue engineers introducing trojans directly into the kernel and/or tools.
They could be better, but we need more guys like Theo DeRaadt to lead the audit teams, which presents a sort of dilemma.
One word: Chromebook! (Score:5, Funny)
I love mine and know it is secure by the simple reason that no one has sold enough to make it a worthwhile target.
Re:One word: Linux! (Score:2)
Linux does not have the market share either.
The other reason is you hardly ever load software onto it. The other problem with your theory though is chrome (browser) has a massive (relative to Linux) market share, I wonder how long it will be before a persistently open tab could become an "attack vector".
Re: (Score:2)
Actually, paraphrasing the great line from Soylent green, "Chrome OS is made of SUSE"!
So, it is Linux. It just has anything not needed removed and all the posts not needed locked up. It's *prolly very secure in it's own right.
I had a Samsung Galaxy Tab 7", and replaced it with the Chromebook. It is great as an internet appliance with a real keyboard.
Re: (Score:2)
Actually, believe it or not it is based on Gentoo - at least the package management aspects are. The end-user experience is pretty appliance-ish.
One thing going for Chrome is the fact that it uses secure boot, so that greatly limits attack vectors, and if you do manage to get temporary control the next OS upgrade is going to fix that, unless you manage to somehow block those (and that will be even harder to do without tripping the signature checks). And, it is pretty trivial to re-image in the absolute wo
Re: (Score:2)
So your saying they are not only useless to users, but useless to virus writers also?
Re: (Score:2)
it's a pretty good target for js malware. but the sales and use numbers are so low, you might as well target beos.
Re: (Score:2)
Very well. (Score:5, Insightful)
So long as said security doesn't inhibit my ability to use my machine entirely as I wish, and doesn't treat me as an enemy as well.
Like The Old Joke (Score:3, Insightful)
This reminds me of the old joke:
Alice and Bob are camping when they get attacked by a hungry lion. Running away at top speed, Alice begins to overtake Bob. "We'll never be able to outrun it!" says Bob. Alice replies, "I don't need to outrun the lion - I only need to outrun YOU!"
In that sense, all the security any given person needs is just not to be low-hanging fruit.
Re: (Score:2)
Re: (Score:2)
This reminds me of the old joke:
Alice and Bob are camping when they get attacked by a hungry lion. Running away at top speed, Alice begins to overtake Bob. "We'll never be able to outrun it!" says Bob. Alice replies, "I don't need to outrun the lion - I only need to outrun YOU!"
In that sense, all the security any given person needs is just not to be low-hanging fruit.
That joke is only about encryption if the bear's name is Carol.
Re: (Score:2)
Two guys are out camping in the woods, and the discussion turns to bears. One of them has a monstrous cannon of a pistol he lugs around all day, but it gets heavy by the end of the day. The other guy shows him a tiny .22 pistol,
A: "This is what I carry. All I need for bear."
B: "Are you kidding? You won't even slow down the bear a little bit with that thing."
A: "I wasn't going to shoot the bear.
Moral of the story: Increase your own security a little bit, and encourage everyone else to be less secure,
Re: (Score:2)
Yup, if you want to survive WWIII your bomb shelter is only going to be as useful as its defensibility.
This Is The Wrong Way, Period. (Score:2, Interesting)
Yep with capitals on every word.
So you see every security researcher and their friend claim how good it is to have long, strong unremembered passwords for each of your 1000 services.
They also want to have a million software work-arounds to manage flaws in the current software and operating system design. Such as ASLR, canaries, what not - then make your believe your system is, I quote again, RESILIENT. Nothing less! Your OS fights back for you and has multiple layers of security! (which usually are all bypa
Re: (Score:2)
Well, considering that remotely-exploitable network-stack-level overflow vulnerabilities are almost completely gone, either the programming techniques have improved, or these technologies are helping.
I would like to point out that the pervasive attitude at Sony seemed to be one of "well, nothing is perfect, so we don't need to spend too much money doing our best".
On the other hand, building a secure OS from the ground up IS the right approach, and I'm sure Mr Miller would agree, but, the simple fact is that
start by taking time to a non rush job and do QA (Score:2)
start by taking the time to a non rush job and do a lot more QA / testing. Also usability testing needs to be done as well.
auto testing can help but it does not cover all things / leads to coding to pass the test missing the stuff that the test does not cover.
Tolerance (Score:2)
Stop makeing us change passwords each month or les (Score:2)
Stop makeing us change passwords each month or less and cut back on the pass word rules Ti5@j0ke is way to pass with out needing to use a post it and next month it's P@ssw0rd2!
Re: (Score:2)
Listen, I do computer security audits and penetration testing and we break into 90% of the companies we attempt to break into. The simple fact is that password complexity and password changes is probably the #3 biggest risk in the enterprise, aside from simple patching and configuration/hardening issues.
Through a combination of techniques, we are able to obtain password hashes of various values. Frequently these are cached values. If you've ever logged into a windows workstation on a domain, your password
Re: (Score:1)
Active Directory cached credentials are salted. I've never seen RT files for anything other than the "administrator" account. It's a non-trivial hash.
But your point is valid.
He's mentioned everything except (Score:2)
Re: (Score:2)
I don't disagree with what you are saying at all, but I am curious:
Who is going to do the educating, exactly, and how? It's not like you can force people to learn things they don't want to learn. You don't need a license to use a computer or the Internet.
Make no mistake, there are actively, willfully ignorant users all over the place. They know what they need to do to learn more - use the computer more. But they don't want to, because using the system is not an enjoyable, rewarding experience. It's mor
Re: (Score:2)
Who is going to do the educating, exactly, and how?
At the moment, the only ones trying to teach people about security are frustrated IT workers. Every little bit helps, so if the gov't put some effort into it, quit doing campaigns for the RIAA and started doing something for their citizens, they could improve the situation quite a bit.
There are a lot of possibilities. From introducing security essentials into school curricula (who needs to be taught Powerpoint?), to encouraging companies to take action to safeguard their own data (the recent hacks should be
Re: (Score:1)
Umm, no. The user should not have to worry about security. It should be secure by default. The burden of security should be placed on the thousands of software engineers instead of the millions of end users.
Re: (Score:3)
Re: (Score:1)
You can't educate willful indifference.
Users KNOW they should have strong passwords, but consistently, in my security audits of big companies without technical controls in place to prevent it, 30% or more of passwords are crap like "master" and "cookie" and "god".
I'm not kidding. People DONT see value. Even if they do, they think... "well, everyone needs to do that, but I am special". It's human nature.
Security is about fixing human nature, which is why it's so damn hard, and sometimes appears irrational
Re: (Score:2)
You can't educate willful indifference.
Users KNOW they should have strong passwords, but consistently, in my security audits of big companies without technical controls in place to prevent it, 30% or more of passwords are crap like "master" and "cookie" and "god".
I'm not kidding. People DONT see value. Even if they do, they think... "well, everyone needs to do that, but I am special". It's human nature.
Actually, you can to an extent.
The way I've educated my mom about secure passwords was to teach her how easy it was to crack her own passwords. And when I say teach, I don't mean to say that I broke her passwords for her. No, I showed her the script, explained it a little, and then I made sure she filled out some of the paths and that she ran the script herself.
That was half of the education process. The other half was to teach her how to make a password out of a long sentence of her choice.
Just explaining
Playing Catch Up (Score:2)
"...and I am an unsecured girl"? (Score:1)
Is that how it goes?
personal computer security = personal hygiene (Score:2)
Of course, it makes sense that a security consultant would want to centralize security even more. He would profit from such centralization, but he wouldn't profit from ensuring that we get better security.
In my opinion, computer security should be approached just like a public health issue. We should teach people good computer hygiene, just like we teach people about proper personal hygiene. Granted, this approach is not going to solve every problem, and this educational effort would have to be never ending
Curious question (Score:2)
One curious part of the interview is when Alan Dang write: "But it seems like in today's world, the end-user is playing a less important role. The end-user with the latest software updates who is also savvy to social engineering cannot protect himself against hackers who steal credit card data from Sony."
This is incorrect: many banks sell "virtual" credit cards services: these CC number work only for one purchase, so users can protect themselves.
But the sad part in this case is that it's the security consci
Several design issues with hardware and software. (Score:3)
The problem of seccurity starts with CPUs, goes through the operating system and programming languages, and ends up to the communication standards.
The problem with CPUs is their horrible security model: it is either user or kernel mode for an application, there is no other security mode. This means that once an app is compromised, and foreign code is executed, all sorts of nasty things can be done. A more finegrained CPU security model would offer much better security, allowing software components withihin the same process space to coexist without affecting each other.
The problem with operating systems is that their security model is based, again, on the guest/administrator model, i.e. it is actually the same security model as the one used by the CPUs. A better security model would allow software that communicates with the outside world to run with less privileges than the user, thus saving the user from being compromized when malicious code. Furthermore, operating systems resources are not virtualized for the user, requiring access to administrator rights for jobs that could not require such rights.
The problem with programming languages is that the most used programming languages for system programming are too open for abuse. I am talking about C/C++, of course. Take Windows, for example: hundreds of buffer overflows bugs, because C does not do bounds checking on arrays. If C was designed with safety first, performance second, and made checked array access the default, and unchecked array access explicit, less security issue would exist.
Finally, communications over networks should have been encrypted by default, and only revert to unencrypted when it did not hurt to do so. The encryption support cost would have been minimal by now, as with all technologies that start expensive and get cheap as they are massively produced.
PKI issue (Score:2)
Finally, communications over networks should have been encrypted by default, and only revert to unencrypted when it did not hurt to do so.
In the system you propose, how would each party know the other's key?
Re: (Score:2)
Each part would know the other's public key by exchanging public keys on communication initialisation.
In order to avoid man-in-the-middle attacks, a solution like verifying the other part's public key by a different route could be used.
CA, WOT, or Perspectives? (Score:2)
In order to avoid man-in-the-middle attacks, a solution like verifying the other part's public key by a different route could be used.
I can think of three sorts of "different routes", none without drawbacks:
Re: (Score:2)
How about verifying the public key by uploading it to an email account, like Mozilla's single sign on system?
Re: (Score:2)
The problem with CPUs is their horrible security model: it is either user or kernel mode for an application, there is no other security mode.
Wrong. The x86 architecture alone has numerous rings. Five I think? No mainstream kernels use more than two of those rings.
The problem with programming languages is that the most used programming languages for system programming are too open for abuse. I am talking about C/C++, of course. Take Windows, for example: hundreds of buffer overflows bugs, because C does not do bounds checking on arrays. If C was designed with safety first, performance second, and made checked array access the default, and unchecked array access explicit, less security issue would exist.
C is just a tool. How a tool is used is a methodology. The tool is not at fault, the methodology is. Even with a good methodology, you just can not have morons at the console writing the code. I know, business owners dream of a world where they can have low-cost interchangeable morons writing code. That is not going to ever happen (reliably).
Finally, communications over networks should have been encrypted by default, and only revert to unencrypted when it did not hurt to do so. The encryption support cost would have been minimal by now, as with all technologies that start expensive and get cheap as they are massively produced.
I think Phil Zimmerman is the name of a guy y
Re: (Score:3)
FTFY
Re: (Score:1)
To give Microsoft their due, I think Windows (that is to say Windows NT on which current Windows is based) was quite specifically designed for security. Remember the NT kernel was designed by guys stolen from Digital who had worked on VMS. What seems to have gone wrong is that Microsoft has different priorities from their customers. Uncontrollable automatic installation of things like Active X was done because they wanted their new system to push others out of the market place. Look at the big recent p
Re: (Score:2)
There's also the issue that security is annoying. Whether it's changing your password monthly or something non-IT related like checking badges at the lobby, security is a pain in the ass, and a lot of people would rather install the security infrastructure and then bypass it. Hell Feynman used to tell the story of the general at Los Alamos who ordered a zillion dollar uber-safe to store the secrets of the bomb in, and then never bothered to change the factory combination.
One reason UAC and the other recent
Re: (Score:2)
Re: (Score:2)
There's also the issue that security is annoying. Whether it's changing your password monthly or...
I've never understood why "change your password monthly" has become the poster child for security advice most often mandated by IT departments. On the list of things to make security stronger, this wouldn't even be in the top one hundred, and in fact, I suspect frequent password changes make security weaker.
("Never use the same password on two different systems" would have been my number one choice for advice.)
Re: (Score:2)
I've always thought it was a butt-covering method. "Yeah, we had a data breach but we're taking proper security measures. We make them change their password every month!"
You're right - it makes it less secure. Everyone at my office writes their pw down and stores it somewhere around their desk.
Re: (Score:2)
Re: (Score:1)
Re: (Score:3)
Computers weren't designed for security. They still aren't. We shouldn't feel bad though, 'god' didn't do much better.
A lot of Apple fans will disagree with that last part.
Re: (Score:2)
Computers weren't designed for security. They still aren't. We shouldn't feel bad though, 'god' didn't do much better.
Modern ones maybe not. Many older ones, back when a big buyer was the military, and some smaller ones still designed for such areas, are. What we have now is an upgraded micro-controller architecture with security bolted on the back. The problem isn't that we don't know how to do security much better. The problem is that nobody who's building the systems cares enough.
Re:Fundamental design flaw (Score:4, Informative)
switch to openbsd :)