Want to read Slashdot from your mobile device? Point it at m.slashdot.org and keep reading!

 


Forgot your password?
Close
typodupeerror
×
Security Businesses Privacy IT

Security Hackers Interviewed 57

Posted by Zonk from the learning-from-the-blue-hats dept.
An anonymous reader writes "SecurityFocus has published an interview with Dan Kaminsky. He was guest-hacker at Microsoft Blue-Hat event. At the same time, Whitedust is running an interview with Richard Thieme from back in April. Richard is best known for his column 'Islands in the Clickstream' which is syndicated in over 60 countries." Thieme also wrote a column or two for Slashdot back in the day. From the Kaminsky interview: "Corporations are not monolithic -- there is no hive mind that can one day change every opinion towards some sort of 'rightthink'. Microsoft has said the right things about security for years, but then, who hasn't? Security requires more than PR, or even proclamations from C-levels."
This discussion has been archived. No new comments can be posted.

Security Hackers Interviewed More

Security Hackers Interviewed

Comments Filter:

  • "Blue hat" hackers (Score:5, Funny)

    by tpgp ( 48001 ) on Thursday July 21, 2005 @10:04AM (#13123721) Homepage
    Note to Microsoft

    We have more then enough hat colours as things stand.

    Blue Hat hacker sounds like an IBM employee anyway (or an Anti-Fedora agent?)
    • Yet another embrace-and-extend (YAEE?) by the boys in Redmond.

      • Enumerate all the possible colors of Hats and file trademarks on them (Purple Hat, Aqua Hat, Green Hat, Pink Hat, etc.) .

        Then, write a Perl script that does daily google queries for each color of hat. Whenever someone else starts using Aqua Hat, or Gold Hat or whatever, Write them a Cease and Desist Letter. Also have your script attempt to locate new names of colors. Then automatically generate Trademark applications for those names of Hats as well.

        File a Patent application for your Perl Script. Say i
    • I know, how about Red Hat hackers! oh wait...

  • Just like Customer Service (Score:5, Interesting)

    by WebHostingGuy ( 825421 ) * on Thursday July 21, 2005 @10:09AM (#13123765) Homepage Journal
    Duh.

    Security is a neat buzz word lately. We all "need" to do security, blah, blah, blah.

    Security is just like customer service. In order for it to be effective you have to ingrain it in a culture which places it as a top priority. It's obvious that most developers and corporations think of this as an after thought.

    Okay, we need functionality x and y. Great, now that we have it ... oh yeah, put a firewall in front of it. What, we were hacked? We had a firewall ...

    Just reading the article it shows that the developers were surprised someone can reverse engineer their code; they were "annoyed" someone created a graphical exploit. Annoyed? How about pissed? What about "motivated" to plug the hole. Obviously we weren't there to hear this first hand but it sounds like just an oh well we should do something about this. The article talks about a priority shift. Just another corporate slogan.

    If it was a true culture shift you would see something like: x company has announced the hiring of 1,000 new software programmers to create a new division of security. This new division will audit all code for potential security problems before any new programs are released.
    • My company is placing a huge emphasis on security. The developers and testers take lunch at least once a month to try and learn more about a different aspect of security, all of detailed designs are now being designed with security in mind it is no longer an after thought. The testers now test known security holes and are encouraged to come up with new security holes before the products are released.

    • Re:Just like Customer Service (Score:4, Insightful)

      by Nytewynd ( 829901 ) on Thursday July 21, 2005 @10:17AM (#13123842)
      If it was a true culture shift you would see something like: x company has announced the hiring of 1,000 new software programmers to create a new division of security. This new division will audit all code for potential security problems before any new programs are released.

      That would be followed immediately by "On IRC, 10,000 hackers were recruited to find holes in X Company's security measures."

      Security is a concern, but it is mostly exclusive from features. For 99.9% of the features you add, there is a way to make them secure. Unless the feature is to upload and execute random code I guess.

      The biggest problem with security is that you can't guard against things you don't know about. Hackers find holes, and then they get closed. It's hard to fill in a hole if you don't know it is there. In a way, for every hack that is exploited the fix makes things more secure than they were. Unfortunately there is a window of opportunity in between the finding and the fixing during which your pants are around your ankles.
      • The biggest problem with security is that you can't guard against things you don't know about.

        But this is the point. How can you secure code when you don't actively audit it? The reason why there are 10,000 holes is that companies don't have the mindset of features + security = release. It is first develop the features then release. And after the fact add security.

        It will take a huge culture shift to get that the concept that in order for programs to be secure they have to have security built in from
      • The biggest problem with security is that you can't guard against things you don't know about.

        Sounds reasonable, BUT.
        The entire purpose of security is to guard against things you don't know about. Otherwise it's too much like Monday morning quarterbacking.

        Finding holes is not particularly difficult. Just use it in unexpected ways and look for unexpected results. Closed source is pretty useless as a defence. The attacks are based on what the program actually does. The source shows what the programmer thin

    • Re:Just like Customer Service (Score:4, Insightful)

      by Effugas ( 2378 ) * on Thursday July 21, 2005 @10:18AM (#13123844) Homepage
      Lesse...

      1) Metasploit isn't a graphical exploit; it's a Perl shell, very well done, that made exploit development and deployment a far more reliable endeavor.

      2) They're pretty damn motivated -- not perfect, but way more than I've seen any corp. Like I said -- the "intro to security lecture" (people WILL find your holes, you WILL get attacked, etc) just didn't happen.

      3) 13 open reqs for just one consultancy I know of that's got security auditing gigs at MS. Yeah.

      4) I hadn't made the link between customer service and security. You're completely right about it needing to be a cultural element.

      --Dan
    • If it was a true culture shift you would see something like: x company has announced the hiring of 1,000 new software programmers to create a new division of security. This new division will audit all code for potential security problems before any new programs are released.

      The problem with this is that of the 1,000 employees, about fifteen, or 1.5% will be knowlegeable enough to find actual exploits or vulnerabilities.

      Because of this, about 95% (3.5% stick around to "manage" the 1.5% that do the work) o
  • Security is the last modism from the vendors, like terrorism is on our world today. We have a lot of products that "protect our networks", a lot of guys that keep on telling that "you need security". But you can see that all the people always says the same thing.
  • I am glad to see that Dan did not kowtow to MS despite being a speaker. MS cannot smoke and mirror us into believing the "Windows is secure mantra" by merely providing good, believable speakers. His comparing apples to apples was also a jab at the MS statistical spin machine.

  • Blue Hat? (Score:1, Insightful)

    by Anonymous Coward
    "(Hackers are) not just a bunch of disaffected teenagers sitting in their mom's basement. These are professionals that are thinking about these issues."
    --Noel Anderson
    Wireless networking
    engineer, Microsoft

    I can play both of those, a single-forty-year-old woman, a fresh-out-of-college jerk, a recently-made-available celebrity, a professional weatherman with agrophobia, or even an FBI/CIA/NSA agent with a hardcore case of "the powertrip", and you'll never know the difference.

    So why bother defining me? To h

  • Who is this clown? (Score:4, Interesting)

    by fdiskne1 ( 219834 ) on Thursday July 21, 2005 @10:46AM (#13124158)
    The interview with Dan Kaminsky, while heavy on the car/computer analogy still comes across as "okay". He provided some insight into what happened at the "Blue Hat Hackers" meeting with Microsoft. The interview with Richard Thieme left me awestruck. He is a spittin' image (interview-wise) as Jon Katz. Lots of buzzwords that didn't provide any information or insight. I feel as though I was a security expert forced to listen to a marketing person tell me why he is a security expert. That was painful and I'm not a security expert.
    • I rate highly Thieme's words on his site (Thiemeworks.com [thiemeworks.com] and his comments at Islands in the Clickstream [thiemeworks.com]), but the article linked from here is very hand-wavy and contains too much hot air.

      You may have to forgive the guy for continuing to process the world in terms of his religious background: the mystery at the Unknown Other, the power of the symbols we use to communicate Good and Evil, humanity's need for the company of other humans and the need to treat each other person with respect and dignity (althoug
  • Corporations are not monolithic.
    There is no hive mind that can one day change every opinion towards some sort of 'rightthink'.
    Microsoft has said the right things about security for years.
  • I'm sure that such events would be less boring if the spearkes were nice and wise girls, using some sexy lingerie. And a good name for that would be Black Underwear !
  • Another problem with metrics is that you can't "test in" security, and measuring security by the number of failures is really trying to do just that.

    You need to look at what the actual failures are, whether the kinds of failures are changing or not, whether there's a common cause to some class of failures and how hard it would be to address that common cause, and whether different systems tend to suffer from different kinds of failures.

    Buffer overflows, for example. Everyone gets hit by buffer overflows, there's a common cause, but some of the techniques you can use to address them are easier than others. Non-executable stacks, great. Easy to do, if the hardware supports it, and doesn't have much of an impact on the developers. Changing to a language where buffer overflows can't happen? That's hard.

    Code injection by playing quoting games, using '%2E%2E' or some complex Unicode string instead of '..', or telling me your name is '%34;cat%20/etc/passwd;echo%20%34'. Different symptoms, sometimes you can systematically fix them, sometimes you can't. A lot of what people think they know about these kinds of attacks is wrong, and they fix them badly and someone with a name like "d'Artagnon" finds he's a hacker.

    Sandboxes. Lots of bad information about these going around. Microsoft used to say sandboxes were a bad idea, too much overhead. I don't know if they still do, but they need to come up with a fully sandboxed inherently safe version of Internet Explorer... the sooner the better. Oh, and Firefox has been playing with fire here too... and Apple needs to quit trying to sandbox dashboard at all and just treat it as another application platform... before they end up with people depending on a sandbox that isn't really there.

    But the bottom line is, all the metrics in the world won't tell you whether these problems are things that vendors should be held directly accountable for, or whether they're the user's responsibility for configuring their systems correctly, or whether it's a third party plugin/cgi/component vendor that's the real problem.
    • Counting exploits is too much like traffic cops with quotas, and no incentive to go over the quota.

      With that, the nature of open source is find and fix and become a hero.
      Closed source would really rather that exploits not be published.

      To measure the relative security, imagine how hard it was to find the exploit. If they're finding low-hanging fruit, there has to be plenty left. If it takes heroic effort, then there are not so many left.

      OpenBSD publishes a security patch. Do you apply it? Likely not, sinc
  • Seriously, am I the only person who's sick of some public speaking rep from the biggest richest most powerful self professed technically exotic company on the planet snarkily explain to be why something is 'hard' or we're 'getting better' at something.

    Dan, MS security is for shit by any fucking metric you want to hurl at it. And no amount of hemming and hawing about hats and China and whatnot is ever going to alter the profound and terrifying reality of that a company larger than the GDP of fucking Belgium
  • Anyone wonder why this whitedust website is getting so much free publicity lately ? is it some how related to slashdot , or the slashdot editors ? i find 3 stories in a weeks time, kind of odd. they will approve a story about how to track down a fscking mac address, but they wont publish a story about how thousands of SS#'s just got comprised from a USC database.
  • Got this SYN packet from him with the following data in it:

    000 : 48 65 6C 6C 6F 2C 20 74 68 69 73 20 70 61 63 6B Hello, this pack
    010 : 65 74 20 69 73 20 70 61 72 74 20 6F 66 20 74 68 et is part of th
    020 : 65 20 44 6F 78 50 61 72 61 20 49 6E 66 72 61 73 e DoxPara Infras
    030 : 74 72 75 63 74 75 72 65 20 56 61 6C 69 64 61 74 tructure Validat
    040 : 69 6F 6E 20 50 72 6F 6A 65 63 74 2E 20 46 75 72 ion Project. Fur
    050 : 74 68 65 72 20 64 65 74 61 69 6C 73 20 61 72 65 ther details are
    060 : 20 61 76 61 69 6C 61 62 6

Slashdot Top Deals

One man's constant is another man's variable. -- A.J. Perlis

Close