Security Hackers Interviewed 57
An anonymous reader writes "SecurityFocus has published an interview with Dan Kaminsky. He was guest-hacker at Microsoft Blue-Hat event. At the same time, Whitedust is running an interview with Richard Thieme from back in April. Richard is best known for his column 'Islands in the Clickstream' which is syndicated in over 60 countries." Thieme also wrote a column or two for Slashdot back in the day. From the Kaminsky interview: "Corporations are not monolithic -- there is no hive mind that can one day change every opinion towards some sort of 'rightthink'. Microsoft has said the right things about security for years, but then, who hasn't? Security requires more than PR, or even proclamations from C-levels."
Just like Customer Service (Score:5, Interesting)
Security is a neat buzz word lately. We all "need" to do security, blah, blah, blah.
Security is just like customer service. In order for it to be effective you have to ingrain it in a culture which places it as a top priority. It's obvious that most developers and corporations think of this as an after thought.
Okay, we need functionality x and y. Great, now that we have it
Just reading the article it shows that the developers were surprised someone can reverse engineer their code; they were "annoyed" someone created a graphical exploit. Annoyed? How about pissed? What about "motivated" to plug the hole. Obviously we weren't there to hear this first hand but it sounds like just an oh well we should do something about this. The article talks about a priority shift. Just another corporate slogan.
If it was a true culture shift you would see something like: x company has announced the hiring of 1,000 new software programmers to create a new division of security. This new division will audit all code for potential security problems before any new programs are released.
Re:Just like Customer Service (Score:3, Interesting)
But this is the point. How can you secure code when you don't actively audit it? The reason why there are 10,000 holes is that companies don't have the mindset of features + security = release. It is first develop the features then release. And after the fact add security.
It will take a huge culture shift to get that the concept that in order for programs to be secure they have to have security built in from the ground up, not after the fact. If you don't do it this way then you get a fix opening another problem fixing a problem. Build in the security first and you don't have this problem.
In order to do it this way you need to change the way people program. And in order to do that you need some external or internal motivation to do so. And honestly speaking I don't see that yet. Maybe another 40 million credit cards need to be released.
Who is this clown? (Score:4, Interesting)
Re:Who is this clown? (Score:3, Interesting)
You may have to forgive the guy for continuing to process the world in terms of his religious background: the mystery at the Unknown Other, the power of the symbols we use to communicate Good and Evil, humanity's need for the company of other humans and the need to treat each other person with respect and dignity (although too few religious people hit this last target...).
Another problem with metrics... (Score:3, Interesting)
You need to look at what the actual failures are, whether the kinds of failures are changing or not, whether there's a common cause to some class of failures and how hard it would be to address that common cause, and whether different systems tend to suffer from different kinds of failures.
Buffer overflows, for example. Everyone gets hit by buffer overflows, there's a common cause, but some of the techniques you can use to address them are easier than others. Non-executable stacks, great. Easy to do, if the hardware supports it, and doesn't have much of an impact on the developers. Changing to a language where buffer overflows can't happen? That's hard.
Code injection by playing quoting games, using '%2E%2E' or some complex Unicode string instead of '..', or telling me your name is '%34;cat%20/etc/passwd;echo%20%34'. Different symptoms, sometimes you can systematically fix them, sometimes you can't. A lot of what people think they know about these kinds of attacks is wrong, and they fix them badly and someone with a name like "d'Artagnon" finds he's a hacker.
Sandboxes. Lots of bad information about these going around. Microsoft used to say sandboxes were a bad idea, too much overhead. I don't know if they still do, but they need to come up with a fully sandboxed inherently safe version of Internet Explorer... the sooner the better. Oh, and Firefox has been playing with fire here too... and Apple needs to quit trying to sandbox dashboard at all and just treat it as another application platform... before they end up with people depending on a sandbox that isn't really there.
But the bottom line is, all the metrics in the world won't tell you whether these problems are things that vendors should be held directly accountable for, or whether they're the user's responsibility for configuring their systems correctly, or whether it's a third party plugin/cgi/component vendor that's the real problem.