Slashdot Mirror
Slashback: Subterfuge, Rejoinder, Caution
Good things come in hidden pictures. Intrepid strongman Dug Song writes, in reaction to the "fairly thin" piece earlier today on Steganographic anlysis:
"The only cutting edge, practical work being done today in steganalysis and steganography is by Niels Provos, who gave a talk at HAL2001, and is also presenting at the USENIX security symposium tomorrow: He's been developing several interesting tools to do steganalysis during the course of his universal stego engine development: (http://www.outguess.org/) including stegbreak (which can detect images produced by all popular stego tools -- except outguess), crawl (which he's used to download 2 million jpeg's from eBay to analyze), discern (his distributed computing platform), etc."
Hushing up is not such a good answer sometimes ... Reader Brian McWilliams <brian@pc-radio.com< notes regarding the thread on Slashdot about the costs of full disclosure, "you might want to add an update linking to this story Newsbytes did a couple days ago about the Richard Smith posting. Contains responses from eEye & full disclosure advocates, as well as some more ammo from Smith."
Smith doesn't take kindly to being blamed for damages caused by security holes he publically aired.
So you want to patent "bacon and eggs"? I guess that's OK then. You recently read about the McAffee patent on a seemingly overbroad stretch of computing transactions. Well, it's raised quite a few eyebrows among people interested in a fair computing marketplace. geoa points to this article in which "Neil McAllister in The Gate takes too long to say we shouldn't let another monopoly in the playpen."
It was soooo old ... For everyone enjoying the recent upswing in retro computing interest, Silicon Avatar writes with another tidbit: "Although not necessarily new news, I found a link today when someone mentioned Roland MT-32 to me. Starting with Space Quest IV, Sierra games were written to use either the Adlib soundcard or the Roland MT-32 'soundcard.' Quest Studios seems to have repository of MANY of those songs, including the 'lounge tape' I once had but lost!"
Put that in your souped up underclocked emulator and smoke it.
His argument basically boils down to "Security through Obscurity"; and anyone who has delt with security knows that this leads to no security at all.
Yes, there is "one hell of a price tag". Chalk it up to the hidden price tag of Windows.
What in the world do you expect of an architecture where blatant security flaws are deliberately ignored? What do you expect from a company which has publically stated that "security gets in the way"? And what do you expect from a company where the average time to release a security patch is about 60 days?
One expects problems - serious problems. And Smith's argument is an attempt to cover these problems up. This hinders how bad the situation really is. While some people might like to stick their head in the sand and not know the truth, this does not make our infrastructure stronger.
Quite frankly, given how insecure Microsofts' software has been historically, I would expect a strong attempt by them to try to do away with Full Disclosure. It is certainly a lot cheaper than having to fix the problems properly in the first place. While I would not accuse Mr. Smith of being a Microsoft shill, I would certainly say that he is misguided here.
Full Disclosure helps keep Microsoft honest. Anything less is an attempt to gloss over the fact that Windows is flawed; and that anyone who uses it has to pay an additional hidden tax due to its serious security flaws.
Please let us deal with the truth, and stick to the truth. Anything less is deceitful; nor will it stop experienced pros from exploiting the existing flaws. Lack of full disclosure will however, lull people into a false sense of security.
And as we have seen with the Code Red worm, the price of a false sense of security can be very expensive.
Full disclosure, although it sounds like a dangerous idea, is perhaps the most effective manner for preventing attack.
It becomes a double-edged sword, when you release a vulnerability, who will get to it first, the vendor or the crackers?
Scenario 1: Crackers take charge. OK, for the sake of argument, let's say eEye discovers a remote root in IIS. They release the vulnerability specifics, and as soon as they do so, a cracker creates an exploit, and before you know it, it's the hottest thing on Packetstorm. The attacks spread rampant, but by this time, Microsoft has gotten wind of the threat, and released a patch. Thousands of boxen are patched by admins who keep up with the news, however thousands remain unpatched, and many have been cracked. Over the course of a few months, things get ironed out, cracked boxes get fixed, security patch is propogated everywhere.
Scenario 2: The Secret Vulnerability The same vulnerability, discovered by eEye, instead of being released to the public, is released to Microsoft only. Microsoft creates a patch, and puts it on the internet. Few admins apply it, because there is no huge hype about a massive attack wave. This leaves a massive amount of servers open to attack. Then, out of the blue, a cracker discovers the same exploit, and writes the code to exploit it. Script kiddies everywhere are rooting IIS boxen. The threat spreads vigorously, all the while, MS claims plausibly deniability, because they already released a patch.
The Skinny: Why one is better The second scenario is somewhat similar to the CodeRed situation. MS released a patch for the bug long before the worm spread, and people never expected it. When the wave hit, many admins flocked to the MS update site, and patched their boxen. It uses the media to propogate information about the vulnerability.
This is why CodeRed spread so fast, because there were fewer patched boxes. If more boxes had been patched, the spread would be less severe.
The point I am trying to make here is that we must sacrifice a certain amount of servers to any given bug before it is eliminated. The patching-frenzy is triggered by the massive infection. Such a necessity for a patch must be created for it to be propogated fully.
I hope this is understandable, for I still may be an idiot, I have yet to confirm.
--Ted
McAfee wasn't even necessary, just apply the security patch and reboot.
I guess the "how many dozen suits does it take to change a light bulb" applies to using web browsers and rebooting a server?