Sendmail Bug Tests US Dept Homeland Security

yanestra writes "CNET reports that the reported Sendmail bug has been a test for the US Department of Homeland Security which seems to have managed information flow in this case."

Comments

Where does this leave CERT?

[mdb31]

Interesting to read that the government is involved with this -- kind of makes you wonder what happened to CERT, which always used to coordinate public disclosure of and vendor response to bugs like this.

The fact that CERT always seemed to do a decent job makes this even more interesting. The biggest criticisms voiced about CERT were that they acted too slow and didn't provide enough detail information about problems (other than to acknowledge the general nature of it). How will the government do better in these areas?

My guess is that the answer to the latter question is 'not much', and that we'll start hearing the same complaints about the Dept. of Homeland Security soon...

Encouraging

[Peter_Pork]

This is actually quite encouraging. Having an organization that deals with the painful process of contacting each vendor and major user of a program with a newly discovered vulnerability is a major improvement. They also seem to have the law behind them (is this true?), so we finally have someone that can force people to fix security holes. I don't quite like the homeland-security big-brother model, but it worked nicely in this case and got the job done, something pretty hard in the Internet jungle.

I work for the government.

[joe630]

We all got notified to patch our systems immediately.

Everyone is working togther to get all the systems running sendmail patched.

While this doesn't seem like a big deal in the corporate world, in the government world, all red tape has been removed and we can make changes to critical systems INSTANTLY.

FIX FIRST, meet later. It's an entirely different attitude, and it allows me to do my job more efficently. It works.

Re:I work for the government.

[sckeener]

FIX FIRST, meet later. It's an entirely different attitude, and it allows me to do my job more efficently. It works.

Gosh the exact opposite of that reminds me of NASA in the early 90s. A problem would happen. We'd have a meeting about the problem only to realize we needed another meeting to discuss the problem. Between the meetings to discuss the problem, we'd have a meeting to discuss the format for the next meeting. Of course in each meeting various contracting companies would be represented. The problem was always the fault of either A) the person or contract company not present at any of the meetings (hence why they have so many meetings) or B) the person to the left while seating around a table.

I never knew how the problems were solved. I never saw any solutions at the meetings. It's my belief that NASA has trained MICE doing the repairs for slices of cheese.

Homeland Security

[benjiboo]

Are homeland security responsible for any tech security, or does that fall under the realm of CIA/FBI? (Forgive me, I'm not from the US.)

The reason I ask is because this type of co-operation with public defense organisations and the private sector are likeley to become much more important as we come to rely more on these technologies, OR if we ever see any kind of cyber-terrorism. Ideally there would be a single point through which relevant information flows - as hinted at in the article, any leaks could be a problem.

Do these agencies have a reputation for hiring good security people?

What about international software?

[bigberk]

Is the U.S. Department of Homeland Security also going to try and take care of software developed internationally?

For example, it seems that a lot of OpenSSH development is done in Canada and Germany. And the server is run out of Canada.

The OpenSSL team looks primarily international too (UK, Germany, Sweden, New Zealand). There server is managed by Brits and Swedes.

Actually... I think you'll find that a lot of crypto software is based outside the US. Probably due to constraints placed on crypto development in the last decade.

Re:Why does sendmail still in use?

[Oculus Habent]

Windows always has been and always will be a security risk.

Superior alternatives exist... so why is anyone still using Windows???
--
Sure Joe runs sendmail, and sendmail is insecure. But does Joe's server get attacked frequently? Chances are it probably doesn't. If it does, Joe may be looking into alternatives, or Joe may have found one already.

Joe doesn't have the time to fix every potential threat. Joe probably installs patches and updates as frequently as possible, maybe even on a schedule. Joe does his best to keep sendmail from being a problem, and at the same time Joe tries not to waste time.

If Joe were working for a huge company that depended heavily on it's e-mail, Joe would probably spend more time on sendmail. But odds are Joe doesn't, and Joe is doing the best he can.

ISS - proven shills

[Anonymous Coward]

Once again, ISS have let the community down. Instead of informing the vendors, or CERT, or even just posting to Bugtraq, they informed the USG first. As a result .mil sites had the patch four days before anyone else (so far as we know) were even aware that there was an issue. [Although they claim that they checked their private "sensor" networks, somehow I doubt they have better coverage than eg DShield.org. ) This is unacceptable behaviour for an info-sec company that wants to be a responsible member of the community, and of course is just the latest in a list of behaviour that I at least consider unethical. I work for an ISS reseller outside the USA, and I will be exercising my influence internally to push for replacing the ISS prodcuts either with Free alternatives, or proprietary products from companies with a better grasp of their responsibilities. BTW we have several very big global clients.

Re:bleh

[Oculus Habent]

I think a timeframe needs to be established. Those who find exploits in programs have a moral obligation to let the maintainers of the program know first and give them a reasonable amount of time to fix the problem.

But what is reasonable? A week? A month? What if the exploit is a deep flaw in the system, something that cannot be fixed?

So, how long is long enough to keep an exploit from the general public? Does it depend upon the exploit, the company that makes the product, or the person who finds it? Is there a balance to be found?

Goverment is getting credit!

[giberti]

I think it's interesting that the government is getting credit for working with the private sector in releasing information. Part of the the point of open sourced software is so that bugs can be found and patched quickly. The CERT email I got yesterday afternoon had MANY patch sources listed by vendor (RedHat, Apple, Sendmail etc) and was timely. I don't belive that the pat on the back goes to Uncle Sam in this situation, but rather the folks at Sendmail who worked to resolve this issue in a timely and organized fashion. They released the information to those who needed to know (including the DHS) and worked on a solution to get this stuff out to the public.

To quote Eric Raymond, "Given enough eyeballs, all bugs are shallow"

Kudos to Sendmail for getting this taken care of.

Maintain Obscurity!!

[tacocat]

The one thing I didn't like about this article was the idea that this kind of process should be followed by everyone. This is what I saw as the process:

1. Find a bug
2. Tell only the owner.
3. Keep it a secret until the owner comes back with a fix
4. Now go tell everybody about the bug and the fix at the same time

Here's the flaw(s) in this process:

1. There is no interim action. While you wait for me to fix the bug, everyone in the world is vulnerable without the option of shutting down that service or taking additional safeguards against the bug. This could be days to months of insecurity. What makes you think DHS is always going to be the first to discover an exploit?
2. I don't see how a Government Department is going to succeed where Public Voice has failed.
   • Microsoft has some huge security flaws in their browser that they have admitted will not be fixed in the near future. This is public knowledge. Public Voice has failed
   • Microsoft, as another example, has managed to avoid doing a lot of things it's supposed to by litigation. This can cause great delays in progressing a security notification.
   • Past practices by some companies is to sue the disclosures of bugs with a gag order. How will this be different? The government gets sued (and bought) all the time
3. How is this process going to be handled when there is no Company supporting the code? I'm uncertain that this will be supportive in the OpenSource Model.

I guess the biggest thing that I don't like about this is that idea that this model will support the Closed Source software model because of the arguments of:

• What you can't see won't hurt you.
• There's a great big company to yell at.
• We (Govt and Corp) can talk in private. You open sources are all a bunch of security risks
• If anybody tells of a bug early, they must be a terrorist.

Timeline?

[Marty200]

FYI, this flaw was actually found in December [msnbc.com] and just reported yesterday, roughly two months later

It would be interesting to see the time line on this... Did it take this long for the patch to be created or did it get left on someones desk of periods of time before some one spent an hour making the patch.

MG

getting into the "tarist" snitch business

[zogger]

--CERT has been runing this "survey" about "internal threats" that companies might have observed between two specific dates. Not from such and such a date until the survey is taken by any respondents, but between two exact dates. I looked, maybe I missed it, but I haven't seen a reason for picking the end date. I can speculate why that might be, but I'll let someone else do that.

begin more generic rant

Don't know about anyone else, but with patriot act 2 coming into law soon, where the government can just call someone a "terrorist" on their say-so, and with the definition just vague enough to apply to-just about anyone it appears- and that means they are now not under any civil protection or rights, I am wondering if they are starting to set up even more infrastructure to add to "the lists".

Anyone who don't take the "lists" serious is someday gonna be waving bye bye from the back of a truck heading..someplace.

When I was growing up, the stuff the US government is doing right now was something we were taught only "bad" places like east germany did. And those bad places had a complete blend of bureaucracy, large corporations, and then the military and police. Everyone snitched on each other. government had all the rights, you had none, even if some word drivel was printed on paper someplace, government ignored it. That's exactly what those bad places were.

We were taught that was definetly "wrong".

Now it's "patriotic".

Yes, we have a need for some sort of law enforcement effort on the net,and it's there and quite frankly it's more than enough to function, the net is part of society,but what we are seeing now goes WAY beyond it. And now all these other weird things? Model toy rocket permits now but leave the border just wide open, millions of illegals ayear free to just walk across? Huh? They are going to regulate or ban model airplanes, while they have been sprayinbg HUGE amounts of weird crap over america for several years now and outright lying about it? huh?? We have a MAJOR goon run cia front company called "wackenhut security" running private prisons,running for -profit manufacturing efforts using prisoners, running some mental institutions, and now RUNNING ROADBLOCKS on the public highway? This just broke a few days ago, private security org manning roadblocks. Just THINK on this one. We have "secret" Total Informational Awareness efforts codified into law? Is there something about the word "total" that isn't understood? Forced collection of DNA samples at roadblocks? Taking hair and blood samples and you aren't going to be able to say NO? Collation of all purchase records? High level officials who just blatantly WARN YOU that if you are NOT 100% behind their efforts that YOU ARE A TERRORIST? And now they are taking over these internet efforts when it comes to security, telling people what they can and can't do, and this "they" guy will tell you when an exploit gets noted and "official" patches released? Huh? What's to stop them from eventually making little cute distinctions between what they release and what they don't, suppose "they" decide they would like a little pre-patch hacking so they can get into machines THEMSELVES. Maybe they JUST DID THAT, hmmm?

sweet deal for them.

I am against non disclosure of exploits in a timely manner. Waiting months is not timely. Anyone writing code now can review it before release. Anyone NOT knowing about "security" in general needs to stop and step back away from the keyboard and stop writing code until they "get it" on security, because GUARANTEED if this constant release of buggy code continues,and if people who maintain what are historical examples of just dismal exploitable code that should just be chucked out as lame don't voluntarily just admit it's buggy and pull it off the distribution mirrors, this government will start regulating all releases themselves, after a "review". they don't do it now, but they sure as heck could make it a law tomorrow. In my opinion, it's better to be able to not give them any more excuses. If that's what everyone wants,because known sloppy stuff keeps being used and released, this is what's going to happen. You are going to see licenses, you are going to see full governmental review of code, probably fees attached, stuff like that, I tell you, the internet is going to turn into an electronic "highway" whoops they call it that, so that means that this highway is going to be full of smokey the bears and roadblocks and regulations. And I am NOT kidding on that. We saw them just hijacking sites last week. I can see them starting to do that on a much larger scale. And if sites get hosted overseas, you know what, government will have no problems dealing with that, if anyone cares to notice, they have no problems going over stomping on other nations, they can control some wires if they choose to. Host at home, you are going to outfox them? Not when they can just call up your isp and have you dropped, then they send over some goons to pick you up once you are on the "suspicious" list. And they'll do some of these efforts from major backbones or routers if they have to, I am not so convinced that carnivore and such-like efforts only have the capability to just sniff. /rant

Re:As if Ridge and

[Anonymous Coward]

Umm... they did in fact have everything to
do with this.

The Homeland department contracted out the
NCIP coordination to ISS, allowing them to
hire programmers to do code review. As
part of the NCIP review, this bug was found,
and kept quite for over a month while the
government and industry got first crack at
updates and patches.

OK, it wasn't a government employee who found
the bug, but it was a private contractor
doing work for the government. (You don't
really expect republicans to hire gov't workers
when they can just contract out to industry
do you?)

And by the way, it wasn't Ridge that started
this whole process. The Critical Infrastructure
protection process started under Clinton.
After 9/11, it all got moved under Homeland
to coordinate with other agencies. (E.g.,
the Department of Defense has known about
this bug in Iraqi mail servers since last
year....) Now THAT'S coordination.