Mitnick on OSS

comforteagle writes "Infamous cracker Kevin Mitnick (turned security consultant) has come out to say that he'd prefer to 'hack' open source code vs proprietary closed code. "Mitnick says that open source software is easier to analyse for security holes, since you can see the code. Proprietary software, on the other hand, requires either reverse engineering, getting your hands on illicit copies of the source code, or using a technique called 'fuzzing'." He further says that open source is more secure, but leaves you wondering questions if enough people are really interested in securing open source code."

Comments

Captain Obvious

[Fusen]

In other news, it's easier to see where you are going when you have your eyes open.

In other news...

[HaloZero]

He's got the same general (valid) outlook that the rest of us have: open-source code is easier to tinker with because you can see how and why it works. That is an intrinsic element of having open-source code.

Just because Mitnick has said what thousands - neigh - millions have said before, doesn't mean it's new and exciting. Doesn't make it news.

Prefers?

[Black Parrot]

I wonder what he means by "prefers". Is it more fun to sit around reading someone's crappy code than to use the trial-and-error approach crackers use with closed-source software?

The empirical evidence suggests that people don't have an especial lot of trouble cracking CSS.

I guess if you have the source you can grep for reads and examine them for overflow vulnerabilities, but I wonder how much easier even that would be vs. just trying it.

Ask a hacker a question, get a hacker answer

[AKAImBatman]

Famous hacker says it's easier to find holes when they let you look at the source! News at 11!

Is this really all that suprising? If you've got a mentality of "how can I break this?" it's much easier to figure out how if you can look at how it's built. Unfortunately, having a hacker able to look at a system is not the same thing as having the original designers catch the issue. If you wait until hackers get ahold of it, they'll find ways to exploit the problem before the patch is in wide distribution. That's what makes this dangerous.

Thankfully, the majority of those who are looking at the code have less selfish reasons, and are happy to share any issues they see. Thus the "many-eyes" philosophy depends heavily on the good will of the common man. Personally, I wouldn't have it any other way. :-)

Re:Fuzzing and Obfuscation

[muhgcee]

Granted, you had a disclaimer about mistakes, but...
This is all assuming that the home dir or the working dir is in the path.

obvious but often denied

[Anonymous Coward]

Come on now, how many times have I seen the same statement greeted with derision here?

I'd prefer to hack open source with FEW AUTHORS

[xxxJonBoyxxx]

I think I'd agree with Kevin if he said:

"I'd prefer to hack open source with FEW AUTHORS."

There's no doubt that lots of eyes and a security focus have helped Apache, but there's lots of open source shitware (for example, just Google up a list of PHP messageboards) that don't have basic input validation controls, require too much access to the operating system, use plain-text or unsalted MD5 passwords or contain other gaping holes.

Without those extra eyes helping out...yes, many open source projects are easier to hack than similar closed source projects.

Re:I'd prefer to hack open source with FEW AUTHORS

[kfg]

. . .there's lots of open source shitware. . .

Indeed there is, and lack of recognition of this is one of the "weaknesses" of OSS, however, let me ask you this question:

How many people run this shitware?

Not much point in spending who knows how many hours going over code that nobody uses. The Mother of all UNIX Holes was found in GNU emacs, because that was someplace worth looking for one.

Thus the code that everybody uses gets harder faster.

KFG

Re:I'd prefer to hack open source with FEW AUTHORS

[xxxJonBoyxxx]

"So my question remains, who runs this shitware?"

Accidentally, the answer is "many web hosting providers". If they allow users to upload and execute their own scripts on their site (and who doesn't, these days), they typically end up with several dozen copies of God knows what because web designers find these things on their own and crib them into their own sites. The permissions set to allow these scripts to run are often open enough or there is a powerful enough shared backend database to do something interesting...

How would it have helped Mitnick?

[jcr]

The dude was a social engineer. I've seen no evidence that he ever wrote an exploit himself.

-jcr

Re:Securing Open Source Code

[cli_man]

I agree completely with the parent post. Also I know when I work on any open source projects I make double sure that my code looks right and that I didn't do something stupid because I don't want to get torn apart on a mailling list of my peers.

Also when working on open source it may not be so much that other people are looking over your code for bugs, but that someone might be looking over your code for bugs. I don't know many programmers who like to get shown up on their abilities.

However when working on closed source you tend to just get it working, meet the deadline, and get on with life. Most times you don't have someone looking over your shoulder at each line of code.

Err, no.

[Paradox]

Look, everyone knows that opening your source is a double-edged sword. It's not like your intent to open source summons the Buffer Overflow Fairy who magically waves their Valgrind wand and your code is perfect. The whole point is to get the bugs out in the open so that everyone can see them and patches can be submitted by a larger number of contributors. The idea is that it gets rid of the bugs faster.

The fact that Mitnik says this doesn't damage the case for open source at all. The Captain Obvious comments are just pointing out that Mitnik is just saying, "I like easier work over harder work." Or maybe, "It's really fucking tedious to analyze a binary without the source." Does that stop people from finding bizzare bugs in closed source code? Absolutely not.

Re:Fuzzing and Obfuscation

[TheSkyIsPurple]

>One more thing about the article, the beauty of OSS is that it is impossible to implement security through obfuscation [wikipedia.org]--a major pitfall to security in application design.

Careful with the word impossible.

Can you really guarantee that for every OSS project, there are enough people looking through each bit of code trying to look for any "security through obscurity"-type issues?

If there are 1,000 submitters, most of whom are working on features, can you guarantee that everyone's code is getting audited? That there is no code where they all thing to themselves "Well, there are enough other people on this... I really don't need to look in here, I have better things to do."

Not saying it is epecially prone. I'd even be willing to say it is less prone, but I don't think you can say "impossible"

Dangerous mistake.

[Mr. Underbridge]

obvious but often denied: Come on now, how many times have I seen the same statement greeted with derision here?

Now, for what it's worth, much that seems obvious isn't true. It seems like a good notion that open software allows people to more easily figure out how to fix holes. This is certainly true. However, it also makes it easier for hackers to find holes as well.

The fact is, assuming we had two nominally identical projects, one closed-source and one open-source, bugs would be easier to find by *everybody,* good and bad. The question, which Mitnick alluded to, is this - are there sufficiently more good-guy" eyes on the code to ensure that bugs are found/fixed more quickly, to account for the fact that bad guys can find bugs faster?

The answer to that question isn't a guaranteed "Yes." In many cases it works, but I don't think in all. I realize that people around here like the notion of free software. I do too. But that doesn't mean that it works in practice the way it does in theory. We have to actually question how many people are actively maintaining the code compared to how many "bad guys" are looking to exploit it. I think for most projects this ends up working for us, but it's not guaranteed.

In other words, taking for granted that OSS is more secure because it's OSS is a dangerous mistake.

I think...

[mangus_angus]

Mr. Mitnick is forgetting that most people want to see the proprietary software code because it is closed to prying eyes. Where as OSS being open to everyone is less appealing. And any issues that need to be fixed will be in a shorter time due to more people around the globe working on it. Where as with Proprietary software you have a small team working on it. They also have the added task (in Microsoft's case) of it having to be test on many different systems due to the large and various types of machines the software is being run on.

Re:Master of the obvious!

[sbrown123]

I think the parent, and many others, wish they had some fame, a good job, and other such things. Nice try, though.

Wow, I have a better job than Mitnick, make more $$$ per year than him, don't have to fret with the fame, and I still think he knows less about hacking in todays world than I do. And I've never hacked a system in my life! But your like most lemmings today who believe that if a person roams around talk shows and writes some books on hacking that it he/she must be the defacto guru of hacking. Please. Thats like saying somebody that robbed banks 60 years ago are all-knowing-pros at how to rob the high tech banks of today. Time changes, and with it so do people.

Never understand when people say OSS is secure

[TheSkepticalOptimist]

You exposing your entire source code for public scrutiny, and this is more secure the closed proprietary software?

How and why?

I think people are deluded into thinking that because a project like Linux is secure, and that Linux is Open Source, ergo Open Source software must be secure. This is convoluted and dangerous logic.

I think OSS is the most insecure software out there. Think of it. Anybody could take RedHat's source code, create their own distro filled with back doors and zombie daemons, and then distribute this OS supposedly under the guise of a secure RedHat release. This goes with any of the countless personalized Linux distros out there. Same goes for Open Office, etc, etc, etc. If you are not careful (and it is easy not to be careful when OSS is distributed largely with P2P software and bit torrents), you can end up purposely installing a corrupted OS or application whose code base as been hacked INTERNALLY and exposes your data to great risk.

Also, your security protocols and measures are all exposed to public scrutiny. Perhaps among the Open Source community that this exposure allows them to create more secure software, by collectively working to plug holes and make the code base rock solid. But this ignores the fact that people with the same skill set but with vastly different intentions can use the same source code to FIND holes and to WRITE exploits using the original source code as its base. Wouldn't it be more difficult to find a security flaw if it uses the original source code as its base.

I just never bought the whole OSS is more secure then proprietary software bit. The fact you have to reverse engineer proprietary software (which is full of guess work) and THEN start to find ways of exploiting it suggests proprietary software is more secure by obscurity. I think people are just making assumptions based on the fact that Windows, a closed OS, is not secure, thus closed software is less secure. Its the same mistake as assuming OSS is more secure because Linux is more secure. OS X isn't open source (for the most part) and it is secure.

In the end, I think that if someone truly wanted to target OSS and make it a victim of hackers they would more easily find exponentially greater security flaws and deliver more damaging payloads simply by the fact they can use the ACTUAL code as a basis for their attacks. OSS has the benefit of being treated with respect by the hacker and OSS communities, its a hobbyist community after all, why sabotate your favourite pasttime? But if OSS produces the dominant OS and applications of choice for the corporate and government communities I think this whole myth of OSS as being more secure will be ended, very quickly.

Re:Never understand when people say OSS is secure

[m50d]

You exposing your entire source code for public scrutiny, and this is more secure the closed proprietary software?

Yes.

How and why?

Because holes are more likely to be brought to your attention. If a good guy has access to your source, they may well look through it, and if they're doing that, they may well spot any holes, even if they weren't looking from a security standpoint, if they were just looking to improve your code. Whereas the only person who's going to bother looking for holes in a closed program is a bad guy.

I think OSS is the most insecure software out there. Think of it. Anybody could take RedHat's source code, create their own distro filled with back doors and zombie daemons, and then distribute this OS supposedly under the guise of a secure RedHat release.

It's just as easy to do this with windows, OSX or anything you like, you don't need source access to do it. People know, or should do, to get PGP sigs from the official site.

If you are not careful (and it is easy not to be careful when OSS is distributed largely with P2P software and bit torrents)

Of course, but if you're the kind of person who will do that, you probably won't be careful when you're downloading programs for other OSes. In which case you're just as owned.

Also, your security protocols and measures are all exposed to public scrutiny. Perhaps among the Open Source community that this exposure allows them to create more secure software, by collectively working to plug holes and make the code base rock solid. But this ignores the fact that people with the same skill set but with vastly different intentions can use the same source code to FIND holes and to WRITE exploits using the original source code as its base. Wouldn't it be more difficult to find a security flaw if it uses the original source code as its base.

Yes, it would be. But if it's more difficult to find a flaw, that actually makes you less secure. If anyone can find a flaw, if you're lucky it will be a friendly OSS programmer who will just fix it. If you're unlucky it will be a script kiddie who will deface your homepage - annoying and embarrassing, but not a real problem. If it takes lots of skill and effort, the only person who will bother to find it is the one who's going to use it to take your credit card database.

In the end, I think that if someone truly wanted to target OSS and make it a victim of hackers they would more easily find exponentially greater security flaws and deliver more damaging payloads simply by the fact they can use the ACTUAL code as a basis for their attacks.

You don't need the code to do the attack, once you've found the hole, exploiting it is easy enough without it.

Doublespeak ?

[bmajik]

So when Mitnick says it is easier to hack OSS software, people say "duh"

When Microsoft says "making our stuff open source will make it easier to find vulnerabilities", people say "Stop FUDing, Microsoft"

I dont see how can you beleive it when Mitnick says it and how you can refute it when Allchin says the same thing.

Re:Doublespeak ?

[Cal Paterson]

Every so often someone comes in and claims to have found some blatently obvious "double standards." What you've failed to take account of is that these are opinions expressed by different people. They could only be double standards if they were voiced by the same person.

The slashdot community isn't some kind of hive mind; generally, people have different opinions.

Re:Doublespeak ?

[Knuckles]

You can't believe it because you (1) are making up an argument for the aim to refute it, commonly called a strawman, and (2) treat a collection of people as an individual. (Is there a fallacy name for this too?)

ad (1)
Mitnick did not say "it's easier to hack" (I assume TFA/you mean "crack" here) which would mean that it's easier to get unauthorized access.

In fact TFA quoted Mitnick as saying that finding vulnerabilities in OSS code is easier, since it's easier to analyze for holes. This is true for both black-hats and white-hats, so it gets evened out somewhat. On the other hand, finding holes in closed source is harder for black-hats, but fixing them is impossible for white-hats, so overall this might put black-hats at an advantage.

And you leave out that OSS is not just "GPL the source and put it on a server". Mature OSS projects generally are modularized well, because parallel development is greatly hampered otherwise. Closed projects tend to be much dirtier in this respect.
Incidentially, this separation also helps secure coding.

ad (2)
It should not be a surprise that among > 1,000,000 /. users, you find both people who say "duh" in the one, and others who say "Stop Fudding" in the other story.

Actually, what happens is this:
Some people say "duh", because, well, duh, but you leave out the supporting argument that while Mitnick's assertion is obviously true, TFA left out the fact that it is easier to fix also.
Other people say "FUD", because they forget that Allchin is somewhat right: putting Windows in the open now, necessarily with insufficient preparation and code cleanup, would make it more insecure. But that does not mean that it couldn't be more secure had it been constructed in the open from the beginning.

And I can't believe there are idiots who modded you +5 Insightful.

Re:Doublespeak ?

[FireFury03]

So when Mitnick says it is easier to hack OSS software, people say "duh"

He didn't quite say that (infact, he didn't really say a lot). My interpretation of his comment was basically that given 2 pieces of software with a similar number of security holes in it's easier to crack the open stuff (well duh).

Of course, that's ignoring the fact that FOSS software _generally_ seems to be more secure than closed software. You can make up your mind as to why that is, but some thoughts:
1. FOSS software has more people looking at it to find the security holes.
2. If your software is closed you can be much lazier about coding and bugfixing since it's less likely someone (e.g. a peer) will discover your crap code. This means that you will be more inclined to give in the commercial pressures at the expense of security.
3. The person discovering the security hole can (and often does) produce a patch or extensive debugging for FOSS software. This is not possible for closed software. Whilest the patch may not be used in the end it does give the developers a starting point (same goes for debugging - when I've found bugs in FOSS software I have usually done some extensive debugging and can point the developers in the general direction of the bug even if I haven't been able to fix it myself).

Assuming you can get the number of bugs in closed software down to the same level as open software then of course the closed software is going to be more secure, the thing is that the open nature of the software seems to make bugs fewer and that tips the scales.

Note: I am aware that there is crap code in both the open and closed worlds, I'm talking about the _big_ projects here. E.g. Apache vs. IIS, Firefox vs. IE, etc.