Slashdot Mirror
McAfee Blames Open Source for Botnets
v3xt0r writes "It seems that 'the Open Source Development Model' is to be blamed for the recent increase in botnet development. 'We're not taking aim at the open-source movement; we're talking about the full-disclosure model and how that effectively serves malware development,' the spokesman for McAfee says. Why not just blame the IRC Protocol? Or simply admit that Proprietary vendors cannot keep pace with the Open Source Model?"
So, here is an article simply claiming that some "malicious developers" have found a way to collaborate using open-source tools...
Wow, I've seen a lot of commercial vendors doing that in the recent years also - maybe they're all suspect.
But what model would you blame for the hundreds of PC viruses that devestated home and corporate computers in the 90's up to today? I think the exploits they relied upon were simple coding flaws and insecure type checking or buffer overflows that wer simply poor coding kept as a secret.
So, in light of what causes the malware, would I rather the code be fully disclosed or instead guess that there's probably no major exploit possible? I'd probably go with the former considering the sheer number of viruses based on the latter and the fact that it's the exploits based on proprietary code that often do the most severe damage to society.
I would like to ask McAfee what they would think if a competitor found a virus and figured out how to fix it but couldn't tell McAfee that information because it would be considered disclosure. That would be the real irony here. Sites that host viruses and describe/publish them are often very useful sources for people looking to rid them from their computers or even how to avoid exploits in the future.
This article is entitled "Hackers Learn from Open Source" but they only learn as much as the researchers and patchers do. I would rather the community be progressing towards solid impenetrable code than have guarded secrets that keep everyone under a thin veil of security. Because if those secrets are ever discovered by the wrong people, we will not know about them and we'll essentially be caught with our pants down. I'd rather have every programmer know the pitfalls of coding than to have thousands of applications deployed world wide all waiting for one hacker to stumble upon a secret.
You really have to question McAfee's motives here in their Sage magazine
My work here is dung.
Say there is an vulnerability, only known to black hats which is being exploited. Someone finds it, reports it to the vendor. The vendor sits on it for months while a massive botnet spams the hell out of us using it.
Isn't it better to release info so people can do something about it? Network admins can use it to help block the attacks, or disable the vulnerable software. Users can stop using it. And people can ever make their own patches, or use the shared knowledge to look for similar flaws in other software.
We have seen this happen. Can anyone provide a good alternative, because McAfee certainly can't?
const int one = 65536; (Silvermoon, Texture.cs)
SJW, n: "Someone I don't like, and by the way I'm a fuckwit" - AC
Evil hackers learn programming techniques in schools and colleges!
Why not just blame the IRC Protocol?
Because McAfee has an unterior motive and wants to discredit the competition.
With there be anything else?
Basically it seems to me that McAffee _isn't_ complaining about OSS, and explicitly says they don't. There are two _very_ distinct and unrelated parts of the article:
1. The open source part. Which doesn't contain any kind of anti-OSS slant. It just says that people now have a lot of F/OSS tools to manage their files and whatnot.
2. The part about full disclosure. Where they basically whine that they'd like to have what we all call "security by obscurity." Basically McAffee would like a world where researchers keep a lot more stuff secret, because supposedly being public about that helps evil hackers. Which is as stupid as it gets, yes, but it also has nothing to do with OSS at this point.
So why the fanboy slant in the summary?
A polar bear is a cartesian bear after a coordinate transform.
Don't blame Babbage. It's those people putting the wrong figures into the machines and expecting the right answers to come out that are the real problem.
My headline is as credible as theirs. If they want to start flinging mud we can fling it back. Outsourcing virus writers to help perpetuate sales of Anti Virus software is good for business has a large return on investment and a practical way of making sure that the next incremental release is purchased by all your customers.
Do not look at laser with remaining good eye.
Given that the summary itself says that this is not about the open-source development model, I've got to conclude that the headline is a troll. You can apply the full-disclosure model of security notification to any software, open or closed.
This is about whether the finders of security vulnerabilities give the vendor a grace period to fix the problem before disclosing the vulnerability to the general public. It has nothing to do with open source.
Causation can cause correlation
"You know what really grinds my gears?..."
Linux is evil, Windows is good, proprietary blah blah blah. The biggest shock to me is that anyone has the balls to point to open source and say "YOUR development model is responsible for this mess," especially considering the way Windows ships as default (make all initial users members of Administrators). I'm still reeling from hearing McAfee (or someone officially affiliated) say something to the effect of "Your open code and development is killing us!"
You have to consider the fact that some tools, while they can aid those with ill will, serve mostly to benefit. Take nmap, for example. Some script kiddie can use it to scope out their target. On the other hand, a tech can use it to check for open ports on their own systems to prevent those kinds of things. These are useful tools, but because of their power, they could also potentially be used as bad devices in the wrong hands. You could say the same thing for guns. Innocent people are killed with guns (among other things, such as knives and harsh language). Should a bullet-proof vest manufacturer come out and say, "We're not taking aim at the gun manufacturers; we're talking about the ability to propel small things really fast and how that effectively serves criminals?"
From the sounds of it, it sounds like they're blaming the OSS model simply because malware authors use it. Although, I could have completely missed what TFA was saying; I'm really tired and I keep reading each paragraph over and over and I just can't grok it.
"Beware of he who would deny you access to information, for in his heart he dreams himself your master."
Perhaps what McAfee is really afraid of is the open dialog and response of something like ClamAV?
If enough developers 'pool' into working on it, and an open dialog of faults and vulnerabilities continues, could they find themselves out of a job from an Open Source solution?
(especially as they are about to be challenged by MS Defender, which could also benefit from open dialoge to augment a shallower background in the field?)
This space for rent. All reasonable inquiries will be entertained at proprietors discretion.
we're talking about the full-disclosure model and how that effectively serves malware development
The open source, full-disclosure model improves the pace of ALL software development. All means all, including software development for "bad" purposes.
Moderating "-1, Disagree" is simple censorship. Have the guts to post your opinion.
Maybe that's what McAfee really cares about. Full disclosure means, in part, that it's easier for new vendors and products to compete in the security field. Sticking with limited disclosure, where only the OS vendors and established security vendors are informed, just lets the established vendors get complacent. Which given the quality of modern security software I would say has already happened. So they throw a bunch of FUD around, as though the problem isn't in large part due to closed-source software vendors being incapable of getting their shit together when it comes to security.
I don't see why computers should be any different. Yes I want disclosure about security problems, espically if teh company is slow in getting a patch out. However disclose the problem, what it relates to, what the potential attack vectors, and what if anythign can be done to fix it. Don't go and post code that not only shows people how the exploit works but allows them to just compile and do it. Do that and in all likelyhood my system will be 0wned before I ever read the notice and try to do anything about it.
In an ideal world, a security researcher will discover a fix and do the following:
1) Create code that reliably exercises the flaw that can be used to verify that the problem really exists and that the fix (when it is finished by the vendor/OSS group) works. You can call this the "exploit code" if you want; it is necessary for someone to create it so that the fix in step 3 below can be tested.
2) Notify the vendor/group of the hole and pass along the exploit code.
3) The vendor/group evaluates the problem, assigns a reasonable fix schedule to it, and eventually a fix is produced, verified to work against the exploit code, and distributed to the world.
4) The hole is then announced on a security bulletin *along with the exploit code* to notify customers/users that might not have updated already that they should do so at their earliest convenience, and to provide customers/users (many of whom are knowledgable programmers) the same tool given to the vendors to verify that the hole is plugged in their systems.
This is a reasonable system. The whitehats try to do it all the time, and for many OSS projects it works out just this way. Blackhats OTOH do only #1 and then distribute the exploit code only to other blackhats, so that when they use a flaw both vendors and customers/users are taken unawares.
Unfortunately, many closed-source vendors break the whitehat process between steps #2 and #3. They are given notification and exploit code, but rather than prioritize a fix they decide that no fix is necessary, because their local astrologer told them that only whitehats find flaws. After enough time with no action, the whitehats MUST move on to #4 so that users can isolate the systems with the hole in order to preserve the rest of their network.
In your house analogy, this is equivalent to notifying a neighborhood that the developer who built many of their houses made a serious mistake in the wiring such that any house at any time might burn to the ground, and that their insurance will not cover it, and the developer has decided not to pay for a fix, and the local fire department has announced that they will not intervene to stop any fires that start due to a wiring fault.
A device is available that can quickly determine which houses are at risk. The developer is spending twice as much money needed to fix the wiring on ads in the local newspaper exhorting those citizens who have these "bad house detector" devices to destroy them rather than share them with their neighbors so that they can hire their own electricians.
The process YOU want is already being followed by the majority of legitimate whitehats. The process McAfee wants leaves everyone screwed.