Slashdot Mirror
Why All The Hype About 0day?
nuthinbutspam writes "Michael Sutton has up an interesting post on the security vulnerabilities that we really need to be concerned about. According to Sutton, it's not the new ones that are scary, it's the old ones that have long since been forgotten. He illustrates his point by walking through an example where he uses Google and Yahoo! to identify 50 web servers that are wide open to attack. The list includes an ivy league school, various colleges and a company traded on the NYSE. Sobering stuff."
I wonder if his webserver was one of the 50.
I think that qualifies as a well duh. If you haven't secured yourself against old vulnerabilities, worrying about zero-day vulnerabilities won't do you much good. On the other hand, if you're on top of security, staying in touch with the latest vulnerabilities has some real value. It's common sense. To use a bad analogy, if someone is suffering from a hear attack, you don't stop treating them because you notice they have a scratch that needs a bandage.
If you, as the admin, haven't secured your systems for KNOWN vulnerabilities, then you probably aren't one of the people concerned about 0 day exploits.
On the other hand, those of us who DO secure their systems ARE concerned. And rightfully so.
Michael Sutton has up an interesting post on the security vulnerabilities that we really need to be concerned about. According to Sutton, it's not the new ones that are scary, it's the old ones that have long since been forgotten.
The old ones may be the most worrying to people tracking security in general. They are not, however, the most worrying to those of us looking to secure our own networks, since we know how to stop them. It is a matter of control. I can patch and Firewall, and ACL away any old worms and detect them if they get through. I might be helpless, however, if a new, zero day worm hits.
Release The exploit in a form so easy even the most assbackwards 13 yearold skiddie can use it on his Dell.
Just wait and see how long it takes before it gets patched.
perpetually dwelling in the -1 pits
*looking at watch waiting for compulsory relation to terrorism analogy and the ubiquitous overlord welcoming*
Please troll me up, I am aching for some negative karma.
The most dangerous vulnerabilities are the ones people don't know about. Whether that's because they haven't learned yet or because they've forgotten is immaterial.
That's why Step 2 of making a truly secure network is to assume "everything I have done so far is wrong and my server is slightly less airtight than a block of swiss cheese infested by cheese-eating termites".
Breaking Into the Industry - A development log about starting a game studio.
Following direction on the site, it was a wiki at Harvard with the remote vunerability:p /Special:Version
http://hcs.harvard.edu/~freeculture/wiki/index.ph
The term "zero day" refers to the amount of time between a patch being available and an exploit being in the wild. That's all fine and dandy except it propagates the idea that exploits are never in the wild before a patch is available. It's not the "zero day" exploits that have me worried--it's the "negative three months" exploits.
I have been in a meeting with a Microsoft security "expert" who seriously claimed that exploits are only be produced by reverse-engineering Microsoft's patches, and that the primary risk is that the time it takes to reverse-engineer a patch is decreasing. If that was really true, Microsoft could stop all exploits immediately by never releasing any more patches. The primary risk is that there's a flaw in the software, obviously, and the clock starts ticking the moment people start using the buggy software, not the moment Microsoft tells us to patch it.
However, admitting that Microsoft is REACTING to hackers rather than the other way around makes them look kinda dumb. Thus the "zero day" myth.
If you are in charge of an important network, you are always afraid.
There are many things that can keep you comfy, like daily updates and 24/7 monitoring of advisories, but the professionals do not always submit their findings. Security gurus submit holes as part of their work or to get their name known or to make a point..but many will stay in the dark. The really serious ones will always have their own unreported set of vulns in various platforms, 99% of the time these are buffer overflows at the kernel level(e.g your TCP/IP stack), leading to immediate root access to boxes/routers/firewalls.
Money is the root of all evil.
Think about it, how do you get famous in security? You break something. Further, a lot of pen-testing is done with loaded contracts, if you actually break in, you might get paid a lot more so you create this culture where by nobody who does that is really that interested in actually increasing security and it's in their best interest to actually have a collection of exploits that they don't disclose. There is a whole mystic around it, do you want Kevin Mitnick to test your social engineering defenses or do you want some faceless large company to do it?
You can spend a couple grand to go to blackhat and "learn hacking" and you can spend tens of thousands of dollars buying exploits from companies like immunitysec, it's a potentically a great business if you don't mind being a security "expert" that doesn't actually encourage security and you don't mind hanging around and dealing with criminals and some of the dirtier folks out there. Just trade and accumulate "0days" and then sell them. Then they all have this nice little excuse built in, they are practicing responsible disclosure and so they can't tell you; then they backhand the vendors and claim that they reported certain issues "months ago" and the vendors never fixed it. I'm not sure what the percentage is, but a lot of it is bullshit. Just look at those Apple Wireless frauds from a couple weeks ago, they didn't report shit to anybody, they lied about it, the lied about being threatened with law suits and claimed that's why they couldn't disclose anything, the entire thing could be a fraud. They lied to their audience at blackhat, they very clearly made it sound like they were threatened by apple and other vendors and the truth is they never spoke to anyone about it; that's par for the course. I'd bet that somewhere near 80% or even more of it is that way, that's the reason behind full-disclosure.
It's all about layered protection and policy. That's sort of where the whole thing falls apart, organizations don't have policy and you can't build protection on top of nothing. No policy, what do you expect? Sure, large schools and organizations are going to have tons of unpatched systems, who'd want to screw up a working server if they don't have to and security isn't their concern? Honestly, unless you're a high profile target, 0days aren't your problem. Your problem is insiders doing stupid or malicious things, botnets and unpatched systems that are exposed to the world and that you potentially don't even know about.
No I meanth 51th. Why do you athk?
Or you don't care and you deny responsibility when your machine is being abused. That's the most popular way.
....would work to keep a tool kit of their own "zero-day" exploits handy for that day when they need or want to gain access to something in particular where the admin is doing the work of applying patches.
The problem with quotes on the internet, is that nobody bothers to check their veracity. -- Abraham Lincoln
Hey zonk if you have a quota and need to fill it just by posting random journal entries, try posting one that doesn't used a bastardized form of a word like "0day". That was made for warez, not exploits.
Btw the NYSE company isn't even named it coudl be any entertainment company from Universal studios to a small IPO that is making a casual game for people that costs 2 dollars, as well as single computer on a lan. With no meantion of if these are "honey pots" which will get people's attention but it will actually have no access to the real network since it's segregated.
I think slash dot needs to stop posting "news that's not news" and start pointing "news that matters" again.