Slashdot Mirror
Michal Zalewski On Security's Broken Promises
Lipton-Arena writes "In a thought-provoking guest editorial on ZDNet, Google security guru Michal Zalewski laments the IT security industry's broken promises and argues that little has been done over the years to improve the situation. From the article: 'We have in essence completely failed to come up with even the most rudimentary, usable frameworks for understanding and assessing the security of modern software; and spare for several brilliant treatises and limited-scale experiments, we do not even have any real-world success stories to share. The focus is almost exclusively on reactive, secondary security measures: vulnerability management, malware and attack detection, sandboxing, and so forth; and perhaps on selectively pointing out flaws in somebody else's code. The frustrating, jealously guarded secret is that when it comes to actually enabling others to develop secure systems, we deliver far less value than could be expected.'"
Computer security will kill itself.
Emotions! In your brain!
IT & PC security companies will never "fix" things or come up with a solid and secure foundation for computer security - because it would put them out of business.
When Virtual Security mirrors Physical Security - people should expect more from virtual security? How is a Night watchmen not a form of "vulnerability management" and "attack detection"?
All security in general is reactive. You can't proactively solve every problem - this philosophy goes beyond security. The proactive solution is to plan on how to handle the situation when a vulnerability gets exploited, something I think virtual security has managed to handle a lot better than physical security.
Reactive security is not necessarily a bad thing. Only by challenging today's security can we seek to inspire people to improve security for tomorrow.
I do, however, feel that security in the digital age is laughable at best. It turns out telling a computer not to do what it's told is significantly harder than telling it to do what it's told.
I just get this feeling like the approach is all wrong to security.
At the heart of the security concept is that CPUs generally aren't designed with security in mind. I blame Intel, ARM, Motorola, IBM, and anyone else I can. CPUs are just executing code they're told to execute. NX, ASLR, and other "security" features don't work. Particularly when the underlying architecture itself is flawed.
Well, no, IBM gets a pass. Given that the PS3 has yet to see a major exploit, I believe that the Cell may have security done right.
Non impediti ratione cogitationus.
To me this article just reads as another standard "We're doing it wrong" line with a whole lot of why, but not an iota or even smidgen of reference as to how to get to doing it right. What is with people who constantly have to harp on how we could be doing something different/better but can't actually come up with so much as a rough concept of how to do it different/better and use a lot of unrelated "why's" to get the point across?
Computer security is roughly equivalent to real-world security, only the malicious agents are extremely fast, can copy themselves at will, and can hit as many targets as they want simultaneously. When considered from the point of view of real-life security, our software security problems seem almost inevitable.
The central insecurity of software stems from the fact that security requires time and effort, which makes it hard to get management to fully commit to it, and there's nothing in the world that can make a bad or ignorant programmer churn out secure code. There have been solid steps taken that have helped a lot, and programmers are getting more educated, but at the end of the day security requires a lot of effort.
Security can be widely deployed by enterprise IT, OS vendors, and possibly some hardware OEMs. The larger the footprint, the easier it is for such real security to be rolled out. The thing is, while some IT departments have very good security, just as many have terrible. Hardware vendors are unlikely to have the expertise and are unlikely to be able to profit using an integrated security platform as a differentiator. This pretty much leaves OS vendors. MS has a monopoly so they don't have much financial motivation to dump money into it. Apple doesn't really have a malware problem, with most users never seeing any malware let alone making a purchasing decision based upon the fear of OS insecurity. Linux is fragmented, has little in the way of malware problems, and has niche versions for those worried about it.
I'm convinced malware is largely solvable. It will never be completely eliminated by the vast majority could be filtered out if we implemented some of the cool new security schemes used in high security environments. But who's going to do it? Maybe Apple or a Linux vendor if somehow they grow large enough or their platform is targeted enough. Maybe if MS were broken up into multiple companies with the IP rights to Windows, they're start competing to make a more secure product than their new rival. Other than that, we just have to sit in the mess we've made.
Considering that the x86 platform is inherently insecure, I don't understand why this is surprising to people. Until we move away from the architecture, I don't think someone who says they takes PC's security seriously is being as serious as they could be. And yes, I do realize that a new architecture is a huge change, and one that's going to be a long time coming... But it's something that WILL happen. We will eventually need to overcome the shortcomings of x86, and it's at that point that we can really start to take proactive PC security more seriously.
It may be that a secure and convenient system is possible, but it's too expensive for anybody to sit down and write.
Rather, we're slowly and incrementally making improvements. There's quite a bit of momentum to overcome (witness the uproar when somebody suggests replacing Unix DAC with SELinux MAC) in any installed base, but that's where the change needs to come from, since it's too expensive to do otherwise.
If time and money were no object, everything would be different. More efficient allocation of the available time and money is happening as a result of Internet collaboration.
So, 'we're getting there' seems to be as good an answer as any.
My God, it's Full of Source!
OUTSIDE_IP=$(dig +short my.ip @outsideip.net)
There is no market in safe, secure computing unless you're a closed system. Macs are generally safer, but are a closed system. Windows isn't, but Microsoft isn't in the business of selling hardware. They're in the business of helping hardware become obsolete in order to sell more software. Until it's in Microsoft's interest to be secure, why would they worry? They NEED computers to "break" every few years. See: 1970's American autos.
-kgj
Not to bash MS but isn't it primarily Windows that is the worst culprit when it comes to IT security? No level of proactive security policies can possibly keep up with the vulnerabilities inherent in the MS OS's. With each iteration new vulnerabilities are discovered and exploited before MS even knows they exist and literally days or even hours after new releases. This is not the case in environments ix or ux. Until MS puts way more effort into securing their OS's, the world will continue to be a digitally dangerous place.
I don't know what he's talking about. Computer security is perfectly RUSSIAN H4X0R YURI HAS 0WNED THIS POST @%$2$^^PO(@!#$^_@($Y^[NO CARRIER]
"The frustrating, jealously guarded secret is that when it comes to actually enabling others to develop secure systems, we deliver far less value than could be expected."
The biggest names in security make their living by telling you what you're doing wrong that what you do to fix them. You're going to spend money if you're scared. Everything from the largest security companies and even to pundits like Schneier spend most of their time Monday morning quarterbacking, telling you what you're doing wrong, and why you should listen to them but offer no real ways to predict how to secure yourself in the future.
When you have an entire industry focused on patents, copyrights, regulation and litigation, where is the money to develop tighter security going to come from?
I think the issue is not that we're bad at security, it's just that attacks are cheap, so you need the virtual equivalent of fort knox security on every webserver. That sort of thing isn't feasible.
The lock on my house isn't 100% secure, but a random script kiddie isn't pounding on it 24/7, so it's good enough.
Re:x86 will not fix passwords on post it notes / other ways to get a good passoword and no a password that changes each week and locks out any thing that even looks like your past 10 ones is even more of joke.
Almost every major problem in computer science is the result of our infatuation with the Turing machine. The problem with the Turing computing model is that time is not an inherent part of the model. Timing is the key to solving the cyber security and reliability crises. Turing is the problem, not the solution.
Check out this short discussion at the new Federal Cybersecurity R&D Forum.
In my experience, developers don't want Security anywhere near their products. We insist that they fix these "theoretical" and "academic" security problems, ruining their schedules and complicating their architectures.
Fine! Whatever. We will continue cleaning up your messes and pointing out the errors in your coding (which we warned you about). You can continue stonewalling us and doing everything you can to avoid us. We still get paid and you still get embarrassed.
A slashdotter who didn't build his own computer is like a Jedi who didn't build his own lightsaber.
That particular example is a bad one for the point you're making.
Things happen when you have control logic and peripherals.
By "peripherals" I mean anything the code can control. It could be a database, or a Space Shuttle main engine.
Dan Bernstein's theory, which he sharply distinguishes from least privilege, is to ruthlessly eliminate the code's control over anything not actually required. No matter how complex the code, it can't do anything that the computer can't. No compromise of my laptop could damage a shuttle main engine. Sandboxing is an attempt to implement this philosophy.
By "control logic", I mean anything that is an input that has results. A mouse is control logic. A radio button on a form is control logic that is simple enough to analyze. A web browser is control logic that is beyond definite analysis.
So a web form that builds a SQL statement from user input should have set off alarm bells on general principles, because it's allowing a malicious user to edit code in a complex programming language that has control over a database.
If you define security as being able to determine whether or not a program will reach an undesired state given arbitrary input, isn't that equivalent to the halting problem? Isn't that NP hard? I know that I generally force programs to halt when they're behaving badly, if they don't halt on their own.
For all intensive purposes, "whom" is no longer a word. That begs the question, "who cares"?
Until there are negative consequences for the execs, there will never be IT security because it costs money. If the execs of companies that have IT breaches were jailed for a couple of years (hard time, not some R&R farm) and personally fined millions of dollars, they would insist on proper security, rather than blowing it off. 'Course, these are the same guys who schmooze with, and pay bribes to, "our" elected representatives, so that's never gonna happen.
"Security is not a product, it's a process", and, since there's no easily calculated ROI on the time spent on securing IT, even when there's a paper process, it is so frequently bypassed that it might as well not exist.
#1. Getting management to say "OK we'll let the deadline slide, max out the budget and reduce some functionality/ease-of-use so we can fix the security flaws".
#2. Getting minimum wage Java programmers to understand/care about securing their code.
Things are not helped by the sad state of so-called security products by the likes of Symantec that seem very popular with PHB's, they must have a lot of sales reps hanging around golf courses.
Its also a bit much Google bitching about other people's security - wardriving streetview anyone?
#include <sig.h>
No. And no one is saying that.
You might want to look at this article.
http://www.ranum.com/security/computer_security/editorials/antivirus/index.html
There is no SINGLE solution that is 100% EFFECTIVE for EVERY scenario.
But the current focus on black lists is ineffective. At least white lists would give SOME degree of protection.
Fuck legacy. Seriously. I'm tired of everyone trotting out "legacy" as if it were some natural law.
A 100% brand new system today will STILL be vulnerable to the same attacks that were directed at the previous version of that system. That is simply bad design.
And why do you need that?
Why not just a series of steps getting from the current disaster to a state closer to "best practices"?
Because there will always be "malware" does NOT mean that the situation cannot be improved. Instead of millions of machines infected, how about we aim for an environment where only 100,000 machines are infected?
...you could proactively solve every security problem by exploiting some weakness that all of them have in common? And what if I told you that the same weakness is also responsible for the unreliability of software in general?
We should attack security issues the way pathologists attack contagious viral diseases. We must find something vital that is common to all the viruses and devise a vaccine that targets the common weak point.
FWIW, I believe that the weak point of malevolent code has to do with timing. So, we will not solve the security problem with our current software model. We will need a new model that incorporates timing at the fundamental level.
Time is the main missing ingredient in a Turing Machine. We need a new computing model.
Sandboxing is not reactive at all and should be the default setup for many applications, is this guy truly Goggle's security expert? What a joke.
Anyone with half a brain can avoid security threats, that people actively choose not to for imaginary convenience says a hell of a lot more about them than anyone else.
Have a fucking clue (the bar is much lower than people pretend) so you can avoid doing stupid shit like running Microsoft software and clicking anything and everything and allowing whatever to run.
Update god dammit, and ditch bs unreliable software.
And if it takes writing down your passwords (but only the passwords) in an obfuscated manner then by all means do so as long as you choose long hard passwords, keep them on your body (and if you can't stop pickpockets you have an issue that can be resolved by becoming a tiny little bit smarter).
Computer security isn't much harder than not letting in people claiming to need in to switch the entrance carpets: if they don't have a key don't give them access, it's not your problem but if you don't have a locked door in the first place (most computers and most computer "security") then smarten up or it makes no difference.
Some of us (like me) NEVER have uncontrolled security issues (and yes i browse porn thank you very much, and download movies and TV shows, but not without taking sensible precautions including choice of operating system), and it takes a bare minimum of PROACTIVE effort. Anyone fit to use a computer should be able to do the same if they actually find it important enough (but they don't).
I'm convinced that the software companies intentionally fuck up the interfaces like that. That way they are not responsible if the user installs something bad.
And, exactly like you posted, the user will NOT read the pop-ups after the first few. All they will see is a "click 'yes' to continue" the same as they see on the EULA's and every other pop-up. The same as "do you want to run this".
A basic white list would be better for the users than the current situation. And pop-up a DIFFERENT box when the user is trying to install anything not on that white list.
Who makes the white lists? Why not the anti-virus companies? Yeah, I know about McAfee. At least this way they'd be more effective. If you want to install Civ9 and the anti-virus app checks the hashes and sees that it is legit, then no scary warnings.
It should be easier to keep a list of software from major vendors than to try to track every possible variation of every piece of "malware" out there.
There is a way to discover bad code. It has to do with timing. If timing had been part of our computing model from the beginning, we would have no trouble identifying bad code. Why? Because they cannot help changing, even if slightly, the temporal signature of a software system. It's time to retire the Turing computing model because time is its main missing ingredient. It's all in the timing.
Read How to Construct 100% Bug-Free Software. The only problem is that we need a new computing model. The current one obviously sucks.
I would hate to work in an environment where "it's hopeless, nothing we do today works" was the prevailing theme.
Take off every 'sig' !!
nt;
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
I'm wondering how the license issues will fall out on locked-down Android based devices, and that is part of the problem.
(Locked-down and tied-down are slightly different things.)
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
The most correct program in existence consists of exactly one instruction:
NO-OP
and it is unfortunately not correct in all contexts.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
You mean the race condition between the marketing department's release schedule and the engineering department's bugzilla?
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Bosses keep saying, why re-invent the wheel?
If our wheels are triangular and Microsoft keeps selling us on the idea that wheels are supposed to be triangular, then we need more people to tell it like it is.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
Bill Gates and Steve Ballmer made the mess, and I'm doing my best not to sit in it.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
if you put a lock on a box and leave the box in the middle of the highway, is the box secure?
I'm inclined less to access control lists (vectors, whatever) and more to ephemeral users (kind of like sandboxes for everything, but not really).
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
All the primary incentives are, still, tilted towards low-cost, high functionality, ease of use. The truth is that computers and software are now mass market devices, little different than sneakers or pencils. In spite of all the security problems people won't pay sufficiently and they won't tolerate the security gating and slowdown mechanisms. Not for the most part.
And there's huge denial or ignorance of what the goals of the bad guys are. I've heard many times, "I don't have anything of value on my computer. There's nothing to steal and therefore security isn't a problem." What these people do not appreciate is that ANY computer, especially on the Internet, is a valuable resource. It has the ability to work, participate in botnets, and attack others. It can just be a reservoir of malware code. There are thousands of reasons why every computer has value to the bad guys.
And it's not just security. People won't pay sufficiently for reliability either. In fact we had, and to some extent continue to have secure systems. They are called mainframes and minis, and their cost and slowness to evolve meant that their market share is much smaller than it was 30 years ago. We had reliable systems too. They were called Tandems, MVS SysPlexes, VMS clusters, and so forth. Those too were too expensive and inflexible for the market and suffered huge market share losses.
The answers are not unknown and commercial implementations have existed for years. The markets abandoned them in droves when simpler, cheaper, easier to use (and riskier) alternatives appeared.
Come to think of it, we had less automotive pollution (overall, not in certain specific areas) in the '70s, too.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
I wonder if my sock puppet has mod points.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
it only postpones the problem, as long as the industry itself is pushing impossible deadlines and weighing them down (and fueling them) with impossible feature lists.
Sandboxing is good in theory, but nobody really does it right, yet. The present version is more of a low wall than a speedbump, for now. Today's low walls are tomorrows speedbumps.
Computer memory is just fancy paper, CPUs just fancy pens with fancy erasers; the 'net is just a fancy backyard fence.
I've read through all the comments, and this is the only sane one that stands out. The principle of least privilege, as I see it, is the idea of letting the user give privileges to a program at run time, and they would chose the least possible set of resources to get the job done.
The main thing is that with cabsec, you NEVER trust a program with the full resources of a user, and thus it never has enough resources to take out your system.
Consider if Outlook were only allowed to talk to a mail server, and a datastore, and use the console IO. It wouldn't be possible for an email to take out anything else, as it would be out of the scope of allowed actions. Everyone could manage profiles for things to automate the normal routine stuff, and use a nice GUI for the tricky bits... saving the settings if the results were favorable.
The big plus of cabsec (CApability Based SECurity) is that it would allow pretty much anyone to manage their own system, and to NEVER worry about virii again.
It can be done, but for many good reasons most users have never heard of it.
The principles of secure software are almost the same as bugfree software. No silver bullet -- again.
Even in shops that I have worked in where there was an attempt at high security at a network level, there are other events that occur for the admins to do their job that undermines said security such as using portable media, shared user IDs. This because security has only been done to the extent that it will cost no more money where a complete infrastructure of servers should have been put in place to allow people to work in the environment; safe staging servers and the like. Furthermore I see less 'security robust' operating systems replacing ones that are more secure because they are easier and cheaper to administer. Developers and admins complain because an operating system like Solaris or AIX are basically nothing but a kernel and therefore require more time and effort compared to a swiss army knife such as Red Hat. Sure, one could strip down a Red Hat install to the bare essentials but again, no one is allowed to take the time. Don't even get me started on the negatives of offshoring.
Companies have never, ever, invested enough in IT. They want servers to be quick, easy, and as cheap as possible. Until companies recognize the level of investment required in hardware and people to make an environment truly secure we will continue to be reactive.
Laws are rules for the court, but merely a bottom bar to hit for life. Think beyond laws in your actions always.
Mr. Zalewski lives in his little unsecure world, not understanding the big picture. IBM Power Systems running i5/OS (formerly iSeries and AS/400) keep data and programs in separate memory areas. You cannot execute data as a program unless you go through an IBM compiler. To my knowledge there has never been a virus in the wild on this platform. We don't even need firewalls! This basic concept is not used in any other computer I know of, but surely the patents have expired by now and others can use this concept if they could break free of the PC processor mentality.
But security be damned. There's more money to be made with insecure systems (not just by the scammers but also the "security researchers" and all the other security infrastructure) and until that incentive disappears, we will have "just-in-time" security, which is now becoming "just-a-bit-late; sorry-about-that" security. People are more impressed when you fix their computer than when it runs for years without any viruses or other malware.
If I used a sig over again, would anyone notice?