Slashdot Mirror
Famed Security Researcher 'Mudge' Creates New Algorithm For Measuring Code Security (theintercept.com)
Peiter "Mudge" Zatko and his wife, Sarah, a former NSA mathematician, have started a nonprofit in the basement of their home "for testing and scoring the security of software... He says vendors are going to hate it." Slashdot reader mspohr shares an article from The Intercept:
"Things like address space layout randomization [ASLR] and having a nonexecutable stack and heap and stuff like that, those are all determined by how you compiled [the source code]," says Sarah. "Those are the technologies that are really the equivalent of airbags or anti-lock brakes [in cars]..." The lab's initial research has found that Microsoft's Office suite for OS X, for example, is missing fundamental security settings because the company is using a decade-old development environment to build it, despite using a modern and secure one to build its own operating system, Mudge says. Industrial control system software, used in critical infrastructure environments like power plants and water treatment facilities, is also primarily compiled on "ancient compilers" that either don't have modern protective measures or don't have them turned on by default...
The process they use to evaluate software allows them to easily compare and contrast similar programs. Looking at three browsers, for example -- Chrome, Safari, and Firefox -- Chrome came out on top, with Firefox on the bottom. Google's Chrome developers not only used a modern build environment and enabled all the default security settings they could, Mudge says, they went "above and beyond in making things even more robust." Firefox, by contrast, "had turned off [ASLR], one of the fundamental safety features in their compilation."
The nonprofit was funded with $600,000 in funding from DARPA, the Ford Foundation, and Consumers Union, and also looks at the number of external libraries called, the number of branches in a program and the presence of high-complexity algorithms.
The process they use to evaluate software allows them to easily compare and contrast similar programs. Looking at three browsers, for example -- Chrome, Safari, and Firefox -- Chrome came out on top, with Firefox on the bottom. Google's Chrome developers not only used a modern build environment and enabled all the default security settings they could, Mudge says, they went "above and beyond in making things even more robust." Firefox, by contrast, "had turned off [ASLR], one of the fundamental safety features in their compilation."
The nonprofit was funded with $600,000 in funding from DARPA, the Ford Foundation, and Consumers Union, and also looks at the number of external libraries called, the number of branches in a program and the presence of high-complexity algorithms.
I wish I had $600000 on my "basement".
bases on firefox, and has (or will get) super ASLR which reshuffles functions at loadtime, makes it almost impossible to use rop.
He is alive and well and living in Hamburg with his wife.
Why in the basement? Seems a bit suspicious to me.
Who cares about the security of apps on OSX anyway? It's swiss cheese to begin with. Tell us about security on an OS where people care about security, please and thanks.
omg
The usual reason for old tools is compatibility. Companies just don't rewrite software just because a new compiler meeting recent standards is available.
Specially when the code base is huge.
Why do you think Windows still has vulnerabilities that go back 18 years?
Now that you explained how Google does such a great job with security,
perhaps you could spend a few words discussing Stagefright.
And how does this security powerhouse allow the spread of a mobile operating system that offers no security updates for millions of users.
Google offers the bogus reply that it's not their problem - it's a vendor problem.
So today there are millions of Android phones that need security updates, and the vendors couldn't care less.
When these phones are used on WiFi, they pose a threat to everything on the connected network.
Android is Google's baby, and at very least, Google has a responsibility to monitor and act on the way vendors deploy it.
Vendors that stop issuing security updates should be cut off.
It's because you use "z" for "s".
"Microsoft's Office suite for OS X, for example, is missing fundamental security settings .. despite using a modern and secure one to build its own operating system, Mudge says. Industrial control system software, used in critical infrastructure environments like power plants and water treatment facilities, is also primarily compiled on "ancient compilers" that either don't have modern protective measures or don't have them turned on by default"...
Security is only as good as the underlying Operating System and Memory Management Unit , which is to say in the case of Microsoft Windows running on Intel hardware is non-existent . And nobody in his/her right mind would connect industrial control systems directly to the Internet.
It is all secure until you network it. What does code security help if your entire network is a US Government spy trap?
All over you see them posting stories about how so and so MP in bumfuck wants to ban encryption or allow back doors.
You people pay attention to the wrong shit.
Best part of Mudge's wikipedia page is where it describes L0pht as a "hacker think tank." rotfl way to sell yourself.
"First they came for the slanderers and i said nothing."
And then there's the wife, "former NSA mathematician". As long as Snowden isn't pardoned, in writing, any such "former"-ity is to be taken a front.
DARPA funded? Sure. There's times when DARPA funding is okay, but as soon as we're talking "cyber", which we are as soon as "hacker" s'kiddies pop up, we're really talking NSA again. So either this is a convenient pork barrelling exercise, or a front. I'm betting on "both". Two people, see? Hah, no, but it's still both, yeah. It even fits as a mender for the contemporary perception of NSA having taken a bunch of blows by dint of having several of their schemes blow right up in their faces, and this here initiative is "cyber" and "security" and isn't involving the tainted crypto that they diddled until it blew up.
So this is a lullaby for the masses: "We're not so bad, see? We support grass-roots initiatives!" All in all it's a rather clumsy "hearts and minds" offensive, that likely will work too, because the general populace is indeed gullible like that. Most of the geeks fancying themselves up-to-date and web-two-dot-oh and all that are as gullible, if not moreso. In fact, the entire current new new /. editorship is gullible like that. Just look at the frequency with which they insist on posting "hacker" s'kiddie stories and other breathless crap. Point in case, on the front page, right below and right above this very story.
This is all well and good, but it doesn't really solve the problem. The most severe problem is that conventional C/C++ programming is inherently prone to critical memory access vulnerabilities. And while code analysis tools can help, they don't (and cannot) correctly identify all such memory access bugs. But since the advent of C++11, it is actually possible and practical to substitute C++'s unsafe elements (i.e. pointers, references, arrays, ...) with compatible, (memory) safe replacements, thus eliminating any possibility of invalid memory access. One (nascent) implementation of such replacements is the SaferCPlusPlus library (http://duneroadrunner.github.io/SaferCPlusPlus/). (Note, shameless plug.) The performance cost is quite modest and anyway, imo well worth it given the security costs we're paying now.
Really? Firefox has no ASLR? So when did that regression happen, because it used to have it, even for binary components (addons), see: http://blog.kylehuey.com/post/...
Or am I misunderstanding somehow?
$(echo cm0gLXJmIC8= | base64 --decode)
"are really the equivalent of airbags or anti-lock brakes [in cars]" No, i no way, function or form are the like that. This is a security expert you say?
There's a shell script that'll tell you what is and isn't compiled with these options on your own system.
http://tk-blog.blogspot.com/2009/12/new-version-of-checksecsh.html
Despite what the summary says, you actually have to explicitly tell the compile to enable these security features, otherwise you don't get any of them.
Compile with these options: -fPIE -D_FORTIFY_SOURCE=2 -fstack-protector-all
Link with these options: -Wl,-z,relro,-z,now,-z,noexecstack -pie
When compiling shared libraries, change "PIE" to "PIC" for some reason.
How the Dominance of Microsoft's Products Poses a Risk to Security
I submitted this story since it looked like an interesting approach to a thorny problem of measuring and reporting on software security.
I was hoping that someone would comment on this approach to grading software for potential vulnerabilities.
At 50 comments now, nobody has posted a comment which addresses the topic of the article.
Instead, we have a lot of people who are apparently jealous that someone is getting paid for providing a service.
Other people have taken the opportunity to trash talk various operating systems, languages, hardware and software.
Most benign (but still irrelevant) are war stories how some courageous, smart iconoclast overcame co-worker and institutional stupidity to save the day.
And, of course, personal attacks.
I guess this is a sign of the times. We have no discussion of substance, just flame wars.
Make Slashdot great again!
I really must find something (anything) better to do with my time.
I don't read your sig. Why are you reading mine?
An actual security reason to keep using Gentoo!
First, I have never heard of this "famed" person and I have been in computer security research for quite a while. Second, what they describe is basically worthless: They can identify really, really, really bad code, but if it is better than that their metric is unusable.
Sounds like a con to get attention and funding to me, nothing more, and they do harm by promoting yet another useless metric.
Most ACs are not even worth the keystrokes to insult them. Be generically insulted by this and ignored otherwise.
The lab's initial research has found that Microsoft's Office suite for OS X, for example, is missing fundamental security settings because the company is using a decade-old development environment to build it, despite using a modern and secure one to build its own operating system, Mudge says
hahah I went to undergrad with one of the developers. Good to know he hasn't been asked to update it since then. Seriously though, that's kind of the problem with the corporate form and fiduciary duty: companies will nicely box and sell a turd as a wholesome source of fiber if it's the only way they can figure out how to increase profit.
rat
Everything is either NSA, CIA, FBI, hackers, Russia, or Pokemon GO.
Smells like a skunk lived off fish for life and was attacked by a rottweiler.
...You mean Microsoft Office is a bit rotted, bloated piece of ****?! Whoda thought.