4 ms·

> Never again worry about zero-days. Before anyone asks, the point of this statement isn't "We'll never have a security hole." It's "the time-scale that the p

> Never again worry about zero-days. Before anyone asks, the point of this statement isn't "We'll never have a security hole." It's "the time-scale that the patch will be released and applied is less than one hour, not multiple days". An alternative way of putting it might be: Zero hours are the new zero days.

barkingcat 10y ago
Maybe reword that phrasing a bit then to make it mean what you want? As a server operator I will always be worried about zero days, regardless of what my cms is or who wrote the software. The person who stops worrying about it is the one who will get hacked. Maybe you mean "stop waiting for vendors to patch zero days?" And even then, once a zero-day hits, someone's going to have to write that patch, and if it's in a base library like openSSL it can be non-trivial, and you're going to have to wait regardless of what CMS you choose. Either way, the wording needs to be refined.
- CiPHPerCoder 10y ago
  I added a footnote to clarify the intent. The point of short statements like that is to encourage further scrutiny from skeptical security folks. Our previous attempts just led to people nodding along and saying "Sounds great!" https://paragonie.com/blog/2016/05/keyggdrasil-continuum-cryptography-powering-cms-airship https://paragonie.com/blog/2016/05/keyggdrasil-continuum-cry...
chrisan 10y ago
For anyone that has used this, how are automatic updates with custom code/plugins? I think Wordpress gets a lot of flak from all of the custom code/plugins while the WP core has been pretty secure in recent years in fixing 0-days? (I'm not a WP dev, but we do contract out for our company's marketing site and just going off what I hear from them)
- CiPHPerCoder 10y ago
  > I think Wordpress gets a lot of flak from all of the custom code/plugins while the WP core has been pretty secure in recent years in fixing 0-days? I don't entirely agree or disagree. It's a nuanced topic. The WordPress core team sat on a Unicode-based SQL injection flaw for years, after it was known to their team, then tried to sneak the fix in under the guise of Emoji support. https://kraft.im/2015/05/how-emoji-saved-your-sites-hide/ https://kraft.im/2015/05/how-emoji-saved-your-sites-hide/ Part of fixing 0-days is minimizing the feedback loop from "bug known" to "bug fixed". The other part is minimizing the feedback loop from "bug fixed" to "fix deployed". To their credit, they at least try to solve the latter problem. To their detriment, if you compromise their update server, you've got RCE on just over 25% of the websites on the Internet. (Among other things, their update hooks use unserialize(), which allows for some fun exploitation techniques.) With Airship, root access to our update server doesn't let you forge updates. You'll need an airgapped Ed25519 signing key, and then you still have a catch-22 to resolve: A. Announce your presence to the network (untargeted attack) B. Find another way to hack every other Airship just so you can perform a silent, targeted attack against a single Airship. This catch-22 makes exploiting a pilfered signing key unattractive to nation states, who generally want their activities to be covert.
  - ryanlol 10y ago
    > Among other things, their update hooks use unserialize(), which allows for some fun exploitation techniques S-s-surely not?
anton_gogolev 10y ago
> the time-scale that the patch will be released and applied is less than one hour, not multiple days Provided that the Auto-Updater is up and running: https://cspr.ng/blog/2016/07/cms-airship-1-1-2-stored-xss-post-mortem https://cspr.ng/blog/2016/07/cms-airship-1-1-2-stored-xss-po...

barkingcat 10y ago

Maybe reword that phrasing a bit then to make it mean what you want? As a server operator I will always be worried about zero days, regardless of what my cms is or who wrote the software. The person who stops worrying about it is the one who will get hacked. Maybe you mean "stop waiting for vendors to patch zero days?" And even then, once a zero-day hits, someone's going to have to write that patch, and if it's in a base library like openSSL it can be non-trivial, and you're going to have to wait regardless of what CMS you choose. Either way, the wording needs to be refined.

CiPHPerCoder 10y ago
I added a footnote to clarify the intent. The point of short statements like that is to encourage further scrutiny from skeptical security folks. Our previous attempts just led to people nodding along and saying "Sounds great!" https://paragonie.com/blog/2016/05/keyggdrasil-continuum-cryptography-powering-cms-airship https://paragonie.com/blog/2016/05/keyggdrasil-continuum-cry...

chrisan 10y ago

For anyone that has used this, how are automatic updates with custom code/plugins? I think Wordpress gets a lot of flak from all of the custom code/plugins while the WP core has been pretty secure in recent years in fixing 0-days? (I'm not a WP dev, but we do contract out for our company's marketing site and just going off what I hear from them)

CiPHPerCoder 10y ago
> I think Wordpress gets a lot of flak from all of the custom code/plugins while the WP core has been pretty secure in recent years in fixing 0-days? I don't entirely agree or disagree. It's a nuanced topic. The WordPress core team sat on a Unicode-based SQL injection flaw for years, after it was known to their team, then tried to sneak the fix in under the guise of Emoji support. https://kraft.im/2015/05/how-emoji-saved-your-sites-hide/ https://kraft.im/2015/05/how-emoji-saved-your-sites-hide/ Part of fixing 0-days is minimizing the feedback loop from "bug known" to "bug fixed". The other part is minimizing the feedback loop from "bug fixed" to "fix deployed". To their credit, they at least try to solve the latter problem. To their detriment, if you compromise their update server, you've got RCE on just over 25% of the websites on the Internet. (Among other things, their update hooks use unserialize(), which allows for some fun exploitation techniques.) With Airship, root access to our update server doesn't let you forge updates. You'll need an airgapped Ed25519 signing key, and then you still have a catch-22 to resolve: A. Announce your presence to the network (untargeted attack) B. Find another way to hack every other Airship just so you can perform a silent, targeted attack against a single Airship. This catch-22 makes exploiting a pilfered signing key unattractive to nation states, who generally want their activities to be covert.
- ryanlol 10y ago
  > Among other things, their update hooks use unserialize(), which allows for some fun exploitation techniques S-s-surely not?

anton_gogolev 10y ago

> the time-scale that the patch will be released and applied is less than one hour, not multiple days Provided that the Auto-Updater is up and running: https://cspr.ng/blog/2016/07/cms-airship-1-1-2-stored-xss-post-mortem https://cspr.ng/blog/2016/07/cms-airship-1-1-2-stored-xss-po...