4 ms·

But you feel morally ok by selling exploits? You never know how are they being used, how come you're so proud of it?

nickpsecurity 10y ago
I was originally against it but now I'm neutral on it. Most of the exploits are intentionally put there by companies that have enough money & expertise to avoid them. The bigger ones have enough money to make compilers and CPU's that make the software immune to code injection. Microsoft even has Steve Lipner who did one of projects (below) that taught me high-assurance security. Like them, his philosophy is shipping product over correctness since that is what market rewards. As for market, they almost always buy something insecure over something more secure if even the slightest extra benefit in insecure thing. You can't get them to use something secure even when it's free (eg Signal). So, what you should be thinking is you and/or other people are using and financially rewarding companies that intentionally leave vulnerabilities in software. Is that morally right? Probably not. Is someone making money off those vulnerabilities morally right? Probably not. The first seems worse, though, as the vulnerability market would be tiny if it wasn't happening. They'd command higher prices but even that would mean less damage. http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf Note: Compare Design and Assurance sections to how commercial or FOSS VM's are built today. Regular "security" is a joke.
- md_ 10y ago
  Wait, what? Did you just say software companies intentionally embed vulnerabilities in software?
  - nickpsecurity 10y ago
    Yes. They don't put the individual vulnerabilities in there on purpose. It's an indirect effect that they're conscious of. They know certain practices will reduce the amount of vulnerabilities in their software at some increased cost. They know a quick-and-dirty approach will leave a ton of bugs, including vulnerabilities, in there at a higher, profit margin. If not embedded, they also usually sell the fixes for it in terms of support contracts or upgrades. They consciously choose to go the route that increases vulnerabilities and profits. After problems happen, they do as little as possible to patch them while underlying process creating them for profit remains. We call the result of this game penetrate-and-patch. By avoiding QA for extra profit, they're effectively adding vulnerabilities to their software. There's other companies that know certain practices reduce their defect rates or security worries. They're preventing or removing defects on a regular basis while still making a profit. These companies are rare. Most leave vulnerabilities in. The project managers will even tell you that if you question them in a way to get a straight answer. Here's Lipner at Microsoft straight up saying it. He at least still turned their security around a lot with compromise that was SDL. https://blogs.microsoft.com/microsoftsecure/2007/08/23/the-ethics-of-perfection/ https://blogs.microsoft.com/microsoftsecure/2007/08/23/the-e... A recent example comes from Jack Ganssle in The Embedded Muse where he points out basically nobody commissioning embedded systems will sacrifice dollars or time-to-market for security: http://www.ganssle.com/tem/tem314.html#article2 http://www.ganssle.com/tem/tem314.html#article2 A follow up was a person that lost their job improving security in an embedded product: http://www.ganssle.com/tem/tem315.html#article5 http://www.ganssle.com/tem/tem315.html#article5 Others in later issues & other forums I've read all consistently say the same things. Total apathy where it's not even on the checklist or requirements is default. I experienced this myself with a lot of people I tried to sell on security at 10-30% extra cost. Just 10-30% on a critical system! Most in embedded will also frown on or fire you for improving security if it adds substantially to the BOM cost, dev cost, or time-to-market. You're supposed to do it cheap as possible. It's why 8-bitters are still selling by the millions of units or however large number despite little to no built-in safety/security. Hard to argue with $1 a chip vs $5-30 when selling 100,000+ units of a product with that different being profit. And you probably won't even get sued over hacks! :) Counterexamples in case you're curious of methods for making software with low defects at somewhere from slightly to 50% increased cost: http://infohost.nmt.edu/~al/cseet-paper.html http://infohost.nmt.edu/~al/cseet-paper.html http://www.anthonyhall.org/c_by_c_secure_system.pdf http://www.anthonyhall.org/c_by_c_secure_system.pdf Companies using those methods actually warrantied their software at specific defect levels that were usually under 6 bugs per loc. Praxis is still around as Altran.

I was originally against it but now I'm neutral on it. Most of the exploits are intentionally put there by companies that have enough money & expertise to avoid them. The bigger ones have enough money to make compilers and CPU's that make the software immune to code injection. Microsoft even has Steve Lipner who did one of projects (below) that taught me high-assurance security. Like them, his philosophy is shipping product over correctness since that is what market rewards. As for market, they almost always buy something insecure over something more secure if even the slightest extra benefit in insecure thing. You can't get them to use something secure even when it's free (eg Signal). So, what you should be thinking is you and/or other people are using and financially rewarding companies that intentionally leave vulnerabilities in software. Is that morally right? Probably not. Is someone making money off those vulnerabilities morally right? Probably not. The first seems worse, though, as the vulnerability market would be tiny if it wasn't happening. They'd command higher prices but even that would mean less damage. http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf http://www.cse.psu.edu/~trj1/cse543-f06/papers/vax_vmm.pdf Note: Compare Design and Assurance sections to how commercial or FOSS VM's are built today. Regular "security" is a joke.

md_ 10y ago
Wait, what? Did you just say software companies intentionally embed vulnerabilities in software?
- nickpsecurity 10y ago
  Yes. They don't put the individual vulnerabilities in there on purpose. It's an indirect effect that they're conscious of. They know certain practices will reduce the amount of vulnerabilities in their software at some increased cost. They know a quick-and-dirty approach will leave a ton of bugs, including vulnerabilities, in there at a higher, profit margin. If not embedded, they also usually sell the fixes for it in terms of support contracts or upgrades. They consciously choose to go the route that increases vulnerabilities and profits. After problems happen, they do as little as possible to patch them while underlying process creating them for profit remains. We call the result of this game penetrate-and-patch. By avoiding QA for extra profit, they're effectively adding vulnerabilities to their software. There's other companies that know certain practices reduce their defect rates or security worries. They're preventing or removing defects on a regular basis while still making a profit. These companies are rare. Most leave vulnerabilities in. The project managers will even tell you that if you question them in a way to get a straight answer. Here's Lipner at Microsoft straight up saying it. He at least still turned their security around a lot with compromise that was SDL. https://blogs.microsoft.com/microsoftsecure/2007/08/23/the-ethics-of-perfection/ https://blogs.microsoft.com/microsoftsecure/2007/08/23/the-e... A recent example comes from Jack Ganssle in The Embedded Muse where he points out basically nobody commissioning embedded systems will sacrifice dollars or time-to-market for security: http://www.ganssle.com/tem/tem314.html#article2 http://www.ganssle.com/tem/tem314.html#article2 A follow up was a person that lost their job improving security in an embedded product: http://www.ganssle.com/tem/tem315.html#article5 http://www.ganssle.com/tem/tem315.html#article5 Others in later issues & other forums I've read all consistently say the same things. Total apathy where it's not even on the checklist or requirements is default. I experienced this myself with a lot of people I tried to sell on security at 10-30% extra cost. Just 10-30% on a critical system! Most in embedded will also frown on or fire you for improving security if it adds substantially to the BOM cost, dev cost, or time-to-market. You're supposed to do it cheap as possible. It's why 8-bitters are still selling by the millions of units or however large number despite little to no built-in safety/security. Hard to argue with $1 a chip vs $5-30 when selling 100,000+ units of a product with that different being profit. And you probably won't even get sued over hacks! :) Counterexamples in case you're curious of methods for making software with low defects at somewhere from slightly to 50% increased cost: http://infohost.nmt.edu/~al/cseet-paper.html http://infohost.nmt.edu/~al/cseet-paper.html http://www.anthonyhall.org/c_by_c_secure_system.pdf http://www.anthonyhall.org/c_by_c_secure_system.pdf Companies using those methods actually warrantied their software at specific defect levels that were usually under 6 bugs per loc. Praxis is still around as Altran.