3 ms·

Wait, what? Did you just say software companies intentionally embed vulnerabilities in software?

by md_ 10y ago

nickpsecurity 10y ago
Yes. They don't put the individual vulnerabilities in there on purpose. It's an indirect effect that they're conscious of. They know certain practices will reduce the amount of vulnerabilities in their software at some increased cost. They know a quick-and-dirty approach will leave a ton of bugs, including vulnerabilities, in there at a higher, profit margin. If not embedded, they also usually sell the fixes for it in terms of support contracts or upgrades. They consciously choose to go the route that increases vulnerabilities and profits. After problems happen, they do as little as possible to patch them while underlying process creating them for profit remains. We call the result of this game penetrate-and-patch. By avoiding QA for extra profit, they're effectively adding vulnerabilities to their software. There's other companies that know certain practices reduce their defect rates or security worries. They're preventing or removing defects on a regular basis while still making a profit. These companies are rare. Most leave vulnerabilities in. The project managers will even tell you that if you question them in a way to get a straight answer. Here's Lipner at Microsoft straight up saying it. He at least still turned their security around a lot with compromise that was SDL. https://blogs.microsoft.com/microsoftsecure/2007/08/23/the-ethics-of-perfection/ https://blogs.microsoft.com/microsoftsecure/2007/08/23/the-e... A recent example comes from Jack Ganssle in The Embedded Muse where he points out basically nobody commissioning embedded systems will sacrifice dollars or time-to-market for security: http://www.ganssle.com/tem/tem314.html#article2 http://www.ganssle.com/tem/tem314.html#article2 A follow up was a person that lost their job improving security in an embedded product: http://www.ganssle.com/tem/tem315.html#article5 http://www.ganssle.com/tem/tem315.html#article5 Others in later issues & other forums I've read all consistently say the same things. Total apathy where it's not even on the checklist or requirements is default. I experienced this myself with a lot of people I tried to sell on security at 10-30% extra cost. Just 10-30% on a critical system! Most in embedded will also frown on or fire you for improving security if it adds substantially to the BOM cost, dev cost, or time-to-market. You're supposed to do it cheap as possible. It's why 8-bitters are still selling by the millions of units or however large number despite little to no built-in safety/security. Hard to argue with $1 a chip vs $5-30 when selling 100,000+ units of a product with that different being profit. And you probably won't even get sued over hacks! :) Counterexamples in case you're curious of methods for making software with low defects at somewhere from slightly to 50% increased cost: http://infohost.nmt.edu/~al/cseet-paper.html http://infohost.nmt.edu/~al/cseet-paper.html http://www.anthonyhall.org/c_by_c_secure_system.pdf http://www.anthonyhall.org/c_by_c_secure_system.pdf Companies using those methods actually warrantied their software at specific defect levels that were usually under 6 bugs per loc. Praxis is still around as Altran.

Wait, what? Did you just say software companies intentionally embed vulnerabilities in software?

by md_ 10y ago

Wait, what? Did you just say software companies intentionally embed vulnerabilities in software?

Yes. They don't put the individual vulnerabilities in there on purpose. It's an indirect effect that they're conscious of. They know certain practices will reduce the amount of vulnerabilities in their software at some increased cost. They know a quick-and-dirty approach will leave a ton of bugs, including vulnerabilities, in there at a higher, profit margin. If not embedded, they also usually sell the fixes for it in terms of support contracts or upgrades. They consciously choose to go the route that increases vulnerabilities and profits. After problems happen, they do as little as possible to patch them while underlying process creating them for profit remains. We call the result of this game penetrate-and-patch. By avoiding QA for extra profit, they're effectively adding vulnerabilities to their software. There's other companies that know certain practices reduce their defect rates or security worries. They're preventing or removing defects on a regular basis while still making a profit. These companies are rare. Most leave vulnerabilities in. The project managers will even tell you that if you question them in a way to get a straight answer. Here's Lipner at Microsoft straight up saying it. He at least still turned their security around a lot with compromise that was SDL. https://blogs.microsoft.com/microsoftsecure/2007/08/23/the-ethics-of-perfection/ https://blogs.microsoft.com/microsoftsecure/2007/08/23/the-e... A recent example comes from Jack Ganssle in The Embedded Muse where he points out basically nobody commissioning embedded systems will sacrifice dollars or time-to-market for security: http://www.ganssle.com/tem/tem314.html#article2 http://www.ganssle.com/tem/tem314.html#article2 A follow up was a person that lost their job improving security in an embedded product: http://www.ganssle.com/tem/tem315.html#article5 http://www.ganssle.com/tem/tem315.html#article5 Others in later issues & other forums I've read all consistently say the same things. Total apathy where it's not even on the checklist or requirements is default. I experienced this myself with a lot of people I tried to sell on security at 10-30% extra cost. Just 10-30% on a critical system! Most in embedded will also frown on or fire you for improving security if it adds substantially to the BOM cost, dev cost, or time-to-market. You're supposed to do it cheap as possible. It's why 8-bitters are still selling by the millions of units or however large number despite little to no built-in safety/security. Hard to argue with $1 a chip vs $5-30 when selling 100,000+ units of a product with that different being profit. And you probably won't even get sued over hacks! :) Counterexamples in case you're curious of methods for making software with low defects at somewhere from slightly to 50% increased cost: http://infohost.nmt.edu/~al/cseet-paper.html http://infohost.nmt.edu/~al/cseet-paper.html http://www.anthonyhall.org/c_by_c_secure_system.pdf http://www.anthonyhall.org/c_by_c_secure_system.pdf Companies using those methods actually warrantied their software at specific defect levels that were usually under 6 bugs per loc. Praxis is still around as Altran.