6 ms·

To get a feel for the current state of computer security I recommend spending a few days looking at the articles on https://www.reddit.com/r/netsec/ https://www

To get a feel for the current state of computer security I recommend spending a few days looking at the articles on https://www.reddit.com/r/netsec/ https://www.reddit.com/r/netsec/ Here you'll find the latest in information security. For example, here are just the top entries at the emoment. How I found a command injection vulnerability in my TV set while in bed (and how I exploited it using nc) PS4 4.0x WebKit Exploit Writeup (github.com) How to find 56 potential vulnerabilities in FreeBSD code in one evening Detecting and recovering from brute-forced RDP attacks (xednaps.com) CVE-2017-2416 Remote code execution triggered by malformed GIF in ImageIO framework (blog.flanker017.me) It's a fascinating field and the number of exploits appearing everyday is truley scary.

tyingq 10y ago
That does sort of invalidate the "things are starting to get better" part of the title. It must be difficult to get better because new software comes out all the time, and old software stays around. So the attack surface grows. IoT really pushes that model hard. I know the firmware in my TV hasn't changed since I bought it, but the newer model of the same TV has different firmware.
- cvwright 10y ago
  I'd argue that these are lagging indicators. The code that's deployed and being exploited now was written years ago, using languages and tools developed decades ago. If you read to the end of the article, it discusses recent DARPA projects that are addressing the tools and languages component. And most of this stuff is still in heavy development. Even assuming that we get it sorted out soon, it will still be years and years before most deployed software is built on these improved foundations. So yes, things are starting to get better. But it will take a long time before we see the results.
  - tyingq 10y ago
    Perhaps. Those tools, though, don't fix issues like default admin passwords, admin interfaces that listen on 0.0.0.0, and so forth. It's a fairly big jump for me to see the low end vendors adopting high end techniques when they don't even use ancient best practice.

tyingq 10y ago

That does sort of invalidate the "things are starting to get better" part of the title. It must be difficult to get better because new software comes out all the time, and old software stays around. So the attack surface grows. IoT really pushes that model hard. I know the firmware in my TV hasn't changed since I bought it, but the newer model of the same TV has different firmware.

cvwright 10y ago
I'd argue that these are lagging indicators. The code that's deployed and being exploited now was written years ago, using languages and tools developed decades ago. If you read to the end of the article, it discusses recent DARPA projects that are addressing the tools and languages component. And most of this stuff is still in heavy development. Even assuming that we get it sorted out soon, it will still be years and years before most deployed software is built on these improved foundations. So yes, things are starting to get better. But it will take a long time before we see the results.
- tyingq 10y ago
  Perhaps. Those tools, though, don't fix issues like default admin passwords, admin interfaces that listen on 0.0.0.0, and so forth. It's a fairly big jump for me to see the low end vendors adopting high end techniques when they don't even use ancient best practice.