4 ms·

I'm not jumping to any conclusions. The exploit appears to be a deserialization bug in a the REST plugin for Struts that allowed the attackers to perform arbitr

I'm not jumping to any conclusions. The exploit appears to be a deserialization bug in a the REST plugin for Struts that allowed the attackers to perform arbitrary code execution: >The bug specifically affects a popular plugin called REST, which developers use to handle web requests, like data sent to a server from a form a user has filled out. The vulnerability relates to how Struts parses that kind of data and converts it into information that can be interpreted by the Java programming language. When the vulnerability is successfully exploited, malicious code can be hidden inside of such data, and executed when Struts attempts to convert it. >That means intruders could easily inject malware into web servers, possibly without being detected, and use it to steal or delete sensitive data, or infect computers with ransomware, among other things. https://qz.com/1073221/the-hackers-who-broke-into-equifax-exploited-a-nine-year-old-security-flaw/ https://qz.com/1073221/the-hackers-who-broke-into-equifax-ex...

hota_mazi 9y ago
Like I said, none of that would have happened if Equifax had used very basic network safety principles. This has nothing to do with Java EE.
- yogthos 9y ago
  None of that would've happened if Struts didn't have remote code execution bugs in it either. My original point was precisely that there are many attack vectors, and a complex stack makes it nearly impossible to account for all of them.
  - wglb 9y ago
    Name one that is immune. Clue: none are.
    - grzm 9y ago
      This kind of statement is the basis of a lot of false equivalence. You're right: there have been exploits found in many different types of systems. Is it easier for bugs to hide in complex systems? Are some systems more complex than others? I think it's pretty unconstriversial to say the answer to both of these are yes. I don't see your parent saying that this could only occur in this stack.
      - wglb 9y ago
        Ok, let's try from this angle? Are you familiar with Capability Maturity Model https://www.sei.cmu.edu/reports/93tr024.pdf https://www.sei.cmu.edu/reports/93tr024.pdf? Now we know how to build reliable software to fly airplanes and land men on the moon. The CMM level 5 is a pretty effective component of this. Now if you take the bottom 400 companies of the fortune 500, where do you think their public-facing web sites fare on the CMM scale? As another part of the exercise, what software that does anything remotely interesting is not complex?
        grzm 9y ago
        Thanks for the link. I haven't read it, but from the name and the little I know about NASA software development practices, it's not clear to me at all that these are inconsistent. They're orthogonal, if anything. Are they not? Is there something in CMM that says that complex systems are not more difficult to understand (and therefore more likely to hide/contain bugs)? Where a particular set of companies falls on such a scale is also independent of this, isn't it? I feel like I'm missing something (which admittedly may be because I haven't read the linked PDF), so if you'd be willing to take the time to expound, I'd appreciate it.
        wglb 9y ago
        The point of the CMM is that it is a measure of an organization's capability to develop error free software. The trick is that it is a very time consuming, deliberate process. Not exactly agile. Read: vastly increases cost of developing software, certainly increases time to market.
        grzm 9y ago
        Thanks for the synopsis. Given what you've written here I don't see how that would be in opposition to what I've written above. A team could have a goal of writing simpler, composable code and use CMM to measure their capability against CMM criteria. Or am I misunderstanding?

hota_mazi 9y ago

Like I said, none of that would have happened if Equifax had used very basic network safety principles. This has nothing to do with Java EE.

yogthos 9y ago
None of that would've happened if Struts didn't have remote code execution bugs in it either. My original point was precisely that there are many attack vectors, and a complex stack makes it nearly impossible to account for all of them.
- wglb 9y ago
  Name one that is immune. Clue: none are.
  - grzm 9y ago
    This kind of statement is the basis of a lot of false equivalence. You're right: there have been exploits found in many different types of systems. Is it easier for bugs to hide in complex systems? Are some systems more complex than others? I think it's pretty unconstriversial to say the answer to both of these are yes. I don't see your parent saying that this could only occur in this stack.
    - wglb 9y ago
      Ok, let's try from this angle? Are you familiar with Capability Maturity Model https://www.sei.cmu.edu/reports/93tr024.pdf https://www.sei.cmu.edu/reports/93tr024.pdf? Now we know how to build reliable software to fly airplanes and land men on the moon. The CMM level 5 is a pretty effective component of this. Now if you take the bottom 400 companies of the fortune 500, where do you think their public-facing web sites fare on the CMM scale? As another part of the exercise, what software that does anything remotely interesting is not complex?
      - grzm 9y ago
        Thanks for the link. I haven't read it, but from the name and the little I know about NASA software development practices, it's not clear to me at all that these are inconsistent. They're orthogonal, if anything. Are they not? Is there something in CMM that says that complex systems are not more difficult to understand (and therefore more likely to hide/contain bugs)? Where a particular set of companies falls on such a scale is also independent of this, isn't it? I feel like I'm missing something (which admittedly may be because I haven't read the linked PDF), so if you'd be willing to take the time to expound, I'd appreciate it.
        wglb 9y ago
        The point of the CMM is that it is a measure of an organization's capability to develop error free software. The trick is that it is a very time consuming, deliberate process. Not exactly agile. Read: vastly increases cost of developing software, certainly increases time to market.
        grzm 9y ago
        Thanks for the synopsis. Given what you've written here I don't see how that would be in opposition to what I've written above. A team could have a goal of writing simpler, composable code and use CMM to measure their capability against CMM criteria. Or am I misunderstanding?