4 ms·

The researcher's reaction is correct. OpenBSD maintainers' lack of patience may have led to this vulnerability being discovered and exploited by other people.

by iaml 9y ago

claudius 9y ago
The researcher’s lack of full disclosure may have lead to this vulnerability being discovered and exploited by other people.
- Xylakant 9y ago
  As far as I understood, this attack has no client-side mitigation that could be employed other than treating every wifi as an open network. The attack might already be known to hostile actors or may have become known during the embargo, but full disclosure without an embargo would guarantee that clients are at risk without mitigation. An embargo at least gives time to prep patches and protect at least a portion of the clients.
  - claudius 9y ago
    Either there is a possibility for patches to be prepared during an embargo or there is “no client-side mitigation”, you can’t have both. From reading the rest of this thread, it appears that it is quite possible to patch this on clients such that, if you are using a patched client, you are safe. Disclosing earlier would have lead to more people having patched clients earlier and hence being safe.
    - Xylakant 9y ago
      Patching the client is a fix. Mitigation would bea config setting that makes me safer (disable some unused functionality,...). So yes, you can have both.
      - claudius 9y ago
        That’s like saying that prior to introducing seatbelts, we should have allowed for a period of time to glue people to their seats because it is preferable to have a mitigation they can apply themselves than a fix the manufacturer has to put in. If you don’t limit mitigation to "a config setting" (and why would you?!), a patch/new version is the best mitigation you can get.
        Xylakant 9y ago
        I limit mitigation to a config setting because that’s what affected clients can do in this case. Everyone patching wpa_supplicant on their android handset is just not going to happen and it takes time for vendors to roll out patches.
  - koolba 9y ago
    > As far as I understood, this attack has no client-side mitigation that could be employed other than treating every wifi as an open network. I've been doing that for years and recommend others do so as well. The rise of HTTPS nearly everywhere helps mitigate things a bit. This same type of exploit 5 years ago would wreak havoc exploited at the local Starbucks WiFI.
- u123u4 9y ago
  I wonder when the NSA and CIA was responsibly informed about this vulnerability.
  - stsp 9y ago
    OpenBSD wifi maintainer here. I was informed on July 15. The first embargo period was already quite long, until end of August. Then CERT got involved, and the embargo was extended until today. You can connect the dots. I doubt that I knew something the NSA/CIA weren't aware of.
    - occultist_throw 9y ago
      In other words, its malfeasance by the security community for holding out. There's only a few courses of actions. One is to sit quietly and let everyone eventually do the solution. And that doesn't work. No fire under peoples' asses, and the work is delayed. The other, is to release it promptly. Then, at least we can decide to triage by turning down X service (even if wifi), requiring another factor like tunnel-login or what have you. But truthfully, defect in a Prisoners Game played out here was the best choice. The rest of the community is "agree".
      - lagosc 9y ago
        No one should care about a community that agrees that releasing silent patches is a good idea. This is exactly the same behavior that created the need for full disclosure in the first place. And no, there aren't just two options nor are processes binary. It's rather mind boggling how "the community" has managed to go full circle in such a short time and themselves become the opinionated people they were supposed to be the alternative to.
    - Filligree 9y ago
      Really makes me wish you'd told the world. I know all the arguments against that, but this sort of thing is no good either.
      - 9y ago
- sschueller 9y ago
  Also an embargo lasting months seems excessive. You also can not guarantee me that no one who gets this information early is not working for a bad actor.
  - abcdef123xyz 9y ago
    I'm just so glad this long embargo meant that everyone had patches ready to go as soon as it expired! Oh wait, they don't. Good job CERT.
mimi89999 9y ago
You got everything wrong. If big vendors are unable to patch their proprietary products in an acceptable time, that shouldn't put others at risk. Users shouldn't choose their products... Think about it in a different way: What if a vulnerability was discovered in TLS and FOSS implementations patched it, but there is an embargo for supposedly protecting some banking software? What if NSA/CIA/other agencies find out about it (they would know immediately) and use it to target users/activists?
- cyphar 9y ago
  This is why embargoes have deadlines. To make the necessary trade-off between "patch as soon as you can, potentially jeopardising the safety of users -- even users of non-proprietary projects" and "wait for everyone to be ready before you patch -- which also jeopardises users". The embargo system deals with this by forcing everyone to agree on a date, and if someone patches after that date then too bad. You may disagree that the deadline was so long, and that could be a fair criticism. But pretending as though co-ordination of any kind is somehow bad (and then resorting to emotional arguments and so on) is pretty reckless.
  - mimi89999 9y ago
    3 months is more of a joke than a reasonable time, but one can argue about that if he wants... > even users of non-proprietary projects Actually many FOSS projects get only notified on the disclosure date. Hiding the vulnerability for such a long time makes more harm good. The vulnerability can potentially be exploited by security agencies that necessarily know about them and could also be leaked to a bad actor by an employee of one the vendors. Hopefully WPA2 isn't that important, but potentially security sensitive users trusted something that was known by some to be vulnerable for 3 months! Bad actors could have used it against them. The embargo resulted in potentially bad actors knowing about the issue, but not vulnerable users.
    - user5994461 9y ago
      The state actor should be least of your worries compared to the millions of script kiddies would could use the vulnerability once it is disclosed publicly.
cm2187 9y ago
But have the other OS makers released patches already?

The researcher's reaction is correct. OpenBSD maintainers' lack of patience may have led to this vulnerability being discovered and exploited by other people.

by iaml 9y ago

The researcher's reaction is correct. OpenBSD maintainers' lack of patience may have led to this vulnerability being discovered and exploited by other people.

claudius 9y ago

The researcher’s lack of full disclosure may have lead to this vulnerability being discovered and exploited by other people.

Xylakant 9y ago
As far as I understood, this attack has no client-side mitigation that could be employed other than treating every wifi as an open network. The attack might already be known to hostile actors or may have become known during the embargo, but full disclosure without an embargo would guarantee that clients are at risk without mitigation. An embargo at least gives time to prep patches and protect at least a portion of the clients.
- claudius 9y ago
  Either there is a possibility for patches to be prepared during an embargo or there is “no client-side mitigation”, you can’t have both. From reading the rest of this thread, it appears that it is quite possible to patch this on clients such that, if you are using a patched client, you are safe. Disclosing earlier would have lead to more people having patched clients earlier and hence being safe.
  - Xylakant 9y ago
    Patching the client is a fix. Mitigation would bea config setting that makes me safer (disable some unused functionality,...). So yes, you can have both.
    - claudius 9y ago
      That’s like saying that prior to introducing seatbelts, we should have allowed for a period of time to glue people to their seats because it is preferable to have a mitigation they can apply themselves than a fix the manufacturer has to put in. If you don’t limit mitigation to "a config setting" (and why would you?!), a patch/new version is the best mitigation you can get.
      - Xylakant 9y ago
        I limit mitigation to a config setting because that’s what affected clients can do in this case. Everyone patching wpa_supplicant on their android handset is just not going to happen and it takes time for vendors to roll out patches.
- koolba 9y ago
  > As far as I understood, this attack has no client-side mitigation that could be employed other than treating every wifi as an open network. I've been doing that for years and recommend others do so as well. The rise of HTTPS nearly everywhere helps mitigate things a bit. This same type of exploit 5 years ago would wreak havoc exploited at the local Starbucks WiFI.
u123u4 9y ago
I wonder when the NSA and CIA was responsibly informed about this vulnerability.
- stsp 9y ago
  OpenBSD wifi maintainer here. I was informed on July 15. The first embargo period was already quite long, until end of August. Then CERT got involved, and the embargo was extended until today. You can connect the dots. I doubt that I knew something the NSA/CIA weren't aware of.
  - occultist_throw 9y ago
    In other words, its malfeasance by the security community for holding out. There's only a few courses of actions. One is to sit quietly and let everyone eventually do the solution. And that doesn't work. No fire under peoples' asses, and the work is delayed. The other, is to release it promptly. Then, at least we can decide to triage by turning down X service (even if wifi), requiring another factor like tunnel-login or what have you. But truthfully, defect in a Prisoners Game played out here was the best choice. The rest of the community is "agree".
    - lagosc 9y ago
      No one should care about a community that agrees that releasing silent patches is a good idea. This is exactly the same behavior that created the need for full disclosure in the first place. And no, there aren't just two options nor are processes binary. It's rather mind boggling how "the community" has managed to go full circle in such a short time and themselves become the opinionated people they were supposed to be the alternative to.
  - Filligree 9y ago
    Really makes me wish you'd told the world. I know all the arguments against that, but this sort of thing is no good either.
    - 9y ago
sschueller 9y ago
Also an embargo lasting months seems excessive. You also can not guarantee me that no one who gets this information early is not working for a bad actor.
- abcdef123xyz 9y ago
  I'm just so glad this long embargo meant that everyone had patches ready to go as soon as it expired! Oh wait, they don't. Good job CERT.

mimi89999 9y ago

You got everything wrong. If big vendors are unable to patch their proprietary products in an acceptable time, that shouldn't put others at risk. Users shouldn't choose their products... Think about it in a different way: What if a vulnerability was discovered in TLS and FOSS implementations patched it, but there is an embargo for supposedly protecting some banking software? What if NSA/CIA/other agencies find out about it (they would know immediately) and use it to target users/activists?

cyphar 9y ago
This is why embargoes have deadlines. To make the necessary trade-off between "patch as soon as you can, potentially jeopardising the safety of users -- even users of non-proprietary projects" and "wait for everyone to be ready before you patch -- which also jeopardises users". The embargo system deals with this by forcing everyone to agree on a date, and if someone patches after that date then too bad. You may disagree that the deadline was so long, and that could be a fair criticism. But pretending as though co-ordination of any kind is somehow bad (and then resorting to emotional arguments and so on) is pretty reckless.
- mimi89999 9y ago
  3 months is more of a joke than a reasonable time, but one can argue about that if he wants... > even users of non-proprietary projects Actually many FOSS projects get only notified on the disclosure date. Hiding the vulnerability for such a long time makes more harm good. The vulnerability can potentially be exploited by security agencies that necessarily know about them and could also be leaked to a bad actor by an employee of one the vendors. Hopefully WPA2 isn't that important, but potentially security sensitive users trusted something that was known by some to be vulnerable for 3 months! Bad actors could have used it against them. The embargo resulted in potentially bad actors knowing about the issue, but not vulnerable users.
  - user5994461 9y ago
    The state actor should be least of your worries compared to the millions of script kiddies would could use the vulnerability once it is disclosed publicly.

cm2187 9y ago

But have the other OS makers released patches already?