7 ms·

"Hey, I think I noticed a horrible horrible embargoed security bug. I know, I should do my best to pole holes in the embargo early!"

aceofspad3s 9y ago
Maybe they shouldn't have started merging the patches in the open if they weren't ready to disclose the bug.
justincormack 9y ago
It has been obvious something is up for weeks now, and the disclosure is apparently going to be very soon, so it is a bit late to worry.
syshum 9y ago
Ahh yes, Security through Obscurity that is always the best If no one talks about a security problem that makes it disappear
- preordained 9y ago
  If you're taking off for vacation and forgot to lock your door, the best thing would be to go back and lock it. If you couldn't get the door locked right away for some reason, you probably wouldn't want the news of your unlocked door broadcast through your neighborhood... Obscurity actually is a layer of security. The mistake is is when people are dependent upon it.
  - jstanley 9y ago
    But this isn't one persons' door that's unlocked. This is more like a company that shipped a faulty door lock and is trying to keep it secret until they can ship fixed doors to everybody.
    - Splines 9y ago
      But wouldn't you want to know if your door is faulty, so you can either replace your door, delay your vacation until the new door arrives, or beef up your security system?
      - jstanley 9y ago
        Absolutely!
  - syshum 9y ago
    Your analogy is severely flawed as my door lock is under my control and I know about the risks (i.e it is unlocked) so I can take the steps I need to mitigate that risk For your analogy to apply here it would be the manufacturer of the door lock having a master key stolen then not telling anyone about it until they have a new lock for you to buy from them, in the case of a lock I would want to know that the lock is useless even if there was not solution so I can mitigate the risk no simply continue locking it believing it to be secure
    - neerajsi 9y ago
      Locksmiths can get into many locks that people use to secure their houses. That doesn't mean that I want them to share that knowledge widely.
      - pixl97 9y ago
        Eh, that information is shared widely. Some decent googl-fu will get you the information you want. The difference is a lock-pick can't exploit 20,000 doors in 20 minutes.
        hintss 9y ago
        There are definitely bypass tools for common lock mechanisms, whose mechanism of operation isn't readily google-able.
        pixl97 9y ago
        And you still have to visit those, one at a time, in person where things like getting shot could occur.
      - syshum 9y ago
        I see so now we are advocating for the suppression of Speech... Because how else are you going to prevent that? Pretty sure there are 100's of youtube vidoes on lock picking, you want to ban all of them?
      - 9y ago
saas_co_de 9y ago
Embargos do not make you secure. If the bug exists the only safe assumption is that it is already being exploited. The faster the information gets out the better.
- avh02 9y ago
  No, but they prevent everybody with ill-intent from exploiting the issue en-masse
  - jstanley 9y ago
    No they don't. They prevent everybody with ill intent who doesn't already know about it from finding out about it from the guys without ill intent. That's all.
    - avh02 9y ago
      would you say it prevents the small fry from having a big impact? edit: I think the mirai botnet(s) had some sort of power struggle? avoiding propagating knowledge about it prevents it from being easily exploited by more actors.
    - brazzledazzle 9y ago
      The reality is that there's a group you're excluding from consideration and I don't think it's unreasonable to conclude that embargoes keeps every random "hacker" from taking advantage of it in a packaged form. Being vulnerable to the minority population that can and would take advantage of it vs. anyone that would is a valid consideration and shouldn't be dismissed so casually.
  - saas_co_de 9y ago
    Once there is disclosure then 100% of users can make the choice to take appropriate mitigation steps. Prior to disclosure there will always be the possibility that some users are being exploited without their knowledge. Therefore disclosure always improves the situation by giving those who could have been exploited without their knowledge the choice to take mitigation steps. All of the "responsible disclosure" nonsense is just PR by companies who want to avoid the most obvious mitigation, which is for customers to stop using their products.
cjbprime 9y ago
They weren't really trying to uncover the exploit such that they can reproduce it. They were trying to learn who the exploit affects and what the impact is. I don't think there's anything wrong with that. If you're an AWS customer who depends on hypervisor isolation for critical security guarantees, it helps you to know that this is threatened and perhaps exploitable. Please don't buy into the idea that embargoes and coordinated disclosure are sacred. They tend to just reinforce existing power structures, sometimes in an unethical (or at least unfair) way.
- madez 9y ago
  The CCC stated also that they observed that companies take a more reactive rather than proactive stance regarding their IT security because they believe that they will be notified of vulnerabilities prior of public disclosure or attacks. This may justify not following embargoes and coordinated disclosure.
  - tbrownaw 9y ago
    Do you have a link? I'd expect the incentives to be a bit more complicated than that, and I'm also a bit skeptical that either is all that good of a solution. I'd also like to see how exactly "proactive" and "reactive" are being used here, is it about push vs pull for vulnerability notifications, or about hiring their own security researchers, or... ?
- tbrownaw 9y ago
  Please don't buy into the idea that embargoes and coordinated disclosure are sacred. They tend to just reinforce existing power structures, sometimes in an unethical (or at least unfair) way. They're an attempt to minimize harm, by getting things patched while minimizing information leaked to blackhats. Just because giving preference to groups with a better reputation and more market share isn't "fair", doesn't mean it's automatically wrong. Now, if you can show that it actually doesn't help . . .
  - cjbprime 9y ago
    I didn't say it was automatically wrong. I said it was sometimes wrong, and not sacred.
caf 9y ago
Anyone capable of exploiting this issue based on the information in that blog post, already knew everything in that blog post.

aceofspad3s 9y ago

Maybe they shouldn't have started merging the patches in the open if they weren't ready to disclose the bug.

justincormack 9y ago

It has been obvious something is up for weeks now, and the disclosure is apparently going to be very soon, so it is a bit late to worry.

syshum 9y ago

Ahh yes, Security through Obscurity that is always the best If no one talks about a security problem that makes it disappear

preordained 9y ago
If you're taking off for vacation and forgot to lock your door, the best thing would be to go back and lock it. If you couldn't get the door locked right away for some reason, you probably wouldn't want the news of your unlocked door broadcast through your neighborhood... Obscurity actually is a layer of security. The mistake is is when people are dependent upon it.
- jstanley 9y ago
  But this isn't one persons' door that's unlocked. This is more like a company that shipped a faulty door lock and is trying to keep it secret until they can ship fixed doors to everybody.
  - Splines 9y ago
    But wouldn't you want to know if your door is faulty, so you can either replace your door, delay your vacation until the new door arrives, or beef up your security system?
    - jstanley 9y ago
      Absolutely!
- syshum 9y ago
  Your analogy is severely flawed as my door lock is under my control and I know about the risks (i.e it is unlocked) so I can take the steps I need to mitigate that risk For your analogy to apply here it would be the manufacturer of the door lock having a master key stolen then not telling anyone about it until they have a new lock for you to buy from them, in the case of a lock I would want to know that the lock is useless even if there was not solution so I can mitigate the risk no simply continue locking it believing it to be secure
  - neerajsi 9y ago
    Locksmiths can get into many locks that people use to secure their houses. That doesn't mean that I want them to share that knowledge widely.
    - pixl97 9y ago
      Eh, that information is shared widely. Some decent googl-fu will get you the information you want. The difference is a lock-pick can't exploit 20,000 doors in 20 minutes.
      - hintss 9y ago
        There are definitely bypass tools for common lock mechanisms, whose mechanism of operation isn't readily google-able.
        pixl97 9y ago
        And you still have to visit those, one at a time, in person where things like getting shot could occur.
    - syshum 9y ago
      I see so now we are advocating for the suppression of Speech... Because how else are you going to prevent that? Pretty sure there are 100's of youtube vidoes on lock picking, you want to ban all of them?
    - 9y ago

saas_co_de 9y ago

Embargos do not make you secure. If the bug exists the only safe assumption is that it is already being exploited. The faster the information gets out the better.

avh02 9y ago
No, but they prevent everybody with ill-intent from exploiting the issue en-masse
- jstanley 9y ago
  No they don't. They prevent everybody with ill intent who doesn't already know about it from finding out about it from the guys without ill intent. That's all.
  - avh02 9y ago
    would you say it prevents the small fry from having a big impact? edit: I think the mirai botnet(s) had some sort of power struggle? avoiding propagating knowledge about it prevents it from being easily exploited by more actors.
  - brazzledazzle 9y ago
    The reality is that there's a group you're excluding from consideration and I don't think it's unreasonable to conclude that embargoes keeps every random "hacker" from taking advantage of it in a packaged form. Being vulnerable to the minority population that can and would take advantage of it vs. anyone that would is a valid consideration and shouldn't be dismissed so casually.
- saas_co_de 9y ago
  Once there is disclosure then 100% of users can make the choice to take appropriate mitigation steps. Prior to disclosure there will always be the possibility that some users are being exploited without their knowledge. Therefore disclosure always improves the situation by giving those who could have been exploited without their knowledge the choice to take mitigation steps. All of the "responsible disclosure" nonsense is just PR by companies who want to avoid the most obvious mitigation, which is for customers to stop using their products.

cjbprime 9y ago

They weren't really trying to uncover the exploit such that they can reproduce it. They were trying to learn who the exploit affects and what the impact is. I don't think there's anything wrong with that. If you're an AWS customer who depends on hypervisor isolation for critical security guarantees, it helps you to know that this is threatened and perhaps exploitable. Please don't buy into the idea that embargoes and coordinated disclosure are sacred. They tend to just reinforce existing power structures, sometimes in an unethical (or at least unfair) way.

madez 9y ago
The CCC stated also that they observed that companies take a more reactive rather than proactive stance regarding their IT security because they believe that they will be notified of vulnerabilities prior of public disclosure or attacks. This may justify not following embargoes and coordinated disclosure.
- tbrownaw 9y ago
  Do you have a link? I'd expect the incentives to be a bit more complicated than that, and I'm also a bit skeptical that either is all that good of a solution. I'd also like to see how exactly "proactive" and "reactive" are being used here, is it about push vs pull for vulnerability notifications, or about hiring their own security researchers, or... ?
tbrownaw 9y ago
Please don't buy into the idea that embargoes and coordinated disclosure are sacred. They tend to just reinforce existing power structures, sometimes in an unethical (or at least unfair) way. They're an attempt to minimize harm, by getting things patched while minimizing information leaked to blackhats. Just because giving preference to groups with a better reputation and more market share isn't "fair", doesn't mean it's automatically wrong. Now, if you can show that it actually doesn't help . . .
- cjbprime 9y ago
  I didn't say it was automatically wrong. I said it was sometimes wrong, and not sacred.

caf 9y ago

Anyone capable of exploiting this issue based on the information in that blog post, already knew everything in that blog post.