2 ms·

Every exploit payload is comprised entirely of data, so I think you’re even giving them too much credit there... The thing that triggered me the most was that

Every exploit payload is comprised entirely of data, so I think you’re even giving them too much credit there... The thing that triggered me the most was that they got the engineers who wrote the code to test it, and report back that their own code was fine. From the sound of it they didn’t even test the vulnerability, they just did an external test, without specifically testing the segmentation controls or the components in question.

mark-r 7y ago
They probably rely on network segmentation to keep the various components separated. If they consider the segmentation to be 100% effective, there'd be no need to do the kind of in-depth testing you advocate. I don't think it's justifiable to assume that segmentation doesn't have its own bugs that could be exploited.
- AmericanChopper 7y ago
  Yeah, that seems to be what their attitude is. I have a couple of major issues with that though. 1. Relying on segmentation to protect vulnerable components is not a reasonable standard operating procedure. Segmentation is supposed to be an additional layer of protection, you’re also supposed to secure individual components. 2. It seems as though the researcher believed there may have been a way to bypass some of the segmentation (the segmentation between the medium-sensitive network and the highly-sensitive network). The article kinda implies that they didn’t test that layer of segmentation, that they only tested the most external layer (the segmentation between the non-sensitive network and the medium-sensitive network). The whole response comes across as dismissive spin, that they hope will be consumed by people who don’t have a particularly sophisticated understanding of network/application security.
dreamcompiler 7y ago
Yeah, this is ridiculous. A real red team does not involve engineers testing their own code. The fact that they couldn't break it means nothing.

mark-r 7y ago

They probably rely on network segmentation to keep the various components separated. If they consider the segmentation to be 100% effective, there'd be no need to do the kind of in-depth testing you advocate. I don't think it's justifiable to assume that segmentation doesn't have its own bugs that could be exploited.

AmericanChopper 7y ago
Yeah, that seems to be what their attitude is. I have a couple of major issues with that though. 1. Relying on segmentation to protect vulnerable components is not a reasonable standard operating procedure. Segmentation is supposed to be an additional layer of protection, you’re also supposed to secure individual components. 2. It seems as though the researcher believed there may have been a way to bypass some of the segmentation (the segmentation between the medium-sensitive network and the highly-sensitive network). The article kinda implies that they didn’t test that layer of segmentation, that they only tested the most external layer (the segmentation between the non-sensitive network and the medium-sensitive network). The whole response comes across as dismissive spin, that they hope will be consumed by people who don’t have a particularly sophisticated understanding of network/application security.

dreamcompiler 7y ago

Yeah, this is ridiculous. A real red team does not involve engineers testing their own code. The fact that they couldn't break it means nothing.