10 ms·

Does anyone actually have faith in their hw+sw security these days? The speculative execution stuff on CPUs, system code full of buffer overflow / privilege esc

• chundicus 7y ago
  I think it's all relative really. I don't really worry about these sorts of exploits because I'm not a high value target whose going to be attacked by most scary exploits. Certainly there are exceptions, especially when the exploit casts a wide net and doesn't care about who it hits. Your trust in your HW and SW should be proportional to the risk. I would hate to have my private data leaked, but realistically it wouldn't be much more than a nuisance I have to sort out. The same is not true for a government agent or a CEO for example. It would be nice if we could just 100% trust all our software and hardware, but it's just not practical these days.
  • tasty_freeze 7y ago
    You are a worthwhile target at a minimum that your machines can be used as part of botnets and DOS networks. Sure, they might not be digging out your bank account number, but since the cost to the attacker of compromising your machine might be nothing more than a few hundred packets, they'll try anyway.
    • deleted 7y ago
      [deleted]
    • chundicus 7y ago
      Sure, which is why I mentioned the "wide net". I take reasonable precautions, apply basic monitoring, and take care with what software I'm downloading so that I lower my risk of this. It's not foolproof but it's good enough to keep me from being an easy target, while not sacrificing any convenience or spending a lot of time fortifying my machine.
  • SlowRobotAhead 7y ago
    Every small time accountant, car dealer, mom and pop shop, and school thinks “there are bigger targets than me!”... then they’re dealing with ransomware. It’s just another form of “I don’t break the law! I have nothing to hide”.
    • chundicus 7y ago
      Regularly backup and keep those backups off your network, boom problem solved. My point was not that I take no precautions or that you're not at risk because you're not a government agent.
      • SlowRobotAhead 7y ago
        Ok, aside from the time it takes to restore from backup... What about ransomware + spyware where you just lost account numbers and IP? Just stop. There is zero reason to be reckless with infosec and IT infrastructure. Sometimes things will exist outside of your control but that’s a long shot away from “whatever, it won’t happen to me”.
        • chundicus 7y ago
          time to restore from backup really is not a personal concern "whatever it won't happen to me" isn't my point, but okay. I'm not advocating for recklessness or apathy toward infosec / IT. I'm not trying to tell anyone how to live their lives, and explicitly I'm not saying what a company should do. I'm just trying to convey how I view MY risk from a target probability perspective vs the loss it would incur, and thus how I decide to trust some HW/SW Not sure why you're trying to strawman me here, no need to be hostile
• sneak 7y ago
  Metal detectors as usually deployed and configured aren’t sensitive enough to pick up MicroSD cards. :D
  • pixelpoet 7y ago
    Yeah, optical storage wouldn't trigger the metal detectors either, but those drives are uncommon now. Similarly, you wouldn't have a MicroSD device in the secure env. I wonder if you could do a kind of power over ethernet thing, where you increase the system's power draw in a precise manner that gets a signal outside the Faraday cage, since presumably your power will come from an external cable.
    • RL_Quine 7y ago
      A USB drive can be small enough to fit inside a USB connector, barely larger than a MicroSD card. Unless you mandate cavity searches for your employees you're not stopping egress of data like that.
• mey 7y ago
  I have little faith. I aggressively replace digital things (does it have a radio and/or compute) that are not actively supported by the manufacturer. I make thoughtful choices about when to trade security vs convenience (I have no home assistant devices. I do have a Google Pixel, because it is supported and receives monthly security updates.) Limit how much collateral damage can happen when it will happen. Have robust offsite versioned backups, a unique password for every system, strong 2FA, credit freezes, etc. It isn't perfect, but it works for me.
• eitland 7y ago
  > attacks that can work across airgaps using high frequency sounds, Has any real ones been found and confirmed? I remember one being mentioned a couple of years ago or so by one researcher but last I can remember it was not confirmed and IIRC other researchers were voicing their doubt about it.
  • user5994461 7y ago
    On Cisco, not sure, but otherwise the most amazing is probably this one. Reading PGP keys with a microphone up to few meters away from the laptop, from the sound of the power supply. It's more noise when it's busy. https://m.tau.ac.il/~tromer/acoustic/ https://m.tau.ac.il/~tromer/acoustic/
    • eitland 7y ago
      Thanks. Yes, this looks more familiar. For some reason my head was shortcutting "attack" to mean "infect". Thorrez in sibling comment mentions BadBIOS which is probably the one I thought about.
  • Thorrez 7y ago
    The one you remember was BadBIOS, and yes it was bunk.
    • eitland 7y ago
      Thanks! (Also, I realize that my brain thinks 2013 is "a couple of years ago". On a personal level that is possibly even more scary :-/ )
• duxup 7y ago
  I worked for a large networking equipment manufacturer. A company that should know better / how to handle things. The team that fielded inquiries from security researchers and etc were STILL fighting fights with engineering executives whose first response when they saw something that showed a problem in their code from a researcher ... was to go running to the lawyers and talk about lawsuits. In the meantime some engineers recognize the increased need for better security practices but there were NO new resources allocated to actually make time to do such things. Everything was lip service (if there even was any) but no time, and then later reactive to issues. In terms of what I saw in a practical manner. There was a shockingly high rate of "we saw this security bug before" re-introduced right after it was fixed. You could almost bank on it happening. In the meantime you'd watch security related bug fixes pushed from one version to the next to the next ...
• toomim 7y ago
  Sure there are exploits, but security isn't binary. Something isn't "truly secure" or "insecure". It's all a matter of how difficult the attack is to pull off, or how expensive the exploit is to purchase. Security is economic. There's a cost/benefit to attack, and to defend. A good way to measure how secure we actually are is to observe the rate of cryptocurrency theft. How many people do you know with crypto? How many people do you know who have had their computers hacked and crypto stolen? That's how secure you are.
  • derefr 7y ago
    > Security is economic. There's a cost/benefit to attack, and to defend. In some cases, sure. In other cases (e.g. if you're a nation declaring war on the US) you kind of have to assume basically-unlimited cryptanalysis resources and the willingness to prioritize their use to attack your crypto. Is there a name for the discipline of "cybersecurity doctrine as pertains to protecting against unlimited-strength attacks"? Sort of the crypto equivalent of the Airforce One doctrine, of trying to ensure that an individual survives ICBMs aimed directly at their best-predicted location (with the predictive capacity of a state actor.)
    • fulafel 7y ago
      State actors aren't mythical, they're working with budgets same as everyone else, and they don't have "unlimited-strength attacks". They weigh what to burn their zero days on, use social engineering etc low tech attacks when it's more efficient, and so on.
• tptacek 7y ago
  The speculative execution stuff is fascinating and a little terrifying but, for the most part, has been of little practical impact so far, at least after the first round of Meltdown/Spectre fixes. Attacks on various hash functions are not really a thing. We've known not to use SHA-1 for over a decade, and cryptographers working in the space have started saying we may never find a viable preimage attack on MD5, let alone SHA-1. We are on pretty sound footing with hash functions; what you were doing in a competent system 10 years ago (using SHA-2) is still the right thing today. I've been a vulnerability researcher since around 1995. I feel significantly better about security today than I have at any point in the past. We've been doing an imperfect but steady job of shutting down bug classes for decades, with the obvious and most important factor being the deprecation of insecure systems languages.
  • aidenn0 7y ago
    From my point of view, the proliferation of so many new classes of network connected devices has offset much of the gains in better practices. With enough systems being designed, the odds of a single system being both incompetently designed and widely deployed approaches unity. I think I'll call this the "lightbulb effect" since in 1995 the lightbulbs in everyone's home were secure against all RCE vulnerabilities, while in 2020, this is no longer true.
    • pixelpoet 7y ago
      There was a related blog post from 2016 about a guy who managed to hack his hotel's "smart" lights/curtains/etc system. Unfortunately the images no longer work, but they're not essential anyway: https://mjg59.dreamwidth.org/40505.html https://mjg59.dreamwidth.org/40505.html
    • tptacek 7y ago
      This is a reason not to buy lightbulbs with Internet connections, but not a good reason to despair about the state of overall software and hardware security.
      • pixelpoet 7y ago
• all_blue_chucks 7y ago
  If you designed your application correctly, you shouldn't have to trust network hardware in the first place.
  • throwaway15392 7y ago
    Can you elaborate?
    • all_blue_chucks 7y ago
      If every network connection your system makes authenticates the client to the server, authenticates the server to the client, and encrypts the dataflows then you don't have to worry if your routers are hacked. A typical way to do this is to use TLS, verify certificates, and have a password for the client.
    • fulafel 7y ago
      It's a well known & age old principle in building networked systems. https://en.wikipedia.org/wiki/Fallacies_of_distributed_computing https://en.wikipedia.org/wiki/Fallacies_of_distributed_compu... (But of course these fallacies are so well known exactly because programmers have proven their inability to reliably internalize them...)
  • McTossOut 7y ago
    Not if an adjacent attacker can brick networking equipment. No amount of software engineering will make a computer telepathic.
• pjmlp 7y ago
  Not at all. This is why I rant about C, even though I seldom touch it. The "experts" that sell our infrastructure have proven multiple times they aren't able to deliver. 3 from 5 exploits are memory corruption bugs.
• furyofantares 7y ago
  > Does anyone actually have faith in their hw+sw security these days? Well, I can only remember one time I've had any of my personal devices compromised in 25 years of heavy computing, and it windows XP pre-SP3. So yeah, quite a bit of faith seems to be warranted, even if the stream of flaws makes it seem like it shouldn't be
• deleted 7y ago
  [deleted]
• flatiron 7y ago
  Only pc I trust is my Ben Eater 8 bit CPU. Gotta turn that into a router now :)
• topspin 7y ago
  > Does anyone actually have faith in their hw+sw security these days? Not much. We actually know how to deal with most of the things you mentioned. There are simple CPU cores that don't have speculative execution problems. It is possible to achieve memory safety. Formally proven OS kernels exist. Physical security is largely understood and can be made very difficult to compromise. Why don't we have all this as routine? Because security theater is cheaper than actual security. The value of 'cheaper' here is very broad and includes avoiding all of the costs that emerge with robust security including opportunity costs.
  • pixelpoet 7y ago
    Intel seem to be paying a hefty price lately for some security shortcuts they made in hardware compared to AMD (who paid the opportunity cost; security measures don't happen by accident, and they do slow you down). Good security is getting rarer all the time, and therefore expensive; I think a lot of people would be interested in having a small truly secure system (say, for storing your cryptocurrency keys), and as I wrote, I sincerely don't know where to practically begin with this. Is it commercially available? Concretely speaking, what can I buy, and what software should I run on it?
    • robocat 7y ago
      > Intel seem to be paying a hefty price lately But the gains they made have surely outweighed any current hit? Also I haven’t perceived that much of a hit (although I’m not in the industry): are they selling more CPUs? AMD have an opportunity, but I haven’t seen that translated into sales to hyperscalers or consumers (beyond what they were achieving anyway). Same as Microsoft knowingly for decades chose functionality before security - with the cooperation of plenty of customers that knew better.
• blantonl 7y ago
  This is what state sponsored actors and agencies have been doing for generations. There is no reason to think that anything has changed with the explosion of security consultants and firms. If you are doing anything national security related, you should really just boil your security thinking down to thinking about the remotest possibility something could happen, and then multiply that x10, and then apply your mitigation.
• VectorLock 7y ago
  Having worked at Cisco 2 years ago and seeing "how the sausage is made." No. Not a shred of faith.
  • johnmaguire2013 7y ago
    Cisco is a huge company.
    • VectorLock 7y ago
      They might have a department somewhere thats doing great thing. But I never saw it. I did see a lot of bad ones though.
    • muspopi 7y ago
      Size doesn't matter. IE is made by a trillion dollar company but you can still find tons of security issues with IE.
      • rodw 7y ago
        I think the grandparent post isn't trying to say "a 100,000 employee company automatically makes secure software" but rather "anecdotal evidence from a year or two of personal experience may not be representative of a 100,000 employee company". Cisco has dozens (hundreds?) of global offices and is well known for growth-via-acquisition. There must be a million little micro-cultures in an organization that large, diverse and distributed.
        • atilaneves 7y ago
          > There must be a million little micro-cultures in an organization that large There are, and in those, good code can be written. They're the exception. Source: worked there for 7 years.
        • PeterisP 7y ago
          That's kind of the problem - if you have a hundred little micro-cultures involved in a project, and 99 of these cultures value safety and one does not, then in the end you get an insecure product. A chain is as strong as its weakest link.
• kbenson 7y ago
  Like locks and doors, secure and safe are not a binary state, it's a spectrum, where your purpose is to provide more hurdles of time, effort, discovery, consequences, etc to the attacker such that what they would want from you is not worth it. Nothing will leave you entirely secure (and conversely nothing will leave you entirely insecure. You can leave piles of cash on your front porch and it still depends on someone actually walking by to note there's something to steal). If you're a bank in a metropolis, you get a sophisticated vault. If you're a business you get an alarm system to protect your inventory. If you're a farmer and it's the less expensive farm equipment, you might not even lock the barn/shed. If you expect state level adversaries, you probably need state level resources, planning, and mitigations. If you're jane/joe schmoe citizen, don't give out your passwords or click on unknown binaries, and be wary of people asking you for SMS codes in IMs. Scale appropriately for the threat you think you'll face, and as much buffer as you think you can stomach.
• atilaneves 7y ago
  > Does anyone actually have faith in their hw+sw security these days? I worked for 7 years so I know how the software sausage is made. The answer is most definitely "no", and I'm frankly surprised now that the internet works at all.
  • justincredible 7y ago
    The internet was created by people who really knew how to make sausage. Unfortunately security was not one of their concerns.
• konceptz 7y ago
  I think that after you realize the limits of your (and our) technical ability to defend against attacks, you can then apply a threat model to see which attacks are not practical given your assets. For example, I’m reasonably sure there are weaknesses in my gaming pc but I don’t do banking or other more secure things on it. There’s little motivation to target an attack or burn (use) an exploit to get access to this pc for an attacker and the defenses I have defend against most spray and pray attacks.