3 ms·

Summary: "There's a highly exploitable design flaw in the domain name system. We're not telling anyone what it is for thirty days, though, so the open-source co

Summary: "There's a highly exploitable design flaw in the domain name system. We're not telling anyone what it is for thirty days, though, so the open-source community can't fix it themselves within days and embarrass larger vendors. Patches will be sent out without context, so as to make it only slightly challenging to reverse-engineer them[1], and impossible to trust they're not actually creating worse vulnerabilities." [1]: See: http://www.schneier.com/blog/archives/2008/04/reverseengineer.html http://www.schneier.com/blog/archives/2008/04/reverseenginee...

LogicHoleFlaw 18y ago
Well, the original article did include Red Hat in the list of vendors. I don't expect that the details will remain secret for long.
- silentbicycle 18y ago
  While Red Hat is a Linux vendor, they already have some closed binaries floating around. Look at "binary blob" drivers. http://en.wikipedia.org/wiki/Binary_blob http://en.wikipedia.org/wiki/Binary_blob
tptacek 18y ago
The research Schneier is pointing to suggests that it's possible to automatically generate exploits from patches. It's an "open question", but given how much flexibility there is in patching vulnerabilities (effective patches don't need to be tightly correlated with the single broken code path used by an exploit), you can predict what the result is going to be on it.
- silentbicycle 18y ago
  I linked to it because I think trying to keep it under wraps but issuing binary patches is doomed from the start. I guess my sarcasm wasn't clear enough, so I changed it it "... only slightly challenging ...". Mainly, I think the computer industry at large should know better by now. Delay the people who would fix things from getting the details they need and hoping the 'evil types' (their words) won't be able to figure it out in the mean time is a pretty bad strategy. (Fortunately, the "good guys" are often good at reverse-engineering things too.) I don't know anything at all about the technical details here, but it sounds like the whole thing is being handled very badly.
  - tptacek 18y ago
    I agree with you. In this case, for reasons I won't go into right here, I think the effort to "hide" this "new flaw" was doomed from the start. But in general, if you patch it, it's out there. If this announcement counts as "Hackers News", it's marginal at best. "Protocols designed in the '70s found insecure --- film at 11!" But the discussion about whether you can reliable reverse patches to vulns? THAT's fun.
    - gojomo 18y ago
      That so many vendors have collaborated to synchronize a patch release is interesting Hacker News. The odd quasi-disclosure -- here's how to test, here's a mostly-helpful patch, but full details will wait a month or until third parties figure it out -- is Hacker News. Regular reminders of the general insecurity of DNS are also a public service, attached to megapatch firedrills or not.
      - tptacek 18y ago
        It would be news if it was (a) news or (b) really true. Regarding (a), there was more collaboration and a bigger fire drill on the OULU.FI SNMP findings from 2003. That was a series of memory corruption and code execution findings in multiple different implementations. ---------------------------------------------------------- EVERYTHING BELOW THIS LINE WAS WRONG Also, Microsoft patches on a schedule ("Patch Tuesday"), so if you have an activist security researcher trying to keep details from getting out, the major coordination problem is already solved: you're releasing on Patch Tuesday. What I'm saying is, if you find ANYTHING, and you want to talk about a mass vendor reaction, get Microsoft on board and you're done. Dan has a professional relationship with Microsoft. Regarding (b), most of the implementations that are patching fall into two categories: (1) --- Derivatives of ISC BIND (2) --- Fantastically weak embedded or proprietary DNS implementations that were totally screwed prior to any new research result, and are now catching up on 13-15 years of DNS best practices for fear of being found out.

LogicHoleFlaw 18y ago

Well, the original article did include Red Hat in the list of vendors. I don't expect that the details will remain secret for long.

silentbicycle 18y ago
While Red Hat is a Linux vendor, they already have some closed binaries floating around. Look at "binary blob" drivers. http://en.wikipedia.org/wiki/Binary_blob http://en.wikipedia.org/wiki/Binary_blob

tptacek 18y ago

The research Schneier is pointing to suggests that it's possible to automatically generate exploits from patches. It's an "open question", but given how much flexibility there is in patching vulnerabilities (effective patches don't need to be tightly correlated with the single broken code path used by an exploit), you can predict what the result is going to be on it.

silentbicycle 18y ago
I linked to it because I think trying to keep it under wraps but issuing binary patches is doomed from the start. I guess my sarcasm wasn't clear enough, so I changed it it "... only slightly challenging ...". Mainly, I think the computer industry at large should know better by now. Delay the people who would fix things from getting the details they need and hoping the 'evil types' (their words) won't be able to figure it out in the mean time is a pretty bad strategy. (Fortunately, the "good guys" are often good at reverse-engineering things too.) I don't know anything at all about the technical details here, but it sounds like the whole thing is being handled very badly.
- tptacek 18y ago
  I agree with you. In this case, for reasons I won't go into right here, I think the effort to "hide" this "new flaw" was doomed from the start. But in general, if you patch it, it's out there. If this announcement counts as "Hackers News", it's marginal at best. "Protocols designed in the '70s found insecure --- film at 11!" But the discussion about whether you can reliable reverse patches to vulns? THAT's fun.
  - gojomo 18y ago
    That so many vendors have collaborated to synchronize a patch release is interesting Hacker News. The odd quasi-disclosure -- here's how to test, here's a mostly-helpful patch, but full details will wait a month or until third parties figure it out -- is Hacker News. Regular reminders of the general insecurity of DNS are also a public service, attached to megapatch firedrills or not.
    - tptacek 18y ago
      It would be news if it was (a) news or (b) really true. Regarding (a), there was more collaboration and a bigger fire drill on the OULU.FI SNMP findings from 2003. That was a series of memory corruption and code execution findings in multiple different implementations. ---------------------------------------------------------- EVERYTHING BELOW THIS LINE WAS WRONG Also, Microsoft patches on a schedule ("Patch Tuesday"), so if you have an activist security researcher trying to keep details from getting out, the major coordination problem is already solved: you're releasing on Patch Tuesday. What I'm saying is, if you find ANYTHING, and you want to talk about a mass vendor reaction, get Microsoft on board and you're done. Dan has a professional relationship with Microsoft. Regarding (b), most of the implementations that are patching fall into two categories: (1) --- Derivatives of ISC BIND (2) --- Fantastically weak embedded or proprietary DNS implementations that were totally screwed prior to any new research result, and are now catching up on 13-15 years of DNS best practices for fear of being found out.