4 ms·

Old != bad. Old and well maintained software can be reliable and secure, it just rate to encounter it. Maintenance is underappreciated. People don't get rises

Old != bad. Old and well maintained software can be reliable and secure, it just rate to encounter it. Maintenance is underappreciated. People don't get rises and promotions for successful maintenance of an old system. But they get it for new projects even if this project is rewriting of an old system in a new language/framework (even if a rewrite introduces new bugs, vulnerabilities and drops some old features). So if an organization has money to spare, the software will be re-written every several years to flow the fashion and if doesn't have money security will suffer too.

cerved 5y ago
it's bad if it's running on a deprecated runtime that's no longer being patched for security
- citrin_ru 5y ago
  If the runtime is no longer maintained then it is of course it is a problem (I'm from the Unix world and don't know if classic ASP is still supported by the vendor). We cannot say that a system as a whole is well maintained if it's dependencies are not.
  - cerved 5y ago
    can't say for sure but I'd wager that it's not
    - giardini 5y ago
      IIRC Classic ASP has the same end-of-life, 2025, as Windows 10.
      - cerved 5y ago
        it's also a matter of the dependencies used, are they running in supported .net
  - raesene9 5y ago
    The thing is, in web appsec world, when Classic ASP was a production platform, we were very early in terms of what attacks would be prevalent and the defences that are generally added to modern web application frameworks were not in use. In theory you can totally add those protections per application but the effort of doing that, maintaining the knowledge required per application or team and keeping on top of new research, is likely higher than just moving to a new framework which has in-built protection. Also you have to consider developer availability. At 19 years since it was deprecated, there is a smaller pool of people who are skilled at maintaining that codebase, and the group of people who can do that, and keep on top of web application security attacks is even smaller.
    - citrin_ru 5y ago
      Attacks evolve, but I remember reading around 2005 on OWASP site about SQL injections and XSS. Database APIs with parameter binding (and auto-escape of these parameters) where available in most popular languages even back then and here we are 15 years later, SQL injections and XSS are still in OWASP top 10. Though Classic ASP was released much earlier in 1996 and I don't know if SQL libraries offered parameter binding and template engine - escaping of string in template variables.
      - raesene9 5y ago
        The first named mention of SQLi was 1998 by Rain.Forest.Puppy (AFAICR), however classic ASP did not have any in-built protection from it. I started in security in 2000, as an analyst for an org using classic ASP. maintaining security was a pain. I then started as a pentester in ~2005 and what I can tell you is, in my experience, classic ASP applications rarely had good protections against injection attacks (e.g. XSS, SQLi) for precisely the reason that the framework did not protect against it, leaving developers to make sure they had routines to canonicalise/sanitize/parameterize input correclty, and also that they implemented them universally across all possible user inputs. Whilst this isn't impossible, in my experience, it was rarely done perfectly. In comparison, something like ASP.Net which had in-built protections available, at least had the chance of having good uniform protection.
      - 5y ago
raesene9 5y ago
Sure old != bad if they maintain it... Classic ASP was good 20 years ago, it's harder to secure than a modern framework which helps with security (e.g. XSS helpers, ORMs to help mitigate SQLi, which is one of the issues exploited here) The problem is that in most codebases I've seen, once you get to 19 years passed deprecated, it's not that it's a well maintained hardened environment. It's a poorly maintained environment that people don't want to clean up for fear they break something.

cerved 5y ago

it's bad if it's running on a deprecated runtime that's no longer being patched for security

citrin_ru 5y ago
If the runtime is no longer maintained then it is of course it is a problem (I'm from the Unix world and don't know if classic ASP is still supported by the vendor). We cannot say that a system as a whole is well maintained if it's dependencies are not.
- cerved 5y ago
  can't say for sure but I'd wager that it's not
  - giardini 5y ago
    IIRC Classic ASP has the same end-of-life, 2025, as Windows 10.
    - cerved 5y ago
      it's also a matter of the dependencies used, are they running in supported .net
- raesene9 5y ago
  The thing is, in web appsec world, when Classic ASP was a production platform, we were very early in terms of what attacks would be prevalent and the defences that are generally added to modern web application frameworks were not in use. In theory you can totally add those protections per application but the effort of doing that, maintaining the knowledge required per application or team and keeping on top of new research, is likely higher than just moving to a new framework which has in-built protection. Also you have to consider developer availability. At 19 years since it was deprecated, there is a smaller pool of people who are skilled at maintaining that codebase, and the group of people who can do that, and keep on top of web application security attacks is even smaller.
  - citrin_ru 5y ago
    Attacks evolve, but I remember reading around 2005 on OWASP site about SQL injections and XSS. Database APIs with parameter binding (and auto-escape of these parameters) where available in most popular languages even back then and here we are 15 years later, SQL injections and XSS are still in OWASP top 10. Though Classic ASP was released much earlier in 1996 and I don't know if SQL libraries offered parameter binding and template engine - escaping of string in template variables.
    - raesene9 5y ago
      The first named mention of SQLi was 1998 by Rain.Forest.Puppy (AFAICR), however classic ASP did not have any in-built protection from it. I started in security in 2000, as an analyst for an org using classic ASP. maintaining security was a pain. I then started as a pentester in ~2005 and what I can tell you is, in my experience, classic ASP applications rarely had good protections against injection attacks (e.g. XSS, SQLi) for precisely the reason that the framework did not protect against it, leaving developers to make sure they had routines to canonicalise/sanitize/parameterize input correclty, and also that they implemented them universally across all possible user inputs. Whilst this isn't impossible, in my experience, it was rarely done perfectly. In comparison, something like ASP.Net which had in-built protections available, at least had the chance of having good uniform protection.
    - 5y ago

raesene9 5y ago

Sure old != bad if they maintain it... Classic ASP was good 20 years ago, it's harder to secure than a modern framework which helps with security (e.g. XSS helpers, ORMs to help mitigate SQLi, which is one of the issues exploited here) The problem is that in most codebases I've seen, once you get to 19 years passed deprecated, it's not that it's a well maintained hardened environment. It's a poorly maintained environment that people don't want to clean up for fear they break something.