4 ms·

This reeks of survivorship bias. Making any decision based on this would be similar to examining warplanes for sign of bullets to determine which parts to rein

by fooker 5y ago

This reeks of survivorship bias. Making any decision based on this would be similar to examining warplanes for sign of bullets to determine which parts to reinforce. I'd assert that a good fraction of exploits are never caught/analyzed.

anyfoo 5y ago
You don't deserve the downvotes, but it's worth noting that well known and often exploited vulnerabilities are still, well, exploited, while the planes that came back and were inspected for bullet holes were the ones that were not taken down. But your point still stands: Even if you are more likely to be hit by one of the vulnerabilities in the list (big dragnet operations are more likely to have used them, and it's easier for other attackers to copy existing and known exploits), it would be absolutely bad to think the lesser known ones are less dangerous. You don't want to be in the first few batches of the lesser known bug's journey to become one of the well known ones... Generally patch your stuff, basically. Even going by severity instead of popularity is not foolproof, other comments already pointed out how that severity has apparently been misassessed for bugs on this very list.
breck 5y ago
Not at all. It's the exact opposite. In that case, they didn't have access to the planes that crashed. In this case, they do.
- Normal_gaussian 5y ago
  Do we? The vast majority of our computing infrastructure is not actively and forensicly monitored; vulns are either actively patched out, accidently patched out, or 'reset' when services/servers are rolled (often due to "misbehaviour", be it a desktop by a user or a server by a tech), leaving no trace that they were exploited. The vast majority of vendors and sysadmins are incentivised not to reveal that they had an exploit, often by reclassification (exploit -> bug), failure to inform, or refusal to detect. I think this is what the parent meant by "I'd assert that a good fraction of exploits are never caught/analyzed.". Afaict as an outsider we account for this with honeypots, which should give us some kind of estimation at least.
  - genewitch 5y ago
    What sorts of honeypots are available these days? In 2018 I wandered into honeypots again and windows was the primary host OS for most of them. That's not necessarily and issue, but the rest seemed abandoned or unfinished. On our subnet I was seeing a couple thousand cve exploits a month, and about the same in "unknown probes" that may or may not have been 0-days. I don't have (or want) access to the entire flows through the main gateway, but setting up a few honeypots with public IP is fine by me.
bigiain 5y ago
> Making any decision based on this would be similar to examining warplanes for sign of bullets to determine which parts to reinforce. I think that’d be great advice, if most current “enterprise software” deployments didn’t have bright flashing strobe lights directly mounted to the un armoured fuel tanks and cockpit blinking out “shoot here to kill” in Morse code. Once your attack surface doesn’t reveal multiple ways you can be trivially exploited using readily available tools like Shodan and metasploit, then maybe start looking at the places the bullets haven’t hit…
jfoutz 5y ago
I'm not sure about the point you're trying to make. The famous reference is about Abraham Wald looking at all of the common places that planes didn't get shot. That's where you put the armor. And it was really effective. (there's another good one about helmets). Maybe you're saying, yes it's embarrassing to have some static content hosted on some random cloud instance get compromised - but that's clearly not fatal. You have finite resources to devote to security, so pick your battles. But I think you're saying something else. I don't quite get it.
- fooker 5y ago
  I'm saying that the sample here is very much biased towards exploits which were detected and analyzed. Very often, whenever something looks wrong it's just routine to reset and restore. This is even more common nowadays with clouds made of stateless containers.
_jal 5y ago
I don't think there's as much survivorship bias as you're suggesting - we do, in fact, have the airplane wreckage to inspect, it is just that frequently after-action forensices doesn't happen. But the point is valid. I think lists like these are primarily useful for evaluating how unfamiliar networks are managed - if you spot anything on the list, likely some bot or volunteer-sysadmin already beat you to it. And if your scanner doesn't know to look for something on the list, it is probably time to renew your support contract or find a new tool.

by fooker 5y ago

anyfoo 5y ago

You don't deserve the downvotes, but it's worth noting that well known and often exploited vulnerabilities are still, well, exploited, while the planes that came back and were inspected for bullet holes were the ones that were not taken down. But your point still stands: Even if you are more likely to be hit by one of the vulnerabilities in the list (big dragnet operations are more likely to have used them, and it's easier for other attackers to copy existing and known exploits), it would be absolutely bad to think the lesser known ones are less dangerous. You don't want to be in the first few batches of the lesser known bug's journey to become one of the well known ones... Generally patch your stuff, basically. Even going by severity instead of popularity is not foolproof, other comments already pointed out how that severity has apparently been misassessed for bugs on this very list.

breck 5y ago

Not at all. It's the exact opposite. In that case, they didn't have access to the planes that crashed. In this case, they do.

Normal_gaussian 5y ago
Do we? The vast majority of our computing infrastructure is not actively and forensicly monitored; vulns are either actively patched out, accidently patched out, or 'reset' when services/servers are rolled (often due to "misbehaviour", be it a desktop by a user or a server by a tech), leaving no trace that they were exploited. The vast majority of vendors and sysadmins are incentivised not to reveal that they had an exploit, often by reclassification (exploit -> bug), failure to inform, or refusal to detect. I think this is what the parent meant by "I'd assert that a good fraction of exploits are never caught/analyzed.". Afaict as an outsider we account for this with honeypots, which should give us some kind of estimation at least.
- genewitch 5y ago
  What sorts of honeypots are available these days? In 2018 I wandered into honeypots again and windows was the primary host OS for most of them. That's not necessarily and issue, but the rest seemed abandoned or unfinished. On our subnet I was seeing a couple thousand cve exploits a month, and about the same in "unknown probes" that may or may not have been 0-days. I don't have (or want) access to the entire flows through the main gateway, but setting up a few honeypots with public IP is fine by me.

bigiain 5y ago

> Making any decision based on this would be similar to examining warplanes for sign of bullets to determine which parts to reinforce. I think that’d be great advice, if most current “enterprise software” deployments didn’t have bright flashing strobe lights directly mounted to the un armoured fuel tanks and cockpit blinking out “shoot here to kill” in Morse code. Once your attack surface doesn’t reveal multiple ways you can be trivially exploited using readily available tools like Shodan and metasploit, then maybe start looking at the places the bullets haven’t hit…

jfoutz 5y ago

I'm not sure about the point you're trying to make. The famous reference is about Abraham Wald looking at all of the common places that planes didn't get shot. That's where you put the armor. And it was really effective. (there's another good one about helmets). Maybe you're saying, yes it's embarrassing to have some static content hosted on some random cloud instance get compromised - but that's clearly not fatal. You have finite resources to devote to security, so pick your battles. But I think you're saying something else. I don't quite get it.

fooker 5y ago
I'm saying that the sample here is very much biased towards exploits which were detected and analyzed. Very often, whenever something looks wrong it's just routine to reset and restore. This is even more common nowadays with clouds made of stateless containers.

_jal 5y ago

I don't think there's as much survivorship bias as you're suggesting - we do, in fact, have the airplane wreckage to inspect, it is just that frequently after-action forensices doesn't happen. But the point is valid. I think lists like these are primarily useful for evaluating how unfamiliar networks are managed - if you spot anything on the list, likely some bot or volunteer-sysadmin already beat you to it. And if your scanner doesn't know to look for something on the list, it is probably time to renew your support contract or find a new tool.