3 ms·
That reminds me of bogus `npm` results. You use a regex at build time? Oh, apparently you are exposed to a ReDoS attack even though that regex isn’t available a
by LudwigNagasena 3y ago
That reminds me of bogus `npm` results. You use a regex at build time? Oh, apparently you are exposed to a ReDoS attack even though that regex isn’t available at runtime.
Or that time when Python disallowed string to int conversion of long strings because it is a DoS vulnerability. The lack of sanitisation led to DoS vulnerabilities in applications, but the conversion is obviously not a vulnerability in itself. Oh, and now those apps have DoS attack that just halts the application because the conversion throws ValueError.
It’s hard to say what the solution to that problem is. Oftentimes security vulnerabilities indeed don’t cause any problems alone and require a chain of other exploits to actually cause trouble. At the same time you don’t want to treat every function that runs in O(n^2) on input as a potential DoS attack. Distinguishing between a simple bug and a vulnerability requires contextual knowledge and expert judgement that simply cannot be built into bureaucratic organisations like MITRE.
- stefan_ 3y agoThis is my favorite lately. Sure, some insane people use these packages for backend services, but we are just building a big JS blob that's statically shipped to the browser; none of the "vulnerabilities" in them apply. But try getting this across to people who think they need to track security issues they don't understand (not fix them, of course).
- derstander 3y ago> Distinguishing between a simple bug and a vulnerability requires contextual knowledge and expert judgement that simply cannot be built into bureaucratic organisations like MITRE. Why can’t it? MITRE runs FFRDCs. Having worked for an FFRDC (although in electrical engineering, not computer security), if you were to tell me that engineers in FFRDCs or UARCs in my domain simply cannot utilize contextual knowledge or expert judgment (or that their knowledge and judgment would be completely overridden by management such that it appears they can’t) then I would wonder if you ever interacted with that kind of organization. Is computer security somehow different to e.g. radar or comms systems engineering?
- LudwigNagasena 3y agoThe scope of use is very underspecified. If your program is disconnected from the internet, all remote execution bugs stop being security bugs. If you can provide specific input to run arbitrary code into a program that already requires you to have elevated privileges to run, it is not a security bug. Etc, etc.
- derstander 3y agoSorry: I'm confused. Are you saying this is why an organization like MITRE cannot build contextual knowledge and expert judgement into itself? Or are you saying this is how computer security differs from radar and/or communications systems engineering?
- LudwigNagasena 3y agoBoth?
- arp242 3y ago> Or that time when Python disallowed string to int conversion of long strings because it is a DoS vulnerability. You're right that applications should have range checking of course, but the default limit is 4,300 digits, which seems enough for all but the most specialized applications; this number is huge. It makes sense to have a reasonable limit so your server isn't using all the memory and CPU time by accident. It's the same as max recursion limits and the like. Personally I don't think any DoS is a "security problem" though. It can be a problem, just as many bugs are, but "site is unavailable for a bit" or "my desktop application crashed" is just not on the order as "I lost all my money". Last month my bank's website was unavailable for a week, and it was annoying but basically fine with no real serious consequences.