4 ms·

so far no word on ivantis website about the CVE or exploit, or even a fix. forcing CISA to walk out of the gate with a nuclear-option mitigation is pretty insu

so far no word on ivantis website about the CVE or exploit, or even a fix. forcing CISA to walk out of the gate with a nuclear-option mitigation is pretty insulting to the corporations/governments that spend millions on this hokum each year to achieve certification or ATO. then again SolarWinds was effectively crucified before their customers and somehow --unaccountably-- still manages to hold a 4.5 in the gartner ratings and enjoys widespread use still to this day in government and private industry. it feels like security certification at this level is mostly a performative art.

ecshafer 3y ago
Most Government and Corporate security / IT just aren't some awesome hacker or security analyst. Most just follow some corporate flow chart for security. I once worked at a company that allowed IE only as a browser for security reasons, eventually they allowed Chrome, but not Firefox again for security reasons, their reasoning was: Microsoft and Google are Billion dollar companies. If you try and bring some solid open source software, well where is the X certification? Even though just from using the corporate certified software for 10 seconds you can tell its not good.
- nonrandomstring 3y ago
  > their reasoning was: Microsoft and Google are Billion dollar companies. Did you ever see that written down. Or was it an assumption or rumour? I ask because I specifically advise against that thinking and debunk the "big company = trustworthy" fallacy. But what I find is that actually there is appropriate low trust of US big-tech amongst the C level, but they are compelled to use Microsoft or whatever for non-technical/non-security reasons.
  - AvocadoPanic 3y ago
    The list of 'approved' software vendors doesn't say it's because their billion dollar companies, but if it's from a company on the list that's enough. No further vetting required.
    - nonrandomstring 3y ago
      Yes indeed. I think where this goes wrong is when Bob in purchasing confuses can use this approved supplier with must use this supplier and fails to notice said supplier about to be bankrupted in court over a multi-billion security scandal, and goes ahead anyway. Voila! We just bought a couple million IoT bricks and doorstops that will be in a landfill next week.
    - Natsu 3y ago
      It very much feels like a "no one ever got fired for buying IBM" type of scenario sometimes.
  - ecshafer 3y ago
    In this case, a financial company, yes the reasoning written down on the intranet was that they had the backing of billion dollar companies.
- passwordoops 3y ago
  This. CYA by ticking the boxes. We once had a city IT guy block our deployment because we were vulnerable to CVE-whatever - turned out to be a minir vulnerability in the DuckDuckGo browser
- tptacek 3y ago
  That is a reasonable argument about Chrome! That's not hokum; even some people who have worked on and are invested in the Firefox security and isolation model will concede that Chrome has historically had a material edge there, and it has been reflected in browser vulnerability prices (I don't want to cite the obvious chart here because I think the audience for that thing is message boards and not people working in the field, but it's directionally correct). There's also the benefit of having one set of controls with respect to profiles and extensions.
  - 616c 3y ago
    You've been known for your hot takes past and present, but this one threw me for a curve. Is there empirical data on this? I think many in the security industry believe this. I ironically use FF if we can accept personal beliefs since I believe people attack the Chrome sandbox as a badge of honor and I can use containers to isolate state to different personas. That said also anecdata bullshit take on my part.
    - tptacek 3y ago
      (1) I think public exploit price lists are bullshit, and mostly about marketing, but directionally they consistently put Chrome >2x of Firefox. You can choose not to take that seriously. (2) The fact that people attack Chrome as a badge of honor is a reason to use it, not to avoid it. It's why exploits for Firefox would be cheaper. (3) I don't think my take is spicy at all? I haven't refreshed it in a few years, but when last I did, I don't think I talked to anybody on either side of browser security who felt that Firefox outclassed Chrome (I got a long, valuable Slack thread from a FF security person that I wish I'd saved that built a claim that FF was approaching parity with Chrome architecturally). I have spicy takes, to be sure, but I think I'm giving you a pretty mainstream take from software security land. (4) Even if you believed Firefox and Chrome (or Chrome and Safari) were at parity, it makes a great deal of sense to standardize browsers, for the reasons I gave previously. The right way to think of your browser "fleet" is as multiple single points of failure; diversity isn't helping you at all. This is one of those "put all your eggs in one basket and guard it" situations. I don't have any particular personal reason to love Chrome. I'm a Mac person, so I guess the best outcome for me would be for Safari to be perceived as the best browser. Certainly my batteries would last longer! Every couple of years I talk to people about what the landscape looks like; if I ever get different answers, I'll be sure to update my take.
- Dalewyn 3y ago
  Certifications (and specifically paying to get certified) are about legally throwing liability on another party, because nobody wants to end up with the hot ball in their hands. The assumption is that shit will or already has hit the fan, and the question is how to reduce your own liabilities as much as possible by throwing what you can on someone else. Certifications were and are never about practical or literal security.
  - semi-extrinsic 3y ago
    It reminds me of the old quote by Keynes: A sound banker, alas, is not one who foresees danger and avoids it. But one who, when he is ruined, is ruined in a conventional and orthodox way with his fellows, so that no-one can really blame him
antongribok 3y ago
There is a forum post from a few weeks ago: https://forums.ivanti.com/s/article/Recovery-Steps-Related-to-CVE-2023-46805-and-CVE-2024-21887 https://forums.ivanti.com/s/article/Recovery-Steps-Related-t... (Linked from TFA)
drynewton 3y ago
It's on their website and has been for days. https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-ivanti-policy-secure-gateways https://www.ivanti.com/blog/security-update-for-ivanti-conne... That latest update is a follow up from Jan 10
MilStdJunkie 3y ago
I heard CMMC 2.0 will fix everything in govcon.

ecshafer 3y ago

Most Government and Corporate security / IT just aren't some awesome hacker or security analyst. Most just follow some corporate flow chart for security. I once worked at a company that allowed IE only as a browser for security reasons, eventually they allowed Chrome, but not Firefox again for security reasons, their reasoning was: Microsoft and Google are Billion dollar companies. If you try and bring some solid open source software, well where is the X certification? Even though just from using the corporate certified software for 10 seconds you can tell its not good.

nonrandomstring 3y ago
> their reasoning was: Microsoft and Google are Billion dollar companies. Did you ever see that written down. Or was it an assumption or rumour? I ask because I specifically advise against that thinking and debunk the "big company = trustworthy" fallacy. But what I find is that actually there is appropriate low trust of US big-tech amongst the C level, but they are compelled to use Microsoft or whatever for non-technical/non-security reasons.
- AvocadoPanic 3y ago
  The list of 'approved' software vendors doesn't say it's because their billion dollar companies, but if it's from a company on the list that's enough. No further vetting required.
  - nonrandomstring 3y ago
    Yes indeed. I think where this goes wrong is when Bob in purchasing confuses can use this approved supplier with must use this supplier and fails to notice said supplier about to be bankrupted in court over a multi-billion security scandal, and goes ahead anyway. Voila! We just bought a couple million IoT bricks and doorstops that will be in a landfill next week.
  - Natsu 3y ago
    It very much feels like a "no one ever got fired for buying IBM" type of scenario sometimes.
- ecshafer 3y ago
  In this case, a financial company, yes the reasoning written down on the intranet was that they had the backing of billion dollar companies.
passwordoops 3y ago
This. CYA by ticking the boxes. We once had a city IT guy block our deployment because we were vulnerable to CVE-whatever - turned out to be a minir vulnerability in the DuckDuckGo browser
tptacek 3y ago
That is a reasonable argument about Chrome! That's not hokum; even some people who have worked on and are invested in the Firefox security and isolation model will concede that Chrome has historically had a material edge there, and it has been reflected in browser vulnerability prices (I don't want to cite the obvious chart here because I think the audience for that thing is message boards and not people working in the field, but it's directionally correct). There's also the benefit of having one set of controls with respect to profiles and extensions.
- 616c 3y ago
  You've been known for your hot takes past and present, but this one threw me for a curve. Is there empirical data on this? I think many in the security industry believe this. I ironically use FF if we can accept personal beliefs since I believe people attack the Chrome sandbox as a badge of honor and I can use containers to isolate state to different personas. That said also anecdata bullshit take on my part.
  - tptacek 3y ago
    (1) I think public exploit price lists are bullshit, and mostly about marketing, but directionally they consistently put Chrome >2x of Firefox. You can choose not to take that seriously. (2) The fact that people attack Chrome as a badge of honor is a reason to use it, not to avoid it. It's why exploits for Firefox would be cheaper. (3) I don't think my take is spicy at all? I haven't refreshed it in a few years, but when last I did, I don't think I talked to anybody on either side of browser security who felt that Firefox outclassed Chrome (I got a long, valuable Slack thread from a FF security person that I wish I'd saved that built a claim that FF was approaching parity with Chrome architecturally). I have spicy takes, to be sure, but I think I'm giving you a pretty mainstream take from software security land. (4) Even if you believed Firefox and Chrome (or Chrome and Safari) were at parity, it makes a great deal of sense to standardize browsers, for the reasons I gave previously. The right way to think of your browser "fleet" is as multiple single points of failure; diversity isn't helping you at all. This is one of those "put all your eggs in one basket and guard it" situations. I don't have any particular personal reason to love Chrome. I'm a Mac person, so I guess the best outcome for me would be for Safari to be perceived as the best browser. Certainly my batteries would last longer! Every couple of years I talk to people about what the landscape looks like; if I ever get different answers, I'll be sure to update my take.
Dalewyn 3y ago
Certifications (and specifically paying to get certified) are about legally throwing liability on another party, because nobody wants to end up with the hot ball in their hands. The assumption is that shit will or already has hit the fan, and the question is how to reduce your own liabilities as much as possible by throwing what you can on someone else. Certifications were and are never about practical or literal security.
- semi-extrinsic 3y ago
  It reminds me of the old quote by Keynes: A sound banker, alas, is not one who foresees danger and avoids it. But one who, when he is ruined, is ruined in a conventional and orthodox way with his fellows, so that no-one can really blame him

antongribok 3y ago

There is a forum post from a few weeks ago: https://forums.ivanti.com/s/article/Recovery-Steps-Related-to-CVE-2023-46805-and-CVE-2024-21887 https://forums.ivanti.com/s/article/Recovery-Steps-Related-t... (Linked from TFA)

drynewton 3y ago

It's on their website and has been for days. https://www.ivanti.com/blog/security-update-for-ivanti-connect-secure-and-ivanti-policy-secure-gateways https://www.ivanti.com/blog/security-update-for-ivanti-conne... That latest update is a follow up from Jan 10

MilStdJunkie 3y ago

I heard CMMC 2.0 will fix everything in govcon.