4 ms·

This has been bothering me for a while. Security people act like it's their duty to expose every vulnerability, and that companies are negligent if they don't

by sdwr 2y ago

This has been bothering me for a while. Security people act like it's their duty to expose every vulnerability, and that companies are negligent if they don't harden themselves against all attack vectors, while they are responsible for a good part of the danger. Out in meatspace, I don't wander around picking random people's locks, making smug posts about how vulnerable their houses are (along with their address). Nobody would be happy about that, no matter what color hat I have on. Security is a twin-engine racket, based on the pillars of - assumed intellectual superiority - the actual protection racket part

megous 2y ago
Company makes HW that can potentially harm people, if someone logs in to it remotely and turns all lights green at once. It's possible to find the vulnerability in 15 minutes of getting remote access to the device without any prior knowledge, that gives admin access to the HW. Company rejects the report based on flmisy reasons via a lawyer, threatening with a felony prosecution. But the person finding the vulnerability and notifying the company is the smug one. :)
- sdwr 2y ago
  There are electrical junction boxes all over my neighborhood, that direct power to the stoplights and residential buildings (?). They have a simple padlock, and could be opened in 30 seconds with a lockpick or bolt cutters. Nobody tries! Not even to test it out! The question isn't "How easy is it to break in?", but rather "Should I be tampering with this?"
  - patrickmay 2y ago
    Your analogy breaks down immediately because the Internet isn't your neighborhood, it's effectively everyone's neighborhood, including the state-level bad actors mentioned above. If someone could access those electrical junction boxes from China or North Korea, I'd want the locals finding the vulnerabilities first.
    - rvnx 2y ago
      Hypothetic answer from state-actor: "We will push an update to Flipper Zero for this, the right moment. Thanks to the Flipper Zero, we have millions of devices in the wild that we can remotely control and send signals from. Just wait."
qual 2y ago
Could you help me understand what you are suggesting is done instead? To me, it seems like you're suggesting that vulnerabilities are just left in play until someone malicious comes along and decides to do some real damage. But that seems so silly that I must be missing some alternative that you're thinking about.
- rvnx 2y ago
  You've noticed an issue. You let the manufacturer know, and you let them decide for the next steps. No ultimatum to threaten to disclose to the public or to ruin their reputation, it's not your business. In the meantime, you keep it for yourself. You helped: no lawyers, no problems. If really there is a safety issue, after a reasonable period of time you can inform the regulators, as it is their job to assess safety. This is responsible disclosure, not TMZ-style public-shaming.
  - qual 2y ago
    You're presenting this as if its a new idea, but the security industry tried the above (for the majority of the time that "computer security" has been a thing) and... it didn't work! That's the whole reason public disclosure came about in the first place -- there's quite a rich history there if you're interested. Some other thoughts: >You let the manufacturer know, and you let them decide for the next steps. Which, as history has proven, the "next steps" is generally to sweep it under the rug and to be forgotten about until it's exploited by a bad actor. >it's not your business But, what about when it is? On-topic: I drive a car, so I care about vulnerabilities in traffic lights and they may directly affect me. It's also my business if my personal data is stolen, or my identity, or corporate data, etc. >You helped: no lawyers, no problems. No problems... Until the vulnerability is exploited and it causes me a problem.
  - EvanAnderson 2y ago
    > No ultimatum to threaten to disclose to the public or to ruin their reputation, it's not your business. I found an authentication bypass in a door card access controller. Per the installer I was working with the units are regularly exposed directly to the Internet. (Heck, the installer was trying to cajole my Customer into doing it for "remote support" reasons.) Given that there's an impact to the public-- albeit not necessarily directly safety-related-- I think this kind of vulnerability is still "my business". If I owned one of these controllers and it was "protecting" my property I'd want to know. (Fun aside: The installer went so far as to suggest that because their other Customers expose these units to the Internet-- particularly a small bank who is "audited" for "security"-- it would be okay if my Customer did it. Needless to say, my Customer did not. I let my Customer know about the auth. bypass and we kept the unit locked down in a VLAN w/ a restrictive ACL, but I never publicly disclosed... too afraid of hostile response from the vendor. Eventually a researcher did find it and disclose it publicly, at least...)
yojo 2y ago
I assume that any piece of technologically backed infrastructure is a potential target for state-level actors. If rando security researcher finds the vuln in 15 minutes, I guarantee China already has it. Anyone operating infrastructure hardware is negligent if they won't take basic measures to harden it against disclosed threats. I’m not worried about malfeasant citizens mucking with the traffic lights, there are simpler ways to make mayhem. But in the event of a war, you can bet every unpatched vulnerability in your infrastructure will be used against your country.
- rvnx 2y ago
  When you work for a state-actor it's no different than anywhere else; you don't have exploits coming out of the sky. You either research these vulnerabilities (and you have limited capacity and knowledge) or you purchase vulnerabilities from vendors, exchanges and "research companies". In such case, it was an unnecessary free gift to an enemy state or a malicious actor. The same with NSA, they do not know all the vulns of the universe (due to budget, resources, or simply focus). You may actually have some vulns they are interested into but unless someone points these vulns to them, they will not get aware that they exists.
floatrock 2y ago
> Out in meatspace, I don't wander around picking random people's locks, making smug posts about how vulnerable their houses are (along with their address). Nobody would be happy about that, no matter what color hat I have on. Yeah, but in youtube space, there are, eg, lawyers who are into lockpicking who post smug videos showing how vulnerable various manufacturers' locks really are to common lockpicking techniques. Apparently 4.5M subscribers are quite happy being informed what the state of lock security is out there. https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ
rootusrootus 2y ago
> Out in meatspace, I don't wander around picking random people's locks Sure, because the chances of getting punched out, shot, or reported to the cops is significantly higher. Given how trivial it is to quietly attack across the network, I think the analogy with meatspace makes little sense.
- olyjohn 2y ago
  Also breaking into a single persons house... maybe they don't want to lock their doors. It affects nobody but them. These systems affect lots of people, it's a public safety issue, and there is a company being paid money by the public to ensure that their systems are safe and secure. They should be tested by everybody and anybody who wants to test them. Especially if they are running on a publicly accessible IP address. Also if you want to test the locks on someone's house, you don't go to their house. You buy the locks that they are using, and test them quietly in your own location.
  - rootusrootus 2y ago
    > Also if you want to test the locks on someone's house, you don't go to their house. You buy the locks that they are using, and test them quietly in your own location. This is a pretty great point, because it's exactly what the guy in the article did to find the vulnerability in the traffic controllers.
olyjohn 2y ago
Your analogy is flawed. This isn't testing someone's house. This is buying the locks that are on people's houses and testing them in your own location. Which people should absolutely be doing.
mmsc 2y ago
I think a better analogy is wandering around noting what locks random peoples' houses use, buying your own, breaking your own, informing the manufacturer of the flaw, and then informing the owners of the random peoples' houses. AKA what criminals already do, except the criminals actually break into the random peoples' homes and steal their stuff.

by sdwr 2y ago

megous 2y ago

Company makes HW that can potentially harm people, if someone logs in to it remotely and turns all lights green at once. It's possible to find the vulnerability in 15 minutes of getting remote access to the device without any prior knowledge, that gives admin access to the HW. Company rejects the report based on flmisy reasons via a lawyer, threatening with a felony prosecution. But the person finding the vulnerability and notifying the company is the smug one. :)

sdwr 2y ago
There are electrical junction boxes all over my neighborhood, that direct power to the stoplights and residential buildings (?). They have a simple padlock, and could be opened in 30 seconds with a lockpick or bolt cutters. Nobody tries! Not even to test it out! The question isn't "How easy is it to break in?", but rather "Should I be tampering with this?"
- patrickmay 2y ago
  Your analogy breaks down immediately because the Internet isn't your neighborhood, it's effectively everyone's neighborhood, including the state-level bad actors mentioned above. If someone could access those electrical junction boxes from China or North Korea, I'd want the locals finding the vulnerabilities first.
  - rvnx 2y ago
    Hypothetic answer from state-actor: "We will push an update to Flipper Zero for this, the right moment. Thanks to the Flipper Zero, we have millions of devices in the wild that we can remotely control and send signals from. Just wait."

qual 2y ago

Could you help me understand what you are suggesting is done instead? To me, it seems like you're suggesting that vulnerabilities are just left in play until someone malicious comes along and decides to do some real damage. But that seems so silly that I must be missing some alternative that you're thinking about.

rvnx 2y ago
You've noticed an issue. You let the manufacturer know, and you let them decide for the next steps. No ultimatum to threaten to disclose to the public or to ruin their reputation, it's not your business. In the meantime, you keep it for yourself. You helped: no lawyers, no problems. If really there is a safety issue, after a reasonable period of time you can inform the regulators, as it is their job to assess safety. This is responsible disclosure, not TMZ-style public-shaming.
- qual 2y ago
  You're presenting this as if its a new idea, but the security industry tried the above (for the majority of the time that "computer security" has been a thing) and... it didn't work! That's the whole reason public disclosure came about in the first place -- there's quite a rich history there if you're interested. Some other thoughts: >You let the manufacturer know, and you let them decide for the next steps. Which, as history has proven, the "next steps" is generally to sweep it under the rug and to be forgotten about until it's exploited by a bad actor. >it's not your business But, what about when it is? On-topic: I drive a car, so I care about vulnerabilities in traffic lights and they may directly affect me. It's also my business if my personal data is stolen, or my identity, or corporate data, etc. >You helped: no lawyers, no problems. No problems... Until the vulnerability is exploited and it causes me a problem.
- EvanAnderson 2y ago
  > No ultimatum to threaten to disclose to the public or to ruin their reputation, it's not your business. I found an authentication bypass in a door card access controller. Per the installer I was working with the units are regularly exposed directly to the Internet. (Heck, the installer was trying to cajole my Customer into doing it for "remote support" reasons.) Given that there's an impact to the public-- albeit not necessarily directly safety-related-- I think this kind of vulnerability is still "my business". If I owned one of these controllers and it was "protecting" my property I'd want to know. (Fun aside: The installer went so far as to suggest that because their other Customers expose these units to the Internet-- particularly a small bank who is "audited" for "security"-- it would be okay if my Customer did it. Needless to say, my Customer did not. I let my Customer know about the auth. bypass and we kept the unit locked down in a VLAN w/ a restrictive ACL, but I never publicly disclosed... too afraid of hostile response from the vendor. Eventually a researcher did find it and disclose it publicly, at least...)

yojo 2y ago

I assume that any piece of technologically backed infrastructure is a potential target for state-level actors. If rando security researcher finds the vuln in 15 minutes, I guarantee China already has it. Anyone operating infrastructure hardware is negligent if they won't take basic measures to harden it against disclosed threats. I’m not worried about malfeasant citizens mucking with the traffic lights, there are simpler ways to make mayhem. But in the event of a war, you can bet every unpatched vulnerability in your infrastructure will be used against your country.

rvnx 2y ago
When you work for a state-actor it's no different than anywhere else; you don't have exploits coming out of the sky. You either research these vulnerabilities (and you have limited capacity and knowledge) or you purchase vulnerabilities from vendors, exchanges and "research companies". In such case, it was an unnecessary free gift to an enemy state or a malicious actor. The same with NSA, they do not know all the vulns of the universe (due to budget, resources, or simply focus). You may actually have some vulns they are interested into but unless someone points these vulns to them, they will not get aware that they exists.

floatrock 2y ago

> Out in meatspace, I don't wander around picking random people's locks, making smug posts about how vulnerable their houses are (along with their address). Nobody would be happy about that, no matter what color hat I have on. Yeah, but in youtube space, there are, eg, lawyers who are into lockpicking who post smug videos showing how vulnerable various manufacturers' locks really are to common lockpicking techniques. Apparently 4.5M subscribers are quite happy being informed what the state of lock security is out there. https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ https://www.youtube.com/channel/UCm9K6rby98W8JigLoZOh6FQ

rootusrootus 2y ago

> Out in meatspace, I don't wander around picking random people's locks Sure, because the chances of getting punched out, shot, or reported to the cops is significantly higher. Given how trivial it is to quietly attack across the network, I think the analogy with meatspace makes little sense.

olyjohn 2y ago
Also breaking into a single persons house... maybe they don't want to lock their doors. It affects nobody but them. These systems affect lots of people, it's a public safety issue, and there is a company being paid money by the public to ensure that their systems are safe and secure. They should be tested by everybody and anybody who wants to test them. Especially if they are running on a publicly accessible IP address. Also if you want to test the locks on someone's house, you don't go to their house. You buy the locks that they are using, and test them quietly in your own location.
- rootusrootus 2y ago
  > Also if you want to test the locks on someone's house, you don't go to their house. You buy the locks that they are using, and test them quietly in your own location. This is a pretty great point, because it's exactly what the guy in the article did to find the vulnerability in the traffic controllers.

olyjohn 2y ago

Your analogy is flawed. This isn't testing someone's house. This is buying the locks that are on people's houses and testing them in your own location. Which people should absolutely be doing.

mmsc 2y ago

I think a better analogy is wandering around noting what locks random peoples' houses use, buying your own, breaking your own, informing the manufacturer of the flaw, and then informing the owners of the random peoples' houses. AKA what criminals already do, except the criminals actually break into the random peoples' homes and steal their stuff.