3 ms·

"Technology vendors are the characters who are building problems..." there are vendors building problems into their products? isn't that a crime? What a silly

"Technology vendors are the characters who are building problems..." there are vendors building problems into their products? isn't that a crime? What a silly take. "House developers that build weak doors into houses are the real problem, not the burglars" Security is an age-old problem, it is not a new concept. What is different with information security is the complexities and power dynamics changed drastically. I mean, really! She should know better, the #1 attack vector for initial access is still phishing or social-engineering of some kind. Not a specific vulnerability in some software.

acdha 2y ago
Hint: she didn’t say that they were building them intentionally. Skimping is building a problem even if nobody had a Jira ticket saying they had to leave out bounds checking.
- notepad0x90 2y ago
  Most vulnerabilities are not there because someone was deliberately negligent either. I see no evidence of a trend where vendors are "skimping" on anything.
  - acdha 2y ago
    You don’t think the vendors who are years behind on dependency updates are skimping? Not the ones who are still struggling to ship patches on a better than quarterly cadence? Not the ones who still ship 90s-style C code to enterprise customers who are paying high prices for their security products? Not the ones still writing new code in memory unsafe languages? Not the ones who still tell customers to disable SELinux? Not the ones who still refuse to use the sandboxing features in modern operating systems? Companies love the idea that you can’t hold the liable for any defect they didn’t intentionally build in, but software is the extreme outlier where they were able to avoid consumer safety regulations and thus the expense of hiring people who can even tell when something is risky. Shift the cost back to the supplier would restore the market feedback mechanism which is currently missing, greatly improving the health of the industry.
EnigmaFlare 2y ago
Search MasterLock on Youtube and you'll see that people blame the lock maker rather than the burglars. That's because the lock maker is notorious for making insecure locks. Social engineering is also something that can be protected against by developers, at least to some extent. Yubikey type 2FA is more resistant to that than user-input TOTP codes, for example. Nothing's bulletproof but it could certainly be improved in many cases. Wasn't some company that experienced a credential stuffing attack recently sued for not requiring 2FA for its users? We don't tolerate house builders who says "well there's always some way water might get into the framing, so we don't need to bother installing flashings properly - a bit of caulking will do instead."
- notepad0x90 2y ago
  Even a yubikey isn't resistant to cookie-theft, plenty of TOTP code theft phishing kits exist. Users literally enable third-party apk side-loading and install malicious apks on their android phones because of social engineering. It's not new to security. If you wear a high-vis vest and carry a clipboard, you'd be let into even government buildings. that also is social engineering. For your house builders statement, that is not a fair analogy. Is there evidence of a trend where software devs are saying "well there's always some other way of getting hacked so let's not bother doing things properly"? You masterlock analogy is on-point though, because of "threat model", the purpose of most doors and locks in the US for residential use is as a lightweight deterrent. Burglars can just break the glass window and walk by the no-fence perimeter. You can and probably should get a more secure lock, but it is as strong as the door frame and windows, and whatever alarm system you're using. In other words, for that analogy (and for what the CISA boss is saying) to be valid, there needs to be evidence that burglars give up and go home when the lock is secure. I would even go further and ask for a proper root cause analysis. Do the builders of masterlock know how insecure their lock is? If they are indeed making it weak because of cost, then are they really to blame? they're a business after all. Where is the regulation for proper secure locks. As a government agency, CISA shouldn't be blaming vendors, that's a cheap cop-out. They should be lobbying for regulation and laws, and then enforcing them. So, in the end, even if the CISA boss is right, ultimately she shouldn't be blaming vendors but explaining what she's been doing to pass regulations.
__turbobrew__ 2y ago
Physical analogs do not apply to computer security because the burglar usually does not live in a place where the judicial system can punish them. How are you going to bring some random hackers from Russia, China, India, etc to justice if those countries will not extradite them for their crimes? When the judiciary is no longer effective the only option is to design secure systems or balkanize the internet so only those who can be punished under the judiciary can access the computer system (which is nearly impossible with proxies).
- notepad0x90 2y ago
  the dynamics are different but hackers get prosecuted all the time. they don't always live in non-extradition countries.

acdha 2y ago

Hint: she didn’t say that they were building them intentionally. Skimping is building a problem even if nobody had a Jira ticket saying they had to leave out bounds checking.

notepad0x90 2y ago
Most vulnerabilities are not there because someone was deliberately negligent either. I see no evidence of a trend where vendors are "skimping" on anything.
- acdha 2y ago
  You don’t think the vendors who are years behind on dependency updates are skimping? Not the ones who are still struggling to ship patches on a better than quarterly cadence? Not the ones who still ship 90s-style C code to enterprise customers who are paying high prices for their security products? Not the ones still writing new code in memory unsafe languages? Not the ones who still tell customers to disable SELinux? Not the ones who still refuse to use the sandboxing features in modern operating systems? Companies love the idea that you can’t hold the liable for any defect they didn’t intentionally build in, but software is the extreme outlier where they were able to avoid consumer safety regulations and thus the expense of hiring people who can even tell when something is risky. Shift the cost back to the supplier would restore the market feedback mechanism which is currently missing, greatly improving the health of the industry.

EnigmaFlare 2y ago

Search MasterLock on Youtube and you'll see that people blame the lock maker rather than the burglars. That's because the lock maker is notorious for making insecure locks. Social engineering is also something that can be protected against by developers, at least to some extent. Yubikey type 2FA is more resistant to that than user-input TOTP codes, for example. Nothing's bulletproof but it could certainly be improved in many cases. Wasn't some company that experienced a credential stuffing attack recently sued for not requiring 2FA for its users? We don't tolerate house builders who says "well there's always some way water might get into the framing, so we don't need to bother installing flashings properly - a bit of caulking will do instead."

notepad0x90 2y ago
Even a yubikey isn't resistant to cookie-theft, plenty of TOTP code theft phishing kits exist. Users literally enable third-party apk side-loading and install malicious apks on their android phones because of social engineering. It's not new to security. If you wear a high-vis vest and carry a clipboard, you'd be let into even government buildings. that also is social engineering. For your house builders statement, that is not a fair analogy. Is there evidence of a trend where software devs are saying "well there's always some other way of getting hacked so let's not bother doing things properly"? You masterlock analogy is on-point though, because of "threat model", the purpose of most doors and locks in the US for residential use is as a lightweight deterrent. Burglars can just break the glass window and walk by the no-fence perimeter. You can and probably should get a more secure lock, but it is as strong as the door frame and windows, and whatever alarm system you're using. In other words, for that analogy (and for what the CISA boss is saying) to be valid, there needs to be evidence that burglars give up and go home when the lock is secure. I would even go further and ask for a proper root cause analysis. Do the builders of masterlock know how insecure their lock is? If they are indeed making it weak because of cost, then are they really to blame? they're a business after all. Where is the regulation for proper secure locks. As a government agency, CISA shouldn't be blaming vendors, that's a cheap cop-out. They should be lobbying for regulation and laws, and then enforcing them. So, in the end, even if the CISA boss is right, ultimately she shouldn't be blaming vendors but explaining what she's been doing to pass regulations.

__turbobrew__ 2y ago

Physical analogs do not apply to computer security because the burglar usually does not live in a place where the judicial system can punish them. How are you going to bring some random hackers from Russia, China, India, etc to justice if those countries will not extradite them for their crimes? When the judiciary is no longer effective the only option is to design secure systems or balkanize the internet so only those who can be punished under the judiciary can access the computer system (which is nearly impossible with proxies).

notepad0x90 2y ago
the dynamics are different but hackers get prosecuted all the time. they don't always live in non-extradition countries.