5 ms·

I must say, I'm impressed with how this was handled both by the original researcher and DigitalOcean.

by mey 13y ago

ihsw 13y ago
Responsible disclosure can benefit us all, unfortunately some vendors -- SaaS, PaaS, physical, or otherwise -- use their legal departments as blunt weapons to needlessly attack well-meaning security researchers. In case anybody is wondering, I'm referring to Volkswagen. http://www.engadget.com/2013/07/29/uk-court-volkswagen-megamos-crypto/ http://www.engadget.com/2013/07/29/uk-court-volkswagen-megam... Personally I'm an advocate of full, anonymous, and public disclosure.
- suhailpatel 13y ago
  I too am an advocate of full public disclosure but the concerns by Volkswagen are warranted and fixes to the issue can not be deployed as easily as DigitalOcean has done here. I don't agree with the gag order from the UK courts but it isn't totally unjustified.
- philtar 13y ago
  That's not a fair comparison. DigitalOcean just needs to update some stuff to fix this issue. VW would need to recall millions of vehicles (10s billions $). You would do the same thing if you were in their position and had shareholders to worry about.
  - mikeash 13y ago
    No, I certainly would not do the same thing, and to suggest otherwise is an insult. Let's not excuse bad behavior with this misguided idea that we're all equally bad.
    - smtddr 13y ago
      So what is VW suppose to do? I'm actually truly curious. This flaw apparently will unlock many expensive cars. These cars' system cannot be replaced as quickly/cheaply as an sshd binary in a linux OS. I'm very curious, what other action could they have taken. They need him to be silent so they can figure out how to fix it before he make it public right? Is letting the public know the detailed exploit more important than the potential problems of the info being public?
      - mikeash 13y ago
        VW needs to come up with an immediate workaround that they can publish to owners or allow dealers to quickly hack in, then come up with a permanent fix after that buys them some time. The immediate workaround may not be possible. In that case, they're just screwed. A company is not entitled to be able to save themselves from the consequences of their past fuckups in all situations. Sometimes, a mistake costs a lot of money or even kills the company. Perhaps this is one. I find it unlikely that it's impossible to disable the keyless entry system on the cars in question. Surely there is some fuse or wire that can be pulled to shut it off. But it ultimately doesn't matter. Finding a workaround quickly is what they need to do, and if they can't do it, that's not his problem.
        vacri 13y ago
        Your new solution of "fuck the company" actually harms the enduser even more. Some of them get the updated lock... then the company goes out of business, and now none of them can get official parts for their vehicles. It seems a solution for an ideal world, not the actual world.
        mikeash 13y ago
        You'll note that I proposed other solutions first. To repeat myself: it is highly unlikely that there is not some possible workaround that temporarily disables the system, even if it's something as brute as snipping a wire. Even in the absolute worst case that the vulnerability is somehow built into the very fabric of the car, you can still secure it by removing all valuables from the interior and then clamping a wheel with a boot. Remove the boot once you figure out a fix. Inconvenient to the owner to be sure, but not impossible to deal with. Harm to the end user is not my priority. Harm to society is, and it's clear to me that the long-term chilling effects on academic research far outweigh any temporary harm from VM issuing a recall or even going bankrupt. The alternative is to say that entity B should suffer from a restriction on their free speech simply because entity A, due to their own negligence, finds it excessively costly. There are so many different ways this could be handled other than "threaten to throw the researcher in jail if he doesn't shut up". But they are all more inconvenient and costly to VW. One can understand why, then, VW would go for the "threaten" option, if we think of VW as a sort of non-moral profit-optimizing organism. But I certainly can't understand why anyone would defend it, let alone say that we would do the same thing.
    - philtar 13y ago
      And here's one of the reasons why you're not the CEO of one of the largest corporations in the world. The biggest CEOs in the world are amoral (not immoral) a lot of the time. Also, the researcher wanted to disclose this information without VW having fixed it. DigitalOcean got the opportunity to fix their system. Do you know what VW's next step is?
  - glesica 13y ago
    I would absolutely not do what they have done. But at the same time, I will probably never be the CEO of a large company. I suspect there is at least a weak causal relationship at work here...
  - ihsw 13y ago
    It's the cost of doing business. They're putting insecure software into hundreds of thousands of cars, and every owner of that car has no control over the software that's running on them. Imagine if we applied the same logic to phones and other devices -- I wouldn't be surprised if you personally would be offended at the idea that you have little recourse over your phone being hacked remotely and you can't do a damn thing about it because the mobile handset manufacturer locked it down. Thankfully phones are subsidized, ubiquitous, and cheap, so you can take your phone anywhere and get it fixed/replaced. This is the future folks: locked down devices that you have no control over. Caveat: we're all plugging our phones into these insecure systems too. Wrap your brain around that for a second to see where I'm going with this.
specto 13y ago
Except I informed them of this issue in January of this year http://imgur.com/GTi2UxJ http://imgur.com/GTi2UxJ Apparently they ignored it :)
- kintamanimatt 13y ago
  That worries me far more than the actual security issue. Security issues happen to everybody, but so long as too many don't occur, it's the response that shapes my ongoing confidence in that company or product. What's happening on the left side? Is that you or the rep?
  - specto 13y ago
    I blocked out my name, the rep is the one with a picture. edit: actually I didn't realize there was a skype window up when I took the screenshot, thanks for warning me...
- mey 13y ago
  Ok, that is disturbing...
  - specto 13y ago
    Honestly, I figured they would realize how important it would be to fix this so I didn't follow up on it once I fixed my own images.
    - coldpie 13y ago
      It's a reality of doing tech support. You get a flood of garbage information ("Hi, I can't access your web page, I get a 404 error. My system has 8 GB of RAM and an Intel 4700K and blah blah blah..."), and have to do your best to sort through and solve the user's problem. Your ticket had two problems described. The tech probably didn't understand the significance of the first problem, and so just discarded the information. Then she answered your second question. When you've got 100 tickets to sort through in your 8 hour day, you simply have to make some compromises on the thoroughness of your response. To get her attention, it would have been better to explain a little about what the consequences are, and request that she have a developer follow up. Make it clear that it's a major security failure and could lead to compromised VMs. Then open a second ticket for your other issue.
ceol 13y ago
Except I don't see an email from DO or a notification when I log in to the admin panel. So if I didn't check HN at this exact time and saw this article, I would have no idea. It's not a huge deal to me, but if Linode did the same thing, you all would be foaming at the mouth. Just thought I would point this out.
- tallanvor 13y ago
  Do you have any Ubuntu instances running or saved? If not, then they would have no reason to notify you of the issue.
  - hexedpackets 13y ago
    I have a few Ubuntu instance and didn't receive any notification.
  - damncabbage 13y ago
    I've had a Ubuntu instance running for three months now; no notification.
  - rschmitty 13y ago
    running an Ubuntu 12.04.2 LTS (GNU/Linux 3.2.0-23-virtual x86_64) for 2 months, no notice yet for me

I must say, I'm impressed with how this was handled both by the original researcher and DigitalOcean.

by mey 13y ago

I must say, I'm impressed with how this was handled both by the original researcher and DigitalOcean.

ihsw 13y ago

Responsible disclosure can benefit us all, unfortunately some vendors -- SaaS, PaaS, physical, or otherwise -- use their legal departments as blunt weapons to needlessly attack well-meaning security researchers. In case anybody is wondering, I'm referring to Volkswagen. http://www.engadget.com/2013/07/29/uk-court-volkswagen-megamos-crypto/ http://www.engadget.com/2013/07/29/uk-court-volkswagen-megam... Personally I'm an advocate of full, anonymous, and public disclosure.

suhailpatel 13y ago
I too am an advocate of full public disclosure but the concerns by Volkswagen are warranted and fixes to the issue can not be deployed as easily as DigitalOcean has done here. I don't agree with the gag order from the UK courts but it isn't totally unjustified.
philtar 13y ago
That's not a fair comparison. DigitalOcean just needs to update some stuff to fix this issue. VW would need to recall millions of vehicles (10s billions $). You would do the same thing if you were in their position and had shareholders to worry about.
- mikeash 13y ago
  No, I certainly would not do the same thing, and to suggest otherwise is an insult. Let's not excuse bad behavior with this misguided idea that we're all equally bad.
  - smtddr 13y ago
    So what is VW suppose to do? I'm actually truly curious. This flaw apparently will unlock many expensive cars. These cars' system cannot be replaced as quickly/cheaply as an sshd binary in a linux OS. I'm very curious, what other action could they have taken. They need him to be silent so they can figure out how to fix it before he make it public right? Is letting the public know the detailed exploit more important than the potential problems of the info being public?
    - mikeash 13y ago
      VW needs to come up with an immediate workaround that they can publish to owners or allow dealers to quickly hack in, then come up with a permanent fix after that buys them some time. The immediate workaround may not be possible. In that case, they're just screwed. A company is not entitled to be able to save themselves from the consequences of their past fuckups in all situations. Sometimes, a mistake costs a lot of money or even kills the company. Perhaps this is one. I find it unlikely that it's impossible to disable the keyless entry system on the cars in question. Surely there is some fuse or wire that can be pulled to shut it off. But it ultimately doesn't matter. Finding a workaround quickly is what they need to do, and if they can't do it, that's not his problem.
      - vacri 13y ago
        Your new solution of "fuck the company" actually harms the enduser even more. Some of them get the updated lock... then the company goes out of business, and now none of them can get official parts for their vehicles. It seems a solution for an ideal world, not the actual world.
        mikeash 13y ago
        You'll note that I proposed other solutions first. To repeat myself: it is highly unlikely that there is not some possible workaround that temporarily disables the system, even if it's something as brute as snipping a wire. Even in the absolute worst case that the vulnerability is somehow built into the very fabric of the car, you can still secure it by removing all valuables from the interior and then clamping a wheel with a boot. Remove the boot once you figure out a fix. Inconvenient to the owner to be sure, but not impossible to deal with. Harm to the end user is not my priority. Harm to society is, and it's clear to me that the long-term chilling effects on academic research far outweigh any temporary harm from VM issuing a recall or even going bankrupt. The alternative is to say that entity B should suffer from a restriction on their free speech simply because entity A, due to their own negligence, finds it excessively costly. There are so many different ways this could be handled other than "threaten to throw the researcher in jail if he doesn't shut up". But they are all more inconvenient and costly to VW. One can understand why, then, VW would go for the "threaten" option, if we think of VW as a sort of non-moral profit-optimizing organism. But I certainly can't understand why anyone would defend it, let alone say that we would do the same thing.
  - philtar 13y ago
    And here's one of the reasons why you're not the CEO of one of the largest corporations in the world. The biggest CEOs in the world are amoral (not immoral) a lot of the time. Also, the researcher wanted to disclose this information without VW having fixed it. DigitalOcean got the opportunity to fix their system. Do you know what VW's next step is?
- glesica 13y ago
  I would absolutely not do what they have done. But at the same time, I will probably never be the CEO of a large company. I suspect there is at least a weak causal relationship at work here...
- ihsw 13y ago
  It's the cost of doing business. They're putting insecure software into hundreds of thousands of cars, and every owner of that car has no control over the software that's running on them. Imagine if we applied the same logic to phones and other devices -- I wouldn't be surprised if you personally would be offended at the idea that you have little recourse over your phone being hacked remotely and you can't do a damn thing about it because the mobile handset manufacturer locked it down. Thankfully phones are subsidized, ubiquitous, and cheap, so you can take your phone anywhere and get it fixed/replaced. This is the future folks: locked down devices that you have no control over. Caveat: we're all plugging our phones into these insecure systems too. Wrap your brain around that for a second to see where I'm going with this.

specto 13y ago

Except I informed them of this issue in January of this year http://imgur.com/GTi2UxJ http://imgur.com/GTi2UxJ Apparently they ignored it :)

kintamanimatt 13y ago
That worries me far more than the actual security issue. Security issues happen to everybody, but so long as too many don't occur, it's the response that shapes my ongoing confidence in that company or product. What's happening on the left side? Is that you or the rep?
- specto 13y ago
  I blocked out my name, the rep is the one with a picture. edit: actually I didn't realize there was a skype window up when I took the screenshot, thanks for warning me...
mey 13y ago
Ok, that is disturbing...
- specto 13y ago
  Honestly, I figured they would realize how important it would be to fix this so I didn't follow up on it once I fixed my own images.
  - coldpie 13y ago
    It's a reality of doing tech support. You get a flood of garbage information ("Hi, I can't access your web page, I get a 404 error. My system has 8 GB of RAM and an Intel 4700K and blah blah blah..."), and have to do your best to sort through and solve the user's problem. Your ticket had two problems described. The tech probably didn't understand the significance of the first problem, and so just discarded the information. Then she answered your second question. When you've got 100 tickets to sort through in your 8 hour day, you simply have to make some compromises on the thoroughness of your response. To get her attention, it would have been better to explain a little about what the consequences are, and request that she have a developer follow up. Make it clear that it's a major security failure and could lead to compromised VMs. Then open a second ticket for your other issue.

ceol 13y ago

Except I don't see an email from DO or a notification when I log in to the admin panel. So if I didn't check HN at this exact time and saw this article, I would have no idea. It's not a huge deal to me, but if Linode did the same thing, you all would be foaming at the mouth. Just thought I would point this out.

tallanvor 13y ago
Do you have any Ubuntu instances running or saved? If not, then they would have no reason to notify you of the issue.
- hexedpackets 13y ago
  I have a few Ubuntu instance and didn't receive any notification.
- damncabbage 13y ago
  I've had a Ubuntu instance running for three months now; no notification.
- rschmitty 13y ago
  running an Ubuntu 12.04.2 LTS (GNU/Linux 3.2.0-23-virtual x86_64) for 2 months, no notice yet for me