6 ms·

Good response from Akamai. No beating around the bush there.

by hrrsn 13y ago

mycodebreaks 13y ago
Yes, they've been clear and honest in their communication.
daeken 13y ago
No, this was not a good response. It was well written and took responsibility for bad code, but it failed to address the elephant in the room: why were keys not immediately rotated? I've said this a number of times lately, but it bears repeating that the golden rule of security is: If a compromise occurs, assume that everything is compromised. Even if their approach was tested to be perfect, they shouldn't have made the assumption that that actually reflected reality. They were extraordinarily irresponsible. There's simply no other way to slice it.
- blahedo 13y ago
  No, that goes too far the other way. If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too? Your argument is totally correct if I am simply unsure---if I don't know whether an exploit affects me but I suspect it might, I assume the worst and act accordingly. But in this case Akamai had good reason to believe they were unaffected. (And, when someone demonstrated otherwise, they responded responsibly.)
  - daeken 13y ago
    > If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too? If you have a memory read out of a process that contains sensitive data, you should always assume that the sensitive data was breached, even if you "programmed defensively against it". Period. No exceptions. They had good reason to believe they were unaffected, which is why they shouldn't have hit the "oh shit, the world is ending" button. But the decision to not roll their keys in the face of a breach was a massively irresponsible one. We have how many years of major bugs to look at? And in how many cases are the likes of Akamai (that is, organizations with theoretical mitigations in place) actually safe when they think they are? Always, always assume your protections are faulty in a way that a motivated attacker will figure out.
  - makomk 13y ago
    Take a look at how much protection people's legitimate reasons to believe that this didn't affect them have given so far - the only people who haven't been proven wrong were the ones who weren't running a vulnerable OpenSSL. Their arguments all assumed that because they couldn't imagine a way to get the keys there wasn't one, when in fact they just hadn't thought about it enough.
  - grayclhn 13y ago
    > If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too? Your argument hinges on the word "legitimate." I don't do security, but "it looks good to me" is not a legitimate reason to believe that the exploit does not affect you (for any value of "me"). OTOH "I've never used the versions of OpenSSL that have this bug" is a legitimate reason to believe that you're not affected, e.g. Tarsnap's explanation [1]. I'd also recommend that post for another take on what defensive programming looks like in this context. [1] http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartb... on HN: https://news.ycombinator.com/item?id=7562125 https://news.ycombinator.com/item?id=7562125
- Narkov 13y ago
  They believed that they were covered and that no compromise could/did occur. It's a mistake they now acknowledge but they have owned up to it and are taking action - just as you suggest. I believe their actions are honest and completely reasonable. If they had known they still had an issue I seriously doubt they would have publicised the patch and risk the issue they now have.
  - daeken 13y ago
    > I believe their actions are honest and completely reasonable. If they had known they still had an issue I seriously doubt they would have publicised the patch and risk the issue they now have. I completely agree that their actions are honest, and I seriously doubt they would have played things this way if they knew their protections were faulty. I'm not saying that they're acting maliciously; I'm saying that they acted in an arrogant and irresponsible way. If an attacker can read memory out of a process containing sensitive data, the assumption should always be that they got the keys to the kingdom even if they didn't. I'm not saying they didn't do their best to defend their service -- on the contrary, I think that their defense is a good one -- but that they played chicken with an exploit and ended up on the wrong side of it. Their customers deserved better.
    - Narkov 13y ago
      > If an attacker can read memory out of a process containing sensitive data, the assumption should always be that they got the keys to the kingdom even if they didn't We both agree on this. > but that they played chicken with an exploit and ended up on the wrong side of it. I disagree with this. They thought they had a valid technical solution and did the honourable thing by releasing it. Unfortunately they were wrong but that's a bug and not a arrogance issue.

Good response from Akamai. No beating around the bush there.

by hrrsn 13y ago

Good response from Akamai. No beating around the bush there.

mycodebreaks 13y ago

Yes, they've been clear and honest in their communication.

daeken 13y ago

No, this was not a good response. It was well written and took responsibility for bad code, but it failed to address the elephant in the room: why were keys not immediately rotated? I've said this a number of times lately, but it bears repeating that the golden rule of security is: If a compromise occurs, assume that everything is compromised. Even if their approach was tested to be perfect, they shouldn't have made the assumption that that actually reflected reality. They were extraordinarily irresponsible. There's simply no other way to slice it.

blahedo 13y ago
No, that goes too far the other way. If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too? Your argument is totally correct if I am simply unsure---if I don't know whether an exploit affects me but I suspect it might, I assume the worst and act accordingly. But in this case Akamai had good reason to believe they were unaffected. (And, when someone demonstrated otherwise, they responded responsibly.)
- daeken 13y ago
  > If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too? If you have a memory read out of a process that contains sensitive data, you should always assume that the sensitive data was breached, even if you "programmed defensively against it". Period. No exceptions. They had good reason to believe they were unaffected, which is why they shouldn't have hit the "oh shit, the world is ending" button. But the decision to not roll their keys in the face of a breach was a massively irresponsible one. We have how many years of major bugs to look at? And in how many cases are the likes of Akamai (that is, organizations with theoretical mitigations in place) actually safe when they think they are? Always, always assume your protections are faulty in a way that a motivated attacker will figure out.
- makomk 13y ago
  Take a look at how much protection people's legitimate reasons to believe that this didn't affect them have given so far - the only people who haven't been proven wrong were the ones who weren't running a vulnerable OpenSSL. Their arguments all assumed that because they couldn't imagine a way to get the keys there wasn't one, when in fact they just hadn't thought about it enough.
- grayclhn 13y ago
  > If I have legitimate reason to believe that an exploit does not affect me (especially if it's because I acknowledged its possibility and programmed defensively against it), why would I automatically act as if I were breached too? Your argument hinges on the word "legitimate." I don't do security, but "it looks good to me" is not a legitimate reason to believe that the exploit does not affect you (for any value of "me"). OTOH "I've never used the versions of OpenSSL that have this bug" is a legitimate reason to believe that you're not affected, e.g. Tarsnap's explanation [1]. I'd also recommend that post for another take on what defensive programming looks like in this context. [1] http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartbleed-here.html http://www.daemonology.net/blog/2014-04-09-tarsnap-no-heartb... on HN: https://news.ycombinator.com/item?id=7562125 https://news.ycombinator.com/item?id=7562125
Narkov 13y ago
They believed that they were covered and that no compromise could/did occur. It's a mistake they now acknowledge but they have owned up to it and are taking action - just as you suggest. I believe their actions are honest and completely reasonable. If they had known they still had an issue I seriously doubt they would have publicised the patch and risk the issue they now have.
- daeken 13y ago
  > I believe their actions are honest and completely reasonable. If they had known they still had an issue I seriously doubt they would have publicised the patch and risk the issue they now have. I completely agree that their actions are honest, and I seriously doubt they would have played things this way if they knew their protections were faulty. I'm not saying that they're acting maliciously; I'm saying that they acted in an arrogant and irresponsible way. If an attacker can read memory out of a process containing sensitive data, the assumption should always be that they got the keys to the kingdom even if they didn't. I'm not saying they didn't do their best to defend their service -- on the contrary, I think that their defense is a good one -- but that they played chicken with an exploit and ended up on the wrong side of it. Their customers deserved better.
  - Narkov 13y ago
    > If an attacker can read memory out of a process containing sensitive data, the assumption should always be that they got the keys to the kingdom even if they didn't We both agree on this. > but that they played chicken with an exploit and ended up on the wrong side of it. I disagree with this. They thought they had a valid technical solution and did the honourable thing by releasing it. Unfortunately they were wrong but that's a bug and not a arrogance issue.