Symantec CEO says source code reviews by foreign states pose unacceptable risk • Hacker News Board

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#121

Post by colordrops » Fri, Oct 13, 2017, 1:57 AM UTC

ksk wrote: post #117

colordrops wrote: post #88

Earlier quoted context omitted.

Sounds like a vulnerability. Isn't that how the argument went about source code? "If you know how the program works it may be easier to write an exploit." But then experience taught people that exposing source code to the bright sunlight by opening its source could actually make software more secure through many eyes finding holes. Why is this not applicable to virus detection algorithms?

>If you know how the program works it may be easier to write an exploit." BTW, this is true. Seeing the source code versus having to go through assembly listings - I know which one I'd pick if I had to find logic bugs. >Why is this not applicable to virus detection algorithms? Its not an algorithm, but a heuristic. If you want to look for a suspect, you don't announce "I'm looking for someone 5 feet 5 inches tall wit…

How do you build a heuristic if not with an algorithm? Perhaps the entire AV model employed by Symantec is flawed.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#122

Post by ksk » Fri, Oct 13, 2017, 4:40 PM UTC

colordrops wrote: post #121

ksk wrote: post #117

Earlier quoted context omitted.

>If you know how the program works it may be easier to write an exploit." BTW, this is true. Seeing the source code versus having to go through assembly listings - I know which one I'd pick if I had to find logic bugs. >Why is this not applicable to virus detection algorithms? Its not an algorithm, but a heuristic. If you want to look for a suspect, you don't announce "I'm looking for someone 5 feet 5 inches tall wit…

How do you build a heuristic if not with an algorithm? Perhaps the entire AV model employed by Symantec is flawed.

>How do you build a heuristic if not with an algorithm?

I don't know what that means. Perhaps superficially there is some overlap since both run on deterministic hardware, but a heuristic is completely different from an algorithm. Its a technique that can perhaps give you an imperfect answer to the question you're asking. An algorithm describes a method, which, if followed, gives you the answer. Here is an AV heuristic that I made up just now:

-Is it encrypted? +1 point

-Does it contain self modifying/unpacking code? +1 point

-Does it call OS APIs to monitor running programs? +1 point

-Does it run at startup? +1 point

-Does it have no UI? +1 point

-Does it try to punch a hole through NAT? +1 point

-Does its process name contain random strings? +1 point

If you get > 5 points, hash the executable and send the hash/executable for analysis.

>Perhaps the entire AV model employed by Symantec is flawed.

Well, for one, the heuristic isn't the "entire AV model". But what makes you think the entire AV model is flawed? Every major OS uses parts of the AV model.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#123

Post by criley2 » Tue, Oct 17, 2017, 1:54 PM UTC

raesene9 wrote: post #60

criley2 wrote: post #58

Earlier quoted context omitted.

Symantec: "No, our code is audited professionally by the most reputable international firms along international standards of quality. You can review our audit reports and engage with the international body responsible for regulating audits to raise any concerns" Foreign Gov. Customer: "But what I really want is for my tech spooks to scan pre-selected high value modules for already known and suspected zero day exploit…

What "interational body for regulating audits" would that be, I'm not aware of any such body...? Also If Symantec won't trust their customers to that degree, why should a foreign government or their key industries trust symantec software? If a US audit firm audits US software, why should an international government trust that there isn't a US backdoor in there? Or perhaps that the US audits have uncovered issues but…

I do not personally believe in todays world that national security and software can be separated.

As an American, I certainly would not trust any non-American AV software.

I would assume that all AV made in another country is compromised by that countries government intelligence. That would be a safe assumption.

I would be safer user American AV as an American because despite what the anti-gov propaganda wants us to believe, it's far harder for the NSA to spy on Americans than non-Americans.

Regardless, this entire thread (and your post) seems to treat nation-state actors as inherently innocent, which is so blindly naive that it's difficult to rationally respond to.

But this is the nature of cyberwar. Damaging, effective, wide-spread--- and invisible and plausibly deniable.

Symantec giving source to Russia should be seen as a violation of American national security at this point, because it gives a hostile foreign government a blueprint to attack US networks.

Re: Symantec CEO says source code reviews by foreign states pose unacceptable risk

#124

Post by raesene9 » Thu, Oct 19, 2017, 7:49 PM UTC

criley2 wrote: post #123

raesene9 wrote: post #60

Earlier quoted context omitted.

What "interational body for regulating audits" would that be, I'm not aware of any such body...? Also If Symantec won't trust their customers to that degree, why should a foreign government or their key industries trust symantec software? If a US audit firm audits US software, why should an international government trust that there isn't a US backdoor in there? Or perhaps that the US audits have uncovered issues but…

I do not personally believe in todays world that national security and software can be separated. As an American, I certainly would not trust any non-American AV software. I would assume that all AV made in another country is compromised by that countries government intelligence. That would be a safe assumption. I would be safer user American AV as an American because despite what the anti-gov propaganda wants us to…

You've picked me up entirely incorrectly if you think I'm of the opinion that nation state actors are innocent.

My point is if the US treats foreign gov's as dangerous then those foreign gov's should treat the US as dangerous equally, including US software.

Given US software companies international sales volumes that's a massive existential threat to the US economy.

If China/Europ/Russia etc stop using US software products then what will happen to the profits of Microsoft/Google/Apple et al....

My other point was the apparent one-way nature of trust that I felt you were implying. that foreign gov's should trust US software whilst at the same time accepting those software companies do not trust them...