Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cryptic Rumblings Ahead of First 2020 Patch Tuesday

krebsonsecurity.com

Post reply on HN
Print view View original

11–20 of 96 posts

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#11

Post by vsareto »

cjbprime wrote: post #9
AaronFriel wrote: post #2

Scary, but not an RCE so threat is limited. It would mean malicious actors could possible create spoofed signatures on malware or possibly websites (EV certificates?). Am I missing something or is there a way to turn a spoofed certificate into a single-click pwn? As I understand it, users would have to download a malicious payload or click a malicious URL to be exposed. Edit: People are asking why I assume it's not a…

Wait, how do you know it's not an RCE? Memory safety flaws in a DLL become RCE all the time. > is there a way to turn a spoofed certificate into a single-click pwn? e.g. The victim clicks on a link to go to your website, their machine wants to validate the TLS cert you sent it, it calls into crypt32.dll to do that, it corrupts memory while handling your attacking cert, pwn? We don't know enough (anything!) about the…

I'm going to be disappointed if all of this hype is for non-code execution

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#12

Post by zrth »

JackRabbitSlim wrote: post #5

The NSA prepping PR damage control already? "Finally removed all totally inactive and harmless old _NSAKEY references." I wouldn't bet against something along those lines.

What is the nsa’s role in this and what kind of key reference do you mean?

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#13

Post by di »

zrth wrote: post #12
JackRabbitSlim wrote: post #5

The NSA prepping PR damage control already? "Finally removed all totally inactive and harmless old _NSAKEY references." I wouldn't bet against something along those lines.

What is the nsa’s role in this and what kind of key reference do you mean?

https://en.wikipedia.org/wiki/NSAKEY

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#14

Post by zrth »

CiPHPerCoder wrote: post #4

Prediction: whatever this is will end up in pen-test reports for many years to come. Even if it's not a worthy successor to MS08-067.

Not only obvious to me how 067’ and this is connected. Yet to save you a few sec: https://en.m.wikipedia.org/wiki/Conficker

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#15

Post by computator »

It's a shame that mathematically proving correctness of code, even for extremely important code, is never done.

I wonder how many lines of code in crypt32.dll. Is it on the order of 7500 lines? If Microsoft spent a few man-years mathematically proving the correctness of that code, they could have the saved the world about 10,000 man-years.

Windows has a user base of 1 billion[1]. A ballpark figure for proving the correctness of 7500 lines of very complex code[2] is about 30 man years[3]. If even 1% of the 1 billion Windows users and sysadmins has to spend a couple hours on things related to this patch, it works out to 9615 man-years of worldwide waste (based on an 8 hour workday and 260 workdays a year).

Had there been a wide-spread exploit, it could have cost the world millions of man-years.

[1] https://en.wikipedia.org/wiki/Usage_share_of_operating_syste...

[2] https://www.schneier.com/blog/archives/2009/10/proving_a_com...

[3] Professor Gernot Heiser, the John Lions Chair in Computer Science in the School of Computer Science and Engineering and a senior principal researcher with NICTA, said for the first time a team had been able to prove with mathematical rigour that an operating-system kernel—the code at the heart of any computer or microprocessor—was 100 per cent bug-free and therefore immune to crashes and failures. Verifying the kernel—known as the seL4 microkernel—involved mathematically proving the correctness of about 7,500 lines of computer code in a project taking an average of six people more than five years.

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#17

Post by saagarjha »

computator wrote: post #15

It's a shame that mathematically proving correctness of code, even for extremely important code , is never done. I wonder how many lines of code in crypt32.dll. Is it on the order of 7500 lines? If Microsoft spent a few man-years mathematically proving the correctness of that code, they could have the saved the world about 10,000 man-years. Windows has a user base of 1 billion[1]. A ballpark figure for proving the co…

Usually you don't really verify the correctness of existing code; you rewrite it in a language that makes it possible to make guarantees that you care about. In addition, Microsoft needs to allocate their time: which components should be verified? Not all of them can be verified practically yet.

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#18

Post by chabad360 »

saagarjha wrote: post #17
computator wrote: post #15

It's a shame that mathematically proving correctness of code, even for extremely important code , is never done. I wonder how many lines of code in crypt32.dll. Is it on the order of 7500 lines? If Microsoft spent a few man-years mathematically proving the correctness of that code, they could have the saved the world about 10,000 man-years. Windows has a user base of 1 billion[1]. A ballpark figure for proving the co…

Usually you don't really verify the correctness of existing code; you rewrite it in a language that makes it possible to make guarantees that you care about. In addition, Microsoft needs to allocate their time: which components should be verified? Not all of them can be verified practically yet.

Keep in mind that we are discussing code meant to run cryptography operations, I'm pretty sure that kind of stuff should be high up on the priority list.

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#19

Post by erk__ »

saagarjha wrote: post #17
computator wrote: post #15

It's a shame that mathematically proving correctness of code, even for extremely important code , is never done. I wonder how many lines of code in crypt32.dll. Is it on the order of 7500 lines? If Microsoft spent a few man-years mathematically proving the correctness of that code, they could have the saved the world about 10,000 man-years. Windows has a user base of 1 billion[1]. A ballpark figure for proving the co…

Usually you don't really verify the correctness of existing code; you rewrite it in a language that makes it possible to make guarantees that you care about. In addition, Microsoft needs to allocate their time: which components should be verified? Not all of them can be verified practically yet.

Microsoft is already using quite a bit of money doing this for example they have made the language F* which have been used to write a verifiable implementation of https.

https://www.fstar-lang.org/ https://project-everest.github.io/

Re: Cryptic Rumblings Ahead of First 2020 Patch Tuesday

#20

Post by saagarjha »

erk__ wrote: post #19
saagarjha wrote: post #17

Earlier quoted context omitted.

Usually you don't really verify the correctness of existing code; you rewrite it in a language that makes it possible to make guarantees that you care about. In addition, Microsoft needs to allocate their time: which components should be verified? Not all of them can be verified practically yet.

Microsoft is already using quite a bit of money doing this for example they have made the language F* which have been used to write a verifiable implementation of https. https://www.fstar-lang.org/ https://project-everest.github.io/

I'm not saying that Microsoft isn't doing good work in this area; it's just that it's impractical to pick an old component that's recently found to have vulnerabilities in it and try to blame Microsoft for not having the foresight to write it in a formally verified way.
Post reply on HN