Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

L0pht’s warnings about the Internet drew notice but little action

washingtonpost.com

Post reply on HN
Print view View original

21–30 of 69 posts

Re: L0pht’s warnings about the Internet drew notice but little action

#21

Post by pnash »

WalterGR wrote: post #16
kbenson wrote: post #7

> Even today, many serious online intrusions exploit flaws in software first built in that era, such as Adobe Flash, Oracle’s Java and Microsoft’s Internet Explorer. Isn't that like saying "Many accidents happen to models of cars first built during that era?" Just because they debuted then doesn't mean they are substantially, or even remotely the same thing. How many complete rewrites of Internet Explorer have we had…

How many complete rewrites of Internet Explorer have we had since then? None? There's an ongoing one that was announced in January with a preview released in March. https://en.wikipedia.org/wiki/Microsoft_Edge

Spartan?

https://twitter.com/dildog/status/612795030345007104

"It feels like 1996 again."

Re: L0pht’s warnings about the Internet drew notice but little action

#23

Post by tptacek »

Animats wrote: post #13

l0pht is a successor to Cult of the Dead Cow, which goes back to the 1980s.[1] Their "Tao of Buffer Overflow"[2] is still a good read. The two big problems in computer security used to be Microsoft and C. Amit Yoran said that publicly when he was Homeland Security's head of computer security. That made him unpopular, and he resigned in 2004. Yoran was then replaced by a Cisco lobbyist who kept his mouth shut. (Yoran…

Yoran wasn't making a philosophical point about Microsoft. He was responding to the news cycle: we had just suffered the "Summer of Worms", which, because of Microsoft's position in the market, involved almost exclusively Microsoft systems.

Microsoft, to their credit, responded admirably to the events: they invested a spectacular amount of money shoring up the nuts-and-bolts quality of their software, training their entire development team (one of the largest in the world) on secure coding standards, hiring researchers to revise their libraries and deprecate unsafe interfaces, and adopting hardened C/C++ runtimes.

Re: L0pht’s warnings about the Internet drew notice but little action

#24

Post by kw71 »

Animats wrote: post #13

l0pht is a successor to Cult of the Dead Cow, which goes back to the 1980s.[1] Their "Tao of Buffer Overflow"[2] is still a good read. The two big problems in computer security used to be Microsoft and C. Amit Yoran said that publicly when he was Homeland Security's head of computer security. That made him unpopular, and he resigned in 2004. Yoran was then replaced by a Cisco lobbyist who kept his mouth shut. (Yoran…

Successor? I don't think so. I think some individuals were part of both groups. L0pht and cDc were part of the same BBS scene. Like QSD's x.25 address, the phone number for Demon Roach Underground is a number I'll never forget.

Re: L0pht’s warnings about the Internet drew notice but little action

#25

Post by dmix »

tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

> the near eradication of SQL injection from popular applications

There is a great chart from an analysis on the history of software bugs showing the rise and decline of SQLi/XSS bugs from between 2005-2010:

https://imgur.com/cY2cJ8W

Memory bugs remain relatively consistent (despite PaX and others effort to change that).

Source: https://www.isg.rhul.ac.uk/sullivan/pubs/tr/technicalreport-...

Re: L0pht’s warnings about the Internet drew notice but little action

#26

Post by tptacek »

dmix wrote: post #25
tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

> the near eradication of SQL injection from popular applications There is a great chart from an analysis on the history of software bugs showing the rise and decline of SQLi/XSS bugs from between 2005-2010: https://imgur.com/cY2cJ8W Memory bugs remain relatively consistent (despite PaX and others effort to change that). Source: https://www.isg.rhul.ac.uk/sullivan/pubs/tr/technicalreport-...

It's painful that they combined XSS and SQLI, because progress on SQLI has been much better than progress on DOM corruption bugs.

Re: L0pht’s warnings about the Internet drew notice but little action

#27

Post by chx »

tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

With all due respect to you, everything would be different. I know even then it would've been a daunting thing to do but perhaps 1998 was the last year when it could've been done: tear it down and rebuild it securely.

I am sure you know this too well but let me remind a few people here who were not even born when some of this happened: The early years were mostly of trust. As an example, I remember running around even in 1994 with a 10BASE2 network tester to find where the network broke. 10BASE2 was a perfect example of a more trustworthy age: many machines shared a single cable and eavesdropping required zero effort. Every machine got all the frames and there was no encryption. Then came Fast Ethernet and with it 100BASE-TX and slowly switches replaced active hubs and this went away. But it often required rewiring buildings which took a long time. I do not have hard data and it's hard to define the start and end points but I would say it took at least five years if not a whole decade to really sunset 10BASE2.

Now of course doing the same on a world level would've been a daunting task. However the number of websites at this point were growing somewhat sedentary at least compared to years prior and later, see the data http://www.internetlivestats.com/total-number-of-websites/ here, compared to the meteoric growth in 1997 (334%) and 2000 (438%) the years 1998 (116%) and 1999 (32%) were slow and peaceful.

Re: L0pht’s warnings about the Internet drew notice but little action

#28

Post by tptacek »

chx wrote: post #27
tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

With all due respect to you, everything would be different. I know even then it would've been a daunting thing to do but perhaps 1998 was the last year when it could've been done: tear it down and rebuild it securely. I am sure you know this too well but let me remind a few people here who were not even born when some of this happened: The early years were mostly of trust. As an example, I remember running around eve…

I understand that's what people think, but what I'm saying is that in 1998, we wouldn't have known how to rebuild everything securely. We'd have ended up with slightly better C standard libaries, S-BGP, IPSEC, and DNSSEC.

Here, let me sum it up this way: I think it's possible that the L0pht testimony predates SQL injection.

Re: L0pht’s warnings about the Internet drew notice but little action

#29

Post by dmix »

tptacek wrote: post #26
dmix wrote: post #25

Earlier quoted context omitted.

> the near eradication of SQL injection from popular applications There is a great chart from an analysis on the history of software bugs showing the rise and decline of SQLi/XSS bugs from between 2005-2010: https://imgur.com/cY2cJ8W Memory bugs remain relatively consistent (despite PaX and others effort to change that). Source: https://www.isg.rhul.ac.uk/sullivan/pubs/tr/technicalreport-...

It's painful that they combined XSS and SQLI, because progress on SQLI has been much better than progress on DOM corruption bugs.

Indeed, I'd love to see an expanded chart (as well as a more recent one). This one is focused on two categories, memory vs web vulns.

Re: L0pht’s warnings about the Internet drew notice but little action

#30

Post by tptacek »

dmix wrote: post #29
tptacek wrote: post #26

Earlier quoted context omitted.

It's painful that they combined XSS and SQLI, because progress on SQLI has been much better than progress on DOM corruption bugs.

Indeed, I'd love to see an expanded chart (as well as a more recent one). This one is focused on two categories, memory vs web vulns.

I'm not in love with White Hat as a company, but they do collect stats across their customer base, and their annual stats have shown sharp declines in SQL injection.

DOM corruption is a somewhat complex class of vulnerabilities (see lcamtuf's "Notes From A Post-XSS World" for an example of why), and it's not surprising to see we're making less progress.

Post reply on HN