Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

L0pht’s warnings about the Internet drew notice but little action

washingtonpost.com

Post reply on HN
Print view View original

41–50 of 69 posts

Re: L0pht’s warnings about the Internet drew notice but little action

#41

Post by chx »

tptacek wrote: post #28
chx wrote: post #27

Earlier quoted context omitted.

With all due respect to you, everything would be different. I know even then it would've been a daunting thing to do but perhaps 1998 was the last year when it could've been done: tear it down and rebuild it securely. I am sure you know this too well but let me remind a few people here who were not even born when some of this happened: The early years were mostly of trust. As an example, I remember running around eve…

I understand that's what people think, but what I'm saying is that in 1998, we wouldn't have known how to rebuild everything securely. We'd have ended up with slightly better C standard libaries, S-BGP, IPSEC, and DNSSEC. Here, let me sum it up this way: I think it's possible that the L0pht testimony predates SQL injection .

Hrm you are right it certainly predates XSS http://www.thesecuritypractice.com/the_security_practice/201...

Re: L0pht’s warnings about the Internet drew notice but little action

#42

Post by anon3_ »

tptacek wrote: post #28
chx wrote: post #27

Earlier quoted context omitted.

With all due respect to you, everything would be different. I know even then it would've been a daunting thing to do but perhaps 1998 was the last year when it could've been done: tear it down and rebuild it securely. I am sure you know this too well but let me remind a few people here who were not even born when some of this happened: The early years were mostly of trust. As an example, I remember running around eve…

I understand that's what people think, but what I'm saying is that in 1998, we wouldn't have known how to rebuild everything securely. We'd have ended up with slightly better C standard libaries, S-BGP, IPSEC, and DNSSEC. Here, let me sum it up this way: I think it's possible that the L0pht testimony predates SQL injection .

> better C standard libaries

What's the story with C standard libraries and security? How could they be better, as you see it?

Re: L0pht’s warnings about the Internet drew notice but little action

#43

Post by WalterGR »

robg wrote: post #11
acqq wrote: post #4

The title picture is wonderful.

And the name plates.

Yeah, that's an amazing image. I thought it must be doctored... but in the intro to the recording of their testimony, the person speaking ("chairman"?) says:

"Due to the sensitivity of the work done at the L0pht they'll be using their hacker names of Mudge, Weld, Brian Oblivion, Kingpin, Space Rogue, Tan, and Stefan."

https://www.youtube.com/watch?v=VVJldn_MmMY

Re: L0pht’s warnings about the Internet drew notice but little action

#44

Post by mikekchar »

tptacek wrote: post #28
chx wrote: post #27

Earlier quoted context omitted.

With all due respect to you, everything would be different. I know even then it would've been a daunting thing to do but perhaps 1998 was the last year when it could've been done: tear it down and rebuild it securely. I am sure you know this too well but let me remind a few people here who were not even born when some of this happened: The early years were mostly of trust. As an example, I remember running around eve…

I understand that's what people think, but what I'm saying is that in 1998, we wouldn't have known how to rebuild everything securely. We'd have ended up with slightly better C standard libaries, S-BGP, IPSEC, and DNSSEC. Here, let me sum it up this way: I think it's possible that the L0pht testimony predates SQL injection .

Buffer overflows were certainly recognised considerably earlier than that. I remember a colleague pointing out buffer overflows in the first STL string implementations. It's not hard to go from that to SQL injection, or any other similar technique.

Certainly, my (possibly rose-coloured) memories of the time includes a lot of, "OMG. How stupid can people be? Surely they know better than that!"

I guess what I'm saying is that some people definitely knew what to do about this and were trying to do it. Most people were ignoring it and saying things like, "Oh, you're just being paranoid. Why would anyone try to do something like that?" It's a bit pointless to say, "What would have happened if people had listened" because the point was that people didn't listen. That was the whole problem.

Re: L0pht’s warnings about the Internet drew notice but little action

#45

Post by afarrell »

tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

> dummies in congress

Are the folks in congress actually stupid? Or do they practice a different profession than you? Namely: the structure and interpretation of laws and policies.

How much do you know about, say... the field of nursing?

Re: L0pht’s warnings about the Internet drew notice but little action

#46

Post by Demiurge »

afarrell wrote: post #45
tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

> dummies in congress Are the folks in congress actually stupid? Or do they practice a different profession than you? Namely: the structure and interpretation of laws and policies. How much do you know about, say... the field of nursing?

Some of them actually, honestly, don't believe in climate change, or nursing.

Re: L0pht’s warnings about the Internet drew notice but little action

#47

Post by tptacek »

mikekchar wrote: post #44
tptacek wrote: post #28

Earlier quoted context omitted.

I understand that's what people think, but what I'm saying is that in 1998, we wouldn't have known how to rebuild everything securely. We'd have ended up with slightly better C standard libaries, S-BGP, IPSEC, and DNSSEC. Here, let me sum it up this way: I think it's possible that the L0pht testimony predates SQL injection .

Buffer overflows were certainly recognised considerably earlier than that. I remember a colleague pointing out buffer overflows in the first STL string implementations. It's not hard to go from that to SQL injection, or any other similar technique. Certainly, my (possibly rose-coloured) memories of the time includes a lot of, "OMG. How stupid can people be? Surely they know better than that!" I guess what I'm saying…

The first modern overflow exploit was Thomas Lopatic's 1995 HPUX httpd exploit. When he wrote it up, he claimed it followed the blueprint of the "microscope and tweezers" paper Spafford wrote about the Morris worm. The Morris Worm, of course, was from 1988. In the years between 1988 and 1995 there were, so far as anyone knows, a total of zero code-exec buffer overflow exploits.

I was in the room with Peiter, at a DC Summercon, as he tried to work out the exploit for Sendmail 8.6.12 that 8lgm had teased. He definitely didn't have it before 8lgm, and 8lgm didn't have it before Lopatic. Even the virus guys didn't have it.

It's weird to think that nobody put two and two together in, say, 1991 --- there certainly was motivation (that's the timing of the Sun-Devil Raids!) and so much vulnerable software.

But then, in the late 1990s, people honestly thought they could mitigate overflows by moving buffers from the stack to the heap. Reliable heap exploits were a big deal as late as 2003, when Matt Conover spoke to a packed CanSec room about the Windows Heap, in excruciating detail for over an hour. That's close to a decade between Lopatic and mainstream heap exploitation on modern heaps.

>shrug<

Re: L0pht’s warnings about the Internet drew notice but little action

#48

Post by sebcat »

tptacek wrote: post #30
dmix wrote: post #29

Earlier quoted context omitted.

Indeed, I'd love to see an expanded chart (as well as a more recent one). This one is focused on two categories, memory vs web vulns.

I'm not in love with White Hat as a company, but they do collect stats across their customer base, and their annual stats have shown sharp declines in SQL injection. DOM corruption is a somewhat complex class of vulnerabilities (see lcamtuf's "Notes From A Post-XSS World" for an example of why), and it's not surprising to see we're making less progress.

> I'm not in love with White Hat as a company, but they do collect stats across their customer base, and their annual stats have shown sharp declines in SQL injection

White Hat has a set of tests they run against their customers over time. They tell their customers what problems they find. Their customers (mostly) fix the problems.

I'm not sure that translates correctly to the outside world. The fact that their stats show a decline in the presence of SQL injection vulnerabilities could only be showing us that they have more old customers that have gone through a couple of reports and patch cycles than they have new customers who might not yet have fixed what they're told to fix.

Re: L0pht’s warnings about the Internet drew notice but little action

#49

Post by tptacek »

sebcat wrote: post #48
tptacek wrote: post #30

Earlier quoted context omitted.

I'm not in love with White Hat as a company, but they do collect stats across their customer base, and their annual stats have shown sharp declines in SQL injection. DOM corruption is a somewhat complex class of vulnerabilities (see lcamtuf's "Notes From A Post-XSS World" for an example of why), and it's not surprising to see we're making less progress.

> I'm not in love with White Hat as a company, but they do collect stats across their customer base, and their annual stats have shown sharp declines in SQL injection White Hat has a set of tests they run against their customers over time. They tell their customers what problems they find. Their customers (mostly) fix the problems. I'm not sure that translates correctly to the outside world. The fact that their stats…

I don't know: their observations square with my anecdotal observations over 10 years of appsec consulting. On my first ever web pentest, I got a 'OR''=' SQLI in the username of a login form. In 2014, when I left Matasano, that would have been absolutely shocking. SQLI has become far less common:

* Developers are taught to use parameterized queries

* Fewer big applications are built in PHP

* More projects use ORMs now than don't

* Random testers hoping for bug bounties hammer every application with SQLI scanners

Re: L0pht’s warnings about the Internet drew notice but little action

#50

Post by CamperBob2 »

afarrell wrote: post #45
tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

> dummies in congress Are the folks in congress actually stupid? Or do they practice a different profession than you? Namely: the structure and interpretation of laws and policies. How much do you know about, say... the field of nursing?

It's more or less beyond question that some of them are either genuinely stupid, or genuinely evil. Which do you prefer? I'm not sure, myself.
Post reply on HN