Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

L0pht’s warnings about the Internet drew notice but little action

washingtonpost.com

Post reply on HN
Print view View original

51–60 of 69 posts

Re: L0pht’s warnings about the Internet drew notice but little action

#51

Post by sebcat »

tptacek wrote: post #49
sebcat wrote: post #48

Earlier quoted context omitted.

> I'm not in love with White Hat as a company, but they do collect stats across their customer base, and their annual stats have shown sharp declines in SQL injection White Hat has a set of tests they run against their customers over time. They tell their customers what problems they find. Their customers (mostly) fix the problems. I'm not sure that translates correctly to the outside world. The fact that their stats…

I don't know: their observations square with my anecdotal observations over 10 years of appsec consulting. On my first ever web pentest, I got a 'OR''=' SQLI in the username of a login form . In 2014, when I left Matasano, that would have been absolutely shocking. SQLI has become far less common: * Developers are taught to use parameterized queries * Fewer big applications are built in PHP * More projects use ORMs no…

Anecdotally, I've recently come across XSS in search fields and SQL injections in login forms.

One could argue that because of reputation and market share, Matasano gets customers who prioritizes security, making such vulnerabilities less occurring for Matasano customers.

Your points are valid.

Even if secure development practices exists, there's a lot of software in production being run by companies and government agencies with a very poor understanding of these practices. It may also be that these entities have very good security departments, but these departments are very limited in what they can improve internally because of lack in resources or policies.

There's a lot of companies out there who outsource a lot of stuff to people who don't know how to write secure code. Like White Hat (Error138): https://github.com/WhiteHatSecurity/Aviator/blob/e2d03093b94...

There's a lot of different angles to it.

Re: L0pht’s warnings about the Internet drew notice but little action

#52

Post by Qwertious »

afarrell wrote: post #45
tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

> dummies in congress Are the folks in congress actually stupid? Or do they practice a different profession than you? Namely: the structure and interpretation of laws and policies. How much do you know about, say... the field of nursing?

The problem is that they deal with making laws on a variety of subjects, which necessitates understanding said subjects. They don't understand the subjects.

Say what you like about programmers, but most of them don't actually have any job-related responsibilities in the field of nursing, breaking the analogy.

Re: L0pht’s warnings about the Internet drew notice but little action

#53

Post by mikekchar »

tptacek wrote: post #47
mikekchar wrote: post #44

Earlier quoted context omitted.

Buffer overflows were certainly recognised considerably earlier than that. I remember a colleague pointing out buffer overflows in the first STL string implementations. It's not hard to go from that to SQL injection, or any other similar technique. Certainly, my (possibly rose-coloured) memories of the time includes a lot of, "OMG. How stupid can people be? Surely they know better than that!" I guess what I'm saying…

The first modern overflow exploit was Thomas Lopatic's 1995 HPUX httpd exploit. When he wrote it up, he claimed it followed the blueprint of the "microscope and tweezers" paper Spafford wrote about the Morris worm. The Morris Worm, of course, was from 1988. In the years between 1988 and 1995 there were, so far as anyone knows, a total of zero code-exec buffer overflow exploits. I was in the room with Peiter, at a DC…

It is possible that I am misremembering. I remember him submitting a bug and being ignored as a crank, though ;-). It may have been some other kind of memory corruption.

It's hard to believe that it's only been since the late 90's that buffer overruns exploits have been around. I will have to believe you as you have considerably more knowledge on the subject than me.

I'm very much wondering now about the times I used to boot trace games to crack them and if I ever used such a technique. It seems so obvious now that I may be assuming that I must have, but it's so long ago that I really can't remember. Certainly getting the loader to move your code around rather than theirs was a normal trick.

Re: L0pht’s warnings about the Internet drew notice but little action

#54

Post by Qwertious »

a3n wrote: post #38
hoodoof wrote: post #36

long hair: hacker credibility +1 beard: hacker credibility +1 nickname/handle: hacker credibility +1 glasses: hacker credibility +1 suit: hacker credibility -1

> suit: hacker credibility -1 Social engineering.

suit: hacker credibility -1

social engineering +1

Re: L0pht’s warnings about the Internet drew notice but little action

#55

Post by kriro »

mikekchar wrote: post #44
tptacek wrote: post #28

Earlier quoted context omitted.

I understand that's what people think, but what I'm saying is that in 1998, we wouldn't have known how to rebuild everything securely. We'd have ended up with slightly better C standard libaries, S-BGP, IPSEC, and DNSSEC. Here, let me sum it up this way: I think it's possible that the L0pht testimony predates SQL injection .

Buffer overflows were certainly recognised considerably earlier than that. I remember a colleague pointing out buffer overflows in the first STL string implementations. It's not hard to go from that to SQL injection, or any other similar technique. Certainly, my (possibly rose-coloured) memories of the time includes a lot of, "OMG. How stupid can people be? Surely they know better than that!" I guess what I'm saying…

I'd say buffer overflows "went mainstream" roughly after November 1996 when Phrack 49 with "Smashing the Stack for Fun and Profit" was released. At least I'd guess that's the most influencing article on the topic.

Re: L0pht’s warnings about the Internet drew notice but little action

#56

Post by roel_v »

vezzy-fnord wrote: post #34
tptacek wrote: post #33

Earlier quoted context omitted.

Peiter was talking about BGP. In 1998, you had to be somewhat diligent to get to a vantage point from which you could inject bogus BGP, and the Venn diagram between those people and "nihilistic assholes" is not that scary. In 2015, you can still technically fuck up BGP, but probably not for very long, and not without burning a lot of assets. Why would anyone bother? The hunting and taxidermy of corrupted BGP advertis…

Further, I recall several of the L0pht members were heavily interested in TEMPEST and van Eck phreaking at the time. Really played it up in an ominous tone.

Well, that sort of scaremongering was part of the PR aspect of the whole thing. Back then (I've been out of the scene for a decade and a half now, I don't know if it's still as bad) the amount of money you could sell your 'company' (read: two guys in a basement) for, was directly correlated to the scariness of the stories you could get into the press.

Re: L0pht’s warnings about the Internet drew notice but little action

#57

Post by pjc50 »

chx wrote: post #27
tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

With all due respect to you, everything would be different. I know even then it would've been a daunting thing to do but perhaps 1998 was the last year when it could've been done: tear it down and rebuild it securely. I am sure you know this too well but let me remind a few people here who were not even born when some of this happened: The early years were mostly of trust. As an example, I remember running around eve…

"Tear it down" never happens for systems that are basically working, even if they have serious flaws.

Re: L0pht’s warnings about the Internet drew notice but little action

#58

Post by pjc50 »

Animats wrote: post #13

l0pht is a successor to Cult of the Dead Cow, which goes back to the 1980s.[1] Their "Tao of Buffer Overflow"[2] is still a good read. The two big problems in computer security used to be Microsoft and C. Amit Yoran said that publicly when he was Homeland Security's head of computer security. That made him unpopular, and he resigned in 2004. Yoran was then replaced by a Cisco lobbyist who kept his mouth shut. (Yoran…

At some point those got replaced by Flash, PDF reader, and Java. Now, as others have pointed out, the main threat is nation-state actions.

Re: L0pht’s warnings about the Internet drew notice but little action

#59

Post by dagw »

hoodoof wrote: post #36

long hair: hacker credibility +1 beard: hacker credibility +1 nickname/handle: hacker credibility +1 glasses: hacker credibility +1 suit: hacker credibility -1

suit: hacker credibility -1

And here I thought we where above judging people by how they chose to dress.

Re: L0pht’s warnings about the Internet drew notice but little action

#60

Post by na85 »

afarrell wrote: post #45
tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

> dummies in congress Are the folks in congress actually stupid? Or do they practice a different profession than you? Namely: the structure and interpretation of laws and policies. How much do you know about, say... the field of nursing?

>Are the folks in congress actually stupid?

Not all. But some of them are, for lack of a better term, really fucking stupid.

Post reply on HN