Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

L0pht’s warnings about the Internet drew notice but little action

washingtonpost.com

Post reply on HN
Print view View original

61–69 of 69 posts

Re: L0pht’s warnings about the Internet drew notice but little action

#61

Post by na85 »

tptacek wrote: post #33
jessaustin wrote: post #2

The Internet itself, he added, could be taken down "by any of the seven individuals seated before you" with 30 minutes of well-choreographed keystrokes. If this wasn't exaggeration, we should study the fortunate circumstances by which this calamity has been avoided for 17 years.

Peiter was talking about BGP. In 1998, you had to be somewhat diligent to get to a vantage point from which you could inject bogus BGP, and the Venn diagram between those people and "nihilistic assholes" is not that scary. In 2015, you can still technically fuck up BGP, but probably not for very long, and not without burning a lot of assets. Why would anyone bother? The hunting and taxidermy of corrupted BGP advertis…

What would you have to do to fuck up BGP in 2015? Is it more or less the Autonomous-System version of ARP cache poisoning?

Re: L0pht’s warnings about the Internet drew notice but little action

#62

Post by blub »

anon3_ wrote: post #40
tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

> Most new software is no longer shipped in C/C++. What language are the applications in? What makes them more secure than C/C++?

Prety much anything is more secure than C, because the language doesn't offer any support for the programmer. No matter how careful one is, a simple mistake could lead to a (potentially exploitable) crash.

Modern C++ can be written in a secure way, however, this requires more discipline and knowledge when compared to languages such as Java or C#, which are very forgiving with programmer errors.

As for what software is written in, that depends. For Linux, I guess that's C and C++. For Mac it's mostly Objective-C, C and C++. For Windows probably a mix of C#, C and C++. On iOS it Objective-C and C or C++, but new apps will maybe move to Swift. On Android it's mostly Java, with some C and C++. Web apps don't use C or C++, however, they're not as hot as they used to be, mobile is the cool thing now.

As one can see, there's actually a lot of C and C++ in production or still being written.

Re: L0pht’s warnings about the Internet drew notice but little action

#63

Post by wglb »

chx wrote: post #27
tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

With all due respect to you, everything would be different. I know even then it would've been a daunting thing to do but perhaps 1998 was the last year when it could've been done: tear it down and rebuild it securely. I am sure you know this too well but let me remind a few people here who were not even born when some of this happened: The early years were mostly of trust. As an example, I remember running around eve…

You see, this is a much older discussion than most folks think. Back in the 70s, there was a lot of talk then about how badly software was built. "If buildings were built the way software is built, the first strong wind would destroy civilization". Remedies were proposed, dogmas (er, sorry, methodologies) developed, proselytized, replaced. Languages came and went. Howling winds came (see the "voodoo gods" in Count Zero) when we connected this all to the internet. Y2K came and showed some of the underbelly.

So, tear it down and rebuild it securely is actually many years to late 1998.

There are a few that know how to build software that isn't swiss cheese. Just picking two that I know of, nobody reads the whole volume set (as noted in Coders at Work), and for the other one, nobody wants to use it because it isn't under active development. The idea, even today, that a chunk of important internet software can actually be finished seems to be met with cognitive dissonance.

And there are organizations that know how to build very good software. But in todays fast moving businesses, who wants to be in a CMM 5 organization? Doesn't sound like much fun to me, and probably not to you either.

My estimate of the last year that all of this could have been fixed was at least 30 years earlier than your estimate. Or sooner. I worked in an organization whose core software, running today, was first written about 50 years ago.

Re: L0pht’s warnings about the Internet drew notice but little action

#64

Post by basch »

tptacek wrote: post #20

The more I think about this story, the dumber it seems to me. The narrative seems to be, L0pht testifies, world ignores them, chaos ensues. But Mudge's testimony coincides almost perfectly with a software security renaissance. The reality is more like: L0pht testifies, world ignores them, gigantic sea-change in security leads to 9-figure investment in securing Windows, the near eradication of SQL injection from popul…

I think if the world had listened the software engineering business process would be different. Security would be a primary concern. Instead of management focusing on cost and time to delivery, ignoring technical concerns and treating IT like things like a black box cost center. Security is often a reactive concern, Target/Home Depo take it seriously AFTER they have lost their customers data once. If the world had listened, boards of companies wouldnt brush off concerns, or wouldnt be in these situations. If the world had listened people would be willing to spend more on the up front cost of development to do things right the first time. If the world had listened, upgrading decaying infrastructures would be preemptive.

The people this message should have been directed at were non-technical executives and managers.

Re: L0pht’s warnings about the Internet drew notice but little action

#65

Post by sarciszewski »

tptacek wrote: post #49
sebcat wrote: post #48

Earlier quoted context omitted.

> I'm not in love with White Hat as a company, but they do collect stats across their customer base, and their annual stats have shown sharp declines in SQL injection White Hat has a set of tests they run against their customers over time. They tell their customers what problems they find. Their customers (mostly) fix the problems. I'm not sure that translates correctly to the outside world. The fact that their stats…

I don't know: their observations square with my anecdotal observations over 10 years of appsec consulting. On my first ever web pentest, I got a 'OR''=' SQLI in the username of a login form . In 2014, when I left Matasano, that would have been absolutely shocking. SQLI has become far less common: * Developers are taught to use parameterized queries * Fewer big applications are built in PHP * More projects use ORMs no…

As someone who's actively engaged in webappsec stuff, I concur with Thomas's observations.

XSS is far more prevalent, and I'm more likely to find PHP Object Injection via unserialize() protected by weak md5/sha1 auth (or outright naked) than I am to find SQLi in modern PHP apps.

Re: L0pht’s warnings about the Internet drew notice but little action

#66

Post by tptacek »

roel_v wrote: post #56
vezzy-fnord wrote: post #34

Earlier quoted context omitted.

Further, I recall several of the L0pht members were heavily interested in TEMPEST and van Eck phreaking at the time. Really played it up in an ominous tone.

Well, that sort of scaremongering was part of the PR aspect of the whole thing. Back then (I've been out of the scene for a decade and a half now, I don't know if it's still as bad) the amount of money you could sell your 'company' (read: two guys in a basement) for, was directly correlated to the scariness of the stories you could get into the press.

I think this happened right before @stake "acquired" L0pht, but I'm not sure how lucrative that really was for them.

Re: L0pht’s warnings about the Internet drew notice but little action

#67

Post by tptacek »

na85 wrote: post #61
tptacek wrote: post #33

Earlier quoted context omitted.

Peiter was talking about BGP. In 1998, you had to be somewhat diligent to get to a vantage point from which you could inject bogus BGP, and the Venn diagram between those people and "nihilistic assholes" is not that scary. In 2015, you can still technically fuck up BGP, but probably not for very long, and not without burning a lot of assets. Why would anyone bother? The hunting and taxidermy of corrupted BGP advertis…

What would you have to do to fuck up BGP in 2015? Is it more or less the Autonomous-System version of ARP cache poisoning?

That's a reasonable way to look at it, I think. Except imagine an ARP where there were thousands of very highly paid network engineers constantly monitoring the tables.

Re: L0pht’s warnings about the Internet drew notice but little action

#68

Post by afarrell »

Qwertious wrote: post #52
afarrell wrote: post #45

Earlier quoted context omitted.

> dummies in congress Are the folks in congress actually stupid? Or do they practice a different profession than you? Namely: the structure and interpretation of laws and policies. How much do you know about, say... the field of nursing?

The problem is that they deal with making laws on a variety of subjects, which necessitates understanding said subjects. They don't understand the subjects. Say what you like about programmers, but most of them don't actually have any job-related responsibilities in the field of nursing, breaking the analogy.

It isn't meant to be an analogy but a contrast.

They are indeed required to understand the subjects, but they have no realistic way to. There are simply too many subjects. If we want to sit around saying "legislators are dumb and don't understand us", fine. It won't solve anything, but it will make us feel really nice about how smart and special we are. I like feeling smart and special too.

But if we actually want to fix anything, we have to think about the system wholistically and understand what motivations and pressures a legislator is under. There are simple too many subjects for a legislator to understand all of them well. Committees help somewhat, but are flawed. Lobbyists are the current way that legislators gain information about industries but that comes at the cost of drastically warping priorities. If anyone wants to comment with some actual insight and detail into those problems, that would be nice.

Re: L0pht’s warnings about the Internet drew notice but little action

#69

Post by chx »

pjc50 wrote: post #57
chx wrote: post #27

Earlier quoted context omitted.

With all due respect to you, everything would be different. I know even then it would've been a daunting thing to do but perhaps 1998 was the last year when it could've been done: tear it down and rebuild it securely. I am sure you know this too well but let me remind a few people here who were not even born when some of this happened: The early years were mostly of trust. As an example, I remember running around eve…

"Tear it down" never happens for systems that are basically working, even if they have serious flaws.

It definitely happened to 10base2!
Post reply on HN