[Date Prev][Date Next][Thread Prev][Thread Next][Date Index][Thread Index]
[Full-disclosure] Re: [ISN] How To Save The Internet
- To: Keith Oxenrider <koxenrider@xxxxxxxxxxxxxxx>
- Subject: [Full-disclosure] Re: [ISN] How To Save The Internet
- From: Scott Berinato <sberinato@xxxxxxx>
- Date: Tue, 22 Mar 2005 08:58:50 -0500
<br><font size=2 face="sans-serif">Keith, </font>
<br>
<br><font size=2 face="sans-serif">I argue in a recent column that the
real problem is not that they won't pay people to secure their products
(though they won't) but that the products can't be secured. As Jason points
out, the architecture is set up to execute code; and there are other inherent
faults in design. Some kind of major upheaval will probably be needed to
fix the problem.</font>
<br>
<br><font size=2 face="sans-serif">Also, perhaps they'd hire you if you
spelled clueless the way they do.</font>
<br>
<br><font size=2 face="sans-serif">Cheers,</font>
<br><font size=2 face="sans-serif">Scott Berinato</font>
<br>
<br>
<br>
<table width=100%>
<tr valign=top>
<td width=40%><font size=1 face="sans-serif"><b>Keith Oxenrider
<koxenrider@xxxxxxxxxxxxxxx></b>
</font>
<p><font size=1 face="sans-serif">03/21/2005 10:21 PM</font>
<td width=59%>
<table width=100%>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">To</font></div>
<td valign=top><font size=1 face="sans-serif">jasonc@xxxxxxxxxxx,
jericho@xxxxxxxxxxxxx</font>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">cc</font></div>
<td valign=top><font size=1 face="sans-serif">isn@xxxxxxx, Scott
Berinato/CIO@CIO,
full-disclosure@xxxxxxxxxxxxxxxxx, bugtraq@xxxxxxxxxxxxxxxxx</font>
<tr>
<td>
<div align=right><font size=1 face="sans-serif">Subject</font></div>
<td valign=top><font size=1 face="sans-serif">Re: [ISN] How To Save The
Internet</font></table>
<br>
<table>
<tr valign=top>
<td>
<td></table>
<br></table>
<br>
<br>
<br><img src=cid:_1_047ADDE0047AD8A8004C5AD485256FCC>
<br><font size=1><tt>I didn't take the time to read every single response
to the article (though<br>
did take the time to pen my own), but I read at least half of them and<br>
didn't see a one that seemed to support the article. Several even
seemed<br>
to think they were reading a Dilbert comic. The ironic part (and
the point<br>
I tried to make in my post) is that the actual readership of CIO are, for<br>
the most part, clewless pointy hairs and probably didn't even finish<br>
reading the article (if they even started it) and certainly would never<br>
take the time to read the responses to it, let alone discuss them with<br>
their technical people. These are the decision makers who pay us
to make<br>
the things that are complained about in the article. As long as they<br>
refuse to pay us to write secure products nothing will change.<br>
</tt></font>
<br><font size=1><tt>Keith Oxenrider<br>
CISSP<br>
</tt></font>
<br><font size=1><tt>At 10:24 AM 3/22/2005 +1200, Jason Coombs wrote:<br>
>InfoSec News wrote:<br>
>>Forwarded from: security curmudgeon <jericho@xxxxxxxxxxxxx><br>
>>Cc: sberinato@xxxxxxx<br>
>>... Big load of crap ...<br>
>>: http://www.cio.com/archive/031505/security.html<br>
>>: BY SCOTT BERINATO<br>
>>: serial numbers and control their distribution. James Whittaker
says :<br>
>>programmable PCs are dangerous, so why not treat them like guns?<br>
><br>
>jericho@xxxxxxxxxxxxx wrote:<br>
>>In 2001, 2002, 2003 and 2004, how many deaths were attributed to
computers?<br>
><br>
>Programmable PCs *are* dangerous, but only to themselves and other<br>
>programmable PCs that aren't operated by skilled people who know how
to<br>
>defend against the execution of unwanted machine code.<br>
><br>
>The problem with programmable PCs is that they execute machine code<br>
>without considering whether any of the instructions are desired by
the<br>
>owner of the CPU. A no execute (NX) stack and heap [1] is a step in
the<br>
>right direction, but everyone in the computer industry who has given
this<br>
>any thought already knows that the core problem with computer security
is<br>
>that our CPUs make no effort to restrict the execution of machine code
to<br>
>that very small subset of all possible machine code which constitutes
the<br>
>code that the owner of the CPU desires it to run.<br>
><br>
>Until this security defect is solved, we will still have problems caused<br>
>by rampant technical bugs in our programmable PCs. Insecure software
would<br>
>not be a threat except in rare circumstances if there were only a way
for<br>
>our CPUs to be configured to execute *only* the insecure software that
we<br>
>desire, and block anything else that is added to our boxes by buffers,<br>
>bullies, or buffoons.<br>
><br>
>If anyone really cared about solving this core security problem with<br>
>computing today, it would be solved in just a few months. We would
then be<br>
>left with all of the wonderful array of security problems that are
caused<br>
>by human behavior (theft, misuse, physical intrusion, eavesdropping,
scam<br>
>artists, etc) and these are problems we can all live with in relative<br>
>harmony [7].<br>
><br>
>The marketplace is not demanding this solution, and it appears from
the<br>
>noise of the media and marketing and PR machines of our revered industry<br>
>leaders that nobody is even trying to build awareness of the problem
much<br>
>less devise and deliver solutions.<br>
><br>
>Programmable CPUs are not suitable for use in data communications
devices<br>
>without hardware defenses that restrict the machine code instruction<br>
>sequences that the CPU will accept. Programmable CPUs are barely
suitable<br>
>for anything without this simple security addition.<br>
><br>
>We're all so busy pushing bits around urgently we've forgotten to care.<br>
><br>
>CIO should be ashamed to be perpetuating the pointless and fraudulent<br>
>business ideas of an industry addicted to extracting profit from victims<br>
>by causing them unnecessary problems and then selling inadequate fixes.<br>
><br>
>Sincerely,<br>
><br>
>Jason Coombs<br>
>jasonc@xxxxxxxxxxx<br>
><br>
><br>
>[1] MSDN Security Developer Center: Execution Protection<br>
>http://msdn.microsoft.com/security/productinfo/XPSP2/memoryprotection/execprotection.aspx<br>
><br>
>[7] Why Was Intel a No-Show on No Execute?<br>
>http://www.eweek.com/article2/0,1759,1599193,00.asp</tt></font>
<br>
<br>
_______________________________________________
Full-Disclosure - We believe in it.
Charter: http://lists.grok.org.uk/full-disclosure-charter.html
Hosted and sponsored by Secunia - http://secunia.com/