Risk
1/21/2010
12:31 PM
Alexander Wolfe
Alexander Wolfe
Commentary
Connect Directly
Twitter
Facebook
RSS
E-Mail
50%
50%

Sloppy Software Dev Exposes Google Hacker Holes

I've ranted on the subject before, but it's worth sounding off again in light of the recent China hacker breaches of Gmail: Poor software development procedures are the big reason major firms are apparently running around scared witless that their products are vulnerable to cyberattacks. (The corollary, about which we haven't read anything, is that firms with buttoned-down dev rules are likely feeling, if not entirely safe, then at least free of the panic which plagues the cluelessly unprepared.

I've ranted on the subject before, but it's worth sounding off again in light of the recent China hacker breaches of Gmail: Poor software development procedures are the big reason major firms are apparently running around scared witless that their products are vulnerable to cyberattacks. (The corollary, about which we haven't read anything, is that firms with buttoned-down dev rules are likely feeling, if not entirely safe, then at least free of the panic which plagues the cluelessly unprepared.)The scary thing is, it's my belief that there aren't many PC-generation vendors (you know what I mean here; I'm not going to name names) who adhere to enforced best practices. Let's stipulate that this is not totally their fault; software developers who came of age without ever having to wield a soldering iron can't be expected to have a deep understand of the hardware upon which their poorly commented, non-error-trapping spaghetti code is running.

I do suspect that networking companies have an inherent advantage insofar as hacker exposure goes. That's because the higher complexity level of their software output -- as compared with, say, desktop PC apps -- means that they're more likely to enforce internal practices such as (real, as opposed to theatrical) code reviews and deep QA testing. This may not be driven by security concerns; at the top level, it's because without a proper process, the stuff just won't work. But the upshot is the same, and they're in a better place as a result.

Personally, I hadn't been planning on writing anything in the wake of the Google China attack. However, I was set off by Wednesday's New York Times article, Fearing Hackers Who Leave No Trace, by John Markoff and Ashlee Vance.

It's a worthy piece of work, taking note of the U.S. government-enforced back door, which vendors like Cisco must put into their products so the National Security Agency can do what it does. (Though of course the NSA would be able to do that even without the back door.)

However, as one would expect from a broad-audience article, it doesn't pick inside-baseball nits, such as my software dev complaint above.

User-Side Protection

The one other angle I'd like to mention involves not the vulnerabilities of the creators of source code, but rather of the users. The deal here is, if any company really wants to be secure, what they would have to do is ensure that they're not using any apps which might be vulnerable.

Sounds like a small deal, but it's not. In practice, this means that if Adobe Acrobat is perceived as being vulnerable to attack--something mentioned in the Times article--then what your organization would need to do to be secure is to not use (or to sandbox) Acrobat. [I can't believe I'm half-channeling Richard Stallman here, though not with the intention of making the same point.]

That's not really practical in the workaday world, but it is in organizations which have the resources to develop their own alternatives. What I'm getting at here is, I wonder if any of the "black ops" orgs are down with this? They're the people who are providing our attack-side resources in the below-the-radar cyberwar with China and Russia.

I don't know what the answer is, but it's certainly an interesting question.

Follow me on Twitter: (@awolfe58)

What's your take? Let me know, by leaving a comment below or e-mailing me directly at alex@alexwolfe.net. Like this blog? Subscribe to its RSS feed: (here)

 My videos on ( YouTube)

 Facebook 

  LinkedIn

Alex Wolfe is editor-in-chief of InformationWeek.com.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
5/22/2014 | 6:09:24 AM
Right on the Money
I absolutely agree.  The recent Heartbleed article on Dark Reading got me ranting similarly about the need for security requirements in software projects and more care by the community in observing them: http://www.darkreading.com/messages.asp?piddl_msgthreadid=11947&piddl_msgid=219318#msg_219318
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2001-1594
Published: 2015-08-04
GE Healthcare eNTEGRA P&R has a password of (1) entegra for the entegra user, (2) passme for the super user of the Polestar/Polestar-i Starlink 4 upgrade, (3) 0 for the entegra user of the Codonics printer FTP service, (4) eNTEGRA for the eNTEGRA P&R user account, (5) insite for the WinVNC Login, an...

CVE-2002-2445
Published: 2015-08-04
GE Healthcare Millennium MG, NC, and MyoSIGHT has a default password of (1) root.genie for the root user, (2) "service." for the service user, (3) admin.genie for the admin user, (4) reboot for the reboot user, and (5) shutdown for the shutdwon user, which has unspecified impact and attack vectors.

CVE-2002-2446
Published: 2015-08-04
GE Healthcare Millennium MG, NC, and MyoSIGHT has a password of insite.genieacq for the insite account that cannot be changed without disabling product functionality for remote InSite support, which has unspecified impact and attack vectors.

CVE-2003-1603
Published: 2015-08-04
GE Healthcare Discovery VH has a default password of (1) interfile for the ftpclient user of the Interfile server or (2) "2" for the LOCAL user of the FTP server for the Codonics printer, which has unspecified impact and attack vectors.

CVE-2004-2777
Published: 2015-08-04
GE Healthcare Centricity Image Vault 3.x has a password of (1) gemnet for the administrator account, (2) webadmin for the webadmin administrator account of the ASACA DVD library, (3) an empty value for the gemsservice account of the Ultrasound Database, and possibly (4) gemnet2002 for the gemnet2002...

Dark Reading Radio
Archived Dark Reading Radio
What’s the future of the venerable firewall? We’ve invited two security industry leaders to make their case: Join us and bring your questions and opinions!