Risk
1/21/2010
12:31 PM
Alexander Wolfe
Alexander Wolfe
Commentary
Connect Directly
Facebook
Twitter
RSS
E-Mail
50%
50%

Sloppy Software Dev Exposes Google Hacker Holes

I've ranted on the subject before, but it's worth sounding off again in light of the recent China hacker breaches of Gmail: Poor software development procedures are the big reason major firms are apparently running around scared witless that their products are vulnerable to cyberattacks. (The corollary, about which we haven't read anything, is that firms with buttoned-down dev rules are likely feeling, if not entirely safe, then at least free of the panic which plagues the cluelessly unprepared.

I've ranted on the subject before, but it's worth sounding off again in light of the recent China hacker breaches of Gmail: Poor software development procedures are the big reason major firms are apparently running around scared witless that their products are vulnerable to cyberattacks. (The corollary, about which we haven't read anything, is that firms with buttoned-down dev rules are likely feeling, if not entirely safe, then at least free of the panic which plagues the cluelessly unprepared.)The scary thing is, it's my belief that there aren't many PC-generation vendors (you know what I mean here; I'm not going to name names) who adhere to enforced best practices. Let's stipulate that this is not totally their fault; software developers who came of age without ever having to wield a soldering iron can't be expected to have a deep understand of the hardware upon which their poorly commented, non-error-trapping spaghetti code is running.

I do suspect that networking companies have an inherent advantage insofar as hacker exposure goes. That's because the higher complexity level of their software output -- as compared with, say, desktop PC apps -- means that they're more likely to enforce internal practices such as (real, as opposed to theatrical) code reviews and deep QA testing. This may not be driven by security concerns; at the top level, it's because without a proper process, the stuff just won't work. But the upshot is the same, and they're in a better place as a result.

Personally, I hadn't been planning on writing anything in the wake of the Google China attack. However, I was set off by Wednesday's New York Times article, Fearing Hackers Who Leave No Trace, by John Markoff and Ashlee Vance.

It's a worthy piece of work, taking note of the U.S. government-enforced back door, which vendors like Cisco must put into their products so the National Security Agency can do what it does. (Though of course the NSA would be able to do that even without the back door.)

However, as one would expect from a broad-audience article, it doesn't pick inside-baseball nits, such as my software dev complaint above.

User-Side Protection

The one other angle I'd like to mention involves not the vulnerabilities of the creators of source code, but rather of the users. The deal here is, if any company really wants to be secure, what they would have to do is ensure that they're not using any apps which might be vulnerable.

Sounds like a small deal, but it's not. In practice, this means that if Adobe Acrobat is perceived as being vulnerable to attack--something mentioned in the Times article--then what your organization would need to do to be secure is to not use (or to sandbox) Acrobat. [I can't believe I'm half-channeling Richard Stallman here, though not with the intention of making the same point.]

That's not really practical in the workaday world, but it is in organizations which have the resources to develop their own alternatives. What I'm getting at here is, I wonder if any of the "black ops" orgs are down with this? They're the people who are providing our attack-side resources in the below-the-radar cyberwar with China and Russia.

I don't know what the answer is, but it's certainly an interesting question.

Follow me on Twitter: (@awolfe58)

What's your take? Let me know, by leaving a comment below or e-mailing me directly at [email protected]. Like this blog? Subscribe to its RSS feed: (here)

 My videos on ( YouTube)

 Facebook 

  LinkedIn

Alex Wolfe is editor-in-chief of InformationWeek.com.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
5/22/2014 | 6:09:24 AM
Right on the Money
I absolutely agree.  The recent Heartbleed article on Dark Reading got me ranting similarly about the need for security requirements in software projects and more care by the community in observing them: http://www.darkreading.com/messages.asp?piddl_msgthreadid=11947&piddl_msgid=219318#msg_219318
Register for Dark Reading Newsletters
White Papers
Video
Cartoon Contest
Write a Caption, Win a Starbucks Card! Click Here
Latest Comment: "Why else would HR ask me if I have a handicap?"
Current Issue
The Changing Face of Identity Management
Mobility and cloud services are altering the concept of user identity. Here are some ways to keep up.
Flash Poll
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2013-7445
Published: 2015-10-15
The Direct Rendering Manager (DRM) subsystem in the Linux kernel through 4.x mishandles requests for Graphics Execution Manager (GEM) objects, which allows context-dependent attackers to cause a denial of service (memory consumption) via an application that processes graphics data, as demonstrated b...

CVE-2015-4948
Published: 2015-10-15
netstat in IBM AIX 5.3, 6.1, and 7.1 and VIOS 2.2.x, when a fibre channel adapter is used, allows local users to gain privileges via unspecified vectors.

CVE-2015-5660
Published: 2015-10-15
Cross-site request forgery (CSRF) vulnerability in eXtplorer before 2.1.8 allows remote attackers to hijack the authentication of arbitrary users for requests that execute PHP code.

CVE-2015-6003
Published: 2015-10-15
Directory traversal vulnerability in QNAP QTS before 4.1.4 build 0910 and 4.2.x before 4.2.0 RC2 build 0910, when AFP is enabled, allows remote attackers to read or write to arbitrary files by leveraging access to an OS X (1) user or (2) guest account.

CVE-2015-6333
Published: 2015-10-15
Cisco Application Policy Infrastructure Controller (APIC) 1.1j allows local users to gain privileges via vectors involving addition of an SSH key, aka Bug ID CSCuw46076.

Dark Reading Radio
Archived Dark Reading Radio

The cybersecurity profession struggles to retain women (figures range from 10 to 20 percent). It's particularly worrisome for an industry with a rapidly growing number of vacant positions.

So why does the shortage of women continue to be worse in security than in other IT sectors? How can men in infosec be better allies for women; and how can women be better allies for one another? What is the industry doing to fix the problem -- what's working, and what isn't?

Is this really a problem at all? Are the low numbers simply an indication that women do not want to be in cybersecurity, and is it possible that more women will never want to be in cybersecurity? How many women would we need to see in the industry to declare success?

Join Dark Reading senior editor Sara Peters and guests Angela Knox of Cloudmark, Barrett Sellers of Arbor Networks, Regina Wallace-Jones of Facebook, Steve Christey Coley of MITRE, and Chris Roosenraad of M3AAWG on Wednesday, July 13 at 1 p.m. Eastern Time to discuss all this and more.