Risk
1/21/2010
12:31 PM
Alexander Wolfe
Alexander Wolfe
Commentary
Connect Directly
Twitter
Facebook
RSS
E-Mail
50%
50%

Sloppy Software Dev Exposes Google Hacker Holes

I've ranted on the subject before, but it's worth sounding off again in light of the recent China hacker breaches of Gmail: Poor software development procedures are the big reason major firms are apparently running around scared witless that their products are vulnerable to cyberattacks. (The corollary, about which we haven't read anything, is that firms with buttoned-down dev rules are likely feeling, if not entirely safe, then at least free of the panic which plagues the cluelessly unprepared.

I've ranted on the subject before, but it's worth sounding off again in light of the recent China hacker breaches of Gmail: Poor software development procedures are the big reason major firms are apparently running around scared witless that their products are vulnerable to cyberattacks. (The corollary, about which we haven't read anything, is that firms with buttoned-down dev rules are likely feeling, if not entirely safe, then at least free of the panic which plagues the cluelessly unprepared.)The scary thing is, it's my belief that there aren't many PC-generation vendors (you know what I mean here; I'm not going to name names) who adhere to enforced best practices. Let's stipulate that this is not totally their fault; software developers who came of age without ever having to wield a soldering iron can't be expected to have a deep understand of the hardware upon which their poorly commented, non-error-trapping spaghetti code is running.

I do suspect that networking companies have an inherent advantage insofar as hacker exposure goes. That's because the higher complexity level of their software output -- as compared with, say, desktop PC apps -- means that they're more likely to enforce internal practices such as (real, as opposed to theatrical) code reviews and deep QA testing. This may not be driven by security concerns; at the top level, it's because without a proper process, the stuff just won't work. But the upshot is the same, and they're in a better place as a result.

Personally, I hadn't been planning on writing anything in the wake of the Google China attack. However, I was set off by Wednesday's New York Times article, Fearing Hackers Who Leave No Trace, by John Markoff and Ashlee Vance.

It's a worthy piece of work, taking note of the U.S. government-enforced back door, which vendors like Cisco must put into their products so the National Security Agency can do what it does. (Though of course the NSA would be able to do that even without the back door.)

However, as one would expect from a broad-audience article, it doesn't pick inside-baseball nits, such as my software dev complaint above.

User-Side Protection

The one other angle I'd like to mention involves not the vulnerabilities of the creators of source code, but rather of the users. The deal here is, if any company really wants to be secure, what they would have to do is ensure that they're not using any apps which might be vulnerable.

Sounds like a small deal, but it's not. In practice, this means that if Adobe Acrobat is perceived as being vulnerable to attack--something mentioned in the Times article--then what your organization would need to do to be secure is to not use (or to sandbox) Acrobat. [I can't believe I'm half-channeling Richard Stallman here, though not with the intention of making the same point.]

That's not really practical in the workaday world, but it is in organizations which have the resources to develop their own alternatives. What I'm getting at here is, I wonder if any of the "black ops" orgs are down with this? They're the people who are providing our attack-side resources in the below-the-radar cyberwar with China and Russia.

I don't know what the answer is, but it's certainly an interesting question.

Follow me on Twitter: (@awolfe58)

What's your take? Let me know, by leaving a comment below or e-mailing me directly at alex@alexwolfe.net. Like this blog? Subscribe to its RSS feed: (here)

 My videos on ( YouTube)

 Facebook 

  LinkedIn

Alex Wolfe is editor-in-chief of InformationWeek.com.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
5/22/2014 | 6:09:24 AM
Right on the Money
I absolutely agree.  The recent Heartbleed article on Dark Reading got me ranting similarly about the need for security requirements in software projects and more care by the community in observing them: http://www.darkreading.com/messages.asp?piddl_msgthreadid=11947&piddl_msgid=219318#msg_219318
Register for Dark Reading Newsletters
White Papers
Cartoon
Current Issue
Flash Poll
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-3345
Published: 2014-08-28
The web framework in Cisco Transport Gateway for Smart Call Home (aka TG-SCH or Transport Gateway Installation Software) 4.0 does not properly check authorization for administrative web pages, which allows remote attackers to modify the product via a crafted URL, aka Bug ID CSCuq31503.

CVE-2014-3347
Published: 2014-08-28
Cisco IOS 15.1(4)M2 on Cisco 1800 ISR devices, when the ISDN Basic Rate Interface is enabled, allows remote attackers to cause a denial of service (device hang) by leveraging knowledge of the ISDN phone number to trigger an interrupt timer collision during entropy collection, leading to an invalid s...

CVE-2014-4199
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, allows local users to write to arbitrary files via a symlink attack on a file in /tmp.

CVE-2014-4200
Published: 2014-08-28
vm-support 0.88 in VMware Tools, as distributed with VMware Workstation through 10.0.3 and other products, uses 0644 permissions for the vm-support archive, which allows local users to obtain sensitive information by extracting files from this archive.

CVE-2014-0761
Published: 2014-08-27
The DNP3 driver in CG Automation ePAQ-9410 Substation Gateway allows remote attackers to cause a denial of service (infinite loop or process crash) via a crafted TCP packet.

Best of the Web
Dark Reading Radio
Archived Dark Reading Radio
This episode of Dark Reading Radio looks at infosec security from the big enterprise POV with interviews featuring Ron Plesco, Cyber Investigations, Intelligence & Analytics at KPMG; and Chris Inglis & Chris Bell of Securonix.