Risk
1/21/2010
12:31 PM
Alexander Wolfe
Alexander Wolfe
Commentary
Connect Directly
Twitter
Facebook
RSS
E-Mail
50%
50%

Sloppy Software Dev Exposes Google Hacker Holes

I've ranted on the subject before, but it's worth sounding off again in light of the recent China hacker breaches of Gmail: Poor software development procedures are the big reason major firms are apparently running around scared witless that their products are vulnerable to cyberattacks. (The corollary, about which we haven't read anything, is that firms with buttoned-down dev rules are likely feeling, if not entirely safe, then at least free of the panic which plagues the cluelessly unprepared.

I've ranted on the subject before, but it's worth sounding off again in light of the recent China hacker breaches of Gmail: Poor software development procedures are the big reason major firms are apparently running around scared witless that their products are vulnerable to cyberattacks. (The corollary, about which we haven't read anything, is that firms with buttoned-down dev rules are likely feeling, if not entirely safe, then at least free of the panic which plagues the cluelessly unprepared.)The scary thing is, it's my belief that there aren't many PC-generation vendors (you know what I mean here; I'm not going to name names) who adhere to enforced best practices. Let's stipulate that this is not totally their fault; software developers who came of age without ever having to wield a soldering iron can't be expected to have a deep understand of the hardware upon which their poorly commented, non-error-trapping spaghetti code is running.

I do suspect that networking companies have an inherent advantage insofar as hacker exposure goes. That's because the higher complexity level of their software output -- as compared with, say, desktop PC apps -- means that they're more likely to enforce internal practices such as (real, as opposed to theatrical) code reviews and deep QA testing. This may not be driven by security concerns; at the top level, it's because without a proper process, the stuff just won't work. But the upshot is the same, and they're in a better place as a result.

Personally, I hadn't been planning on writing anything in the wake of the Google China attack. However, I was set off by Wednesday's New York Times article, Fearing Hackers Who Leave No Trace, by John Markoff and Ashlee Vance.

It's a worthy piece of work, taking note of the U.S. government-enforced back door, which vendors like Cisco must put into their products so the National Security Agency can do what it does. (Though of course the NSA would be able to do that even without the back door.)

However, as one would expect from a broad-audience article, it doesn't pick inside-baseball nits, such as my software dev complaint above.

User-Side Protection

The one other angle I'd like to mention involves not the vulnerabilities of the creators of source code, but rather of the users. The deal here is, if any company really wants to be secure, what they would have to do is ensure that they're not using any apps which might be vulnerable.

Sounds like a small deal, but it's not. In practice, this means that if Adobe Acrobat is perceived as being vulnerable to attack--something mentioned in the Times article--then what your organization would need to do to be secure is to not use (or to sandbox) Acrobat. [I can't believe I'm half-channeling Richard Stallman here, though not with the intention of making the same point.]

That's not really practical in the workaday world, but it is in organizations which have the resources to develop their own alternatives. What I'm getting at here is, I wonder if any of the "black ops" orgs are down with this? They're the people who are providing our attack-side resources in the below-the-radar cyberwar with China and Russia.

I don't know what the answer is, but it's certainly an interesting question.

Follow me on Twitter: (@awolfe58)

What's your take? Let me know, by leaving a comment below or e-mailing me directly at alex@alexwolfe.net. Like this blog? Subscribe to its RSS feed: (here)

 My videos on ( YouTube)

 Facebook 

  LinkedIn

Alex Wolfe is editor-in-chief of InformationWeek.com.

Comment  | 
Print  | 
More Insights
Comments
Newest First  |  Oldest First  |  Threaded View
Christian Bryant
50%
50%
Christian Bryant,
User Rank: Ninja
5/22/2014 | 6:09:24 AM
Right on the Money
I absolutely agree.  The recent Heartbleed article on Dark Reading got me ranting similarly about the need for security requirements in software projects and more care by the community in observing them: http://www.darkreading.com/messages.asp?piddl_msgthreadid=11947&piddl_msgid=219318#msg_219318
Register for Dark Reading Newsletters
White Papers
Flash Poll
Current Issue
Cartoon
Video
Slideshows
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2014-0103
Published: 2014-07-29
WebAccess in Zarafa before 7.1.10 and WebApp before 1.6 stores credentials in cleartext, which allows local Apache users to obtain sensitive information by reading the PHP session files.

CVE-2014-0475
Published: 2014-07-29
Multiple directory traversal vulnerabilities in GNU C Library (aka glibc or libc6) before 2.20 allow context-dependent attackers to bypass ForceCommand restrictions and possibly have other unspecified impact via a .. (dot dot) in a (1) LC_*, (2) LANG, or other locale environment variable.

CVE-2014-0889
Published: 2014-07-29
Multiple cross-site scripting (XSS) vulnerabilities in IBM Atlas Suite (aka Atlas Policy Suite), as used in Atlas eDiscovery Process Management through 6.0.3, Disposal and Governance Management for IT through 6.0.3, and Global Retention Policy and Schedule Management through 6.0.3, allow remote atta...

CVE-2014-2226
Published: 2014-07-29
Ubiquiti UniFi Controller before 3.2.1 logs the administrative password hash in syslog messages, which allows man-in-the-middle attackers to obtains sensitive information via unspecified vectors.

CVE-2014-3020
Published: 2014-07-29
install.sh in the Embedded WebSphere Application Server (eWAS) 7.0 before FP33 in IBM Tivoli Integrated Portal (TIP) 2.1 and 2.2 sets world-writable permissions for the installRoot directory tree, which allows local users to gain privileges via a Trojan horse program.

Best of the Web
Dark Reading Radio