Dark Reading is part of the Informa Tech Division of Informa PLC

This site is operated by a business or businesses owned by Informa PLC and all copyright resides with them.Informa PLC's registered office is 5 Howick Place, London SW1P 1WG. Registered in England and Wales. Number 8860726.

Partner Perspectives  Connecting marketers to our tech communities.
SPONSORED BY
9/22/2017
09:30 AM
Raymond Pompon
Raymond Pompon
Partner Perspectives
Connect Directly
Twitter
RSS
50%
50%

Where Do Security Vulnerabilities Come From?

There are three major causes: code quality, complexity, and trusted data inputs.

It seems earthshaking vulnerabilities are released weekly that leave vendors and system administrators scrambling to remediate. So, where are all these vulnerabilities coming from? A simple search on the National Vulnerability Database shows over 3,300 new vulnerabilities released in just the past three months. Granted that many of these vulnerabilities are esoteric and limited to specific niche applications. However, nearly every other month we see a release with a large-scale hole that affects millions. The most egregious example was Heartbleed, which affected nearly halfof all Internet web servers.

But, why so many and so often? The simple reason is that vulnerabilities are an emergent property of software, and there are three major causes: code quality, complexity, and trusted data inputs.

Code Quality 
This is where everyone points their finger first. But why? Sloppy programming? Not necessarily. More often than not, it’s a conscious choice. In most development teams, the highest priority is given to the features for which customers will pay. And outside of the security group, most people do not want to pay for security. I say most because there are those who will pay for it, most often for applications and systems that are not as useful or flexible as the mainstream, less secure products where they should be paying for security.

Another driving force working against code quality is the concept of minimum viable product, which means it has just enough features and value to gain traction with customers. Any other features are secondary and can be added later. The mantra is: never build a mansion when a tent will do. The problem is that we find ourselves living in a tent for years on end. We also know that fixing security programs down the road is more expensive, which also delays the addition of security features in the face of new customer (and market) demands. Often, it isn’t until after a series of security calamities occur that security is raised to a priority.

Complexity
Most modern applications are so complex that they are beyond the understanding of a single person. To the average user, all this complexity is hidden by the user interface and underlying infrastructure, but IT professionals know better. Consider the current version of the Firefox browser, which contains 16 million lines of code written by 5,094 developers over ten years.

If you consider all the moving parts, interdependencies, layers, libraries, interface modes, and backward compatibility built into these applications, it’s no wonder that there are serious gaps in security coverage. It is also widely known that dynamic and complex systems are hard to predict and can lead to unexpected outcomes. One thing is certain, though: large, complex software applications will contain bugs, and some of those bugs will be security vulnerabilities.

Overly Trusting Data Inputs
If you examine most security vulnerabilities, you will see that they occur where the program is accepting data input. Therefore, every data input into a system is an attack surface. These vulnerabilities exploit weak boundaries where input systems expect data but instead are breached to insert new commands. Look at where attacks such as buffer overflows, SQL injection, or cross-site scripting occur: data input channels that are subverted. This is not a new problem. Decades ago, programmers were taught to expect non-conformant input and filter accordingly. Given the complexity of software and the speed at which it is developed, it is not surprising that programmers do not have the resources or time to ensure robust filtering of every possible input stream.

Pulling It All Together
In "How Complex Systems Fail,” author Richard I. Cook notes that "catastrophic failure occurs when small, innocuous failures join to create a systemic problem." These problems combine to create the chronic disease of security vulnerabilities pervading the entire software industry.  

How can security teams respond to these issues? For one, organizations can use these principles to roughly estimate the magnitude and frequency of potential vulnerabilities in a system, which can also assist in risk assessments. Since every input is a possible attack path, reduce your exposure to just the services you absolutely need to put on the Internet. If you do expose an input path, filter it and monitor it. Also, remember that security tools are software, so build for defense in depth, and test often.

Get the latest application threat intelligence from F5 Labs.

Raymond Pompon is a Principal Threat Researcher Evangelist with F5 labs. With over 20 years of experience in Internet security, he has worked closely with Federal law enforcement in cyber-crime investigations. He has recently written IT Security Risk Control Management: An ... View Full Bio
Comment  | 
Print  | 
More Insights
Comments
Oldest First  |  Newest First  |  Threaded View
COVID-19: Latest Security News & Commentary
Dark Reading Staff 7/9/2020
Introducing 'Secure Access Service Edge'
Rik Turner, Principal Analyst, Infrastructure Solutions, Omdia,  7/3/2020
Russian Cyber Gang 'Cosmic Lynx' Focuses on Email Fraud
Kelly Sheridan, Staff Editor, Dark Reading,  7/7/2020
Register for Dark Reading Newsletters
White Papers
Video
Cartoon
Current Issue
Special Report: Computing's New Normal, a Dark Reading Perspective
This special report examines how IT security organizations have adapted to the "new normal" of computing and what the long-term effects will be. Read it and get a unique set of perspectives on issues ranging from new threats & vulnerabilities as a result of remote working to how enterprise security strategy will be affected long term.
Flash Poll
Twitter Feed
Dark Reading - Bug Report
Bug Report
Enterprise Vulnerabilities
From DHS/US-CERT's National Vulnerability Database
CVE-2020-5607
PUBLISHED: 2020-07-10
Open redirect vulnerability in SHIRASAGI v1.13.1 and earlier allows remote attackers to redirect users to arbitrary web sites and conduct phishing attacks via unspecified vectors.
CVE-2020-15001
PUBLISHED: 2020-07-09
An information leak was discovered on Yubico YubiKey 5 NFC devices 5.0.0 to 5.2.6 and 5.3.0 to 5.3.1. The OTP application allows a user to set optional access codes on OTP slots. This access code is intended to prevent unauthorized changes to OTP configurations. The access code is not checked when u...
CVE-2020-15092
PUBLISHED: 2020-07-09
In TimelineJS before version 3.7.0, some user data renders as HTML. An attacker could implement an XSS exploit with maliciously crafted content in a number of data fields. This risk is present whether the source data for the timeline is stored on Google Sheets or in a JSON configuration file. Most T...
CVE-2020-15093
PUBLISHED: 2020-07-09
The tough library (Rust/crates.io) prior to version 0.7.1 does not properly verify the threshold of cryptographic signatures. It allows an attacker to duplicate a valid signature in order to circumvent TUF requiring a minimum threshold of unique signatures before the metadata is considered valid. A ...
CVE-2020-15299
PUBLISHED: 2020-07-09
A reflected Cross-Site Scripting (XSS) Vulnerability in the KingComposer plugin through 2.9.4 for WordPress allows remote attackers to trick a victim into submitting an install_online_preset AJAX request containing base64-encoded JavaScript (in the kc-online-preset-data POST parameter) that is execu...