Tuesday, January 05, 2016

Will we ever fix that last s/w (h/w) security vulnerability?

A recent talk bu Johanna Rutkowska sparked a discussion about whether the number of vulnerabilities is potentially infinte, or whether the cost and/or value of exploiting and/or fixing them them is slowly increasing (or decreasing) or (thanks to Markus Kuhn and others) it is cyclic, as phases of technological innovation wash up and down the shores of human society....

so my take - we spend ages in the OS community trying (as
per the talk) to nail down the smallest piece of the trusted tiny
center of the kernel (and talk to the hardware people about it very
closely - even modifying their designs), so that the attack surface is
minimized - including, as you say, improved tools and techniques 9type
safe software fuzzers, verifiers etc etc...

then some skunk works thing from the h/w comes along and changes the
whole game (in terms of complexity to start with, but also in terms of
massively opening up the attack space) _ usually its coz of some
geniuine user demand for something faster/cleverer (as per the talk,
add in GPUs, add in smarer NICs with offloading, add in multicore, add
in more instructions for graphics, even for security itself!)

another example of this can be seen on the net  - since well before
current scandels (back in 1990s) we've been trying to batten down the
hatches everywhere  with DNS, BGP and end-to-end crypto (and now
betterer DNSSEC, better certificate ideas, better router-router
systemic ways to prevent problems, better e2e crypto (c.f. tcpcrypt)

and then some bozo comes along and re-jogs the entire mobile phone net
to be IP based (but with lots of little, devilish little changes)

then some mega-bozo comes and puts a rspi in every thing that has a
moving part, and connects that to the interweb (and builds a new stack
with COAP and IPv6 and lowpan/zigbee so we have no idea what new
sneaky things there are in there)...

then some dolt comes and builds million core data centers and modifies
the entire stack and routing system coz it doesn't scale to their
needs....so we don't know what new corner cases have now appeared on
the masive geodesic (no longer nice shiny smooth, hard  thing)

and we have to start a l l   o v e r   a g a i n

It's like you build defences around your big city with walled gardens
and gated communities, and someone comes and builds a massive shanty
town right outside, a favella, which you need, coz, after all, someone
has to come and clean the floors and make your tea and take out the

No comments:

Blog Archive

About Me

My photo
misery me, there is a floccipaucinihilipilification (*) of chronsynclastic infundibuli in these parts and I must therefore refer you to frank zappa instead, and go home