Schneier on Security

Vulnerability Researcher • May 20, 2015 4:58 PM

This is a very well known problem in application security areas, which, btw, are often separated from the same organizations in charge of patching at many organizations. :/ That separation is always a bad combination. But, usually, an organization’s it security department will have some visibility and at the very least be in charge of operating security scanners. (For whatever reason, from corporate to government, these organizations seem to naturally evolve out into the very same structures.)

VeraCode actually does a pretty good job of ferreting out problematic third party libraries that have vulnerbilities. But they have a high false positive rate in general, like IBM AppScan Source & HP Fortify.

That is one of the most insidious problems with patching: third party libraries which are included in custom vendor code. Third party libraries are a staple in the industry, that will not change. Taking code from online sources is a related problem, and also that practice is likely not to change. Typically, however, that can be even more insidious when they are security vulnerabilities in that manner of code. Because that kind of code is very often put in by patch work and so more difficult to detect.

Much of these problems are in the grasp of network scanners. Some of them perform analysis simply by authenticated registry calls. Others perform full binary sweeps checking hash data of known bad vulnerabilities. The later is obviously much stronger at detection for known vulnerabilities… but it is far more intrusive. And being more intrusive means something: already full AV scans are extremely demanding on systems, and this sort of functionality operates in much the same way.

Patching, I do believe, one can reason out is, however, the best strategy to have. The problem is heuristic technology for detection and defeating of vulnerabilities already known is sketchy and highly resource intensive. This later strategy can be, however, invaluable to properly detect who is attempting ‘what’ attacks, and so promises to expand, greatly, the capacity for maintaining accuracy against well known attacks.

Why are those sorts of systems sketchy? Because there are many classes of critical vulnerabilities which can have an extensive array of potential exploit code and much of the exploit code might appear little or no different from legitimate activity. This is, for instance, especially true with ‘business logic’ type vulnerabilities, and many forms of web application vulnerabilities.

It is entirely troubling when it involves lateral network sensors, because most security strategies are designed for perimeter defense, not lateral, ‘behind the DMZ defense’.

This later problem is increasingly problematic as companies increasingly embrace ‘iot’ technology. Already companies are deeply invested in wide spread wireless access and there are many problems with that access to where they effectively mean that their users and customers are bypassing ordinary dmz perimeter controls. eg, handset applications which directly communicate with post-dmz databases, or internal applications initially designed for wired network security instances but now effectively open to external inspection simply because internal access goes over the air, as opposed to the wire.

Vulnerability Researcher • May 20, 2015 10:49 PM

@Figureitout

The little blurp states why just “patching” is insufficient if say, what if there’s a bug in the patching software itself or using an emulator WINE like these researchers did, does not give a true picture of reality and has security issues itself.

🙂

Unfortunately, for everyday corporations not super paranoid government, dealing with the potential threat of attacks via your security scanner is just not on the map. There is so much else to worry about.

I smile, however, because looking for security vulnerabilities in security products is exactly what some of my friends have done. They went the responsible disclosure route, but it was eye opening activity.

I also agree, on the WINE comment, and that stood out to me. You want your studies performed as ‘real world’ as possible.