RE: [fw-wiz] Vulnerability Response (was: BGP TCP RST Attacks)

From: Ben Nagy (ben_at_iagu.net)
Date: 06/01/04

  • Next message: Manoj Kumar Neelapareddy: "[fw-wiz] FW and TCP Sessions" 
    To: <firewall-wizards@honor.icsalabs.com>
Date: Tue, 1 Jun 2004 11:06:52 +0200

    > -----Original Message-----
    > From: Marcus J. Ranum [mailto:mjr@ranum.com]
    [...]
    > >mjr writes:
    [...]
    > > I think eventually time will tell
    > > and we'll give up on patch management as a security
    > > technique. [...]
    (me)
    > | "CRAP!"
    >
    > As I said, I think time will tell. :)
    >
    > <RANT>
    >
    > Come on, Ben! Join me in challenging the preconceptions of an
    > industry that has grown up around "if you can't do something
    > RIGHT do something STUPID, HARDER!" That's what we're
    > talking about, here, with all the focus on patch management:
    > - Rather than run a good O/S: run a bad one and MANAGE it BETTER
    > - Rather than understand your connectivity: leave it OPEN and
    > FIDDLE WITH
    > your endpoints CONSTANTLY
    > - Rather than run good code: run bad code and UPGRADE IT DAILY
    >
    > Talk about not being able to yell "CRAP" loud enough?? What's
    > wrong with this picture?!?!

    I'm horribly torn here. I completely agree with you, but I just don't see
    any evidence of change. Essentially what you are claiming, when you say that
    "time will tell", is that little green men from the Planet Clue are going to
    invade earth with their rectal clue applicators and drag most of the IT
    industry in the world off to re-education camps. Until then, I applaud
    evangelism, but it won't stop me trying to secure the mess we have.

    > >Take a look at the recent security record of MS RPC endpoints. You
    > >can't turn them off. You can't secure them. Windows will break.
    >
    > Yes. So? YOU ARE INSANE IF YOU ARE RELYING ON WINDOWS FOR
    > INTERNET-FACING CRITICAL SYSTEMS.

    Trouble is that it's not just internet facing systems that get owned. This
    idea of crunchy outside chewy centre has GOT to change. It's dead. Didn't
    work. Bye-bye.

    [...]
    > We have seen - CLEARLY - with software and O/S in general -
    > that they are not reliable enough to provide a solid security
    > platform. The evidence is manifest; it's been staring us in
    > the face for at least the last 10 years and it's been covered
    > in big, blinky neon signeage for the last 4 years. Everyone
    > would rather be in denial.
    >
    > What do you think? If we install JUST ONE MORE PATCH it's
    > gonna be SECURE? Heck, no. The only way to secure this crap
    > is to hold it down and hammer a stake through its heart.

    Ah c'mon.

    Given that we can't go back to the abacus, we need to work from where we
    are, and it is happening. I see MS doing GOOD WORK in improving the
    fundamental security core of their OS. I nearly passed out when I saw
    support for NX memory, no anonymous RPC and host firewall enabled by default
    in a general purpose service pack. They've come a long way from VMS. :) I
    see linux including easy (enough) to use stack protection in most major
    distributions, with DAC being doable In Real Life. I see
    MacOS....um...taking massive steps backwards, but hey, they've always
    "thought different".

    The other option to burning it all and starting again is to "get there from
    here". I say it's possible (eventually). Until that happens, we need
    auxilliary solutions to prop things up.

    > </RANT>
    >
    > >How _ELSE_ do you want to deal with that problem? Let me put it a
    > >different way. However much you lock down machines, your biggest
    > >remaining worry will be software vulnerabilities in the services you
    > >_do_ run - the rest is just a matter of degrees. How do you
    > eliminiate vulnerabilities? Patch.
    >
    > Ok... now let me catch my breath and we can talk sense... ;)
    >
    > You're absolutely right that the software vulnerabilities in
    > services are what will kill you. That's why the old-school
    > doctrine was [smart]

    I think you're STILL thinking in terms of building hardened entry points.
    Yes, more people should do that as well. Now what about the other 99.9% of
    machines in the network? Some of the manufacturing places I talk to still
    have Windows 95 machines running production robots. Win 95! The only reason
    they didn't get knocked over by Sasser is that they didn't _have_ a Local
    Security Authority!

    [...]
    > >You can only harden up until the OS will let you.
    >
    > Well, yeah. If you're using the wrong OS you're an idiot. The
    > fact that there are a lot of idiots out there doesn't make
    > them any less idiotic, either.

    This line brings a smile to my face every time I read it.

    You're right, of course, but lots of people aren't going to admit it when
    you rub their nose in it like that. I'm writing this on a Windows box - and
    you just told me that your work box is Windows too. I vote that us "idiots"
    deserve security too.

    > Let me see here: "I am gonna build a 'bastion host' on an O/S
    > that doesn't have chroot, or any notion of file permissions
    > or execution control. But I like it because it automatically
    > loads device drivers on demand and it has shared libraries
    > and no CHANCE of producing a statically bound executable and
    > by the way anyone can overwrite a shared library any time
    > they get file level access because there are no file
    > permissions enforced."
    [...]

    What can I say? :) It's so useable!

    No, seriously, the argument about what to use if building a hardened
    single-service box was conceded a long time ago by all but the masochists.
    I'm talking about the _rest_.

    [...]
    > The idea that code needs to be patched frequently and often
    > is predicated on the flawed concept that cruddy code is
    > exposed to untrusted network. That's just dumb.

    So this is, again, where we differ in opinion. The desktop - also known as
    Cruddy Code Central - is what is causing the problem. You "old school"
    genuises have been telling us "newbies" to build super duper amazing transit
    points between networks of different trust levels, which we have been trying
    to do. The trouble is that malware still gets in. Poot. Them dang worms is
    like roaches, I tell ya. Looks 'ifn that there trusted network weren't quite
    so trusted after all...

    There comes a point where we have to admit that "the security architecture
    operation was a complete success, but the patient died" is of limited value.
    One of the funniest things I ever saw was a small copper tail running out of
    a door in a military research institute - the building was a faraday cage,
    and so they needed the tail to make the radio work. People DO these things -
    it's HUMAN.

    > Fight back. Fight dumbness.
    > Come over to the light. Turn away from the darkness. Fight
    > the "accepted wisdom" of defeat. Use The Force, Ben.... ;)

    Ha! "It's fun to use learning for evil!" [1]

    > > Other solutions (like my
    > >famous "marketing" host based vulnerability mitigation ;) might save
    > >your backside for a while, but the real intent of those
    > solutions is to
    > >buy you time, not obviate the need to fix the real problem.
    >
    > Exactly!! Put another way - the intent of those solutions is
    > to make it easier for you to survive doing something stupid
    > that you may not survive anyhow.

    That's correct. This is a bad thing, how? Seatbelts. The rail around Niagra.
    etc...

    [...]
    > I have never had a worm or virus since I got interested in security.
    > NEVER. And I use Windows as my primary desktop platform.

    Because you have one machine to take care of, plus you have some idea what
    you are doing maybe?

    [...]
    > Yes,
    > desktops that are vulnerable to malcode should have malcode
    > protection (my desktop AV clobbers about 1 or 2 viruses a
    > week that get through my spam filters and attachment
    > blockers)

    !! So we agree! Yay! It's just that AV is not really effective against
    network-borne threats because the threat clobbers the network service before
    the AV gets a crack at it. AV is OK at stopping stuff that comes in from
    Layer 8, but doesn't cover lots of other threats. Other stuff _can_ cover
    some of those threats.

    [...]
    > >With you I will just say that you are five years ahead of your time.
    >
    > What?? I've been saying EXACTLY THE SAME THING since 1990.
    >
    > *BUT* Peter Neumann has been saying EXACTLY THE SAME THING
    > since 1963 or thereabouts. I was 1 year old then.
    >
    > Dude, I'm not "advanced" I'm "retro" !!!! :)

    Computing since the 60s has proved that those two words are effectively
    synonyms. ;)

    > >I am
    > >100% behind you as an idealist, but, as a professional, I don't see
    > >that as useful right now. :D
    >
    > Because you're stuck in the dumbness.[...]
    >
    > Keep shovelling,
    > mjr.

    <shovel, shovel>

    ben

    [1] http://www.dieselsweeties.com/shirts/ This is not my company, I have no
    affiliation, I make no money from shirt sales - I just didn't wanna steal a
    possibly-trademarked line. ;)

    PS: I am ten ninjas. [1]

    _______________________________________________
    firewall-wizards mailing list
    firewall-wizards@honor.icsalabs.com
    http://honor.icsalabs.com/mailman/listinfo/firewall-wizards

  • Next message: Manoj Kumar Neelapareddy: "[fw-wiz] FW and TCP Sessions"

    Relevant Pages

    • SecurityFocus Microsoft Newsletter #51
      ... Subject: SecurityFocus Microsoft Newsletter #51 ... If you're running a Windows network, then this is the intensive 3-day ... Specialist in Microsoft's Security Services Partner Program, ... Platforms: Solaris and Windows NT ...
      (Focus-Microsoft)
    • RE: file sharing on network with vista and xp home computer
      ... Since the contact through microsoft email has been 24 hours+ for each reply, ... security settings for the root folder until I asked them to. ... network was working for that one week, that I had changed "Everyone's" access ... and I had to reinstall my copy of windows. ...
      (microsoft.public.windowsxp.network_web)
    • Re: Biometrics
      ... Can Microsoft remotely work on a Microsoft Windows 98 Second ... Edition computer via India like Microsoft can work on a Windows XP ... Establishing good security practices (patch when we ... within a network for internal safety reasons and potentially to act as ...
      (microsoft.public.security)
    • Behind the Shield, July 2004
      ... Read on to learn how Guardian Digital is currently supplying network security ... Stock Exchange with Secure Internet ... patch management has become exponentially important to the ...
      (comp.os.linux)
    • Behind the Shield, July 2004
      ... Read on to learn how Guardian Digital is currently supplying network security ... Stock Exchange with Secure Internet ... patch management has become exponentially important to the ...
      (comp.os.linux.security)