SEI Insights

There's a really great history on this here: https://insights.sei.cmu.edu/blog/who-needs-to-exploit-vulnerabilities… In summary, each successive version of Office actually walked back the tone of the warning if you tried to enable macros. Office 2000 was still more strict than what we'll have after this change. Office 2010 reduced it to the one yellow bar and a single click enable. Edit: For those reading, this has been for a while something of an embarrassment. The creator of mimikatz only just made this callout in response to Microsoft's security advertising: https://nitter.net/gentilkiwi/status/1488937687281242116#m Further edit: There's a statement regarding the scale of this change here: https://nitter.net/GossiTheDog/status/1490740535849623552#m

A RISC-V linux system for the ECP5 can be built with the FOSS toolchain using vexriscv and litex: https://github.com/litex-hub/linux-on-litex-vexriscv also, step by step using a different core (rocket): https://insights.sei.cmu.edu/sei_blog/2019/10/how-to-build-a-trustwort…

Even done in the best way possible, SSL inspection puts end users at increased risk. In the real world, vendors make mistakes, which put them at even higher risk. https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.…

5 paragraphs of Silver Bullet Magical Thinking nonsense to get to the actual bill, which is basically calling for a study and recommended guidelines for OSS security - of which there are several already, including one from the DoD [1]. I see nothing new or useful here, what am I missing? "The Securing Open Source Software Act would direct CISA to develop a risk framework to evaluate how open source code is used by the federal government. CISA would also evaluate how the same framework could be voluntarily used by critical infrastructure owners and operators. This will identify ways to mitigate risks in systems that use open source software. The legislation also requires CISA to hire professionals with experience developing open source software to ensure that government and the community work hand-in-hand and are prepared to address incidents like the Log4j vulnerability. Additionally, the legislation requires the Office of Management and Budget (OMB) to issue guidance to federal agencies on the secure usage of open source software and establishes a software security subcommittee on the CISA Cybersecurity Advisory Committee." [1] https://insights.sei.cmu.edu/blog/taking-up-the-challenge-of-open-sour…

I usually find it safe to assume that compiler folks are conscious of optimization opportunities and make pretty intelligent tradeoffs on that spectrum. This is one such case. There's a long history of bounds checking compilers. The first that I know of is bcc in the 80s, which had a 10x slowdown! Austin et al. [1] came along a few years later way back in '94 and improved things to a mere 2-5x slowdown. That's pretty much where things stood for the next two decades because pointer accesses are everywhere in C and register pressure is nothing to sneeze at. Moreover, changing pointer sizes breaks your ability to link external things that weren't compiled with the same flags, like the system libc. ABI compatibility is make-or-break for a C compiler. You can get around that by breaking up the metadata from the actual pointer (e.g. softbound), but the performance cost is still ~3-4x [2]. ASAN was notable because 1) it was very efficient. That initial 73% was utterly fantastic at the time. 2) It was production-usable (i.e. worked on big codebases) 3) With hardware support, the performance hit is often under 10%. HWAsan on modern platforms is low-cost enough to run it all the time. And no, I'm saying that pretty much every nontrivial C program has UB, not that they're specifically memory unsafe. [1] https://minds.wisconsin.edu/bitstream/handle/1793/59822/TR1197.pdf?seq… [2] https://insights.sei.cmu.edu/blog/performance-of-compiler-assisted-mem…

SoftICE was one of the most amazing utilities out there both for debugging as well as reverse engineering. The Wikipedia page is spot on about WinDbg/KD, but pretty out of date re: modern tools. Ollydbg2 came out more than half a decade ago and supports all the 64 bit registers and x86-64 instruction set. Immunity Debugger took the place as the defacto standard, and most modern scripts and tooling are built around Immunity for dynamic analysis and IDA Pro for static analysis. IDA Pro adopted QT natively, so the plugin communities are extending the hell out of what was already a great tool, and there are good plugins that export annotations/symbols that Immunity can consume so the union between static and dynamic analysis has never been smaller. If you don't have an IDA license, Immunity combined with Radare (read down) is still pretty powerful to play around with. Either way, the reverse engineering stuff out there is quite simply amazing. https://github.com/aquynh/capstone https://github.com/REhints/HexRaysCodeXplorer (this is CRAZY useful if you bought the Hex Rays license with IDA) https://github.com/ynvb/DIE - makes IDA even better ("DIE is an IDA python plugin designed to enrich IDA`s static analysis with dynamic data) https://portal.cert.org/web/mc-portal/pharos-static-analysis-tools - I haven't used this yet but Pharos is a static analysis tool out of Carnegie Melon that's particularly useful for C++ gen'd code.…

Apparently 1/3 of all software vulnerabilities represent design weaknesses which were introduced in the requirements phase. The MCAS flaw seems to belong to this category which you describe. source: https://insights.sei.cmu.edu/blog/a-tool-to-address-cybersecurity-vuln…

ahh yes, the rational r1000. an ada machine from the 70s that stored programs in a mixed ast/object data format called diana: https://insights.sei.cmu.edu/documents/948/1988_005_001_15650.pdf

It is not necessary to be able to solve a problem in order to identify it. That said, what I think what is needed is general support for architectural connectors in programming languages. Our so-called "general purpose programming languages" (actually: domain specific languages for the domain of algorithms, see ALGOL) effectively support one: the procedure call. https://insights.sei.cmu.edu/library/procedure-calls-are-the-assembly-… See also: https://blog.metaobject.com/2019/02/why-architecture-oriented-programm… and: https://2020.programming-conference.org/details/salon-2020-papers/5/Ca…

Here's an article from the SEI covering the problems with using Ghidra for malware analysis of Rust code. See "Binary Analysis Without Source Code" https://insights.sei.cmu.edu/blog/rust-vulnerability-analysis-and-matu…

https://insights.sei.cmu.edu/blog/forensics-software-and-oracle-outsid… ?

The first lecture is from this summer, the others are from an MIT mini-course few years back when D4M was still incubating. During that time D4M was developed into a standard, which is now GraphBLAS, see my comment from yesterday... Log(Graph): A Near-Optimal High-Performance Graph Representation (2018) https://news.ycombinator.com/item?id=18099520 For an overview of GraphBLAS in the context of Heterogeneous High-Performance Computing (HHPC) systems such as NVIDIA GPUs or Intel Xeon Phis, see the 2015 talk Scott McMillan (https://insights.sei.cmu.edu/author/scott-mcmillan/) gave at the CMU Software Engineering Institute: Graph Algorithms on Future Architectures [video] https://www.youtube.com/watch?v=-sIdS4cz7-4

> I genuinely don't think these features of Rust are really all that useful (they're being disingenuous; acting like C++ is some primitive language where you segfault every 5 minutes). Nobody said that C++ code segfaults every 5 minutes, and accusing people of being disingenuous for saying things they never said is, well, disingenuous. The claim is that memory safety problems are serious problems in C++ code. It's been found that memory safety problems are the leading overall cause of software security vulnerabilities [1]. [1]: https://insights.sei.cmu.edu/sei_blog/2014/08/performance-of-compiler-…

I get your point, but most does not mean all, and hardening is all about adding layers. https://insights.sei.cmu.edu/cert/2016/11/windows-10-cannot-protect-in… is a complete review of the mitigations we are loosing.

So has any person or organization done a statistical survey of a body of bug reports (like CERT) and characterized how many bugs are memory safety related? I see this SEI blog entry [1] that cites a report, with a bitrotted link (I think it's [2]). The blog summarizes the report associating buffer overflow as a source of "14 percent of software security vulnerabilities and 35 percent of critical vulnerabilities making it the leading cause of software security vulnerabilities overall." Though it seems to be the easiest to track and a leading error, buffer overflow is only one category of memory safety problem. [1] https://insights.sei.cmu.edu/sei_blog/2014/08/performance-of-compiler-… [2] https://courses.cs.washington.edu/courses/cse484/14au/reading/25-years…

Email is rarely a good place for sensitive information. DNSSEC is not a panacea, but it does make Eve's job harder. https://insights.sei.cmu.edu/cert/2014/09/-probable-cache-poisoning-of…

I wonder how much DBus (the Inter-Process-Communication (IPC) standard Linux desktops have been based around) is baked into QNX & instrumental to it! Maybe I can find out now? https://ioactive.com/pdfs/IOActive_Remote_Car_Hacking.pdf or https://insights.sei.cmu.edu/blog/vehicle-cybersecurity-the-jeep-hack-… That was such a time. It's sad that it was a security panic, to me, because there was incredible promise there... All of the cars infotainment, windows, interior lighting, HVAC, all these things are just DBus services hosted on QNX? And I can just connect to my car & modify them, in some cases even over the air? QNX & DBus could have been a huge selling point, could have been such an awesome way to debundle the car from its infotainment. If only. Really interested to see if DBus really does underpin much of QNX, or whether this was just a time & place. Seeing how monolithic versus networked QNX is in general would be fascinating; is there one or two QNX hosts & lots of devices, or so the story more distributed that that?

> Is there any realistic threat model under which the difference between 10 minutes and 70 minutes is the difference between "insecure" and "secure"? Time is given here just for an example. To crack systemd, it only takes 70 minutes, but in general, bruteforcing ASLR on 64-bit systems can take as few as 1.3 hours but as many as 34.1 hours, depending on the nature of bug. On the other hand, the ~20-bit of entropy on 32-bit systems is trivial to crack in 10 minutes for nearly all cases, and does not provide an adequate security margin. Oon a 64-bit system there is ~32-40 bit of ASLR entropy available for a PIE program. It forces an attacker to brute-force it. Unlike other protections, no matter how is the system cleverly analyzed beforehand, it taxes the exploit by forcing it to solve a computational puzzle. This fact alone, is enough to stop many "Morris Worm"-type remote exploitations (they have suddenly became a serious consideration, given the future of IoT), since an exploit takes months or years to crack a single machine. If it's not enough (it is not, I acknowledge ASLR by itself cannot be enough), an intrusion detection system should be used, and it already has used by many. For example, PaX offers an optional, simple yet effective anti-bruteforce protection: if the kernel discovers a crash, the `fork()` attempt of the parent process is blocked for 30 seconds. It takes years before an attacker is able to overcome the randomization (so the attacker is likely to try…

If you have a firewall appliance it probably has "TLS Inspection" (sometimes incorrectly referred to as "SSL Inspection"). You could setup PFSense [1] locally on the server to accomplish the same goals. Note that this is universally agreed upon to be a bad idea. [2] [3] [4] [5] [1] https://www.pfsense.org/ [2]https://www.schneier.com/blog/archives/2019/11/the_nsa_warns_o.html [3] https://media.defense.gov/2019/Nov/18/2002212783/-1/-1/0/MANAGING%20RI… [4] https://insights.sei.cmu.edu/cert/2015/03/the-risks-of-ssl-inspection.… [5] https://www.us-cert.gov/ncas/alerts/TA17-075A