It’s been three months now, and the triage has moved beyond the panic phase. The powers that be have thrown resources to look at the state of OpenSSL and they have released a report and a roadmap of how to fix it. Google has decided it can’t be fixed.<\/p>\n
In a rational world, OpenSSL should have been the most tightly controlled and monitored “Open Source” product there is, given that it is protecting the privacy of communications and essential to make sure you are connecting to the real secure web server.<\/p>\n
The value to a hacker was not so much the possibility of finding a private encryption key as it is that OpenSSL is used on most non-Microsoft web servers and it invisibly leaked random chunks of memory.<\/p>\n
This vulnerability was only found because two people – one at Google and another former Microsoft Internet Police Officer went looking for a problem.<\/p>\n
The report is that OpenSSL has
\n– no code review process
\n– no coding standards
\n– no process to approve new features
\n– inaccurate or non-existent documentation
\n– secret undocumented APIs
\n– bug reports that nobody is investigating<\/p>\n
Every few days, I have Fedora check for software updates. Yesterday, the web server updated 35 products with new versions. How do I know that the update to Python doesn’t have a new vulnerability put in by accident or on purpose? “Just trust me”<\/p>\n
One of the first things that was done was a code audit – using software tools to automatically search for coding errors – it found other significant errors and vulnerabilities.<\/p>\n
Another major freeware (but not open source) encryption product called TrueCrypt decided to kill itself when faced with the prospect of a second more rigorous code audit – and admitted to having unfixed security vulnerabilities. Snowden used TrueCrypt – so far, no law enforcement agency has succeeded in breaking into a TrueCrypt volume unless they are given the password<\/p>\n
Locks on doors are designed to keep honest people out. If people want to break the law to get in, you can’t design a door strong enough to stop them. While you’re busy installing 4 inch thick armor on the door, they’re cutting a hole in your roof and coming in through the attic.<\/p>\n
When war between governments officially moves onto the Internet, we’ll find out just how many Trojan horses full of enemy soldiers we invited behind our defenses because we believed in free stuff.<\/p>\n","protected":false},"excerpt":{"rendered":"
It’s been three months now, and the triage has moved beyond the panic phase. The powers that be have thrown resources to look at the state of OpenSSL and they have released a report and a roadmap of how to … Continue reading