Security and Open Source: the 2-Edged Sword Crispin Cowan, Ph.D WireX Communications, Inc wirex.com

Reliability and Security Reliable software does what it is supposed to do.Secure software does what it is supposed to do … and nothing else. –Ivan Arce Security is very simple: only run perfect software … Oh, so we need a ‘plan B’. –Crispin

Open Source and Security: a 2-Edged Sword Open source gives greater power to analyze software for security … for good or bad –Attackers get enhanced capability to find holes to exploit –Defenders get enhanced capability to find holes to close So if you do nothing then Open Source is dangerous But if you leverage what Open Source gives you, then it is a defender’s advantage –… and there are tools to help you

Security Enhancing Tools for Software Code Auditing: static or dynamic analysis of programs to detect flaws, e.g. ITS4 and friends Vulnerability Mitigation: compiled in defense that block vulnerability exploitation at run-time, e.g. StackGuard and friends Behavior Management: OS features to control the behavior of programs Classic: mandatory access controls Behavior blockers: block known pathologies

Security Enhancing Tools and Open Source Most of these tools operate on source code Proprietary systems: –Only the vendor can apply the tools –Users must accept vendor’s level of diligence Open source systems: –Users can raise the level of diligence themselves –Motivated vendors can sell the same system (e.g. BSD, Linux) with higher levels of diligence (e.g. OpenBSD, Open Wall Linux, Immunix) Paper: to appear in the new IEEE Security and Privacy magazine

Way Too Reasonable … time to get outrageous :-)

“Buffer Overflows: We’re Past That” We’ll be “past that” when buffer overflows stop being a majority of all CERT advisories We’ll be well past it when buffer overflows slip from the #1 position (plurality) of CERT advisories

“Full Disclosure Zealots” Perhaps the zealots have a point... “Timing the Application of Security Patches for Optimal Uptime” –Crispin + WireX staff + Adam Shostack –USENIX LISA eattie.html

Main Result: When To Patch Not never: you’ll get hacked Not immediately: patch might be buggy As time advances –Chance of getting hacked rises –Chance of patch being buggy dropsOptimize Bad patch risk Penetration Risk

Hidden Result: “Responsible Disclosure” Does Not Help Some Microsoft security advisories politely acknowledge the “investigators” who reported the bug –Done only when the investigator cooperated with Microsoft With 93% confidence interval, “acknowledged” security patches are more likely to be defective than unacknowledged patches Conjecture: “responsible” disclosure does not help, and may in fact hurt