Technology Review
Security technologies make compromising computers hard, but not hard enough.
Over the past decade, Microsoft, the target of choice for many online attackers, has hardened its operating system, adopting technologies designed to make it harder for attackers to find and exploit vulnerabilities. Apple and many other software makers have followed suit, introducing similar additional security measures to their operating systems.
Yet last week, during the "Pwn2Own contest" at CanSecWest, a security conference in Vancouver, Canada, security researchers demonstrated that software makers need to do more to protect their programs. Using previously unknown vulnerabilities, the researchers were able to compromise Apple's Safari, Microsoft's Internet Explorer 8, and Mozilla's Firefox Web browsers by circumventing the latest security technologies in place in the operating system underneath.
"These things make it hard--they really do," says Charles Miller, a principal analyst at Independent Security Evaluators and the researcher who circumvented the security of Apple's Safari browser and the Mac OS X Snow Leopard operating system underneath. "But, no matter what, a determined attacker can find a way in."
The results of the Pwn2Own contest underscore a truism in security: Defenders must be right all the time, but attackers only have to be right once. "The exploits are really creative; that's why they are tricky," Aaron Portnoy, security research team lead for TippingPoint, the security firm that sponsors the Pwn2Own competition.
Starting with its Trustworthy Computing Initiative in 2002, Microsoft began implementing a series of security technologies in Windows. First, the company protected "the stack"--the logical memory space used by programs to temporarily hold data. A technology called the "/GS flag" (after the software switch used in the company's compiler), prevented attackers from pushing their own code to the stack. But in 2003, David Litchfield, an independent researcher, demonstrated a way around the protection. Microsoft reacted by rolling out two more technologies: SafeSEH to address the attack using structured exception handlers (SEH), and address space layout randomization (ASLR), to make similar vulnerabilities more difficult to exploit in the future. Researchers have, however, found ways around both those protections.
Most recently, Microsoft brought out another technology, data execution protection (DEP), which prevents attacks that overwrite memory with code and then try to execute that code. But earlier this year, an independent researcher, Dion Blazakis, showed off an attack, known as JIT spraying, that uses vulnerabilities in other programs--most notably Adobe Flash and Sun's Java--to bypass those protections.
Security firm aims to make installing updates as painless and invisible as possible.
Google is developing a new computing platform equal to the Internet era. Should Microsoft be worried?
Companies are increasingly offering security products as services, but is it the best approach?
Manufacturing in the United States is in trouble. That's bad news not just for the country's economy but for the future of innovation.
This document is part of the “How-To Guide for Most Common Measurements” centralized resource portal. This tutorial provides a detailed guide for measurement and device considerations to take temperature measurements using thermocouples. Get an introduction to thermocouples, which are inexpensive sensing devices widely used with PC-based data acquisition systems. Also review some specific thermocouple examples and learn how thermocouples work and ways to integrate them into a data acquisition measurement system.
View full PDF >
Listen to story > 
On Twitter
Become a Fan on Facebook
Subscribe to the Feed
Mapou
357 Comments
Software Is Very Bad and Getting Worse
Informative and nicely written article. This is just a continuation of an old malaise that has been around for decades. Microsoft is paying the price for bad software and so is Toyota and everybody else. Software unreliability is much more costly than is commonly assumed. Consider that if we could develop complex software that never breaks, we could automate the entire transportation system. Vehicles would drive themselves, a technology that would eliminate over 40,000 traffic fatalities on US roads alone. How much more pain are the industry and the world willing to endure before they finally realize that the problem is in our flawed algorithmic software model?
The problem with the algorithmic model of computing (aka the Turing Computing Model) is that timing is not an inherent and fundamental part of it. This is a monumental mistake. Almost everything that ails the computer industry, from the reliability and productivity crises to the parallel programming crisis, can be traced to this. Why then are computer scientists clinging to such a hopelessly flawed paradigm?
All other behaving systems, from brains to electronic logic circuits, rely on precise timing at their most fundamental level. Software, too, is a behaving system. So why should it be an exception to the timing rule? In my opinion, computer scientists have gotten us into the mess that we are in. We are drowning in an ocean of programming languages, a sure sign of immaturity. But it doesn't have to be that way. There is a way to build and program computers that will solve all these nasty problems once and for all. The prevailing doctrine notwithstanding, it is possible to have unbreakable and bug-free software regardless of complexity. It is time to abandon the flawed and failing models of the last century and forge a new future.
Read Computer Scientists Created the Parallel Programming Crisis if you want to find what we can do to heal computer science.
Reply