28c3: The Science of Insecurity

Download high quality version: http://bit.ly/uSJPUL
Description: http://events.ccc.de/congress/2011/Fahrplan/events/4763.en.html

Meredith L. Patterson, Sergey: The Science of Insecurity

Why is the overwhelming majority of common networked software still not secure, despite all effort to the contrary? Why is it almost certain to get exploited so long as attackers can craft its inputs? Why is it the case that no amount of effort seems to be enough to fix software that must speak certain protocols?

The answer to these questions is that for many protocols and services currently in use on the Internet, the problem of recognizing and validating their "good", expected inputs from bad ones is either not well-posed or is undecidable (i. e., no algorithm can exist to solve it in the general case), which means that their implementations cannot even be comprehensively tested, let alone automatically checked for weaknesses or correctness. The designers' desire for more functionality has made these protocols effectively unsecurable.

In this talk we'll draw a direct connection between this ubiquitous insecurity and basic computer science concepts of Turing completeness and theory of languages. We will show how well-meant protocol designs are doomed to their implementations becoming clusters of 0-days, and will show where to look for these 0-days. We will also discuss simple principles of how to avoid designing such protocols.

Category:

Science & Technology

Tags:

• 28c3
• ccc
• Meredith L. Patterson
• Sergey
• Science
• Insecurity

[ssyreeni]

Uhm, a fixed width length field most certainly does not make a protocol context sensitive, but only blows up the (D)FA needed to recognize it. On the other hand I'm reasonably sure context sensitive grammars won't cut something like Elias codes. Otherwise, Patterson's ideas are a beautiful formalization of what I've been saying for the longest time: validate first, then compute with minimal checks. Kudos!

[beatsnbleeps]

@sTL45oUw Unfunny troll is unfunny. Go rate more kawasaki movies pls. We need your expertise there.

[dt9394]

I fall asleep with this video... Worst than my lecturer...

[sTL45oUw]

"Blackhat 2010 Exploiting the forest with trees"

Same BS talk just from last year and at blackhat

Who let this academic talk at a hacker con ? She doesn't get it

[sTL45oUw]

I've heard this lesbian looking hoe, talk about this last year or even some years ago.

She obviously tries to look smart but despite her extensive knowledge she offers neither wisdom nor clarity.

My conclusion she is ugly and not funny. She attempts to be like all /b/ but actually she should be killed with fire.

[Lethn]

@GIMBLUTAXT LOL Me too!

[hikingpete]

Thank you. This has really opened my eyes. I'll never look at a parser the same way again.

[GIMBLUTAXT]

Meredith really reminds me of Amy Farrah from the big bang theory.

[funkycoder1]

"*chough* ASN.1 *cough*" ♥

[telakin]

@Jibes tinyurl_com_7x2zawj