The latest high-profile hacks result from benign neglect, and won't be the last
Oct 24th 2014 |The Economist | Science and technology
HEARTBLEED. Goto Fail. Shellshock. POODLE. These are the inscrutable monikers of this year's crop of overlooked errors in widely distributed software programs. Each represents a little digital thread, the pulling of which exposed vulnerabilities in devices numbering into the hundreds of millions. Such dizzying numbers arise from the many different bits of specialised software running on so many interconnected devices, allowing the tiniest security gap to be prised open.
If you are the sort to worry about this kind of thing, the worrying part is that they are the tip of the iceberg. The slickly safe-seeming software that has inveigled itself so completely into modern society is largely built upon computer code written decades ago that acquired new uses and features as an old house acquires coats of paint. One of these errors remained in place for 22 years before being discovered. Exploits, in the parlance, of this holey code have peppered the history of consumer electronics.
Windows was once the planet's dominant operating system and remains the most visible. But Unix, another contender with roots in the 1970s, has outpaced it in two exponentially growing markets. Mobile phones and tablets running the Unix-offshoots Android and Apple's iOS platform make up one of them. Somewhat more behind the scenes are so-called embedded devices: set-top boxes, home routers, smart television sets, gaming consoles and even quite a few refrigerators, all running a descendant of Unix.
But tucked within the sprawling bits of code in these gizmos is a great deal of cruft—vestigial programs and routines that perhaps have no function in a router or a smartphone, but that ostensibly are not doing any harm. This digital analogue of the human appendix can flare up, though, if it is identified as a potential exploit, as this year's crop demonstrates.
Heartbleed relied on a programming error introduced in OpenSSL, which is behind widely used web server software. With a little effort, a remote attacker could retrieve the keys to the castle of secure web connections, deciphering data that browsers and servers had encrypted. Goto Fail made devices running Apple's mobile and desktop software accept bogus web security credentials. Shellshock tugged at a 22-year-old thread in a piece of software called "bash," which permits administrators unfettered access to tell a system what to do; the exploit made benign-seeming server requests into a full command-and-control situations. Bash may be installed on a billion or more devices, most of which are not thought of as computers (this diversity of devices is probably what kept the exploit from bashing every one of the billion).
POODLE was another exploit based on web encryption, finding a hole in a version of software called SSL that had been superseded back in 1999. But because of the continued use of Microsoft's long-outdated Windows XP in not-fully-updated versions, some installations of Internet Explorer 6 could be forced to use the outdated security protocol, giving a hacker access to traffic to and from a web server.
Each of the four problems may seem particular, but they all stem from inattention. The sheer amount of software in use, even on "simple" devices that carry out a single task or two, is overwhelming. As Matthew Green, a cryptography researcher at Johns Hopkins University, puts it, "nobody knows all the features, let alone all the bugs."
The heartening news is that all four were first spotted by security experts, not the bad guys. Exploits that make the news bring attention and funding to efforts such as the OpenSSL Project, a bid to bring the SSL code out of the shadows and collaborate on cleaning it up. But even when attention is paid, the persistence of outdated kit leaves vulnerabilities in place. Many embedded devices, as well as older releases of Android and iOS software, simply cannot be updated—or the owners may lack the skill to update them. For those cases, the only solution that may work is simply to cut off access; in the wake of the POODLE exploit, for example, some Internet Explorer 6 users may be unable to reach some websites. Perhaps your refrigerator will be booted off the web too.
中文版
