Behind the Masq: Yet More DNS and DHCP Vulnerabilities

Re:Behind the Masq: Yet More DNS and DHCP Vulnerabilities by peterwwillis on Monday October 02, 2017 @02:31PM (#15386476)

If nobody has announced it, and there are no known exploits in the wild, it's not public. It could be available on 0day marketplaces, but that doesn't mean it is being widely used. It's probably less likely to be widely used if it's a valuable 0day.

But this isn't about shutting off a service to protect a company's bottom line. This is a vuln affecting consumer devices. SLA has nothing to do with it. People's home networks and devices, not to mention a myriad number of embedded devices and sensors all over the world, are going to be affected by this - not corporations protecting customer data. Affected consumers have no means to patch themselves. Releasing this before vendors could generate patched packages or firmware is just monumentally irresponsible.

[ Parent | on HN ]

Re:Behind the Masq: Yet More DNS and DHCP Vulnerabilities by tptacek on Monday October 02, 2017 @02:40PM (#15386582)

This is ostrich logic. With our heads comfortable buried in the sand we don't have to consider that we're routinely being owned up by vulnerabilities Google hasn't yet published (we are, by the way). Not only that, but when Google does get around to publishing a vulnerability, we're not even obliged to patch it ourselves; rather, we blame Google for publishing.

This would be preposterous reasoning if it weren't overwhelmingly normalized in our industry. It's an embarrassment for the whole field.

[ Parent | on HN ]

Re:Behind the Masq: Yet More DNS and DHCP Vulnerabilities by peterwwillis on Monday October 02, 2017 @04:23PM (#15387583)

I'm not against people patching things themselves. But my grandmother can't apply patched source code to the firmware for her Belkin cable modem. And I sure as hell can't patch the firmware for my carrier's locked Android phone. My Smart TV is probably just fucked. If these vendors were contacted before release, they may be able to keep people safe at publishing time.

What you seem to be suggesting is that we should simply all disconnect from the internet until vendor patches can be prepared, the reason being it's better to stop any potential and unknown exploits going on now, than stop the hundred-fold new exploits that absolutely will follow its public announcement.

[ Parent | on HN ]

Re:Behind the Masq: Yet More DNS and DHCP Vulnerabilities by viraptor on Monday October 02, 2017 @05:44PM (#15388224)

> If these vendors were contacted before release, they may be able to keep people safe at publishing time.

You mean if hundreds of the popular vendors were notified for a coordinated release? And you think that's not making the exploit effectively public? Even skipping possible monitoring of emails, I don't expect that the set of blackhats and employed security engineers have no common elements.

[ Parent | on HN ]

Re:Behind the Masq: Yet More DNS and DHCP Vulnerabilities by abugher on Tuesday October 03, 2017 @02:43AM (#15390635)

Good point. Does that mean there should be zero coordination? What about coordinating with the security teams for a few big Linux distributions? That would be a much smaller list of people, and might make it easier/quicker for some commercial vendors to get fixed once the public announcement is made.

[ Parent | on HN ]

Re:Behind the Masq: Yet More DNS and DHCP Vulnerabilities by irundebian on Tuesday October 03, 2017 @10:10PM (#15397780)

The problem is that we don't have any laws forcing vendors to keep their products (smartphones, TVs, embedded (networking) devices up to date. It's high time to change that.

[ Parent | on HN ]