Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica) [LWN.net]

Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

Posted Apr 25, 2015 16:32 UTC (Sat) by ibukanov (subscriber, #3942)
In reply to: Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica) by wahern
Parent article: Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

> there'll never be a perfect, bug-free solution.

Bugs themselves do not matter, the important metric is the scale of their consequences. If some library/framework/language leads to 10 times more bugs but those at worst leads to abort() calls, it is still a good tradeoff if it protects from arbitrary code execution bug.

to post comments

Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

Posted May 6, 2015 11:02 UTC (Wed) by nix (subscriber, #2304) [Link] (5 responses)

It *very* much depends on the application whether ten denial of service attacks are better or worse than one arbitrary code execution (though of course an attacker could leverage the latter into the former, it is not a *guarantee*, so it may be that the tradeoff is better. Service guarantees for existing users sometimes matter a lot more than a guarantee that a single bad actor can't get away with anything.)

Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

Posted May 6, 2015 11:59 UTC (Wed) by PaXTeam (guest, #24616) [Link] (4 responses)

a failed code execution attempt will result in a DoS otherwise it's worse than DoS (if you worry about the set then by definition you worry about any subset as well, it's simple logic). and in case of successful code execution there're no 'service guarantees' either.

Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

Posted May 6, 2015 23:23 UTC (Wed) by cesarb (subscriber, #6266) [Link] (1 responses)

> a failed code execution attempt will result in a DoS otherwise it's worse than DoS

Not necessarily. For instance, the attacker might succeed in overwriting some data which later isn't used at all, or is used in a harmless way.

Perhaps the code being attacked was something like "if the value at this field is 7, that other field is a function pointer you should use right now, else do nothing; after that, reinitialize all the fields with valid data from elsewhere", and the attacker misaligned the padding and wrote 7 to the wrong field (suppose for the sake of argument that the vulnerability being used doesn't allow for a write outside the object bounds, or a write at any other time than just before that test for 7, and there's no multithreading involved). Unless the attacker hits the correct field with a 7, we have a failed code execution, but which doesn't result in a DoS.

Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

Posted May 6, 2015 23:42 UTC (Wed) by PaXTeam (guest, #24616) [Link]

a failed code execution attempt is when the redirected code execution flow doesn't hit the intended target and tries to execute unmapped memory or unintended instructions that will very likely crash in short order. modifying data is not 'code execution attempt' per se, there has to be a moment when intended control flow is hijacked.

Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

Posted May 9, 2015 21:48 UTC (Sat) by nix (subscriber, #2304) [Link] (1 responses)

In the case of a successful code execution there are indeed no guarantees, but by this point you are simply left asking: is your typical attacker interested in crashing us, or in spying on us or sending spam through us? And with the exception of ransomware the typical attacker would like to either remain unnoticed or keep the system working well enough that he can do his nefarious deeds. So it is *quite likely* that the thing will still be working.

To give a limit case of sorts, I would be very unhappy to fly in a jet with an avionics system vulnerable to arbitrary code execution, but if I had to, I'd hope like hell that any attacker was going to parlay his arbitrary code execution attack into something *other* than a DoS. In this sort of situation DoSes really are strictly worse: even though in terms of *attack classes* they are a subset of arbitrary code execution attacks, in terms of consequences they are very much not. I don't care if the aircraft I am on is sending spam or has someone peering through its cameras. I do care very much if it falls out of the sky.

Wi-Fi software security bug could leave Android, Windows, Linux open to attack (Ars Technica)

Posted May 9, 2015 22:13 UTC (Sat) by PaXTeam (guest, #24616) [Link]

real life examples are a very bad match to the digital world, yours is no exception. you're conflating an attack on a computer system with possible effects of that computer system on the real world. of course that can be set up in arbitrary ways so it is quite pointless to try to prove a point since you might as well prove the exact opposite with the same example (would you not have preferred a DoS if it was flight 11 or 175?).