I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic [LWN.net]

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 20, 2016 21:26 UTC (Wed) by PaXTeam (guest, #24616)
In reply to: I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic by david.a.wheeler
Parent article: Dutch consumer group sues Samsung over Android updates (OSNews)

what's the point of this metric?

to post comments

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 20, 2016 21:58 UTC (Wed) by Wol (subscriber, #4433) [Link] (11 responses)

Quite a lot. It says whether the vendor is serious about security!

Basically it says "on average a vulnerability is discovered every X days. It takes Y days on average to fix it. Is X greater or less than Y?"

If X is less than Y, then your phone is likely to be permanently vulnerable. If X is greater than Y, then your phone is secure at least some of the time. Yes I know we'd rather it was all of the time, but at least we know they're *trying* to do the right thing.

Cheers,
Wol

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 20, 2016 22:28 UTC (Wed) by PaXTeam (guest, #24616) [Link] (10 responses)

why would a phone be secure on those days when the public doesn't know about a particular vulnerability? doesn't that only describe the public's unawareness but not the security of their phones?

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 21, 2016 0:19 UTC (Thu) by FLHerne (guest, #105373) [Link] (3 responses)

If the maintainers didn't fix a bug because they didn't find it for a few years, that doesn't say much about their general attitude to security. They might have crap code and no testing, or it might have been some really obscure edge-case in an otherwise good project.

On the other hand, if a serious vulnerability is left unpatched for more than a few days _after_ the maintainers are told, you know _for sure_ not to rely on them for security. No excuse for leaving a hole when you know it's there.

---

Also, bugs exploited by widespread malware get reported fairly quickly by reverse-engineering the malware. So the number of publically-known bugs should track the number known to typical malware authors with a few weeks/months' delay.
That's not true for targeted, inconspicuous malware as deployed by governments, but few users complain about that.

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 21, 2016 1:16 UTC (Thu) by PaXTeam (guest, #24616) [Link] (2 responses)

> They might have crap code and no testing, or it might have been some really obscure edge-case in an otherwise good project.

that distinction would say very much about that attitude to security. however i don't see how the suggested metric helps here.

> if a serious vulnerability is left unpatched for more than a few days _after_ the maintainers are told, you know _for sure_ not to rely on them for security.

except for certain individuals or teams with single-digit member counts no entity can turn fixes out that fast so it's still not a useful metric because it would make most entities unreliable. and i still don't see how a phone becomes secure on those days when the public is unaware of any particular vulnerability.

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 21, 2016 11:42 UTC (Thu) by jospoortvliet (guest, #33164) [Link] (1 responses)

As was pointed out, the metric is not meant to make phones more secure. Just to show how quickly vendors react to known security issues - one aspect of security, among many. I think it is a great idea.

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 21, 2016 11:50 UTC (Thu) by PaXTeam (guest, #24616) [Link]

compare your

> As was pointed out, the metric is not meant to make phones more secure.

with Wol's

> If X is greater than Y, then your phone is secure at least some of the time.

clearly there's disagreement already on what this metric is supposed to mean.

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 21, 2016 11:00 UTC (Thu) by dunlapg (guest, #57764) [Link] (5 responses)

why would a phone be secure on those days when the public doesn't know about a particular vulnerability? doesn't that only describe the public's unawareness but not the security of their phones?

There's a difference between "public vulnerability" and "private vulnerability". Yes, if there's a vulnerability on your phone, then you are vulnerable, even if that vulnerability has not been published. But the information is not public yet, then the only people who know about it are 1) people who have done the hard work of discovering the bug for themselves, or 2) people who have paid for it (or otherwise acquired it); that's likely to be a very small number of people. The value of a "private vulnerability" (AKA 0-day) lies in the fact that nobody knows about it; every time you use it, every person you tell about it, increases the probability that it will be discovered and patched. So people with a private vulnerability are likely to be careful in the way they use it, to maintain its value.

Only a few people can use a private vulnerability, and they have an incentive to use it very selectively, so your risk from a "private vulnerability" is there, but relatively low (unless you're a high-profile target).

In the case of a "public vulnerability", the tables are turned. The vulnerability can be exploited not only to the small number of people who either discovered it or bought it, but to anyone with a basic technical competence. And since it's already public, the optimal behavior is no longer to only use it on select, high-profile targets, but to try to exploit as many people as quickly as you can before it gets patched.

Millions of people can use a public vulnerability, and there's an incentive to use it indiscriminately; so your risk from a public vulnerability is very high, no matter who you are.

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 21, 2016 11:59 UTC (Thu) by PaXTeam (guest, #24616) [Link] (4 responses)

maybe my question was ambiguous, but by 'the public' i meant those who would be potential targets, not threat actors. you were describing the latter, not the former, so let me rephrase my question: why would a phone be secure on those days when the potentially victimized/targeted public doesn't know about a particular vulnerability?

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 21, 2016 15:04 UTC (Thu) by dunlapg (guest, #57764) [Link] (3 responses)

I think I answered that in my post.

You're insisting on using the word "secure" like it's a binary thing. It's not. Do you lock the door to your house? Probably. Do you put bars on your windows? Probably not, unless you live in a particularly bad area. So if you lock your doors but don't have bars on your windows, are you "secure"? Well, that's the wrong question; the question is, "What is your level of risk, and is it acceptable?"

On days when a vulnerability exists, but it has not been made public, the risk to the average member of the public is fairly low (for reasons I cover in my previous post). On a day when a vulnerability exists but has been made public, the risk is pretty high. The proposed metric says, "What percentage of days in the last year have you been at high risk?"

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 28, 2016 1:10 UTC (Thu) by nix (subscriber, #2304) [Link] (2 responses)

Of course, for houses there are extra rules. I'd be very happy indeed to throw out the (known-horribly-vulnerable) front door lock on my house and replace it with something tied to a Yubikey Neo's near-field one-time passwords, talking to an authentication server in an embedded box attached to the inside of the door or something like that. But even if I had the skills to do that, I couldn't: my mortgage is tied to house insurance, and no insurer on the planet will insure a house that uses some advanced techie thing rather than a lock.

(But then, it fundamentally doesn't matter that front door locks are insecure -- an attacker who actually wanted to break in could just wait until you go out and go in through the window, and more or less nobody bars their windows to prevent this attack because not feeling like you're living in a prison is generally more important than security against such determined bad actors, particularly given that your stuff probably *is* insured, so a robbery, while very unpleasant, is unlikely to be devastating. I guess the analogue of this for computing is backups to protect against wiping and encryption to protect against theft of secrets -- but this doesn't work very well because with computers the bad guy can lurk over your shoulder, undetected, and steal/wipe all your stuff as soon as you unlock it, something very unlikely to happen in the physical world until they invent invisible burglars.)

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Jan 28, 2016 20:17 UTC (Thu) by johannbg (guest, #65743) [Link] (1 responses)

"something very unlikely to happen in the physical world until they invent invisible burglars."
Those are called ninjas and have been around since sometime between the 12th and 15th centuries ;)

I'd like to see "% days vulnerable to publicly-known vulnerabilities" as a smartphone statistic

Posted Feb 10, 2016 20:11 UTC (Wed) by nix (subscriber, #2304) [Link]

That's only relevant if ninjas rob houses often enough for insurance companies to consider them in their policies. If they do where you live, I don't think I want to live there. :)