Thread by @dotMudge

A few weeks back the non-profit group CITL, cyber-itl.org, released a comparative report of software hygiene in 28 home routers...

and vulnerabilities that affect all Linux MIPS systems (not just IoT).

Some thoughts and data...

(Thread 1/N)

cyber-itl.org/2018/12/07/a-l…

This thread intends to get past some security nihilism, use data to refute some assumptions put forward by people as “facts”, and point out the big picture... which the security community largely missed.

Something about not being able to see the forrest through the trees ;)

2/

Let’s look at the router paper first.

cyber-itl.org/assets/papers/…

It’s true that none of the routers did well in regards to basic software safety hygiene, but thinking there’s nothing consumers can do is security nihilism and misses the actionable information in the paper...

If security hygiene is important to you:

1) Avoid Linux MIPS systems if possible (eg choose AARCH64).

2) Choose a system that did better than their competitors (next tweets in thread)

3) Perform your own simple measurements as tribal knowledge is often wrong.

In the Consumer Reports 2018 Home Router Buying guide, CITL, measurements showed that the Netgear r7000 did better than the others in software safety features.

Not great, but better than the others.

Across a collection of other ‘Best of 2018’ home router lists (CNET, PCMag, Trust Compass, and Consumer Reports), the Linksys WRT32x had the best marks.

Although still admittedly low compared to what one would hope for.

Some put forward statements that feel/sound true, but data shows are false. An example is “ARM is more common than MIPS in the home router field now”.

From measurements across 3000+ home router images MIPS is still the dominant architecture.

Another comment put forward was, essentially, that ‘vendors/developers do not ship software with known coding vulnerabilities like gets() etc’.

In fact CITL call graphs showed that out of 18 vendors, 15 still have binaries that call gets().

That’s over 80%. Yikes!

Looking at calls to system() as a security hygiene indicator is equally scary.

Of course one can expect correlation between poor function hygiene given a lack of basic safety awareness (DEP, ASLR, source fortification, RELRO, etc.).

With the MIPS bug(s) a lot of people focused on whether ASLR and DEP are “very important”, or “just important”.

What amazed me was that Linux MIPS Kernels from 2001-2016 lacked *any* Data Execution Prevention and 2016 onward have a universal DEP and ASLR bypass:

NOBODY NOTICED

The CITL team shares their research and work with me, which I appreciate, and I’m struck by two things:

1) they look for hundreds of features that relate to security/safety hygiene in every binary they analyze.

2) for the vast majority of the software industry this is overkill.

Vendors understand unit testing for product functionality but seemingly lack this awareness for the most basic safety/security build settings.

Modern software/systems need to check DEP, ASLR, Stack Guards, etc., the same way automobiles verify they have seatbelts and airbags.

You don’t have to look for all of the complex things the people at CITL do behind the scenes.

Just looking for basics will show you that the world is often very different from what people think it is. This includes security practitioners and a ‘common tribal knowledge’.

To end:

If you can’t/don’t measure it, you will make (incorrect) assumptions.

Product measurements are more helpful when quantitative, to allow comparison, rather than pass/fail or ‘certified’.

Put unit tests in to avoid unintentionally shipping without airbags, seatbelts, etc

P.S.

All of the Linux MIPS router images that the CITL folk looked at were vulnerable...

Even the vendors who stated that they didn’t think their Linux MIPS systems were affected.

So far there aren’t any unaffected Linux MIPS systems.

:/

PPS:

In total it was over 6000 images.

And dang it, I meant to tag @m0thran in the first tweet of the thread.

He is behind this (in my opinion) very impressive work over st CITL.