Quality and security. Two words that share an interesting relationship and no small amount of confusion.

What is certain is that both words are meaningful in the context of software. Quality essentially means that the software will execute according to its design and purpose. Security means that the software will not put data or computing systems at risk of unauthorized access. While quality seems to be easier to measure, both are somewhat subjective in their assessment.

The real confusion comes when you consider the relationship between quality and security. Are they the same thing or is one a subset of the other? If I have quality, does that mean I’m also secure? Are quality problems also security problems or vice versa?

Defining quality and security defects

For those who take a holistic view of software design and development, quality and security issues both fall into the broad category of defects. BusinessDictionary.com defines a defect as a “frailty or shortcoming that prevents an item from being complete, desirable, effective, safe, or of merit, or makes it to malfunction or fail in its purpose.” For example, I can use a fuzzing tool to test software by essentially bombing the software with randomized input data. This process may force the software to respond in a manner that is not within the predefined parameters for the execution flow. Applying the definition of “defect”, the software malfunctioned or failed in its purpose. This would be a defect and would fall into the category of quality.

Determining if the defect has a security component will take more digging. If I can demonstrate that exploiting this issue in some way to gain unauthorized access to data or the network, then this would also fall under the category of security. It is entirely possible that the defect may simply be a logic issue and, while potentially annoying, does not create an exploitable vulnerability.

Based on my scenario above, we can then draw the conclusion that security is a subset of quality.

Or maybe not.

Clarifying the misunderstandings between quality and security

A simple coding bug such as cross-site scripting (XSS) may counter our argument. The developer can code the software within adherence to the requirements and still make the code vulnerable to an XSS attack. The associated defect would be security related, but does reflect a defect from a quality point of view. Many would argue that a security vulnerability is a quality problem. I could easily get behind that line of reasoning, but others would invoke the stricter interpretation. This disabuses the notion that security is a subset of quality.

Part of the misunderstanding between quality and security was that the two were functionally separated in traditional development shops, and the groups that owned them rarely interacted. Quality was the purview of the quality assurance team, who normally resided somewhere in the development organization. This team provided quality assurance and testing services to the developers. Security was handled by the security folks within IT. In many organizations, the relationships with development were not well-defined and even more poorly executed. IT Security and QA could have existed on separate planets and not known the difference.

What the two groups shared was that they were often viewed as a hindrance to development. When a defect was discovered by either QA or IT Security, developers were forced to stop what they were doing and remediate the code. The constant stream of interruptions had a predictable effect on development and the attitudes of the developers. QA and IT Security shared one common bond—they were viewed as an impediment to progress by the developers.

Combining quality and security to enable the developer

As development practices have evolved and agile methods continue to take root, the traditional quality and security silos have had to come down by necessity. Security is being integrated into the development process with the notion of enabling developers to build good security practices into their code. Similarly, the responsibility for quality is now shared by the developers. There is also higher awareness of the architecture, design, and requirements process and how that process affects quality and security.

From a manufacturing angle, defects are viewed as non-conformance with specified requirements. This raises the ever-present question of whether the organization should integrate security into the architecture and design process or take a “test and patch” approach to software security. This is a subject I have touched on in earlier columns, noting that 50% of security defects are flaws that have their genesis in the architecture and design phase. The other 50% of security issues result from the development process and are called “bugs.”

Broadening the quality and security perspective

In the end, quality and security are critical components to a broader notion: software integrity. Which one gets the most emphasis is in the eyes of the beholder? For example, if you were building the Mars Rover or a self-driving car you would want to ensure that the software on board was of the highest quality. If you were writing a banking application or software for a medical device, security would be a strong driver. Neither case is mutually exclusive, so there will be elements of both.

Ultimately, developers strive to develop the best software possible. This implies that defects—quality and security—should be minimalized, or, at best, eliminated. If we agree that quality and security problems are both a form of defect, then we must sufficiently address both to produce software of the highest integrity.

Jim Ivers is Senior Director of Marketing for the Software Integrity Group at Synopsys. Jim is a 30-year technology veteran who has spent the last ten years in IT security. Prior to Cigital, Jim was the CMO at companies such as Covata, Triumfant, Vovici, and Cybertrust, a $200M security solutions provider that was sold to Verizon Business. Jim also served as VP of Marketing for webMethods and VP of Product Management for Information Builders.

Previous Columns by Jim Ivers:

Tags:

More than 8 million websites could be exposed to a buffer overflow vulnerability in Internet Information Services (IIS) 6.0 that has been exploited in the wild since July 2016, researchers warn.

The bug was found in the ScStoragePathFromUrl function of the Web Distributed Authoring and Versioning (WebDAV) service in Windows Server 2003 R2’s IIS 6.0. The issue, tracked as CVE-2017-7269, resides in the improper validation of an ‘IF’ header in a PROPFIND request and could allow an attacker to cause denial of service or to run arbitrary code.

Discovered by two researchers with the Information Security Lab & School of Computer Science & Engineering, South China University of Technology Guangzhou, China, the vulnerability was exploited in the wild in July or August 2016. This week, the researchers published a proof-of-concept on GitHub and revealed that Microsoft has already acknowledged the bug.

The WebDAV extension of the HTTP protocol allows clients to perform remote Web content authoring operations, offering support for new HTTP methods, including COPY, LOCK, MKCOL, PROPFIND, and UNLOCK.

The exploit abuses the PROPFIND method and IF header. The former, Trend Micro’s Virendra Bisht explains, “retrieves properties defined on the resource identified by the Request-URI” and is supported by all WebDAV-Compliant resources, while the latter “handles the state token as well as the ETags.”

According to Bisht, “the vulnerability could be exploited with an overly large ‘IF’ header in the ‘PROPFIND’ request with at least two http resource in the IF header.” The researcher also explains that, while successful attacks could lead to remote code execution, unsuccessful attacks could sometimes lead to denial of service conditions.

Data from W3Techs reveals that Microsoft’s IIS is currently the third most popular web server technology out there, powering 11.4% of all websites. While newer versions of Microsoft’s technology are more popular, IIS 6.0 still accounts for 11.3% of the IIS-powered websites, which results in 1.3% of all websites out there being powered by this version.

According to BuiltWith, however, IIS powers 13.8% of all live websites, while the IIS 6.0 version is used by 2.3% of the entire Internet. This means that over 8.3 million live websites are using IIS 6.0, including tens of thousands of the most popular sites out there. However, the number is constantly dropping.

Disabling the WebDAV service on the vulnerable IIS 6.0 installations can mitigate the risk posed by this vulnerability, Trend Micro’s researcher says. The flaw does not affect newer versions of IIS.

Because IIS 6.0 was included with Windows Server 2003, an old operating system version that is no longer supported by Microsoft, it’s unlikely that a patch will be released for this zero-day.

“Nobody should be running IIS 6 in 2017. This is unsupported and unsafe software and must be upgraded ASAP," Craig Young, Prinicpal Security Researcher for Tripwire, told SecurityWeek. "All vulnerabilities in this software are going to be zero-day forever and while there may be mitigations for this attack, it is incredibly risky to run obsolete software on the Internet.”

"This issue does not affect currently supported versions. We continue to recommend that customers upgrade to our latest operating systems and benefit from robust, modern protection,” a Microsoft spokesperson told SecurityWeek in an emailed statement.

Related: OpenSSL Patches TLS Flaw Exposing Many HTTPS Servers

Related: Shadow Brokers Now Selling Windows, AV Exploits in ZeroNet Marketplace

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

VMware has released updates and patches for its ESXi, Workstation and Fusion products to address critical and moderate severity vulnerabilities disclosed at the Pwn2Own 2017 competition.

Pwn2Own participants earned more than $200,000 this year for exploits involving VMware virtual machine escapes. Researchers at Qihoo 360 earned $105,000 for an Edge exploit that achieved a VM escape, and Tencent Security’s Team Sniper received $100,000 for a Workstation exploit that leveraged two vulnerabilities.

According to VMware, the Qihoo 360 team leveraged a heap buffer overflow (CVE-2017-4902) and an uninitialized stack memory usage in SVGA (CVE-2017-4903) that allow an attacker in the guest operating system to execute code on the host.

One of the security holes exploited by Team Sniper is an uninitialized memory usage issue (CVE-2017-4904) in the XHCI controller that can be exploited to execute code on the host from the guest OS.

The second flaw disclosed by Team Sniper at Pwn2Own, rated “moderate severity,” is an information leak weakness also caused by uninitialized memory usage (CVE-2017-4905).

The flaws affect ESXi 6.0 and 6.5, Workstation 12.x on all operating systems, and Fusion 8.x on OS X. CVE-2017-4904 and CVE-2017-4905 also affect ESXi 5.5, but the former can only be exploited for denial-of-service (DoS) attacks and not code execution.

Mozilla has also patched a Firefox vulnerability disclosed at Pwn2Own. However, the organization addressed the security bug within a day after it was presented at the hacking competition.

This was not the first time VMware patched flaws disclosed at such an event. Last year, it resolved a Workstation and Fusion vulnerability demonstrated at PwnFest, a hacking competition that took place in South Korea at the Power Of Community (POC) conference.

VMware has also released patches for the recently disclosed Apache Struts2 vulnerability, which the company has classified as “catastrophic.”

Related: VMware Patches Vulnerabilities in AirWatch Android Apps

Related: Information Disclosure Flaws Patched in VMware Products

Related: VMware Patches VDP, ESXi Vulnerabilities

Eduard Kovacs is an international correspondent for SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

Researchers at Germany-based security firm Cure53 have conducted a 32-day audit of the Network Time Protocol (NTP) and the NTPsec project and discovered more than a dozen vulnerabilities.

Experts identified a total of 16 security-related issues, including 8 weaknesses that only affect NTP and two that only impact NTPsec, which is meant to be a secure, hardened and improved implementation of NTP. Cure53 has published separate reports focusing on the NTP and NTPsec problems.

The Network Time Foundation addressed the flaws earlier this month with the release of ntp-4.2.8p10.

Cure53 has classified one vulnerability as being critical. CVE-2017-6460, which only affects NTP, has been described as a stack-based buffer overflow that can be triggered by a malicious server when a client requests the restriction list. The flaw can be exploited to cause a crash and possibly to execute arbitrary code.

The security holes rated by Cure53 as high severity are CVE-2017-6463 and CVE-2017-6464, both of which can be exploited for DoS attacks.

It’s worth noting that while some of the vulnerabilities have been classified as critical and high severity by Cure53, NTP developers have only assigned medium, low and informational-level severity ratings to the discovered flaws.

Ntp-4.2.8p10 patches a total of 15 vulnerabilities and also includes just as many non-security fixes and improvements. Of the 15 security holes resolved in the latest version, 14 were discovered by Cure53, which also noticed that a flaw initially patched in December 2014 was reintroduced in November 2016.

One of the vulnerabilities fixed in ntp-4.2.8p10 was reported by researchers at Cisco Talos. Experts identified a DoS vulnerability affecting the origin timestamp check functionality. The company has published a blog post and a technical advisory describing the issue.

This is not the only audit conducted recently by Cure53. In the past months, the company also analyzed the cURL data transfer tool and the Dovecot email server.

Related: NTP Servers Exposed to Long-Distance Wireless Attacks

Related: Several DoS Vulnerabilities Patched in NTP

Related: High Severity DoS Vulnerability Patched in NTP

Eduard Kovacs is an international correspondent for SecurityWeek. He worked as a high school IT teacher for two years before starting a career in journalism as Softpedia’s security news reporter. Eduard holds a bachelor’s degree in industrial informatics and a master’s degree in computer techniques applied in electrical engineering.

Previous Columns by Eduard Kovacs:

Tags:

New Variant of Infamous IoT Botnet Launches Attack Against Network of U.S. College

A newly discovered variant of the Mirai botnet was responsible for powering a 54-hour distributed denial of service (DDoS) attack, Imperva researchers reveal.

Mirai was one of the most discussed Internet of Things (IoT) botnets during the second half of last year, after it was used in two large attacks against Brian Krebs’ blog and DNS provider Dyn. In October, the Trojan’s source code leaked online and new variants emerged soon after.

One such version emerged in December when TalkTalk Telecom home routers were being infected via a vulnerability in the network router protocol. Earlier this year, researchers observed a Windows variant of Mirai, though concluded that it was mainly designed to spread the Linux Trojan to more IoT devices.

The new version, Imperva says, is one of the variants that spawned after the source code leaked. Specifically, while previous versions of the malware launched network layer DDoS attacks, the new variant focuses on application layer assaults, the researchers discovered.

On Feb. 28, the new Mirai threat was used to launch a DDoS attack against a US college, and researchers say that the assault continued for 54 hours straight. The average traffic was of over 30,000 requests per second (RPS) and peaked at around 37,000 RPS, the highest of any Mirai botnet (the attack generated a total of over 2.8 billion requests).

“Based on a number of signature factors, including header order, header values and traffic sources, our client classification system immediately identified that the attack emerged from a Mirai-powered botnet,” Imperva’s Dima Bekerman explains.

The device types used in this attack were already known to be abused by Mirai: CCTV cameras, DVRs and routers. These devices might have been impacted by known vulnerabilities that the botnet exploited via open telnet (23) ports and TR-069 (7547) ports.

According to Bekerman, the DDoS bots used in the attack were hiding behind different user-agents compared to the five previously seen hardcoded in the default Mirai version. These details suggest that the new Mirai variant might have been modified to launch more elaborate application layer attacks.

30 user-agent variants were spotted during the attack, Imperva says. Furthermore, the security researchers observed attack traffic originating from 9,793 IPs worldwide, with over 70% of them located in ten countries: United States (18.4%), Israel (11.3%), Taiwan (10.8%), India (8.7%), Turkey (6%), Russia (3.8%), Italy (3.2%), Mexico (3.2%), Colombia (3.0%), and Bulgaria (2.2%).

“Less than a day after the initial assault ended, another one began that lasted for an hour and a half with an average traffic flow of 15,000 RPS. Based on our experience, we expect to see several more bursts before the offender(s) finally give up on their efforts,” Bekerman says.

Related: Mirai for Windows Built by Experienced Bot Herder: Kaspersky

Related: Mirai Switches to Tor Domains to Improve Resilience

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags:

Stealthy command and control methods allowed a newly discovered malware family to fly under the radar for more than three years, Palo Alto Networks security researchers reveal.

Dubbed Dimnie, the threat was discovered in mid-January 2017, when it was targeting open-source developers via phishing emails. An attached malicious .doc file contained embedded macro code that executed a PowerShell command to download and execute a file.

The first samples pertaining to this malware family dated back to early 2014, but the use of stealthy command and control (C&C) methods, combined with a Russian-focused target base helped the threat remain unnoticed until this year. Dimnie, which attempted a global reach with its January 2017 campaign, is capable of downloading additional malware and stealing information from compromised systems.

The malware has a modular design and can hinder analysis by injecting each of its modules into the memory of core Windows processes. What’s more, the malware appears to have undergone a series of changes over time, Palo Alto Networks reveals.

Looking at the threat’s communication with the C&C infrastructure, the security researchers discovered that it uses HTTP Proxy requests to the Google PageRank service, which hasn’t been available to the public since last year. Because the absolute URI in the HTTP request is for a non-existent service, the server isn’t acting as a proxy, and the seemingly RFC compliant request is merely camouflage.

The HTTP traffic also reveals that the malware uses an AES key to decrypt payloads (which have been previously encrypted using AES 256 in ECB mode). The server’s reply also contains a Cookie value, which is a 48 byte, base64 encoded, AES 256 ECB encrypted series of UINT32 values pertaining to the payload. The malware uses the Cookie parameter to verify the payload’s integrity.

One of the threat’s modules can exfiltrate data using HTTP POST requests to another Google domain, gmail[.]com. These requests, however, are hardcoded to be sent to an attacker controlled server. The malware attempts to hide its presence by masquerading the network traffic as legitimate requests. The data is once again encrypted, the security researchers say.

Analyzing the manner in which Dimnie handles payloads, the researchers discovered that data isn’t written to disk, but the payloads are simply downloaded and subsequently injected directly into memory. The various modules the malware downloads can: extract PC information and send it to the C&C server; enumerate running processes and send the list; log keystrokes, take screenshots; send logged keys and clipboard data to the server; and delete all files on the C: drive.

According to Palo Alto, the malware’s main functionality appears to be information stealing and reconnaissance. However, the threat’s modular framework supposedly allows attackers to use numerous capabilities, and the malware might be able to perform other operations as well, courtesy of modules that haven’t been observed during analysis.

“Multiple factors have contributed to Dimnie’s relatively long-lived existence. By masking upload and download network traffic as innocuous user activity, Dimnie has taken advantage of defenders’ assumptions about what normal traffic looks like. This blending in tactic, combined with a prior penchant for targeting systems used by Russian speakers, likely allowed Dimnie to remain relatively unknown,” Palo Alto researchers conclude.

Related: Stealthy Backdoor Compromised Global Organizations Since 2013: FireEye

Related: Information Stealer "Fareit" Abuses PowerShell

Ionut Arghire is an international correspondent for SecurityWeek.

Previous Columns by Ionut Arghire:

Tags: