Schneier on Security

Clive Robinson • December 16, 2022 9:27 AM

@ ALL,

Re : CVE-2022-42856

For those that don’t use TechCrunch because of the way the Yahho’s force themselves onto your browser,

There are other information sources, just one of which is,

‘https://thehackernews.com/2022/12/new-actively-exploited-zero-day.html

However before you go there or TecCrunch a look at,

https://www.cvedetails.com/cve/CVE-2022-42856/

Which currently tells you next to nothing, tells you most ICTsec and other ICT news sites will not have much of anything to tell you as of yet.

Clive Robinson • December 16, 2022 1:01 PM

@ TimH, ALL,

Re : The heresy of not kow-towing to JavaScript.

“…is the vector foiled by having javascript disabled…”

You can be burned at the stake for saying such things, I know, I’m still brushing out the scorch marks from my “Flame Proof” protection…

Unfortunately a lot of very lazy people have turned a mess that was renamed as JavaScript back last century[1] into the veritable disaster and ICTsec hamster wheel of pain / Red Queen’s Race of today.

Nearly all that have JavaScript on their computers via their web browsers ~98% of Internet users, are getting right royally abused by it. In so many ways it’s not possible to list them all as the list grows alarmingly whilst you are writting.

I usually have both Cookies and JavaScript disabled and I’ve mentioned and advised this ever since this blog has existed, not just on this blog but other places.

Whilst the response here was initially cold, in other places it actually induced violent out burst from those who viewed me as “breaking their rice bowl”.

I used to say the same about other Web-tech like flash that nolonger realy exists and Java (not to be confused with JavaScrip). They have faded from Web client use thankfully, but,

“That scorched smell still lingers”

Just to be blunt,

“Untill developers understand the pit falls of client-side equivalent of “Off-Line” security, any code they right will be ‘insecure by default'”.

Understanding the finer points between “Off-line” and “On-line” security is majorly lacking in the ICT sector, especially in ICTsec which realy does surprise me…

To understand the differences start looking into,

1, Failed Credit-Card Security.
2, Failed Set-top-box Security.
3, Failed Sat-TV-box security.
4, Failed Smart-Card Security.
5, Failed DVD Security.
6, Failed DRM Security.
7, Failed CPU Enclave Security.
8, Failed Ecrypted RAM Security.

And quite a few more examples. You fairly quickly get to see the “failed” instances forming classes, and from there making the development of new instances all so much the easier for those that want to Crack, or Steal peoples Privacy.

But the short version is,

“Off-Line security is Faux-Security as the ‘Root of Trust’ is always vulnerable in some way to a hostile user”.

(We used to say it was “Game-over if they get Front-Pannel Access” back in the early 1980’s and probably back as far as the 1950’s but even I was not as such “a twinkle in the eye” back then 😉

All JavaScript realy does is make the deficiencies of “Off-Line” security more glaringly obvious… But “they” appear to care not a jot, HTML 5 is rather more than a “little shop of horrors and “they” pay the salaries of those behind JavaScript and HTML 5…

BUT… JavaScript “Type Issues” are far from new, people were making jokes about them over a decade ago,

https://web.archive.org/web/20200823123837/https://www.wired.com/2012/01/jokes-for-nerds-wat-moments-in-programming/

[1] Originally called “LiveScript” Brendan Eich’s “quick hack” was first shipped by “Netscape” as part of a “Navigator beta” back in September 1995… Even though it had a country mile of “horses apples” attached on December the 4th it was pushed out the door on an unsuspecting world… There are a number of reasons for it’s existance and none of them are good.

Firstly HTML was never ever designed to be interactive, thus had no method of handeling state for a server to be synced by, or any real kind of user input. Nor was HTML in any way designed to alow user side interaction. Adding these gave the first avalanche of security breeches.

Secondly Web based organisations wanted to do things on the cheap. The correct place to do interaction with the user was not on the client –big security issue– but on the server. However Netscape and Mosaic they came from had made things badly and as a result the server side could not even do even minor CGI without dropping to it’s knees or hemorrhaging memory. So for Netscape it was imperitive that as much as possible be off-loaded onto the client…

Thirdly most of those playing with JavaScript were not actually Systrms Programers, some were not even Programers. Next to none of them knew anything about security… So the results were kind of predictable.

In 1995/6 I gave a series of accademic presentations about the dangers of incorrect handeling of “state”, “Data types”, and “Security” to post-grad and PhD CompSci types. The sheeplike blank looks I was getting told me it was time to get the heck away from “web-tech” and instead develop ways to “fence it off” and “mitigate it” because it was going to be a monumental “cl45t3r-f4ck” which it has been ever since and will no doubt continue to be for years to come…

It was no comfort when Brendan Eich, got not just flamed but toasted for his political/religious views. Unfortunatly his hand is still on the JavaScript tiller one way or another.

Clive Robinson • December 20, 2022 8:28 PM

@ JonKnowsNothing,

“Recently a friend wanted to assist me getting an up to date cellphone. It is a holiday present, and knowing my circumstances, a most generous one.”

It is very kind of them, it would be an expensive gift in the UK where both phones and service contracts tend to be less expensive than the US.

I guess you will where able be doing more than one or two odd jobs etc on the “what comes aroind goes around” principle[1].

But the issue with photos is not unique to Apple and it’s been around one way or another for years.

Back in the early part of the 2000’s “Picture SMS” started as a service, of course it was not SMS at all… Odd things used to happen. Such as with multi-party SMS’s the recipients do not know it’s multi-party or who the other parties are. Howrver adding a picture attachment also tacked a CC-list in. Which in the UK at the time was very much against the rules (SMS were considered to be “telephone communications” thus had to follow “exchange / CO” rules with phone numbers… T-Mobile in the UK were not happy to have me phone them up and point out that and the applicable data protection rules…).

So as a “wild guess” I would say that some one has “cod’sd up” the linking of the disparate parts. Which of course won’t be helped by Apples changes to iMessaging to go via data connection where ever possible.

[1] I’m about the worst person ypu can find for trying to give gifts or help to, at the very least I get very very embarrassed go pink in the ears and try to scuttle away. However, I’m also one of the easiest to ask for practical help as I enjoy helping. Blaim my parents for making me stand on my own feet as an ethos and helping others as a moral duty. As my moter used to say “You helps them that can not help themselves, and you also help those who can help themselves as it gets the job done easier”. As my dad used to say “Hammer in one hand, nail in the other, and a helping hand holds the wood”.