An application runs on an embedded battery-powered PC, accessible to some restricted public, that stores secrets in RAM. To prevent cold boot attacks and that the PC is stolen to extract its secrets, it has temper-proof sensors. If tampering is detected, the application exists (but does not wipe ...
it's obvious that a modern OS needs to wipe, either on allocation or on release
only insecure old systems don't
a slightly different issue, on on Win9x when you created a file and set its size without actually writing to something in between, that file got filled with data from older files
I'd like a .net version that wipes memory whenever it collections an instance on the heap
a moving GC makes wiping sensitive memory even harder than it already is
@RoryMcCune they changed it about a year ago, small emissions like the A1 is like maybe 85 euros a month in taxes, my stepdad his boss had a bmw 750, which costed about 800 euros a month in taxes
it's like catalog price (regardless of age) * something in emission / something
@LucasKauffman youch. here it's a benefit in kind and they knock it off your tax allowances, but yeah emissions counted, so everyone had things like BMW 520d 's
@RoryMcCune they did however change the policy so that when I progress to senior consultant I can immediately get a new car without having to sit out my lease
which means Im getting another new car next yea around this time probably
Our company cars go to the company garage, someone waves a wrench in their general direction, and we get a call 3 weeks later it's ready for pickup. Sometimes the problem has been partially fixed.
@ManishEarth Windows 3.1 and its offspring (up to and including Win98 and Millenium) did not zero out pages before handing them to other process, so a process could get old data that way. But since any process could also read and write into the kernel, it was hardly a security issue.
@AviD true for the most part, although even there you see some silly low salaries..
@AviD yeah we've got a couple of security startups here, some of 'em seem to be spun out of pen test companies when the people came up with products in the course of testing..
@RoryMcCune it is possible, depending on the client, to do other forms of upstream reviews. For example, design reviews and threat modeling. Though this is dependant on being able to have a remote discussion with them.
Nowadays, technologically it is not a problem. Culturally, there is often some ways to go.
@RoryMcCune I had it once in an app, where we found a vulnerability, they fixed the superclass fixing all other classes. But some developers decided to override the superclass re-introducing the same behavior somewhere else :P
@LucasKauffman try a rails app. review when you realise that developers love monkey patching to override core framework classes, to add their own validation
though sometimes you find out once youve started, just what a dog this system is. And then you're stuck digging around in its internals for the next few weeks...
@AviD yeah I guess the hard part compared to testing is that you're delivering an opinion so if the system sucks, people might not like the message. At least with testing it tends to be factually, so less room for debate :)
at that level, it is often about identifying poor tradeoffs. the tradeoff is factual, the risk is factual. Whether it is good or not, might be opinion, but usually I back it up.
I don't really go to FAIR, so yeah it is subjective, but its usually pretty clear.
On the other hand, sometimes there are guesses. Either because nobody knew the answer (and these are mostly hands-off reviews), or there is no answer because the system isnt built yet.
my guesses are usually reasonable, occasionally they are mistakes. Doesnt happen often.
@AviD ahh well as soon as you step into risk there's probability and then it's finger in the air time. That was where I used to see most push back "that'll never really happen" although with the amount of attacks these days hopefully that mentality is on the way out...
@RoryMcCune sure, but threat modeling is finding those risks that are not mitigated. Whether you agree with the priority or not, is a different question.
when needed, I like dropping down to DREAD instead of just damage X probability. that helps emotionally convince that mentality away.
@AviD sure, I've found that demonstrating that there is a risk is usually relatively easy, getting the business to prioritise it absent regulations/policy requirements is more tricky. that said if someone's paying for external risk assessments, they should understand the necessities a bit..
fair enough - despite Claire being away on holiday for a week I didn't sleep well at all. Now she's back I'm knackered, but needing to do a fair amount of work - am helping run a big event for our new team
@AviD yes - (with the usual caveats around drinks and stuff)
erm...when
and where and what and do they understand Scottish
plus, as I'm not getting any younger, and far too many folks are way smarter than me, I can't rely on being the geekiest in the room any more. Well, I normally can, but not in the DMZ so I need to think about other ways to get to conferences. As a speaker I have good crossover between corporate/consulting/techie/management
