Hacker News Reader

Comment by tptacek | Hacker News Reader

Meh. No doubt someone in the US government thinks this is a serious issue, but lack of access to Windows source code is little more than a speed bump for professional exploit developers.

View on HN

We've heard these claims ever since MS started releasing source to certain institutions/governments, and my reaction has always been the same: Reverse-engineering non-obfuscated code is absolutely trivial, and can be automated 99% of the way. If you can find vulnerabilities in source code, you can find vulnerabilities in a binary. For some reason, no one ever seems to understand this...

The funny part of this is that a good chunk of the vanguard of vulnerability researchers aren't even bothering to piece through basic blocks anymore; they just capture a small library of inputs and throw bit-flipped variants of them at the target, like particles from a neutron gun, until something blows up.

Why bother with the source code when you can find vulnerabilities with dumb fuzzer farms?

(Hey, Cody, build one of those for us!)

I always assumed Windows binaries are heavily obfuscated, is that not the case?

Some are, but outside of DRM stuff, nothing in Windows itself. And even when obfuscation is in play, it's usually trivial.

The opposite is mostly the case; Microsoft even makes the PDB debugging symbols available for many of its core components.

Even for the bootloader, where the signature checks for the driver signing chain occurs. The MS symbols database is a goldmine.

From reading the cable itself, it doesn't sound like anyone in the US government thinks it's a serious issue, but that The Guardian thought it made a nice headline. The source-access bit is a single line a 7-paragraph section of a 64-paragraph daily report whose own sectional 'key highlights' don't mention it.

http://www.guardian.co.uk/world/us-embassy-cables-documents/...

Everything's open source, it's just written in assembly.

I might say "control flow graphs" instead of "assembly". Not to be pedantic, but to dispel the notion that reversers are literally reading every opcode in the program.

Being able to read source is not the same as open source. (That's where the term `free software' and it's conotations are useful.)

But it's a major speed bump for non-elite exploit developers. In particular for an organization with a big cyber-army of them. Not proficient with tools like disassemblers but proficient with basic techniques with source code.

The question is then if that particular 'organization' has a large enough number (let's say 50? or 100?) highly skilled exploit developers.

I have no problem to believe that a country of that size, regardless of its technical sophistication overall, can produce without much effort an institute like that.

Don't forget that 'professional exploit developer' was a concept largely unknown until well into the 2000's. That never stopped a whole slew of exploits to appear since the mid 1990's, many of the early ones from the bedrooms of at best amateur security aficionados.

That doesn't mean you have to build them a racetrack and give them a jet car.

The dangers in giving a select few organizations access to the Windows source is far, far outweighed by the benefits. Should evil people have access to the Windows source? Probably not, but the fact is that if you give it to some people, some of them are going to be bad.

Reply on news.ycombinator.com