Zero-days in Cisco Discovery Protocol

It isn't perfect, but it works for me.

Has any real ones been found and confirmed?

I remember one being mentioned a couple of years ago or so by one researcher but last I can remember it was not confirmed and IIRC other researchers were voicing their doubt about it.

The team that fielded inquiries from security researchers and etc were STILL fighting fights with engineering executives whose first response when they saw something that showed a problem in their code from a researcher ... was to go running to the lawyers and talk about lawsuits.

In the meantime some engineers recognize the increased need for better security practices but there were NO new resources allocated to actually make time to do such things. Everything was lip service (if there even was any) but no time, and then later reactive to issues.

In terms of what I saw in a practical manner. There was a shockingly high rate of "we saw this security bug before" re-introduced right after it was fixed. You could almost bank on it happening. In the meantime you'd watch security related bug fixes pushed from one version to the next to the next ...

Security is economic. There's a cost/benefit to attack, and to defend.

A good way to measure how secure we actually are is to observe the rate of cryptocurrency theft. How many people do you know with crypto? How many people do you know who have had their computers hacked and crypto stolen? That's how secure you are.

Attacks on various hash functions are not really a thing. We've known not to use SHA-1 for over a decade, and cryptographers working in the space have started saying we may never find a viable preimage attack on MD5, let alone SHA-1. We are on pretty sound footing with hash functions; what you were doing in a competent system 10 years ago (using SHA-2) is still the right thing today.

I've been a vulnerability researcher since around 1995. I feel significantly better about security today than I have at any point in the past. We've been doing an imperfect but steady job of shutting down bug classes for decades, with the obvious and most important factor being the deprecation of insecure systems languages.

This is why I rant about C, even though I seldom touch it.

The "experts" that sell our infrastructure have proven multiple times they aren't able to deliver.

3 from 5 exploits are memory corruption bugs.

Well, I can only remember one time I've had any of my personal devices compromised in 25 years of heavy computing, and it windows XP pre-SP3. So yeah, quite a bit of faith seems to be warranted, even if the stream of flaws makes it seem like it shouldn't be

Not much.

We actually know how to deal with most of the things you mentioned. There are simple CPU cores that don't have speculative execution problems. It is possible to achieve memory safety. Formally proven OS kernels exist. Physical security is largely understood and can be made very difficult to compromise.

Why don't we have all this as routine? Because security theater is cheaper than actual security. The value of 'cheaper' here is very broad and includes avoiding all of the costs that emerge with robust security including opportunity costs.

There is no reason to think that anything has changed with the explosion of security consultants and firms.

If you are doing anything national security related, you should really just boil your security thinking down to thinking about the remotest possibility something could happen, and then multiply that x10, and then apply your mitigation.

If you're a bank in a metropolis, you get a sophisticated vault. If you're a business you get an alarm system to protect your inventory. If you're a farmer and it's the less expensive farm equipment, you might not even lock the barn/shed.

If you expect state level adversaries, you probably need state level resources, planning, and mitigations. If you're jane/joe schmoe citizen, don't give out your passwords or click on unknown binaries, and be wary of people asking you for SMS codes in IMs. Scale appropriately for the threat you think you'll face, and as much buffer as you think you can stomach.

I worked for 7 years so I know how the software sausage is made. The answer is most definitely "no", and I'm frankly surprised now that the internet works at all.

For example, I’m reasonably sure there are weaknesses in my gaming pc but I don’t do banking or other more secure things on it. There’s little motivation to target an attack or burn (use) an exploit to get access to this pc for an attacker and the defenses I have defend against most spray and pray attacks.

VPNs commonly bridge at layer 2, that's a direct path to pwnage in this case.

And then at the end, understand that you have a system that is still vulnerable so set up a regular cadence of maintenance.

It's a bit harder to do these days for various reasons.