Rust can help make software secure – but it's no cure-all
- Reference: 1707377292
- News link: https://www.theregister.co.uk/2024/02/08/rust_software_memory_safety/
- Source link:
So while coding with Rust can help reduce memory safety vulnerabilities, it won't fix everything.
Security biz Horizon3.ai has [1]analyzed CISA's Known Exploited Vulnerabilities in 2023 and found, as chief attack engineer Zach Hanley put it, that "Rust won’t save us, but it will help us."
[2]
We feel this is something that can't be said enough right now; if it's already obvious to you, well done. Rust will stop you using data after it's been freed, or try its best to stop you, but it can't really prevent you introducing logic bugs or passing unfiltered user input to a command interpreter.
[3]
[4]
The most common vulnerabilities in 2023 had to do with insecure exposed functions, representing 48.8 percent of last year's crop. These include flaws like [5]CVE-2023-33246 in Apache RocketMQ, in which the application "insecurely exposed an endpoint that calls Java's getRuntime().exec() with an attacker-controlled variable."
Or [6]CVE-2023-22515 in Atlassian Confluence, in which the application insecurely exposed an endpoint that allowed a server's configuration state to be modified.
[7]
Memory safety flaws tied for second place alongside web routing and path abuse – categories each representing 19.5 percent of 2023 vulnerabilities.
[8]CVE-2023-34362 , the Progress MOVEit Transfer vulnerability, is an example of path abuse. In this instance, the application tried to limit access locally but contained a header parsing but that exposed functions.
[9]Simon Willison interview: AI software still needs the human touch
[10]Thousands of Juniper Networks devices vulnerable to critical RCE bug
[11]Memory-safe languages so hot right now, agrees Lazarus Group as it slings DLang malware
[12]Dump C++ and in Rust you should trust, Five Eyes agencies urge
While memory safety vulnerabilities may not have been the largest source of problems last year, they tend to have a significant impact because they're often identified at the time they're first actively exploited, before patches have been prepared.
Horizon3.ai found that 75 percent of the memory safety bugs analyzed were exploited as zero-day flaws and that 25 percent of them were initially believed to have been spotted by security researchers who later discovered that others had already been exploiting them.
"When vulnerabilities are exploited as zero-days they typically have a much more widespread effect on the world given that patches often lag by weeks once they are discovered," [13]wrote Hanley.
[14]
Hanley says that most of the vulnerabilities that are being exploited are simple to abuse. So while coding in Rust will help, more attention needs to be paid to the risks complex software presents.
That work is already underway, through initiatives to [15]harden the software supply chain and related projects.
Amid the [16]rush to Rust – which has Microsoft recruiting developers to [17]rewrite C# code in Rust and Google [18]donating to improve Rust tooling – it's easy to forget that security is a process, rather than a product. Or a language. ®
Get our [19]Tech Resources
[1] https://www.horizon3.ai/analysis-of-2023s-known-exploited-vulnerabilities/
[2] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2ZcS0WEHegN1th4caYXaZrgAAAUQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZcS0WEHegN1th4caYXaZrgAAAUQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[4] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZcS0WEHegN1th4caYXaZrgAAAUQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[5] https://attackerkb.com/topics/YBI7e7fY0a/cve-2023-33246
[6] https://attackerkb.com/topics/Q5f0ItSzw5/cve-2023-22515/rapid7-analysis
[7] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44ZcS0WEHegN1th4caYXaZrgAAAUQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[8] https://www.horizon3.ai/moveit-transfer-cve-2023-34362-deep-dive-and-indicators-of-compromise/
[9] https://www.theregister.com/2024/01/24/willison_ai_software_development/
[10] https://www.theregister.com/2024/01/15/juniper_networks_rce_flaw/
[11] https://www.theregister.com/2023/12/11/lazarus_group_edang/
[12] https://www.theregister.com/2023/12/07/memory_correction_five_eyes/
[13] https://www.horizon3.ai/analysis-of-2023s-known-exploited-vulnerabilities/#:~:text=Additionally%2C%2025%25%20were%20discovered%20by,weeks%20once%20they%20are%20discovered.
[14] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33ZcS0WEHegN1th4caYXaZrgAAAUQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[15] https://www.theregister.com/2023/06/13/attestation_form_deadline_moved/
[16] https://www.cisa.gov/news-events/news/urgent-need-memory-safety-software-products
[17] https://www.theregister.com/2024/01/31/microsoft_seeks_rust_developers/
[18] https://www.theregister.com/2024/02/05/google_rust_donation/
[19] https://whitepapers.theregister.com/
"Security is a process, not a product. Nor a language"
More than any of these, it's an outcome of a mind set. In addition to tech-specific factual knowledge, it requires solid understanding of first principles, attention to detail, the ability to synthesise possible outcomes from what's observed, and most of all an ethical commitment to taking responsibility for the results. No tools, languages, dev systems or other tech can substitute for these human capacities, which are in reality elements of character. But, unfortunately, exercising them during development and testing slows it down and greatly increases the cost of production.
These capacities also have to be learnt, and they're not being taught. Just for example, a [1]recent report by the Social Market Foundation entitled ' Character building: Why character is essential for career readiness ' mentions ' • Self-belief • Determination • Self-control • Coping skills ' but makes no reference either to cultivating enquiring minds or to commitment. And IMHO self-belief should not top the list as an objective in itself, but be an outcome of verified capacities. There's far too much unfounded self-belief in the IT sector, witness the deluge of project failures and the parlous state of infosec.
[1] https://www.smf.co.uk/wp-content/uploads/2024/01/Character-building-Jan-2024-1.pdf
Re: "Security is a process, not a product. Nor a language"
Wanted to make a similar point. As other areas of engineering have shown: security and saftey are cultures and require a no-blame environment so that when problems occur, and they always will, minds are focussed on solutions and not on blame.
Rust is only useful where all your Rust code resides in a "safe" block. Literally all.
Because one "unsafe" block can break the guarantees of safe code around it.
And guess what you need if you want to convert arbitrary memory into a data structure - like you would for pretty much every driver, hardware interface, and all kinds of lower-level activities? An unsafe block.
Yes, now you're back to square one running unsafe code making assumptions about arbitrary memory contents to try to turn them into data structures, function calls, etc.
Great for basic applications. Not so great for anything that deals with OS or hardware.