Perfectly secure software

Can any software be coded so well that it doesn’t have any security deficiencies? Yes, theoretically, but it’s way past unlikely. Generously, we can say it’s even rarer than rare.

This question was brought up by last week’s conversation with Firefox add-in vendor, Giorgio Maone, creator of NoScript. He felt that I had unfairly maligned his product with too broad a brush when I mentioned that add-on products had security risks of their own.

[ Join the conversation between Roger A. Grimes and Giorgio Maone in last week’s Security Adviser post: Are all browser plug-ins a security risk? ]

After some e-mailing back and forth, I came away with the understanding that Giorgio and some of his notable NoScript reviewers are above average. Giorgio didn’t claim that NoScript was without its own security bugs, but he felt that if any were ever found, he would be able to close the hole very rapidly. Fair enough. Giorgio’s passion tells me that he truly cares about the security of his own code. Sadly, this can’t be said of many software product vendors — even makers of security software.

You’d be surprised how many coders of computer security products don’t know how to code securely. They weren’t trained in it. They don’t really care about it, and they aren’t paid more for making their code more secure. I’ve run into many crypto software developers who don’t know the first thing about Security Development Lifecycle (SDL), buffer overflows, input parameter checking, and so on. It’s ironic.

Can anyone make secure code? Yes. Dr. D. J. Bernstein, professor at the University of Illinois at Chicago, is probably the poster child for secure coding. His best-known products, DJBDNS and qmail, are among the most secure products in existence. When you hear about a DNS bug, it probably isn’t in DJB’s version of DNS; ditto on e-mail server problems. Dr. Bernstein offers a standing reward for anyone who can find a security bug in his code. To date, only one bug, an obscure one in qmail, has been found, and even it required a rare set of circumstances to become vulnerable.

I know lots of other coders, especially Michael Howard and David LeBlanc, authors of “Writing Secure Code,” who you’d want on your secure coding team. But while secure coders exist, rarely is any software of significance coded by only one person. Giorgio’s NoScript and DJB’s DNS and qmail aren’t complex programs. That’s good. Their essential simplicity gives them a better opportunity to be secure.

The enemy of security

As any software program gains popularity, it typically increases in features and ease-of-use, which means it gains complexity. And complexity is the enemy of security. As the program gains features, rarely can one person keep up with the coding chores. What used to be a simple project maintained by one guy ends up being coded in several sections by teams of people. That changes everything, as far as security is concerned. As much as I trust DJB to code securely, I bet even he would be tested in making sure a team of people produced secure code — especially at the pace commercial software is developed.

Examples abound. When Pretty Good Privacy (PGP), the awesome crypto program created by Phil Zimmerman, was coded only by Zimmerman, zero security bugs were found by the outside world. Then it grew in popularity and added new features. After a team of people became responsible for PGP, a bug was found.

Or take Adobe Acrobat Reader. When it was a simple document reader, who could exploit it? But then the vendor added features, including the ability to embed scripting (the death knell to many a product). Adobe Acrobat 8.x, probably the most popular version, has seen 19 vulnerabilities. A rise in popularity also means a rise in attacks.

Why don’t vendors stop making new features and adding complexity to their products? Do we really need all those new features in the latest version? Did we even ask for them? Heck, the first word processor I every used, First Choice, had everything I needed and only about 10 menu choices. Then I traded up to MultiMate, which had everything I needed for my college work. But then Utah upstart WordPerfect came along with hundreds of other options and it was awesome! I was mail merging away and revealing codes like no tomorrow. I can still Shift-F7 and print in my sleep. Eventually, WordPerfect was replaced by Microsoft Word, even though I had to be dragged kicking and screaming into the GUI. In the end, the GUI won.

See, if the vendor relaxes even for a second and doesn’t push for a gazillion new features in a given year, they become last year’s news and get bypassed by the competition. Anyone use Lotus 1-2-3 anymore?

Security vs. sales

Sadly, most people don’t actively care about computer security like we do. They want that new cool thing they read about — like the iPhone. At the 2007 Black Hat security conference in Las Vegas, Dr. Charles Miller revealed many of the vulnerabilities that the iPhone contained and talked about how easy it was to hack. He said it was an exploitation gold mine. That straight-talk express didn’t seem to hurt the iPhone’s sales.

Let’s imagine for a moment that we put DJB in charge of coding Adobe Acrobat, Internet Explorer, or whatever. DJB is a deadline-be-damned-I’m-all-about-the-security type of guy. He’d be great for security, but terrible for the overall product. It would take DJB’s team (assuming he would even relax control long enough to have a team) more time to make the product than customers would be willing to wait, or it would be more expensive to build than customers could afford. Another vendor’s product would steal all the market share, and no one would be left to use his now ultra-secure product. He’d be out of a job or coding for free (which blessedly, he does already in his free time).

When I asked if a truly secure product could ever be made, I already knew the answer. Yes, it could be made, but no one would buy it. Sometimes, even if you give it away, there are no takers. Just ask the good leaders of OpenBSD, the most secure popular operating system on the planet. It’s not the easiest to use, but it’s secure. Or how about DJB’s very secure qmail or DJBDNS? If they are so superior and free, why isn’t everyone using them? Is it a marketing problem? Is that what you really think?

No, it’s all about usability and the feature set. The products that people pay for are easier to install and use, and they contain features that the more secure versions don’t have. It’s that simple. Most people don’t pay for security, except as an afterthought.

The truth is that security and new features will always be locked in a continuing struggle. We need to educate consumers to expect more secure products, because vendors listen to customers when they are united in demands. And when a critical security bug is found, we expect our vendors to proceed with due haste in patching the hole.

But don’t hold your breath waiting for the perfectly secure product. Vendors already understand the market better than we do.