8/11/2015 No, You Really Cant (Mary Ann Davidson Blog)https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t 1/11OracleBlogsHomeProducts&ServicesDownloadsSupportPartnersCommunitiesAboutLoginOracleBlogMaryAnnDavidsonBlogIsYourShellshocked...|MainNo,YouReallyCantByUser701213OracleonAug10,2015Ihavebeendoingalotofwritingrecently.Someofmywritinghasbeenwithmysister,withwhomIwritemurdermysteriesusingthenomdeplumeMaddiDavidson.Recently,wevebeenworkingonshortstories,developingalotoffunnewideasfordispatchingpeople(literarilyspeaking,thoughIthinkaboutpracticalapplicationsoccasionallywhensomeonetailgatesme).WritingmysteriesisalotmorefunthantheothertypeofwritingIvebeendoing.Recently,Ihaveseenalargeishuptickincustomersreverseengineeringourcodetoattempttofindsecurityvulnerabilitiesinit.ThisiswhyIvebeenwritingalotofletterstocustomersthatstartwithhi,howzit,alohabutendwithpleasecomplywithyourlicenseagreementandstopreverseengineeringourcode,already.8/11/2015 No, You Really Cant (Mary Ann Davidson Blog)https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t 2/11Icanunderstandthatinaworldwhereitseemsalmosteverydaysomeoneelsehadadatabreachandlostumpteengazillionrecordstounnamedintruderswhomayhavebeenworkingatthebehestofahostilenationstate,peoplewanttogotheextramiletosecuretheirsystems.Thatsaid,youwouldthinkthatbeforegearinguptorunthatextramile,customerswouldalreadyhaveensuredtheyveidentifiedtheircriticalsystems,encryptedsensitivedata,appliedallrelevantpatches,beonasupportedproductrelease,usetoolstoensureconfigurationsarelockeddowninshort,theusualsecurityhygienebeforetheyattempttofindzerodayvulnerabilitiesintheproductstheyareusing.Andinfact,therearealotofdatabreachesthatwouldbepreventedbydoingallthatstuff,asunsexyasitis,insteadofhyperventilatingthattheBigBadAdvancedPersistentThreatusingazerodayisouttogetme!WhetheryouarerunningyourownITshoworacloudproviderisrunningitforyou,thereareahostofgoodsecuritypracticesthatarewellworthdoing.Evenifyouwanttohavereasonablecertaintythatsupplierstakereasonablecareinhowtheybuildtheirproductsandthereissomuchmoretoassurancethanrunningascanningtooltherearealotofthingsacustomercandolike,gosh,actuallytalkingtosuppliersabouttheirassuranceprogramsorcheckingcertificationsforproductsforwhichthereareGoodHousekeepingsealsfor(orgoodcodeseals)likeCommonCriteriacertificationsorFIPS140certifications.Mostvendorsatleast,mostofthelargeishonesIknowhavefairlyrobustassuranceprogramsnow(weknowthisbecauseweallcomparenotesatconferences).Thatsallwellandgood,isappropriatecustomerduediligenceandstopswellshortofhey,IthinkIwilldothevendorsjobforhim/her/itandlookforproblemsinsourcecodemyself,eventhough:Acustomercantanalyzethecodetoseewhetherthereisacontrolthatpreventstheattackthescanningtoolisscreamingabout(whichismostlikelyafalsepositive)AcustomercantproduceapatchfortheproblemonlythevendorcandothatAcustomerisalmostcertainlyviolatingthelicenseagreementbyusingatoolthatdoesstaticanalysis(whichoperatesagainstsourcecode)IshouldstateattheoutsetthatinsomecasesIthinkthecustomersdoingreverseengineeringarenotalwaysawareofwhatishappeningbecausetheactualworkisbeingdonebyaconsultant,whorunsatoolthatreverseengineersthecode,getsabigfatprintout,dropsitonthecustomer,whothensendsittous.Now,Ishouldnotethatwedontjustacceptscanreportsasproofthatthereisathere,there,inpartbecausewhetheryouaretalkingstaticordynamicanalysis,ascanreportisnotproofofanactualvulnerability.Often,theyarenotmuchmorethanapileofsteamingFUD.(ThatiswhatIplannedonsayingallalong:FUD.)Thisiswhywerequirecustomerstologaservice8/11/2015 No, You Really Cant (Mary Ann Davidson Blog)https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t 3/11requestforeachallegedissue(notjusthandusareport)andprovideaproofofconcept(whichsometoolscangenerate).Ifwedetermineaspartofouranalysisthatscanresultscouldonlyhavecomefromreverseengineering(inatleastonecase,becausethereportsaid,cleverlyenough,staticanalysisofOracleXXXXXX),wesendalettertothesinningcustomer,andadifferentlettertothesinningconsultantactingoncustomersbehalfremindingthemofthetermsoftheOraclelicenseagreementthatprecludereverseengineering,SoPleaseStopItAlready.(Inlegalese,ofcourse.TheOraclelicenseagreementhasaprovisionsuchas:"Customermaynotreverseengineer,disassemble,decompile,orotherwiseattempttoderivethesourcecodeofthePrograms..."whichwequoteinourmissivetothecustomer.)Oh,andwerequirecustomers/consultantstodestroytheresultsofsuchreverseengineeringandconfirmtheyhavedoneso.WhyamIbringingthisup?Themainreasonisthat,whenIseeaspikeinX,Itrytogetaheadofit.Idontwantmoreroundsofyoubrokethelicenseagreement,no,wedidnt,yes,youdid,no,wedidnt.Idratherspendmytime,andmyteamstime,workingonhelpingdevelopmentimproveourcodethanarguewithpeopleaboutwherethelicenseagreementlinesare.NowisagoodtimetoreiteratethatImnotbeatingpeopleupoverthismerelybecauseofthelicenseagreement.Morelike,Idonotneedyoutoanalyzethecodesincewealreadydothat,itsourjobtodothat,weareprettygoodatit,wecanunlikeathirdpartyoratoolactuallyanalyzethecodetodeterminewhatshappeningandatanyratemostofthesetoolshaveacloseto100%falsepositiveratesopleasedonotwasteourtimeonreportinglittlegreenmeninourcode.Iamnotrunningawayfromourresponsibilitiestocustomers,merelytryingtoavoidapainful,annoying,andmutuallytimewastingexercise.Forthisreason,IwanttoexplainwhatOraclespurposeisinenforcingourlicenseagreement(asitpertainstoreverseengineering)and,inareasonablypreciseyethandwavyway,explainwherethelineisyoucantcrossoryouwillgetastronglywordedletterfromus.Caveat:Iamnotalawyer,evenifIcanusewordslikestaredecisisinrandomconversations.(Exceptwithmydog,becauseheonlyunderstandsHawaiian,notLatin.)Ergo,whenindoubt,refertoyourOraclelicenseagreement,whichtrumpsanythingIsayherein!Withthatinmind,afewFAQishexplanations:Q.Whatisreverseengineering?8/11/2015 No, You Really Cant (Mary Ann Davidson Blog)https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t 4/11A.Generally,ourcodeisshippedincompiled(executable)form(yes,Iknowthatsomecodeisinterpreted).Customersgetcodethatruns,notthecodeaswritten.Thatisformultiplereasonssuchasusersgenerallyonlyneedtoruncode,notunderstandhowitallgetsputtogether,andthefactthatoursourcecodeishighlyvaluableintellectualproperty(whichiswhywehavealotofrestrictionsonwhoaccessesitandprotectionsaroundit).TheOraclelicenseagreementlimitswhatyoucandowiththeasshippedcodeandthatlimitationincludesthefactthatyouarentallowedtodecompile,disassemble,deobfuscateorotherwisetrytogetsourcecodebackfromexecutablecode.Thereareafewcaveatsaroundthatprohibitionbutthereisntanoutforunlessyouarelookingforsecurityvulnerabilitiesinwhichcase,noproblemo,mon!Ifyouaretryingtogetthecodeinadifferentformfromthewayweshippedittoyouasin,thewaywewroteitbeforewedidsomethingtoittogetitintheformyouareexecuting,youareprobablyreverseengineering.Dont.Justdont.Q.WhatisOraclespolicyinregardstothesubmissionofsecurityvulnerabilities(foundbytoolsornot)?A.Werequirecustomerstoopenaservicerequest(onepervulnerability)andprovideatestcasetoverifythattheallegedvulnerabilityisexploitable.Thepurposeofthispolicyistotrytoweedouttheverylargenumberofinaccuratefindingsbysecuritytools(falsepositives).Q.Whyareyougoingafterconsultantsthecustomerhired?Theconsultantdidntsignthelicenseagreement!A.ThecustomersignedtheOraclelicenseagreement,andtheconsultanthiredbythecustomeristhusboundbythecustomerssignedlicenseagreement.Otherwiseeveryonewouldhireaconsultanttosay(legaltermsfollow)Nanny,nannybooboo,bigbadconsultantcandoXevenifthecustomercant!Q.WhatdoesOracledoifthereisanactualsecurityvulnerability?8/11/2015 No, You Really Cant (Mary Ann Davidson Blog)https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t 5/11A.IalmosthatetoanswerthisquestionbecauseIwanttoreiteratethatcustomersShouldNotandMustNotreverseengineerourcode.However,ifthereisanactualsecurityvulnerability,wewillfixit.Wemaynotlikehowitwasfoundbutwearentgoingtoignorearealproblemthatwouldbeadisservicetoourcustomers.Wewill,however,fixittoprotectallourcustomers,meaningeverybodywillgetthefixatthesametime.However,wewillnotgiveacustomerreportingsuchanissue(thattheyfoundthroughreverseengineering)aspecial(oneoff)patchfortheproblem.Wewillalsonotprovidecreditinanyadvisorieswemightissue.Youcantreallyexpectustosaythankyouforbreakingthelicenseagreement.Q.Butthetoolsthatdecompileproductsaregettingbetterandeasiertouse,soreverseengineeringwillbeOKinthefuture,right?A.Ah,no.Thepointofourprohibitionagainstreverseengineeringisintellectualpropertyprotection,nothowcanwecleverlypreventcustomersfromfindingsecurityvulnerabilitiesbwahahahahasoweneverhavetofixthembwahahahaha.Customersarewelcometousetoolsthatoperateonexecutablecodebutthatdonotreverseengineercode.Tothatpoint,customersusingathirdpartytoolorserviceofferingwouldbewellservedbyaskingquestionsofthetool(ortoolservice)providerastoa)howtheirtoolworksandb)whethertheyperformreverseengineeringtodowhattheydo.Anounceofdiscussionisworthapoundofnowedidnt,yesyoudid,didnt,didarguments.*Q.ButIhiredareallycoolcodeconsultant/thirdpartycodescanner/whatever.WhywontmeanoldOracleacceptmyscanresultsandanalyzeall400pagesofthescanreport?A.Hooboy.IthinkIhaverepeatedthissomuchitshouldbeasongchorusinareallyannoyinghiphoppiecebutheregoes:Oraclerunsstaticanalysistoolsourselves(heck,wemakethem),manyofthesegoldurntoolsareridiculouslyinaccurate(sometimesthefalsepositiverateis100%orclosetoit),runningatoolisnothing,theabilitytoanalyzeresultsiseverything,andsoonandsoforth.WeputtheburdenoncustomersortheirconsultantstoprovethereisaThere,Therebecauseotherwise,wewasteaboatloadoftimeanalyzingnothing**whenwecouldbespendingthoseresources,say,fixingactualsecurityvulnerabilities.Q.ButoneoftheissuesIfoundwasanactualsecurityvulnerabilitysothatjustifiesreverseengineering,right?8/11/2015 No, You Really Cant (Mary Ann Davidson Blog)https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t 6/11A.Sigh.Attheriskofbeingrepetitive,no,itdoesnt,justlikeyoucantbreakintoahousebecausesomeoneleftawindowordoorunlocked.Idliketotellyouthatweruneverytooleverdevelopedagainsteverylineofcodeweeverwrote,butthatsnottrue.Wedorequiredevelopmentteams(onpremises,cloudandinternaldevelopmentorganizations)tousesecurityvulnerabilityfindingtools,wevehadasignificantuptickintoolsusageoverthelastfewyears(ourmetricsshowthis)andwedotracktoolsusageaspartofOracleSoftwareSecurityAssuranceprogram.WebeatupImean,requiredevelopmentteamstousetoolsbecauseitisverymuchinourinterests(andcustomersinterests)tofindandfixproblemsearlierratherthanlater.Thatsaid,notoolfindseverything.Notwotoolsfindeverything.Wedontclaimtofindeverything.Thatfactstilldoesntjustifyacustomerreverseengineeringourcodetoattempttofindvulnerabilities,especiallywhenthekeytowhetherasuspectedvulnerabilityisanactualvulnerabilityisthecapabilitytoanalyzetheactualsourcecode,whichfranklyhardlyanythirdpartywillbeabletodo,anotherreasonnottoacceptrandomscanreportsthatresultedfromreverseengineeringatfacevalue,asifweneededone.Q.Hey,Ivegotanidea,whynotdoabugbounty?Paythirdpartiestofindthisstuff!A.Bugbountiesarethenewboyband(nicelyalliterative,no?)Manycompaniesarescreaming,fainting,andthrowingunderwearatsecurityresearchers****tofindproblemsintheircodeandinsistingthatThisIsTheWay,WalkInIt:ifyouarenotdoingbugbounties,yourcodeisntsecure.Ah,well,wefind87%ofsecurityvulnerabilitiesourselves,securityresearchersfindabout3%andtherestarefoundbycustomers.(Smalldigression:IwasbustingmybuttonstodaywhenIfoundoutthatawellknownsecurityresearcherinaparticularareaoftechnologyreportedabunchofallegedsecurityissuestousexceptwehadalreadyfoundallofthemandwewerealreadyworkingonorhadfixes.Woohoo!)Iamnotdissingbugbounties,justnotingthatonastrictlyeconomicbasis,whywouldIthrowalotofmoneyat3%oftheproblem(andwithoutlearninglessonsfromwhatyoufind,itreallyiswhackacodemole)whenIcouldspendthatmoneyonbetterpreventionlike,oh,hiringanotheremployeetodoethicalhacking,whocoulddevelopareallygoodtoolweusetoautomatefindingcertaintypesofissues,andsoon.ThisisoneofthosefullimmersionbaptismorsprinklewaterovertheforeheadissueswewillallowfordifferentreligioustraditionsanddoitOURwayandotherscandoitTHEIRway.Paxvobiscum.Q.Ifyoudontletcustomersreverseengineercode,theywontbuyanythingelsefromyou.8/11/2015 No, You Really Cant (Mary Ann Davidson Blog)https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t 7/11A.Iactuallyheardthisfromacustomer.Itwasironicbecauseinorderforthemtobuymoreproductsfromus(oruseacloudserviceoffering),theydhavetosignalicenseagreement!Withthesametermsthatthecustomerhadalreadyadmittedviolating.Honey,ifyouwontletmecheatonyouagain,ourmarriageisthrough.Ah,er,youalreadyviolatedtheforsakingallotherspartofthemarriagevowsoIthinkthemarriageisalreadyover.ThebetterdiscussiontohavewithacustomerandIalwaysofferthisisforustoexplainwhatwedotobuildassuranceintoourproducts,includinghowweusevulnerabilityfindingtools.Iwantcustomerstohaveconfidenceinourproductsandservices,notjustdropaletteronthem.Q.SurelythebadguysandsomenationsdoreverseengineerOraclescodeanddontcareaboutyourlicensingagreement,sowhywouldyoutrytorestrictthebehaviorofcustomerswithgoodmotives?A.Oracleslicenseagreementexiststoprotectourintellectualproperty.Goodmotivesandgiventheerrataofthirdpartyattemptstoscancodethequotationmarksarequiteaproposarenotanacceptableexcuseforviolatinganagreementwillinglyenteredinto.Anymorethanbuteverybodyelseischeatingonhisorherspouseisanacceptableexcuseforviolatingforsakingallothersifyousaiditinfrontofwitnesses.Atthispoint,IthinkIambeatingadeadorshouldIsay,decompiledhorse.Weaskthatcustomersnotreverseengineerourcodetofindsuspectedsecurityissues:wehavesourcecode,weruntoolsagainstthesourcecode(aswellasagainstexecutablecode),itsactuallyourjobtodothat,wedontneedorwantacustomerorrandomthirdpartytoreverseengineerourcodetofindsecurityvulnerabilities.Andlast,butreallyfirst,theOraclelicenseagreementprohibitsit.Pleasedontgothere.*Isuspectatleastpartoftheangerofcustomersinthesebackandforthdiscussionsisbecausethecustomerhadalreadypaidasecurityconsultanttodothework.Theyareangrywithusforhavingbeensoldabillofgoodsbytheirconsultant(wheretheconsultantbrokethelicenseagreement).8/11/2015 No, You Really Cant (Mary Ann Davidson Blog)https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t 8/11**TheonlyanalogyIcancomeupwithismybookshelf.SomeoneconvincedthatIhadaprurientinterestinpornographycouldlookatthetitlesonmybookshelf,concludetheyaresalacious,anddemandanexplanationfrommeastowhyIhaveacollectionofsteamybooks.Forexample(theseareallrealtitlesonmyshelf):1. ThunderBelow!(whooboy,mustbehotstuff!)2. NakedEconomics(nudeKeynesians!)***3. Inferno(evenhotterstuff!)4. AtDawnWeSlept(youmustbeexhaustedfromyour,ah,nighttimeactivities)MyresponseisthatIdonthavetoexplainmybooktastesorrespondtobaselessFUD.(Ifanybodyisinterested,theactualbooksubjectsare,inorder,1)theexploitsofWWIIsubmarineskipperandCongressionalMedalofHonorrecipientCAPTEugeneFluckey,USN2)abookoneconomics3)abookabouttheEuropeantheaterinWWIIand4)thedefinitiveworkconcerningtheattackonPearlHarbor.)***Absolutelynot,IloatheKeynes.TherearemoreextantdodosthanactualKeynesianmultipliers.AlthoughdodosandtruebelieversinKeynesianmultipliersareinterchangeabletermsasfarasIamconcerned.**** I might be exaggeratinghere.Butmaybenot.Category:OracleTags:nonePermanentlinktothisentry8/11/2015 No, You Really Cant (Mary Ann Davidson Blog)https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t 9/11IsYourShellshocked...|MainComments:PostaComment:Name: guestEMail:URL:NotifymebyemailofnewcommentsRememberInformation?YourComment:HTMLSyntax:NOTallowedPleaseanswerthissimplemathquestion9+50=Preview PostAboutbocadmin_wwSearchEntersearchterm: Searchonlythisblog8/11/2015 No, You Really Cant (Mary Ann Davidson Blog)https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t 10/11RecentPostsNo,YouReallyCantIsYourShellshockedPoodleFreakedOverHeartbleed?TheFourPsofStandards/ProcurementRequirements/WhatevahsMandatedThirdPartyStaticAnalysis:BadPublicPolicy,BadSecurityILoveStandardsThereAreSoManyOfThemPutUporShutUpSummerPotpourriPainComesInstantlyThoseWhoCantDo,AuditTheBucketListTopTagsdavidsonmaddinistnistir7622pciCategoriesOracleArchivesAugust2015SunMonTue WedThuFri Sat 12 3 4 5 6 7 89 10 11 12 13 14 1516 17 18 19 20 21 2223 24 25 26 27 28 2930 31 8/11/2015 No, You Really Cant (Mary Ann Davidson Blog)https://blogs.oracle.com/maryanndavidson/entry/no_you_really_can_t 11/11TodayMenuBlogsHomeWeblogLoginFeedsRSSAll/OracleCommentsAtomAll/OracleCommentsTheviewsexpressedonthisblogarethoseoftheauthoranddonotnecessarilyreflecttheviewsofOracle.TermsofUse|YourPrivacyRights|CookiePreferences