We all know the risks of not updating our devices. Eventually, bugs invade every system—from the slimmest smartphones to the biggest gaming PCs.
"Keep your devices updated" is the most basic of tech advice. But what if the way the industry is releasing updates perpetuates these bugs? Experts say the future of computers could be one where we erase the culture of patch installations altogether. With more and more connected devices coming online every day, the potential for hackers to crack a system rises; and the more complex the system, the easier it can be for developers to make crucial mistakes.
How Do You Know What's Secure?
Ninety percent of an iceberg's mass is underwater; it might appear small and contained, but underneath the surface is a potentially dangerous obstacle.
On the web, Laurie Mercer, a security engineer for the cybersecurity company HackerOne, is looking for digital icebergs as he probes the subdomains of his company's website.
It's a simple enough act; Mercer uses a professional proxy tool—in this case Burp—to intercept communications between his computer and the website's server. Subdomains, ports, and additional applications (such as mobile apps or administrator services) all pop up on the screen.
Watching information ping from his browser to the website, Mercer gets 40 or 50 messages back in an instant. This is all in HTML, the language used to build pages and web apps. Part of his job as a tester, he says, is to go through these things one by one. He spends three or four hours just looking at one particular area the site, hunting for patterns or things that are slightly amiss.
Mercer likens this to a fishing net; "instead of our browser sending information, it's catching it."
Loading up the website of a famous newspaper, he points to a seemingly innocuous number that came back after he put a random word into the search bar. Numbers are always interesting, he says, because they're easy to change. It's simple to write a small bit of enumeration script that will test every possible value to see if there's any difference in behavior, and on GitHub there are a number of word repositories for doing the same thing with language.
If you've ever changed a number, or word, in a URL to get to another part of a website, that's what hackers are doing to try to crack websites, the software on your computer, or your newly purchased smart home device—but on a much greater scale.
But if you replace that number with, for example, a piece of HTML that can modify the product, then that gives your attacker a significant amount of power. Perhaps the most convincing example of this is the Heartbleed vulnerability from 2014, where usernames, passwords, and session IDs could be stolen very quickly and stealthily by those without a lot of technical expertise.
Move Fast and Break (Too Many) Things
As such, it's difficult to know which websites to trust. There are some existing regulations, such as the PCI Security Standards Council for websites that deal with credit card information. But with companies changing their code or pushing out app updates every couple of days to account for new features, customers have little idea what is or isn't slipping through the cracks.
The future of fighting bugs, then, becomes both a technological problem and a cultural one—fueled by our desire to have the newest features fast.
When companies rush to get products out to consumers, it's more likely that it will leave holes that hackers can exploit. Ben Herzberg, Director of Threat Research at Imperva (which discovered a flaw in Facebook's internal system allowing potential hackers to search the data of Facebook users) says "continuous integration [and] continuous deployment" that pushes software updates out on a daily or weekly basis in contrast to every quarter or every two quarters means there is less time for security tests.
Herzberg uses the example of an electricity company that's required to open an API to allow the public to see power consumption. While that might be good for environmental reasons, the rush to implement APIs due to regulation, or because the businesses are pushing them on deadlines, means necessary security checks are missed.
And even the best defenses—such as protecting your traffic through a paid virtual private network (VPN) or a trustworthy free one, or ensuring that your passwords are close to uncrackable by using a password manager—won't keep you safe if the vulnerability is in the system itself or the breach is on the website's server.
Look to the Clouds
Although cybersecurity companies such as HackerOne aim to fix these bugs as quickly as possible, the community of hackers that look at websites all day and all night—with cash incentives to motivate them—can really only do so much.
Currently, one of the simplest ways for everyone to protect their devices is to enable automatic updates and download the latest operating systems. When companies fail to quickly patch bugs, the result is attacks akin to WannaCry, which affected Germany's rail system, FedEx, and even Russia's central bank in 2014. But while patches were released, a huge swath of Windows machines across the world had yet to install them a year later, putting PCs and personal data at risk.
Others hang on to outdated OSes well past their prime. As of January 2019, Windows 7 still had a 37 percent market share, according to Net Applications, despite its imminent demise.
As a result, some, like Google, are leaning into software-as-a-service and building defenses into the foundations of their devices, like the OS and the browser.
Since WannaCry (and similar infections) will find it easier to break into computers that rely on software updates, some are choosing Chromebooks over Windows computers because Chrome OS updates happen automatically and take seconds to complete, versus the minutes or hours customers will have to wait on macOS and Windows.
Similarly, much of the software running on Chrome OS is rooted in the cloud. Google Docs, Sheets, Slides, and other apps are powered by Google's servers, so any update that needs to be rolled out can happen in a matter of seconds across all devices. Google Chrome, meanwhile, is now flagging all unencrypted HTTP sites as "not secure" in an attempt to give customers more information about potentially hazardous sites.
While Chromebooks might be the computer of choice for security professionals, their safe, cut-down OS won't work for everyone. So it's the responsibility of big companies to, as Mercer puts it, bite the bullet and invest in secure technology. Nobody wants to be the reason for another WannaCry or Heartbleed.