Keynote speech by Martin Haunschmid: Security is as bad as it was 20 years ago

The requirements for password security are annoying, as is 2-factor authentication: but precisely because it is so annoying, it is important that we understand how important these things are. And that we urgently need to do better. That was Martin Haunschmid's message in his keynote speech at this year's ReConf.

In this article:

• Martin Haunschmid - From developer to hacker and penetration tester
• Requirements Engineering - Security is also essential for requirements management
• Vibe coding - Rapid development with AI leads to massive security risks
• Security asymmetry - Attackers only have to fail once, defenders must never fail
• Threat Modeling - Early identification of threats with creative examples
• People as a goal - Phishing, malware, manipulated extensions and AI hallucinations
• OWASP Top Ten - Hardly any progress on the most common weaknesses since 2003
• Consequences - Lack of security has legal and economic consequences
• Conclusion - Shift left, threat models and ASVS as central components of secure systems

Martin Haunschmid

Martin has been developing software for a long time, but has always been interested in Attack security Interested. When a website he had developed was hacked, he was hooked: He had found his calling and went from developer to hacker.

In the meantime he is Full-time penetration tester and operates a YouTube channel on the subject.

The bridge to requirements engineering

Martin felt a little bit lost on the ReConfas the topic Requirements is not his domain. But at the same time, he recognized that his topic is extremely relevant for this community: because the earlier we start with security, the better it usually becomes ("Shift Left").

Move fast and Break Things

Marc Zuckerberg

Martin was less than enthusiastic about the advice from Marc Zuckerberg quoted here: "Then you inevitably buy into security problems. What he sees as a danger today is, among other things Vibe codinga procedure in which developers develop a complete app in one weekend with the help of AI. Security problems are inevitable with this approach.

Attackers only need to be successful once

The problem with security is the asymmetry: attackers only need to be successful once to achieve their goal. It doesn't matter if 99 attacks fail. But defenders must not make a single mistake.

Because of this fundamental asymmetry, it is important to address the issue of security at an early stage of development. An important tool for this is the threat model

Create threat models at an early stage

A threat model is actually just a list of all possible threat scenarios. To convey this task, Martin gave the audience a simple task: he showed a picture of a room with a light switch connected by a cable to a light bulb on the ceiling. He then collected suggestions as to how the room could be darkened.

It was enlightening for the audience to see how many possibilities there are. The suggestions ranged from the obvious ("Turn off the switch", "Cut the cable") to the extremely creative ("Blind everyone present", "Don't pay the electricity bill until the public utilities switch off the power").

Human attack vector

Because it is so important, Martin specifically addressed the most common cyber attacks against people, i.e. phishing, malware and data leaks. The examples included:

• Google Advertising - Used alarmingly often as a vector, often via links to popular software, which then contains malware as a payload
• Extensions - In this case, he showed an example from Visual Studio Code (Darcula Official Theme)
• ChatGPT Halucination - I found this attack particularly surprising: a hacker has discovered that ChatGPT hallucinates with certain commands. As an example, he cited ChatGPT's instruction on how to use the command line version of Hugging Face installed. ChatGPT suggested the command pip install huggingface-cli before. But this package didn't exist! The hacker registered the package immediately and it was downloaded 377,502 times in 3 months!

Because of hallucination, ChatGPT suggested installing a non-existent package. After the hacker created it, it was downloaded almost 400,000 times in 3 months!

Martin Haunschmid

Once an attacker has access to a computer, a full attack can be underway in just a few hours. Martin showed screenshots of the software that an attacker can use to monitor and control the compromised computers on a dashboard.

Other attackers also use Information StealerSmall programs that search for and upload everything of interest on the transferred computer.

Very bad is Ransomware, encrypted company data and often extorted millions. I myself was shocked when Economist a field report on a ransomware incident read: The expert was proud that they had "only" paid $180,000 to the blackmailers. Pragmatic and cheap from the company's point of view, but every dollar finances further extortion.

Depressing: little progress

The Open Worldwide Application Security Project (OWASP) is a non-profit organization that deals with cybersecurity. Among other things, it publishes a Top Ten of the most popular exploits. Martin showed the list from 2003, followed by the list from 2024. The result was sobering: the lists were frighteningly similar. Not much has changed in 20 years.

The circle closes

Security can only improve if we have testable requirements. This presentation is therefore relevant for anyone who works with requirements.

Of course, something only happens if neglecting safety has consequences. And there are: In addition to legal consequences (GDPRproduct liability), awareness of the extremely high costs of a successful ransomware attack is slowly gaining ground.

Conclusion

Martin Haunschmid has managed to convey the urgency. For systems engineering and product development, this means considering the issue of security as early as possible ("shift left"), whereby he describes the threat model as the most important tool. All stakeholders should be involved in order to identify as many attack vectors as possible. OSASP provides the Application Security Verification Standard (ASVS) ready.

Cybersecurity is not a luxury, it is a necessity. Companies that neglect security will regret it sooner or later.