3 ms·

Going by Kreb's analysis of the attack [1] it would appear that the breach was a run-of-the-mill SQL Injection attack. Proper security 1-0-1 stuff. [1] http://

Going by Kreb's analysis of the attack [1] it would appear that the breach was a run-of-the-mill SQL Injection attack. Proper security 1-0-1 stuff. [1] http://krebsonsecurity.com/2015/10/talktalk-hackers-demanded-80k-in-bitcoin/ http://krebsonsecurity.com/2015/10/talktalk-hackers-demanded...

vegabook 11y ago
fair enough, though I think the idea that 15-year-olds are somehow to be dismissed as greenhorns is incorrect. We surely have a disproportionate distribution skewed towards the young among the hackerati, even if we take into account the fact that 50+ age groups didn't have computers in their childhood.
- radicalbyte 11y ago
  I totally agree. The stuff I myself was doing at 15 was more sophisticated than the "security consultants" I talk to professionally even consider. At that age you have intelligence, lack of considering consequences and importantly lots of time. That's a dangerous combination.
- criley2 11y ago
  When you combine the potential lack of punishment for juveniles with the biological reality that prefrontal cortex development in adult humans doesn't really complete until the mid twenties, you get teenagers who don't think bad outcomes are possible, and whose brain is less capable of long term risk assessment. I would think that the 50+ crowd would be far more hampered by their risk assessment of the negative outcomes of these behaviors than by their skillsets alone. A teen is in it for the lulz, or the glory, or whatever, but a greybeard could lose his retirement, leave his spouse high and dry, lose his ability to see and support his family...
  - vegabook 11y ago
    So they're less risk averse even if they're less competent. Probably right. Though I think there's also something intellectually liberating about having no risk constraints, which might allow for attack vectors that are unconventional.
    - niels_olson 11y ago
      What you should be really afraid of is 50 year olds without risk aversion. Like the decision-makers at banks, politicians who will never personally go to war or the welfare line, etc.
monksy 11y ago
You would be suprised... There are startups out there who say "we don't care about an attack we're too small... we're going to write all of our sql by hand."
- 0942v8653 11y ago
  Just because they "write all of [their] sql by hand" doesn't mean they will be vulnerable to an attack as simple as this. This is just pure and unmitigated incompetence.
  - tsotha 11y ago
    Yes. Preventing SQL injection attacks is very, very easy. To have something like that in your code in 2015 is inexcusable.
- radicalbyte 11y ago
  It's not just startups. The stuff I've seen at some very large companies would make you cringe. As a colleague developer of mine says: I don't want any of my personal information on the internet because I know how developers think. Sigh.

vegabook 11y ago

fair enough, though I think the idea that 15-year-olds are somehow to be dismissed as greenhorns is incorrect. We surely have a disproportionate distribution skewed towards the young among the hackerati, even if we take into account the fact that 50+ age groups didn't have computers in their childhood.

radicalbyte 11y ago
I totally agree. The stuff I myself was doing at 15 was more sophisticated than the "security consultants" I talk to professionally even consider. At that age you have intelligence, lack of considering consequences and importantly lots of time. That's a dangerous combination.
criley2 11y ago
When you combine the potential lack of punishment for juveniles with the biological reality that prefrontal cortex development in adult humans doesn't really complete until the mid twenties, you get teenagers who don't think bad outcomes are possible, and whose brain is less capable of long term risk assessment. I would think that the 50+ crowd would be far more hampered by their risk assessment of the negative outcomes of these behaviors than by their skillsets alone. A teen is in it for the lulz, or the glory, or whatever, but a greybeard could lose his retirement, leave his spouse high and dry, lose his ability to see and support his family...
- vegabook 11y ago
  So they're less risk averse even if they're less competent. Probably right. Though I think there's also something intellectually liberating about having no risk constraints, which might allow for attack vectors that are unconventional.
  - niels_olson 11y ago
    What you should be really afraid of is 50 year olds without risk aversion. Like the decision-makers at banks, politicians who will never personally go to war or the welfare line, etc.

monksy 11y ago

You would be suprised... There are startups out there who say "we don't care about an attack we're too small... we're going to write all of our sql by hand."

0942v8653 11y ago
Just because they "write all of [their] sql by hand" doesn't mean they will be vulnerable to an attack as simple as this. This is just pure and unmitigated incompetence.
- tsotha 11y ago
  Yes. Preventing SQL injection attacks is very, very easy. To have something like that in your code in 2015 is inexcusable.
radicalbyte 11y ago
It's not just startups. The stuff I've seen at some very large companies would make you cringe. As a colleague developer of mine says: I don't want any of my personal information on the internet because I know how developers think. Sigh.