8 ms·

Am I the only one thinking that we've lost total control over the machines and data we've created. It seems like nothing is safe and or verifiable anymore. Ad

Am I the only one thinking that we've lost total control over the machines and data we've created. It seems like nothing is safe and or verifiable anymore. Add to this the backdrop of governments wanting backdoors. People calling you in the US pretending to be from the "IRS" and yet nothing is/ can be done about it? Maybe its really high time for C and its buffer overflows to go... And SQL injection. We're tech savy here, yet sometime even we fall for these things. Its starting to get actually expensive. I hate to be all conspiracy theory about this, but if/when the banks fall down like this....

marklgr 11y ago
From one of the comments in the article, it's probably more like we've lost control of how businesses work. Many people don't like the phrase "race to the bottom", but that's what comes to mind when you get to see how personal data is handled to third parties and/or cheap, expendable workforce.
- keithpeter 11y ago
  At that point, one would expect to see increasing regulation kick in. It did historically for other kinds of service, e.g. financial services, insurance, public transport &c.
such_a_casual 11y ago
While I know very little about 'computer security', I have never been under the impression that Dell is aware such a term exists. "another dangerous dell root cert dicovered" http://www.pcworld.com/article/3008478/security/and-then-there-were-two-another-dangerous-dell-root-certificate-discovered.html http://www.pcworld.com/article/3008478/security/and-then-the... "dell attacks on scada doubled" http://securityaffairs.co/wordpress/35967/hacking/dell-attacks-on-scada-doubled.html http://securityaffairs.co/wordpress/35967/hacking/dell-attac... "in what some experts are calling the biggest data theft in US history." http://www.abc.net.au/news/stories/2011/04/07/3185296.htm http://www.abc.net.au/news/stories/2011/04/07/3185296.htm
bonestamp2 11y ago
If they could prevent/stop caller id spoofing, that would be a big help in at least the detection phase of phone system security. It's really hard to identify a threat if they can look like they're anybody.
- DrScump 11y ago
  This is too easy with VoIP. It should be illegal for anybody to spoof Caller-ID for deception. The only acceptable caller-id transmitted should be one of: a) the actual origin number; b) the number for a company switchboard that accepts incoming calls to the originating group; or c) blocked number.
  - ascagnel_ 11y ago
    This would also prevent instances of SWATing (someone calls a hoax call into a local police department to force a deployment to a hostile situation where one does not exist).
- theandrewbailey 11y ago
  I wonder how much of a pain in the ass putting X509 (or something like it) into POTS/caller ID. It would stop spoofing dead in it's tracks.
adventured 11y ago
> People calling you in the US pretending to be from the "IRS" and yet nothing is/ can be done about it? Not quite sure I understand your premise on that one. You can't stop people from pretending to be from the IRS any more than you can stop criminal activity by outlawing it. Essentially anyone can call anyone else and pretend to be from a government agency. Ultimately you're going to have to verify that or otherwise know better, there is no practical technical means to stop it. There's a certain level of personal responsibility that comes into play there. That goes with similar things like falling for investment scams over the phone as well. Such should be pursued by the authorities obviously - and you're still responsible for your own person regardless, you can't be saved from everything: the IRS doesn't call people like that, it would take 30 seconds to figure that out via google. The same type of problem would arise if an impostor showed up at your door pretending to be from the IRS. How do you stop it completely? You don't, you arrest after the fact if you can; if it gets widespread enough to be a big problem, you attempt education outreach to teach people not to fall for it. These types of scams are ancient, and will never stop existing (the scammers will always adapt); the only highly effective means of stopping it is awareness.
- derefr 11y ago
  I think the suggestion would be something like having SSL certificates tied to phone numbers the way they're currently tied to domain names, such that there's a difference between a call from some phone number that when reverse-lookuped says "the IRS", and a call that actually shows up as being from "[padlock] the IRS"; and eventually the former could become "[x] Probably Not Actually The IRS".
- viraptor 11y ago
  These scams rely on nobody tracing them back. The phone system is completely insecure, loses are too small to prosecute properly, and it hits mostly people who don't know how to defend themselves. The whole idea of unauthorized phone systems and impersonating officials is probably only going to go away after it actually hits someone who "matters". For example soon after a well known politician's house gets swated a few times and they learn it's how hard is it to track it down. (if the caller knows how to protect themselves and do a few redirections, that is)
Johnny555 11y ago
Maybe its really high time for C and its buffer overflows to go... And SQL injection. Because no one ever wrote an insecure website in Java? And certainly PHP must also be completely safe since it has no buffer overflows to worry about. Are you sure the language is at fault?
- josteink 11y ago
  Assuming an averagely careless programmer, a language made out of shotguns will produce more errors than a language with the occasional presence of shotguns. When simply trying to concatenate 2 strings can result in arbitrary code getting executed, memory leaks, actual data-loss or fatal program instability (or all of those), it's pretty obvious the C language itself is made out of shotguns. Making simple things simple and safe will produce fewer errors and fewer security issues. I don't see how anyone can try to argue anything else.
  - rms_returns 11y ago
    > it's pretty obvious the language itself is made out of shotguns. You are hitting the hammer where there is no nail! In this instance, the Dell WEBSITE was hacked which are (99% of the time) written in high-level programming languages like php, python or Java. No sane business uses C/C++ to develop a website. C/C++ is used for INTERNAL SYSTEM PROGRAMMING and those systems are already linux based and almost impossible to hack (Even in the rare instance that they DO get hacked, C/C++ has nothing to do with it).
    - jlgaddis 11y ago
      > You are hitting the hammer where there is no nail! Pot. Kettle. Black. > In this instance, the Dell WEBSITE was hacked ... I saw absolutely nothing in the article that could even remotely be considered proof of this.
      - dsmithatx 11y ago
        I work with a team in India. I can assure you the Dell tech reps log into Dell's system and are not hacking via the website. This is an inside job and there are no simple ways around it. Cost benefit analysis shows Dell they can allow you to get ripped off. They are still are selling computers and saving tons of money offshoring. They have no reason to correct this problem. Glad I build my own PC's at home.
ctstover 11y ago
You do realize that if "they" took C away from us, then all we would be allowed to use is closed source lock-in oriented ecosystems to the point we wouldn't even be able to trust the very language itself. That's always been the dream, trusted computing all the way from boot to .NET (or similar). You can not in the same breath call for secure computing and spread propaganda against C. (I know it's too much of a leap for most, but it's the same non sequitur as being against government's tight grip on society and for gun control at the same time.)
- eru 11y ago
  I don't get it. What's wrong with using something like Haskell or Rust? The security there is in the type system at compile time, no Trusted Computing shenanigans, and you still avoid buffer overflows and SQL injections (if you use them properly). Even something as lowly as Python mostly protects you from buffer overflows.
  - ctstover 11y ago
    Regardless of the language, if it had a closed source runtime interpreter and/or VM that you forbade you from performing various sequences of operations on hardware that you "own", actively fought against you seeing what it was doing, etc - then you would no more be able to "trust" it than back-doored cryptography. (I'm getting sleeping, so that may sound wrong. Though it's been a popular troll/advocacy touch point since at least the mid 90s, so there should be plenty of resources out there if your are more curious. ie FSF for starters.)
    - DannoHung 11y ago
      That is not what either Rust or Haskell are. It would behoove you to have a passing familiarity with what someone says before responding to them combatively
      - eru 11y ago
        Thanks! > That is not what either Rust or Haskell are. Nor even Python.
damian2000 11y ago
Because there's huge amounts of money at stake, I believe banks operate with a far higher level of security than average companies doing business online ... for them its an existential threat.
Taek 11y ago
It's going to take a lot more than a new programming language to fix the problems. If there's 10 million dollars worth of data to steal, that's enough to pay an entire team of professionals to work full time for a year or more on stealing the data, with a huge payout. Being secure against that kind of attack is going to require an entire paradigm shift in how we approach security. New languages, new operating systems, and new assumptions about how much an attacker has compromised, including learning to keep things heavily compartmentalized.
Taek 11y ago
It's going to take a lot more than a new programming language to fix the problems. If there's 10 million dollars worth of data to steal, that's enough to pay an entire team of professionals to work full time for a year or more on stealing the data, with a huge payout. Being secure against that kind of attack is going to require an entire paradigm shift in how we approach security. New languages, new operating systems, and new assumptions about how much an attacker has compromised, including learning to keep things heavily compartmentalized.

marklgr 11y ago

From one of the comments in the article, it's probably more like we've lost control of how businesses work. Many people don't like the phrase "race to the bottom", but that's what comes to mind when you get to see how personal data is handled to third parties and/or cheap, expendable workforce.

keithpeter 11y ago
At that point, one would expect to see increasing regulation kick in. It did historically for other kinds of service, e.g. financial services, insurance, public transport &c.

such_a_casual 11y ago

While I know very little about 'computer security', I have never been under the impression that Dell is aware such a term exists. "another dangerous dell root cert dicovered" http://www.pcworld.com/article/3008478/security/and-then-there-were-two-another-dangerous-dell-root-certificate-discovered.html http://www.pcworld.com/article/3008478/security/and-then-the... "dell attacks on scada doubled" http://securityaffairs.co/wordpress/35967/hacking/dell-attacks-on-scada-doubled.html http://securityaffairs.co/wordpress/35967/hacking/dell-attac... "in what some experts are calling the biggest data theft in US history." http://www.abc.net.au/news/stories/2011/04/07/3185296.htm http://www.abc.net.au/news/stories/2011/04/07/3185296.htm

bonestamp2 11y ago

If they could prevent/stop caller id spoofing, that would be a big help in at least the detection phase of phone system security. It's really hard to identify a threat if they can look like they're anybody.

DrScump 11y ago
This is too easy with VoIP. It should be illegal for anybody to spoof Caller-ID for deception. The only acceptable caller-id transmitted should be one of: a) the actual origin number; b) the number for a company switchboard that accepts incoming calls to the originating group; or c) blocked number.
- ascagnel_ 11y ago
  This would also prevent instances of SWATing (someone calls a hoax call into a local police department to force a deployment to a hostile situation where one does not exist).
theandrewbailey 11y ago
I wonder how much of a pain in the ass putting X509 (or something like it) into POTS/caller ID. It would stop spoofing dead in it's tracks.

adventured 11y ago

> People calling you in the US pretending to be from the "IRS" and yet nothing is/ can be done about it? Not quite sure I understand your premise on that one. You can't stop people from pretending to be from the IRS any more than you can stop criminal activity by outlawing it. Essentially anyone can call anyone else and pretend to be from a government agency. Ultimately you're going to have to verify that or otherwise know better, there is no practical technical means to stop it. There's a certain level of personal responsibility that comes into play there. That goes with similar things like falling for investment scams over the phone as well. Such should be pursued by the authorities obviously - and you're still responsible for your own person regardless, you can't be saved from everything: the IRS doesn't call people like that, it would take 30 seconds to figure that out via google. The same type of problem would arise if an impostor showed up at your door pretending to be from the IRS. How do you stop it completely? You don't, you arrest after the fact if you can; if it gets widespread enough to be a big problem, you attempt education outreach to teach people not to fall for it. These types of scams are ancient, and will never stop existing (the scammers will always adapt); the only highly effective means of stopping it is awareness.

derefr 11y ago
I think the suggestion would be something like having SSL certificates tied to phone numbers the way they're currently tied to domain names, such that there's a difference between a call from some phone number that when reverse-lookuped says "the IRS", and a call that actually shows up as being from "[padlock] the IRS"; and eventually the former could become "[x] Probably Not Actually The IRS".
viraptor 11y ago
These scams rely on nobody tracing them back. The phone system is completely insecure, loses are too small to prosecute properly, and it hits mostly people who don't know how to defend themselves. The whole idea of unauthorized phone systems and impersonating officials is probably only going to go away after it actually hits someone who "matters". For example soon after a well known politician's house gets swated a few times and they learn it's how hard is it to track it down. (if the caller knows how to protect themselves and do a few redirections, that is)

Johnny555 11y ago

Maybe its really high time for C and its buffer overflows to go... And SQL injection. Because no one ever wrote an insecure website in Java? And certainly PHP must also be completely safe since it has no buffer overflows to worry about. Are you sure the language is at fault?

josteink 11y ago
Assuming an averagely careless programmer, a language made out of shotguns will produce more errors than a language with the occasional presence of shotguns. When simply trying to concatenate 2 strings can result in arbitrary code getting executed, memory leaks, actual data-loss or fatal program instability (or all of those), it's pretty obvious the C language itself is made out of shotguns. Making simple things simple and safe will produce fewer errors and fewer security issues. I don't see how anyone can try to argue anything else.
- rms_returns 11y ago
  > it's pretty obvious the language itself is made out of shotguns. You are hitting the hammer where there is no nail! In this instance, the Dell WEBSITE was hacked which are (99% of the time) written in high-level programming languages like php, python or Java. No sane business uses C/C++ to develop a website. C/C++ is used for INTERNAL SYSTEM PROGRAMMING and those systems are already linux based and almost impossible to hack (Even in the rare instance that they DO get hacked, C/C++ has nothing to do with it).
  - jlgaddis 11y ago
    > You are hitting the hammer where there is no nail! Pot. Kettle. Black. > In this instance, the Dell WEBSITE was hacked ... I saw absolutely nothing in the article that could even remotely be considered proof of this.
    - dsmithatx 11y ago
      I work with a team in India. I can assure you the Dell tech reps log into Dell's system and are not hacking via the website. This is an inside job and there are no simple ways around it. Cost benefit analysis shows Dell they can allow you to get ripped off. They are still are selling computers and saving tons of money offshoring. They have no reason to correct this problem. Glad I build my own PC's at home.

ctstover 11y ago

You do realize that if "they" took C away from us, then all we would be allowed to use is closed source lock-in oriented ecosystems to the point we wouldn't even be able to trust the very language itself. That's always been the dream, trusted computing all the way from boot to .NET (or similar). You can not in the same breath call for secure computing and spread propaganda against C. (I know it's too much of a leap for most, but it's the same non sequitur as being against government's tight grip on society and for gun control at the same time.)

eru 11y ago
I don't get it. What's wrong with using something like Haskell or Rust? The security there is in the type system at compile time, no Trusted Computing shenanigans, and you still avoid buffer overflows and SQL injections (if you use them properly). Even something as lowly as Python mostly protects you from buffer overflows.
- ctstover 11y ago
  Regardless of the language, if it had a closed source runtime interpreter and/or VM that you forbade you from performing various sequences of operations on hardware that you "own", actively fought against you seeing what it was doing, etc - then you would no more be able to "trust" it than back-doored cryptography. (I'm getting sleeping, so that may sound wrong. Though it's been a popular troll/advocacy touch point since at least the mid 90s, so there should be plenty of resources out there if your are more curious. ie FSF for starters.)
  - DannoHung 11y ago
    That is not what either Rust or Haskell are. It would behoove you to have a passing familiarity with what someone says before responding to them combatively
    - eru 11y ago
      Thanks! > That is not what either Rust or Haskell are. Nor even Python.

damian2000 11y ago

Because there's huge amounts of money at stake, I believe banks operate with a far higher level of security than average companies doing business online ... for them its an existential threat.

Taek 11y ago

It's going to take a lot more than a new programming language to fix the problems. If there's 10 million dollars worth of data to steal, that's enough to pay an entire team of professionals to work full time for a year or more on stealing the data, with a huge payout. Being secure against that kind of attack is going to require an entire paradigm shift in how we approach security. New languages, new operating systems, and new assumptions about how much an attacker has compromised, including learning to keep things heavily compartmentalized.

Taek 11y ago