5 ms·
These marketed attacks with special logos drive me up the wall. If I ever discover one I'll <edit!> give it a rude name and force everyone to look at a silly pi
by bencollier49 11y ago
These marketed attacks with special logos drive me up the wall. If I ever discover one I'll <edit!> give it a rude name and force everyone to look at a silly picture to go with it.
- rmc 11y agoBut Heartbleed was the first one, and it's marketing made it get everywhere. Regular newspapers, etc. Instead of hating people marketing vulnerbilities, tackle why people-in-power don't care about vuln when communicated the old way.
- deleted 11y ago[deleted]
- PakG1 11y agoHonestly, I think that would require a generation or two of a modified education system to bring about the desired result. You gotta deal with the here and now sometimes.
- laumars 11y ago> But Heartbleed was the first one Perhaps with a logo - I never really pay much attention to logos - but it wasn't the first to have an accessible name. Just off the top of my head I can name 3 SSL vulnerabilities that predated Heartbleed: BEAST, CRIME, BREACH. Personally I can't see how having a logo changes much in terms of press coverage since radio and printed newspapers tend not to publish the logos, online publications have a large resource of stock images they can use (eg Getty) and the TV would likely want video footage anyway. I think the nature of the bug with Heartbleed also played an important factor in it's coverage. It was quite a simple exploit to explain to the lay-person (albeit imprecisely) when compared to BEAST, CRIME, BREACH, POODLE, etc which require a much greater understanding of SSL/TLS. We do see other unbranded exploits are reported by the mainstream media, such as websites being hacked, DDoS attacks, etc, and in all of those instances the content is easily communicated in a 30 second soundbite.
- manarth 11y agoAnd if we step outside SSL vulnerabilities: - ILOVEYOU - Melissa - Slammer We've been naming attacks for a long time. Perhaps one difference is that these days, a vulnerability is named if it's deemed high-risk/high-impact. In the past, vulnerabilities became well-known names once they'd been seen to do serious damage.
- laumars 11y agoLet's not forget the Millennium bug. That thing also had a logo: http://ichef.bbci.co.uk/news/304/media/images/79938000/jpg/_79938728_squarebug.jpg http://ichef.bbci.co.uk/news/304/media/images/79938000/jpg/_...
- bmurphy1976 11y ago> But Heartbleed was the first one, and it's marketing made it get everywhere. Regular newspapers, etc. This is a blip. As soon as this escalates and everybody starts "Marketing" their latest security vulnerabilities they will once again be lost in the storm.
- danielbln 11y agoIt gets worse, some people produce a whole video around it: https://www.youtube.com/watch?v=3NL2lEomB_Y https://www.youtube.com/watch?v=3NL2lEomB_Y
- bencollier49 11y agoI guess we just rebrand some minor edge case of a well-known attack, give it a stupid name and use it to promote our security consultancy, is that it? EDIT: Sorry, for consultancy read "peer-reviewed paper".
- taf2 11y agoThat video is fun to watch though and does a pretty good job of explaining how that attack works.
- wingerlang 11y agoI agree, but it also felt like one of those TV Shop videos where you just know that you're being sold to.
- matthewmacleod 11y agoI'd be interested to know why this is the case. It's a hunch, but I reckon that this sort of 'branding' makes a serious problem more obvious and memorable. I mean, I remember 'Heartbleed' and 'GHOST', but I don't really remember the details of say CVE-2014-2523.
- bencollier49 11y agoI guess it depends whether Heartbleed and GHOST are actually more serious than the ones without names.
- themartorana 11y agoSeems a bit harsh and unnecessary. This is so much clearer than a security bulletin on a mailing list I'll never see. I'm pretty sure our sites are safe but now I'll remember to check. Rebels without a cause...
- camillomiller 11y agoWould be wonderful, you could also develop a fix and call it COCKBLOCK Edit: dear Ben, you let us down :(
- justinjlynn 11y agoThen develop a workaround for the fix and call it COCKKNOCKER. Edit: Well, OP edited their comment and now mine makes no sense... time to take a break.
- bencollier49 11y agoSorry! I need a more pseudonymous HN account.
- justinjlynn 11y agoNo worries mate... I really do need a break heh
- GirlProgrammer 11y agoCareful! Adria Richards will take your photo and tweet it, then blow her USB whistle! (BTW: Did Adria Richards realize that "Python" as in "Monty Python" is one big Penis Joke?)
- jamescun 11y agoI'm on the fence over the "marketing". On one hand it is easier to communicate terms like DROWN, GHOST and Heartbleed than say CVE-2016-0800; meaning knowledge of the vulnerability gets spreads quicker and sites are patched more readily. Alternatively it could be a distraction from good security management practices, where only the "marketed" vulnerabilities get patched instead of general tracking the security of critical pieces of your infrastructure.
- karlkatzke 11y agoYep; at this point, non-technical management is trained that "it's serious if it's got a cool name."
- shiftoutbox 11y agoWell how long before the novelty names run out of meaning ? For starters there are probably more issues out there then there are catchy American English anachronisms. I vote for using the names of Mezzo-American gods . Like Hachäk'yum or Xbalanque!
- fdej 11y agoI think GitHub should starting doing something this for issues and pull requests. Instead of the nondescript - Issue #2654: misplaced comma on page 3 of documentation - Issue #2653: open() should accept relative file path it should be - Quetzalcoatl's Rage: misplaced comma on page 3 of documentation - The Dying Curse of Buluc Chabtan: open() should accept relative file path
- krylon 11y agoThat would make issue trackers / change logs more interesting to read. ;-) A lot!
- carsonreinke 11y agoMarketing helps market the awareness of these problems, even non-tech folk have heard of Heartbleed. More awareness probably means software is likely to be updated.
- _yosefk 11y agoI think JSFuck beat you to it: http://arstechnica.com/security/2016/02/ebay-has-no-plans-to-fix-severe-bug-that-allows-malware-distribution/ http://arstechnica.com/security/2016/02/ebay-has-no-plans-to... ('Clever "JSFxxK" technique allows hackers to bypass eBay block of JavaScript.')
- tptacek 11y agoI know you didn't mean to do it, but because it's easier for people to snark about attack names, or react to snark, than it is to discuss a complicated crypto attack, this tangent about attack names takes up a pretty big chunk of the thread and really cruds the discussion up. Whatever you might think of the name, this is bona fide important crypto work; it's one of the more interesting TLS attacks ever discovered. Please try to be careful about distracting from the important stuff with silly stuff like naming.
- lawnchair_larry 11y agoThen maybe next time they won't distract people with silly marketing, forcing the conversation to be about substance.
- draw_down 11y agoI dunno, bencollier49. Seems like a strange hill to die upon.
- r1ch 11y agoI don't like it because it puts too much useful information on one domain. Will the researchers still be paying for the domain in 5-10 years?