4 ms·

Sadly, I conclude that devices connected to the Internet are irremediably insecure. Air-gap it or lose it, I guess.

by helloworld 10y ago

criley2 10y ago
Digital is dangerous. There's a reason why the Kremlin switched back to typewriters.
- goalieca 10y ago
  funny thing is that they had digital bugs in the 70s and 80s just for those digital typewriters. Mechanical hipsters rejoice!
- yolesaber 10y ago
  Digital typewriters are prey http://www.cryptomuseum.com/covert/bugs/selectric/ http://www.cryptomuseum.com/covert/bugs/selectric/
- linkregister 10y ago
  The news stories from 2013 were amusing and compelling but all the articles reference an order of about a hundred typewriters. This implies an amazing level of productivity by Russian bureaucrats or that the typewriter order was not sufficient for their needs.
bfuller 10y ago
I can just imagine Richard Stallman tingling with pleasure reading comments like this (after pulling the html through his email server or whatever he does)
Taek 10y ago
That is ultimately too pessimistic. Security is a gradient, and there's a lot you can do make yourself both a smaller target, and a harder target. Compartmentalization is one of the strongest defense tools we have. For example, with the icloud leaks an attacker was able to gain access to all the data in a single strike. If it's true that Apple can no longer decrypt user's icloud data, an attacker now needs to hack people one-by-one. Hacking takes time and effort, and a one-by-one payoff may make it that hacking icloud is no longer worth the effort. Users are safer, even though they are still theoretically vulnerable. A lot of people are stepping up to the plate to offer stronger security on digital systems. (Qubes, for example. Let's Encrypt, for example). If choose to take security seriously, hacking will become harder, the rewards will plummet, and the world will be safer.
- sillysaurus3 10y ago
  helloworld's assessment is realistic when people's lives are on the line. That doesn't happen too often, but when it does, are you sure you'd trust a gradient?
  - Havoc 10y ago
    Sure. Lives are on the line constantly @ gradient. Eg drive a car where a safety feature was omitted because it's uneconomical
- xanderstrike 10y ago
  > hacking will become harder, the rewards will plummet, and the world will be safer... ...security will become less of a concern, hacking will become easier, the rewards will rise, security will be taken more seriously...
- threeseed 10y ago
  Unless I am mistaken iCloud wasn't compromised. There was an issue with allowing brute force attacks which was fixed. But all the publicised hacks were to do with individual accounts being compromised.
  - k-mcgrady 10y ago
    99% sure you're right. It was a mix of brute force and phishing iirc.
    - threeseed 10y ago
      And social engineering. I think in one case the "secret questions" used to reset accounts was actually asked during a media junket by a fake reporter.
kalsk 10y ago
In this case there wasn't even a real security vulnerability, just a spear-phishing attack. Organizations need to hold employees accountable for their own stupidity if they want to prevent this from happening. Any sane organization would fire an employee who gave a stranger keys to the office; falling for a phishing scam is the online equivalent of that.
- deleted 10y ago
  [deleted]
- bsder 10y ago
  > Any sane organization would fire an employee who gave a stranger keys to the office; falling for a phishing scam is the online equivalent of that. No, they likely wouldn't fire someone unless they specifically had controls in place for that (eg. security clearance area). People "tailgate" at companies all the time. http://www.pacifict.com/Story/ http://www.pacifict.com/Story/ In addition, the "value" of these records shot up dramatically once Russia was banned. The security was not stepped up to match. The real problem is the fact that managers DO request passwords, access control changes, etc. via email, and they do it more often than people get phished. So, people learn to give out information rather than protect it.
- mulmen 10y ago
  The security vulnerability is very real. Should this same treatment be applied to the people who write code? If a software vulnerability allows an attacker into the business should that developer be fired? What if it's a UI bug that causes the company to lose sales. Should they be on the hook? I think a more constructive reaction would be to say that phishing training is important and should be implemented or revised. In addition technical solutions should be investigated. Perhaps some of the infallible people who never fall for phishing attacks can automate part of their brilliance for the mere mortals.

Sadly, I conclude that devices connected to the Internet are irremediably insecure. Air-gap it or lose it, I guess.

criley2 10y ago

Digital is dangerous. There's a reason why the Kremlin switched back to typewriters.

goalieca 10y ago
funny thing is that they had digital bugs in the 70s and 80s just for those digital typewriters. Mechanical hipsters rejoice!
yolesaber 10y ago
Digital typewriters are prey http://www.cryptomuseum.com/covert/bugs/selectric/ http://www.cryptomuseum.com/covert/bugs/selectric/
linkregister 10y ago
The news stories from 2013 were amusing and compelling but all the articles reference an order of about a hundred typewriters. This implies an amazing level of productivity by Russian bureaucrats or that the typewriter order was not sufficient for their needs.

bfuller 10y ago

I can just imagine Richard Stallman tingling with pleasure reading comments like this (after pulling the html through his email server or whatever he does)

Taek 10y ago

That is ultimately too pessimistic. Security is a gradient, and there's a lot you can do make yourself both a smaller target, and a harder target. Compartmentalization is one of the strongest defense tools we have. For example, with the icloud leaks an attacker was able to gain access to all the data in a single strike. If it's true that Apple can no longer decrypt user's icloud data, an attacker now needs to hack people one-by-one. Hacking takes time and effort, and a one-by-one payoff may make it that hacking icloud is no longer worth the effort. Users are safer, even though they are still theoretically vulnerable. A lot of people are stepping up to the plate to offer stronger security on digital systems. (Qubes, for example. Let's Encrypt, for example). If choose to take security seriously, hacking will become harder, the rewards will plummet, and the world will be safer.

sillysaurus3 10y ago
helloworld's assessment is realistic when people's lives are on the line. That doesn't happen too often, but when it does, are you sure you'd trust a gradient?
- Havoc 10y ago
  Sure. Lives are on the line constantly @ gradient. Eg drive a car where a safety feature was omitted because it's uneconomical
xanderstrike 10y ago
> hacking will become harder, the rewards will plummet, and the world will be safer... ...security will become less of a concern, hacking will become easier, the rewards will rise, security will be taken more seriously...
threeseed 10y ago
Unless I am mistaken iCloud wasn't compromised. There was an issue with allowing brute force attacks which was fixed. But all the publicised hacks were to do with individual accounts being compromised.
- k-mcgrady 10y ago
  99% sure you're right. It was a mix of brute force and phishing iirc.
  - threeseed 10y ago
    And social engineering. I think in one case the "secret questions" used to reset accounts was actually asked during a media junket by a fake reporter.

kalsk 10y ago

In this case there wasn't even a real security vulnerability, just a spear-phishing attack. Organizations need to hold employees accountable for their own stupidity if they want to prevent this from happening. Any sane organization would fire an employee who gave a stranger keys to the office; falling for a phishing scam is the online equivalent of that.

deleted 10y ago
[deleted]
bsder 10y ago
> Any sane organization would fire an employee who gave a stranger keys to the office; falling for a phishing scam is the online equivalent of that. No, they likely wouldn't fire someone unless they specifically had controls in place for that (eg. security clearance area). People "tailgate" at companies all the time. http://www.pacifict.com/Story/ http://www.pacifict.com/Story/ In addition, the "value" of these records shot up dramatically once Russia was banned. The security was not stepped up to match. The real problem is the fact that managers DO request passwords, access control changes, etc. via email, and they do it more often than people get phished. So, people learn to give out information rather than protect it.
mulmen 10y ago
The security vulnerability is very real. Should this same treatment be applied to the people who write code? If a software vulnerability allows an attacker into the business should that developer be fired? What if it's a UI bug that causes the company to lose sales. Should they be on the hook? I think a more constructive reaction would be to say that phishing training is important and should be implemented or revised. In addition technical solutions should be investigated. Perhaps some of the infallible people who never fall for phishing attacks can automate part of their brilliance for the mere mortals.