14 ms·
Hackers say Friday's massive DDoS attacks were just a dry run
- gremlinsinc 10y agoCouldn't they create a completely separate IOT protocol, so only connections expecting to receive connections from that protocol would receive it--so essentially a IOC device could only ping specific IP's that use a different spec like 255.255.255.255.255 or something.. Essentially a separate internet that can't mess up networks on the main internet? It could still use the internet as a gateway, but would give ddos' protection more ability to block things.
- niftich 10y agoAsk anyone involved in rolling out IPv6 how painful it is to get every middlebox on the public Internet to route a different protocol besides the original IPv4.
- zeven7 10y agoWhat about a special set of bytes that are standardized that all IOT machines should send in every request. Some sort of IS_IOT signature. That way if there's a huge influx, all messages containing the signature could be filtered.
- willglynn 10y agoRFC 3514 seems appropriate here: 1. Introduction Firewalls [CBR03], packet filters, intrusion detection systems, and the like often have difficulty distinguishing between packets that have malicious intent and those that are merely unusual. The problem is that making such determinations is hard. To solve this problem, we define a security flag, known as the "evil" bit, in the IPv4 [RFC791] header. Benign packets have this bit set to 0; those that are used for an attack will have the bit set to 1. https://www.ietf.org/rfc/rfc3514.txt https://www.ietf.org/rfc/rfc3514.txt
- kccqzy 10y agoThis RFC was published on April 1.
- willglynn 10y agoQuite correct, but nonetheless, that RFC does explore the topic of "why not just mark the traffic?" One basic objection which detaro pointed out is that there's nothing to stop attackers from clearing such marks. As Wikipedia puts it: > The evil bit has become a synonym for all attempts to seek simple technical solutions for difficult human social problems which require the willing participation of malicious actors https://en.wikipedia.org/wiki/Evil_bit https://en.wikipedia.org/wiki/Evil_bit
- detaro 10y agoThat would be quite complicated to integrate so deep into the stack that the malware running on a compromised device couldn't just ignore it.
- ComodoHacker 10y agoWhatever protocol you use, its traffic will be flowing the same pipes.
- rezot 10y agoHackers?
- Just_Another 10y ago> Meanwhile not much is required in the way of resources or skill to mount a botnet attack... You mean they don't qualify?
- eveningcoffee 10y agoThis was a claim (according to the article) of specific group who goes by the name New World Hackers. The word hackers has very wide meaning and this title can be considered to be insulting to multiple subgroups who like to think of them as hackers in a good sense.
- chiefalchemist 10y agoThe USA elections are right around the corner. Nuff said.
- asddddd 10y agohttp://www.anonintelgroup.com/2016/10/21/twitter-down-its-not-the-russians-its-the-new-world/ http://www.anonintelgroup.com/2016/10/21/twitter-down-its-no...
- meira 10y agoEverything looks so fake nowadays.
- ComodoHacker 10y agoPerhaps this should be the source link instead of CBC. Worth noting: >we are in Russia Also their website default page looks like DDoS UI.
- x0ner 10y agoSuggested targeting: "...attacks were merely a test, and claimed that the next target will be the Russian government for committing alleged cyberattacks against the U.S. earlier this year."
- ComodoHacker 10y agoWhat a BS. When you target Russian government you don't test on completely unrelated infrastructure it doesn't use.
- bitwize 10y agoMr. Robot? Is that you?
- WalterBright 10y agoIt's kinda silly to make a dry run like that, because people in charge of the attacked systems will harden them and the attack is much less likely to work next time.
- astockwell 10y agoNot at all the case with IoT. See Bruce Schneier's recent article on the matter, where he makes the case that government regulation is the only feasible remedy at this point, as "The market can't fix this because neither the buyer nor the seller cares." [1]. [1] https://www.schneier.com/blog/archives/2016/10/security_econom_1.html https://www.schneier.com/blog/archives/2016/10/security_econ...
- WalterBright 10y agoI meant the servers being attacked. The owners of them definitely care. As for the IoT, the appliances could have their firmware in ROM instead of flash. Then, the malmare would not survive a reboot. Many customers are large scale enough (Microsoft, Google, governments, etc.) that they can demand it of vendors and vendors will deliver. Really, how often do you desire to update the firmware on your hard drive, your USB stick, etc.? (Another way to do it is to have the write-enable line controlled by a physical switch or jumper.) The only thing I can figure is everyone has forgotten what ROM is.
- psybin 10y agoIf there's a ROM with non-editable software it will just get instantly compromised as soon as it comes back up. For your standard "internet of things" device there is no room, physically or in the bill of materials, for things like connectors for people to physically deliver updates.
- WalterBright 10y agoThis is not a difficult problem to solve. The ROM cannot be overwritten - hence it can be designed so that malware cannot run. Also, jumpers are cheap. Just set the jumper to enable writes, and download the update. Are you happy with it being unknowable which of your appliances are compromised or not? Would you pay $1 more for a disk drive with firmware in ROM? I would. If you were running a banking system, would you pay extra for code in ROM that cannot be compromised?
- dimino 10y agoIs there any evidence whatsoever actually linking the people who claimed responsibility with the person/persons who actually perpetrated the attack?
- rms_returns 10y agoI think its just the good old 1990s scenario repeating itself, only this time with IoT, rather than usual IT. First, a mad rush towards the IoT where every startup and their dog wants to setup their business on IoT. Then comes fear as the hackers try to exploit every hole in IoT devices. And finally, once people realize the importance of keeping with the software upgrades, the market will settle somewhere in between.
- nickpsecurity 10y agoI was just saying something similar on Lobsters. It's even the same patterns down to no security in OS's and Telnet-style issues.
- jacobsenscott 10y agoThe thing is there will be no upgrades for the IoT. Just look at all the Android phones abandoned by their manufacturers. Do you think Phillips is going to pay someone to produce patches for a 5 year old light bulb, or smoke detector, or whatever?
- detaro 10y agoIf it becomes to bad and people start to pay attention, yeah. If there were more malware doing (edit: very visible) stupid shit around, people would learn quite quickly (instead of malware that tries to hide and do things that don't effect the device owner), this way we'll see where it goes.
- psybin 10y agoMost compromises in things like this are going to be invisible almost by accident. Unless your light bulb is maxing out your upload for extended periods of time, or the police come knocking on your door when your light bulb does something very illegal and very loud, nobody is ever going to notice.
- an_account 10y agoCould someone connect to all the vulnerable cameras/iot devices and lock them down so that they can't be used in botnets in the future?
- cft 10y agopresumably when Mirai botnet compromises them, it changes the passwords.
- scurvy 10y agoA lot of the passwords can't be changed. They're fixed from the factory. That's one of the really difficult things about dealing with this. I bet that a greyhat will find a way to brick a lot of these cameras.
- pimlottc 10y ago> I bet that a greyhat will find a way to brick a lot of these cameras. A chaos monkey for internet security - now that's an interesting thought! That could actually work. Market forces aren't strong enough currently to force manufacturers to get security right, since the average user doesn't really care that much about it. But if it became common for any poorly secured product to turn into a brick as soon as you connect it to the Internet, users would pretty quickly figure out what brands to buy and bring some serious pressure to bear on the others...
- Ar-Curunir 10y agoWow. I've done research on smart-locks and their poor security models before, but this is news to me. I hear people bemoaning introducing govt. regulation, but I honestly cannot see another way out of this; these manufacturers clearly do not care!
- hilbertseries 10y agoMirai kills the ssh server on the machines when it starts.
- nickpsecurity 10y agoJust bring it, hackers! Drop 100Tbps on every critical service to show them what's up! Hit all of them with everything you got! I've been waiting for a good illustration to regulators of why POTS, leased lines, and satellite must continue to get investment & kept separate. On top of the small cases I have. All these people's shit is going down whereas the people using dial-up to BBS's or leased lines between critical sites are still doing just fine. I mean, they do gripe about speed or pricing more than the rest of us but that's the kind of problems they're used to living with. ;) Note: The major attacks will also get regulators' attention to IoT risk. I have recommendations of techniques and existing products ready for that, too. Note 2: I think someone will see this saying, "OMG! He's encouraging crimes and damage to happen! WHY!?" Actually, apathy by consumers and suppliers is why it happens and will get worse regardless of what I say. I'm just waiting for the inevitable as an opportunity to improve the situation.
- ccvannorman 10y ago"Due to increased DDOS attacks, the U.S. and European nations' governments felt their hand was forced. Swift and sweeping legislation was passed to 'keep you safe' online, including deep tracking and identification of every activity taken online. The number of personnel hires for citizen monitoring increased tenfold in the pursuit of catching hackers, in a new global program that governments are calling, 'no stone unturned'. Private contractors were swift to step in with their offer, providing ever more efficient and penetrating tools to get this job done. Citizens never felt so safe!"
- nickpsecurity 10y agoAre you... from the future??? Cuz that sounds way too plausible.
- Samis2001 10y agoI was expecting that to be a quote from a book or a story and was surprised that it wasn't. Good job, it's scarily plausible. Especially in the UK.
- elchief 10y agoOr maybe it was a distraction while they did some nasty stuff we'll hear about (or not) on Monday... Big linux vuln announced day before, right?
- CN7R 10y agoOk so I don't know that much about how DDoS attacks work besides that it's basically a large influx of input that makes it impossible for 'legitimate' users to get through. But in a block chain, a Sybil attack—imagine voter election fraud, where numerous fake IDs are made to vote for a candidate—is blocked by making the cost of generating hash values (government ID is pretty hard to counterfeit) extremely high. Can the same methodology be applied to blocked DDoS attacks? Like using Dyn to find a domain is similar to making a phone booth call to yellow book call center, why not just raise the price of calling from 25c to $1.00?
- kevingadd 10y agoBecause the whole internet would become unusable if DNS lookups cost you a dollar. In the first place, the requests are being made by owned IoT devices. So making the requests more expensive (in time, bandwidth, or actual money) would just hurt the owners of those devices. The people operating the botnet wouldn't care, they'd just get a larger botnet.
- CN7R 10y agoI don't mean an actual dollar cost but computing power. Is there a way to enforce a limit on requests from IoT, or a way to increase costs of running a botnet but not have that cost transfer to the owners of IoT?
- kevingadd 10y agoIoT botnets are a problem because they're massively distributed. Even if a single device could only issue one request per second you'd just need to own more devices. There are millions and millions of vulnerable boxes out there, sometimes dozens in one home or office.
- psybin 10y agoThings get crazier once you have one compromised hole-punched device that is behind your NAT/firewall too. You can end up in a situation where you have a local C2 server on your light bulb, controlling a sub-botnet of your fridge, washing machine, and wifi controlled doorbell. It's not unreasonable to think that this could compromise orders of magnitude more devices than the original botnet itself, considering how many things are just saved by their interface not being routable or accessible from the wider internet. Something I've wondered is how much of an impact large botnets have on other systems they rely on. If you had a million compromised CPUs in a small geographic area suddenly jump from a low power state into doing a massive amount of work, could it cause localized brown outs? Some napkin math says probably not, but it's not something I've heard considered much before.
- wokky 10y agoImagine if all those IP cameras, routers, NAT boxes and what-have-you had been designed with one simple policy: the internet port doesn't work until the user sets a password. Even very lame passwords might be expected to reduce the effectiveness of this attack approach by an order of magnitude or two.
- stephen_g 10y agoI was just saying to a friend yesterday that this would be a great policy. I think it would go a long way. But the problem remains that these devices, more often than not just don't get updated. So in a year or two, there will probably be a handful of exploitable issues that won't ever get patched...
- necessity 10y agoHow many Windows users are using a pirated version of their operating system that gets no updates? How many of those using the genuine version ignore/disabled it? How many update their anti-virus? Custom ROM users? How many Ubuntu users ignore the updates? ...
- Drdrdrq 10y ago> How many Ubuntu users ignore the updates Hopefully not many, though I could never understand why unattended-updates package is not installed and enabledby default.
- petre 10y agoBecause it breaks things. Updates sometimes break things and require human intervention to get the device running properly again. This can happen since systems use different hardware. With IoT it's an issue to a lesser extent, but you can also brick those with an upgrade.
- oneeyedpigeon 10y ago
- jonshariat 10y agoWhen is someone going to make a robin hood malware that helps resolve these issues and fights off other malicious tools trying to use these insecure devices?
- kimburgess 10y agoThe Mirai source is up on GitHub if anyone's considering doing this: https://github.com/0x27/linux.mirai https://github.com/0x27/linux.mirai. Regardless of any good intentions, it'd be a pretty grey area to deploy a tool that cleaned and then protected against future attacks on a device. The exploit (well, at least the one currently drawing attention) is targeted at devices running BusyBox that are compromised over telnet with a embarrassingly small dictionary attack. If you could clean any existing instances, the protection for future exploits is simple - set a randomly generated password. The downside is doing this (without approval) to remote devices would likely break device functionality. The majority of users/owners of these devices are likely completely unaware they have been compromised today as it has little to no effect on anything they can see. Sure, a robing hood malware could clean up this mess pretty effectively, but the little side effect of stopping devices from, you know, working is probably undesirable.
- hellofunk 10y agoHow are all these iot devices and their ip address found by hackers?
- Kalium 10y agoIP space is limited. If you have a botnet already, you can scan all of IP space. Also, a lot of them expose web interfaces that Google has already found...
- kimburgess 10y agohttps://www.shodan.io/ https://www.shodan.io/
- michwill 10y agoSince the exploit is known: I wonder, is it possible to hack all these devices and let them DDOS localhost?
- petre 10y agoIt would be almost useless since localhost doesn't even generate outside traffic. It will only drive up the electricity consumption and heating the device. One could run a fork bomb and temporarily brick or permanently damage the device (due to overheating) or disable networking altogether.
- kps 10y agoNot localhost: have the device make a nuisance of itself on the local network.
- rdtsc 10y agoThis DoS attack kills the Internet Of Things as a cool new phrase. There is already https://twitter.com/internetofshit https://twitter.com/internetofshit of course. But that is more whimsy and fun "Oh look my toaster is tweeting, that's silly". This attack is more like "Oh-oh, my toaster killed Twitter". So even though as a thing IoT is here to stay, I think the phrase itself will sound negative and will be avoided.
- newmanships 10y agoThere's also a subreddit of the same name that has some good articles from time to time.
- wes-k 10y agoIgnorant thinking out loud here. Is it feasible for certain infrastructure providers to team up and collect the ip addresses of the requests. This gives us a list of IPs with bots. THEN google, Facebook, Twitter, etc (major web properties) use this list to notify any of its users that one or more of their devices have been compromised and point them to a how to guide for securing it. Or more simple a script to patch it. My thinking is that the only way to stop this is to get users to lock down their insecure devices. A constant banner would annoy most people to action. Especially if it was really easy to issue a fix. Download and run. Script determines the actual device causing the harm and patches it. Possibly asking for a new password from user. I guess this assumes that a script could be written to issue a patch for the majority of cases. If not, then how is this device connected? Script could detect router and apply fix at that point. So we need: 1. IP addresses for the sources of the attack load. 2. A way to distribute patches for those IP addresses. I propose: 1. Those suffering the attacks can provide this. 2. Notify users via websites coordinating on displaying an alert with tools to patch. Alternative solution to #2: Can some part of the ISPs that connect these IPs be patched to detect and block malicious attacks?
- mirimir 10y agoMakes sense to me. Back in the day, the Internet was far simpler, with far less bullshit. If your IP was spewing crap, you would hear about it. And you either resolved the problem, or got null-routed. The Internet is far^N larger and more complex, for sure. But accountability still has a place, I think. I wonder if Dyn will at least release a heat map of source IPs.
- wes-k 10y agoOr Dyn and the like should build a system to throttle requests from a given IP. Whitelist trusted IPs that REQUIRE high volume of requests.
- IntelMiner 10y agoWhich would still fall over when you're being flooded with more traffic than you can either outright handle, or screen for authenticity
- Fej 10y agoHow can I test a device I own to see if it's vulnerable? Just telnet in and try passwords?
- itsmeaaron 10y agoI have the same question. Countless articles explain these attacks are being carried out via IoT devices but I've seen no mention of specific brands/models. Are there worst offenders? Are common devices like Nest, Wink, etc vulnerable?
- ommunist 10y agoI think these statements are bogus. Russian government is a much smaller target than Twitter. Besides, it does not rely on the Internet to function.
- ZenoArrow 10y ago> "I think these statements are bogus. Russian government is a much smaller target than Twitter." It's not about the size of the infrastructure, it's about the size of the political statement. Targeting larger infrastructure first appears to have been a move to demonstrate the power of their botnet.
- blazespin 10y agoMaybe someone should create an exploit to brick all of these IoT devices. Than perhaps people would wake up to the problem..
- andrewflnr 10y agoOr a worm that patches them, removes malware, changes the credentials, or something like that.
- Drdrdrq 10y agoThis! On a sidenote: would this be white, black or grey hat operation? Or rainbow hat? :) EDIT: this is the only realistic way of securing the devices.
- Animats 10y agoToo late. The attack payload apparently turns off the Telnet service to prevent other botnets from taking over the device.
- clarry 10y agoMy experience from talking with non-techies suggests that they'll never understand the problem is the lack of security in their devices & network. All they do is act victim and get enraged about hackers. The thought that they should demand security from the companies who sold them the vulnerable devices doesn't cross their mind, and if try to sell them such an idea, they will protest and call for justice on the principle that it is the hackers who are being criminal and it's not the victim's or his devices' responsibility to keep themselves safe. Just as they don't expect to have to live in a bunker with inpenetrable locks to stay reasonably safe from burglary.
- worg 10y agoStretching a bit the burglary analogy you could put it like: "imagine a guy selling you a door lock that can be opened by anyone and then you use it to lock a shootgun, can you shift all the blame to the guy who just took it an shoot your neighbor?"
- ryanlm 10y agoWho are these people init'ing the attacks? They seem like talented folks.
- petre 10y agoToo bad this will lead ISPs to blocking ports 23, 22, breaking telnet and ssh to those ports.
- inferiorhuman 10y agoIMO it's already a bad practice to have SSH listening on a publicly accessible interface on port 22.
- petre 10y agoYeah? Then privision a new box and try to ssh to it with port 22 blocked. I could of course run fail2ban or a firewall rule in order to block at 3 failed attempts to connect and still run on port 22. Or use port knocking.
- inferiorhuman 10y agoOr just use an alternate port. There are, what, 65533 alternate ports available? > Then privision a new box and try to ssh to it with port 22 blocked. Shouldn't be a problem if you've got your provisioning stuff set to configure ssh on an alternate port. > I could of course run fail2ban or a firewall rule in order to block at 3 failed attempts A good idea, but still an additional step beyond simply using a different port. > and still run on port 22 And you'll still end up on the receiving end of more malicious traffic than if you'd not used port 22. > Or use port knocking. Not necessarily a bad idea, but still far more complex than simply using a non-default port. Same reason that many ISPs (including Amazon) place more restrictions on port 25 than other ports commonly used for SMTP traffic.
- user5994461 10y agoI recall an era where boxes came with default firewall rules to block telnet, SSH, windows shares, SMTP.
- Animats 10y agoSome things to do right now: - If you don't have a very well defined need for a short DNS time to live, set your time to live to a large value, perhaps a day. Then, as long as someone can get at least one DNS request through, they can reach your site all day. (Ycombinator.com, why do you have a TTL of 12 seconds?.) - Get multiple DNS services now. Not just two. Get four or five, some of which are not widely used. Those two things will probably get you through future DNS attacks.
- ryantownsend 10y agoCan anyone comment on the best way to run multiple DNS services? Is this as simple as setting up the same records on multiple providers and updating your nameservers to point to the different providers? Or is there more involved? Are there any providers which will replicate records from your 'master' provider, or is this going to be manual?
- cpach 10y agoDJB suggests using rsync over ssh: https://cr.yp.to/djbdns/tcp.html#intro-axfr https://cr.yp.to/djbdns/tcp.html#intro-axfr But I guess this excludes many of the popular DNS services that are used today.
- ComodoHacker 10y agoIs there a better source? The whole article seems sucked out of a single tweet with no link to it. Also hilarious: >Anonymous didn't respond to a request for comment via Twitter
- throw2016 10y agoSometimes it feels we are being herded. If Brian Krebs a single person can identify so many dubious operators and script kiddies in the US then how come significantly larger and massively better equipped government teams known to be using sophisticated surveillance do not have any clue or response while leading US companies go offline. Just the other day Cisco announced a partnership with a company in the UK to detect and disable copy protected streams in real time all over the internet. Surely if they can pull something like this off there would be some serious solutions and proposals by the networking industry on how networks themselves can mitigate massive ddos attacks. The whole focus on IOT and client side devices seems to be a deflection of the real problem because any attempt to solve this client side is likely to introduce serious controls and constraints on machines joining the network apart from the fact you end up in a never ending cycle to 'wack a billion moles'
- lordnacho 10y agoSo does this mean there's a huge cloud of IoT devices that will be usable as a DDOS monster, forever? It sounds like they never get patched, and if you have some camera or small device, how likely are you to throw it away?
- snarfy 10y agoI wouldn't say forever. Technologies become outdated and people upgrade to new, more powerful IoT devices with default passwords.
- gorbachev 10y agoI would say forever. What kind of devices do you think they're being replaced with? The people buying these things aren't buying quality or security minded devices. They're buying the cheapest device they can find. Their next device will be the same.
- TekMol 10y agoHow do these devices make themselfes reachable from the public internet in the first place? As far as I know, my router does not forward incoming traffic. How would it know which device to forward it to anyhow?
- mike-cardwell 10y agoUPNP
- mortdeus 10y agoWhat's most concerning to me is that as hackers get more sophisticated with regards to tech, the US judicial system isn't and this is providing a lot of low hanging fruit for said hackers to use draconian laws like the Computer Fraud Act against innocent Americans by pwning their PC's and utilizing torrenting against them. I have a friend that is pretty much being persecuted by the state of Oklahoma for this very thing right now because the DA, OSBI (oklahoma state bureau of investigations.) and defense attorneys didn't understand how somebody can coincidentally be innocent of the illegal torrenting that appears to being going on from their IP, albeit said activity being totally unbeknownst to them.
- LinuxFreedom 10y agoThe elephant in the room is: Probably these attacks would not be possible if all the money put into governmental surveillance activities would have been invested in building a secure and resilient internet. This attack is the logical answer to the governmental attacks on all networked infrastructure. The root cause for these problems is a primitive way of thinking that is a wrong recipe for the path humanity has to take to not destroy itself. Competition, dominance, control, surveillance, fear vs. cooperation, consistency, trust, freedom, love. This is not about ethics or morality. It is about the fact that this way of primitive thinking just does not work - it is a stupid recipe for complicated problems and just fails. Neanderthalers that like to imprison themselves into hierarchies and dominate the whole world should be put into mental hospitals, but never into governmental institutions or positions. We must stop the domination and hierarchy adoring primitives with their non-working and self-destroying ideas to find an appropriate way to prepare for the future and its challenges. An important first step is to put the military dog back on the chain and show it the place where it belongs to and never ever allow it to infiltrate politics. Military solutions must only be the last step of self-defense that we need to use when all politics failed. A society that allows military thinking to penetrate or even dominate political ideas will be destroyed in the long run, as destruction is the only solution that militarism knows. Again this is not about ethics or morality, it is about logic. If you throw a stone into water, it will make waves.
- formula1 10y agoFirst off, putting a negative spin to competition already tells me you have either a very narrow view or see something I dont. When iojs forked from nodejs, it was a competitor. Linux is a competitive landscape. Browsers are a competitive landscape. The idea that cooperation and consistancy leads to the best possible product is only as accurate as who is trusted to be the leader. There are some pretty dumb leaders out there but convincing enough to be trusted with millions of dollars. Second off, the government didnt force all devices to be vulnerable. "Agile" development practices which we trust so much are what led us here. Build first, worry about security later. The fact that a persons information is valuable to the creator of these devices and they provide a direct gateway so they could be accessed by a third party. And the fact that consumers ignore any possible issues that may arise because they see the benefits. You talk about logic, well logically we wouldnt have computers or any of this if it wasnt for competition abd the desire to evolve. And logically trust and freedom allowed these vulnerabilities to ho unchecked because the software is not open source and companies are free to do whatever they want since its up to the consumer to judge whether its worth it or not. I understand why you want to make this political and pro-love because arguably any problem can be answered by pro-love. But logically, you should think before you dpeak and attempt to frame your argument with a consistant locigal tree than start blaring out hatred for the capitalist system
- snarfy 10y agoDefault passwords need to be made illegal. We all try to think of technological solutions to these problems but this really is a problem of policy not technology. The factory default setting should require a password to be set before the device functions.
- msimpson 10y ago"Anonymous wants DDoS attacks legalized as form of protest." Yet protests aren't comprised of participants who have been forced into attendance.
- sakopov 10y agoI spent the last 4 years integrating with various hardware vendors (non-iot market but the problems are the same) for my employer's Saas offering. Hardware companies are great at making reliable hardware but they have very little to no understanding of security or heck, even software in general. Most of the time we find that their hardware engineers are writing software and and the entire protocols are wide open usually without any built in security mechanisms. Some transmit sensitive information completely in the open. If we ever come across a vendor who understands SSL that's about as good as it gets.
- gandolfinmyhead 10y agoCrackers
- user5994461 10y ago* 24 days since the release of the botnet source code. * 3 days since the latest major DDoS attack. No device has been bricked so far. No counter attack yet. Waiting for the next news...