4 ms·
> "Agile" development practices which we trust so much are what led us here. Build first, worry about security later Hardly. It's not like everyone stopped car
by mhurron 10y ago
> "Agile" development practices which we trust so much are what led us here. Build first, worry about security later
Hardly. It's not like everyone stopped caring about security once they moved to Agile flows. The industry never cared about security.
This last attack on Dyn appears to be Mirai again, so devices with unchangeable default username/password combinations. The same poor practices that have existed since there were engineering practices at all.
- bogomipz 10y ago>"This last attack on Dyn appears to be Mirai again, so devices with unchangeable default username/password combinations" The credentials can't be changed on these? Ouch. I didn't know this. Has Mira released any kind of firmware upgrades for their set top boxes and IP cameras?
- mhurron 10y agoMany, if not most, can not. Sometimes even if the user thinks they have. https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powered-todays-massive-internet-outage/ https://krebsonsecurity.com/2016/10/hacked-cameras-dvrs-powe... 'That’s because while many of these devices allow users to change the default usernames and passwords on a Web-based administration panel that ships with the products, those machines can still be reached via more obscure, less user-friendly communications services called “Telnet” and “SSH.” ... “The issue with these particular devices is that a user cannot feasibly change this password,” Flashpoint’s Zach Wikholm told KrebsOnSecurity. “The password is hardcoded into the firmware, and the tools necessary to disable it are not present. Even worse, the web interface is not aware that these credentials even exist.”'