17 ms·

I wish more people would talk about the economics of why netsec is such a garbage industry. It's a few honest people screaming to be heard above the din of snak

I wish more people would talk about the economics of why netsec is such a garbage industry. It's a few honest people screaming to be heard above the din of snake-oil salesmen, but there's an economic reason that goes beyond "dumb users, incompetent programmers and CTOs who just look and speeds and feeds". The problem is there's weak correlation, or at least very difficult-to-see correlation, between the amount of effort you put in on security and the results you get. You could have no security and just get lucky and never get hacked. Or you could have great security and just get really unlucky and have a determined hacker. Or you could be spending uselessly and still getting lucky, although you (and your vendor!) attribute your good fortune to the product. This kind of information failure makes it really hard to have a functional and efficient market, even when everyone involved is honest. I don't have a good solution for this, which I why I hope someone smarter than me brings it up.

3pt14159 10y ago
The solution isn't to have random security consultants come in and kludge up your process and generate useless reports of irrelevant statistics. The solution is to have a red team on staff permanently, to offer bug bounties based on actual access, to install on-server monitoring for outdated packages (like Appcanary, the authors of this piece), to monitor outbound packets for suspicious behaviour (this is currently the hardest part, imo, since, other than detecting major viruses, it's largely domain and network specific), and to have an automated "take the servers off the internet" button for serious 0-days and leaked credentials. Also, always use HTTPS / HSTS lists and two factor authentication. You'll still get hacked, but you'll be far better off.
- tptacek 10y ago
  "Offer bug bounties based on actual access" why?
  - 3pt14159 10y ago
    Maybe misworded, but actual access is a clear line on the spectrum that starts at reporting a potential DDOS attack on an endpoint to dumping all your users credit cards and passwords. Access to a server isn't necessarily access to a DB, but it's usually serious enough to warrant cash, no matter who you are.
    - tptacek 10y ago
      I'm asking: why would you make a bounty conditional on "access" at all? What's the win? A bug is a bug. If it has the potential for access, it's worth the bounty. All a demonstrated access requirement does is encourage strangers to violate the privacy of your customers. It seems like an incredibly reckless idea.
      - 3pt14159 10y ago
        Bad actors are already trying to get that data, no?
        tptacek 10y ago
        Yes, but what does that have to do with the structure of a bounty?
        brians 10y ago
        Bounty programs are very noisy. I don't even have a bug bounty program, and have several messages from confused people in my inbox asking about one. The "bugs" they propose are not bugs in my programs---for example, one reports that data can be uploaded to a collaboration system, downloaded, and then executed in a user-provided interpreter---and that this interpreter may surprise the user with its behavior. Any better ideas of how to structure a bounty to get bugs and not confused users?
        3pt14159 10y ago
        Saying something is theoretically possible with automated vulnerability scanners (which have incredibly high type 1 error due to out of date headers due to lazy programmers and misconfigured webservers) and showing that it's actually possible are completely different things. A whitehat proving he can get user access or MITMing data they created as a proof of concept is completely benign. I've yet to hear this as the source of a leak of customer data.
andrewstuart2 10y ago
> It's a few honest people screaming to be heard above the din of snake-oil salesmen... I think it more likely that it's a few honest, knowledgeable people screaming to be heard above many honest, well-intentioned, but misguided people screaming to be heard above the din of snake oil salesmen. It's much easier to believe the wrong thing and sell it yourself than it is to be a confidence man. And on the same note, it's much easier to crucify a malicious hacker than it is to ruin the life of a guy who supports his wife and kids who just happened to make the economic call that running everything as root was okay. To your point on economics, I think the old joke about two guys being chased by a bear applies to the economic mindset. One company is seen tying its shoes (for the sake of the metaphor let's add to the joke that he's otherwise naked), and the other company says slyly "I don't think you're going to outrun that bear." "We don't have to," replies the naked company, "we just have to outrun you." It's going to be hard to justify the extra 80% effort on the remaining 20% when management and sales only want to go 21% just so they can outlast their competitors.
- 0xdeadbeefbabe 10y ago
  > And on the same note, it's much easier to crucify a malicious hacker than it is to ruin the life of a guy who supports his wife and kids who just happened to make the economic call that running everything as root was okay. Makes me wonder who makes the snake oil for the salesmen. I'm trying to say this is a plausible caricature that distracts us from a more complex (and way more interesting) reality.
  - freehunter 10y ago
    Well in many cases, the product itself is not snake oil, it's just not as good as it's being sold. I work at a vendor and the product I work with has some unhappy customers who were over-sold and promised the moon when we're actually just a telescope. Being able to see the moon is great, but when it's priced like a moon landing and sold like 40 acres of prime lunar real estate, your telescope looks a little lackluster. And your boss just spent $3m on it, they don't want to hear "now we need to buy all these add-ons, plus we still need a couple more tools to shore up the defenses. The developers (not me) are just writing the best product they can. The sales guys are trying to get sales. The pricing guys are trying to make it profitable. And no one is talking to anyone else, so the developers don't know what features sales is claiming, sales doesn't know the developers roadmap, and pricing... I don't even know who sets the price.
rudolf0 10y ago
It's even more slimey in the enterprise space. I'd like to think that the majority of people involved with the industry in some way have good intentions, but once you start involving, sales, marketing, and certain executives...
whack 10y ago
That's a great point regarding the economics of why IoT manufacturers don't invest all that much on security. Here's another one. It's an externality. Botnet attacks don't harm the IoT manufacturers. They don't even harm the IoT products or their users. They harm completely innocent bystanders like DNS/github. What possible incentive do IoT manufacturers have to invest money on initiatives that bring no benefits to themselves, or their customers? What possible incentive do users have to follow "proper security protocols", when they can just do something simple/convenient, and if something goes wrong, some random internet website pays the price. As idiotic as this sounds, the only non-regulatory solution I can think of is for all potential BotNet victims to collectively "bribe" the IoT companies into following proper security protocols.
- VodkaHaze 10y ago
  Externalities are usually solved through pigouvian taxes. But since we can't really know in advance what product will/won't be secure (or at least it's incredibly difficult in the constantly goalpost moving security industry) the only way I can see this happening is if, say DYN could sue the IoT manufacturers for negligence or something of the like.
- Bartweiss 10y ago
  Honestly, the general public may benefit from the first few attacks targeting IoT owners. If your toaster attacks Dyn, that's an indirect failure. But if your lights decide to shut off permanently because some kid thought it would be funny, you're going to throw them away and buy some dumb lightbulbs. Short of regulation or bribery, I can only hope that we'll see progress after some IoT products are directly attacked instead of repurposed into botnets.
  - fortytw2 10y ago
    Why would anyone in their right mind attack IoT products directly (ie. disabling/destroying them), when using them as a large botnet is far, far more lucrative? Well... Perhaps once IoT webcams are used for blackmail - but even that is a much more difficult task than "really big botnet attack really big sites" so the incentive isn't there
VodkaHaze 10y ago
Those sort of information asymmetry problems (in this case, you can't know the quality of the service you're buying until it's far too late) are a textbook case of market failure [1] [2]. You can improve the outcome sometimes with some smart regulation. But in the security industry there are multiple levels of this problem: - The end user doesn't generally know how hardened the product he buys is - The manufacturer is rarely certain how high quality the security auditing/services he is buying - How much to invest in securing a product is not an easy decision. I'm of course simplifying a lot here, but you asked for the economics of those problems, and hopefully this was interesting to some. [1] http://www.sfu.ca/~allen/leffler2.pdf http://www.sfu.ca/~allen/leffler2.pdf [2]https://www.iei.liu.se/nek/730g83/artiklar/1.328833/AkerlofMarketforLemons.pdf https://www.iei.liu.se/nek/730g83/artiklar/1.328833/AkerlofM...
cm2187 10y ago
Basically some developers need to go to jail for gross negligence.
- verdex_blarg 10y ago
  It wouldn't help. We need to rewrite our entire infrastructure with security as a primary goal. Then we need to find a way to get people to buy it (assuming of course we can even get anyone to pay for it in the first place). Buy one router for 50 bucks or the secure router for 250 ... I don't think we'll get far. At the end of the day a few people who can't afford super lawyers go to jail, and meanwhile ubercorp producing cheap routers with bad security continue with business as usual.
  - cm2187 10y ago
    I think it's deeper than infrastructure. It doesn't cost more to not write a SQL injection vulnerability. It just takes a programmer who has a basic understanding of internet 101, and who while writing any line of code involving user input will ask himself "how will these assholes use this to fuck with my system". As long as one line of code can take down your whole infrastructure, and unless all devs of anything serious have a minimum competency level, we are doomed to continue the current path, with a major data leak pretty much every week. So it will probably take a combination of new, safer programming languages, and minimum proficiency levels, enforced with regulations. I don't like it, but I don't know a better solution, and the statu quo is unacceptable.
    - jedmeyers 10y ago
      > It doesn't cost more to not write a SQL injection vulnerability. It does. > It just takes a programmer who has a basic understanding of internet 101 Most likely this programmer will cost more than a $10/hr contractor from a third-world country that worked on the software before.
      - cm2187 10y ago
        On SQL injections, it doesn't cost more, it just requires to use the correct syntax. Pretty much every database framework offer a syntax to avoid SQL injections. They take a negligible amount of time to type over concatenating a string. On third world country programmers, first I wish only third world country programmers wrote SQL injections vulnerabilities and other easy to avoid mistakes. Then, if you need to audit your accounts or get some engineers to review the structure of your bridge, you will insist on a good reputation / demonstrable competency. If vulnerabilities will land you in jail, you start looking at quotes from software vendors in a different way.
gearhart 10y ago
This sounds like an insurance problem. You've got events that occur rarely enough to an individual (company) that it's hard to work out what the best course of action is using the limited data that an individual can gather. If there were, say, a half dozen major security companies that everyone subscribed to one of, and they each published their statistics showing how many of their customers suffered various kinds of security breaches, this market might look much less broken. You could potentially get to that state by having some major existing insurance companies offer "digital threat insurance", and require anyone who claims on it to be using the security services provided by one of their vetted providers. Yes, you'd be building the sort of major corporate bureaucracy that HN hates, but you'd also be properly aligning everyone's incentives, and shifting the responsibility for the Hard Problem of determining who was selling real security software to a smaller number of better-resourced people. Perhaps there's a reason why major corporates are the norm in big, serious markets. Edit: disclaimer, I'm an armchair theorist and have no skin in the game - perhaps this already exists or there's a good reason why it doesn't work
- palakchokshi 10y ago
  This is in theory a good track to start with. However there is one small hole in the theory. Self reporting by security companies on breaches is very tough to impose. We have seen what self regulation/reporting did for the banking industry. If security companies sidestep accurate self reporting on breaches they have no incentive (in fact they might be motivated to let things slide for economic reasons) to create rock solid security solutions because they know there is an insurance company who will absorb the hit. However if you had an independent entity that rated the security companies' products that might work. Or the insurance company has a division that rates the security products and provided different rates based on which product a company decides to use.
- yxhuvud 10y ago
  I think a more feasible tactic would be to reverse the responsibility so that vendors that produce easily broken products ends up liable for damages unless they can show that they have done due diligence when it comes to securing the devices that they create. One way to get away from liability would then be to be vetted by a reputable security company.
kordless 10y ago
First off, we need to decentralize centralized services. Second, those decentralized services need to have different types of business models applied to them, long term, for achieving sustainability. Business models are what makes a centralized service centralized, secret and brittle. Change the game theory around infrastructure and you change the speed in which that infrastructure can be hacked. All infrastructure should do is to try to be self-sustaining. Making money off infrastructure is inherently greedy, given it doesn't scale linearly. This is the primary problem today, but I've found most people reject it given their intent is to get "rich" off whatever it is they do.
Justsignedup 10y ago
And of course, even if you get hacked, no consumer buys a camera "how good is the anti-hack feature on this?" and how to even quantify it? Hell people still install viruses because the popup told them to. That's the problem. Security is either the default, or ignored.
lawpoop 10y ago
Sounds like a solution would be to rule out the luck factor and institute dedicated hackers, who aren't ultimately getting paid by the manufacturers. The first thing that comes to mind is a governmental agency, but then that opens the government/industry watchdog collusion ball of worms.
stevetrewick 10y ago
>You could have no security and just get lucky and never get hacked. It's been a decade and more since that was even remotely true (if it ever was). Back in 2008 the average survival time of an unpatched internet facing XP box was around 4 minutes [0]. Pwning an unpatched XP box was (very marginally) harder than pwning a system with no security at all. The Morris worm (Edit: which is heavily mentioned in TFA, my bad) [1] got loose in 1998. There's some interesting stuff regarding whether such risks are comparable with things we use insurance to hedge at [2]. [0] https://isc.sans.edu/diary/Survival+Time+on+the+Internet/4721 https://isc.sans.edu/diary/Survival+Time+on+the+Internet/472... [1] https://en.m.wikipedia.org/wiki/Morris_worm https://en.m.wikipedia.org/wiki/Morris_worm [2] http://limn.it/the-morris-worm/ http://limn.it/the-morris-worm/
- enraged_camel 10y ago
  >>Back in 2008 the average survival time of an unpatched internet facing XP box was around 4 minutes [0]. Yep. And that's just the average. It was much, much lower for high-value targets, such as universities. The first thing we did at my Network Security class back in 2006 was to hook up an unpatched XP machine to the Internet. It got pwned in about 30 seconds.
  - pbhjpbhj 10y ago
    What I don't get about this is how the new system is discovered in the first place, assuming the attacker is not already on the network. Sure, gain fast access, but why would you let the traffic on to the local net to discover the machine (except for examples). I can see a box stuck on a home connection getting pwned quick, but surely a Uni network would be blocking rdp traffic, or external pings, or whatever it was that was being used to find and pwn XP computers so quickly?? Wouldn't multiple attackers have to be effectively flooding the network with pings or service/port access attempts to find a new computer so fast?
    - woliveirajr 10y ago
      They were talking about a XP facing the internet, so without network protections like blocking pings.
ethbro 10y ago
Fire the current crop of security cert vendors and start designing them practically. I may be in the minority, but every {insert security title here} I've ever encountered seems to have an alphabet soup after their name and no hard skills. Makes me feel bad for the competent security researchers having to share their field with glorified PowerPoint designers.

3pt14159 10y ago

The solution isn't to have random security consultants come in and kludge up your process and generate useless reports of irrelevant statistics. The solution is to have a red team on staff permanently, to offer bug bounties based on actual access, to install on-server monitoring for outdated packages (like Appcanary, the authors of this piece), to monitor outbound packets for suspicious behaviour (this is currently the hardest part, imo, since, other than detecting major viruses, it's largely domain and network specific), and to have an automated "take the servers off the internet" button for serious 0-days and leaked credentials. Also, always use HTTPS / HSTS lists and two factor authentication. You'll still get hacked, but you'll be far better off.

tptacek 10y ago
"Offer bug bounties based on actual access" why?
- 3pt14159 10y ago
  Maybe misworded, but actual access is a clear line on the spectrum that starts at reporting a potential DDOS attack on an endpoint to dumping all your users credit cards and passwords. Access to a server isn't necessarily access to a DB, but it's usually serious enough to warrant cash, no matter who you are.
  - tptacek 10y ago
    I'm asking: why would you make a bounty conditional on "access" at all? What's the win? A bug is a bug. If it has the potential for access, it's worth the bounty. All a demonstrated access requirement does is encourage strangers to violate the privacy of your customers. It seems like an incredibly reckless idea.
    - 3pt14159 10y ago
      Bad actors are already trying to get that data, no?
      - tptacek 10y ago
        Yes, but what does that have to do with the structure of a bounty?
        brians 10y ago
        Bounty programs are very noisy. I don't even have a bug bounty program, and have several messages from confused people in my inbox asking about one. The "bugs" they propose are not bugs in my programs---for example, one reports that data can be uploaded to a collaboration system, downloaded, and then executed in a user-provided interpreter---and that this interpreter may surprise the user with its behavior. Any better ideas of how to structure a bounty to get bugs and not confused users?
        3pt14159 10y ago
        Saying something is theoretically possible with automated vulnerability scanners (which have incredibly high type 1 error due to out of date headers due to lazy programmers and misconfigured webservers) and showing that it's actually possible are completely different things. A whitehat proving he can get user access or MITMing data they created as a proof of concept is completely benign. I've yet to hear this as the source of a leak of customer data.

andrewstuart2 10y ago

> It's a few honest people screaming to be heard above the din of snake-oil salesmen... I think it more likely that it's a few honest, knowledgeable people screaming to be heard above many honest, well-intentioned, but misguided people screaming to be heard above the din of snake oil salesmen. It's much easier to believe the wrong thing and sell it yourself than it is to be a confidence man. And on the same note, it's much easier to crucify a malicious hacker than it is to ruin the life of a guy who supports his wife and kids who just happened to make the economic call that running everything as root was okay. To your point on economics, I think the old joke about two guys being chased by a bear applies to the economic mindset. One company is seen tying its shoes (for the sake of the metaphor let's add to the joke that he's otherwise naked), and the other company says slyly "I don't think you're going to outrun that bear." "We don't have to," replies the naked company, "we just have to outrun you." It's going to be hard to justify the extra 80% effort on the remaining 20% when management and sales only want to go 21% just so they can outlast their competitors.

0xdeadbeefbabe 10y ago
> And on the same note, it's much easier to crucify a malicious hacker than it is to ruin the life of a guy who supports his wife and kids who just happened to make the economic call that running everything as root was okay. Makes me wonder who makes the snake oil for the salesmen. I'm trying to say this is a plausible caricature that distracts us from a more complex (and way more interesting) reality.
- freehunter 10y ago
  Well in many cases, the product itself is not snake oil, it's just not as good as it's being sold. I work at a vendor and the product I work with has some unhappy customers who were over-sold and promised the moon when we're actually just a telescope. Being able to see the moon is great, but when it's priced like a moon landing and sold like 40 acres of prime lunar real estate, your telescope looks a little lackluster. And your boss just spent $3m on it, they don't want to hear "now we need to buy all these add-ons, plus we still need a couple more tools to shore up the defenses. The developers (not me) are just writing the best product they can. The sales guys are trying to get sales. The pricing guys are trying to make it profitable. And no one is talking to anyone else, so the developers don't know what features sales is claiming, sales doesn't know the developers roadmap, and pricing... I don't even know who sets the price.

rudolf0 10y ago

It's even more slimey in the enterprise space. I'd like to think that the majority of people involved with the industry in some way have good intentions, but once you start involving, sales, marketing, and certain executives...

whack 10y ago

That's a great point regarding the economics of why IoT manufacturers don't invest all that much on security. Here's another one. It's an externality. Botnet attacks don't harm the IoT manufacturers. They don't even harm the IoT products or their users. They harm completely innocent bystanders like DNS/github. What possible incentive do IoT manufacturers have to invest money on initiatives that bring no benefits to themselves, or their customers? What possible incentive do users have to follow "proper security protocols", when they can just do something simple/convenient, and if something goes wrong, some random internet website pays the price. As idiotic as this sounds, the only non-regulatory solution I can think of is for all potential BotNet victims to collectively "bribe" the IoT companies into following proper security protocols.

VodkaHaze 10y ago
Externalities are usually solved through pigouvian taxes. But since we can't really know in advance what product will/won't be secure (or at least it's incredibly difficult in the constantly goalpost moving security industry) the only way I can see this happening is if, say DYN could sue the IoT manufacturers for negligence or something of the like.
Bartweiss 10y ago
Honestly, the general public may benefit from the first few attacks targeting IoT owners. If your toaster attacks Dyn, that's an indirect failure. But if your lights decide to shut off permanently because some kid thought it would be funny, you're going to throw them away and buy some dumb lightbulbs. Short of regulation or bribery, I can only hope that we'll see progress after some IoT products are directly attacked instead of repurposed into botnets.
- fortytw2 10y ago
  Why would anyone in their right mind attack IoT products directly (ie. disabling/destroying them), when using them as a large botnet is far, far more lucrative? Well... Perhaps once IoT webcams are used for blackmail - but even that is a much more difficult task than "really big botnet attack really big sites" so the incentive isn't there

VodkaHaze 10y ago

Those sort of information asymmetry problems (in this case, you can't know the quality of the service you're buying until it's far too late) are a textbook case of market failure [1] [2]. You can improve the outcome sometimes with some smart regulation. But in the security industry there are multiple levels of this problem: - The end user doesn't generally know how hardened the product he buys is - The manufacturer is rarely certain how high quality the security auditing/services he is buying - How much to invest in securing a product is not an easy decision. I'm of course simplifying a lot here, but you asked for the economics of those problems, and hopefully this was interesting to some. [1] http://www.sfu.ca/~allen/leffler2.pdf http://www.sfu.ca/~allen/leffler2.pdf [2]https://www.iei.liu.se/nek/730g83/artiklar/1.328833/AkerlofMarketforLemons.pdf https://www.iei.liu.se/nek/730g83/artiklar/1.328833/AkerlofM...

cm2187 10y ago

Basically some developers need to go to jail for gross negligence.

verdex_blarg 10y ago
It wouldn't help. We need to rewrite our entire infrastructure with security as a primary goal. Then we need to find a way to get people to buy it (assuming of course we can even get anyone to pay for it in the first place). Buy one router for 50 bucks or the secure router for 250 ... I don't think we'll get far. At the end of the day a few people who can't afford super lawyers go to jail, and meanwhile ubercorp producing cheap routers with bad security continue with business as usual.
- cm2187 10y ago
  I think it's deeper than infrastructure. It doesn't cost more to not write a SQL injection vulnerability. It just takes a programmer who has a basic understanding of internet 101, and who while writing any line of code involving user input will ask himself "how will these assholes use this to fuck with my system". As long as one line of code can take down your whole infrastructure, and unless all devs of anything serious have a minimum competency level, we are doomed to continue the current path, with a major data leak pretty much every week. So it will probably take a combination of new, safer programming languages, and minimum proficiency levels, enforced with regulations. I don't like it, but I don't know a better solution, and the statu quo is unacceptable.
  - jedmeyers 10y ago
    > It doesn't cost more to not write a SQL injection vulnerability. It does. > It just takes a programmer who has a basic understanding of internet 101 Most likely this programmer will cost more than a $10/hr contractor from a third-world country that worked on the software before.
    - cm2187 10y ago
      On SQL injections, it doesn't cost more, it just requires to use the correct syntax. Pretty much every database framework offer a syntax to avoid SQL injections. They take a negligible amount of time to type over concatenating a string. On third world country programmers, first I wish only third world country programmers wrote SQL injections vulnerabilities and other easy to avoid mistakes. Then, if you need to audit your accounts or get some engineers to review the structure of your bridge, you will insist on a good reputation / demonstrable competency. If vulnerabilities will land you in jail, you start looking at quotes from software vendors in a different way.

gearhart 10y ago

This sounds like an insurance problem. You've got events that occur rarely enough to an individual (company) that it's hard to work out what the best course of action is using the limited data that an individual can gather. If there were, say, a half dozen major security companies that everyone subscribed to one of, and they each published their statistics showing how many of their customers suffered various kinds of security breaches, this market might look much less broken. You could potentially get to that state by having some major existing insurance companies offer "digital threat insurance", and require anyone who claims on it to be using the security services provided by one of their vetted providers. Yes, you'd be building the sort of major corporate bureaucracy that HN hates, but you'd also be properly aligning everyone's incentives, and shifting the responsibility for the Hard Problem of determining who was selling real security software to a smaller number of better-resourced people. Perhaps there's a reason why major corporates are the norm in big, serious markets. Edit: disclaimer, I'm an armchair theorist and have no skin in the game - perhaps this already exists or there's a good reason why it doesn't work

palakchokshi 10y ago
This is in theory a good track to start with. However there is one small hole in the theory. Self reporting by security companies on breaches is very tough to impose. We have seen what self regulation/reporting did for the banking industry. If security companies sidestep accurate self reporting on breaches they have no incentive (in fact they might be motivated to let things slide for economic reasons) to create rock solid security solutions because they know there is an insurance company who will absorb the hit. However if you had an independent entity that rated the security companies' products that might work. Or the insurance company has a division that rates the security products and provided different rates based on which product a company decides to use.
yxhuvud 10y ago
I think a more feasible tactic would be to reverse the responsibility so that vendors that produce easily broken products ends up liable for damages unless they can show that they have done due diligence when it comes to securing the devices that they create. One way to get away from liability would then be to be vetted by a reputable security company.

kordless 10y ago

First off, we need to decentralize centralized services. Second, those decentralized services need to have different types of business models applied to them, long term, for achieving sustainability. Business models are what makes a centralized service centralized, secret and brittle. Change the game theory around infrastructure and you change the speed in which that infrastructure can be hacked. All infrastructure should do is to try to be self-sustaining. Making money off infrastructure is inherently greedy, given it doesn't scale linearly. This is the primary problem today, but I've found most people reject it given their intent is to get "rich" off whatever it is they do.

Justsignedup 10y ago

And of course, even if you get hacked, no consumer buys a camera "how good is the anti-hack feature on this?" and how to even quantify it? Hell people still install viruses because the popup told them to. That's the problem. Security is either the default, or ignored.

lawpoop 10y ago

Sounds like a solution would be to rule out the luck factor and institute dedicated hackers, who aren't ultimately getting paid by the manufacturers. The first thing that comes to mind is a governmental agency, but then that opens the government/industry watchdog collusion ball of worms.

stevetrewick 10y ago

>You could have no security and just get lucky and never get hacked. It's been a decade and more since that was even remotely true (if it ever was). Back in 2008 the average survival time of an unpatched internet facing XP box was around 4 minutes [0]. Pwning an unpatched XP box was (very marginally) harder than pwning a system with no security at all. The Morris worm (Edit: which is heavily mentioned in TFA, my bad) [1] got loose in 1998. There's some interesting stuff regarding whether such risks are comparable with things we use insurance to hedge at [2]. [0] https://isc.sans.edu/diary/Survival+Time+on+the+Internet/4721 https://isc.sans.edu/diary/Survival+Time+on+the+Internet/472... [1] https://en.m.wikipedia.org/wiki/Morris_worm https://en.m.wikipedia.org/wiki/Morris_worm [2] http://limn.it/the-morris-worm/ http://limn.it/the-morris-worm/

enraged_camel 10y ago
>>Back in 2008 the average survival time of an unpatched internet facing XP box was around 4 minutes [0]. Yep. And that's just the average. It was much, much lower for high-value targets, such as universities. The first thing we did at my Network Security class back in 2006 was to hook up an unpatched XP machine to the Internet. It got pwned in about 30 seconds.
- pbhjpbhj 10y ago
  What I don't get about this is how the new system is discovered in the first place, assuming the attacker is not already on the network. Sure, gain fast access, but why would you let the traffic on to the local net to discover the machine (except for examples). I can see a box stuck on a home connection getting pwned quick, but surely a Uni network would be blocking rdp traffic, or external pings, or whatever it was that was being used to find and pwn XP computers so quickly?? Wouldn't multiple attackers have to be effectively flooding the network with pings or service/port access attempts to find a new computer so fast?
  - woliveirajr 10y ago
    They were talking about a XP facing the internet, so without network protections like blocking pings.

ethbro 10y ago

Fire the current crop of security cert vendors and start designing them practically. I may be in the minority, but every {insert security title here} I've ever encountered seems to have an alphabet soup after their name and no hard skills. Makes me feel bad for the competent security researchers having to share their field with glorified PowerPoint designers.