14 ms·

It's all fine and well until one of those improperly configured devices are a medical device or something critical. Yes I understand that's part of the problem,

It's all fine and well until one of those improperly configured devices are a medical device or something critical. Yes I understand that's part of the problem, but proving a point with risk isn't the right answer either. Every Dialysis machine i've seen runs windows xp, which any security professional will tell you is game over, but given the market hasn't provided an alternative, it's becomes a necessity to figure out how to protect these improperly updated / configured / designed devices. Fandom of actions that impact others in a negative way is bad, and one day someone will do something they feel is right that impacts you and you'll say.. well that's not fair.

c3534l 9y ago
I think this is a legitimate moral paradox. Are you saving more people in the long run by making sure the devices fail sooner rather than later? Not that it's the responsibility of random, unaccountable hackers. But it is someone's responsibility, someone who isn't fixing the problem we know exists.
Waterluvian 9y ago
I experience something akin to this at work all the time. There's the real-world pragmatists and the software purity philosophers. Tell the family of someone killed that, "____ shouldn't have purchased a device without knowing how to secure it!"
- brazzledazzle 9y ago
  Allowing a medical device that can kill or harm someone to be connected to the internet would be a dramatic failure of both the company that produced it and the government. Monitoring is one thing but it better be a one way street or air gapped. No one should be able to do anything to a medical device over the internet besides read information. Or even over a LAN. Even if it is much less convenient or practical.
  - jessaustin 9y ago
    One could make that argument in a hospital environment, but eventually patients go home. While they're at home, some telemedicine might save their lives. Should we expect e.g. pacemaker patients to know how to set up a VPN? Or maybe you're just saying that pacemakers must be controlled through direct contact only... that's on the device designers then, not on local network admins.
    - brazzledazzle 9y ago
      Yes, it should be direct contact. Even short range wireless would make me nervous without guarantees that it was just one way monitoring. I wouldn't blame network administrators for the safety of a device that should have never been on it in the first place.
- notatoad 9y ago
  If you want to tug on heartstrings with the "what about medical devices" argument, it's probably just as likely that a mirai botnet will impact a life support or public safety network than that brickerbot will.
- tsuraan 9y ago
  Tell the family that the device was defective, and the manufacturer is entirely to blame. It's the simple truth, no need to try to blame the deceased.
occam65 9y ago
To be fair, we don't know that the malware doesn't have a whitelist of devices approved to attack.
- Bartweiss 9y ago
  The description in the article did imply it's seeking very specific targets. First, <2,000 devices hit per version? Mirai certainly doesn't show limitations like that. Second, erases and corrupts? Unless I'm missing my mark, bricking a device that's running on firmware takes a fair bit more targeting than just adding it to a botnet. edit: Ars has more info: https://arstechnica.com/security/2017/04/brickerbot-the-permanent-denial-of-service-botnet-is-back-with-a-vengeance/ https://arstechnica.com/security/2017/04/brickerbot-the-perm... Apparently it specifically targets devices open to Mirai, and claims a 2,000,000+ kill count. Not sure what that means for medical gear, but it does mean XP is safe.
adamclarkestes 9y ago
I'm the author of the Gizmodo post. Having covered IoT hacks for a few years, it's obvious that drastic measures would be necessary to convince manufacturers to build more secure products. While I'm not necessarily endorsing this hacker's methods, I do salute his taking a stand. It might land him in jail. But still, the mission is worthwhile.
- tptacek 9y ago
  Did you not have any input into this headline? It is a clear endorsement.
  - adamclarkestes 9y ago
    My editor thought it might be too extreme, but I was sure that careful readers would latch on to the tongue-in-cheek intentions. Maybe I was wrong. I still stand by the statement.
    - deleted 9y ago
      [deleted]
    - thomble 9y ago
      Oh please. Your "editor" was probably like: "gr8 b8 m8."
  - josefresco 9y ago
    I think the headline reads as personal, and therefore a lighter endorsement than something like "This Hacker is Our new Hero" or "This Hacker is a Hero".
  - mnarayan01 9y ago
    For those confused by this comment, the actual title of the piece is: "This Hacker Is My New Hero".
- josst 9y ago
  Just FYI you have a small mistake here: "So why did the Janit0r result to destruction". Should be "resort" I think.
lapsock 9y ago
wait a fucking minute people are connecting medical devices to the internet?
- Toenex 9y ago
  Don't be too alarmed there are 3/4 classes of device all with differing risk profiles. Patient safety include things like protecting patient information so even systems used to transfer medical records can be regarded as a medical device. Not sure I'd want a pace maker updating online though...
- bluejekyll 9y ago
  If you connect it to a network, it's entirely plausible that there is a path to the internet. Even if it's on an airgapped network, laptops and phones end up on both through accidents...
  - nickpsecurity 9y ago
    Or people plugging in USB drives they found outside on ground. Or CD's before that. Or floppy discs before that. ;)
- RobertDeNiro 9y ago
  It might not be connected to the internet in an IoT way, but it makes a lot of sense to connect a device to a wi-fi network if you need to wirelessly transmit any form of data.
  - Neliquat 9y ago
    IoT way? I do not think you can trust traffic to stay local and not leak. This kind of thinking is what got is here.
  - deleted 9y ago
    [deleted]
- notatoad 9y ago
  and not just medical devices, but life-support machines running with known security vulnerabilities? There's nothing inherently wrong with connecting medical devices to the internet, and running an outdated OS on your specialized equipment is fine too as long as it's not being connected to any unsecured networks. But running a known insecure OS on an internet connected life support device has got to be a violation of some law or ethical regulation.
hectorr 9y ago
Connecting critical life support systems to the internet, and not having any contingency for an outage, sounds a lot like malpractice. Hospitals have fail-safes, and if they don't it's a far larger problem than using an insecure IOT device.
frandroid 9y ago
Is there any evidence that BrickerBot targets medical devices?
- Neliquat 9y ago
  No. In fact there is evidence that it does not specifically target them. However, they belong to a set of devices that may be affected by it.
rebuilder 9y ago
The thing is, either way, someone is getting harmed. If these devices are left to run unpatched, they'll take part in attacks against whoever, and someone somewhere suffers. Possibly a lot of someones, Mirai wasn't exactly a joke.
nickpsecurity 9y ago
"It's all fine and well until one of those improperly configured devices are a medical device or something critical. " It would be their fault. High-assurance industry has been telling SCADA and medical industry to get their shit together for a long time. This included pentests showing it could all be destroyed. They even have people at conferences talking about it with products or basic advice to deal with it. The reason it's all still vulnerable is that they... don't... care. They turn whatever small amounts of money the security would've cost into profit. I mean, in some cases we're talking about remote monitoring that operates one way that could be done with a data diode for nearly impenetrable security. Cheap as hell if you homebrew it on cheap, embedded boxes. Likewise for FOSS VPN if two-way is required. Instead, costly system connected to wide open Internet to save a few hundred dollars. They just don't care. So, you have to make them care. The customers don't as much since they often don't know better. Those that do are apathetic since it will be someone else's problem. That's best moment for regulation to step in to force a solution. There's no regulation, though. Court's seem unreliable on this but still some hope there. So, your options are waiting for them to hit you, paying exhorbitant costs for DDOS mitigation due to problems others are creating (i.e. externalizing), or maybe a criminal just smashes the insecure devices until people stop buying them or manufacturers start securing them. So, I like what's going given nothing else is reducing risk as effectively.
- 086421357909764 9y ago
  I've brought this up to others, how would you feel if someone decided to brick / modify your car without you knowing? What would you do if that fix backfired and caused damage, hard locked the controls on your car, or worse, simply shut it off at the wrong time? We absolutely need to fix these issues, the governments of the world need to enforce standards on products, but vigilantism no matter how much you may agree with, has to be treated the same across the line.
  - drspacemonkey 9y ago
    Whether the car is hijacked to carry out attacks, or bricked by a vigilante trying to prevent another attack, I'd be pissed. But the blame lies squarely on the manufacturer who decided "meh, securing our devices against attack sounds expensive".
z3t4 9y ago
devices that can kill people have another level of security then random iot devices.
- Neliquat 9y ago
  > Should
- 086421357909764 9y ago
  Sadly, they don't. What about a car that has vulnerable software? It's not a medical device but could have a real world effect if the same actions were taken.
norea-armozel 9y ago
Okay but why does a dialysis machine need to be on the internet? Even if it's done to forward reports regarding the usage of the machine that can be done in a daily dump when you swap it out I'm guessing, right? So, it doesn't need to be an always-on device with respect to its NIC. Plus, there's no benefit to the user to have their life giving machinery be online. It's just another thing to overcharge the hospital for all in the false name of productivity.
- digi_owl 9y ago
  It is not on the net, but it is on a LAN that has a firewall somewhere that is leaky. This because it is cheaper in the short run to string a single physical network and then use vlans etc to attempt to keep medical stuff from talking to accounting or the visitors WiFi. This so a single overworked nurse can monitor a number of patients from a bank of monitors hooked to a thin client near the ward entrance.
  - norea-armozel 9y ago
    Then it seems to me that more nurses and less dependence on fragile technology is a better option. Costs can be economized by many other methods. Labor is something that should be the last thing to pare down.
    - digi_owl 9y ago
      Technology, done right, can be more reliable than humans. But in this instance the weighting is one done by beancounters looking at salaries as an ongoing expense, while tech is an investment that pays itself back the longer it can be used without further expences.
saosebastiao 9y ago
Meh. This attack is going after the easiest of targets. If a medical device or something critical is victim to this, they should cease to exist. I find it easy to believe that this attack protects far more people in the long run than it will ever hurt right now, and I'm willing to take that side of the moral dilemma. It would be nice if we could live in a world where we all trust each other, and maybe with physical things this is attainable. But the IoT is a worldwide attack surface. It's open to nefarious actors ranging from junkies with stolen laptops, all the way to state-sponsored hacking organizations with billion dollar budgets. Trust and goodwill aren't options anymore.
- 086421357909764 9y ago
  Where do you draw the line, I could argue because we know that certain vehicles are remotely hackable we should just disable all the cars without regard to their status of use. Literally 0 difference in argument, yet the results would somehow dictate a different response.
LinuxBender 9y ago
Stoplights are often installed after {n} number of people die at an intersection to justify the cost. Is that cool? Regulations are put on companies after their freedom of choice; when abused, starts harming people. I think IoT is a perfect example of this. Today the manufactures have a great deal of freedom. Their lack of self regulation will require others to step in and regulate them. On the matter of vigilantes: This is a complicated topic, but I support them doing this, even if it harms myself or someone I care about. If this problem is not stopped sooner than later, it will explode into a much bigger economic and/or societal issue that will be difficult to contain. I have warned the people I care about already. The current state of IoT is a complete lack of responsibility. I would even support someone bricking every piece of machinery they can, including cars, heavy equipment, power plants and anything else that was built without proper engineering.
- flukus 9y ago
  I don't think the connection will ever be direct enough for the masses to care, there will never been an equivalent of dead bodies hanging out of car wreckage at an intersection. If someones dishwasher is streaming pirated movies would they care? If their children's bedroom were unknowingly being streamed to pedophiles would the care (obviously they wouldn't like it, but caring requires knowing)? Vigalantes may be the least worst option.
castis 9y ago
I agree, we should continue let all the badly configured IoT devices continually be used against the end user. Doing something about it is dangerous and no one likes danger.
deleted 9y ago
[deleted]
squarefoot 9y ago
> until one of those improperly configured devices are a medical device or something critical. Medical or critical devices should never be exposed to the Internet, especially if badly configured. If there's something illegal involved here is putting lives at risk by not implementing proper security. If I had to find an analogy, that's like someone hung a grand piano using a shoestring from a roof and the hacker cuts the string letting the piano fall at 4:00 in the morning before it breaks later with much higher probability of killing people. It's still a dangerous and wrong act, but it prevents a much worse one.
- MertsA 9y ago
  To play devil's advocate on that, if there's some super sensitive life support system that's indirectly connected to the internet it's probably going to be turned off until it's actually in use.
jacquesm 9y ago
Why would a Dialysis machine even need an internet connection?
- cushychicken 9y ago
  Because the sales guy insisted it'd help sales.
evilDagmar 9y ago
If someone has life-sustaining medical equipment on a public network, they have lost their minds. Everything about that is likely subject to privacy regulations of some kind. It would violate best practices of network security with a vengeance. If someone has life-sustaining medical equipment and they're not maintaining it by ensuring it gets it's patches in a timely fashion, then that right there is where the blame starts. Doing so is no better than ignoring frayed wires on an extension cord. The real horror is that such poorly designed devices would ever be deployed for such important uses. Things like BrickerBot don't even show up on the same scale.

c3534l 9y ago

I think this is a legitimate moral paradox. Are you saving more people in the long run by making sure the devices fail sooner rather than later? Not that it's the responsibility of random, unaccountable hackers. But it is someone's responsibility, someone who isn't fixing the problem we know exists.

Waterluvian 9y ago

I experience something akin to this at work all the time. There's the real-world pragmatists and the software purity philosophers. Tell the family of someone killed that, "____ shouldn't have purchased a device without knowing how to secure it!"

brazzledazzle 9y ago
Allowing a medical device that can kill or harm someone to be connected to the internet would be a dramatic failure of both the company that produced it and the government. Monitoring is one thing but it better be a one way street or air gapped. No one should be able to do anything to a medical device over the internet besides read information. Or even over a LAN. Even if it is much less convenient or practical.
- jessaustin 9y ago
  One could make that argument in a hospital environment, but eventually patients go home. While they're at home, some telemedicine might save their lives. Should we expect e.g. pacemaker patients to know how to set up a VPN? Or maybe you're just saying that pacemakers must be controlled through direct contact only... that's on the device designers then, not on local network admins.
  - brazzledazzle 9y ago
    Yes, it should be direct contact. Even short range wireless would make me nervous without guarantees that it was just one way monitoring. I wouldn't blame network administrators for the safety of a device that should have never been on it in the first place.
notatoad 9y ago
If you want to tug on heartstrings with the "what about medical devices" argument, it's probably just as likely that a mirai botnet will impact a life support or public safety network than that brickerbot will.
tsuraan 9y ago
Tell the family that the device was defective, and the manufacturer is entirely to blame. It's the simple truth, no need to try to blame the deceased.

occam65 9y ago

To be fair, we don't know that the malware doesn't have a whitelist of devices approved to attack.

Bartweiss 9y ago
The description in the article did imply it's seeking very specific targets. First, <2,000 devices hit per version? Mirai certainly doesn't show limitations like that. Second, erases and corrupts? Unless I'm missing my mark, bricking a device that's running on firmware takes a fair bit more targeting than just adding it to a botnet. edit: Ars has more info: https://arstechnica.com/security/2017/04/brickerbot-the-permanent-denial-of-service-botnet-is-back-with-a-vengeance/ https://arstechnica.com/security/2017/04/brickerbot-the-perm... Apparently it specifically targets devices open to Mirai, and claims a 2,000,000+ kill count. Not sure what that means for medical gear, but it does mean XP is safe.

adamclarkestes 9y ago

I'm the author of the Gizmodo post. Having covered IoT hacks for a few years, it's obvious that drastic measures would be necessary to convince manufacturers to build more secure products. While I'm not necessarily endorsing this hacker's methods, I do salute his taking a stand. It might land him in jail. But still, the mission is worthwhile.

tptacek 9y ago
Did you not have any input into this headline? It is a clear endorsement.
- adamclarkestes 9y ago
  My editor thought it might be too extreme, but I was sure that careful readers would latch on to the tongue-in-cheek intentions. Maybe I was wrong. I still stand by the statement.
  - deleted 9y ago
    [deleted]
  - thomble 9y ago
    Oh please. Your "editor" was probably like: "gr8 b8 m8."
- josefresco 9y ago
  I think the headline reads as personal, and therefore a lighter endorsement than something like "This Hacker is Our new Hero" or "This Hacker is a Hero".
- mnarayan01 9y ago
  For those confused by this comment, the actual title of the piece is: "This Hacker Is My New Hero".
josst 9y ago
Just FYI you have a small mistake here: "So why did the Janit0r result to destruction". Should be "resort" I think.

lapsock 9y ago

wait a fucking minute people are connecting medical devices to the internet?

Toenex 9y ago
Don't be too alarmed there are 3/4 classes of device all with differing risk profiles. Patient safety include things like protecting patient information so even systems used to transfer medical records can be regarded as a medical device. Not sure I'd want a pace maker updating online though...
bluejekyll 9y ago
If you connect it to a network, it's entirely plausible that there is a path to the internet. Even if it's on an airgapped network, laptops and phones end up on both through accidents...
- nickpsecurity 9y ago
  Or people plugging in USB drives they found outside on ground. Or CD's before that. Or floppy discs before that. ;)
RobertDeNiro 9y ago
It might not be connected to the internet in an IoT way, but it makes a lot of sense to connect a device to a wi-fi network if you need to wirelessly transmit any form of data.
- Neliquat 9y ago
  IoT way? I do not think you can trust traffic to stay local and not leak. This kind of thinking is what got is here.
- deleted 9y ago
  [deleted]
notatoad 9y ago
and not just medical devices, but life-support machines running with known security vulnerabilities? There's nothing inherently wrong with connecting medical devices to the internet, and running an outdated OS on your specialized equipment is fine too as long as it's not being connected to any unsecured networks. But running a known insecure OS on an internet connected life support device has got to be a violation of some law or ethical regulation.

hectorr 9y ago

Connecting critical life support systems to the internet, and not having any contingency for an outage, sounds a lot like malpractice. Hospitals have fail-safes, and if they don't it's a far larger problem than using an insecure IOT device.

frandroid 9y ago

Is there any evidence that BrickerBot targets medical devices?

Neliquat 9y ago
No. In fact there is evidence that it does not specifically target them. However, they belong to a set of devices that may be affected by it.

rebuilder 9y ago

The thing is, either way, someone is getting harmed. If these devices are left to run unpatched, they'll take part in attacks against whoever, and someone somewhere suffers. Possibly a lot of someones, Mirai wasn't exactly a joke.

nickpsecurity 9y ago

"It's all fine and well until one of those improperly configured devices are a medical device or something critical. " It would be their fault. High-assurance industry has been telling SCADA and medical industry to get their shit together for a long time. This included pentests showing it could all be destroyed. They even have people at conferences talking about it with products or basic advice to deal with it. The reason it's all still vulnerable is that they... don't... care. They turn whatever small amounts of money the security would've cost into profit. I mean, in some cases we're talking about remote monitoring that operates one way that could be done with a data diode for nearly impenetrable security. Cheap as hell if you homebrew it on cheap, embedded boxes. Likewise for FOSS VPN if two-way is required. Instead, costly system connected to wide open Internet to save a few hundred dollars. They just don't care. So, you have to make them care. The customers don't as much since they often don't know better. Those that do are apathetic since it will be someone else's problem. That's best moment for regulation to step in to force a solution. There's no regulation, though. Court's seem unreliable on this but still some hope there. So, your options are waiting for them to hit you, paying exhorbitant costs for DDOS mitigation due to problems others are creating (i.e. externalizing), or maybe a criminal just smashes the insecure devices until people stop buying them or manufacturers start securing them. So, I like what's going given nothing else is reducing risk as effectively.

086421357909764 9y ago
I've brought this up to others, how would you feel if someone decided to brick / modify your car without you knowing? What would you do if that fix backfired and caused damage, hard locked the controls on your car, or worse, simply shut it off at the wrong time? We absolutely need to fix these issues, the governments of the world need to enforce standards on products, but vigilantism no matter how much you may agree with, has to be treated the same across the line.
- drspacemonkey 9y ago
  Whether the car is hijacked to carry out attacks, or bricked by a vigilante trying to prevent another attack, I'd be pissed. But the blame lies squarely on the manufacturer who decided "meh, securing our devices against attack sounds expensive".

z3t4 9y ago

devices that can kill people have another level of security then random iot devices.

Neliquat 9y ago
> Should
086421357909764 9y ago
Sadly, they don't. What about a car that has vulnerable software? It's not a medical device but could have a real world effect if the same actions were taken.

norea-armozel 9y ago

Okay but why does a dialysis machine need to be on the internet? Even if it's done to forward reports regarding the usage of the machine that can be done in a daily dump when you swap it out I'm guessing, right? So, it doesn't need to be an always-on device with respect to its NIC. Plus, there's no benefit to the user to have their life giving machinery be online. It's just another thing to overcharge the hospital for all in the false name of productivity.

digi_owl 9y ago
It is not on the net, but it is on a LAN that has a firewall somewhere that is leaky. This because it is cheaper in the short run to string a single physical network and then use vlans etc to attempt to keep medical stuff from talking to accounting or the visitors WiFi. This so a single overworked nurse can monitor a number of patients from a bank of monitors hooked to a thin client near the ward entrance.
- norea-armozel 9y ago
  Then it seems to me that more nurses and less dependence on fragile technology is a better option. Costs can be economized by many other methods. Labor is something that should be the last thing to pare down.
  - digi_owl 9y ago
    Technology, done right, can be more reliable than humans. But in this instance the weighting is one done by beancounters looking at salaries as an ongoing expense, while tech is an investment that pays itself back the longer it can be used without further expences.

saosebastiao 9y ago

Meh. This attack is going after the easiest of targets. If a medical device or something critical is victim to this, they should cease to exist. I find it easy to believe that this attack protects far more people in the long run than it will ever hurt right now, and I'm willing to take that side of the moral dilemma. It would be nice if we could live in a world where we all trust each other, and maybe with physical things this is attainable. But the IoT is a worldwide attack surface. It's open to nefarious actors ranging from junkies with stolen laptops, all the way to state-sponsored hacking organizations with billion dollar budgets. Trust and goodwill aren't options anymore.

086421357909764 9y ago
Where do you draw the line, I could argue because we know that certain vehicles are remotely hackable we should just disable all the cars without regard to their status of use. Literally 0 difference in argument, yet the results would somehow dictate a different response.

LinuxBender 9y ago

Stoplights are often installed after {n} number of people die at an intersection to justify the cost. Is that cool? Regulations are put on companies after their freedom of choice; when abused, starts harming people. I think IoT is a perfect example of this. Today the manufactures have a great deal of freedom. Their lack of self regulation will require others to step in and regulate them. On the matter of vigilantes: This is a complicated topic, but I support them doing this, even if it harms myself or someone I care about. If this problem is not stopped sooner than later, it will explode into a much bigger economic and/or societal issue that will be difficult to contain. I have warned the people I care about already. The current state of IoT is a complete lack of responsibility. I would even support someone bricking every piece of machinery they can, including cars, heavy equipment, power plants and anything else that was built without proper engineering.

flukus 9y ago
I don't think the connection will ever be direct enough for the masses to care, there will never been an equivalent of dead bodies hanging out of car wreckage at an intersection. If someones dishwasher is streaming pirated movies would they care? If their children's bedroom were unknowingly being streamed to pedophiles would the care (obviously they wouldn't like it, but caring requires knowing)? Vigalantes may be the least worst option.

castis 9y ago

I agree, we should continue let all the badly configured IoT devices continually be used against the end user. Doing something about it is dangerous and no one likes danger.

deleted 9y ago

[deleted]

squarefoot 9y ago

> until one of those improperly configured devices are a medical device or something critical. Medical or critical devices should never be exposed to the Internet, especially if badly configured. If there's something illegal involved here is putting lives at risk by not implementing proper security. If I had to find an analogy, that's like someone hung a grand piano using a shoestring from a roof and the hacker cuts the string letting the piano fall at 4:00 in the morning before it breaks later with much higher probability of killing people. It's still a dangerous and wrong act, but it prevents a much worse one.

MertsA 9y ago
To play devil's advocate on that, if there's some super sensitive life support system that's indirectly connected to the internet it's probably going to be turned off until it's actually in use.

jacquesm 9y ago

Why would a Dialysis machine even need an internet connection?

cushychicken 9y ago
Because the sales guy insisted it'd help sales.

evilDagmar 9y ago

If someone has life-sustaining medical equipment on a public network, they have lost their minds. Everything about that is likely subject to privacy regulations of some kind. It would violate best practices of network security with a vengeance. If someone has life-sustaining medical equipment and they're not maintaining it by ensuring it gets it's patches in a timely fashion, then that right there is where the blame starts. Doing so is no better than ignoring frayed wires on an extension cord. The real horror is that such poorly designed devices would ever be deployed for such important uses. Things like BrickerBot don't even show up on the same scale.