6 ms·

No mention that this security hole has been kept secret by US government and leaked with devastating consequences around the world. You can't imply that it's t

No mention that this security hole has been kept secret by US government and leaked with devastating consequences around the world. You can't imply that it's the sole customers' fault by saying that it's "the easiest thing to do - update operating system" without mentioning NSA not cooperating with Microsoft to patch the hole. Many setups require certification which is void after modifications which may include system updates so it's not "the easiest thing to do". It needs to go through the certification process again. Even without certification requirements it may not be as trivial as it looks at first to "just update OS" on every device. The "easiest thing to do" is for the government to report holes just like everybody else does. Isn't it kind of strange that the only ones that fail to report security issues are a) criminals and b) government?

dtech 9y ago
> No mention that this security hole has been kept secret by US government and leaked with devastating consequences around the world. This is irrelevant in this case. The infection happened months after the security holes had been made public and patches had been released. The same could have happened if the US government had immediately reported the security holes instead of keeping them secret. > Many setups require certification which is void after modifications which may include system updates so it's not "the easiest thing to do". It needs to go through the certification process again. That's seems like an utterly useless certification process then. Any certification worth its salt should refuse to certify a networked Windows computer that doesn't automatically install security updates, since things like this WILL happen.
- cube00 9y ago
  In this case it wasn't networked, operators infected the cameras using USB sneaker-net.
  - kavok 9y ago
    I don't see any mention of USB in the article. Can you link a source?
    - DanBC 9y ago
      https://www.theguardian.com/australia-news/2017/jun/22/traffic-cameras-in-victoria-infected-by-wannacry-ransomware https://www.theguardian.com/australia-news/2017/jun/22/traff... > The department of justice said Victoria’s infection was not the result of a targeted attack, but was caused by a contractor mistakenly connecting infected hardware to cameras. Some sources are calling this a USB stick, the Guardian is being a bit more cautious.
      - jaimex2 9y ago
        Interesting, I always assumed the cameras transmitted the photos and data back to a source over mobile networks. Technically this means if someone gets snapped and is desperate enough ( will lose job as a result of losing licence etc ) they can turn back and destroy the evidence.
        digi_owl 9y ago
        Now that you mention it, i recall reading about a local case where someone tried to take out a camera using dynamite. This revealed that the actual image storage was in a hardened cased buried in the ground some distance from the camera. I suspect though that these are older installs. And that newer ones, particularly those that issue tickets based on time between two cameras, are networked.
- snarfy 9y ago
  It doesn't matter if it's utterly useless if it's legally required.
darawk 9y ago
Why is a comment like this always at the top of one of these HN threads? Does everyone here actually believe that the NSA shouldn't hoard vulnerabilities? I find it hard to believe that people here would collectively be that naive and simple-minded in their thinking. The NSA hoards vulnerabilities for the same reason the military has guns. Because other countries have guns too. This is too obvious a point to be lost on the readers here. So, i'm left wondering who it is that's upvoting these things.
- wfunction 9y ago
  I do get the impression a fair number of people actually believe the NSA shouldn't do this. Whether it's out of naiveté or wisdom is harder to tell, but I definitely don't get the impression everyone here is speaking from, say, 50 years of wisdom or experience in domestic and foreign policy or (cyber)warfare or what have you.
- michaelt 9y ago
  The NSA hoards vulnerabilities for the same reason the military has guns. Vulnerabilities are fundamentally unlike guns. Because vulnerabilities can be independently discovered or accidentally released, then reproduced in vast quantities and used against the public and civilian infrastructure of both us and our allies - largely with impunity. If wannacry was a gun, it'd be a gun that fired backwards and sideways at the same time as forwards, and you can't stop it firing once it's started, and sometimes it starts firing on its own.
  - wfunction 9y ago
    Correct me if I'm wrong but WannaCry used vulnerabilities that already had patches. How does reporting these vulnerabilities earlier instead of keeping them fix this situation? You'd still have the problem of slow updates regardless.
    - naz 9y ago
      If the bug were responsibly disclosed to Microsoft, there'd be no proof of concept in the wild, available for anyone to integrate into their ransomware. Instead, intelligence agencies irresponsibly hold onto them. And so they get leaked at best, or at worst end up in the wrong hands.

dtech 9y ago

> No mention that this security hole has been kept secret by US government and leaked with devastating consequences around the world. This is irrelevant in this case. The infection happened months after the security holes had been made public and patches had been released. The same could have happened if the US government had immediately reported the security holes instead of keeping them secret. > Many setups require certification which is void after modifications which may include system updates so it's not "the easiest thing to do". It needs to go through the certification process again. That's seems like an utterly useless certification process then. Any certification worth its salt should refuse to certify a networked Windows computer that doesn't automatically install security updates, since things like this WILL happen.

cube00 9y ago
In this case it wasn't networked, operators infected the cameras using USB sneaker-net.
- kavok 9y ago
  I don't see any mention of USB in the article. Can you link a source?
  - DanBC 9y ago
    https://www.theguardian.com/australia-news/2017/jun/22/traffic-cameras-in-victoria-infected-by-wannacry-ransomware https://www.theguardian.com/australia-news/2017/jun/22/traff... > The department of justice said Victoria’s infection was not the result of a targeted attack, but was caused by a contractor mistakenly connecting infected hardware to cameras. Some sources are calling this a USB stick, the Guardian is being a bit more cautious.
    - jaimex2 9y ago
      Interesting, I always assumed the cameras transmitted the photos and data back to a source over mobile networks. Technically this means if someone gets snapped and is desperate enough ( will lose job as a result of losing licence etc ) they can turn back and destroy the evidence.
      - digi_owl 9y ago
        Now that you mention it, i recall reading about a local case where someone tried to take out a camera using dynamite. This revealed that the actual image storage was in a hardened cased buried in the ground some distance from the camera. I suspect though that these are older installs. And that newer ones, particularly those that issue tickets based on time between two cameras, are networked.
snarfy 9y ago
It doesn't matter if it's utterly useless if it's legally required.

darawk 9y ago

Why is a comment like this always at the top of one of these HN threads? Does everyone here actually believe that the NSA shouldn't hoard vulnerabilities? I find it hard to believe that people here would collectively be that naive and simple-minded in their thinking. The NSA hoards vulnerabilities for the same reason the military has guns. Because other countries have guns too. This is too obvious a point to be lost on the readers here. So, i'm left wondering who it is that's upvoting these things.

wfunction 9y ago
I do get the impression a fair number of people actually believe the NSA shouldn't do this. Whether it's out of naiveté or wisdom is harder to tell, but I definitely don't get the impression everyone here is speaking from, say, 50 years of wisdom or experience in domestic and foreign policy or (cyber)warfare or what have you.
michaelt 9y ago
The NSA hoards vulnerabilities for the same reason the military has guns. Vulnerabilities are fundamentally unlike guns. Because vulnerabilities can be independently discovered or accidentally released, then reproduced in vast quantities and used against the public and civilian infrastructure of both us and our allies - largely with impunity. If wannacry was a gun, it'd be a gun that fired backwards and sideways at the same time as forwards, and you can't stop it firing once it's started, and sometimes it starts firing on its own.
- wfunction 9y ago
  Correct me if I'm wrong but WannaCry used vulnerabilities that already had patches. How does reporting these vulnerabilities earlier instead of keeping them fix this situation? You'd still have the problem of slow updates regardless.
  - naz 9y ago
    If the bug were responsibly disclosed to Microsoft, there'd be no proof of concept in the wild, available for anyone to integrate into their ransomware. Instead, intelligence agencies irresponsibly hold onto them. And so they get leaked at best, or at worst end up in the wrong hands.