4 ms·

This seems alarmist to me. In principle we can make computers much more secure and in practice some groups actually do. If we get some decent information out t

by sqeaky 9y ago

This seems alarmist to me. In principle we can make computers much more secure and in practice some groups actually do. If we get some decent information out there and stop enabling people with the mentality that computer security is an add-on product I think we can make it pretty far. I doubt google or microsoft will be significantly harmed by a "cyber-weapon", and I don't think most end-user devices with automatic updates enabled will either. This is a solvable problem.

amelius 9y ago
> This is a solvable problem. If only security wasn't last on the budget ...
GilbertErik 9y ago
It's not about harming Google or Microsoft. It's about attacking vulnerabilities in infrastructure. No one cares if your webapp that's instantly reporting on the current length of a celebrity's hair is still capable of serving traffic if traffic lights have been disabled or if your ISP has been knocked completely off line or if the cellular network has been severely crippled.
BoiledCabbage 9y ago
> In principle we can make computers much more secure and in practice some groups actually do. In principle we could, and yet in the 20-30 years of common interconnected computers we haven't. > If we get some decent information out there and stop enabling people with the mentality that computer security is an add-on product This isn't just about getting "information" out, and if it were only information people would've fixed it decades ago. The problem is that there are no incentives. The cost of making products actually secure, dwarfs the cost of getting a product out that makes money. The cost of being found out with a massive security breach pales in comparison to the amount of money to be made on being first to market, or having dominant share. > I doubt google or microsoft will be significantly harmed by a "cyber-weapon", and I don't think most end-user devices with automatic updates enabled will either. Linux based Android and Microsoft Windows are currently full of holes and have been exploited now for years. And this is happening by small groups of people who do it for a few dollars or to spy on a company - none of them have the full backing and resources of a nation state. To think that this problem will suddenly be solved by doing more of the same "educating people" to me comes across as a bit naive. It hasn't worked this long, it won't suddenly work now. Incentives need to change. Punishment for a security hole needs to increase significantly, entirely new tooling needs to be enforced or some other solution needs to be created. This is one of those cases where the solution is seen as so drastic that people will want to just ignore or dismiss it. Thinking to themselves, no-one can really be advocating for that it'd impact everything. It will - making our digital systems secure will be hugely expensive. I see a Y2K x 10 style concerted effort as the only way to get things to change - but hopefully someone out there has an idea more likely to be implemented.
tw04 9y ago
I don't think you understand... there's literally 0 chance that hospitals and power plants are going to just universally enable windows update on their critical systems. Any patch that gets applied to life or death systems has to go through significant regression testing before going live. I guess you could suggest they just get universally redundant systems and take rolling outages, but I'm guessing nobody would be willing to pay for the cost of implementing such a scheme.
- sqeaky 9y ago
  Perhaps there should be a 0% chance that those things are on networks and a 0% chance they run a normal consumer grade OS. If the software in power plants were treated like their hardware it wouldn't be a problem.
  - rbanffy 9y ago
    A custom OS would have an attack surface larger than one widely used. For high value targets, it'd be easier to attack.
    - sqeaky 9y ago
      A minimalistic OS intended for high security ought to be much smaller and should lack almost everything a general purposed OS has. This should make the attack surface pretty minimal. If that OS gets reused by many people so it gets vetted by time I think that would be best. Perhaps a very stripped down Linux or BSD could fill the role. There is absolutely no reason to have things network configuration wizards, wobbly windows or other fluff. I think there are already systems and tools to help someone construct a custom minimal Linux OS (Yocto) and perhaps people already use these to construct appliances for highly sensitive systems. I don't think we are that far away, at least some industries are pretty well covered already.
      - tw04 9y ago
        The exploits in question haven't been from "network configuration wizards" or "wobbly windows" - they're literally from backwards compatibility. And medical devices are one of the EXACT reasons there's so much cruft in Windows. They rely on ancient code becaues getting things re-approved via the FDA can take YEARS and millions of dollars. Those manufacturers won't change unless they have a gun to their head. So what... we switch to a stripped down version of Linux that won't ever have the kernel updated and will need to continue supporting version 1.0 of samba because of some arbitrary codepath to load new versions of firmware. It's easy to sit back and cast judgement when you don't deal with that industry... but they aren't doing it this way because it's fun.
shallot_router 9y ago
When you're up against a hostile organized adversary, especially a superpower nation-state's government and intelligence agencies, it's very very hard to just rely on better training and education and secure development practices. Everyone still needs to be doing these things, but the fight here is very asymmetric. If NSA or FSB or equivalent decides they want to disrupt or damage your company in a cyberattack, it's going to happen.

by sqeaky 9y ago

amelius 9y ago

> This is a solvable problem. If only security wasn't last on the budget ...

GilbertErik 9y ago

It's not about harming Google or Microsoft. It's about attacking vulnerabilities in infrastructure. No one cares if your webapp that's instantly reporting on the current length of a celebrity's hair is still capable of serving traffic if traffic lights have been disabled or if your ISP has been knocked completely off line or if the cellular network has been severely crippled.

BoiledCabbage 9y ago

> In principle we can make computers much more secure and in practice some groups actually do. In principle we could, and yet in the 20-30 years of common interconnected computers we haven't. > If we get some decent information out there and stop enabling people with the mentality that computer security is an add-on product This isn't just about getting "information" out, and if it were only information people would've fixed it decades ago. The problem is that there are no incentives. The cost of making products actually secure, dwarfs the cost of getting a product out that makes money. The cost of being found out with a massive security breach pales in comparison to the amount of money to be made on being first to market, or having dominant share. > I doubt google or microsoft will be significantly harmed by a "cyber-weapon", and I don't think most end-user devices with automatic updates enabled will either. Linux based Android and Microsoft Windows are currently full of holes and have been exploited now for years. And this is happening by small groups of people who do it for a few dollars or to spy on a company - none of them have the full backing and resources of a nation state. To think that this problem will suddenly be solved by doing more of the same "educating people" to me comes across as a bit naive. It hasn't worked this long, it won't suddenly work now. Incentives need to change. Punishment for a security hole needs to increase significantly, entirely new tooling needs to be enforced or some other solution needs to be created. This is one of those cases where the solution is seen as so drastic that people will want to just ignore or dismiss it. Thinking to themselves, no-one can really be advocating for that it'd impact everything. It will - making our digital systems secure will be hugely expensive. I see a Y2K x 10 style concerted effort as the only way to get things to change - but hopefully someone out there has an idea more likely to be implemented.

tw04 9y ago

I don't think you understand... there's literally 0 chance that hospitals and power plants are going to just universally enable windows update on their critical systems. Any patch that gets applied to life or death systems has to go through significant regression testing before going live. I guess you could suggest they just get universally redundant systems and take rolling outages, but I'm guessing nobody would be willing to pay for the cost of implementing such a scheme.

sqeaky 9y ago
Perhaps there should be a 0% chance that those things are on networks and a 0% chance they run a normal consumer grade OS. If the software in power plants were treated like their hardware it wouldn't be a problem.
- rbanffy 9y ago
  A custom OS would have an attack surface larger than one widely used. For high value targets, it'd be easier to attack.
  - sqeaky 9y ago
    A minimalistic OS intended for high security ought to be much smaller and should lack almost everything a general purposed OS has. This should make the attack surface pretty minimal. If that OS gets reused by many people so it gets vetted by time I think that would be best. Perhaps a very stripped down Linux or BSD could fill the role. There is absolutely no reason to have things network configuration wizards, wobbly windows or other fluff. I think there are already systems and tools to help someone construct a custom minimal Linux OS (Yocto) and perhaps people already use these to construct appliances for highly sensitive systems. I don't think we are that far away, at least some industries are pretty well covered already.
    - tw04 9y ago
      The exploits in question haven't been from "network configuration wizards" or "wobbly windows" - they're literally from backwards compatibility. And medical devices are one of the EXACT reasons there's so much cruft in Windows. They rely on ancient code becaues getting things re-approved via the FDA can take YEARS and millions of dollars. Those manufacturers won't change unless they have a gun to their head. So what... we switch to a stripped down version of Linux that won't ever have the kernel updated and will need to continue supporting version 1.0 of samba because of some arbitrary codepath to load new versions of firmware. It's easy to sit back and cast judgement when you don't deal with that industry... but they aren't doing it this way because it's fun.

shallot_router 9y ago

When you're up against a hostile organized adversary, especially a superpower nation-state's government and intelligence agencies, it's very very hard to just rely on better training and education and secure development practices. Everyone still needs to be doing these things, but the fight here is very asymmetric. If NSA or FSB or equivalent decides they want to disrupt or damage your company in a cyberattack, it's going to happen.