6 ms·

They deserve it, for: 1) having mission critical systems on the internet and 2) not patching mission critical systems for vulnerabilities that have been (extr

They deserve it, for: 1) having mission critical systems on the internet and 2) not patching mission critical systems for vulnerabilities that have been (extremely) public for nearly a year now

oneplane 9y ago
Indeed. Which department of 'management level' deserves this is another question, but somewhere, someone (probably C-level) decided that it wasn't important enough and now got bit by it. I'm pretty sure someone else will get the blame for it, for about 6 months 'improvements' will be made, and next year, we're going to see something like this just repeat itself.
- yayyayh 9y ago
  We all know dozens if not hundreds of engineers were very well aware of the vulnerability and even brought it to management attention multiple times to basically he told to f-off since it wasn't costing the company any money. Meanwhile those managers collect ludicrous bonuses.
bigiain 9y ago
I'm not a fan of victim-blaming ("She was wearing a miniskirt in a sketchy part of town" is never an excuse!). But yeah - this was negligence. (Also, #1 is not necessarily true - WannaCry spreads via USB too - https://www.tripwire.com/state-of-security/featured/wannacry-ransomware-infects-australian-traffic-cameras-human-error-blamed/ https://www.tripwire.com/state-of-security/featured/wannacry... )
- orf 9y ago
  > "She was wearing a miniskirt in a sketchy part of town" is never an excuse! More like: she left all her bright-red sports car car doors open with the windows rolled down, parked unattended in a sketchy part of town
  - bigiain 9y ago
    Even then - it was the thief who stole it who was "to blame". I've walked past plenty of open doors, topless convertibles, unattended bicycles - without being compelled to steal anything. To push the analogy too far - building a robot to check every parked car to see if it's unlocked and stealing the ones that are - is not OK, even though they were unlocked.
    - orf 9y ago
      You'd be hard pressed to find anyone who's immediate reaction to that story is not "what the hell did you expect was going to happen, that's on you", regardless of where the blame philosophically lies. Thievery happens, it's happened since the dawn of time and will happen up until the end. To not be aware of this is your fault. In my opinion arguing otherwise is like arguing the sea is to blame for destroying your house, when you built it unprotected on a beach.
      - bigiain 9y ago
        Sure - and I won't argue about whether it counts as "contributory negligence" if you park your nice car unlocked in sketchy areas and it gets stolen (and I'm sure you'll be hearing that from your insurance company if it's you). But if your sister/girlfriend/wife/mother is assaulted in the street and I said to you "what the hell did you expect was going to happen, that's on you" - I'd fully expect you to punch me in the face. (And yes, I realise the hypocrisy in that - welcome to the inconsistency of being a human being...)
    - kolpa 9y ago
      Many a gravestone bears the epitaph "but I was right." Of course criminals are wrong, to blame, and should be punished. Still, people are responsible for securing their own safety for as long as criminals exist.
      - bigiain 9y ago
        Agreed - part of that is locking your car. But at least as big a part is paying your taxes, contributing to society, requiring your political representatives to write appropriate and sensible laws, ensuring the police are funded and trained to catch people who break them, ensuring the courts are capable and willing to punish them. "Securing safety" should be mostly a collective thing, not an individual thing. Society as a whole has a lot better opportunity to deter crime in the first place and to reduce the incidences overall - than most individuals do. [edit]Oh, and not stealing other people's shit yourself, or giving a pass to your friends or family who do.
xoa 9y ago
I'd actually argue that at least as important (if and only if this isn't the case) would be 3) Not having extensive WORM backups and a plan to simply nuke and repave everything, or even quickly substituting in duplicate clean hardware kept cold for emergency. This should include (to the extent possible) running everything isolated while infection source is determined. I mean yes, both your points are important too though with caveats. For 1, it's not necessarily the case they had mission critical systems on the Internet. There are significant ways that malware can cross even decent air gaps (let alone softer protections). And of course sometimes even mission critical equipment does in fact need to have a WAN link, though in that case I'd hoped it'd have protects wrt their intranet. For 2, yes to that also if Boeing just plain didn't patch when they could have. But particularly when dealing with a lot of heavy duty industrial control applications sometimes enormously expensive hardware will only work with very old systems and/or have other baroque and fragile dependencies. Perhaps more to the point, there are zero days out there too, and Boeing should be ready even if this was an entirely unknown vulnerability rather then an old one. Or for that matter if a bunch of their critical computers simply exploded into flame. At their level I'd expect a very concrete and specific action plan to simply bootstrap from scratch in a worst case and bring themselves back up from mere computer failure within a few days at worst and with a limited amount of data lost. Of course, like I said at the start, maybe that is in fact what they're executing, the article was light on details. If they are having to do a "swap in fresh hardware/reimage/restore while preventing reinfection" scenario across tons of systems in a hurry that would indeed be an All Hands On Deck critical event, albeit one with hopefully a relatively deterministic time frame. While it wouldn't stun me to see even a big engineering oriented company like that mess up here in a facepalm way I also don't want to jump to conclusions too fast. Clearly something has gone wrong, but if they have a worst case plan all in place ready to go and practiced and are now executing, it wouldn't be good they'd have to but that's what worst case plans are for.

They deserve it, for: 1) having mission critical systems on the internet and 2) not patching mission critical systems for vulnerabilities that have been (extremely) public for nearly a year now

oneplane 9y ago

Indeed. Which department of 'management level' deserves this is another question, but somewhere, someone (probably C-level) decided that it wasn't important enough and now got bit by it. I'm pretty sure someone else will get the blame for it, for about 6 months 'improvements' will be made, and next year, we're going to see something like this just repeat itself.

yayyayh 9y ago
We all know dozens if not hundreds of engineers were very well aware of the vulnerability and even brought it to management attention multiple times to basically he told to f-off since it wasn't costing the company any money. Meanwhile those managers collect ludicrous bonuses.

bigiain 9y ago

I'm not a fan of victim-blaming ("She was wearing a miniskirt in a sketchy part of town" is never an excuse!). But yeah - this was negligence. (Also, #1 is not necessarily true - WannaCry spreads via USB too - https://www.tripwire.com/state-of-security/featured/wannacry-ransomware-infects-australian-traffic-cameras-human-error-blamed/ https://www.tripwire.com/state-of-security/featured/wannacry... )

orf 9y ago
> "She was wearing a miniskirt in a sketchy part of town" is never an excuse! More like: she left all her bright-red sports car car doors open with the windows rolled down, parked unattended in a sketchy part of town
- bigiain 9y ago
  Even then - it was the thief who stole it who was "to blame". I've walked past plenty of open doors, topless convertibles, unattended bicycles - without being compelled to steal anything. To push the analogy too far - building a robot to check every parked car to see if it's unlocked and stealing the ones that are - is not OK, even though they were unlocked.
  - orf 9y ago
    You'd be hard pressed to find anyone who's immediate reaction to that story is not "what the hell did you expect was going to happen, that's on you", regardless of where the blame philosophically lies. Thievery happens, it's happened since the dawn of time and will happen up until the end. To not be aware of this is your fault. In my opinion arguing otherwise is like arguing the sea is to blame for destroying your house, when you built it unprotected on a beach.
    - bigiain 9y ago
      Sure - and I won't argue about whether it counts as "contributory negligence" if you park your nice car unlocked in sketchy areas and it gets stolen (and I'm sure you'll be hearing that from your insurance company if it's you). But if your sister/girlfriend/wife/mother is assaulted in the street and I said to you "what the hell did you expect was going to happen, that's on you" - I'd fully expect you to punch me in the face. (And yes, I realise the hypocrisy in that - welcome to the inconsistency of being a human being...)
  - kolpa 9y ago
    Many a gravestone bears the epitaph "but I was right." Of course criminals are wrong, to blame, and should be punished. Still, people are responsible for securing their own safety for as long as criminals exist.
    - bigiain 9y ago
      Agreed - part of that is locking your car. But at least as big a part is paying your taxes, contributing to society, requiring your political representatives to write appropriate and sensible laws, ensuring the police are funded and trained to catch people who break them, ensuring the courts are capable and willing to punish them. "Securing safety" should be mostly a collective thing, not an individual thing. Society as a whole has a lot better opportunity to deter crime in the first place and to reduce the incidences overall - than most individuals do. [edit]Oh, and not stealing other people's shit yourself, or giving a pass to your friends or family who do.

xoa 9y ago

I'd actually argue that at least as important (if and only if this isn't the case) would be 3) Not having extensive WORM backups and a plan to simply nuke and repave everything, or even quickly substituting in duplicate clean hardware kept cold for emergency. This should include (to the extent possible) running everything isolated while infection source is determined. I mean yes, both your points are important too though with caveats. For 1, it's not necessarily the case they had mission critical systems on the Internet. There are significant ways that malware can cross even decent air gaps (let alone softer protections). And of course sometimes even mission critical equipment does in fact need to have a WAN link, though in that case I'd hoped it'd have protects wrt their intranet. For 2, yes to that also if Boeing just plain didn't patch when they could have. But particularly when dealing with a lot of heavy duty industrial control applications sometimes enormously expensive hardware will only work with very old systems and/or have other baroque and fragile dependencies. Perhaps more to the point, there are zero days out there too, and Boeing should be ready even if this was an entirely unknown vulnerability rather then an old one. Or for that matter if a bunch of their critical computers simply exploded into flame. At their level I'd expect a very concrete and specific action plan to simply bootstrap from scratch in a worst case and bring themselves back up from mere computer failure within a few days at worst and with a limited amount of data lost. Of course, like I said at the start, maybe that is in fact what they're executing, the article was light on details. If they are having to do a "swap in fresh hardware/reimage/restore while preventing reinfection" scenario across tons of systems in a hurry that would indeed be an All Hands On Deck critical event, albeit one with hopefully a relatively deterministic time frame. While it wouldn't stun me to see even a big engineering oriented company like that mess up here in a facepalm way I also don't want to jump to conclusions too fast. Clearly something has gone wrong, but if they have a worst case plan all in place ready to go and practiced and are now executing, it wouldn't be good they'd have to but that's what worst case plans are for.