7 ms·

I know this is not going to be a popular opinion, but using Windows for critical systems, even air-gapped and everything is simply irresponsible. Windows seems

by 4ad 8y ago

I know this is not going to be a popular opinion, but using Windows for critical systems, even air-gapped and everything is simply irresponsible. Windows seems to be too hard to secure, and these problem keep happening again and again. It's not that Linux or some RTOS would necessarily be immune to a targeted attack like Stuxnet, but they would be immune from the random crap malware that exists in the Windows world.

tetha 8y ago
I've been thinking about that on and off for quite some time. These kind of embedded systems are actually a really hard problem, because updates are hard up to impossible. So eventually there will be 10 years of known bugs in that system. Digesting from a lot of defcon / blackhat talks, it seems that the best way to minimize this amount of bugs is to deploy less code. And I think that's where a BSD or a linux has a strong option to be more secure: you could strip down the kernel and the system as much as possible. Don't deploy any USB related code, potentially remove the entire network stack if you can. That's the theory anyway. The IoS displays how badly managed linux can be equally open.
- laythea 8y ago
  My experience of redundant embedded controller systems is that whilst they may not be WindowsTM software, they are usually based on an RTOS such as vxWorks, QNX etc. I don't suppose they are any harder to "hack" than Windows. In fact, it is possible that they may be easier depending on the security mentality of the manufacturer, and given the number of eyeballs on WindowsTM. I can only imagine this will get worse as these controllers become more and more sophisticated. The only way, in my opinion, to safeguard against this, is have a fully disconnected system, with no USB access. However USB is easy.
  - tetha 8y ago
    > I can only imagine this will get worse as these controllers become more and more sophisticated. That is exactly the thing though. If you could reduce a digital control unit to a small program and run that on a write-once memory in a dead simple controller, you'd avoid spectre, meltdown, you'd avoid the vulnerability of overwriting the program post-deployment and you'd simplify ensuring correctness of the control program. Verification might actually be possible there.
    - laythea 8y ago
      Hi, yes but they wont do that. Normally, there is no write once memory. Most eg. oil rig control systems are not hammered down to that level. Heck - most aviation flight control systems are not like that. In fact, I was, in my early career responsible for writing a windows C# communications driver for the entire oil rig. Its still working :)
AngryData 8y ago
It seems incredibly stupid and irresponsible to use any 'modern' hardware systems for fairly simple but critical functions. Like voting machines, you need a chip less powerful than a damn 30 year old scientific calculator to do something as simple as count votes, everything more is just layers of vulnerability. And I would say the same for any critical infrastructure, but money and profit is apparently more important than safety or security.

by 4ad 8y ago

tetha 8y ago

I've been thinking about that on and off for quite some time. These kind of embedded systems are actually a really hard problem, because updates are hard up to impossible. So eventually there will be 10 years of known bugs in that system. Digesting from a lot of defcon / blackhat talks, it seems that the best way to minimize this amount of bugs is to deploy less code. And I think that's where a BSD or a linux has a strong option to be more secure: you could strip down the kernel and the system as much as possible. Don't deploy any USB related code, potentially remove the entire network stack if you can. That's the theory anyway. The IoS displays how badly managed linux can be equally open.

laythea 8y ago
My experience of redundant embedded controller systems is that whilst they may not be WindowsTM software, they are usually based on an RTOS such as vxWorks, QNX etc. I don't suppose they are any harder to "hack" than Windows. In fact, it is possible that they may be easier depending on the security mentality of the manufacturer, and given the number of eyeballs on WindowsTM. I can only imagine this will get worse as these controllers become more and more sophisticated. The only way, in my opinion, to safeguard against this, is have a fully disconnected system, with no USB access. However USB is easy.
- tetha 8y ago
  > I can only imagine this will get worse as these controllers become more and more sophisticated. That is exactly the thing though. If you could reduce a digital control unit to a small program and run that on a write-once memory in a dead simple controller, you'd avoid spectre, meltdown, you'd avoid the vulnerability of overwriting the program post-deployment and you'd simplify ensuring correctness of the control program. Verification might actually be possible there.
  - laythea 8y ago
    Hi, yes but they wont do that. Normally, there is no write once memory. Most eg. oil rig control systems are not hammered down to that level. Heck - most aviation flight control systems are not like that. In fact, I was, in my early career responsible for writing a windows C# communications driver for the entire oil rig. Its still working :)

AngryData 8y ago

It seems incredibly stupid and irresponsible to use any 'modern' hardware systems for fairly simple but critical functions. Like voting machines, you need a chip less powerful than a damn 30 year old scientific calculator to do something as simple as count votes, everything more is just layers of vulnerability. And I would say the same for any critical infrastructure, but money and profit is apparently more important than safety or security.