4 ms·

i agree tech illiteracy is the red herring, the fact this vulnerability affected so many people, points to the issue being with the manufacturer, designing and

i agree tech illiteracy is the red herring, the fact this vulnerability affected so many people, points to the issue being with the manufacturer, designing and coding this, without consideration to the security. i think the "attack" they did is pretty perfectly grey hat, expose a weakness to the user with a "how-to-fix" guide. (i should note, i'm talking about the chrome hack.)

isostatic 8y ago
One prank would be egging cars. Clearly it's the car companies fault for building cars that have paint ruined if you don't wash it quickly. Another would be putting a potato in the exhaust -- why don't they build potato proof exhausts? You can let car tyres down without causing an ounce of damage, what a hoot. It's the car company's fault that so many cars are susceptible.
- who-knows95 8y ago
  sorry, i guess companies shouldn't worry about writing code or making products that have vulnerability built in. i'm sure you don't want secure strong products.
  - watwut 8y ago
    Of course they should. And we all on this forum know small internet devices are full of vulnerabilities. We also all know smart homes and such are security disaster waiting for happen. That does not mean it is for me to take advantage of that for pranks, fun or profit. Just as we should not demonize acts like this as something more dangerous then it is, we should not add naive feel good interpretations that makes them misunderstood heroes.
    - who-knows95 8y ago
      the chrome cast hack, along with the printer hack aren't pranks, for fun or profit? they did them to expose a weakness to the user so they could fix it. if white hat is employed by companies, and black hat is working for malicious gain. their actions fall squarely into grey hat. i'm not calling them saints, but it confuses me that anyone would have a issue with their actions? can you explain why they don't fit the model of grey hat? what they do wrong?
      - watwut 8y ago
        They are pranks for fun. I don't buy "to expose vulnerability so that users fix it" explanation. I think that what they did crossed the boundaries of other people. It did not caused much harm, just like walking around directors office without permission and without taking away something. I don't care about hat color games. That just serves to obfuscate issues. Also, it was illegal and put themselves in danger for that reason. So PewDiePie along with all adults who talk from both sides of their mounth in front of audience they intentionally build from young inexperienced impulsive people can stuff themselves too. "This illegal thing is totally cool I love you, I mean don't do anything illegal, I love you for doing that ilegal thing" is mastery of double message and manipulation.
        who-knows95 8y ago
        "I don't buy "to expose vulnerability so that users fix it" explanation" so why did the chrome cast hack include a 'how to fix this' guide? https://www.veracode.com/blog/security-news/hackers-exploit-known-google-chromecast-vulnerability-thousands-devices https://www.veracode.com/blog/security-news/hackers-exploit-... "the CastHack bug, allegedly disclosed nearly five years ago" "A spokesperson from Google told TechCrunch, “We have received reports from users who have had an unauthorized video played on their TVs via a Chromecast device. This is not an issue with Chromecast specifically, but is rather the result of router settings that make smart devices, including Chromecast, publicly reachable.”" google has ignored this bug as it isn't a issue with the chromecast, but the router, so using this hack to teach users to fix the router issue is a legitimate way to help users. your analogy suck, a better one is how bug hunters work, except this bug was exposed directly to the end-user. sorry i know colours can be confusing, don't worry about it. point me to the laws that were broken, just because you hate a YouTuber doesn't make him a bad person.
        isostatic 8y ago
        > point me to the laws that were broken Encouraging a crime is a crime in the UK based on the Serious Crime Act 2007 The actual hacking falls under the Computer Misuse Act 1990 If I leave my front door unlocked, return home, find that someone has gone into my house and left a note saying "Hi, your door was unlocked, you should lock it", I would not be happy. If they papered my living room with "visit this celeb's webpage" I'd be furious.
- mindslight 8y ago
  Analogs to the real world are compelling, but this line of reasoning is nonsensical when applied to the digital realm. The magnitude differences of "constant factors" make the Internet paradigm/philosophy wildly different. It's quite hard to accidentally put a potato in an exhaust pipe. One cannot write a script that mechanically puts a potato up every car in the world's tailpipe, in 5 minutes nonetheless! An appropriate real world analogy would be something like a maker of explosion-proof equipment forgoes designing any actual protection against those harsh environments, and then blames the ensuing explosion on all that dust in the air. The Internet was successful precisely due to scaling from the End to End principle. The Internet is hostile noise - as soon as something speaks IP, it must be capable of standing up for its own security rather than relying on some imagined benevolence or accountability. If a manufacturer is not up to this task, then there are plenty of non-globally-routing protocols (eg USB, bluetooth) that printers can use to communicate with a competent Internet node. (Furthermore ignoring the digital spookiness, the actual damage doesn't even add up to much. If we assume they hacked 30k printers, that's only 60 reams of paper - on the scale of petty larceny. And given that we allow junk mail and other advertising companies to do far more damage as their above-board business, it's questionable whether that integral even applies!)

isostatic 8y ago

One prank would be egging cars. Clearly it's the car companies fault for building cars that have paint ruined if you don't wash it quickly. Another would be putting a potato in the exhaust -- why don't they build potato proof exhausts? You can let car tyres down without causing an ounce of damage, what a hoot. It's the car company's fault that so many cars are susceptible.

who-knows95 8y ago
sorry, i guess companies shouldn't worry about writing code or making products that have vulnerability built in. i'm sure you don't want secure strong products.
- watwut 8y ago
  Of course they should. And we all on this forum know small internet devices are full of vulnerabilities. We also all know smart homes and such are security disaster waiting for happen. That does not mean it is for me to take advantage of that for pranks, fun or profit. Just as we should not demonize acts like this as something more dangerous then it is, we should not add naive feel good interpretations that makes them misunderstood heroes.
  - who-knows95 8y ago
    the chrome cast hack, along with the printer hack aren't pranks, for fun or profit? they did them to expose a weakness to the user so they could fix it. if white hat is employed by companies, and black hat is working for malicious gain. their actions fall squarely into grey hat. i'm not calling them saints, but it confuses me that anyone would have a issue with their actions? can you explain why they don't fit the model of grey hat? what they do wrong?
    - watwut 8y ago
      They are pranks for fun. I don't buy "to expose vulnerability so that users fix it" explanation. I think that what they did crossed the boundaries of other people. It did not caused much harm, just like walking around directors office without permission and without taking away something. I don't care about hat color games. That just serves to obfuscate issues. Also, it was illegal and put themselves in danger for that reason. So PewDiePie along with all adults who talk from both sides of their mounth in front of audience they intentionally build from young inexperienced impulsive people can stuff themselves too. "This illegal thing is totally cool I love you, I mean don't do anything illegal, I love you for doing that ilegal thing" is mastery of double message and manipulation.
      - who-knows95 8y ago
        "I don't buy "to expose vulnerability so that users fix it" explanation" so why did the chrome cast hack include a 'how to fix this' guide? https://www.veracode.com/blog/security-news/hackers-exploit-known-google-chromecast-vulnerability-thousands-devices https://www.veracode.com/blog/security-news/hackers-exploit-... "the CastHack bug, allegedly disclosed nearly five years ago" "A spokesperson from Google told TechCrunch, “We have received reports from users who have had an unauthorized video played on their TVs via a Chromecast device. This is not an issue with Chromecast specifically, but is rather the result of router settings that make smart devices, including Chromecast, publicly reachable.”" google has ignored this bug as it isn't a issue with the chromecast, but the router, so using this hack to teach users to fix the router issue is a legitimate way to help users. your analogy suck, a better one is how bug hunters work, except this bug was exposed directly to the end-user. sorry i know colours can be confusing, don't worry about it. point me to the laws that were broken, just because you hate a YouTuber doesn't make him a bad person.
        isostatic 8y ago
        > point me to the laws that were broken Encouraging a crime is a crime in the UK based on the Serious Crime Act 2007 The actual hacking falls under the Computer Misuse Act 1990 If I leave my front door unlocked, return home, find that someone has gone into my house and left a note saying "Hi, your door was unlocked, you should lock it", I would not be happy. If they papered my living room with "visit this celeb's webpage" I'd be furious.
mindslight 8y ago
Analogs to the real world are compelling, but this line of reasoning is nonsensical when applied to the digital realm. The magnitude differences of "constant factors" make the Internet paradigm/philosophy wildly different. It's quite hard to accidentally put a potato in an exhaust pipe. One cannot write a script that mechanically puts a potato up every car in the world's tailpipe, in 5 minutes nonetheless! An appropriate real world analogy would be something like a maker of explosion-proof equipment forgoes designing any actual protection against those harsh environments, and then blames the ensuing explosion on all that dust in the air. The Internet was successful precisely due to scaling from the End to End principle. The Internet is hostile noise - as soon as something speaks IP, it must be capable of standing up for its own security rather than relying on some imagined benevolence or accountability. If a manufacturer is not up to this task, then there are plenty of non-globally-routing protocols (eg USB, bluetooth) that printers can use to communicate with a competent Internet node. (Furthermore ignoring the digital spookiness, the actual damage doesn't even add up to much. If we assume they hacked 30k printers, that's only 60 reams of paper - on the scale of petty larceny. And given that we allow junk mail and other advertising companies to do far more damage as their above-board business, it's questionable whether that integral even applies!)