5 ms·
I'm not sure why we laugh at old systems that are still doing their job Because other countries are hacking our infrastructure, as we hack theirs, and t
by _underground 7y ago
I'm not sure why we laugh at
old systems that are still
doing their job
Because other countries are hacking our infrastructure, as we hack theirs, and those laughing are doing so nervously, because with an operating system that is decades out of date, it's painfully obvious that anything defended by a password protected user account on that operating system isn't really protected against a determined enemy at all, and any of the permissions and privileges conferred by user accounts on that system are likely a facade protected by an honor system, and mostly physical security.
In truth, even if the operating system were newer, we would not want it hooked up to the internet, but if the operating system were up to date, and not well isolated and became exposed to any public gateways, it would stand a fighting chance of not spilling its guts to the world.
With such a system disconnected from the internet, one can still bet that a determined attack is going to implant remote connectivity under their own control, and their job is much easier once the implant is connected. They don't need to sweat OS level password rotation, probably won't worry about strong encryption key changes or having to prove identity to policy enforcement tools with signing keys or tokens. Very little in the way of locking the integrity of the system is built into the concept of the OS. The application layer may offer better protection with proprietary controls, but the contents of disk and RAM are very probably possible to dump, inspect, bit twiddle and write back in place to just do anything you want, if your expertise runs deep enough.
- Wowfunhappy 7y agoIs the NYC subway's OS/2 connected to the internet?
- xvector 7y agoI think the real question is “what is the physical security model of the OS/2?” I would imagine a determined attacker could infiltrate the system in-person. The question then becomes - how easy is it to compromise the system given physical access? And, assuming total compromise, how much damage and loss of life can be caused? (Do the subways have physical fail-safes?)
- flomo 7y agoOS/2 was a single user PC OS, it didn't have any physical security or account passwords or etc.
- tw04 7y agoCountless ATMs ran it for decades. They obviously figured something out to secure it.
- meowface 7y agoI wouldn't be so confident about that.
- nickpsecurity 7y agoCameras, locks, and obfuscation, basically. Ti hack it, you need to be alone with it long enough to find the flaws, figure out how dispensor works, etc. People hardly ever try to bypass them. Recently, hackers have been buying, studying, and hacking ATM's. They're not secure. You can see them in action searching for DEFCON ATM hacking on YouTube.
- Wowfunhappy 7y agoWouldn't that be true of a mechanical system as well? We need a way to deal with this. It doesn't make sense to change out the OS of something like a subway system every five years or so.
- duxup 7y agoHow many steps away from the internet is anything? Maybe it is entirety physically separate and if so that is fine but few things are and infrastructure changes. I've worked on a lot of things that "shouldn't be on the internet" but it always seems to lead to bad security choices.
- mr-sinister 7y agoMr. Sinister's Law of Network Connectivity: For any given electronic system, the internet is never more than two software-defined radios away.
- duxup 7y agoSo true. And tommorow someone moves a cable or configuration and it is right there on the internet and nobody knows.
- Wowfunhappy 7y ago"software defined"? Is there something obvious I'm missing here? I can very easily build a computer without any sort of radio in it. Another person could come along and add one, of course, but that would be hardware.
- fulafel 7y agoYou can turn io interfaces into radios with just software. Emitters, at least.
- dmitriid 7y agoThe answer is: quite probably. A lot of old systems get retrofitted with additional features/terminals/addons on top to make them "more modern" and as a result end up being connected to the internet. A great presentation on this (and many other things) here: https://www.youtube.com/watch?v=5cWck_xcH64 https://www.youtube.com/watch?v=5cWck_xcH64
- southern_cross 7y agoStatements like that ring a bit hollow considering the number of security patches that Microsoft has to provide on a ongoing basis for their most "modern" Windows OS, and the thousands to tens of thousands of potential holes still left to be patched there. Out of necessity that patching is just never going to end, in other words, so Windows will never really be secure. In fact, it may just be about time to bring something like OS/2 back from the grave.