6 ms·
A quote from not the current worm's author, but the author of the worm that may be the inspiration for the current one: >The BrickerBot author argued that it w
by Groxx 7y ago
A quote from not the current worm's author, but the author of the worm that may be the inspiration for the current one:
>The BrickerBot author argued that it would be better if the devices were destroyed, rather than sit around as cannon fodder for DDoS botnets, and haunting the internet for years.
... yea, broadly I'd agree. IoT vendors are causing a tragedy of the commons, inflicting quite a lot of damage without feeling any of the pain because it hits others.
It's the sort of thing that should be addressed by legislation of some kind, but absent that (which includes nearly all international cases)... what else can you do to stop the worst offenders?
- Waterluvian 7y agoI don't think it's ever acceptable to make an "if I didn't do it, someone else may have done something worse" defense.
- Groxx 7y agoWhich is part of what causes tragedies of the commons, yes. I totally get your point, and it's valid, but it's being demonstrated right now that the current appropriate strategies have failed rather spectacularly. When appropriate measures have massively failed, what are the alternatives? Vigilante actions are one option, as is "watch the whole thing burn down", and probably an infinite variety of stuff in the middle and along different axes. What's your preferred option? edit: also, it's not quite "may [do] something worse". Insecure IoT things are used as botnets. Frequently. It's not a hypothetical threat at all, it's just a question of scale / frequency.
- tty2300 7y agoI see like a food safety inspector going around shutting down unsafe restaurants. These IoT devices are a danger to society and should be shut down.
- mehrdadn 7y agoDDoSes are as bad as food poisoning now?
- Groxx 7y agoWhen it causes millions of dollars of damage... Yeah. Sure. Why not? https://www.zdnet.com/article/the-average-ddos-attack-cost-for-businesses-rises-to-over-2-5m/ https://www.zdnet.com/article/the-average-ddos-attack-cost-f...
- mehrdadn 7y agoYou measure your health in dollars? I dare say you won't find much common ground with most people.
- Groxx 7y agoYou'll find it in tons of large-scale (e.g. governmental) decisions at the very least. "is it worth more to prevent X than to deal with the fallout" is a decision that has to be made at some point, and human life / injury are part of that equation. So, in a way, yes. I do. So do lots of people when they go to urgent care rather than the ER, knowing that the ER could bankrupt them, and they'd rather risk the delay. I don't have numbers off the top of my head, but I don't think it's as uncommon as you seem to think it is.
- mehrdadn 7y agoYou're comparing urgent care to ER to somehow argue people view both DDoS and food poisoning in dollars? Just because some policymakers put rough numbers on the value of human life in the aggregate in very specific situations with very particular interpretations, you think people would support your cause of measuring everything in dollars and going around destroying their property because they're "just as dangerous as food poisoning"? Like, seriously? If you went around and asked people whether their restaurants should be shut down for unsanitary practices, do you think you would get a response on the same planet as what you would get if you asked them about their IoT devices getting shut down? Come on.
- pjc50 7y agoMore like an unlicensed vigilante "food inspector" going round restaurants and burning them down on sight of a cockroach.
- icebraining 7y agoSoft-bricking is hardly comparable to burning something down. More like adding an extra lock and throwing away the key. Inconvenient, but not destructive.
- oaw-bct-ar-bamf 7y agoTo you as a domain expert, yes. A typical user just tosses the device into the trashcan. For him it’s effectively bricked.
- SkyBelow 7y agoIn a society where people refuse to have food inspectors and some are being harmed by food poisoning, I think one could argue that there isn't something wrong with that level of action.
- nickpsecurity 7y agoI think it's more like firearms. These devices can be and are used as weapons to hurt 3rd parties on the Internet. It's more like firearm owners leaving their weapons in front of their barely-sturdy windows. Then, folks needing weapons keep breaking the windows before firing them at others. The homeowners and homebuilders keep letting it happen. So, vigilantees concerned about damage to innocent people keep breaking into the windows, stealing the guns, unloading them, and tossing them into landfills. I'd be like: "Stop putting your guns in front of the windows. Be a responsible gun owner." Enough broken windows and stolen guns might incentivize them to do that.
- seanhunter 7y agoFood safety inspectors have an official remit to do this that is enshrined in statues and local laws. You don't get to just decide for yourself you will shut down some restaurants on a freelance basis.
- boomlinde 7y agoThat's a misleading representation of the defense. "If I didn't do it, they would eventually have become a public nuisance in the form of nodes in a botnet" captures the supposed intent more fairly, and with the intent to target every known vector used by Mirai and Qbot it seems quite realistic that these systems would eventually become botnet nodes. It's IMO somewhat comparable to culling high-risk farm animals to prevent widespread disease outbreaks.
- FakeComments 7y agoOkay, I accept your analogy. Where do you have legal authority to do a vigilante culling of your neighbor’s herd, because you decided something about them merited it?
- boomlinde 7y agoThere is a dead reply to this which I think asks a fair question. > Where do you have legal authority to do a vigilante culling of your neighbor’s herd, because you decided something about them merited it? I am not making the argument that this is legally defensible. You can by definition not have legal authority to engage in vigilantism. It's from an ethical and practical perspective that I draw the analogy. On the matter of legality, the difference you point out applies, but also goes both ways. There is no legal framework around "culling" insecure devices, and very little regulation.
- mcv 7y agoWhat would be really nice is if a worm like this patched the crappy security of those IoT devices, but I guess that's too hard. With the question being either bricking them or allowing them to become part of a botnet, I guess the world might indeed be better off with vulnerable IoT devices getting bricked. But boy, it's really a marginally lesser evil. Let's hope this forces manufacturers to improve their security. That's the main good that needs to come out of this.
- Groxx 7y agoWorms that patch with better security have been a thing before: https://en.wikipedia.org/wiki/Computer_worm#Worms_with_good_intent https://en.wikipedia.org/wiki/Computer_worm#Worms_with_good_... They have generally had mixed success, from the ones I've read about. Pretty often there are side effects that aren't good (e.g. bricking some devices, excess traffic due to being too successful, that kind of thing) But yea, in this case I think it's clearly too complex. There are thousands of different things hooked up to the internet, and you can't fix all of them at once.
- icebraining 7y agoPatching is just a subsidy for the manufacturer. This malware just soft-bricks (the device can be restored by reinstalling the firmware), so it inflicts a cost without generating extra garbage. Sounds great to me.
- dexen 7y ago>IoT vendors are causing a tragedy of the commons, inflicting quite a lot of damage It's an interesting problem in that the value of hackale/wormable IoT devices stems from their sheer number. In a way the culpability of any singular vendor for any singular sale is low by and of itself; it's only large in aggregate of all the vendors' products ever sold & still deployed. This is a reverse of, but comparable to, the low value of personal data being gathered&processed (or stolen) - for every singular individual, the value/loss is exceedingly low. The value lies in the aggregate of the data; the whole is much more than the sum of its parts. Thus the prosecution of things like the Equifax hack, or the insecure IoT devices is pretty spotty at best. Perhaps we need a new, specialized legislation & judiciary for cases where network effects dominate.
- TeMPOraL 7y agoThere aren't many "network effects" (the business term) in IoT, despite vendors' best efforts. The value of the network to the user does not increase with the number of nodes in the network. That said, I agree there's a sort-of similar pattern here, which I feel underlies many of the biggest problems of our era - including climate change. The pattern is that there's a lot of entities - individual, small and large companies - engaging in transactions, and each transaction has a small negative - some personal data stolen here, some toaster joining the botnet there, some trivial amount of carbon emitted elsewhere. The negatives however add up, and ultimately manifest as huge and international problems. We definitely need to develop legislative methods that would combat this pattern at the structural level, regardless of the business domain it shows itself in.
- kbenson 7y agoThat's an interesting perspective. It brings to light some personal responsibility we might be glossing over. Is it the responsibility of the bottled water seller to not sell plastic bottles because they fill landfills, or the consumer to make sure to dispose of the plastic bottle responsibly? That doesn't entirely match the current situation, but there probably is a some responsibility that lays with consumers for buying crappy devices from companies with no track record for keeping them updated. It's not always simple to reason about, but it is something to consider next time there's a decision to buy some cheaper device from some no name company or from some well known company (that hopefully has some sort of support lifetime at least).
- jpalomaki 7y agoIn Europe the we have the laws that protect consumer rights. The thing missing is somebody to define that severe security vulnerability is considered as a defect in the product. Once this is done, consumers can either demand the seller to fix the problem, replace product or give refund. This should pretty quickly create a financial incentive to sell products which get updates.
- Groxx 7y agoThis would be a huge improvement for made-and-sold-in-Europe, and would at least make a sizable dent... but the rest of the internet still exists, and doesn't care where the botnet devices are made or installed, only that they exist. Still, yea, this is exactly the kind of thing that needs to become commonplace. Hopefully it will be, though this is far from the first time that something like this has happened and here we still are.
- TeMPOraL 7y agoYou have to start somewhere. See also: GDPR - it's already made enough waves that other nations and even some US states are considering similar legislation.
- johnnycab 7y agoWhat are your experiences of acquiring information in Poland under GDPR, especially if you were either denied or came across any hurdles in exercising your rights; whether or not the subsequent disclosure was to your satisfaction?
- StavrosK 7y agoI'm not temporal, but haven't had many bad experiences that I chased up. I didn't request some data from Revolut that they didn't provide, but I didn't email their compliance officer to request it. I think they would have provided it if I had. Still, even just the fact that companies are now thinking about this and providing ways to download/delete your data makes me love the GDPR.