5 ms·
Pen Testing Ships. A year in review
- ropiwqefjnpoa 7y agoThe cruise booking hacks caught my attention... In any case, I still find myself removing sticky notes on monitors with passwords. One time, I caught them mass producing login credentials on avery label sheets. I nearly lost it on the poor reception staff.
- frandroid 7y agoI used to keep a fake password sticky on my monitor to make people like you lose it. :)
- yjftsjthsd-h 7y agoIt would take some work, but I'd really love to have a password that, if entered, would trigger an alert (and maybe power off the machine or something). Then put that booby-trapped password on a bit of paper and stick it under your keyboard or wherever.
- jdsnape 7y agoThere’s a company that makes exactly this - https://canary.tools/ https://canary.tools/
- krisoft 7y ago"password re-use across an environment is endemic..." What is the solution against this? I just can't identify with the "D’OH!". People want to get their work done. They will use whatever gets the job done. If there is an easier, better way they will use that. So how can we provide them systems where the easier, better way is also safer? What is the current best practice in this area?
- pas 7y agoSmart cards with NFC? YubiKeys with the button? A small personal password plus the second factor should work well enough on ships.
- freeone3000 7y agoIf you can do the second factor, why bother with the password?
- PeterisP 7y agoA simple password or a pin code does mitigate quick attacks of opportunity using lost or stolen physical factor; and adds non-repudiation if someone uses someone else's token - you can't just say "oh we must have accidentally swapped our cards at lunch" if you had to enter their pin as well.
- freeone3000 7y agoGiven the existing password hygiene, I think it's more likely that any new PIN or password would be treated in the same manner as the existing ones, and would just be an additional hassle.
- yencabulator 7y agoSerious question: How often do such employees/contractors claim to have accidentally swapped keys at lunch?
- seer 7y agoI would love to know this as well. The rise of 2FA has made everything more secure for sure, but it has made usability plummet like a rock on Jupiter. Especially in a corporate environment where you have multiple layers of tokens, authenticators and passwords. Password managers do help, but you still need to click and enter and copy paste many many times a day. If only someone like apple / microsoft / google came up with a comprehensive solution to all this - as they seem to be the only entities big enough to shoulder such a monumental task. I mean Apple sorta kinda does, but only for its own services. I have an apple watch, it knows that its me and its authenticated. The proximity with my laptop unlocks it automatically - so far so good, but why can’t I use the same thing for github/google/microsoft websites? Why can’t safari send some sort of token through to then authenticating that its me? I mean if you’re afraid it might be someone else at the computer - _check the damn watch proximity again_! And if there’s a need for personas - sure but they are all still linked to me. I would imagine there could be like a system dialog where I choose which persona to send to a specific site/app. /rant
- RyJones 7y agoOne of the competitions in Hack the Machine[0] brings in a copy of the setup of the bridge[1] of a ship and you're allowed to attack in a lot of ways. It was impressive. [0] https://www.hackthemachine.ai https://www.hackthemachine.ai [1] https://www.hackthemachine.ai/track1/ https://www.hackthemachine.ai/track1/
- cbsks 7y agoStupid question: What are "OT" and "IT" in this context?
- hhh 7y agoOperational technology and Information Technology I would assume.
- cbsks 7y agoI've been a programmer for 15+ years, and for some reason I thought that IT meant Internet Technology... oops
- cbsks 7y agoAnswered my own question: Information Technology (IT): “The entire spectrum of technologies for information processing, including software, hardware, communications technologies and related services. In general, IT does not include embedded technologies that do not generate data for enterprise use.” Operational Technology (OT): “Is hardware and software that detects or causes a change through the direct monitoring and/or control of physical devices, processes and events in the enterprise.” https://www.globalsign.com/en/blog/it-vs-ot-industrial-internet https://www.globalsign.com/en/blog/it-vs-ot-industrial-inter... So basically OT is IoT and embedded devices, and IT is everything else on your network.
- csours 7y agoYes, think of OT as the device that connects sensors to actions: When this limit switch is tripped, that servo is activated. You may also want to know how many times each switch is activated, and the status of the servo, so the information gets sent over to IT for logging and display in a HMI.