7 ms·

Is it just me, or has the number of large hacks on “things you’d expect to be at least somewhat secure” picked up since the pandemic started? It seems like ever

by derefr 6y ago

Is it just me, or has the number of large hacks on “things you’d expect to be at least somewhat secure” picked up since the pandemic started? It seems like every week now there’s a source-code leak for some high-profile project. My own assumption so far is that credentials that were previously being passed along through (essentially) in-person key-exchange parties, have now been forced to be passed along over channels like email/Slack/etc., making the ability to spin “mail/chat server admin creds” into “general system-level elevated creds” a lot more frequent.

aboringusername 6y ago
I think the pandemic has a role to play in this for sure. I imagine may were required to use computers/tech as they've not done before. Often times those who are uneducated have to be accounted for so concessions are made. For example, Sam needs to use a corporate network, doesn't really understand "apps" or what a "TOTP" is, so they optimize (weaken security) to allow them in.
- luckman212 6y ago
  Can we change this to "dumber than average" Sue? I guarantee when I'm 60 I'll still be able to safely operate a computer and understand what an "app" is, FFS. Ageism is really out of control these days.
  - jstanley 6y ago
    Sure, but when you're 60 you might not be so hot on technology that you first encountered in your 50s. I'm sure today's 60-year-olds are still perfectly good at the kind of things they've been doing since they were 20.
    - ineedasername 6y ago
      The implication that someone couldn't keep up with a relatively new things-- in your case vague example something they even encountered a few years earlier-- is pretty much the definition of ageism. Anyone who decides to keep their professional skills current will do just fine whether they're 5 years out of school or 40 years out of school. If someone doesn't keep current & is 5 years out of date on their skills, there's not a lot of difference between a 30 year old and a 60 year old that are equally 5 years out of date. Though the 60 year old might have decades more of experience working in their advantage, so maybe the two aren't equal.
    - blackrock 6y ago
      25 years ago, the hot technology was dial-up modems. And PCMCIA cards to connect to WiFi. Haven’t had much use of that lately.
  - ldng 6y ago
    You have a point about ageism, but you also make quite a condescending mistake of your own. You could have say "less tech savvy" than "dumber than average". It is not because you don't master something that you did not use before that you are dumb.
  - aboringusername 6y ago
    I edited the comment, you make a good point. My bias is that in my experience the elderly tends to struggle the most as it wasn't common in their day, but point duly noted.
  - cosmodisk 6y ago
    Absolutely agree on this. I've seen the entire spectrum by now: kids,who literally grew up with computers in their hands, not being able to operate simple software and people way past retirement age doing complex 'magic' on their PCs
    - ethbr0 6y ago
      I'm not impressed by the digital native, current generations. I think a better descriptor would be "app-native" -- i.e. "I don't understand or care how anything computing works under the hood, and it'd better be tied off with a pretty bow and UI."
      - cosmodisk 6y ago
        This is a topic we discussed with a colleague earlier this week: everyone's smart to click some buttons on an app,which, even a monkey with some basic training could do, but anything outside their comfort zone is a foreign language to them. Just a few days ago got asked what's the url to login to Office 365. There doesn't seem to be any willingness to think.
        boomboomsubban 6y ago
        As someone who hasn't touched Microsoft office in a decade, what's the URL for Office 365 seems like a fair question. Isn't it competing with Google? I assume they offer an in browser client, So yes, I have no idea how things I don't use work. This isn't that I'm unwilling to think, things are more open ended.
        cosmodisk 6y ago
        It's not the part whether one knows or doesn't know the url fascinates me: it's a professional setting, where people are quite used to solve problems much more complex than figuring out what's the url. For me it's the thought process: What's the url? I don't know.. error... error.. error. The equivalent of this is if I'd say to someone I've read a great article on Financial Times website,and they'd reply with: sorry, I can't read it,I don't know the url..
  - klingon79 6y ago
    How about Pat? That’s ambiguous enough.
    - fortyrod 6y ago
      Or pretend you're in the southeastern US, where "Sam" and "Sue" are both non-gendered, and probably ageless, according to Mr. Cash, at least. You could also go with Courtney, Tracy, Billie, Casey, Drew...
- lpriv 6y ago
  Cocks are tasty
dEnigma 6y ago
It wouldn't surprise me if the pandemic had an influence on some of these hacks. E.g. at our company there are some PCs still running Windows 7. For that reason they had no direct internet access, only to the internal network. But since about half the workforce, or at times more, had to work from home, and the licenses of our ERP software are bound to hardware, IT had to connect those PCs to the internet again, so the office workers could access them from home. Of course the whole situation was less than ideal to begin with, but now it's even worse.
- dboreham 6y ago
  Just to point out this makes no sense: you can have connectivity between host A and host B without also enabling transitive connectivity to the world of hacker-contolled host N.
  - dEnigma 6y ago
    I should also mention that it isn't in-house IT, but a separate company, and the whole thing was set up in a rushed effort late on a Friday afternoon the week before the whole working from home business would start (our management slept on it until the last minute), with a lot of other companies requesting the same support from the IT company at the same time. Not that it completely excuses everything, and as you can tell from the Windows 7 PCs it was never the most secure setup, but simply to explain some of the reasons behind the mess.
    - Kalium 6y ago
      This has all the hallmarks of an organization that views IT as a cost center rather than an enabler. Such an organization will tend to resent any spending on IT, so it's unfortunately not a surprise that it has likely scrimped and saved its way into ineffectual IT.
  - ethbr0 6y ago
    I believe this is assuming companies have segmented networks and jump hosts. In my experience, most... don't. Enterprise IT at non-tech companies is an absolute #&@_ show. The only rationale I've been able to come with is: if some portion of your company isn't developing / keeping up with tech trends, your IT shop isn't going to be pressured to either.
kilroy123 6y ago
I think people just have a ton of free time these days. I know I have.
- fortyrod 6y ago
  Occam called, he wants his razor back :)
lefstathiou 6y ago
It’s not uncommon to test the resolve of a new administration soon after a changing of the guard.
Barrin92 6y ago
>things you’d expect to be at least somewhat secure I feel like with a lot of security or cyber-crime stuff there's a "physician who smokes" dynamic to it where the people who you expect to have great security actually often don't take a lot of precautions. How many hackers end up being exposed because of fairly trivial or random accidents is actually surprising.
- guerrilla 6y ago
  That reminds me that Qualys was just hacked.
  - Godel_unicode 6y ago
    I wasn't surprised, I've used their product...
- theMuckPot 6y ago
  I've heard it said that first day beginners on a wood saw will almost never hurt themselves. Their fear of it, combined with their known ignorance of it, makes them extra cautious. Veterans of many years are the ones who get too comfortable, and too complacent. I guess the confidence of many years leads them to work a little too closely to the blade. This might be a universal human trait, across any industry.
TheRealPomax 6y ago
Sort of: since 2017 the number of CVEs have basically gone up a steady 8% per year [1], but the fact that you only noticed it this year also suggests that this alone is not why you noticed. The more likely reason you're noticing is that thanks to covid, and the accelerated death of real news services, combined with the echo chamber effect where we're all reminding each other of how bad things are, means you're getting more exposure to sensationalism, because that echos the best. And hacks certainly qualify as sensational, especially on slow news days, where news services desperately need clicks, and "X got hacked" gets those (even if it's a report on a hack that isn't actually one, like when someone walked into a data container with tens of servers, one of which happened to be rented by a password manager). The real wtf is what happened in 2017, though. [1]: https://nvd.nist.gov/vuln/search/statistics?form_type=Basic&results_type=statistics&search_type=all https://nvd.nist.gov/vuln/search/statistics?form_type=Basic&...
- SavantIdiot 6y ago
  I don't think major hacker sites getting hacked, or the MSE exploit from a few months ago qualifies as "sensationalism". These, especially the latter, are a Pretty Big Deal (tm). What do you consider a big news item that isn't "sensationalism"? (Your link timed-out)
  - TheRealPomax 6y ago
    Something can be a pretty big deal in terms of security, and get dressed up in sensationalism by news outlets to get more clicks. They're not mutually exclusive categories. But it's the "we can get clicks by reporting more of these" that most folks notice, rather than the reporting being in lockstep with the number of hacks being perpetrated every month/week/day for the last 4 years.
the8472 6y ago
This shouldn't be necessary. Getting the SSH pubkeys of other developers is easy. Grab them from github or from a shared server or ask them once. Then use age/rage to asymmetrically encrypt the secret you want to share. No password has to travel in cleartext anywhere.
deleted 6y ago
[deleted]
mrkramer 6y ago
Pandemic has nothing to do with frequency of cyber security incidents at least not on a large scale. Every time when something global is happening spammers jump on the bandwagon and try to lure people into opening their email spam and buy something or download attachments filled with malware. This global situation is specific because a lot of people are working remotely so they easier to target and compromise then before. In the last decade or so a lot of businesses moved their presence and other ops online and lots of them practice poor cyber security that's why you see a lot of hacks happening. Speaking of big companies they are always targets of state sponsored attacks and industrial espionage.
cloudking 6y ago
Generally the only people I've seen transfer credentials securely are IT and software engineers. You can count on every other department to send passwords over plaintext channels.
threeseed 6y ago
There was a US election. And one in which many countries i.e. Russia, Israel, China, Saudi Arabia, North Korea did not want Biden to win and who have a record of state-sponsored hacking. Solarwinds and the Microsoft compromises for example are clearly at a scale beyond your regular criminal hacker.

by derefr 6y ago

aboringusername 6y ago

I think the pandemic has a role to play in this for sure. I imagine may were required to use computers/tech as they've not done before. Often times those who are uneducated have to be accounted for so concessions are made. For example, Sam needs to use a corporate network, doesn't really understand "apps" or what a "TOTP" is, so they optimize (weaken security) to allow them in.

luckman212 6y ago
Can we change this to "dumber than average" Sue? I guarantee when I'm 60 I'll still be able to safely operate a computer and understand what an "app" is, FFS. Ageism is really out of control these days.
- jstanley 6y ago
  Sure, but when you're 60 you might not be so hot on technology that you first encountered in your 50s. I'm sure today's 60-year-olds are still perfectly good at the kind of things they've been doing since they were 20.
  - ineedasername 6y ago
    The implication that someone couldn't keep up with a relatively new things-- in your case vague example something they even encountered a few years earlier-- is pretty much the definition of ageism. Anyone who decides to keep their professional skills current will do just fine whether they're 5 years out of school or 40 years out of school. If someone doesn't keep current & is 5 years out of date on their skills, there's not a lot of difference between a 30 year old and a 60 year old that are equally 5 years out of date. Though the 60 year old might have decades more of experience working in their advantage, so maybe the two aren't equal.
  - blackrock 6y ago
    25 years ago, the hot technology was dial-up modems. And PCMCIA cards to connect to WiFi. Haven’t had much use of that lately.
- ldng 6y ago
  You have a point about ageism, but you also make quite a condescending mistake of your own. You could have say "less tech savvy" than "dumber than average". It is not because you don't master something that you did not use before that you are dumb.
- aboringusername 6y ago
  I edited the comment, you make a good point. My bias is that in my experience the elderly tends to struggle the most as it wasn't common in their day, but point duly noted.
- cosmodisk 6y ago
  Absolutely agree on this. I've seen the entire spectrum by now: kids,who literally grew up with computers in their hands, not being able to operate simple software and people way past retirement age doing complex 'magic' on their PCs
  - ethbr0 6y ago
    I'm not impressed by the digital native, current generations. I think a better descriptor would be "app-native" -- i.e. "I don't understand or care how anything computing works under the hood, and it'd better be tied off with a pretty bow and UI."
    - cosmodisk 6y ago
      This is a topic we discussed with a colleague earlier this week: everyone's smart to click some buttons on an app,which, even a monkey with some basic training could do, but anything outside their comfort zone is a foreign language to them. Just a few days ago got asked what's the url to login to Office 365. There doesn't seem to be any willingness to think.
      - boomboomsubban 6y ago
        As someone who hasn't touched Microsoft office in a decade, what's the URL for Office 365 seems like a fair question. Isn't it competing with Google? I assume they offer an in browser client, So yes, I have no idea how things I don't use work. This isn't that I'm unwilling to think, things are more open ended.
        cosmodisk 6y ago
        It's not the part whether one knows or doesn't know the url fascinates me: it's a professional setting, where people are quite used to solve problems much more complex than figuring out what's the url. For me it's the thought process: What's the url? I don't know.. error... error.. error. The equivalent of this is if I'd say to someone I've read a great article on Financial Times website,and they'd reply with: sorry, I can't read it,I don't know the url..
- klingon79 6y ago
  How about Pat? That’s ambiguous enough.
  - fortyrod 6y ago
    Or pretend you're in the southeastern US, where "Sam" and "Sue" are both non-gendered, and probably ageless, according to Mr. Cash, at least. You could also go with Courtney, Tracy, Billie, Casey, Drew...
lpriv 6y ago
Cocks are tasty

dEnigma 6y ago

It wouldn't surprise me if the pandemic had an influence on some of these hacks. E.g. at our company there are some PCs still running Windows 7. For that reason they had no direct internet access, only to the internal network. But since about half the workforce, or at times more, had to work from home, and the licenses of our ERP software are bound to hardware, IT had to connect those PCs to the internet again, so the office workers could access them from home. Of course the whole situation was less than ideal to begin with, but now it's even worse.

dboreham 6y ago
Just to point out this makes no sense: you can have connectivity between host A and host B without also enabling transitive connectivity to the world of hacker-contolled host N.
- dEnigma 6y ago
  I should also mention that it isn't in-house IT, but a separate company, and the whole thing was set up in a rushed effort late on a Friday afternoon the week before the whole working from home business would start (our management slept on it until the last minute), with a lot of other companies requesting the same support from the IT company at the same time. Not that it completely excuses everything, and as you can tell from the Windows 7 PCs it was never the most secure setup, but simply to explain some of the reasons behind the mess.
  - Kalium 6y ago
    This has all the hallmarks of an organization that views IT as a cost center rather than an enabler. Such an organization will tend to resent any spending on IT, so it's unfortunately not a surprise that it has likely scrimped and saved its way into ineffectual IT.
- ethbr0 6y ago
  I believe this is assuming companies have segmented networks and jump hosts. In my experience, most... don't. Enterprise IT at non-tech companies is an absolute #&@_ show. The only rationale I've been able to come with is: if some portion of your company isn't developing / keeping up with tech trends, your IT shop isn't going to be pressured to either.

kilroy123 6y ago

I think people just have a ton of free time these days. I know I have.

fortyrod 6y ago
Occam called, he wants his razor back :)

lefstathiou 6y ago

It’s not uncommon to test the resolve of a new administration soon after a changing of the guard.

Barrin92 6y ago

>things you’d expect to be at least somewhat secure I feel like with a lot of security or cyber-crime stuff there's a "physician who smokes" dynamic to it where the people who you expect to have great security actually often don't take a lot of precautions. How many hackers end up being exposed because of fairly trivial or random accidents is actually surprising.

guerrilla 6y ago
That reminds me that Qualys was just hacked.
- Godel_unicode 6y ago
  I wasn't surprised, I've used their product...
theMuckPot 6y ago
I've heard it said that first day beginners on a wood saw will almost never hurt themselves. Their fear of it, combined with their known ignorance of it, makes them extra cautious. Veterans of many years are the ones who get too comfortable, and too complacent. I guess the confidence of many years leads them to work a little too closely to the blade. This might be a universal human trait, across any industry.

TheRealPomax 6y ago

Sort of: since 2017 the number of CVEs have basically gone up a steady 8% per year [1], but the fact that you only noticed it this year also suggests that this alone is not why you noticed. The more likely reason you're noticing is that thanks to covid, and the accelerated death of real news services, combined with the echo chamber effect where we're all reminding each other of how bad things are, means you're getting more exposure to sensationalism, because that echos the best. And hacks certainly qualify as sensational, especially on slow news days, where news services desperately need clicks, and "X got hacked" gets those (even if it's a report on a hack that isn't actually one, like when someone walked into a data container with tens of servers, one of which happened to be rented by a password manager). The real wtf is what happened in 2017, though. [1]: https://nvd.nist.gov/vuln/search/statistics?form_type=Basic&results_type=statistics&search_type=all https://nvd.nist.gov/vuln/search/statistics?form_type=Basic&...

SavantIdiot 6y ago
I don't think major hacker sites getting hacked, or the MSE exploit from a few months ago qualifies as "sensationalism". These, especially the latter, are a Pretty Big Deal (tm). What do you consider a big news item that isn't "sensationalism"? (Your link timed-out)
- TheRealPomax 6y ago
  Something can be a pretty big deal in terms of security, and get dressed up in sensationalism by news outlets to get more clicks. They're not mutually exclusive categories. But it's the "we can get clicks by reporting more of these" that most folks notice, rather than the reporting being in lockstep with the number of hacks being perpetrated every month/week/day for the last 4 years.

the8472 6y ago

This shouldn't be necessary. Getting the SSH pubkeys of other developers is easy. Grab them from github or from a shared server or ask them once. Then use age/rage to asymmetrically encrypt the secret you want to share. No password has to travel in cleartext anywhere.

deleted 6y ago

[deleted]

mrkramer 6y ago

Pandemic has nothing to do with frequency of cyber security incidents at least not on a large scale. Every time when something global is happening spammers jump on the bandwagon and try to lure people into opening their email spam and buy something or download attachments filled with malware. This global situation is specific because a lot of people are working remotely so they easier to target and compromise then before. In the last decade or so a lot of businesses moved their presence and other ops online and lots of them practice poor cyber security that's why you see a lot of hacks happening. Speaking of big companies they are always targets of state sponsored attacks and industrial espionage.

cloudking 6y ago

Generally the only people I've seen transfer credentials securely are IT and software engineers. You can count on every other department to send passwords over plaintext channels.

threeseed 6y ago

There was a US election. And one in which many countries i.e. Russia, Israel, China, Saudi Arabia, North Korea did not want Biden to win and who have a record of state-sponsored hacking. Solarwinds and the Microsoft compromises for example are clearly at a scale beyond your regular criminal hacker.