4 ms·

Ransomware wouldn't be a problem if the software industry took quality assurance seriously (or was regulated to do so), like every other engineering industry.

by jude- 5y ago

Ransomware wouldn't be a problem if the software industry took quality assurance seriously (or was regulated to do so), like every other engineering industry. There's little difference to me between an insecure program that allows hackers to hold your data for ransom, and a defective home appliance that occasionally starts electric fires.

thatguy0900 5y ago
Well every home appliance could easily start a fire if random malicious actors got to fuck with it while it was plugged in. You'll note that other engineering disciplines would also fall apart if hostile actors were constantly throwing explosives at the things they make 24/7.
- akiselev 5y ago
  Yeah but software engineers know that hostile actors come with the territory any time they expose a networked device or service. It's no different than corrosion or any number of other inevitabilities that engineers have to deal with. When's the last time a civil engineer designed a bridge without accounting for corrosion or the fact that people will be driving over it?
  - thatguy0900 5y ago
    How is wear and tear equivalent to hostile humans purposefully trying to fuck it up? Even military installations needs armed guards to stop people from just cutting through the fence. Wear and tear is more equivalent to keeping your site from going down to high traffic. Show me a road that's still safe when three guys with guns are standing in the middle of it shooting at passing drivers.
    - akiselev 5y ago
      How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them? Engineers design stuff to withstand adversaries all the time, when it's required. Designing with adversaries in mind is always required for connected systems in our field. The computer equivalent to "three guys with guns are standing in the middle of [a road] shooting at passing drivers" would be three gunmen gaining physical access to a datacenter - game over. We don't try to protect against that attack vector any more than civil engineers protect against terrorists when designing some intersection, except maybe we encrypt some data at rest and they put up some bollards and CCTV. You're getting hung up on the agency aspect when the most important thing is the attack by attrition. It doesn't matter whether it is a force of nature like corrosion or all the bad actors in human civilization, the point is that it is a known quantity that will eventually degrade and break every nontrivial system. We don't know which future zero day exploit will break our systems any more than civil engineers know which wave or car will cause the ultimate collapse, but we know that it is inevitable. That's why we have defense in depth. It is the nature of the beast. [1] https://en.wikipedia.org/wiki/33_Thomas_Street https://en.wikipedia.org/wiki/33_Thomas_Street
      - fendy3002 5y ago
        > How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them? Well if they're exists, why don't we use them for everyone on daily basis, since it'll be safer? Because they're hella expensive and resources are limited. If any smaller shops or businesses try to implement highest security for their system, their development and operation cost can multifold easily, and the ux can be reduced due to security.
    - bluGill 5y ago
      If I was regularly getting shot at while driving my car I'd take action. Bullet proof glass would be a must - sure it is expensive, but I'd pay that price. In fact if this was a regular thing the average car would be built more like a tank - armor, fun flat tires (or metal tracks), probably a scuba type air supply so I can't be gassed out... But since it isn't a regular thing I don't bother with that. My car wouldn't survive long in a real battle and I'm okay with that as I don't expect to have to drive my car in a real battle. The warning is out to everything network connected: it is time to invest in the equivalent of armor and bullet proof glass.
- throw1122 5y ago
  Things that are exposed to an adversarial environment are usually engineered with that in mind. Locks are (usually) designed to be hard to pick, for instance.
  - creato 5y ago
    I think locks are about as weak as software security, relatively speaking. The difference is that if an organized gang of criminals physically broke down the doors to a corporation and stole truckloads of computers, the law enforcement response would be significant. (And we mostly wouldn't be sitting around blaming the corporation for not hiring armed guards.)
- a1369209993 5y ago
  Home appliances are designed not to connect to or interact with the internet. Software engineers could stand to learn a thing or two from that.
g_p 5y ago
In the case of ransomware though, this really is pointing firmly at the operating system. It's not (generally) insecure programs that lead to ransomware succeeding - ransomware works so effectively (and is a force multiplier for malicious actors) specifically because it runs with normal user privileges, and isn't needing to "exploit" anything. It runs as a user, and just makes do with the access that user has to files. Before we hold application software to account (and we really do need to), we need to start with the fundamentals - operating systems need to move beyond a "software runs as the current user" model. Otherwise I don't see how we can fix this with assurance/regulation - the root issue seems to be inherent design flaws in modern GUI/desktop operating systems. The tools are there to protect yourself (binary whitelisting, applocker, santa etc.), but they are seen as more inconvenient to use than doing nothing... Hence most companies do nothing, as that's cheaper.
Bukhmanizer 5y ago
I mean I disagree completely. A lot of ransomware occurs completely incidentally to the programs. Not to mention a lot of actors getting hit with ransomware aren’t software companies. They’re governments, schools, and hospitals. Never mind taking QA seriously, these institutions don’t even take IT seriously.
nicbou 5y ago
We can do this, but it has a price the market is not willing to pay, except in rare cases.

by jude- 5y ago

thatguy0900 5y ago

Well every home appliance could easily start a fire if random malicious actors got to fuck with it while it was plugged in. You'll note that other engineering disciplines would also fall apart if hostile actors were constantly throwing explosives at the things they make 24/7.

akiselev 5y ago
Yeah but software engineers know that hostile actors come with the territory any time they expose a networked device or service. It's no different than corrosion or any number of other inevitabilities that engineers have to deal with. When's the last time a civil engineer designed a bridge without accounting for corrosion or the fact that people will be driving over it?
- thatguy0900 5y ago
  How is wear and tear equivalent to hostile humans purposefully trying to fuck it up? Even military installations needs armed guards to stop people from just cutting through the fence. Wear and tear is more equivalent to keeping your site from going down to high traffic. Show me a road that's still safe when three guys with guns are standing in the middle of it shooting at passing drivers.
  - akiselev 5y ago
    How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them? Engineers design stuff to withstand adversaries all the time, when it's required. Designing with adversaries in mind is always required for connected systems in our field. The computer equivalent to "three guys with guns are standing in the middle of [a road] shooting at passing drivers" would be three gunmen gaining physical access to a datacenter - game over. We don't try to protect against that attack vector any more than civil engineers protect against terrorists when designing some intersection, except maybe we encrypt some data at rest and they put up some bollards and CCTV. You're getting hung up on the agency aspect when the most important thing is the attack by attrition. It doesn't matter whether it is a force of nature like corrosion or all the bad actors in human civilization, the point is that it is a known quantity that will eventually degrade and break every nontrivial system. We don't know which future zero day exploit will break our systems any more than civil engineers know which wave or car will cause the ultimate collapse, but we know that it is inevitable. That's why we have defense in depth. It is the nature of the beast. [1] https://en.wikipedia.org/wiki/33_Thomas_Street https://en.wikipedia.org/wiki/33_Thomas_Street
    - fendy3002 5y ago
      > How about a skyscraper in downtown New York that can withstand a nuclear blast? [1] Or a bunch of nuclear blast shelters built all over the world? Or every fighter jet or other heavy duty piece of military equipment literally built to withstand guys shooting at them? Well if they're exists, why don't we use them for everyone on daily basis, since it'll be safer? Because they're hella expensive and resources are limited. If any smaller shops or businesses try to implement highest security for their system, their development and operation cost can multifold easily, and the ux can be reduced due to security.
  - bluGill 5y ago
    If I was regularly getting shot at while driving my car I'd take action. Bullet proof glass would be a must - sure it is expensive, but I'd pay that price. In fact if this was a regular thing the average car would be built more like a tank - armor, fun flat tires (or metal tracks), probably a scuba type air supply so I can't be gassed out... But since it isn't a regular thing I don't bother with that. My car wouldn't survive long in a real battle and I'm okay with that as I don't expect to have to drive my car in a real battle. The warning is out to everything network connected: it is time to invest in the equivalent of armor and bullet proof glass.
throw1122 5y ago
Things that are exposed to an adversarial environment are usually engineered with that in mind. Locks are (usually) designed to be hard to pick, for instance.
- creato 5y ago
  I think locks are about as weak as software security, relatively speaking. The difference is that if an organized gang of criminals physically broke down the doors to a corporation and stole truckloads of computers, the law enforcement response would be significant. (And we mostly wouldn't be sitting around blaming the corporation for not hiring armed guards.)
a1369209993 5y ago
Home appliances are designed not to connect to or interact with the internet. Software engineers could stand to learn a thing or two from that.

g_p 5y ago

In the case of ransomware though, this really is pointing firmly at the operating system. It's not (generally) insecure programs that lead to ransomware succeeding - ransomware works so effectively (and is a force multiplier for malicious actors) specifically because it runs with normal user privileges, and isn't needing to "exploit" anything. It runs as a user, and just makes do with the access that user has to files. Before we hold application software to account (and we really do need to), we need to start with the fundamentals - operating systems need to move beyond a "software runs as the current user" model. Otherwise I don't see how we can fix this with assurance/regulation - the root issue seems to be inherent design flaws in modern GUI/desktop operating systems. The tools are there to protect yourself (binary whitelisting, applocker, santa etc.), but they are seen as more inconvenient to use than doing nothing... Hence most companies do nothing, as that's cheaper.

Bukhmanizer 5y ago

I mean I disagree completely. A lot of ransomware occurs completely incidentally to the programs. Not to mention a lot of actors getting hit with ransomware aren’t software companies. They’re governments, schools, and hospitals. Never mind taking QA seriously, these institutions don’t even take IT seriously.

nicbou 5y ago

We can do this, but it has a price the market is not willing to pay, except in rare cases.