6 ms·

We can't get chips in anything resembling reasonable quantity. Computer security is a joke. The hardware and software is too complex to analyze, too complex t

by Syonyk 5y ago

We can't get chips in anything resembling reasonable quantity. Computer security is a joke. The hardware and software is too complex to analyze, too complex to reason about, too complex to secure even if you could. All you can do now is wait for either attackers or researchers to find a hole, patch it, and hope the patch works (see "Windows Print Spooler" for how that sometimes doesn't work). And the concept of "Hey, maybe we can do things without x86 processors running Windows" is never discussed. Do train networks actually need full on Windows workstations, or can they work on things like microcontrollers? The conversation isn't even being had. But we've got problems from complexity created to solve the problems from the previous wave of complexity, running on top of complex hardware that's trying desperately to be fast enough to run the ever-more-complex software that... largely does about the same things we did 20 years ago, just far less efficiently. I don't see a good path forward here. :/

matthewmorgan 5y ago
Doesn't this same complexity prevent an all-consuming virus?
- Syonyk 5y ago
  It doesn't seem to be. Simpler, more straightforward systems to reason about (both hardware and software) are easier to secure.
- meowface 5y ago
  Makes it take more effort; but, no, definitely doesn't prevent it.
- askvictor 5y ago
  I would have thought that a diversity of systems/OSes would prevent an all-consuming virus (much like in the biological world)
  - VortexDream 5y ago
    As soon as a system becomes a target, it doesn't matter if it's an entirely bespoke system that only runs on Iranian trains. You might avoid being accidentally targeted by automated exploits, but that doesn't mean your system is secure or secure enough to avoid something like this.
    - Syonyk 5y ago
      That depends heavily on your threat model and who is out to bother you. I agree that you can't make something custom totally secure - but you can radically reduce the number of people capable of attacking it, and increase the costs of attacking it. If you're running Windows with Active Directory, the number of people who can attack your network at some level is "Pretty much anyone who cares to learn a bit about hacking." They may not be successful, but if they happen to get lucky around the time some new 0day drops, welp. Timmy Two Thumbs just pwned you. The more custom your environment in terms of hardware and software, the higher the development costs, certainly, but also the fewer people who can attack you. If you've got a custom limited function OS, no generic hacking tools are going to work on it, so now your attacker scope is things like "Governments who can get a copy of it and are willing to invest the money to reverse engineer it and find vulnerabilities." Which, if you're worried about governments, is certainly a risk - but at that point, the chances of some random ransomware gang taking you down are near-zero, because they don't care about you - they care about easy targets who are likely to pay. Custom reverse engineering isn't really their thing. There's no such thing as a system secure against everyone - but you can make it a lot harder to randomly target. And, if you're talking about a train system, there comes some point when it's easier to just go blow up the locomotives than to wage a cyber attack. Easier to trace, certainly, and riskier, but that's the point. If you can force an attacker to either expend disproportionate resources, or require them to go down riskier attack paths, you may be able to deter the attack. You can also ask some reasonable questions about the concept of field upgradeable firmware on critical safety systems. There was some set of malware a while back that targeted some sort of industrial control system, and seemed designed to bypass the safety release valves through a remote firmware update. If you have a safety valve set to pop at 300 psig, why does that need remote firmware updates? It should be set to monitor the pressure sensor, pop the valve and report at 300psig. Allowing someone on the network to remotely update the firmware on the safety system seems entirely silly, because presumably if you actually needed to do that, you'd have been doing some piping upgrades that would make it easy enough to go get the unit, physically touch it to twiddle the write lock, and upgrade it.
- walterlb 5y ago
  I'm not sure what 'all consuming' would mean exactly. But excess complexity might also indicate fragility, in which case breaking an entire system/subsystem might come fairly easily
samstave 5y ago
I recommend the movie "The Operative" -- its a good movie about the Mossad specifically infiltrating an Iranian electronic companies networks, selling them compromised chips, and enforcing the chip sanctions against Iran. It does not have a "political message" -- its just a good spy movie.
morpheos137 5y ago
Hey if things ran efficiently and unecessary complexity was taboo then software developers, who manufacture a good that does not physically wear out with time, would be earning a lot less money. But as things are today you got to pay a web developer say $100k a year to implement the latest kalefedhipster.js framework that doesn't actually provide significant additional functionality beyond what we had in 2015 if not 2005. I firmly believe that overgrown complexity is going to be one of the things that brings down the tech sphere if not civilization as a whole. It seems things are breaking far more frequently already. Even things like retail transactions are falling appart. Whereas 10-15 years ago you could go into walmart and grab something check out within 5 minutes. Now you can't. Of the twenty lanes only 4-5 are open at anytime. If you buy a refillable phone card the cashier does not know how to recharge it. If you try self checkout all 10 systems are rebooting after an upgrade. You insert your poorly engineered sim inspired "chip card." It fails three times, every time then you swipe. Meanwhile if you go on vacation 150 miles away and use your card, you card automatically locks because of a "suspcious transaction." Since it is Sunday your bank is not open but you can call tech support in India who after having you wait on hold for an hour transfers you to a different agent who you have to repeat the whole story to. Etc, etc, etc. It seems like simple things are getting more complicated every year, because new is good or new is safer or new is easier to track you with.
- 101008 5y ago
  > to implement the latest kalefedhipster.js framework that doesn't actually provide significant additional functionality beyond what we had in 2015 if not 2005. Amen. How I miss old plain HTML websites.
  - jrockway 5y ago
    I mean, if we only had plain old HTML for websites, all these people writing web applications would just be writing desktop applications. The complexity of the problems being solved wouldn't change, and it would basically be the same hell of large projects being done by large teams with little in the way of planning. The main difference would be that nothing would run on OS X or Linux, because it would be too costly to support. Microsoft would have 99.9% of the OS market, and it would cost $300 a month to have a license. (Remember when you couldn't do online banking on Linux because they all used ActiveX? I remember.) Basically, the field of software engineering wouldn't be any different. There would be different winners and we probably wouldn't have phones. But you'd still be using slow, confusing, crappy UIs, because that is the human condition. The programming language / platform wouldn't change any of that.
m4rtink 5y ago
IoT devices effectively run on microcontrollers and their security is usually even worse than PC class hardware/software. :P
- Syonyk 5y ago
  Not really. They run small embedded processors, but most IoT hardware is running a full Linux, for the sake of pushing a bit of data to some cloud server, and receiving responses. Just because you can do it in Python running with a full Linux stack behind things doesn't mean you should. A lot of that sort of stuff can be done with a far smaller microcontroller, preferably Harvard architecture, with a memory safe language - I'm not exceedingly familiar with it, but Rust shows a lot of promise for this type of work. Very, very limited functionality, and the minimum amount of hardware/software to make it work. Aggressive code reviews, fuzzing, etc, before deployment. It's literally the opposite of how most "things" are deployed, but it reduces the attack surface rather significantly. It does make updates harder, depending on how one implements it, but if it's properly done in the first place, this isn't a big problem. I absolutely despise the "Ship first, correct it later!" approach to software that has taken over literally everything these days. Yes. Great. Tesla was able to OTA update the brake controller for the Consumer Reports Model 3 and fix the braking - and nobody gets around to asking how on earth they shipped a near-production car to a review agency with broken brake control firmware in the first place. That's the sort of thing that should be tested, correct, and immutable after shipping. I'm not comfortable with trusting Silicon Valley companies to properly OTA update the brake firmware on my car, I'd rather it ship with working brakes that remain unchanged for the life of the vehicle. I'm aware this is totally at odds with the modern software ecosystems, and that's entirely deliberate. I do not like what modern software has become.
  - d110af5ccf 5y ago
    To be fair, there's some nuance to be had here. OTA updates for cell phone firmware probably make a fair amount of sense. A mobile game shipping quickly and fixing things up later is likely financially favorable and it's not as though I can't find something else to do with my time if the devs inadvertently break it. OTA updates for brake control firmware, however, is an absolutely terrifying reality that should probably be made outright illegal in the first place. It creates a centralized attack vector of alarming scope that would never have existed otherwise. I get it, there's a CAN bus and diagnostics and now it's all hooked up to the mobile network for data collection and analysis purposes. That doesn't justify any of the essential systems attached to the bus being able to receive data though. Outside of direct physical access (ie plugging in a cable), safety critical systems should be broadcast only unless an incredibly compelling reason exists to do otherwise.
alephnan 5y ago
> the concept of "Hey, maybe we can do things without x86 processors running Windows" is never discussed M1 running Mac OS X.
- jfrunyon 5y ago
  Has a similar attack surface to Windows on x86 with less attention on it.
mark_l_watson 5y ago
You make good points. A reasonable path forward would be developing single purpose devices, with software written in safe languages like Rust and Swift (and OCaml, Haskell, etc. ?) Simpler processors, simpler designs, secure small operating systems. Before the 9/11 wrong turn our government made, the NSA did a lot of public good work hardening Linux, worked with the FBI to go after international digital crime syndicates, etc. We lost our way, and we need to find it again. To do all this we need to start with the educational system, making secure computing a big thing in the job market, so upstream, professors do the right research, and train students.
7373737373 5y ago
It's all economics Insurance is cheaper than security Reuse is cheaper than research and development

by Syonyk 5y ago

matthewmorgan 5y ago

Doesn't this same complexity prevent an all-consuming virus?

Syonyk 5y ago
It doesn't seem to be. Simpler, more straightforward systems to reason about (both hardware and software) are easier to secure.
meowface 5y ago
Makes it take more effort; but, no, definitely doesn't prevent it.
askvictor 5y ago
I would have thought that a diversity of systems/OSes would prevent an all-consuming virus (much like in the biological world)
- VortexDream 5y ago
  As soon as a system becomes a target, it doesn't matter if it's an entirely bespoke system that only runs on Iranian trains. You might avoid being accidentally targeted by automated exploits, but that doesn't mean your system is secure or secure enough to avoid something like this.
  - Syonyk 5y ago
    That depends heavily on your threat model and who is out to bother you. I agree that you can't make something custom totally secure - but you can radically reduce the number of people capable of attacking it, and increase the costs of attacking it. If you're running Windows with Active Directory, the number of people who can attack your network at some level is "Pretty much anyone who cares to learn a bit about hacking." They may not be successful, but if they happen to get lucky around the time some new 0day drops, welp. Timmy Two Thumbs just pwned you. The more custom your environment in terms of hardware and software, the higher the development costs, certainly, but also the fewer people who can attack you. If you've got a custom limited function OS, no generic hacking tools are going to work on it, so now your attacker scope is things like "Governments who can get a copy of it and are willing to invest the money to reverse engineer it and find vulnerabilities." Which, if you're worried about governments, is certainly a risk - but at that point, the chances of some random ransomware gang taking you down are near-zero, because they don't care about you - they care about easy targets who are likely to pay. Custom reverse engineering isn't really their thing. There's no such thing as a system secure against everyone - but you can make it a lot harder to randomly target. And, if you're talking about a train system, there comes some point when it's easier to just go blow up the locomotives than to wage a cyber attack. Easier to trace, certainly, and riskier, but that's the point. If you can force an attacker to either expend disproportionate resources, or require them to go down riskier attack paths, you may be able to deter the attack. You can also ask some reasonable questions about the concept of field upgradeable firmware on critical safety systems. There was some set of malware a while back that targeted some sort of industrial control system, and seemed designed to bypass the safety release valves through a remote firmware update. If you have a safety valve set to pop at 300 psig, why does that need remote firmware updates? It should be set to monitor the pressure sensor, pop the valve and report at 300psig. Allowing someone on the network to remotely update the firmware on the safety system seems entirely silly, because presumably if you actually needed to do that, you'd have been doing some piping upgrades that would make it easy enough to go get the unit, physically touch it to twiddle the write lock, and upgrade it.
walterlb 5y ago
I'm not sure what 'all consuming' would mean exactly. But excess complexity might also indicate fragility, in which case breaking an entire system/subsystem might come fairly easily

samstave 5y ago

I recommend the movie "The Operative" -- its a good movie about the Mossad specifically infiltrating an Iranian electronic companies networks, selling them compromised chips, and enforcing the chip sanctions against Iran. It does not have a "political message" -- its just a good spy movie.

morpheos137 5y ago

Hey if things ran efficiently and unecessary complexity was taboo then software developers, who manufacture a good that does not physically wear out with time, would be earning a lot less money. But as things are today you got to pay a web developer say $100k a year to implement the latest kalefedhipster.js framework that doesn't actually provide significant additional functionality beyond what we had in 2015 if not 2005. I firmly believe that overgrown complexity is going to be one of the things that brings down the tech sphere if not civilization as a whole. It seems things are breaking far more frequently already. Even things like retail transactions are falling appart. Whereas 10-15 years ago you could go into walmart and grab something check out within 5 minutes. Now you can't. Of the twenty lanes only 4-5 are open at anytime. If you buy a refillable phone card the cashier does not know how to recharge it. If you try self checkout all 10 systems are rebooting after an upgrade. You insert your poorly engineered sim inspired "chip card." It fails three times, every time then you swipe. Meanwhile if you go on vacation 150 miles away and use your card, you card automatically locks because of a "suspcious transaction." Since it is Sunday your bank is not open but you can call tech support in India who after having you wait on hold for an hour transfers you to a different agent who you have to repeat the whole story to. Etc, etc, etc. It seems like simple things are getting more complicated every year, because new is good or new is safer or new is easier to track you with.

101008 5y ago
> to implement the latest kalefedhipster.js framework that doesn't actually provide significant additional functionality beyond what we had in 2015 if not 2005. Amen. How I miss old plain HTML websites.
- jrockway 5y ago
  I mean, if we only had plain old HTML for websites, all these people writing web applications would just be writing desktop applications. The complexity of the problems being solved wouldn't change, and it would basically be the same hell of large projects being done by large teams with little in the way of planning. The main difference would be that nothing would run on OS X or Linux, because it would be too costly to support. Microsoft would have 99.9% of the OS market, and it would cost $300 a month to have a license. (Remember when you couldn't do online banking on Linux because they all used ActiveX? I remember.) Basically, the field of software engineering wouldn't be any different. There would be different winners and we probably wouldn't have phones. But you'd still be using slow, confusing, crappy UIs, because that is the human condition. The programming language / platform wouldn't change any of that.

m4rtink 5y ago

IoT devices effectively run on microcontrollers and their security is usually even worse than PC class hardware/software. :P

Syonyk 5y ago
Not really. They run small embedded processors, but most IoT hardware is running a full Linux, for the sake of pushing a bit of data to some cloud server, and receiving responses. Just because you can do it in Python running with a full Linux stack behind things doesn't mean you should. A lot of that sort of stuff can be done with a far smaller microcontroller, preferably Harvard architecture, with a memory safe language - I'm not exceedingly familiar with it, but Rust shows a lot of promise for this type of work. Very, very limited functionality, and the minimum amount of hardware/software to make it work. Aggressive code reviews, fuzzing, etc, before deployment. It's literally the opposite of how most "things" are deployed, but it reduces the attack surface rather significantly. It does make updates harder, depending on how one implements it, but if it's properly done in the first place, this isn't a big problem. I absolutely despise the "Ship first, correct it later!" approach to software that has taken over literally everything these days. Yes. Great. Tesla was able to OTA update the brake controller for the Consumer Reports Model 3 and fix the braking - and nobody gets around to asking how on earth they shipped a near-production car to a review agency with broken brake control firmware in the first place. That's the sort of thing that should be tested, correct, and immutable after shipping. I'm not comfortable with trusting Silicon Valley companies to properly OTA update the brake firmware on my car, I'd rather it ship with working brakes that remain unchanged for the life of the vehicle. I'm aware this is totally at odds with the modern software ecosystems, and that's entirely deliberate. I do not like what modern software has become.
- d110af5ccf 5y ago
  To be fair, there's some nuance to be had here. OTA updates for cell phone firmware probably make a fair amount of sense. A mobile game shipping quickly and fixing things up later is likely financially favorable and it's not as though I can't find something else to do with my time if the devs inadvertently break it. OTA updates for brake control firmware, however, is an absolutely terrifying reality that should probably be made outright illegal in the first place. It creates a centralized attack vector of alarming scope that would never have existed otherwise. I get it, there's a CAN bus and diagnostics and now it's all hooked up to the mobile network for data collection and analysis purposes. That doesn't justify any of the essential systems attached to the bus being able to receive data though. Outside of direct physical access (ie plugging in a cable), safety critical systems should be broadcast only unless an incredibly compelling reason exists to do otherwise.

alephnan 5y ago

> the concept of "Hey, maybe we can do things without x86 processors running Windows" is never discussed M1 running Mac OS X.

jfrunyon 5y ago
Has a similar attack surface to Windows on x86 with less attention on it.

mark_l_watson 5y ago

You make good points. A reasonable path forward would be developing single purpose devices, with software written in safe languages like Rust and Swift (and OCaml, Haskell, etc. ?) Simpler processors, simpler designs, secure small operating systems. Before the 9/11 wrong turn our government made, the NSA did a lot of public good work hardening Linux, worked with the FBI to go after international digital crime syndicates, etc. We lost our way, and we need to find it again. To do all this we need to start with the educational system, making secure computing a big thing in the job market, so upstream, professors do the right research, and train students.

7373737373 5y ago

It's all economics Insurance is cheaper than security Reuse is cheaper than research and development