8 ms·
It just makes me so uncomfortable that these things keep happening. We always find out about these things eventually but what percentage of the time are our dev
by TaylorAlexander 5y ago
It just makes me so uncomfortable that these things keep happening. We always find out about these things eventually but what percentage of the time are our devices vulnerable? Isn’t it close to 100% of the time that our desktops and mobile devices have significant security vulnerabilities?
- r00fus 5y agoInvulnerability for your devices is a chimera. You can only do what's possible in your capacity to secure yourself. I am at peace with the fact that I'm doing the best I can and keeping those I love protected.
- buddylw 5y agoSecurity has always been relative. I feel much safer knowing that an exploit like this is worth hundreds of thousands or even millions of dollars. It keeps them closely guarded and selective about use. All of that makes me an unlikely target and reduces individual risk.
- heavyset_go 5y ago> I feel much safer knowing that an exploit like this is worth hundreds of thousands or even millions of dollars. I don't. Look at how much companies like Apple pay out for responsible disclosure if they pay out at all, and then compare it to what exploits go for on the grey/black market. Typically the buyers have deep pockets and burning millions of dollars wouldn't make them blink.
- dkokelley 5y agoWhy does it matter if it’s the “good guys” or “bad guys” paying? If a vulnerability only cost ~$100 then a malicious person could compromise an ex lover’s phone, for example. The fact that they are expensive means that their use is limited to targeted, strategic attacks. You don’t have to agree that those attacks are good, but surely pricing the average person out of 0-days is better than the alternative.
- heavyset_go 5y ago> The fact that they are expensive means that their use is limited to targeted, strategic attacks. There are organized crime networks that pull in billions of dollars of revenue a year. If they wanted to pull off dragnet fraud, for example, they have the funds to do so.
- dylan604 5y ago>Why does it matter if it’s the “good guys” or “bad guys” paying? Who do you think are more likely to use the vuln/exploit on regular everyday users? The nation state people are going to use it on targeted persons/groups (typically) while the "bad guys" are going to use it so they get the greatest bang for their buck.
- Aerroon 5y agoOr the nation state uses it against everyone in a dragnet operation? Also, specifically targeted people by nation states often are "regular everyday users". They just happened to draw the ire of the wrong person.
- madeofpalk 5y agoBut still, I feel relatively safe knowing/thinking that the Saudi government doesn’t want to hack my iPhone.
- heavyset_go 5y agoOrganized crime might, as they orchestrate fraud, blackmail etc networks all over the world.
- gitanovic 5y agoIt makes me wonder how people like Bill Gates or Jeff Bezos use for their phone security. For sure they are much more interesting targets than I am, therefore burning a few 0-days might be worth the effort.
- thinkharderdev 5y agoWasn't Bezos phone hacked by the Saudis?
- gitanovic 5y agooh didn't know that
- Aerroon 5y agoThe problem is that we're moving into a more and more digital world where it's not possible to even opt out. Estonia had their ID card photo database hacked.[0] >A hacker was able to obtain over 280,000 personal identity photos following an attack on the state information system last Friday. The suspect is reportedly a resident of Tallinn. >The culprit had already obtained personal names and ID codes and was able to obtain a third component, the photos, by making individual requests from thousands of IP addresses. How do you protect yourself against that when the government requires you to have an ID card and puts you into the database? What happens when financial transaction logs get hacked or medical histories? [0] https://news.err.ee/1608291072/hacker-downloads-close-to-300-000-personal-id-photos https://news.err.ee/1608291072/hacker-downloads-close-to-300...
- SilverRed 5y agoYeah I find it worrying how society only cares about what is technically possible and not what is realistically safe and secure. We could build taller and cheaper buildings if we ignored standards and just accepted that sometimes they fall over. But we don't because that is insanely dangerous. But now with tech the risk is invisible unlike a collapsed bridge. In Australia it is basically impossible to live a normal life without bringing your phone everywhere because they mandate that you scan QR codes before entering stores and the manual written forms are usually hidden behind a counter and on request only.
- shapefrog 5y ago> Isn’t it close to 100% of the time that our desktops and mobile devices have significant security vulnerabilities? It is 100%. The sader reality is that the most likely weak link when it comes to exploiting your device is you.
- sneak 5y agoYes, but it can be somewhat mitigated by not using SMS or iMessage. Don't share the phone number of your sim with anyone for any reason whatsoever (or don't put a sim in the phone at all and use an external wifi router (this is what I do), or use a data-only sim), and ensure that iMessage and iCloud is disabled. This doesn't make your phone invulnerable, it just makes it less vulnerable.
- overkill28 5y agoThe way I describe it to friends and family is that there are basically two levels of protection: - Protecting yourself from rub of the mill malware that is looking to make money off of you. You can do this pretty effectively by always updating your software as soon as you can and avoiding sketchy and unnecessary apps and websites - Protecting yourself from an attack by a nation state level agency. I don't think there is any way to be safe from this, and people who are targeted like this need to use protection that go well beyond the choice of cell phone or chat app
- dylan604 5y agoUntil run of the mill malware learns of a vuln only thought to be known by nation states, and then all hell breaks loose.
- jonplackett 5y agoDon't know why you're getting down voted, that's literally what happened with WannaCry https://www.acronis.com/en-gb/articles/nhs-cyber-attack/ https://www.acronis.com/en-gb/articles/nhs-cyber-attack/
- jdavis703 5y ago> Protecting yourself from an attack by a nation state level agency. My personal data was hacked by a nation-state level agency. The only way I could’ve prevented that is by not working in a national security position for that country’s geopolitical rival. Now the only thing I can reasonably do is avoid ever stepping foot in that country lest they detain me for “extra questioning.”
- 8eye 5y agoyou would expect quality from a commercial product because all of the investment being put into a product but these exploits are saying otherwise. open source projects may have more investments that care on a different level. we might have to figure out a way to go in that direction eventually considering how dangerous this is getting, many people depend on the quality of a product to ensure safer communication, and with some it is a life and death situation. do yeah it’s sad that this keeps happening, it seems like we can think of a better way to not make this happen as often.
- dcsommer 5y agoFor those that are uncomfortable with this state of affairs, I recommend this presentation: "Quantifying Memory Unsafety and Reactions to It" https://www.youtube.com/watch?v=drfXNB6p6nI https://www.youtube.com/watch?v=drfXNB6p6nI
- teawrecks 5y agoIt's the same as asking, what percentage of the time is science wrong? 100% of the time, yes. We're trying to approximate correctness and the plan is to get a bit closer every day as new information becomes available.
- swiley 5y agoOne company, which likely has a retention problem, is writing all of the code for your system and setting things up so that you can’t easily use anything else. Do you think this is a recipe for secure computing?
- Gxtaillon 5y agoThat's exactly why I started scratching my head as to why the web entire security model assumes a trusted execution environment. That no longer makes sense in today's world. Naively to me it looks like it's an artifact of 90s OS security model. The modern web, and the threats of the modern world require more stringent security facilities at the OS level to allow isolation of security context even to super users and specifically per program-origin, per identity, and per-process context isolation. Super users having the ability to read-write in any security context is no longer appropriate, at most super users should only be able to deny and delete, that's the only way to protect end-user privacy.
- saagarjha 5y agoThis is largely how iOS works.
- fsflover 5y agoQubes OS [0] is based on a different security model: security through compartmentalization. [0] https://www.qubes-os.org/ https://www.qubes-os.org/
- beermonster 5y agoI can't find a link to it now, but there was a blogpost on how all other non-compartmentalization approaches to security had failed.
- fsflover 5y agohttps://www.qubes-os.org/faq/#what-about-other-approaches-to-security https://www.qubes-os.org/faq/#what-about-other-approaches-to...
- beermonster 5y agoThat’s the one! :)
- UncleMeat 5y ago
- grishka 5y agoWhy do people keep writing file format parsers in unsafe languages?
- mastax 5y agoI think it's mostly that people are continuing to use file format parsers that were written in unsafe languages in 1998. I do sometimes wonder what a "Manhattan Project" of software security would look like. I do think rewriting all common file parsers in <X> would be a very achievable project with a budget of a few dozen million dollars - nothing compared to the potential savings. The issue is then getting people to actually switch over. I think that a PR push by NIST et.al. could help convince the slowpokes that the "industry standard" has changed and they need to do something to avoid liability.
- grishka 5y agoWith kinds of resources Apple has, you could be writing a PDF parser from scratch in Rust or Swift (it is 100% memory-safe, right?) or whatever else kind of "in the background", maybe as an experimental project, and then replace the existing one with it when it's mature enough. Microsoft at least started rewriting some components of Windows in Rust. Though they aren't saying which ones.
- mastax 5y agoSure, tech companies and even just random people are already working on it piecemeal. I just think of someone with resources put a concerted effort into it we could replace all the parsers of un-trusted data in e.g. Chrome within 2 years. If a government did it then it can be justified by benefiting all of society, rather than one individual product team having to justify the effort for their own use.
- j16sdiz 5y ago1. There are public visible Swift rewrite and sanbix enhancement. 2. With the number of projects Apple has, the number of "trivial" enhancement like this add up very quickly.
- rapind 5y agoIt might be the outrage goggles, but OpenBSD is sure looking good lately. https://www.openbsd.org/security.html https://www.openbsd.org/security.html
- schleck8 5y agoUntil it becomes more mainstream; every os can be exploited if lucrative
- hulitu 5y agoAt least in Android the level of security is comparable with Win 3.11 for Workgroups. There is no access control except all or nothing. There is an OS which actively spies you.
- meibo 5y agoWhen have you last used a modern Android OS? This is just not true, it offers exactly the same kind of controls as iOS does.