4 ms·

I hope Zhang doesn't feel too bad for accidentally setting this in motion. The fault lies entirely with the manufacture's poor security practices and the overre

by bhaney 3y ago

I hope Zhang doesn't feel too bad for accidentally setting this in motion. The fault lies entirely with the manufacture's poor security practices and the overreaction of the corrections officials, but I bet there are still going to be people pointing fingers at him saying "you shouldn't have hacked that laptop and published your findings! Now all these students lost their laptops because of you!"

lima 3y ago
There aren't even any poor security practices. It's just security theatre and the DOC is overreacting.
- demondemidi 3y ago
  The article said the default admin password wasn’t changed. Thats not security theater that’s a legit goof. Why so cynical?
  - zogrodea 3y ago
    It does sound very much like an overreaction, from the manufacturer of these devices. "The man who made the devices said there’s little someone inside could actually do with a hacked Securebook. They’d need to fashion a USB port, be able to install another operating system, and get access to a docking station, said Jeremy Schwartz, Justice Tech president. Even when the devices are docked, they’re not connected to the wider internet. "
    - oofbey 3y ago
      When a critical part of a security system is defeated, saying “that’s okay we have other layers of security so they probably can’t do much” would be IMHO pretty horrible security practice. Taking the laptops away is horrible, but from a security perspective it’s not over reacting.
      - SargeDebian 3y ago
        Assessing the balance between risk and the cost of mitigation sounds like it should be part of the basics.
    - demondemidi 3y ago
      Eh, true. But then both sides of the political spectrum would have been up their asses had they just said, "relax, its no big deal." Not something you want to hear from a prison (even a not-for-profit prison).
  - striking 3y ago
    It doesn't even help you get to the end of the exploit chain. To boot anything they still needed to tap the touchpad USB lines and attach preimaged external USB storage. It's a goof but it's not a goof worth making 1200 incarcerated people's lives harder.
    - pcthrowaway 3y ago
      Why is it so bad to let prisoners have internet access or unrestricted access to a device anyway? Sure, they can commit crimes with it. But prisons obviously don't care about their charges committing crimes or they would take serious measures to prevent violence.
- tyingq 3y ago
  The bios password is known now, and you can't change it locally. Security practices aside, it does sound like collecting them and doing an update is required.
  - aaomidi 3y ago
    This is why we have layers of security. This was one of the layers. It absolutely did not necessitate gathering up every single one at once.
    - latchkey 3y ago
      Maybe they know about more issues than just the one the researcher discovered?
- baobabKoodaa 3y ago
  The secure boot password was stored as a SHA-1 hash. The machine was designed in a way that the password effectively can not be changed. Those are poor security practices.
- oofbey 3y ago
  These devices must now all be treated as if they’re rooted. That’s a gigantic security problem. Casual analysis here says “well it would be hard to install a new OS, so it’s not a big deal.” That is a terrible security assumption. We don’t know what other changes could be done to a rooted device, but anybody with a sensible security mindset would assume something undesirable is possible. So, the outcome might be harsh, but it is NOT overreacting to promptly deal with secure devices becoming easily rooted.
scotty79 3y ago
The person who shared the password publicly might feel a bit guilty. That's something better suited for DMs
randmeerkat 3y ago
> I bet there are still going to be people pointing fingers at him saying "you shouldn't have hacked that laptop and published your findings! Now all these students lost their laptops because of you!” I wonder if they’d be in prison if they were given a free education and laptops before whatever life choices they made that sent them to prison.
- trallnag 3y ago
  >free education School?
- fakedang 3y ago
  Free education and laptops alone aren't enough for that.
  - marcosdumay 3y ago
    They are certainly enough for some people, and really far from enough for others. Knowing the shape of that distribution would be interesting.
- deleted 3y ago
  [deleted]
- deleted 3y ago
  [deleted]
- fennecbutt 3y ago
  People in most Western countries are given a free education. These people tend to be the ones that skipped out on school. And sure, some are situational but at least from my school XP people were bunking because they thought they were too cool for school™

by bhaney 3y ago

lima 3y ago

There aren't even any poor security practices. It's just security theatre and the DOC is overreacting.

demondemidi 3y ago
The article said the default admin password wasn’t changed. Thats not security theater that’s a legit goof. Why so cynical?
- zogrodea 3y ago
  It does sound very much like an overreaction, from the manufacturer of these devices. "The man who made the devices said there’s little someone inside could actually do with a hacked Securebook. They’d need to fashion a USB port, be able to install another operating system, and get access to a docking station, said Jeremy Schwartz, Justice Tech president. Even when the devices are docked, they’re not connected to the wider internet. "
  - oofbey 3y ago
    When a critical part of a security system is defeated, saying “that’s okay we have other layers of security so they probably can’t do much” would be IMHO pretty horrible security practice. Taking the laptops away is horrible, but from a security perspective it’s not over reacting.
    - SargeDebian 3y ago
      Assessing the balance between risk and the cost of mitigation sounds like it should be part of the basics.
  - demondemidi 3y ago
    Eh, true. But then both sides of the political spectrum would have been up their asses had they just said, "relax, its no big deal." Not something you want to hear from a prison (even a not-for-profit prison).
- striking 3y ago
  It doesn't even help you get to the end of the exploit chain. To boot anything they still needed to tap the touchpad USB lines and attach preimaged external USB storage. It's a goof but it's not a goof worth making 1200 incarcerated people's lives harder.
  - pcthrowaway 3y ago
    Why is it so bad to let prisoners have internet access or unrestricted access to a device anyway? Sure, they can commit crimes with it. But prisons obviously don't care about their charges committing crimes or they would take serious measures to prevent violence.
tyingq 3y ago
The bios password is known now, and you can't change it locally. Security practices aside, it does sound like collecting them and doing an update is required.
- aaomidi 3y ago
  This is why we have layers of security. This was one of the layers. It absolutely did not necessitate gathering up every single one at once.
  - latchkey 3y ago
    Maybe they know about more issues than just the one the researcher discovered?
baobabKoodaa 3y ago
The secure boot password was stored as a SHA-1 hash. The machine was designed in a way that the password effectively can not be changed. Those are poor security practices.
oofbey 3y ago
These devices must now all be treated as if they’re rooted. That’s a gigantic security problem. Casual analysis here says “well it would be hard to install a new OS, so it’s not a big deal.” That is a terrible security assumption. We don’t know what other changes could be done to a rooted device, but anybody with a sensible security mindset would assume something undesirable is possible. So, the outcome might be harsh, but it is NOT overreacting to promptly deal with secure devices becoming easily rooted.

scotty79 3y ago

The person who shared the password publicly might feel a bit guilty. That's something better suited for DMs

randmeerkat 3y ago

> I bet there are still going to be people pointing fingers at him saying "you shouldn't have hacked that laptop and published your findings! Now all these students lost their laptops because of you!” I wonder if they’d be in prison if they were given a free education and laptops before whatever life choices they made that sent them to prison.

trallnag 3y ago
>free education School?
fakedang 3y ago
Free education and laptops alone aren't enough for that.
- marcosdumay 3y ago
  They are certainly enough for some people, and really far from enough for others. Knowing the shape of that distribution would be interesting.
deleted 3y ago
[deleted]
deleted 3y ago
[deleted]
fennecbutt 3y ago
People in most Western countries are given a free education. These people tend to be the ones that skipped out on school. And sure, some are situational but at least from my school XP people were bunking because they thought they were too cool for school™