3 ms·

The article said the default admin password wasn’t changed. Thats not security theater that’s a legit goof. Why so cynical?

zogrodea 3y ago
It does sound very much like an overreaction, from the manufacturer of these devices. "The man who made the devices said there’s little someone inside could actually do with a hacked Securebook. They’d need to fashion a USB port, be able to install another operating system, and get access to a docking station, said Jeremy Schwartz, Justice Tech president. Even when the devices are docked, they’re not connected to the wider internet. "
- oofbey 3y ago
  When a critical part of a security system is defeated, saying “that’s okay we have other layers of security so they probably can’t do much” would be IMHO pretty horrible security practice. Taking the laptops away is horrible, but from a security perspective it’s not over reacting.
  - SargeDebian 3y ago
    Assessing the balance between risk and the cost of mitigation sounds like it should be part of the basics.
- demondemidi 3y ago
  Eh, true. But then both sides of the political spectrum would have been up their asses had they just said, "relax, its no big deal." Not something you want to hear from a prison (even a not-for-profit prison).
striking 3y ago
It doesn't even help you get to the end of the exploit chain. To boot anything they still needed to tap the touchpad USB lines and attach preimaged external USB storage. It's a goof but it's not a goof worth making 1200 incarcerated people's lives harder.
- pcthrowaway 3y ago
  Why is it so bad to let prisoners have internet access or unrestricted access to a device anyway? Sure, they can commit crimes with it. But prisons obviously don't care about their charges committing crimes or they would take serious measures to prevent violence.

3 ms·

The article said the default admin password wasn’t changed. Thats not security theater that’s a legit goof. Why so cynical?

by demondemidi 3y ago

zogrodea 3y ago
It does sound very much like an overreaction, from the manufacturer of these devices. "The man who made the devices said there’s little someone inside could actually do with a hacked Securebook. They’d need to fashion a USB port, be able to install another operating system, and get access to a docking station, said Jeremy Schwartz, Justice Tech president. Even when the devices are docked, they’re not connected to the wider internet. "
- oofbey 3y ago
  When a critical part of a security system is defeated, saying “that’s okay we have other layers of security so they probably can’t do much” would be IMHO pretty horrible security practice. Taking the laptops away is horrible, but from a security perspective it’s not over reacting.
  - SargeDebian 3y ago
    Assessing the balance between risk and the cost of mitigation sounds like it should be part of the basics.
- demondemidi 3y ago
  Eh, true. But then both sides of the political spectrum would have been up their asses had they just said, "relax, its no big deal." Not something you want to hear from a prison (even a not-for-profit prison).
striking 3y ago
It doesn't even help you get to the end of the exploit chain. To boot anything they still needed to tap the touchpad USB lines and attach preimaged external USB storage. It's a goof but it's not a goof worth making 1200 incarcerated people's lives harder.
- pcthrowaway 3y ago
  Why is it so bad to let prisoners have internet access or unrestricted access to a device anyway? Sure, they can commit crimes with it. But prisons obviously don't care about their charges committing crimes or they would take serious measures to prevent violence.