5 ms·

"Back in 2008, a Russian cosmonaut managed to take a laptop to the ISS that spread the W32.Gammima.AG worm to all the other laptops aboard the station." Holy c

"Back in 2008, a Russian cosmonaut managed to take a laptop to the ISS that spread the W32.Gammima.AG worm to all the other laptops aboard the station." Holy crap.

winter_blue 13y ago
Why is it always the Russians or Chinese? Why isn't there a American or Western European scientist/cosmonaut committing similar mistakes/blunders?
- lkozma 13y ago
  Because you are reading American/Western European news.
- thejosh 13y ago
  That you hear of anyway.
- slacka 13y ago
  I don't know about Russian, but when I lived in China, I discovered that the Chinese expect PCs to have malware. From my tailor to our factories, every machine I used was infected. Opening a new web page on someone else’s PC always started a game of wack-a-mole to close all the popups. Even the pirated XP CDs they'd sell everywhere came with malware pre-installed.
- a1a 13y ago
  Before assuming they are the ones "always committing mistakes/blunders" please provide source or at least some examples. You are making use of the logical fallacy "Complex Question Fallacy" - http://www.logicalfallacies.info/presumption/complex-question/ http://www.logicalfallacies.info/presumption/complex-questio... - and I do not approve.
  - rbanffy 13y ago
    I don't think winter_blue meant what you think he/she meant. The question is why we hear these stories more often than american-made blunders. Which I am not even very sure we do.
- ghshephard 13y ago
  Different cultures, different attitudes towards these things. I was recently in Aschaffenburg (Germany) doing interoperability tests with some of our networking equipment and a large SCADA vendor. About two hours into the tests, we ran into some problems, which we quickly identified as being related to the firewall on one of the test laptops in their lab having a very restrictive firewall rule (wouldn't allow ping). We had to wait for the better part of two hours while they got approval to adjust the firewall rules to allow ping from another device in the same lab. Note that this was a lab laptop, and these were technically sophisticated people - they understood the implication of allowing ping - it's just that their policy/procedures with regards to security were very, very strict. I can guarantee you, in any interop tests I've done in Silicon Valley - there would be zero friction (even with the utility companies, enterprise software vendors, scada vendors) around opening up icmp on a lab laptop firewall. I cite this as an example where Americans (at least those in Norcal) are more lax regarding security than another culture (in this case, whatever was prevalent in the part of Germany Aschaffenburg is located in)
  - kmasters 13y ago
    You can guarantee that? I dont think so, Im not a sysop but if I was, you would need to explain why ICMP needs to be open. Whether Im in Norcal or not. Most sane organizations are going to turn off ping, its not a cultural thing and it doesnt seem like you faced any friction since you got it opened in 2 hours. Ive been working here in norcal my whole life and I dont see a culture of lax security in shops that have actual security requirements. Its not the country is the quality of the network administration team.
    - ghshephard 13y ago
      I've been a network engineer for 15+ years, and I'm saying that 95% of all employees I deal with in the Bay Area would not think twice about opening up a firewall rule and allowing you to ping a lab machine, particularly when the purpose of your engagement was to verify end-end network connectivity. They would make the call, themselves, on the spot. The reason I bring this up, is that I've been told by a number of my colleagues that german culture, in particular, has a tendency to be more rule structured than in the United States, so, if there was a security policy in place, it had a greater chance of being adhered to in Germany, than in the Norcal. And the entire point of my little anecdote was to make it clear, that there is broad diversity of attitudes towards rules, policy - and that the "United States" doesn't have a lock on following rules/policy.
- dimitar 13y ago
  Because people from poorer countries like these use their employers computers to download movies, games and music from p2p networks. The Westerners have more disposable income so they a) use their own computers for entertainment and b) buy stuff from amazon and itunes instead of searching for warez. So its about income and culture. Company cars are also viewed as a perk and its not unusual to take a company car for a picnic. Employers are usually fine with this - it improves morale and is less costly than actually paying more.
  - malloc2x 13y ago
    An interesting idea. s|movies, games, music|games/software| and it might be more plausible. (.mkv, .mp3 or even the .rmvb that's weirdly popular in China are hardly common attack vectors.) However, if we're talking about China, and the demographic of employees that get sent for international matters, then we're definitely not talking about people that can't afford their own computers. I would posit this holds for nearly any country (except North Korea?) Taking your argument as just "a culture of grabbing untrustworthy software from anywhere is the reason", it becomes more persuasive to me.
- fakeer 13y ago
  You read the book just like the publisher published and finally press guy printed it.
Maarten88 13y ago
It is probably a wise move for them to move to Linux, having many other systems running Linux too. But Windows security is a poor argument imo. If they had upgraded to Vista in 2008 (which was working quite well by then), or had better managed those laptops, that incident would not have happened. Now, five years later, they still have not upgraded to a modern Windows version. After so many years, anything is going to be more secure than XP. Nowadays, you have to patch and update to have a secure system. Freezing the software to guarantee stability makes it inherently unsecure, Windows or Linux. There is no difference other than the larger base of existing virusses for Windows. Also I wonder what this means for power usage, which is not unimportant in space. Windows still gets longer use out of most laptop batteries than Linux.
- exDM69 13y ago
  > If they had upgraded to Vista in 2008 .... Keeping your Windows up-to-date might require updating (some of) your hardware too. And hardware updates are expensive if they have to be delivered to low earth orbit.
  - johnminter 13y ago
    Yes. We have lab PCs here still running Windows NT because the upgrades for the hardware are either unavailable or would be prohibitively expensive (> $20K) and still not implement all the functionality. We tend to hide these from our well-protected corporate network behing a boat-anchor PC running XP with all the service packs and antivirus. We will run these systems until they can no longer be repaired because management does not want to spend the money to replace them.
- rbanffy 13y ago
  > If they had upgraded to Vista in 2008 For that, they'd probably have to certify that all their software and flight-certified hardware functions correctly with Vista. They'd have to start certifying them for Longhorn in 2003.
  - Someone 13y ago

"Back in 2008, a Russian cosmonaut managed to take a laptop to the ISS that spread the W32.Gammima.AG worm to all the other laptops aboard the station." Holy crap.

winter_blue 13y ago

Why is it always the Russians or Chinese? Why isn't there a American or Western European scientist/cosmonaut committing similar mistakes/blunders?

lkozma 13y ago
Because you are reading American/Western European news.
thejosh 13y ago
That you hear of anyway.
slacka 13y ago
I don't know about Russian, but when I lived in China, I discovered that the Chinese expect PCs to have malware. From my tailor to our factories, every machine I used was infected. Opening a new web page on someone else’s PC always started a game of wack-a-mole to close all the popups. Even the pirated XP CDs they'd sell everywhere came with malware pre-installed.
a1a 13y ago
Before assuming they are the ones "always committing mistakes/blunders" please provide source or at least some examples. You are making use of the logical fallacy "Complex Question Fallacy" - http://www.logicalfallacies.info/presumption/complex-question/ http://www.logicalfallacies.info/presumption/complex-questio... - and I do not approve.
- rbanffy 13y ago
  I don't think winter_blue meant what you think he/she meant. The question is why we hear these stories more often than american-made blunders. Which I am not even very sure we do.
ghshephard 13y ago
Different cultures, different attitudes towards these things. I was recently in Aschaffenburg (Germany) doing interoperability tests with some of our networking equipment and a large SCADA vendor. About two hours into the tests, we ran into some problems, which we quickly identified as being related to the firewall on one of the test laptops in their lab having a very restrictive firewall rule (wouldn't allow ping). We had to wait for the better part of two hours while they got approval to adjust the firewall rules to allow ping from another device in the same lab. Note that this was a lab laptop, and these were technically sophisticated people - they understood the implication of allowing ping - it's just that their policy/procedures with regards to security were very, very strict. I can guarantee you, in any interop tests I've done in Silicon Valley - there would be zero friction (even with the utility companies, enterprise software vendors, scada vendors) around opening up icmp on a lab laptop firewall. I cite this as an example where Americans (at least those in Norcal) are more lax regarding security than another culture (in this case, whatever was prevalent in the part of Germany Aschaffenburg is located in)
- kmasters 13y ago
  You can guarantee that? I dont think so, Im not a sysop but if I was, you would need to explain why ICMP needs to be open. Whether Im in Norcal or not. Most sane organizations are going to turn off ping, its not a cultural thing and it doesnt seem like you faced any friction since you got it opened in 2 hours. Ive been working here in norcal my whole life and I dont see a culture of lax security in shops that have actual security requirements. Its not the country is the quality of the network administration team.
  - ghshephard 13y ago
    I've been a network engineer for 15+ years, and I'm saying that 95% of all employees I deal with in the Bay Area would not think twice about opening up a firewall rule and allowing you to ping a lab machine, particularly when the purpose of your engagement was to verify end-end network connectivity. They would make the call, themselves, on the spot. The reason I bring this up, is that I've been told by a number of my colleagues that german culture, in particular, has a tendency to be more rule structured than in the United States, so, if there was a security policy in place, it had a greater chance of being adhered to in Germany, than in the Norcal. And the entire point of my little anecdote was to make it clear, that there is broad diversity of attitudes towards rules, policy - and that the "United States" doesn't have a lock on following rules/policy.
dimitar 13y ago
Because people from poorer countries like these use their employers computers to download movies, games and music from p2p networks. The Westerners have more disposable income so they a) use their own computers for entertainment and b) buy stuff from amazon and itunes instead of searching for warez. So its about income and culture. Company cars are also viewed as a perk and its not unusual to take a company car for a picnic. Employers are usually fine with this - it improves morale and is less costly than actually paying more.
- malloc2x 13y ago
  An interesting idea. s|movies, games, music|games/software| and it might be more plausible. (.mkv, .mp3 or even the .rmvb that's weirdly popular in China are hardly common attack vectors.) However, if we're talking about China, and the demographic of employees that get sent for international matters, then we're definitely not talking about people that can't afford their own computers. I would posit this holds for nearly any country (except North Korea?) Taking your argument as just "a culture of grabbing untrustworthy software from anywhere is the reason", it becomes more persuasive to me.
fakeer 13y ago
You read the book just like the publisher published and finally press guy printed it.

Maarten88 13y ago

It is probably a wise move for them to move to Linux, having many other systems running Linux too. But Windows security is a poor argument imo. If they had upgraded to Vista in 2008 (which was working quite well by then), or had better managed those laptops, that incident would not have happened. Now, five years later, they still have not upgraded to a modern Windows version. After so many years, anything is going to be more secure than XP. Nowadays, you have to patch and update to have a secure system. Freezing the software to guarantee stability makes it inherently unsecure, Windows or Linux. There is no difference other than the larger base of existing virusses for Windows. Also I wonder what this means for power usage, which is not unimportant in space. Windows still gets longer use out of most laptop batteries than Linux.

exDM69 13y ago
> If they had upgraded to Vista in 2008 .... Keeping your Windows up-to-date might require updating (some of) your hardware too. And hardware updates are expensive if they have to be delivered to low earth orbit.
- johnminter 13y ago
  Yes. We have lab PCs here still running Windows NT because the upgrades for the hardware are either unavailable or would be prohibitively expensive (> $20K) and still not implement all the functionality. We tend to hide these from our well-protected corporate network behing a boat-anchor PC running XP with all the service packs and antivirus. We will run these systems until they can no longer be repaired because management does not want to spend the money to replace them.
rbanffy 13y ago
> If they had upgraded to Vista in 2008 For that, they'd probably have to certify that all their software and flight-certified hardware functions correctly with Vista. They'd have to start certifying them for Longhorn in 2003.
- Someone 13y ago