4 ms·

I saw the show here[1]. It's beyond ridiculous. The saddest thing is how stupid they consider average Joe to be. [1] http://www.thewire.com/national/2013/12/60

by atmosx 13y ago

I saw the show here[1]. It's beyond ridiculous. The saddest thing is how stupid they consider average Joe to be. [1] http://www.thewire.com/national/2013/12/60-minutes-nsa-good-snowden-bad/356174/ http://www.thewire.com/national/2013/12/60-minutes-nsa-good-... Another question that always puzzles me... Are operating system THAT vulnerable? Every Agency, Criminal, whatever-organization has a remote 0day windows/linux/macosx exploit????

troels 13y ago
Some more than others. But I'm pretty sure that the average consumer os is vulnerable to someone with the skills. Even if the os itself isn't, there will typically be hundreds of unaudited programs running under escalated privileges. Any one of those would suffice.
- noinsight 13y ago
  I think that the situation is hopeless for joe users, if someone wants to own their computer they will. I wouldn't really even trust many IT admins to not get owned if someone actually targets them (instead of the normal random stuff everyone gets). Even if you know what you're doing, in the worst case you just need to browse to the wrong URL to get instantly owned without user interaction. I think it's hopeless for systems that are used in standard "desktop" manner, the attack surface is so large. See for example this: http://nakedsecurity.sophos.com/2013/11/03/fake-femme-fatale-dupes-it-guys-at-us-government-agency/ http://nakedsecurity.sophos.com/2013/11/03/fake-femme-fatale...
  - ds9 13y ago
    "Even if you know what you're doing, in the worst case you just need to browse to the wrong URL to get instantly owned without user interaction" You'll have to make a better case. In the exploit in your link, the user was tricked by social engineering, had his computer configured to automatically run Java applets from arbitrary sources, and in all probability was running Microsoft Windows - hardly someone practicing good security.
PeterisP 13y ago
Yes, anybody who wants definitely has remote 0days - they're available on the market, you simply buy them. Of course, they might 'expire' at any point, but there's a whole industry that's finding (or making?) new ones and selling them to be exploited, not fixed.
aestra 13y ago
Well Stuxnet (which is believed to be written by government(s)) had an unprecedented four zero-day exploits.
doktrin 13y ago
Thanks for the link. I'm pretty sure Barbara Walters has lobbed harder questions than the ones seen here on 60 minutes.

by atmosx 13y ago

troels 13y ago

Some more than others. But I'm pretty sure that the average consumer os is vulnerable to someone with the skills. Even if the os itself isn't, there will typically be hundreds of unaudited programs running under escalated privileges. Any one of those would suffice.

noinsight 13y ago
I think that the situation is hopeless for joe users, if someone wants to own their computer they will. I wouldn't really even trust many IT admins to not get owned if someone actually targets them (instead of the normal random stuff everyone gets). Even if you know what you're doing, in the worst case you just need to browse to the wrong URL to get instantly owned without user interaction. I think it's hopeless for systems that are used in standard "desktop" manner, the attack surface is so large. See for example this: http://nakedsecurity.sophos.com/2013/11/03/fake-femme-fatale-dupes-it-guys-at-us-government-agency/ http://nakedsecurity.sophos.com/2013/11/03/fake-femme-fatale...
- ds9 13y ago
  "Even if you know what you're doing, in the worst case you just need to browse to the wrong URL to get instantly owned without user interaction" You'll have to make a better case. In the exploit in your link, the user was tricked by social engineering, had his computer configured to automatically run Java applets from arbitrary sources, and in all probability was running Microsoft Windows - hardly someone practicing good security.

PeterisP 13y ago

Yes, anybody who wants definitely has remote 0days - they're available on the market, you simply buy them. Of course, they might 'expire' at any point, but there's a whole industry that's finding (or making?) new ones and selling them to be exploited, not fixed.

aestra 13y ago

Well Stuxnet (which is believed to be written by government(s)) had an unprecedented four zero-day exploits.

doktrin 13y ago

Thanks for the link. I'm pretty sure Barbara Walters has lobbed harder questions than the ones seen here on 60 minutes.