4 ms·
One of the most striking things to me is this sentence: "Trustwave and other companies that get hired to investigate breaches involving card data is that far to
by hyperion2010 12y ago
One of the most striking things to me is this sentence: "Trustwave and other companies that get hired to investigate breaches involving card data is that far too many point-of-sale breaches start when the thieves abuse some kind of remote access tool installed on the point-of-sale device itself."
We have an incredibly secure and successful piece of remote access software (ssh) that is used on billions of computers and yet that sentence exists. It seems that sometimes it's not just an engineering problem.
- kijin 12y agoSSH is no better than some random Windows-based remote admin tool if the same default password is used.
- hyperion2010 12y agoAh yes of course, and the portion that I quoted didn't include this tidbit which I guess is what I was actually thinking about: “What the investigators we’ve worked with so far have been able to gather is that [the thieves] were exploiting not the pcAnywhere credentials, but a flaw in old versions of pcAnywhere,” Then again old versions of SSH are probably equally vulnerable. It would seem that there is no substitute for having a real root who has responsibility for the system, though perhaps the comment from nuxi7 is a simple way to engineer around part of the problem. Sane defaults or in this case an explicit lack of defaults could be useful.
- wglb 12y agoWell, it is better, since SSH doesn't come with a default password, and you can disable the use of passwords in SSHD.