Live data from Hacker News

TalkTalk cyber-attack: boy, 15, arrested in Northern Ireland

theguardian.com

31–40 of 51 posts

Re: TalkTalk cyber-attack: boy, 15, arrested in Northern Ireland

#31

Earlier quoted context omitted.

So you're still writing code in Delphi or maybe Zortech C++ ?

try Reddit. Your (zero insight) posts are not constructive here.

I think his point was you don't to be "entrenched" in an old stack.

How "nimble" your mind is really isn't important, and surely you don't think that a 15 year old can be more competent than you in a given stack.

It's just that you're not exposing yourself to the new stacks.

Re: TalkTalk cyber-attack: boy, 15, arrested in Northern Ireland

#32
post #28

Man, I have some real cognitive dissonance when it comes to physical versus cyber crimes. If someone were to leave their car unlocked then have items stolen out of it, I would find the criminal despicable; people make mistakes and don't deserve to be robbed for it. When a company leaves its data vulnerable and someone steals from it, I find the company despicable, as if they were "asking for it". Apparently the hacke…

There are two crimes. One is theft, the other negligence.

Re: TalkTalk cyber-attack: boy, 15, arrested in Northern Ireland

#33
post #28

Man, I have some real cognitive dissonance when it comes to physical versus cyber crimes. If someone were to leave their car unlocked then have items stolen out of it, I would find the criminal despicable; people make mistakes and don't deserve to be robbed for it. When a company leaves its data vulnerable and someone steals from it, I find the company despicable, as if they were "asking for it". Apparently the hacke…

[deleted]

Re: TalkTalk cyber-attack: boy, 15, arrested in Northern Ireland

#34
post #28

Man, I have some real cognitive dissonance when it comes to physical versus cyber crimes. If someone were to leave their car unlocked then have items stolen out of it, I would find the criminal despicable; people make mistakes and don't deserve to be robbed for it. When a company leaves its data vulnerable and someone steals from it, I find the company despicable, as if they were "asking for it". Apparently the hacke…

[deleted]

Re: TalkTalk cyber-attack: boy, 15, arrested in Northern Ireland

#35
post #28

Man, I have some real cognitive dissonance when it comes to physical versus cyber crimes. If someone were to leave their car unlocked then have items stolen out of it, I would find the criminal despicable; people make mistakes and don't deserve to be robbed for it. When a company leaves its data vulnerable and someone steals from it, I find the company despicable, as if they were "asking for it". Apparently the hacke…

For me, it's not a question of physical vs cyber, it's securing your own vs securing other's stuff.

If I paid for a car parking service that had the practice (not a one time incident) of leaving all their clients' cars unlocked, I'd definitively find them despicable.

While at the same time, if someone was hosting their own little personal server and forgot to apply a security patch and someone hacked it and used it for spam or as a botnet, I'd find the attacker despicable.

Re: TalkTalk cyber-attack: boy, 15, arrested in Northern Ireland

#36

Earlier quoted context omitted.

So you're still writing code in Delphi or maybe Zortech C++ ?

try Reddit. Your (zero insight) posts are not constructive here.

If it was my job to penetrate remote systems, you can bet that I wouldn't still be using the same stack and MO I was 30 years ago, in the just the same way that I'm not using an Amiga.

The OP is ridiculous that it cannot be imagined that someone needs to be a child to break into systems.

I'm at University and I run rings around my 20 something cohort.

Re: TalkTalk cyber-attack: boy, 15, arrested in Northern Ireland

#37
post #28

Man, I have some real cognitive dissonance when it comes to physical versus cyber crimes. If someone were to leave their car unlocked then have items stolen out of it, I would find the criminal despicable; people make mistakes and don't deserve to be robbed for it. When a company leaves its data vulnerable and someone steals from it, I find the company despicable, as if they were "asking for it". Apparently the hacke…

Your comparison is not analogous. It should be; a car owner that left the car unlocked with a bunch of private information inside.

I hadn't considered that angle before. That helps me reconcile it – imagine it's health records left more or less unattended.

Re: TalkTalk cyber-attack: boy, 15, arrested in Northern Ireland

#38

Earlier quoted context omitted.

Going by Kreb's analysis of the attack [1] it would appear that the breach was a run-of-the-mill SQL Injection attack. Proper security 1-0-1 stuff. [1] http://krebsonsecurity.com/2015/10/talktalk-hackers-demanded...

fair enough, though I think the idea that 15-year-olds are somehow to be dismissed as greenhorns is incorrect. We surely have a disproportionate distribution skewed towards the young among the hackerati, even if we take into account the fact that 50+ age groups didn't have computers in their childhood.

When you combine the potential lack of punishment for juveniles with the biological reality that prefrontal cortex development in adult humans doesn't really complete until the mid twenties, you get teenagers who don't think bad outcomes are possible, and whose brain is less capable of long term risk assessment.

I would think that the 50+ crowd would be far more hampered by their risk assessment of the negative outcomes of these behaviors than by their skillsets alone.

A teen is in it for the lulz, or the glory, or whatever, but a greybeard could lose his retirement, leave his spouse high and dry, lose his ability to see and support his family...

Re: TalkTalk cyber-attack: boy, 15, arrested in Northern Ireland

#39
post #12

Earlier quoted context omitted.

You would be suprised... There are startups out there who say "we don't care about an attack we're too small... we're going to write all of our sql by hand."

Just because they "write all of [their] sql by hand" doesn't mean they will be vulnerable to an attack as simple as this. This is just pure and unmitigated incompetence.

Yes. Preventing SQL injection attacks is very, very easy. To have something like that in your code in 2015 is inexcusable.

Re: TalkTalk cyber-attack: boy, 15, arrested in Northern Ireland

#40
post #38

Earlier quoted context omitted.

fair enough, though I think the idea that 15-year-olds are somehow to be dismissed as greenhorns is incorrect. We surely have a disproportionate distribution skewed towards the young among the hackerati, even if we take into account the fact that 50+ age groups didn't have computers in their childhood.

When you combine the potential lack of punishment for juveniles with the biological reality that prefrontal cortex development in adult humans doesn't really complete until the mid twenties, you get teenagers who don't think bad outcomes are possible, and whose brain is less capable of long term risk assessment. I would think that the 50+ crowd would be far more hampered by their risk assessment of the negative outco…

So they're less risk averse even if they're less competent. Probably right. Though I think there's also something intellectually liberating about having no risk constraints, which might allow for attack vectors that are unconventional.
Post reply on HN