The Mirai Botnet Is Proof the Security Industry Is Broken
blog.appcanary.com
The Mirai Botnet Is Proof the Security Industry Is Broken
1–10 of 260 posts
Re: The Mirai Botnet Is Proof the Security Industry Is Broken
#2> The major botnet of 2016 is simpler than the botnet of 1988.
That, right there, is a damning indictment not only of our industry but also of our culture. We know how to secure systems. It's not magic. But — unlike for example physical hygiene — we haven't made the decision to make computer hygiene part of our culture. We look down on people who don't wash their hands, but we don't look down on people who use poor passwords. We teach children to cover their mouths when they cough, but we don't teach children not to plug a Windows machine into a network.
Re: The Mirai Botnet Is Proof the Security Industry Is Broken
#3> The major botnet of 2016 is simpler than the botnet of 1988. That, right there, is a damning indictment not only of our industry but also of our culture. We know how to secure systems. It's not magic. But — unlike for example physical hygiene — we haven't made the decision to make computer hygiene part of our culture. We look down on people who don't wash their hands, but we don't look down on people who use poor p…
Worst of all, they think people who haven't learned about security deserve what happens to them...
Re: The Mirai Botnet Is Proof the Security Industry Is Broken
#4My toaster has to be certified that it meets certain minimum safety standards. It really seems that IoT and safety critical software/firmware should be required to pass a similar (bare minimum) certification.
Re: The Mirai Botnet Is Proof the Security Industry Is Broken
#5Completely incorrect claim, the IoT industry doesn't spend a penny on security, and therefore will be vulnerable to these type of attacks.
If anything this is proof that the security industry does work, these attacks are happening on devices where there is no security budget - not on servers with large investments in security.
Re: The Mirai Botnet Is Proof the Security Industry Is Broken
#6I like how the author complains about cyberpocalypse conference talks then goes on to say the security industry is broken...
Hard coded creds and the allowance of default creds isn't the security industry, it's the manufacturer.
Re: The Mirai Botnet Is Proof the Security Industry Is Broken
#7The "security industry" was never significantly involved in improving product security and software quality. They have roots in profiting from the deplorable state of PC security. Centralised firewalls, "intranets", and anti-virus products are not sustainable solutions to any of these problems - they're just so ingrained in the mindset of IT profiessionals that they self-perpetuate.
Re: The Mirai Botnet Is Proof the Security Industry Is Broken
#8How about a law that requires computerized devices to be shipped with unique passwords.
That would be a start.
Second, any computerized device must pass FTC/FCC/UL (pick one) tests for computer security before going on sale.
There's more that can be done, but let's go after the simple stuff first.
Re: The Mirai Botnet Is Proof the Security Industry Is Broken
#9> The major botnet of 2016 is simpler than the botnet of 1988. That, right there, is a damning indictment not only of our industry but also of our culture. We know how to secure systems. It's not magic. But — unlike for example physical hygiene — we haven't made the decision to make computer hygiene part of our culture. We look down on people who don't wash their hands, but we don't look down on people who use poor p…
In this case, it's more like we look down on people who don't wash their hands, but don't care if the companies making soap also handle raw sewage. The tragedy of the modern botnet is that it wasn't even the fault of dumb consumers, but companies so careless they didn't give people the ability to set passwords in the first place!
Re: The Mirai Botnet Is Proof the Security Industry Is Broken
#10Yeah, no.
Mirai doesn't have shit to do with the security industry. The security industry are the people who you hire to secure your things, victims of Mirai did not take advantage of the services provided by the security industry.
More like, The Mirai Botnet Is Proof the Security Industry Is Going To Be Doing Fucking Great