The Mirai Botnet Is Proof the Security Industry Is Broken • Hacker News Board

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#71

Post by drzaiusapelord » Tue, Nov 01, 2016, 3:27 PM UTC

XaYdEk wrote: post #37

iregistered4 wrote: post #5

Completely incorrect claim, the IoT industry doesn't spend a penny on security, and therefore will be vulnerable to these type of attacks. If anything this is proof that the security industry does work, these attacks are happening on devices where there is no security budget - not on servers with large investments in security.

How many pennies would've been needed to insert a simple page forcing you to change user/password combo and to choose a reasonably strong password after first boot ? In the case of Mirai it's not even a cost issue, just lacking good practices.

Anything that adds any interaction with the user will cost support time, thus dollars. Its easier for these companies to hard code a password in and have it "just work" with their mobile app or web interface than actually do security correctly.

Until there are regulations in place to make them do this, they will not care.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#72

Post by achr2 » Tue, Nov 01, 2016, 3:28 PM UTC

wott wrote: post #59

achr2 wrote: post #4

My toaster has to be certified that it meets certain minimum safety standards. It really seems that IoT and safety critical software/firmware should be required to pass a similar (bare minimum) certification.

But most of those safety standards are meant to protect the device and its user during a normal use , not against malicious attempts to destroy it or pervert its usage.

If my toaster exposed its wires and buttons to the outside world, there would certainly be added measures to prevent malicious usage.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#73

Post by michaelt » Tue, Nov 01, 2016, 3:34 PM UTC

bikamonki wrote: post #57

MR4D wrote: post #8

How about a law that requires computerized devices to be shipped with unique passwords. That would be a start. Second, any computerized device must pass FTC/FCC/UL (pick one) tests for computer security before going on sale. There's more that can be done, but let's go after the simple stuff first.

That'll work until the database of device credentials is breached from company X which provides call center support services for manufacturers A through Z and needs said credentials at hand.

Pretty much every home router sold in the UK is shipped with a unique default wifi network name and password printed on a sticker and stuck to the device.

Manufacturers don't need to keep a credential database, as legitimate users can simply look at the label.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#74

Post by ontoillogical » Tue, Nov 01, 2016, 3:34 PM UTC

tptacek wrote: post #53

The security industry has been "broken" for as long as there has been a security industry. When I left Network Associates in 1999 to start a chat company, leaving the security industry to do something non-security was already a cliche. It's true, the 1U rackmount netsec industry does virtually nothing to prevent consumer electronics vendors from shipping terribly insecure code. I don't like the netsec industry either…

> When I was your age I was leaving the security industry before it was cool

I'm not interested in leaving the security industry. I'd rather work to change it. I'm a millennial, I guess :)

> The "security industry" is not in fact chartered with stopping things like Mirai. So Mirai is a weird complaint to level at it.

No one "chartered" the industry to do anything.

You're right, a metal box or an AV isn't going to prevent your IoT product from shipping with default creds on telnet, but don't you think the industry is complicit in drowning out the good advice to not do that in a sea of noise and then blaming the victims?

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#75

Post by FussyZeus » Tue, Nov 01, 2016, 3:35 PM UTC

whack wrote: post #49

Analemma_ wrote: post #13

I wish more people would talk about the economics of why netsec is such a garbage industry. It's a few honest people screaming to be heard above the din of snake-oil salesmen, but there's an economic reason that goes beyond "dumb users, incompetent programmers and CTOs who just look and speeds and feeds". The problem is there's weak correlation, or at least very difficult-to-see correlation, between the amount of eff…

That's a great point regarding the economics of why IoT manufacturers don't invest all that much on security. Here's another one. It's an externality. Botnet attacks don't harm the IoT manufacturers. They don't even harm the IoT products or their users. They harm completely innocent bystanders like DNS/github. What possible incentive do IoT manufacturers have to invest money on initiatives that bring no benefits to t…

The safety equipment on vehicles is also an externality but it's mandated because when a car is unsafe it affects other people who aren't the driver. I don't see how IoT is any different. If you don't want to secure your product, then don't build your product and save the rest of us from dealing with the fallout of your laziness.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#76

Post by fortytw2 » Tue, Nov 01, 2016, 3:39 PM UTC

Bartweiss wrote: post #65

whack wrote: post #49

Earlier quoted context omitted.

That's a great point regarding the economics of why IoT manufacturers don't invest all that much on security. Here's another one. It's an externality. Botnet attacks don't harm the IoT manufacturers. They don't even harm the IoT products or their users. They harm completely innocent bystanders like DNS/github. What possible incentive do IoT manufacturers have to invest money on initiatives that bring no benefits to t…

Honestly, the general public may benefit from the first few attacks targeting IoT owners. If your toaster attacks Dyn, that's an indirect failure. But if your lights decide to shut off permanently because some kid thought it would be funny, you're going to throw them away and buy some dumb lightbulbs. Short of regulation or bribery, I can only hope that we'll see progress after some IoT products are directly attacked…

Why would anyone in their right mind attack IoT products directly (ie. disabling/destroying them), when using them as a large botnet is far, far more lucrative?

Well... Perhaps once IoT webcams are used for blackmail - but even that is a much more difficult task than "really big botnet attack really big sites" so the incentive isn't there

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#77

Post by tptacek » Tue, Nov 01, 2016, 3:40 PM UTC

ontoillogical wrote: post #74

tptacek wrote: post #53

The security industry has been "broken" for as long as there has been a security industry. When I left Network Associates in 1999 to start a chat company, leaving the security industry to do something non-security was already a cliche. It's true, the 1U rackmount netsec industry does virtually nothing to prevent consumer electronics vendors from shipping terribly insecure code. I don't like the netsec industry either…

> When I was your age I was leaving the security industry before it was cool I'm not interested in leaving the security industry. I'd rather work to change it. I'm a millennial, I guess :) > The "security industry" is not in fact chartered with stopping things like Mirai. So Mirai is a weird complaint to level at it. No one "chartered" the industry to do anything. You're right, a metal box or an AV isn't going to pre…

No? I am having a hard time seeing any intersection between either of the major two branches of the security industry (PC security and network security) and IoT botnets.

There's a major failure happening, but it's not attributable to the security industry. It's a failure of the computing industry as a whole.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#78

Post by peterwwillis » Tue, Nov 01, 2016, 3:44 PM UTC

clarry wrote: post #47

peterwwillis wrote: post #25

It's actually proof that internet architecture in general is broken. Well, not broken; it was broken, and then healed in a weird way so there's extra cartilage sticking out causing annoyances and won't move as easily anymore. The security industry has absolutely nothing to do with the existence of a botnet that can take down massive internet infrastructure. The security industry just puts bandaids on shitty products.…

How do you tell illegitimate and legitimate traffic apart? In many cases the only difference between a DDoS and normal operation is the volume of traffic at the victim host.

I'm not sure, but like I said, separate first by address and function. This could work a hundred different ways. I could give examples but they'd be off the top of my head and not properly designed.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#79

Post by maze-le » Tue, Nov 01, 2016, 3:45 PM UTC

raesene9 wrote: post #67

_pdp_ wrote: post #46

There is no cure for weak passwords.

Of course there is, in cases like this anyway. The problem here wasn't weak passwords, it was that all the passwords were the same, so it was trivial to automate the attack (well that and the devices had a command injection vuln.) That can be fixed by requiring users to set a unique password on setup, or shipping each device with a different password. This exact problem occurred in the UK where ADSL router manufactur…

This may be the cure in this case, but unique/automated passwords can go horribly wrong too. I once was the owner of a Vodafone EasyBox, a cheap and crappy router with pre-configured wlan wpa-keys. They looked randomly enough, but were a crude mixture of your mac-adress and router serial number[0]. It turns out, the bits of the mac adress (wich were always on the same digit) reduced the length of the unknown parts of the key to 16. The rest 65535-something key-bits could easily be brute forced.

I just had the good fortune to configure my wifi- network myself, so I had to put in my own keys. Many other people didn't, and who could blame them, they were probably happy the thing worked in the first place...

[0]: https://www.wardriving-forum.de/wiki/Standardpassw%C3%B6rter...

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#80

Post by tyingq » Tue, Nov 01, 2016, 3:48 PM UTC

dfc wrote: post #48

ctz wrote: post #32

Earlier quoted context omitted.

> There are no such thing and UL security requirements for IOT device. UL 2900-1.

404 for every link to the standards. Awesome!

You have to buy them... http://www.comm-2000.com/ProductDetail.aspx?UniqueKey=31733