Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Mirai Botnet Is Proof the Security Industry Is Broken

blog.appcanary.com

Post reply on HN
Print view View original

81–90 of 260 posts

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#81

Post by ilyanep »

Silhouette wrote: post #66
zby wrote: post #15

Maybe we need liability for software vendors? With exemption for those who provide full source code.

Maybe we need liability for software vendors? That's a common suggestion, but since no-one knows how to make completely secure systems yet, I don't think it's that simple. If you're talking about a general presumption that anyone selling software that has a security vulnerability becomes liable for any consequential losses, then it seems likely to result in only large businesses with the war chest to fight a liabilit…

> and/or in a new insurance industry popping up so that the problem reduces to money and the cost is ultimately passed on to software users in higher prices

The price of providing a basic level of security should be priced into the product! The fact that someone can go out there and buy an IOT camera that will be used to DDOS my server is a negative externality that constitutes a market failure. I want sketchy IOT manufacturer 32XB123 to be forced to buy liability insurance for that.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#82

Post by ArchReaper »

onion2k wrote: post #22
MR4D wrote: post #8

How about a law that requires computerized devices to be shipped with unique passwords. That would be a start. Second, any computerized device must pass FTC/FCC/UL (pick one) tests for computer security before going on sale. There's more that can be done, but let's go after the simple stuff first.

If you want to go after the simple stuff then blocking significant outbound traffic at the ISP level from a home user account until they agree it's something they want to do is the most straightforward solution. No need to change much infrastructure, no need to test devices, and no need to have costly manufacturing processes. You could even let specific traffic through (Facebook live streaming, online gaming services…

That sounds like a terrible idea. You think every end user, everywhere, needs to manually verify with their ISP for every single outbound connection? How could that possibly be an acceptable solution?

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#83

Post by clarry »

peterwwillis wrote: post #78
clarry wrote: post #47

Earlier quoted context omitted.

How do you tell illegitimate and legitimate traffic apart? In many cases the only difference between a DDoS and normal operation is the volume of traffic at the victim host.

I'm not sure, but like I said, separate first by address and function. This could work a hundred different ways. I could give examples but they'd be off the top of my head and not properly designed.

I'm sure you could come up with a hundred different improperly designed ways off the top of your head. And it wouldn't work.

And trying to design it properly, you'd probably come to the conclusion that it won't work (without causing massive disruption and breaking everything we've built so far).

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#84

Post by ontoillogical »

pjc50 wrote: post #70
ontoillogical wrote: post #56

Earlier quoted context omitted.

> Solving the core problems is good for society, but society doesn't reward this behavior. I'd like to think that we can solve collective action problems like this as a society and be rewarded for it. We have to figure out how to fight this problem the way we fought smallpox and polio.

Large international state-funded scientific collaboration?

Sure, I'd like to see CERT get more funding...

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#86

Post by peterwwillis »

pjc50 wrote: post #69
peterwwillis wrote: post #25

It's actually proof that internet architecture in general is broken. Well, not broken; it was broken, and then healed in a weird way so there's extra cartilage sticking out causing annoyances and won't move as easily anymore. The security industry has absolutely nothing to do with the existence of a botnet that can take down massive internet infrastructure. The security industry just puts bandaids on shitty products.…

The thing is, that's the opposite of the net neutrality world; it's the telco world, where the monopolist gets to segregate your traffic and charge arbitary prices for it. I'm old enough to remember when UK modems had to be "BABT approved", adding considerably to the price. See (1993) https://groups.google.com/forum/#!topic/uk.telecom/6j1bVHcq1...

We already know what customers are sending what traffic to what providers; net neutrality is purely a political thing, there is nothing technical stopping it. Baking the differences in traffic into the address space and protocols would just more clearly define what we already define very loosely with things like port numbers and loose firewall rules.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#87

Post by kordless »

Analemma_ wrote: post #13

I wish more people would talk about the economics of why netsec is such a garbage industry. It's a few honest people screaming to be heard above the din of snake-oil salesmen, but there's an economic reason that goes beyond "dumb users, incompetent programmers and CTOs who just look and speeds and feeds". The problem is there's weak correlation, or at least very difficult-to-see correlation, between the amount of eff…

First off, we need to decentralize centralized services. Second, those decentralized services need to have different types of business models applied to them, long term, for achieving sustainability. Business models are what makes a centralized service centralized, secret and brittle. Change the game theory around infrastructure and you change the speed in which that infrastructure can be hacked. All infrastructure should do is to try to be self-sustaining. Making money off infrastructure is inherently greedy, given it doesn't scale linearly. This is the primary problem today, but I've found most people reject it given their intent is to get "rich" off whatever it is they do.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#88

Post by djrogers »

This is not a failure of the security industry - the security industry is targeted at the enterprise, largely not the host of the vulnerable IoT devices involved.

Don't get me wrong, there are tons of ways in which the security industry fails (the biggest IMHO is buying/selling things that only get implemented in a half-@$$ed manner or not at all), but this is like blaming the Airline industry for a train wreck.

Perhaps the real problem is that for home users there really is no security industry to speak of? A handful of features on WiFi APs that get turned off if they break your XBOX games, and maybe some desktop AV. That's pretty much it - and I'm not sure we can ever expect much more..

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#89

Post by onion2k »

clarry wrote: post #41
onion2k wrote: post #22

Earlier quoted context omitted.

If you want to go after the simple stuff then blocking significant outbound traffic at the ISP level from a home user account until they agree it's something they want to do is the most straightforward solution. No need to change much infrastructure, no need to test devices, and no need to have costly manufacturing processes. You could even let specific traffic through (Facebook live streaming, online gaming services…

An attack can be quite effective even if the traffic from a single home is insignificant. I don't need ISPs to mess with my connection any more than they do already.

An attack can be quite effective even if the traffic from a single home is insignificant.

In a recent attack there were 145607 devices sending >1.5Tbps[1]. That's a lot from individual connections.

(From: https://twitter.com/olesovhcom/status/779297257199964160 )

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#90

Post by iregistered4 »

XaYdEk wrote: post #37
iregistered4 wrote: post #5

Completely incorrect claim, the IoT industry doesn't spend a penny on security, and therefore will be vulnerable to these type of attacks. If anything this is proof that the security industry does work, these attacks are happening on devices where there is no security budget - not on servers with large investments in security.

How many pennies would've been needed to insert a simple page forcing you to change user/password combo and to choose a reasonably strong password after first boot ? In the case of Mirai it's not even a cost issue, just lacking good practices.

"How many pennies would've been needed to insert a simple page forcing you to change user/password combo and to choose a reasonably strong password after first boot ?"

These are written by outsourced developers who don't know anything about security. They wouldn't even think to develop something as simple as that.

You are obviously unaware of how this works, companies would have to hire consultants/penetration testers to assess the product first. Then they would spend even more money making the changes suggested by the consultants. So it would cost a lot of pennies.. actually.

Post reply on HN