Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Mirai Botnet Is Proof the Security Industry Is Broken

blog.appcanary.com

Post reply on HN
Print view View original

91–100 of 260 posts

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#91

Post by tkinom »

deelowe wrote: post #40
tkinom wrote: post #18

Earlier quoted context omitted.

Toaster is required to pass safety standards because of the there is strong economic incentive (UL requirements) to do it. Without UL, it can't get on the shelf on any stores in US. There are no such thing and UL security requirements for IOT device. Time for such regulation? But "internet + regulation" normally raise a lot of objections internally from the IT industry. If someone (MSFT) proposes secure boot are requ…

UL isn't a regulatory body. UL testing is voluntary. You may know this, but perhaps many others don't. I think a UL for internet connected devices is a fantastic idea. Just need to figure out how to get companies to volunteer for such testing. The way it works for UL is that they provide some insulation from litigation. Perhaps if users could litigate IOT manufacturers for inadequate security testing, something simil…

Retailers (Walmart) require UL for insurance propose.

UL is created for by Insurance companies to gauge the safety of the products.

At the end, the real cause is "The force of Lawyers" is strong for product safety in US. :-)

"The force of the lawyers for IOT" is still weak. :-)

The force of the Jedi (IT, hackers, SW Dev, EFF, OSF) still strong, for now....

The Empire will win when and if enough Jedi (SW Dev) turn to the dark side - team up with the lawyers start suing IOT startup, devices, creators.

No more IOT, raspberryPI, OpenWRT.... only Intel/Qualcomm/MSFT licensed UEFI controlled SecureBoot (Windows CE) devices, Lock down Chromebooks from Google will be allowed.

Feel the power of Dark Side!!!..... :-)

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#92

Post by raesene6 »

maze-le wrote: post #79
raesene9 wrote: post #67

Earlier quoted context omitted.

Of course there is, in cases like this anyway. The problem here wasn't weak passwords, it was that all the passwords were the same, so it was trivial to automate the attack (well that and the devices had a command injection vuln.) That can be fixed by requiring users to set a unique password on setup, or shipping each device with a different password. This exact problem occurred in the UK where ADSL router manufactur…

This may be the cure in this case, but unique/automated passwords can go horribly wrong too. I once was the owner of a Vodafone EasyBox, a cheap and crappy router with pre-configured wlan wpa-keys. They looked randomly enough, but were a crude mixture of your mac-adress and router serial number[0]. It turns out, the bits of the mac adress (wich were always on the same digit) reduced the length of the unknown parts of…

Sure there are bad implementations, but the principle that you can fix this kind of problem is there, just need to give the manufacturers enough incentive to spend the effort to a) implement this process and b) get a compentent security review to ensure it's not easily broken.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#93

Post by Bartweiss »

fortytw2 wrote: post #76
Bartweiss wrote: post #65

Earlier quoted context omitted.

Honestly, the general public may benefit from the first few attacks targeting IoT owners. If your toaster attacks Dyn, that's an indirect failure. But if your lights decide to shut off permanently because some kid thought it would be funny, you're going to throw them away and buy some dumb lightbulbs. Short of regulation or bribery, I can only hope that we'll see progress after some IoT products are directly attacked…

Why would anyone in their right mind attack IoT products directly (ie. disabling/destroying them), when using them as a large botnet is far, far more lucrative? Well... Perhaps once IoT webcams are used for blackmail - but even that is a much more difficult task than "really big botnet attack really big sites" so the incentive isn't there

The same reason we got ILOVEYOU?

I know profit motivated attacks have eclipsed entertainment motivated ones, but that's partly been about the work required to get a 'strong' exploit going. Mirai used an easier access vector than Morris to get full ownership of target devices, so it wouldn't be hard for one person to copy and abuse.

I don't think this is going to become the norm - messing up a refrigerator isn't a lucrative goal - but I expect that it'll happen occasionally if systems stay this weak.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#95

Post by Justsignedup »

Analemma_ wrote: post #13

I wish more people would talk about the economics of why netsec is such a garbage industry. It's a few honest people screaming to be heard above the din of snake-oil salesmen, but there's an economic reason that goes beyond "dumb users, incompetent programmers and CTOs who just look and speeds and feeds". The problem is there's weak correlation, or at least very difficult-to-see correlation, between the amount of eff…

And of course, even if you get hacked, no consumer buys a camera "how good is the anti-hack feature on this?" and how to even quantify it? Hell people still install viruses because the popup told them to.

That's the problem. Security is either the default, or ignored.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#96

Post by pjc50 »

peterwwillis wrote: post #86
pjc50 wrote: post #69

Earlier quoted context omitted.

The thing is, that's the opposite of the net neutrality world; it's the telco world, where the monopolist gets to segregate your traffic and charge arbitary prices for it. I'm old enough to remember when UK modems had to be "BABT approved", adding considerably to the price. See (1993) https://groups.google.com/forum/#!topic/uk.telecom/6j1bVHcq1...

We already know what customers are sending what traffic to what providers; net neutrality is purely a political thing, there is nothing technical stopping it. Baking the differences in traffic into the address space and protocols would just more clearly define what we already define very loosely with things like port numbers and loose firewall rules.

What "differences in traffic" do you mean exactly? Who gets to decide them - that's a political thing, no?

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#97

Post by peterwwillis »

clarry wrote: post #83
peterwwillis wrote: post #78

Earlier quoted context omitted.

I'm not sure, but like I said, separate first by address and function. This could work a hundred different ways. I could give examples but they'd be off the top of my head and not properly designed.

I'm sure you could come up with a hundred different improperly designed ways off the top of your head. And it wouldn't work. And trying to design it properly, you'd probably come to the conclusion that it won't work (without causing massive disruption and breaking everything we've built so far).

Causing massive disruption is what I'm proposing.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#98

Post by peterwwillis »

pjc50 wrote: post #96
peterwwillis wrote: post #86

Earlier quoted context omitted.

We already know what customers are sending what traffic to what providers; net neutrality is purely a political thing, there is nothing technical stopping it. Baking the differences in traffic into the address space and protocols would just more clearly define what we already define very loosely with things like port numbers and loose firewall rules.

What "differences in traffic" do you mean exactly? Who gets to decide them - that's a political thing, no?

Traffic in general can be (roughly) summarized as application, infrastructure, and signaling. On top of this, it's clear that different address space is used by different organizations for different purposes. Classify the traffic based on these differences and carve up address space to suit the differences, and perhaps differences in the transport protocols that match the practical differences in how the traffic is used.

For example, bgp traffic shouldn't work on non-routers. Certain signaling (icmp and udp traffic flags for non-peer traffic) isn't needed by most customer equipment. And it's stupid that IP spoofing works at all, much less on robust servers on internet backbones. It's clear there is traffic allowed on parts of the internet it shouldn't be allowed on. Changes could be made to correct this, and no, they are not political.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#99

Post by Silhouette »

ilyanep wrote: post #81
Silhouette wrote: post #66

Earlier quoted context omitted.

Maybe we need liability for software vendors? That's a common suggestion, but since no-one knows how to make completely secure systems yet, I don't think it's that simple. If you're talking about a general presumption that anyone selling software that has a security vulnerability becomes liable for any consequential losses, then it seems likely to result in only large businesses with the war chest to fight a liabilit…

> and/or in a new insurance industry popping up so that the problem reduces to money and the cost is ultimately passed on to software users in higher prices The price of providing a basic level of security should be priced into the product! The fact that someone can go out there and buy an IOT camera that will be used to DDOS my server is a negative externality that constitutes a market failure. I want sketchy IOT ma…

The price of providing a basic level of security should be priced into the product!

The question is whether that is all that would be priced in, or whether the insurance industry, given a rich new feeding ground, would charge huge rates for many types of device in case of catastrophic failure.

My car insurance probably costs me several times the value of my car each year, because I am required to have cover for third party losses as well. That remains true even though I've been driving for a long time and never made a claim so far, because in the nature of insurance, they are guarding against the relatively rare possibility of a relatively high payout.

What happens when your $100 office software package now has mandatory insurance in case each installed instance costs the business $200 in lost revenues from downtime after a breach, or $2,000 in average compensation when a vulnerability leads to personal data being illegally disclosed?

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#100

Post by clarry »

onion2k wrote: post #89
clarry wrote: post #41

Earlier quoted context omitted.

An attack can be quite effective even if the traffic from a single home is insignificant. I don't need ISPs to mess with my connection any more than they do already.

An attack can be quite effective even if the traffic from a single home is insignificant. In a recent attack there were 145607 devices sending >1.5Tbps[1]. That's a lot from individual connections. (From: https://twitter.com/olesovhcom/status/779297257199964160 )

About 1.4 megabytes on average is not that much.

Even so, this one wasn't a particularly sophisticated attack. Even if we could weed out this particular type, many a DoS rely on amplification or asymmetrical computational cost with respect to the size of the request. So if we concluded that 1.4 MB/s of HTTP or DNS or plain TCP were a lot and managed to block these senders, it would be far from a universal solution against DDoS originating from domestic hosts. And there's reason to believe we'll see much larger botnets unless manufacturers of IoT devices start taking security seriously. So tomorrow 0.14 MB/s per home could be plenty.

What cost would this blocking incur? How often would I have to call my ISP because they blocked perfectly legitimate traffic? Unfortunately maybe not that often, because after the first few calls I'd probably figure that they are too big to give a shit about my problems.

Post reply on HN