The Mirai Botnet Is Proof the Security Industry Is Broken • Hacker News Board

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#221

Post by sk5t » Wed, Nov 02, 2016, 2:06 AM UTC

cm2187 wrote: post #167

jedmeyers wrote: post #163

Earlier quoted context omitted.

> It doesn't cost more to not write a SQL injection vulnerability. It does. > It just takes a programmer who has a basic understanding of internet 101 Most likely this programmer will cost more than a $10/hr contractor from a third-world country that worked on the software before.

On SQL injections, it doesn't cost more, it just requires to use the correct syntax. Pretty much every database framework offer a syntax to avoid SQL injections. They take a negligible amount of time to type over concatenating a string. On third world country programmers, first I wish only third world country programmers wrote SQL injections vulnerabilities and other easy to avoid mistakes. Then, if you need to audit…

The point is that it still costs more, on average, to hire the person who understands how to avoid SQL injection by using the right tools/syntax. The person who only understands string concatenation and basic SQL will always be available to hire.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#222

Post by killbrad » Wed, Nov 02, 2016, 2:21 AM UTC

st3v3r wrote: post #202

drvdevd wrote: post #195

Earlier quoted context omitted.

In one sense, sure. But IMO regulating the IoT "industry" in a general way is a bad idea because it will just shift the low hanging fruit around some, while ultimately stifiling innovation, which is what is needed for any deep, meaningful security to happen in the long term .

I cannot take this idea that "innovation" will be stifled because people were told to actually give a shit about what they were doing. Honestly, if it means that fly by nite groups aren't releasing their "innovations" out there, I'd consider it a pretty good trade.

Obviously the products out there that aren't giving a fuck are still selling. There isn't a market without buyers.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#223

Post by killbrad » Wed, Nov 02, 2016, 2:26 AM UTC

scrollaway wrote: post #211

SkyMarshal wrote: post #210

Earlier quoted context omitted.

Do most of the ddos attacks actually come from China? I thought they came from botnets of pwned PC's all over the world.

We're talking about who controls the ddos. Where the devices end up is different.

I haven't seen anything about originations on recent broad internet attacks - any good links? Having done "internet work" for about 20 years, it seems like a reasonable statement, but they certainly are getting harder to pinpoint.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#224

Post by st3v3r » Wed, Nov 02, 2016, 2:28 AM UTC

killbrad wrote: post #222

st3v3r wrote: post #202

Earlier quoted context omitted.

I cannot take this idea that "innovation" will be stifled because people were told to actually give a shit about what they were doing. Honestly, if it means that fly by nite groups aren't releasing their "innovations" out there, I'd consider it a pretty good trade.

Obviously the products out there that aren't giving a fuck are still selling. There isn't a market without buyers.

That's why we need the regulation in order to make them give a fuck.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#225

Post by freehunter » Wed, Nov 02, 2016, 2:57 AM UTC

0xdeadbeefbabe wrote: post #126

andrewstuart2 wrote: post #27

Earlier quoted context omitted.

> It's a few honest people screaming to be heard above the din of snake-oil salesmen... I think it more likely that it's a few honest, knowledgeable people screaming to be heard above many honest, well-intentioned, but misguided people screaming to be heard above the din of snake oil salesmen. It's much easier to believe the wrong thing and sell it yourself than it is to be a confidence man. And on the same note, it'…

> And on the same note, it's much easier to crucify a malicious hacker than it is to ruin the life of a guy who supports his wife and kids who just happened to make the economic call that running everything as root was okay. Makes me wonder who makes the snake oil for the salesmen. I'm trying to say this is a plausible caricature that distracts us from a more complex (and way more interesting) reality.

Well in many cases, the product itself is not snake oil, it's just not as good as it's being sold. I work at a vendor and the product I work with has some unhappy customers who were over-sold and promised the moon when we're actually just a telescope. Being able to see the moon is great, but when it's priced like a moon landing and sold like 40 acres of prime lunar real estate, your telescope looks a little lackluster. And your boss just spent $3m on it, they don't want to hear "now we need to buy all these add-ons, plus we still need a couple more tools to shore up the defenses.

The developers (not me) are just writing the best product they can. The sales guys are trying to get sales. The pricing guys are trying to make it profitable. And no one is talking to anyone else, so the developers don't know what features sales is claiming, sales doesn't know the developers roadmap, and pricing... I don't even know who sets the price.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#226

Post by andreareina » Wed, Nov 02, 2016, 3:13 AM UTC

rgbrenner wrote: post #189

Animats wrote: post #106

As I said previously, someone needs to bring negligence suits against some IoT vendors, wholesalers, and retailers. Start with the retailers, like Amazon. They'll find the supply chain for you as they try to pass the buck. It worked with hoverboards. There's a problem at the China end with crap low-end devices driving out the good ones. Here's a good example: solid state relays, useful little devices for safely switc…

someone needs to bring negligence suits against some IoT vendors, wholesalers, and retailers IANAL, so I wonder if that would actually work. Especially since everyone always attaches the standard no-warranty disclaimers to software (and we're talking about vulnerabilities in the software on these devices). Maybe we need to give the FCC power similar to the CPSC.. they can issue recalls of unsafe products (or in the c…

Also IANAL, but I don't think that no-warranty disclaimers work for commercial products. Some countries even specify mandatory warranties (e.g. Australia's Warranty Against Defects[1])

[1] http://www.accc.gov.au/business/treating-customers-fairly/of...

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#227

Post by peterwwillis » Wed, Nov 02, 2016, 3:14 AM UTC

pjc50 wrote: post #107

peterwwillis wrote: post #98

Earlier quoted context omitted.

Traffic in general can be (roughly) summarized as application, infrastructure, and signaling. On top of this, it's clear that different address space is used by different organizations for different purposes. Classify the traffic based on these differences and carve up address space to suit the differences, and perhaps differences in the transport protocols that match the practical differences in how the traffic is u…

None of those examples are relevant to the Mirai case, though? I don't think it even relied on IP spoofing. It was just an enormous HTTP flood.

.....source? They hit a DNS provider, and the bot has a dozen different capabilities. In any case it doesn't matter, DoS often relies on spoofing and the attack still stands

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#228

Post by 505 » Wed, Nov 02, 2016, 3:16 AM UTC

stevetrewick wrote: post #164

Analemma_ wrote: post #13

I wish more people would talk about the economics of why netsec is such a garbage industry. It's a few honest people screaming to be heard above the din of snake-oil salesmen, but there's an economic reason that goes beyond "dumb users, incompetent programmers and CTOs who just look and speeds and feeds". The problem is there's weak correlation, or at least very difficult-to-see correlation, between the amount of eff…

> You could have no security and just get lucky and never get hacked. It's been a decade and more since that was even remotely true (if it ever was). Back in 2008 the average survival time of an unpatched internet facing XP box was around 4 minutes [0]. Pwning an unpatched XP box was (very marginally) harder than pwning a system with no security at all. The Morris worm (Edit: which is heavily mentioned in TFA, my bad…

Probably just a typing error in your otherwise fine post, but the Morris worm was 1988.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#229

Post by woliveirajr » Wed, Nov 02, 2016, 3:21 AM UTC

pbhjpbhj wrote: post #208

enraged_camel wrote: post #171

Earlier quoted context omitted.

>>Back in 2008 the average survival time of an unpatched internet facing XP box was around 4 minutes [0]. Yep. And that's just the average. It was much, much lower for high-value targets, such as universities. The first thing we did at my Network Security class back in 2006 was to hook up an unpatched XP machine to the Internet. It got pwned in about 30 seconds.

What I don't get about this is how the new system is discovered in the first place, assuming the attacker is not already on the network. Sure, gain fast access, but why would you let the traffic on to the local net to discover the machine (except for examples). I can see a box stuck on a home connection getting pwned quick, but surely a Uni network would be blocking rdp traffic, or external pings, or whatever it was…

They were talking about a XP facing the internet, so without network protections like blocking pings.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#230

Post by Animats » Wed, Nov 02, 2016, 3:27 AM UTC

andreareina wrote: post #226

rgbrenner wrote: post #189

Earlier quoted context omitted.

someone needs to bring negligence suits against some IoT vendors, wholesalers, and retailers IANAL, so I wonder if that would actually work. Especially since everyone always attaches the standard no-warranty disclaimers to software (and we're talking about vulnerabilities in the software on these devices). Maybe we need to give the FCC power similar to the CPSC.. they can issue recalls of unsafe products (or in the c…

Also IANAL, but I don't think that no-warranty disclaimers work for commercial products. Some countries even specify mandatory warranties (e.g. Australia's Warranty Against Defects[1]) [1] http://www.accc.gov.au/business/treating-customers-fairly/of...

The one harmed in a DDOS attack is not the purchaser. It's a third party. They're not bound by any agreement with the manufacturer or retailer.