Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Mirai Botnet Is Proof the Security Industry Is Broken

blog.appcanary.com

Post reply on HN
Print view View original

231–240 of 260 posts

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#231

Post by drvdevd »

st3v3r wrote: post #224
killbrad wrote: post #222

Earlier quoted context omitted.

Obviously the products out there that aren't giving a fuck are still selling. There isn't a market without buyers.

That's why we need the regulation in order to make them give a fuck.

What I'm ultimately arguing here is that: even after the regulators step in and make make them give a fuck, I mean really give a fuck, and they are forced to fix the low hanging fruits, these botnets or other similar machinations, will still exist. In fact, if we assume the regulations work and actually make things harder to exploit, we can add in the knowledge that the price for using and creating IoT botnets will go up - possibly making botnet creation a more lucrative career than IoT defense. I'm saying we have a technical conundrum that regulation can't regulate away.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#232

Post by pjlegato »

rybosome wrote: post #153
pjlegato wrote: post #146

Earlier quoted context omitted.

The major flaw with that proposal is that the government has shown itself to be exceptionally incompetent (just like everyone else) when it comes to security. For example, the NSA 's security -- not some underfunded, minor agency, but the NSA itself, the world's leading cybersecurity agency -- has had its security breached on a large scale basis, multiple times. And that is just the beginning of the very long list. I…

Fair, but we are not expecting manufacturers to make bullet-proof devices. We are expecting them to make devices that do not let you achieve root access over the internet using an unchanged username and password combination. That's a very easy and specific thing to regulate.

Well, the NSA let a low level contractor (Snowden) walk off with a thumb drive containing half their archive. That's not far removed from not changing the default root password.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#233

Post by dredmorbius »

dredmorbius wrote: post #220
wnevets wrote: post #155

The free market has decided security of IoT doesn't matter.

Markets consistently under-assess complexity, in both value and const components. Simple systems are easy to assess and communicate. Complex systems are hard (expensive) to assess and communicate. This results in several asymmetries: 1. Complex systems are communicated in an oversimplified mode. 2. Asymmetries exist between buyers and sellers of products (Akerloff's "Market for Lemons". 3. Asymmetries exist for all p…

s/const/cost/

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#234

Post by herbst »

scrollaway wrote: post #211
SkyMarshal wrote: post #210

Earlier quoted context omitted.

Do most of the ddos attacks actually come from China? I thought they came from botnets of pwned PC's all over the world.

We're talking about who controls the ddos. Where the devices end up is different.

I am pretty sure there was nothing really pointing to china so far. Any links?

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#235

Post by sdrinf »

gearhart wrote: post #60
Analemma_ wrote: post #13

I wish more people would talk about the economics of why netsec is such a garbage industry. It's a few honest people screaming to be heard above the din of snake-oil salesmen, but there's an economic reason that goes beyond "dumb users, incompetent programmers and CTOs who just look and speeds and feeds". The problem is there's weak correlation, or at least very difficult-to-see correlation, between the amount of eff…

This sounds like an insurance problem. You've got events that occur rarely enough to an individual (company) that it's hard to work out what the best course of action is using the limited data that an individual can gather. If there were, say, a half dozen major security companies that everyone subscribed to one of, and they each published their statistics showing how many of their customers suffered various kinds of…

Strictly from an insurance business perspective, there are two major problems with this:

* Netsec events are black swans: it's very, very hard to model how often a security breach will occur. One could checklist all the ways by which we know currently sites are getting hacked, and would still have to pay out, _because hacking exploits things we don't already know_.

* When a hack occurs, it can happen at scale. Unlike eg life insurance, where you have a single payout for hard-to-predict events, the better the hack, the higher the potential for damage, and so the higher the total payout.

These two together means an IT-security-insurance company might do well for a few years, then file for bankruptcy at the first event that hits it, due to inability to pay.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#236

Post by aidenn0 »

pbhjpbhj wrote: post #212
iregistered4 wrote: post #143

Earlier quoted context omitted.

" Ok, I am aware of how it works, but I'm not talking pentests or hardening. I'm talking simple, cheap design choices in this case, that could've eliminated the whole Mirai debauchery." Then you are not talking about the security industry or its failure to work are you? Its a failure in the development industry to have basic security awareness. If you don't engage the security industry for pentests or consulting. You…

>Its a failure in the development industry to have basic security awareness. // Is that really it? Surely even a high-school level developer will realise that having a device connected to the wild web with a default user:pass will be hacked easily. I'd have thought the problem is not wanting to support customer calls saying "we changed the password and now can't access our device". So default user:pass and no prompt…

No, that dev will say "It will be behind a NAT, so it's fine to have a default user:pass"

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#237

Post by ams6110 »

pbhjpbhj wrote: post #208
enraged_camel wrote: post #171

Earlier quoted context omitted.

>>Back in 2008 the average survival time of an unpatched internet facing XP box was around 4 minutes [0]. Yep. And that's just the average. It was much, much lower for high-value targets, such as universities. The first thing we did at my Network Security class back in 2006 was to hook up an unpatched XP machine to the Internet. It got pwned in about 30 seconds.

What I don't get about this is how the new system is discovered in the first place, assuming the attacker is not already on the network. Sure, gain fast access, but why would you let the traffic on to the local net to discover the machine (except for examples). I can see a box stuck on a home connection getting pwned quick, but surely a Uni network would be blocking rdp traffic, or external pings, or whatever it was…

At that time? At a university? No. You typically got a public IP address via DHCP and there was no firewall at all. Even today that's still pretty much the case, though a new device is probably assigned a non-routable address until a terms of use agreement is clicked.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#238

Post by fulafel »

viraptor wrote: post #175
fulafel wrote: post #7

The "security industry" was never significantly involved in improving product security and software quality. They have roots in profiting from the deplorable state of PC security. Centralised firewalls, "intranets", and anti-virus products are not sustainable solutions to any of these problems - they're just so ingrained in the mindset of IT profiessionals that they self-perpetuate.

I get what you're going for but you're actually wrong. Both firewalls centralised or not (configure to prevent all access outbound apart from approved nodes) and intranets (put IoT in isolation) would actually prevent Mirai from both spreading and attacking anyone. But most people are not implementing either, because home router is all you need...

To prevent Mirai you have to convince the least competent security camera owners running their corner supermarket or whatever to spend the money and effort. The people who are self-selected technologically illiterate cheapskates because they bought the cheapest Chinese IP security camera.

Yeah, you can always make this argument. "If only there had been sufficiently advanced and non-buggy firewall rules in place in firewalls optimally placed in the topology, looked after by competent networking staff"

It just doesn't work in most environments because you don't have firewall experts on staff and you have no incentives to spend money and effort on firewalls.

(And even for professional firewall wranglers it's hard in normal semi-chaotic IT organisations, you don't intrinsically get any assurance things are set up tightly, or that it remains so after network configuration changes, and you keep breaking working systems, you just get feedback for angry users that you've inconvenienced and you never get feedback from successfully defending against attacks. etc etc. And at the end of the day for the same money you could have gotten better security improvement by spending man hours (and hours lost by impeding your users) elsewhere, in line with end-to-end thinking.)

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#239

Post by viraptor »

fulafel wrote: post #238
viraptor wrote: post #175

Earlier quoted context omitted.

I get what you're going for but you're actually wrong. Both firewalls centralised or not (configure to prevent all access outbound apart from approved nodes) and intranets (put IoT in isolation) would actually prevent Mirai from both spreading and attacking anyone. But most people are not implementing either, because home router is all you need...

To prevent Mirai you have to convince the least competent security camera owners running their corner supermarket or whatever to spend the money and effort. The people who are self-selected technologically illiterate cheapskates because they bought the cheapest Chinese IP security camera. Yeah, you can always make this argument. "If only there had been sufficiently advanced and non-buggy firewall rules in place in fi…

You're talking about people, I was only talking about technologies.

> If only there had been sufficiently advanced and non-buggy firewall rules in place

We don't even have to look for ideal or advanced solutions. First forbid spoofed IPs, then kill incoming low port traffic to residential users (but let them opt out of that, just like we already often do with outgoing port 25). This applied globally would kill a large chunk of DDoS attacks these days. But today's ISPs are not doing even that.

I don't know how we can convince people to care enough.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#240

Post by cm2187 »

sk5t wrote: post #221
cm2187 wrote: post #167

Earlier quoted context omitted.

On SQL injections, it doesn't cost more, it just requires to use the correct syntax. Pretty much every database framework offer a syntax to avoid SQL injections. They take a negligible amount of time to type over concatenating a string. On third world country programmers, first I wish only third world country programmers wrote SQL injections vulnerabilities and other easy to avoid mistakes. Then, if you need to audit…

The point is that it still costs more, on average, to hire the person who understands how to avoid SQL injection by using the right tools/syntax. The person who only understands string concatenation and basic SQL will always be available to hire.

And again you are assuming that these vulnerabilities are introduced by cheap untrained or foreign programmers. Massive silicon valley firms who pay top market rates do the same mistakes. I am sure there is a correlation between pay level and understanding of security but we are very far from a position where if you hire a team of developper, a business can have any confidence that they won't do something dumb like md5 a password, concatenate a string in a SQL qry, rely on user supplied array length in an unmanaged language, not protect themselves against CSRF (I suspect 50% of professional web dev still don't even know what it is!), etc.
Post reply on HN