Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

A vigilante trying to improve IoT security

gizmodo.com

Post reply on HN
Print view View original

21–30 of 242 posts

Re: A vigilante trying to improve IoT security

#21

Post by hectorr »

086421357909764 wrote: post #8

It's all fine and well until one of those improperly configured devices are a medical device or something critical. Yes I understand that's part of the problem, but proving a point with risk isn't the right answer either. Every Dialysis machine i've seen runs windows xp, which any security professional will tell you is game over, but given the market hasn't provided an alternative, it's becomes a necessity to figure…

Connecting critical life support systems to the internet, and not having any contingency for an outage, sounds a lot like malpractice. Hospitals have fail-safes, and if they don't it's a far larger problem than using an insecure IOT device.

Re: A vigilante trying to improve IoT security

#22

Post by seob »

orng wrote: post #4

Slightly OT, but not too long ago I read that it is not uncommon for viruses to remove other known, competing, malware. Does anyone know if anyone has ever made a virus who's only purpose is to remove other malware? Perhaps the same aggressive approach used by Janit0r is needed to stop the spread of worms, kill off botnets etc.?

> Does anyone know if anyone has ever made a virus who's only purpose is to remove other malware?

The first computer virus was an experimental self-replicating program called Creeper.

And the second computer virus was Reaper, a similar program created for the sole purpose of deleting Creeper.

http://corewar.co.uk/creeper.htm

Re: A vigilante trying to improve IoT security

#23

Post by fredley »

thomble wrote: post #15
fredley wrote: post #12

Earlier quoted context omitted.

I think it's rather brilliant. It is the manufacturer's responsibility to ship secure products. Here a consumer with a bricked product will demand a replacement/refund, putting pressure on the manufacturers to not ship shitty products. It's directly applying market pressure to sellers of insecure hardware, and that's a great thing.

Yes. In fact, I'm going to start stealing bikes that have insecure locks.

Very different. If you can bust an insecure lock you can steal a bike. If you bust an insecure IoT device, you can steal data from potentially thousands or millions of people.

Re: A vigilante trying to improve IoT security

#24

Post by thomble »

badosu wrote: post #16
thomble wrote: post #15

Earlier quoted context omitted.

Yes. In fact, I'm going to start stealing bikes that have insecure locks.

What kind of stupid person would think that we could have a cooperative, functional society where I can just be careless with my bike, right? What's the problem with these people? Sarcasm aside, I live in Brazil, ask any Brazilian who stayed on an European country what was the biggest difference: "I could feel safe anytime, without worrying about my stuff". That really shapes the mind and behaviour of people.

You may get the exact same answer from a European who has lived in Japan.

Re: A vigilante trying to improve IoT security

#25

Post by tptacek »

adamclarkestes wrote: post #19
086421357909764 wrote: post #8

It's all fine and well until one of those improperly configured devices are a medical device or something critical. Yes I understand that's part of the problem, but proving a point with risk isn't the right answer either. Every Dialysis machine i've seen runs windows xp, which any security professional will tell you is game over, but given the market hasn't provided an alternative, it's becomes a necessity to figure…

I'm the author of the Gizmodo post. Having covered IoT hacks for a few years, it's obvious that drastic measures would be necessary to convince manufacturers to build more secure products. While I'm not necessarily endorsing this hacker's methods, I do salute his taking a stand. It might land him in jail. But still, the mission is worthwhile.

Did you not have any input into this headline? It is a clear endorsement.

Re: A vigilante trying to improve IoT security

#26

Post by ZoFreX »

fruzz wrote: post #9

It takes a special kind of entitled to destroy people's things and to then blame others (the manufacturers) for it.

How are the manufacturers not to blame? One way or another, these devices are getting hacked. Only most of the time, they're taking down Playstation Network or GitHub rather than being bricked.

Attacks on devices that have hardcoded weak credentials online aren't an event or an act. They're a force of nature, like erosion. No-one would be happy with someone building bridges that don't account for erosion. Nor is it ok to ship something that connects to the internet and doesn't account for the millions of automated bots that are prowling the web 24/7 looking for insecure devices.

The manufacturers are 100% to blame, and the worst thing is that they're not the ones that deal with the fall-out – innocent companies and consumers are.

Re: A vigilante trying to improve IoT security

#27

Post by thomble »

scrollaway wrote: post #17
thomble wrote: post #15

Earlier quoted context omitted.

Yes. In fact, I'm going to start stealing bikes that have insecure locks.

Please don't. With some funding from China, I'm currently running a massive worldwide operation, which allows me to spy on hundreds of millions of unsuspecting Master Lock users; allowing me to track, among other things, where every bike user is at all time, as well as record what they are doing. If only it weren't for you meddling kid. Analogies, aren't they great? (Since it's apparent that sarcasm can't be read: "S…

If this danger is real, isn't it best to inform the consumer, or perhaps use a lawsuit to force a recall, rather than destroying other people's hardware?

Does this concept apply to software? When the next large-scale RCE 0-day drops, does it make sense to use exploitation to destroy as much as possible in order to pressure the developers to ship a secure product? Since, the hacked machines certainly could allow an attacker lateral movement to sensitive data.

Re: A vigilante trying to improve IoT security

#28

Post by ZoFreX »

orng wrote: post #4

Slightly OT, but not too long ago I read that it is not uncommon for viruses to remove other known, competing, malware. Does anyone know if anyone has ever made a virus who's only purpose is to remove other malware? Perhaps the same aggressive approach used by Janit0r is needed to stop the spread of worms, kill off botnets etc.?

Yes, such things exist, but they are still technically malware.

It's a risky approach. It could have unintended consequences. If it's a worm, it could spread out of control and cause considerable harm purely from its transmission.

As attractive an idea as it might be, it's dangerous.

Re: A vigilante trying to improve IoT security

#29

Post by brazzledazzle »

Waterluvian wrote: post #11
086421357909764 wrote: post #8

It's all fine and well until one of those improperly configured devices are a medical device or something critical. Yes I understand that's part of the problem, but proving a point with risk isn't the right answer either. Every Dialysis machine i've seen runs windows xp, which any security professional will tell you is game over, but given the market hasn't provided an alternative, it's becomes a necessity to figure…

I experience something akin to this at work all the time. There's the real-world pragmatists and the software purity philosophers. Tell the family of someone killed that, "____ shouldn't have purchased a device without knowing how to secure it!"

Allowing a medical device that can kill or harm someone to be connected to the internet would be a dramatic failure of both the company that produced it and the government. Monitoring is one thing but it better be a one way street or air gapped. No one should be able to do anything to a medical device over the internet besides read information. Or even over a LAN. Even if it is much less convenient or practical.
Post reply on HN