Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Victoria Police cancel hundreds of speeding fines after WannaCry virus attack

theage.com.au

Post reply on HN
Print view View original

41–50 of 57 posts

Re: Victoria Police cancel hundreds of speeding fines after WannaCry virus attack

#41

Post by blackoil »

darawk wrote: post #8
mirekrusin wrote: post #4

No mention that this security hole has been kept secret by US government and leaked with devastating consequences around the world. You can't imply that it's the sole customers' fault by saying that it's "the easiest thing to do - update operating system" without mentioning NSA not cooperating with Microsoft to patch the hole. Many setups require certification which is void after modifications which may include syste…

Why is a comment like this always at the top of one of these HN threads? Does everyone here actually believe that the NSA shouldn't hoard vulnerabilities? I find it hard to believe that people here would collectively be that naive and simple-minded in their thinking. The NSA hoards vulnerabilities for the same reason the military has guns. Because other countries have guns too. This is too obvious a point to be lost…

Another analogy is, NSA has find vaccine for Zika virus, but they haven't released it to public because as if now only they have weaponized it. If some rogue group manages to weaponize Zika, they release the vaccine. Though vaccinating whole world will take few years, US can do so in a matter of months. May cost millions of people in poor countries and 1000s in first world, that's just cost of business.

Unfortunately, for all 3 letter agencies of the world, the analogy may not be far fetched.

Re: Victoria Police cancel hundreds of speeding fines after WannaCry virus attack

#42

Post by jerardope »

ams6110 wrote: post #34

Why do so many commercial embedded devices use Window OS, and generally old versions like NT or XP? Do vendors get a kickback from Microsoft to use Windows in systems that don't even have a display? Otherwise I don't see why they would license Windows instead of using a no-cost BSD or Linux derived OS.

Concerning the display: I've seen it quite often at random public places that when a technician tries to fix something on these devices, he or she will connect an external device with display and touch screen (at least when Windows 8+ is used).

My guess is that maintenance of such systems is just much cheaper. Virtually everyone knows the Windows GUI.

Re: Victoria Police cancel hundreds of speeding fines after WannaCry virus attack

#43

Post by jaimex2 »

DanBC wrote: post #36
kavok wrote: post #33

Earlier quoted context omitted.

I don't see any mention of USB in the article. Can you link a source?

https://www.theguardian.com/australia-news/2017/jun/22/traff... > The department of justice said Victoria’s infection was not the result of a targeted attack, but was caused by a contractor mistakenly connecting infected hardware to cameras. Some sources are calling this a USB stick, the Guardian is being a bit more cautious.

Interesting, I always assumed the cameras transmitted the photos and data back to a source over mobile networks.

Technically this means if someone gets snapped and is desperate enough ( will lose job as a result of losing licence etc ) they can turn back and destroy the evidence.

Re: Victoria Police cancel hundreds of speeding fines after WannaCry virus attack

#44

Post by digi_owl »

jaimex2 wrote: post #43
DanBC wrote: post #36

Earlier quoted context omitted.

https://www.theguardian.com/australia-news/2017/jun/22/traff... > The department of justice said Victoria’s infection was not the result of a targeted attack, but was caused by a contractor mistakenly connecting infected hardware to cameras. Some sources are calling this a USB stick, the Guardian is being a bit more cautious.

Interesting, I always assumed the cameras transmitted the photos and data back to a source over mobile networks. Technically this means if someone gets snapped and is desperate enough ( will lose job as a result of losing licence etc ) they can turn back and destroy the evidence.

Now that you mention it, i recall reading about a local case where someone tried to take out a camera using dynamite.

This revealed that the actual image storage was in a hardened cased buried in the ground some distance from the camera.

I suspect though that these are older installs. And that newer ones, particularly those that issue tickets based on time between two cameras, are networked.

Re: Victoria Police cancel hundreds of speeding fines after WannaCry virus attack

#45

Post by patcheudor »

ams6110 wrote: post #34

Why do so many commercial embedded devices use Window OS, and generally old versions like NT or XP? Do vendors get a kickback from Microsoft to use Windows in systems that don't even have a display? Otherwise I don't see why they would license Windows instead of using a no-cost BSD or Linux derived OS.

I have a oscilloscope which you can regularly find on eBay at a fairly high price. It's an awesome scope that runs XP and will always run XP because the vendor has moved on and no longer supports it. Given the age, it's unrealistic to expect that if they would have used a BSD or Linux kernel that wouldn't be vulnerable to any number of attacks. Thus, I would suggest the question isn't why are manufacturers using Windows, but rather, how can we get to a point where vendors either support their products for the anticipated life of the device or allow end-users to upgrade the kernel and related packages themselves?

Re: Victoria Police cancel hundreds of speeding fines after WannaCry virus attack

#46

Post by 0xfeba »

ams6110 wrote: post #34

Why do so many commercial embedded devices use Window OS, and generally old versions like NT or XP? Do vendors get a kickback from Microsoft to use Windows in systems that don't even have a display? Otherwise I don't see why they would license Windows instead of using a no-cost BSD or Linux derived OS.

Laziness. Even embedded linux things (routers, cameras, etc.) tend to have outdated packages and unnecessary binaries (netcat, etc.) left from the 'standard install'.

Lots of people only "do Windows" so that's the choice they make for the company.

Re: Victoria Police cancel hundreds of speeding fines after WannaCry virus attack

#47

Post by jaclaz »

I am completely failing to see how Wannacry could have affected the operations of those devices AND at the same time leave some data "good enough" to produce the fines.

I presume that essentally it is a photo taking device that superimposes a date/time and detected speed (and maybe also OCR's the license plate).

More or less three or four pieces of data:

1) picture

2) date/time

3) speed

4) (maybe) OCR'ed liense plate number

If any of these items were encrypted it would be evident, and the following step (looking in a database for the ownere of the license plate number) would have returned a null result.

The only way for this to actually work (creating a wrong fine) would be if ONLY the license plate number was encrypted by Wannacry AND the encrypted string matched another existing license plate number.

Re: Victoria Police cancel hundreds of speeding fines after WannaCry virus attack

#48

Post by darawk »

criddell wrote: post #32
darawk wrote: post #8

Earlier quoted context omitted.

Why is a comment like this always at the top of one of these HN threads? Does everyone here actually believe that the NSA shouldn't hoard vulnerabilities? I find it hard to believe that people here would collectively be that naive and simple-minded in their thinking. The NSA hoards vulnerabilities for the same reason the military has guns. Because other countries have guns too. This is too obvious a point to be lost…

> The NSA hoards vulnerabilities for the same reason the military has guns. Because other countries have guns too. The key difference is that we can't make the enemies guns ineffective by accumulating even more guns. The NSA could weaken the enemy's vulnerability stockpile by aggressively chasing and releasing vulnerability information to vendors.

Sure, but as you well know, two distinct sets of actors working to find vulnerabilities are going to find some non-overlapping sets of vulnerabilities. We can't know which ones they've found. In fact, one good way to know what the enemy has is to have some of our own, so we can do some espionage. Which, of course, requires us to possess unpatched vulnerabilities.

Re: Victoria Police cancel hundreds of speeding fines after WannaCry virus attack

#49

Post by darawk »

blackoil wrote: post #41
darawk wrote: post #8

Earlier quoted context omitted.

Why is a comment like this always at the top of one of these HN threads? Does everyone here actually believe that the NSA shouldn't hoard vulnerabilities? I find it hard to believe that people here would collectively be that naive and simple-minded in their thinking. The NSA hoards vulnerabilities for the same reason the military has guns. Because other countries have guns too. This is too obvious a point to be lost…

Another analogy is, NSA has find vaccine for Zika virus, but they haven't released it to public because as if now only they have weaponized it. If some rogue group manages to weaponize Zika, they release the vaccine. Though vaccinating whole world will take few years, US can do so in a matter of months. May cost millions of people in poor countries and 1000s in first world, that's just cost of business. Unfortunately…

A better analogy might be, the NSA knows that every other country in the world has weaponized a wide variety of viruses. The NSA has also weaponized and created vaccines for a wide variety of viruses. They know that they can't vaccinate the US population without tipping off the enemy to what they have. If they tip off the enemy to what they have, all their weaponized viruses become ineffective, and all of the sudden, the enemy is the only one with effective weaponized viruses.

Re: Victoria Police cancel hundreds of speeding fines after WannaCry virus attack

#50

Post by darawk »

boomboomsubban wrote: post #27
darawk wrote: post #8

Earlier quoted context omitted.

Why is a comment like this always at the top of one of these HN threads? Does everyone here actually believe that the NSA shouldn't hoard vulnerabilities? I find it hard to believe that people here would collectively be that naive and simple-minded in their thinking. The NSA hoards vulnerabilities for the same reason the military has guns. Because other countries have guns too. This is too obvious a point to be lost…

>The NSA hoards vulnerabilities for the same reason the military has guns. Because other countries have guns too. This is too obvious a point to be lost on the readers here Not remotely the same thing. The Army hoards guns in case we enter a war and need them. The NSA hoards vulnerabilities so they can spend more time using them on our allies, fellow citizens, anf our enemies.

We use guns plenty on our allies and fellow citizens. We just call it 'police' when we do that.
Post reply on HN