I know someone who works at a data center for the IRS, and a lot of their records are all stored in PDFs. He thought it was disgusting when he first learned about it, but eventually realized that it's essentially resistant to a large scale data leak. Retrieval just isn't fast enough.
Why older tech is sometimes safer from hackers
21–30 of 87 posts
Re: Why older tech is sometimes safer from hackers
#22>But the team picked an older software version for their honeypot that had been upgraded multiple times since its release and, consequently, no hackers bothered to target it. "When we upgraded it to the new one, we had all the attacks we wanted," recalls Bishop. "I thought it was so amusing." It feels like fantasy imo While I could understand using outdated or not popular protocols, then software with known vulns see…
Let's say your security budget is pretty limited, and you can say with relative certainly that there's only a 0.1% chance of any adversary bothering to check the known flaws in your FossileWare(tm) Firewall in a given month. Vs.how many dire flaws have been found in big-name security products in the past year, that even a low-budget adversary is likely to be regularly checking for?
> a 0.1% chance of any adversary bothering to check the known flaws in your FossileWare(tm) Firewall in a given month.
How would you arrive at this percentage in your risk analysis?
Re: Why older tech is sometimes safer from hackers
#23I know someone who works at a data center for the IRS, and a lot of their records are all stored in PDFs. He thought it was disgusting when he first learned about it, but eventually realized that it's essentially resistant to a large scale data leak. Retrieval just isn't fast enough.
How is it resistant? Can't all the pdfs just be leaked?
Re: Why older tech is sometimes safer from hackers
#24I understand BBC may not have the technical background to critically assess this approach, but whoever using Eudora (I loved it in 2001 btw) for security should get their credentials removed via King's order. Security through "obsolescence" is no different from security through obscurity - therefore, it doesn't work. Somebody not bothering to look for holes in your software doesn't mean they don't exist - in the age…
wait until you find out that a large percentage of operating system developers use mutt, alpine or mail.
Re: Why older tech is sometimes safer from hackers
#25It's incredible how far back the surveillance state goes - GSM mobile phones have an IMEI number that's tied to the handset - and the SIM is tied to the subscriber, and your phone broadcasts imei to neighboring towers constantly. I haven't really gotten really into this, but from what I can tell, anything that has to do with mobile phones is strictly worse in terms of anonimity than Wifi. At least anything that ties…
One of the things about mobile phone is that there's 2 OSes on the phone: one that handles the phone stuff and the other that you as a user actually interact with. What's really scary about it is that the OS we do not think about is often licensed to the manufacturer (Apple, Samsung, etc.), closed-source, and dated. There's a lot of security firms that sell fake cell towers to law enforcement and governments and that…
I think this how modern CPUs work also.
Re: Why older tech is sometimes safer from hackers
#26Daily reminder that connecting everything to the cloud was a terrible idea and should never have happened like it did.
Re: Why older tech is sometimes safer from hackers
#27> Interest in magnetic tape is only increasing further today because the cost of random access memory (Ram), a form of computer memory that doesn't rely on tape, is skyrocketing. hmm
Sign of quality journalism? LLM's probably would not have made such a misstake ..
Re: Why older tech is sometimes safer from hackers
#28This seems largely to be about security by obscurity.
I was hoping it was gonna be about how our modern practices are making things less secure.
For instance, we claim we need to be able to rapidly update clients so that we can patch security vulnerabilities as they are discovered (often without involving the user at all). And there are a lot of companies that have an incentive to push this narrative because they have products which facilitate this whack-a-mole approach to security. But there's no reason to believe that new software is more secure than old software. Old software is just more likely to be known to be insecure. So anything written before it became trendy to update without your user's consent is more secure in at least one way because it is not configured to automatically update to whatever comes down the pipe from "the vendor".
Re: Why older tech is sometimes safer from hackers
#29I know someone who works at a data center for the IRS, and a lot of their records are all stored in PDFs. He thought it was disgusting when he first learned about it, but eventually realized that it's essentially resistant to a large scale data leak. Retrieval just isn't fast enough.
How is it resistant? Can't all the pdfs just be leaked?
Presumably the pdfs are so large that moving any significant chunk of them over available bandwidth takes so much time, and requires so much storage, that doing so just isn't useful for the attacker.
While I don't know any of the relevant numbers involved, imagine a scenario where exfiltrating even 10% of the total data would take years. What would be the point?
A malicious actor can target individual records, but leaking a lot of them becomes impractical.
Re: Why older tech is sometimes safer from hackers
#30I know someone who works at a data center for the IRS, and a lot of their records are all stored in PDFs. He thought it was disgusting when he first learned about it, but eventually realized that it's essentially resistant to a large scale data leak. Retrieval just isn't fast enough.
How is it resistant? Can't all the pdfs just be leaked?
Right, the entire PDF.
You can't just create a tiny csv of the records you want. You need to upload GBs of data which is easily noticed by any of the routers involved.
Although I mean just because somebody noticed data is being leaked they might not have the authority to stop that doge employee or whomever.