Live data from Hacker News

Why older tech is sometimes safer from hackers

bbc.com

41–50 of 87 posts

Re: Why older tech is sometimes safer from hackers

#41

Sadly, the real lesson we need to learn from Battlestar Galactica is not this. They weren't saved by old software, they were saved by not having critical systems on the network unnecessarily. Our water and power utilities need to re-watch the pilot.

The point is NOT older, rather decentralized!

From a efficiency perspective centralized anything seems better at first glance, however decentralized anything just seems more resilient in the long run like nature and/or our universe.

Re: Why older tech is sometimes safer from hackers

#42
Reminds me of a sci-fi book I read where the protagonist goes to hack a computer but can't because it's running a 50 year old alien OS that none of his tools will run on.

That said, as a strategy it will only protect you from bots going after low-hanging fruit, not someone targeting you specifically.

Re: Why older tech is sometimes safer from hackers

#43
I am one of those emacs users who use it for everything, it always worries me the way that it could be attacked given (particularly email some how evaling some elisp or something), Despite how easy emacs would be to exploit in many aspects I do not know of any attack done on emacs either through supply chain attack (think about how many third party libs an emacs mode might use) or one of the many ways that it's no doubt possible to get emacs to eval something the user would not want it to do. If anyone knows why or if their has been an attack on emacs I would love to know.

Re: Why older tech is sometimes safer from hackers

#44
post #8

It's incredible how far back the surveillance state goes - GSM mobile phones have an IMEI number that's tied to the handset - and the SIM is tied to the subscriber, and your phone broadcasts imei to neighboring towers constantly. I haven't really gotten really into this, but from what I can tell, anything that has to do with mobile phones is strictly worse in terms of anonimity than Wifi. At least anything that ties…

> surveillance state How do you suppose mobile phones are meant to work without subscriber info? > I haven't really gotten really into this Clearly.

I think the argument is more the IMEI side of things, one might naively expect that they could could simply change SIM and that would change ones identity and that anything like an IMEI could be easily configurable like how a MAC is on a NIC is.

Re: Why older tech is sometimes safer from hackers

#45
Another reason is that a lot of tech from 20 years ago uses the QNX microkernel operating system, which is highly secure even when the software is never patched.

The problem is that most of these older devices are about to be replaced and many manufacturers have switched to Linux for their operating system. It's cheaper and requires no licensing, but far more insecure. It needs almost constant patching to stay secure because the attack surface is so large.

Re: Why older tech is sometimes safer from hackers

#46
post #16
post #2

MS-DOS: Over 45 years, and STILL NO remote holes in the default install!

Well, there is no protection against compromised floppy disk sent by snail mail. I have also seen virus source code published in books and magazines. We don't have such threats anymore.

--

virus source code published in books and magazines. We don't have such threats anymore.

--

No, we do not need this anymore - today you have CAPTCHAs, convincing people to copy & paste PowerShell code on their machine and execute it with Admin privileges! :-D

Re: Why older tech is sometimes safer from hackers

#47
post #38

Earlier quoted context omitted.

which reasons?

Remote monitoring is one of them presumably

But is it completely impossible to separate the monitoring and equipment/management?

Stupid example like the equipment itself is not networked, but you could watch via a webcam and/or get metrics via image recognition.

Maybe it's safer just to have somebody work the night shift.

Re: Why older tech is sometimes safer from hackers

#48
post #5

Makes it harder to catch you in a general sweep, but it probably makes it much easier if anyone decides to target you specifically. How good a tradeoff that is varies from person to person. And the difficulty of targeting a specific person is changing in an AI world. I wouldn't try to characterize it any farther than that, just to observe that it is changing. "Hey AI go individually research and target county clerks…

It reminds me of an interview with police detectives. They say that some criminals think that using weapons like swords and bows will make the police job harder because police is so used to deal with guns that they may have a blind spot.

The thing is: police actually have data on swords and bows, and the fact it is so unusual to commit crimes with these limit the search space and tend to make the investigation easier.

Re: Why older tech is sometimes safer from hackers

#49

Sadly, the real lesson we need to learn from Battlestar Galactica is not this. They weren't saved by old software, they were saved by not having critical systems on the network unnecessarily. Our water and power utilities need to re-watch the pilot.

Why are our water and power utilities connected to the internet? Is it so that the employees controlling them can work from home? If so they are accepting too much risk relative to the benefit.

think about a grid responding to demand. The old model (like the titanic) had a remote manager phoning the site lead who phoned the control room who phoned the engineering room.

Remote management has clear benefits, don’t be obtuse. I totally agree on the security risks, but the benefits are obvious.

Re: Why older tech is sometimes safer from hackers

#50

Earlier quoted context omitted.

Remote monitoring is one of them presumably

But is it completely impossible to separate the monitoring and equipment/management? Stupid example like the equipment itself is not networked, but you could watch via a webcam and/or get metrics via image recognition. Maybe it's safer just to have somebody work the night shift.

No, and it's not strictly impossible to correctly build out a SOC / SIEM and ingest all the logs you want and pay for the right engineers to make sure it all works correctly. But damned if anyone manages to do a great job in this area. It's too complex and too expensive, so almost everyone settles for "best effort."

A lot of problems are easy conceptually, but we can't manage to tackle them.

Post reply on HN