Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Why older tech is sometimes safer from hackers

bbc.com

Post reply on HN
Print view View original

81–87 of 87 posts

Re: Why older tech is sometimes safer from hackers

#81

Post by rbanffy »

JacobKfromIRC wrote: post #51
postexitus wrote: post #6

I understand BBC may not have the technical background to critically assess this approach, but whoever using Eudora (I loved it in 2001 btw) for security should get their credentials removed via King's order. Security through "obsolescence" is no different from security through obscurity - therefore, it doesn't work. Somebody not bothering to look for holes in your software doesn't mean they don't exist - in the age…

I would be curious to know what kind of vulnerabilities the latest version of Eudora (7.1.0.9 I think) has. With how old it is (2006), surely there are several critical vulnerabilities, but all I could find when looking online is that an IMAP server or SMTP server can execute arbitrary code, which doesn't seem likely to cause a real problem, because I wouldn't expect Google, Yahoo, Microsoft, etc. to use this trick.…

> an IMAP server or SMTP server

I hope they are authenticating the server to prevent MITM attacks.

Re: Why older tech is sometimes safer from hackers

#82

Post by rbanffy »

The whole “they won’t hack me because they won’t bother to target Eudora running on AIX 3.1” is flawed in an age when AI is both ubiquitous and cheap. It wasn’t worth targeting you because it required the attention of a human, but now it requires just a few seconds of a GPU server that’s running on stolen credentials.

This is the thing with AI - it has an infinite capacity to do things - the same way we find new RCEs by the dozen so we can fix them, our attackers find them so they can get infiltrate our systems.

Re: Why older tech is sometimes safer from hackers

#83

Post by rbanffy »

fhdkweig wrote: post #12
chrisvls wrote: post #11

Sadly, the real lesson we need to learn from Battlestar Galactica is not this. They weren't saved by old software, they were saved by not having critical systems on the network unnecessarily. Our water and power utilities need to re-watch the pilot.

To be fair, it was both. Those ships that got the recent upgrades also got trojans that Caprica Six put in the defense mainframe with Baltar's access codes.

Adding a layer of obscurity on top of your non-obscure security is a good idea. The more slices of swiss cheese you wrap your system with, the smaller the odds of the holes aligning.

Re: Why older tech is sometimes safer from hackers

#84

Post by Ekaros »

burger wrote: post #76
saltcured wrote: post #69

Earlier quoted context omitted.

Because other replies aren't really stating it explicitly, let me add... The water and power utilities are themselves large distributed systems. They need communications between elements just to function properly. They don't exist in a single location where people can go locally manage them in some air-gapped, offline fashion. There is no option of not having a communication network to monitor and manage these geogra…

That explains why they are networked, not why internet access is required. The problem of secure networking has been solved long ago but there is no incentive for OT solution architects to get it right.

In the end real reason is always cost. Connecting straight to internet is extremely cheap. Anything else is somewhat more expensive.

Re: Why older tech is sometimes safer from hackers

#85

Post by postexitus »

trashb wrote: post #24
postexitus wrote: post #6

I understand BBC may not have the technical background to critically assess this approach, but whoever using Eudora (I loved it in 2001 btw) for security should get their credentials removed via King's order. Security through "obsolescence" is no different from security through obscurity - therefore, it doesn't work. Somebody not bothering to look for holes in your software doesn't mean they don't exist - in the age…

wait until you find out that a large percentage of operating system developers use mutt, alpine or mail.

mutt is still being actively developed. Being on command line doesn't make something legacy. Eudora on the other hand had its latest version out 2 decades ago - it lacks even the most basic security updates (starting from TLS, but many more).

Re: Why older tech is sometimes safer from hackers

#86

Post by postexitus »

badsectoracula wrote: post #67
postexitus wrote: post #6

I understand BBC may not have the technical background to critically assess this approach, but whoever using Eudora (I loved it in 2001 btw) for security should get their credentials removed via King's order. Security through "obsolescence" is no different from security through obscurity - therefore, it doesn't work. Somebody not bothering to look for holes in your software doesn't mean they don't exist - in the age…

> in the age of Claude - I am pretty sure I can destroy your legacy software in minutes. Yes but you'd need to a) know that they use that particular software and b) have a reason to bother destroying it in the first place. That is really the crux of the idea. The client the guy in the article uses isn't secure because it has no security vulnerabilities - it is secure because nobody bothers to target Eudora users in g…

True - you avoid widespread attacks, but you become super vulnerable for targeted ones.

Re: Why older tech is sometimes safer from hackers

#87

Post by flowerlad »

saltcured wrote: post #69
flowerlad wrote: post #36

Earlier quoted context omitted.

Why are our water and power utilities connected to the internet? Is it so that the employees controlling them can work from home? If so they are accepting too much risk relative to the benefit.

Because other replies aren't really stating it explicitly, let me add... The water and power utilities are themselves large distributed systems. They need communications between elements just to function properly. They don't exist in a single location where people can go locally manage them in some air-gapped, offline fashion. There is no option of not having a communication network to monitor and manage these geogra…

> The water and power utilities are themselves large distributed systems.

For power I can understand. For water supply it is harder to understand. Does water supply have similar characteristics to power, for example can you turn on a reservoir when there is an “outage” in another?

Post reply on HN