Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

The Mirai Botnet Is Proof the Security Industry Is Broken

blog.appcanary.com

Post reply on HN
Print view View original

241–250 of 260 posts

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#241

Post by stevetrewick »

505 wrote: post #228
stevetrewick wrote: post #164

Earlier quoted context omitted.

> You could have no security and just get lucky and never get hacked. It's been a decade and more since that was even remotely true (if it ever was). Back in 2008 the average survival time of an unpatched internet facing XP box was around 4 minutes [0]. Pwning an unpatched XP box was (very marginally) harder than pwning a system with no security at all. The Morris worm (Edit: which is heavily mentioned in TFA, my bad…

Probably just a typing error in your otherwise fine post, but the Morris worm was 1988.

Indeed, good catch.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#242

Post by MichaelBurge »

rgbrenner wrote: post #189
Animats wrote: post #106

As I said previously, someone needs to bring negligence suits against some IoT vendors, wholesalers, and retailers. Start with the retailers, like Amazon. They'll find the supply chain for you as they try to pass the buck. It worked with hoverboards. There's a problem at the China end with crap low-end devices driving out the good ones. Here's a good example: solid state relays, useful little devices for safely switc…

someone needs to bring negligence suits against some IoT vendors, wholesalers, and retailers IANAL, so I wonder if that would actually work. Especially since everyone always attaches the standard no-warranty disclaimers to software (and we're talking about vulnerabilities in the software on these devices). Maybe we need to give the FCC power similar to the CPSC.. they can issue recalls of unsafe products (or in the c…

I'm not sure those disclaimers work. They usually say something like, "We disclaim all warranties, including fitness for a particular purpose"

And then you look on their marketing pages and call their sales people, and they tell you all the particular purposes for which their software is a perfect fit.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#243

Post by _pdp_ »

raesene9 wrote: post #67
_pdp_ wrote: post #46

There is no cure for weak passwords.

Of course there is, in cases like this anyway. The problem here wasn't weak passwords, it was that all the passwords were the same, so it was trivial to automate the attack (well that and the devices had a command injection vuln.) That can be fixed by requiring users to set a unique password on setup, or shipping each device with a different password. This exact problem occurred in the UK where ADSL router manufactur…

Really? Assuming the user will choose a very secure password! :) That totally works in real life.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#245

Post by onion2k »

ArchReaper wrote: post #82
onion2k wrote: post #22

Earlier quoted context omitted.

If you want to go after the simple stuff then blocking significant outbound traffic at the ISP level from a home user account until they agree it's something they want to do is the most straightforward solution. No need to change much infrastructure, no need to test devices, and no need to have costly manufacturing processes. You could even let specific traffic through (Facebook live streaming, online gaming services…

That sounds like a terrible idea. You think every end user, everywhere, needs to manually verify with their ISP for every single outbound connection? How could that possibly be an acceptable solution?

I think you misread or misunderstood what I meant by "blocking significant outbound traffic". 99.9% of what home users do doesn't generate significant amounts of outbound traffic. If someone typically browsers the web, sends a few emails, and then their traffic starts doing 20Mbps/s on an undocumented port, blocking that traffic until they verify what it is wouldn't be a bad idea. It wouldn't affect most users.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#246

Post by kahrkunne »

scrollaway wrote: post #209
Animats wrote: post #106

As I said previously, someone needs to bring negligence suits against some IoT vendors, wholesalers, and retailers. Start with the retailers, like Amazon. They'll find the supply chain for you as they try to pass the buck. It worked with hoverboards. There's a problem at the China end with crap low-end devices driving out the good ones. Here's a good example: solid state relays, useful little devices for safely switc…

Given that most of the ddos attacks come from China, isn't it a reasonable assumption that the Chinese manufacturers are complicit in keeping the system broken?

The Chinese are not a hive mind. The people ddosing are not the people making technology.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#247

Post by paulryanrogers »

redbeard0x0a wrote: post #217
whack wrote: post #49

Earlier quoted context omitted.

That's a great point regarding the economics of why IoT manufacturers don't invest all that much on security. Here's another one. It's an externality. Botnet attacks don't harm the IoT manufacturers. They don't even harm the IoT products or their users. They harm completely innocent bystanders like DNS/github. What possible incentive do IoT manufacturers have to invest money on initiatives that bring no benefits to t…

If ISPs turned off your connection if it was found that something on your network is part of an active attack of a botnet until the problem is cleaned up. Now the 'victim' (I'd not really say victim because they chose the cheapest webcam online) has to figure out (or hire somebody to) clean up their network. If there are actual consequences for people's computers and IoT devices being 'hacked', they will start to loo…

This seems the most practical, though I imagine the consumer is likely going change their ISP until they find one that won't. So ISPs have no incentive to do this unless they're regulated.

If customers or ISPs had tools to find out which devices were at fault then it may be more feasible.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#248

Post by pjc50 »

st3v3r wrote: post #200
rfrank wrote: post #160

Earlier quoted context omitted.

Counterfeit component risk and bad security for an assembled IoT device are two separate issues. Sourcing components on Amazon in the first place is ludicrous to me, to be honest, and I'd be shocked if any reputable EMS companies do it. As an aside, a couple years ago I saw some guys from NXP do a talk on component counterfeiting. People will apparently remove them from dead boards, shave a few microns of material of…

"Sourcing components on Amazon in the first place is ludicrous to me, to be honest" I'm a hobbyist, I have Amazon Prime, and I would like to use components in a project. What's ludicrous about that?

It's fine as a hobbyist, but once you're making 1000+ then the only way Amazon (which doesn't do volume pricing I think?) can be cheaper is by selling you fakes.

As a hobbyist I buy stuff from ebay, amazon, and aliexpress all the time, but not for anything mains-powered or safety-critical.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#249

Post by sk5t »

cm2187 wrote: post #240
sk5t wrote: post #221

Earlier quoted context omitted.

The point is that it still costs more, on average, to hire the person who understands how to avoid SQL injection by using the right tools/syntax. The person who only understands string concatenation and basic SQL will always be available to hire.

And again you are assuming that these vulnerabilities are introduced by cheap untrained or foreign programmers. Massive silicon valley firms who pay top market rates do the same mistakes. I am sure there is a correlation between pay level and understanding of security but we are very far from a position where if you hire a team of developper, a business can have any confidence that they won't do something dumb like m…

> I am sure there is a correlation between pay level and understanding of security

Good, then maybe you can see a path forward to stop arguing the opposite?

Yes, it is possible to pay a lot for a little. Developed country, less developed country, wherever. It remains, nevertheless, relatively less expensive to hire an inexperienced coder than it is to hire an experienced one, who has a greater likelihood of being security-conscious. But no formal mechanism prevents the inexperienced coder from finding work cranking out unreviewed programs.

Re: The Mirai Botnet Is Proof the Security Industry Is Broken

#250

Post by pjc50 »

dredmorbius wrote: post #218
Animats wrote: post #106

As I said previously, someone needs to bring negligence suits against some IoT vendors, wholesalers, and retailers. Start with the retailers, like Amazon. They'll find the supply chain for you as they try to pass the buck. It worked with hoverboards. There's a problem at the China end with crap low-end devices driving out the good ones. Here's a good example: solid state relays, useful little devices for safely switc…

A Nashville, TN, family are suing Amazon for $30 million following a hoverboard fire which destroyed their $1m home. http://www.wtsp.com/money/family-sues-amazon-after-hoverboar... The control points are rapidly becoming retail and payment systems. Suing Amazon, Walmart, Visa, MasterCard, Paypal, etc., for facilitating the commerce of counterfeit and manifestly harmful products seems to be the logical evolution.

Retailers have always been the first point of liability for products. In some jurisdictions it was hard to sue the manufacturer directly - after all, they're not the one you had a contract with.

Payment processors are another matter IMO, and should not be made into product police or underwriters.

Post reply on HN