Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

mobile.nytimes.com

Post reply on HN
Print view View original

361–370 of 505 posts

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#361

Post by briandarvell »

bluGill wrote: post #34
eggbrain wrote: post #19

Earlier quoted context omitted.

> It sounds like the basic (?) security practices recommended by professionals - keep systems up-to-date, pay attention to whether an email is suspicious - would have covered your network. This is secondhand information (so take it for what it's worth, there could be pieces I'm missing), but I talked with a startup that was focusing on this problem, and the issue was not quite the computers and servers that IT were u…

In defense of these medical devices, that is actually a FDA requirement. The entire combination of the system is certified to work, and even one patch for a security vulnerability leaves open the possibility that the patch breaks something and people die! Of course it goes without saying that you need to ensure that a virus cannot run on this machine by some other means. If these machines can get infected they automa…

If that's the case that's fine, but then my question is why are these computers networked to any extranet source? It seems a natural conflict: you cannot update the system due to it being so important that it always works, yet we need to attach it to an outside network which allows risk of infection. In my opinion, if the computer HAS to be connected to a network that is accessible from outside, then it MUST be allowed to be updated with latest antivirus/protection updates.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#362

Post by WheelsAtLarge »

Wow, the future is here and it's not looking very good. We need to diversify our OS's in the enterprise. This time it was MSFT next it could be linux. No OS gives an absolute guarantee. The systems are relatively dumb now what will happen when AI has gotten deeper into our everyday lives. This is a wake up call.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#364

Post by [deleted] »

mjevans wrote: post #128
a2tech wrote: post #78

Earlier quoted context omitted.

This 100x. I know it's extremely easy to Monday morning quarterback hospital IT but it's not as simple as people think. There's legal and, far more importantly, medical implications to updating software at a hospital. Oh you think it's ridiculous we use i.e. 7 in compatibility mode? It's because our mission critical emr only works in that (well it really works in everything but it's certified in 7) and if we use anyt…

Yes, it actually is. Life critical systems should be small, fully open stack, fully audited, and mathematically proven to be correct. Non-critical systems, secondary information reporting, and possibly even remote control interfaces for those systems should follow industry best practices and try to do their best to stay up to date and updated. Most likely many modern pieces of medical technology have not been designe…

[deleted]

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#365

Post by aswanson »

erikpukinskis wrote: post #329
kartan wrote: post #310

Earlier quoted context omitted.

> Patriotism is both a wonderful and terrible thing I found that hypothesis widely accepted, without so much for it. Patriotism fuses core values like freedom or solidarity with a flag. That's why it is easier to pervert. Patriotism tells people that because there are people born in the same line limits that you, you should be proud of what they do, and you should help them first. Patriotism distorts history. > "Four…

Patriotism was temporarily necessary while we rapidly increased standard of living for ourselves, and didn't have enough resources to do it globally. In the early 21st century it was still a zero sum game on subdecade timescales. Now we have more than enough resources to provide basics for all 10 billion of us (and decreasing) so patriotism has largely been confined to friendly rivalry around sports and regional cuis…

16s? No Neuralink?

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#366

Post by tootie »

jps359 wrote: post #162
turnip123942 wrote: post #60

I think this is an excellent example that we can all reference the next time someone says that governments should be allowed to have backdoors to encryption etc. This shows that no agency is immune from leaks and when these tools fall into the wrong hands the results are truly catastrophic.

also that it is very unethical for the US government to find some vulnerability in android/windows/whatever and not report it

Were all of these unreported?

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#367

Post by tootie »

jps359 wrote: post #162
turnip123942 wrote: post #60

I think this is an excellent example that we can all reference the next time someone says that governments should be allowed to have backdoors to encryption etc. This shows that no agency is immune from leaks and when these tools fall into the wrong hands the results are truly catastrophic.

also that it is very unethical for the US government to find some vulnerability in android/windows/whatever and not report it

Were all of these unreported?

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#368

Post by tehlike »

r00fus wrote: post #308
mhogomchungu wrote: post #61

Earlier quoted context omitted.

He has backups of his data. I personally use linux and my github repo is here[1] where i have a bunch of encryption related projects(zuluCrypt,SiriKali and lxqt_wallet). The last windows computer i used was windows xp. I dont want to move him to linux because i am not always around and he can ask other people for help when he is on windows. [1] https://github.com/mhogomchungu

Are macOS or ChromeOS options? Heck, some of my relatives are good with an iPad for 90% of their online activities.

Chromeos and everything in browser sandbox with always up to date software sounds pretty solid.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#369

Post by viraptor »

data4science wrote: post #316
a2tech wrote: post #78

Earlier quoted context omitted.

This 100x. I know it's extremely easy to Monday morning quarterback hospital IT but it's not as simple as people think. There's legal and, far more importantly, medical implications to updating software at a hospital. Oh you think it's ridiculous we use i.e. 7 in compatibility mode? It's because our mission critical emr only works in that (well it really works in everything but it's certified in 7) and if we use anyt…

I'm curious, not trying to be smart: 1. Would running Windows 7 in a VM violate the certified software load? 2. Is new device software being written to run in containers/hypervisor level? I could understand if 1 would be a violation, but perhaps, after today, the FDA could fast track manufacturer patches to run software loads on VMs? I don't imagine 2 would solve current infrastructure issues any time soon given the…

Usually you get the system integrated into some panel of the device. It's not the software itself that's certified. It's the device as a whole with everything running on it, hypervisors included.

Re: Cyberattacks in 12 Nations Said to Use Leaked N.S.A. Hacking Tool

#370

Post by viraptor »

bsder wrote: post #197
lazaroclapp wrote: post #172

Earlier quoted context omitted.

In offense of these medical devices, they should never have been running Windows or any general purpose OS in the first place! A lot easier to guarantee security if the entire thing is a well tested 10-50KLOC Rust daemon on top of seL4. I am not even asking them to do formal verification themselves, just a small trusted base and reasonable secure coding practices. I mean, come on, a critical medical device running th…

> In offense of these medical devices, they should never have been running Windows or any general purpose OS in the first place! Except that people don't want to learn a new GUI for every machine... Except that people want to be able to use a tablet for the interface... Except that people want to control things from their phone... Here's the reality: The end user doesn't give one iota of DAMN about security. People w…

Most of these don't apply in context of medical devices. Sure, you can find some which will give you access to the usual OS desktop. But largely they're integrated and have a full-screen, completely customised interface
Post reply on HN