431–440 of 505 posts
Earlier quoted context omitted.
Well this justifies MS's decision for forced updates in Win10. Not that I like it, just saying.
It justifies security updates for all operating systems. It does not justify the installation of spyware or changes to the user interface.
One of the big problems here will be for any country which makes a lot of use of older computers using Windows XP as there is no patch for this vulnerability on that OS version. How many systems that is, is debatable but by at least one benchmark ( https://www.netmarketshare.com/operating-system-market-share... ) we're looking at 7% of the desktop PC market that could be exposed with no patch available.
Not anymore: https://blogs.technet.microsoft.com/msrc/2017/05/12/customer...
Earlier quoted context omitted.
In offense of these medical devices, they should never have been running Windows or any general purpose OS in the first place! A lot easier to guarantee security if the entire thing is a well tested 10-50KLOC Rust daemon on top of seL4. I am not even asking them to do formal verification themselves, just a small trusted base and reasonable secure coding practices. I mean, come on, a critical medical device running th…
> In offense of these medical devices, they should never have been running Windows or any general purpose OS in the first place! Except that people don't want to learn a new GUI for every machine... Except that people want to be able to use a tablet for the interface... Except that people want to control things from their phone... Here's the reality: The end user doesn't give one iota of DAMN about security. People w…
Earlier quoted context omitted.
In defense of these medical devices, that is actually a FDA requirement. The entire combination of the system is certified to work, and even one patch for a security vulnerability leaves open the possibility that the patch breaks something and people die! Of course it goes without saying that you need to ensure that a virus cannot run on this machine by some other means. If these machines can get infected they automa…
In offense of these medical devices, they should never have been running Windows or any general purpose OS in the first place! A lot easier to guarantee security if the entire thing is a well tested 10-50KLOC Rust daemon on top of seL4. I am not even asking them to do formal verification themselves, just a small trusted base and reasonable secure coding practices. I mean, come on, a critical medical device running th…
Moreover, the manufacturer have the obligation to assess every known bug of every SOUP and provide fixes if this can endanger the patient.
The issue is that to prove that a device is safe you have to execute costly tests. For a device I have been working on, we do endurance tests on multiple systems to simulate 10 years of use. Even with intensive scenario, on multiple systems it can take a few months. And if we encounter a single crash we reset the counter and start again. So in the end the product is safe but it is costly. This is why most of the time it is actually better to have the most simple stack possible on bare metal. But sometimes mistakes have been made, and you inherit a system full of SOUP and this is a nightmare to maintain.
I actually except some shitstorm on Monday morning, luckily I am working more on the embedded side so no Windows for me but some other divisions will be affected.
There is not a single proof or reason to believe that the second leak was not a fake (while the vault7 leak looks more legit) .
There are reasons to think that the same people are behind the second leak and the malware, and the malware, which is said to be based on "a leaked NSA exploit", was the part of a single plan.
It is not that hard to guess who is behind the internet bullying.
Earlier quoted context omitted.
NSA made a weapon with the purpose of harming someone. In court, intent matters.
So: A makes a product with flaws, B makes an exploit, C leaks that exploit, D adds a harmful payload to the exploit and goes on to extort/profit from E, who has computers systems they failed to patch in time... and somehow B and only B is at fault?
It's not 12 nations.... it's all over the world...
The real world doesn't update in 2 months. (I wish it did.) The NSA should have responsibly disclosed the vulnerabilities they had been sitting on as soon as they were discovered. That protects national security - not this.
Earlier quoted context omitted.
The doctors' PC can run just fine on an isolated network and doesn't have to be connected to the internet.
So you propose a separate, isolated network linking all the medical facilities, doctor's offices and private practices nationwide? Even the military doesn't do that for most of their offices. Also, the doctor's computer pretty much needs to interface with the system(s) that handles patient billing (and thus non-medical companies) and the system(s) that handle patient scheduling, reminders, etc.
Not really an issue in the NHS, apart from the occasional non-resident foreign national.
(The "fundholding" system does mean there's a certain amount of internal billing which the patient is never aware of, but the beating Bevinist heart of the free-at-point-of-use system is still in place)
> "Microsoft rolled out a patch for the vulnerability last March, but hackers took advantage of the fact that vulnerable targets — particularly hospitals — had yet to update their systems." > "The malware was circulated by email; targets were sent an encrypted, compressed file that, once loaded, allowed the ransomware to infiltrate its targets." It sounds like the basic (?) security practices recommended by professio…
> It sounds like the basic (?) security practices recommended by professionals - keep systems up-to-date, pay attention to whether an email is suspicious - would have covered your network. This is secondhand information (so take it for what it's worth, there could be pieces I'm missing), but I talked with a startup that was focusing on this problem, and the issue was not quite the computers and servers that IT were u…