91–100 of 174 posts
I call BS. How does an ECM (or anti-lock brake controller) "slam on the brakes"?
Earlier quoted context omitted.
Terrible advice to pull a media stunt. First, you have no idea what the manufacturer needs to do to fix the problem, alert customers, do recalls and recertifications, and the like. Second, you put yourself directly in the line of fire unnecessarily and for all the wrong reasons. You could find yourself on the end of all kinds of legal trouble, and on top of that you would be morally culpable for any harm. Do it the r…
> get a lawyer Because this is the world we should want to live in? Where you must pay a member of the protection racket to mediate publishing knowledge of someone else's extreme wrongdoing? That is terrible advice. Its road ends with TORified disclosures of weaponized automated exploits, because as pure info sec has shown, that's the only way the message ever gets across when you give people the insulation to not li…
It would be interesting if someone created a payload that patches exploited device.
Earlier quoted context omitted.
There's no need to call CNN. We have Youtube now, which would arguably be a more effective medium if the video can achieve any level of virality.
I'd guess the demographic that cares about this does not go on YouTube enough to make it more effective.
Earlier quoted context omitted.
> get a lawyer Because this is the world we should want to live in? Where you must pay a member of the protection racket to mediate publishing knowledge of someone else's extreme wrongdoing? That is terrible advice. Its road ends with TORified disclosures of weaponized automated exploits, because as pure info sec has shown, that's the only way the message ever gets across when you give people the insulation to not li…
Can you elaborate on how lawyers are "member[s] of the protection racket"?
Earlier quoted context omitted.
> get a lawyer Because this is the world we should want to live in? Where you must pay a member of the protection racket to mediate publishing knowledge of someone else's extreme wrongdoing? That is terrible advice. Its road ends with TORified disclosures of weaponized automated exploits, because as pure info sec has shown, that's the only way the message ever gets across when you give people the insulation to not li…
> Because this is the world we should want to live in? Where you must pay a member of the protection racket to mediate publishing knowledge of someone else's extreme wrongdoing? Might be useful to distinguish between the ideal and the actual: in an ideal world, you of course shouldn't need a lawyer and the manufacturers should smilingly thank anyone who discovers an exploit and tells them. In this less-than-perfect w…
Call up CNN and offer to demonstrate how BIOTRONIC is so evil that they refuse to fix their pacemakers. Hook it up to an ECG and use your phone to make it flatline. Then turn to the camera and tell the audience, "because BIOTRONIC doesn't want to pay to fix their product, I can now kill your grandmother just by walking past her on the street." Watch how long it takes them to fix it then, and watch how reactive they b…
Watch how long it takes them to fix it then... That strikes me as really optimistic. Another scenario: Medical equipment manufacturing lobby (I'm assuming there is such a thing) pushes to have such disclosures treated as acts of terrorism. Manufacturer issues a patch that fixes your very specific vulnerability in some trivial, meaningless way. Your career is ruined. Pacemakers truly secured: 0.
Yes, there is a lobby.
Earlier quoted context omitted.
> get a lawyer Because this is the world we should want to live in? Where you must pay a member of the protection racket to mediate publishing knowledge of someone else's extreme wrongdoing? That is terrible advice. Its road ends with TORified disclosures of weaponized automated exploits, because as pure info sec has shown, that's the only way the message ever gets across when you give people the insulation to not li…
Can you elaborate on how lawyers are "member[s] of the protection racket"?
Absolutely NOT because this could kill people. If you truly have a pacemaker 0day, contact me (joelparkerhenderson) on most major service and I will connect you with my healthcare policy lawyer. She can rapidly open the doors to the vendors who have the risk.
The question isn't whether it could kill people, but whether it would kill fewer people than not releasing the exploit. (Though even if you were sure fewer people would die it would still be an ethical conundrum)
Earlier quoted context omitted.
> get a lawyer Because this is the world we should want to live in? Where you must pay a member of the protection racket to mediate publishing knowledge of someone else's extreme wrongdoing? That is terrible advice. Its road ends with TORified disclosures of weaponized automated exploits, because as pure info sec has shown, that's the only way the message ever gets across when you give people the insulation to not li…
Can you elaborate on how lawyers are "member[s] of the protection racket"?
Specifically, the above comment references having a lawyer handle (and moderate) what should be open technical communication with the manufacturer and regulatory agencies, the implication being that simply disclosing facts put you at grave risk from an endlessly complex legal system.