Inadequate IT security measures in operating systems leading to vulnerabilities in the age of persistent internet connections

Signals over time

4 observed signals across 1 sources, tracked for 6 days. Confidence: low.

What people are saying Observed

• “> This still shouldn't be online. This line suggests the units themselves were targeted individually with a hack: > Danfoss said the affected cold units were older models whose security software could not be updated to ward off a risk they had identified. But the problem with networked devices spread across tens of thousands of pretty much unguarded locations, surrounded by unvetted employees, but taking orders form a central location is that there is no such thing as "not online". They'll talk to the management server used to set up the nightly defrost schedules across the fleet. Even if they are in an isolated VLAN, it's always one step away from someone connecting a Pi to that network and off they go online. There's only so much zero-trust, NAC/802.1x and segmentation can do when some devices will be too old to support these and their network will be the entry point to the management server, then to the whole fleet. I'm honestly very surprised that a couple of things things haven't happened yet: the central server for managing these fleets getting hacked and allowing access to the entire fleet, and/or the companies realizin”

  Hacker News · complaint

• “Sure the labs want to see the emergent behavior, but that's not all that matters. You can wave it away and say anyone upset is missing the point, but for some, the point is that the labs are behaving poorly. > our systems are not as hardened as we say they are Agreed, and this has always been the case. Anyone in security already knows this. But there's a difference between the unsolved problem of 100% secure networked systems vs not applying available techniques to mitigate the current issues. I'm not saying it's easy, or that there are any guarantees in this new world, I'm just pointing out what appears to be low effort by the labs. Negligence is pretty much the standard for computer security because there aren't meaningful consequences for the most part. I got another $35 dollar class action settlement the other day for a data breach I had no control over. Cool. Personally, I'm "OK" with all of it, because maybe we'll finally see more effort on the security front, which has historically been neglected since day one. Besides that, I also love seeing the emergent behavior and evolution of computing and society. That said, it woul”

  Hacker News · frustration

• “> OK gimme an ssh key into your box then. Obviously no, as I haven't hardened my system for that. You made a claim that "adversaries have never existed inside of the systems that we hoped to secure in the first place" and I gave you two examples that show why that claim is ridiculous. > It's a start, but now you're just pushing the fallibility up into extensive policy writing. You have to fully audit and trust every endpoint that's been granted access. We're talking about is trillion dollar companies. Outbound DPI is just one method. There are lots of tools and techniques available to mitigate the behavior that has people upset. No security is perfect, and aggressive hardening takes time and resources, but it's certainly within reach of a company that has the resources of a frontier lab. People are cranky because it appears that the labs have been lazy. It's not the unsolved problem that you're making it out to be.”

  Hacker News · frustration

• “We've definitely got an IT Security problem that goes down to the roots. If you're testing an AI for hacking ability and it's not air-gapped from the internet, you need to go to jail when it inevitably breaks out and commits crimes. The whole hugging face incident could have been completely prevented. The underlying security problem we've faced for the past decade is that Linux/Windows/MacOS, etc are all not fit for purpose in an age of persistent internet connections and mobile code. The only way out is an OS built around default deny instead of ambient authority. More people need to know what a data diode is, and how to use it, myself included. I've finally got the resources together to start figuring that out, 2 Raspberry Pi B+ computers, the old kind without wireless. The data diode itself is trivial, I'll probably end up with a 6N137 optocoupler between 2 serial ports. The hard part is the proxies for all the protocols, and the digital fountain to spray the data across the connection with ECC. At this point I intent to do it all in Free Pascal/Lazarus, but I'll suck it up and use C++ if I have to.”

  Hacker News · frustration