Slashdot Mirror


User: plover

plover's activity in the archive.

Stories
0
Comments
7,233
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 7,233

  1. Re:What happens when the behavior changes on The Coming IT Nightmare of Unpatchable Systems · · Score: 1
  2. Re:wait on The Coming IT Nightmare of Unpatchable Systems · · Score: 2

    There are plenty of embedded systems that are "unpatchable": those that have their programs burned into ROM instead of Flash or EEPROM. The physical hardware required to modify the ROM chips simply doesn't exist in the equipment the manufacturer shipped; or the chips themselves may not even be modifiable once burned.

    However, "unpatchable" does not mean they are "unhackable", as the CPU of a von Neuman architecture chip can still be subverted to execute code dynamically loaded into a RAM buffer (and the code in the ROM can still be used by the attacker using techniques like ROP.) The chances are the manufacturer didn't leave the attacker much extra RAM to play with, but if all he's looking to do is have it execute a DDoS attack (sending ACKs to his victim in a tight loop) it's probably enough to wreak havoc. Or he might be looking for a simple IP proxy just capable enough to forward his network traffic.

    Yes, a reboot will refresh the RAM and remove the malware, but that generally won't matter to the attacker. If he hacked it once, he can hack it again; or he might have a thousand more smart toasters in his robot army, all of which are sending the same DDoS attack.

    Any vulnerabilities they were shipped with, they still have today; and you simply can't fix them without replacing some hardware.

  3. Re:Nightmare of Slashdot ads sending me to viruses on The Coming IT Nightmare of Unpatchable Systems · · Score: 2

    Don't say that word, lest you summon ... him.

  4. Re:This "nightmare" rigns a bell on The Coming IT Nightmare of Unpatchable Systems · · Score: 2

    So perhaps they should be sold like that: "You can buy our Amazing zPhone 5 for $100, guaranteed to work until 2018, or our Amazing zPhone 5c for $150, guaranteed to work until 2021. We no longer sell the Ordinary zPhone 4, whose guarantee runs out in 2015, and will in fact quit working by 2016."

    Right now when someone buys a cell phone, they have it in their brains that they're making an "investment", that the phone will last for the next 20 years, or even forever. They are used to products that wear out due to usage, abuse, accidents, but for some reason they do not ascribe the same attributes of reliability to software, even though they've almost never encountered perfect software in their lives. For the most part, it's ignorable to them, even when it has bugs.

  5. Re:wait on The Coming IT Nightmare of Unpatchable Systems · · Score: 1

    A system that can't be patched, can also not be altered to do the attackers bidding.

    That's not completely true. Even if a device loads its code from ROM on every reboot, with no capability of flashing new software, an attacker can still patch the running instance of code to do his evil bidding. Many machines will run for months or years without rebooting, allowing the attacker to benefit from them over and over.

    The attackers who are hacking into your thermostat or washing machine have little interest in making your house hot, or your clothes dirty. They want to make money. They do that by adding zombies to their bot farms, which can participate in DDoS attacks; they can broadcast spam to hundreds of victims; they can host malware; they can spy on your banking PC; they can serve as a cutout relay for other attacks, etc. In most cases, the attacker wants your thermostat and washing machine to keep working without interruption to you so you don't even know they're infected.

    If the machine is rebooted, the malware is gone, but so what? The attacker already made his profits.

  6. Re:The poster is showing his prejudice. on The Coming IT Nightmare of Unpatchable Systems · · Score: 5, Informative

    I don't mind smart appliances - but again, I don't see why they need internet access. The exceptions to this (smart TV's, for example) should be viewed with suspicion specifically because they are likely to be connected to the internet in some way, but my smart refrigerator probably shouldn't be - and ATM's, slot machines, SCADA systems, etc. almost certainly should never be.

    Just because you haven't encountered a specific example for yourself doesn't mean they don't exist in the real world.


    • The TV? Netflix, of course.

    • The BluRay player? New keys for new disks, and to unlock "extra special downloadable content" (whatever that may be.)

    • The thermostat? You're coming home from summer vacation and want to turn on the A/C a few hours before you arrive.

    • The laundry machines? You're upstairs, out of earshot of the dryer, and want to know when the load is done so you can hang up your clothes to prevent wrinkles.

    • The smart refrigerator? Maybe you're having a problem, and need the technician to connect to it to remotely diagnose it and give you an estimate without making an expensive house call.

    • The freeze alarms? You're out of town during the winter, and want to be alerted if your house temperature drops to the point where it's threatening to freeze your water pipes, so you can call a neighbor for help or a repairman to fix the furnace.

    • The door camera, locks, and security alarms? You're still out of town and want to let the repairman in, so you look at the ID he holds up to the camera and remotely unlock the door for him.

    • The window shades? They're located high up in the skylights where you installed a motorized system to operate them, so it was a small additional expense to add a remote control. And as today may be very sunny, you want to close them while at work to keep the house cooler.

    • The dishwasher? It might need to know the scheduled price of electricity in order to avoid running during peak rates, and save you money.

    These are not made up examples - they happen every day. If someone already has the connectivity, and pays for the equipment to have the capabilities, there's no reason they shouldn't also enjoy the convenience.

    Note that this is true whether or not you personally think it's a good idea to connect your washing machine to the internet: the reality is Sally Soccermom and Charlie Cuttingedge already have houses full of this tech. You can buy all this stuff at Best Buy and Home Depot and Verizon today.

    Of all of these systems, most are designed and built with a remote update mechanism. Some that aren't (door locks, freeze alarms) are generally run through a home automation controller that is itself updatable; so even if you can't remotely patch your freeze alarm, you can at least patch the controller that interfaces with the network. Also of note, most are aware of the typical home firewall configuration, and are designed to "phone home" to check for updates. They generally don't sit on the raw internet and listen for incoming connections, so the attacker generally has to get inside the firewall to abuse them (which is not that big of a problem for many models of firewalls, that's for sure.)

  7. Re:But if it can be hack broken, it can be hack fi on The Coming IT Nightmare of Unpatchable Systems · · Score: 3, Insightful

    Probably not unless the user wants it fixed, and most don't. People have plenty of experiences with patches breaking new things, or taking away old functionality they had come to depend on. When someone tells me "this patch will solve all your problems", they usually aren't advertising the list of new problems they're creating for me. Anyone who plays iPhone app games knows that the patches sometimes come with game-stopping bugs; other patches have been known to suddenly add annoying advertising.

    Usually, I'm at a point of equilibrium where I am at least coping with the bugs in the devices surrounding me. If I know that the "mute button" on my GoogleTV box doesn't work unless I press it twice, I simply learn to press it twice; while I know it's a stupid workaround, it's one I can live with. What I might not be able to live with are the bugs that come with the next round of patches.

    Now, we make that experience hurdle even harder to scale: as a end user, I think security patches are worse than regular patches. The end user doesn't see a physical benefit from the patches, but knows he might suffer. What does he care if his thermostat or washing machine is sending spam around the world, as long as his house is warm and his clothes are clean? But if he installs the patches, he risks having a cold house or dirty clothes, or even advertisements streaming across his refrigerator's screen. It's just not worth the risk to patch them.

    And if you want to see a really risk-averse, don't-patch-me crowd, talk to the SCADA industrial control people. If you suggest you need to update the software running the sewage ejection pump, the city engineer is going to hand you an invoice for $20,000 and say "that covers my cost of testing your patch."

  8. Re:Speculation on The Sudden Policy Change In Truecrypt Explained · · Score: 1

    So why the announcement? Because unsupported it IS less secure - eventually more holes and vulnerabilities will turn up and it might be fatal. Better to get everyone off it rather than believing their data is secure against unknown future attacks.

    The problem is they didn't say it that way, instead they claimed it had unfixed security issues. Which is weird, because the audit has demonstrated the opposite.

    However, I think we should all read what they wrote a bit more literally: "Warning: Using TrueCrypt is not secure." The key word we're all overlooking in all this paranoia is "using". TrueCrypt itself may be just fine as is, but according to Snowden's documents, virtually every single computing platform is susceptible to some form of software or hardware hacking that allow the NSA access. Keyloggers built into keyboards, motherboards, USB cables, hubs; the ability to wirelessly transmit logs up to 8 miles away; BIOS that allows remote control; routers with subverted access commands - it doesn't matter how secure the software is if the attackers already own the platform itself.

  9. Re:people ruin everything on The Sudden Policy Change In Truecrypt Explained · · Score: 1

    Governments are not just made of people. They are made of people, laws, and processes. A bad process (or law) encourages people who prosper by it to leave it unchanged This means that people do the wrong thing in order to keep their jobs. A person who is only trying to do what they were hired to do may do something morally wrong because that's what they were told was correct. A really really bad set of processes in a secret organization can lead to secrecy for secrecy's sake, and that leads to what we saw here.

  10. Re:This is what happens... on Security Researchers Threatened With US Cybercrime Laws · · Score: 1

    Look who you replied to. YHBT. HTH.

  11. Re:Infectious diseases ... on Mutant Registration vs. Vaccine Registration · · Score: 1

    Following your logic, if you can control your own damn body, then it's your responsibility to control your own damn body and make it stop shedding viruses and infecting the rest of us.

    If you can manage to do that without a vaccine, yay! If you can't, then your argument doesn't make any sense at all.

  12. Re:Well... on Mutant Registration vs. Vaccine Registration · · Score: 1

    It would be fine if those people lived on the Island of Misfit Religions, but it turns out that we all now live in a global village, like it or not. Tommy Typhus can hop a plane from the Congo today and stand in line next to you tomorrow, shedding viruses everywhere he goes. Those viruses penetrate the body far more deeply than any needle.

    Beliefs and prayers are no defense against modern aggressive diseases and global travel.

  13. Re:What he's really saying is on Why You Shouldn't Use Spreadsheets For Important Work · · Score: 1

    The definition of legacy software is quite simple: legacy software is code for which you do not have automated tests.

    That's it. Automate your testing and you can change anything you like, and still know the software works as designed. Refactor, rearrange, chop out blocks of dead code, whatever, as long as it still passes the tests.

    Of course your tests have to be readable, and comprehensive, and trustworthy, but if you've gotten that far, you're golden.

  14. Re:Spreadsheets - best and worst thing there is on Why You Shouldn't Use Spreadsheets For Important Work · · Score: 5, Informative

    What people fail to realize is that spreadsheets are like any other form of programming, and therefore should be treated as such. Write tests. Break complex formulas down into named cells. Use references to carry concepts. Beware of globals. Keep small concepts small, simple, and modular. Write more tests.

    Does anybody do that with every spreadsheet they write? Doubtful. I know I only go to all that trouble myself when I have a boatload of inputs that have to get put together. I usually discover about part way in that the sheet is going to be complex enough to need tests. When I do, it's time to start refactoring it, and these are my general steps:

    1. Give cells and ranges meaningful names
    2. Break complex formulas down to several small formulas
    3. Add tests for the formulas
    4. Factor out duplicates

    Of all of these, giving cells and ranges names is the most important, because it makes the sheets readable. I can then usually understand the results well enough to know if my formulas are working, but a complex formula often needs an independent set of tests to prove the discontinuities in the functions are actually where I think they should be.

  15. Re:Not rocket science on Why Snowden Did Right · · Score: 1

    Unfortunately, the vast majority of human beings (regardless of where they live in the world) DO trust coercive authority, ...

    But isn't a democracy defined by the stated goals of "the vast majority"? It says nothing about ignorant or stupid citizens. The direction of a democracy is supposed to be simply what the most people agree to.

    The disenfranchised minority might call it deception, coercion, or 'the tyranny of the majority'. They may even assume the mantle of a freedom fighter, revolutionary, or terrorist.

    But what would be different if Willie Nelson or Kid Rock is contracted to create a patriotic-sounding song that conveniently gets ignorant voters to overlook the abuses being perpetrated by the NSA ? Is that deceitful or coercive? Or is it just politics in a democracy?

  16. Re:Elephant in the Room on US Nuclear Plants Expanding Long-Term Waste Storage Facilities · · Score: 2

    Off the planet? I don't think you understand how amazingly expensive that is. First, you've got the costs (and environmental damage) of the fuel needed to push all that stuff up and out of Earth's gravity, and get it to the sun. Remember the Saturn 5? It was the largest heavy lifting rocket ever built. Fully fueled it weighed 2,900,000 kg (131,000 kg empty), and could lift 100,000 kg to the moon. It remains one of mankind's most impressive machines.

    Next, think about the reliability of rockets. Do you really want a launch failure to spray spent fuel rods all over the launch pad, the ocean, or the planet? Out of the 13 Saturn 5s that were launched, 12 were successful. Is the world ready to put its nuclear waste on top of that track record?

    One average reactor produces perhaps 27,000 kg of high level waste per year [http://www.world-nuclear.org/info/Nuclear-Fuel-Cycle/Nuclear-Wastes/Radioactive-Waste-Management/]. That doesn't count the shielding needed to protect everything else while it sits on top of the rocket and flies up. For a wild guess, and to make the math a bit simpler, let's just say it works out to 100,000 kg total. That's one Saturn 5 launch to dispose of the annual waste of one reactor. Now multiply that number by the hundreds of reactors in operation around the globe. You're probably talking at least one Saturn 5 launch per day, forever.

    Maybe you are hoping there would be efficiencies of scale that would make the task cheaper and safer over time. Surely if we launched 365 days a year, we'd get really good at it. We'd eventually arrive at a 100% safety and success track record. Or maybe we'd figure out a space elevator. However, it turns out that it doesn't matter what kind of technological breakthroughs we have, it still takes a tremendous amount of energy to lift mass out of earth's gravity. And like every other energy problem on this planet, where's that energy going to come from? Nuclear?

    Realistically, we have to figure out how to deal with that stuff down here, on the ground.

  17. Re:this is cool on Servo Stock 3D Printer Brings Closed-Loop Control To Reprap · · Score: 2

    Don't think of it as "more expensive", think of it as "the price of precision." If you pay less today for the components, you'll pay more tomorrow in making scrap parts. Make your own tradeoff - would you rather get into cheap printing, and pay in terms of delays and waste, or would you rather produce more usable parts?

    At least if you pay up front, you've theoretically reduced the long term expense. The downside to that theory is: will today's 3D printer be the technology you want in 2018? If you think these machines will improve a lot in other ways in the next four years, adding extra costs today won't save you much if you're just going to replace it anyway.

  18. Re:Time for a new name? on TechCrunch and Others On the Microsoft Surface Pro 3 · · Score: 1

    As good as the Surface Pro 1 was, the Surface Pro 2 is even better. I'd love to swap up my Pro 2 for a Pro 3, but not without a good trade in deal.

  19. Re:New version, same problem on TechCrunch and Others On the Microsoft Surface Pro 3 · · Score: 3, Insightful

    They have the RT, and it's pretty much the crappy machine you should expect if you're cheap. Having a decent processor makes a huge difference.

  20. Re:Not to sound cold... on Ask Slashdot: Communication With Locked-in Syndrome Patient? · · Score: 1

    This is very sad, but true. We just had this exact scenario play out two months ago, when my father-in-law had a series of strokes and a brain bleed that left him locked in as well, without even a reliable eyeblink way to communicate. The EEG showed he was still in there, but nothing could come out.

    We were so thankful that he had discussed this with us and the family's lawyer just a few months prior, and had established in his living will that he did not want to live the rest of his life like this. We had a family meeting, and everyone was in unanimous agreement that he clearly did not want this kind of existence. We moved him to palliative care, where he spent his last week at home, and passed peacefully in the night.

    Without knowing his wishes so well, he could very well have still been in the ICU today, trapped and going insane. It was a relief to all of us to have his explicit permission to end it.

  21. Re:Good luck with that. on With the Surface Pro, Microsoft Is Trying To Recreate the PC Market · · Score: 1

    The Windows 8 UI is mostly OK for touch screen functions. It's worse than useless on a desktop or laptop without a touchscreen, and the CEO of Microsoft should be bludgeoned with a Model-M keyboard until they go back to the Windows 7 UI for those machines.

    As far as portable machines go, I love my Surface Pro 2. It's not a closed architecture like the RT or iOS, and I have put a ton of random stuff on it, from SDR clients to dev environments to forensic analysis packages.

    There's still too much integration with Microsoft's cloud (i'm not a fan of using someone else's storage for my data) but otherwise it's a very decent performing machine. And while it's nowhere near as light as an iPad, it's still very carryable.

  22. Re:danger will robinson on Professors: US "In Denial" Over Poor Maths Standards · · Score: 1

    That's Florida. Among educational systems, they're just liars amongst outliers. But hey, at least their rich have low taxes, right?

  23. Re:Star Wars Sucks! on Ask Slashdot: Can Star Wars Episode VII Be Saved? · · Score: 2

    Awards are granted to all kinds of movies, and aren't the definition of adult entertainment. These movies were not nearly as popular among adults as they were among kids. They were and are kids's movies first.

  24. Re:Yes! No more mandates! on Gun Rights Groups Say They Don't Oppose Smart Guns, Just Mandates · · Score: 1

    Given the rabid attacks often launched by people claiming to be the NRA, it can be hard to take them seriously. The title of "gun nut" is well deserved for many of them; and when you're talking to a gun owner, it's hard to know which kind you're talking to.

    I just thought it relevant that even though I'm not a gun nut, I still think people should have the rights granted them in the Constitution - all of them, and for the reasons stated. We should be able to defend ourselves against tyranny and despots.

  25. Re:except your products are killing children on Gun Rights Groups Say They Don't Oppose Smart Guns, Just Mandates · · Score: 1

    Not yet.