Beta
×

Welcome to the Slashdot Beta site -- learn more here. Use the link in the footer or click here to return to the Classic version of Slashdot.

Thank you!

Before you choose to head back to the Classic look of the site, we'd appreciate it if you share your thoughts on the Beta; your feedback is what drives our ongoing development.

Beta is different and we value you taking the time to try it out. Please take a look at the changes we've made in Beta and  learn more about it. Thanks for reading, and for making the site better!

The Lesson of Recent Hacktivism

Soulskill posted more than 3 years ago | from the don't-piss-off-the-internet dept.

Security 159

itwbennett writes "LulzSec says they're retired, which may or may not be true. But one thing the world has learned from their 'frightening yet funny escapades is that 'the state of online security stinks,' writes blogger Tom Henderson. LulzSec (and Anonymous) have 'demonstrated that an awful lot of people are either asleep at the switch or believed in arcane security methods like security through obscurity.'" A related story at the Guardian suggests that governmental attempts to control the internet are spurring these activities.

cancel ×

159 comments

Sorry! There are no comments related to the filter you selected.

Twitter: (-1)

Anonymous Coward | more than 3 years ago | (#36607506)

What is it for?

Re:Twitter: (3, Funny)

Anonymous Coward | more than 3 years ago | (#36607542)

Its a site that allows celebrities & famous people to make twats of themselves by not speaking through agents, PR or lawyers.

Yikes. Coffee. Smell. Up. Getting. (5, Insightful)

Anonymous Coward | more than 3 years ago | (#36607558)

They believed that money spent on security products == we are secure. They were not asleep. They did not believe in security through obscurity. They trusted the industry. They gave it money in return for products that were supposed to protect them. They lived in ignorant bliss. Unfortunately, the security industry (and the rhetoric they proclaim) is all about the end goal of the industry making money. Companies are lured into a false sense of security based on what they are being told, and what they spend money on - and it seems totally reasonable from their perspective. Unfortunately, the public (and the victim companies) are not aware of one tenth of one percent of what is actually going on. Any company that has anything worth significant financial value is either compromised or is a target with a big bulls eye on their gold stash - guaranteed.

Re:Yikes. Coffee. Smell. Up. Getting. (1, Interesting)

Anonymous Coward | more than 3 years ago | (#36607752)

The problem is the opposite. Actual security is ridiculously expensive and there is not a willingness to put up with that level of expense, especially not since any security you have, no matter how well done, can still be breached by someone who is sufficiently determined. So when few are willing to pay for actual security, and put up with the inconvenience required by actual security, you get products that try to patch things up a little bit for a much reduced cost. The much reduced cost may still be significant, but it is nowhere near the cost of actual security.

Re:Yikes. Coffee. Smell. Up. Getting. (3, Insightful)

c0lo (1497653) | more than 3 years ago | (#36608374)

Actual security is ridiculously expensive and there is not a willingness to put up with that level of expense

The cost of risk prevention: if the cost if risk mitigation is lower (no matter if people are burnt [wikipedia.org] ) there you have it.
Far easier to them to externalize the cost and lobby for DCMA and anti-hacking laws - it's the populace that pays for the jail time.

Re:Yikes. Coffee. Smell. Up. Getting. (1)

Dunbal (464142) | more than 3 years ago | (#36609172)

Actual security is ridiculously expensive

If you don't take those costs into account when drawing up your business plan and prefer the "let's cross our fingers and hope it doesn't happen" security method, perhaps you deserve to fail. Also, actual security is not _that_ expensive, you just need to hire the right people, or design the software properly from the start if you are going to code it yourself.

Somehow I'm reminded of a paragraph somewhere in the instruction manual to the game "Pirates!" - the original version in the late 80's, not the remake(s). Paraphrasing - "the goal of piracy is to redistribute wealth to the pirates from those that are too lazy to protect it". Your excuse about costs is as ludicrous as the captain of a galleon full of gold complaining that he couldn't afford cannons to protect himself. If you're not making money you probably don't have anything worth stealing. On the other hand if you have 50,000,000 credit card/billing information entries in your database, please don't tell me you couldn't afford to hire someone to handle security.

Re:Yikes. Coffee. Smell. Up. Getting. (-1, Troll)

michiko (2270072) | more than 3 years ago | (#36607780)

you Mean to say people are asleep at the switch.!? well I don't think at all. [a.ly]

In large companies I have worked for, there are a lot of very competent people that care a lot about security. But the thing is, security is a minor consideration to spend time and money on compared to making working systems.

but I don't think honestly it can until someone has had the lesson REALLY driven home to them by a major security issue.

Re: a.ly (-1, Troll)

xeon13 (2268514) | more than 3 years ago | (#36607802)

ooo..!!! diss is much helpful to people.. well i think u r ri8... becoz security is mandatory to all big n small companies..

Re:Yikes. Coffee. Smell. Up. Getting. (4, Interesting)

rtfa-troll (1340807) | more than 3 years ago | (#36607892)

They believed that money spent on security products == we are secure. They were not asleep..

Except that, according to the reports, Sony had servers for development which were fully protected with firewalls etc. and which were not hacked / hackable (by LulzSec) and other servers for customer data where they hadn't made any investment. So they hadn't spent that money. You may be right they weren't asleep. Someone made a conscious choice that customer data is not important, but it's not that they had made any of the investment they should have done.

Re:Yikes. Coffee. Smell. Up. Getting. (3, Interesting)

jhoegl (638955) | more than 3 years ago | (#36607918)

Or it could be that the person in charge of Development was smart enough to invest in it because they knew better and the person in charge of Customer Data was not.
We could come up with many scenarios, the only ones that know what happened internally are not going to speak out about it willingly.
One thing is for sure, what I have seen in the small business world is a mirror to big business. It IS ignorance at some level in the corporate model.
Ironically, this same model helps bring down corporations and small businesses alike. All it takes is one bad stone at the right point in the pyramid to make it all come crumbling down.

Re:Yikes. Coffee. Smell. Up. Getting. (4, Insightful)

phantomfive (622387) | more than 3 years ago | (#36607916)

It's been my experience that most companies aren't even spending money on security. If they are even thinking about security, they are ahead of most. Many companies are leaving wide open, simple holes, like failing to escape their SQL, or parse out javascript. That is the lowest-hanging fruit. Really, it wouldn't surprise me if you could use Metasploit and nothing else to break into 20% of the major websites in the world.

If you're a web developer, let it be a lesson to you: download some basic hacking tools and try them out on your own website. You'll definitely learn something.

Re:Yikes. Coffee. Smell. Up. Getting. (1)

CodeBuster (516420) | more than 3 years ago | (#36608006)

Many companies are leaving wide open, simple holes, like failing to escape their SQL, or parse out javascript

This is less the result of a conscious decision on their part to trade off security and more often the consequence of hiring out any IT or development work to the cheapest possible bidder. Companies, like people, must sometimes learn the hard way that one gets what one pays for. For what it's worth, I've noticed that offshore outsourcing shops are especially negligent when it comes to SQL injection, script entered into forms, careless query string handling and many other common attacks. It's too bad that LulzSec disbanded, they were bringing attention to problems that have long been ignored by corporate America.

Re:Yikes. Coffee. Smell. Up. Getting. (4, Insightful)

Dunbal (464142) | more than 3 years ago | (#36609246)

I hate it when this excuse is used. And it's used often in business in many areas, not just security. It's the junior manager's way out - the way to duck and hide behind someone else. But while it's true a contractor, agency, or someone else will never do as good a job as you would if you did it yourself - at the end of the day it's the responsibility of the guy who approved and signed the cheque. If you don't even take the time to review the work you contracted, if you don't even bother to keep ONE person around who has any notion of how the work should be done and get him/her to go over it and approve it before it's accepted, then my friend, you deserve the good anal fucking that you are about to get.

Re:Yikes. Coffee. Smell. Up. Getting. (5, Insightful)

CodeBuster (516420) | more than 3 years ago | (#36607960)

They were not asleep. They did not believe in security through obscurity. They trusted the industry.

It has often been said, by Bruce Schneier [wikimedia.org] and others, that security is not a product that can be purchased, installed after the fact and forgotten, but rather an attitude and culture that must be cultivated and maintained. Knowledge and tools are important, but without the right attitudes and culture they will be of limited use. Remember that nobody cares more about your security than you do. If you don't care then nobody else will either, despite what they may tell you.

Re:Yikes. Coffee. Smell. Up. Getting. (1)

Intrepid imaginaut (1970940) | more than 3 years ago | (#36608508)

The trick is finding the right balance between that and every other concern involved in running a business.

Re:Yikes. Coffee. Smell. Up. Getting. (0)

Anonymous Coward | more than 3 years ago | (#36609230)

security is not a product that can be purchased, installed after the fact and forgotten, but rather an attitude and culture that must be cultivated and maintained

To Bruce Schneier and yourself for quoting it, Amen Brothers.

This. This right here (or rather the lack of understanding of this) is exactly why we're in the mess we're in.

Re:Yikes. Coffee. Smell. Up. Getting. (5, Insightful)

hairyfeet (841228) | more than 3 years ago | (#36608488)

This reminds me of an old story i was told by a teacher: A friend of his goes in to do some hired gun work for this company and gets told by the PHB he is NOT allowed under ANY circumstances to touch the NT 3.whatever server box. It has run great for years and he don't care if it is out of date, it works so just clean the fans and go on. Now since he had worked with NT 3.whatever before he didn't see how this machine had been doing its job all these years without a single fail. So he logs into it and what does he find? It is actually some version of Fedora. apparently the guy before him got tired of the BS and just changed it out without telling the PHB.

And it is THIS, this right here, that is often the problem. It isn't that the IT guys don't want to do a good job, it is that some PHB is cockblocking them at every turn. I myself ran into this doing some hired gun for a law firm. I told them I didn't have time to support the place but I recommended a couple of different guys who could do the job well. they had experience, their prices were reasonable, so what happened?

Somebody decided they cost to much and "he knew a guy" that was "a whiz at computers" and could do it for half the price. I get called back a year later when they catch this clown running a gaming server and downloading porn on company time and...wow. he had first of all took ALL the nice neat Dell office boxes, which were standard MOR office machines, and chunked them because they were "too slow" and instead custom built a bunch of gamer rigs from kits so of course nothing matched, then since he didn't know shit about corporate networking he bought a bunch of Dlink home routers you know, the shitty blue ones? Oh and that is not all he had more than half a dozen ISPs as his idea of "adding capacity" was just to add another ISP.

So needless to say fixing that clusterfuck wasn't cheap, neither for me nor all the hardware I had to buy to replace his gamer shit, so did the guy that caused this mess get punished? Nope he had already got promoted a couple of times for all the money he saved them on "IT costs" and was no longer in charge of anything IT and therefor didn't get the blame...ARGH!

So if you want to know why networks are a mess, it often ain't the IT guy (except for gamer retard) it is the stupid ass, dumb shit, WTF are they thinking, Dilbert bullshit that goes on every single damned day in this country. The PHBs get rewarded for saving money even if that money was saved by sacking anyone who knew what the fuck was going on, they cause one clusterfuck after another, but ultimately they don't care because they either fail up or use their "success story" to move to another comapny.

This is why i had to get out of corporate and open my little shop, as the stress of absolute insane stupidity was giving me chest pains. It was like a friend who ended up being threatened with losing his job and got drug before the regional head. The PHB above him wanted him fired because, and I quote "You have NO RIGHT to tell me who i can and can't talk to! I demand you give me my emails from Melissa [wikipedia.org] right now!". He got lucky that the regional head actually watched the news so he went "He isn't talking about the virus, is he?" and when he found out that yes, senior bigfool wanted Glenn to let Melissa loose on the network the PHB got a dressing down and Glenn got an apology and a free steak dinner.

But it is that kinda of rampant herp derp that is the cause of this bullshit and frankly I don't see how some script kiddies are gonna undo decades of upward failure and PHBs. Oh and what you are talking about is what me and my friends called "black box thinking" which sadly I saw every time the salesmen came around. You wine and dine the PHB and give the "This (insert device) will make you (insert hacker, virus,fool) proof!" and sadly they'd bite 9 times out of 10. Needless to say the shit never worked like it was sold, but since the PHB never got dinged for it who cares, right?

I disagree (0, Flamebait)

Saint Stephen (19450) | more than 3 years ago | (#36607566)

It seems to me to be not as reasonable to think that LulzSec represents a massive amount of laziness / carelessness on the part of those admin'ing the systems, as to think that we just didn't understand the situation sufficiently clearly yet. The LulzSec twerps merely pointed out the "chaos in the universe" aka the difficulty in getting anything done.

To mangle a quote quoted in V for Vendetta (favorite subject of Anonymous): The falcon spins ever wider and soon cannot see the falconer. Mere chaos is unleashed upon the world.

LulzSec, being children, merely pointed out the chaos. To that end it's a great lesson, just like Al Quaeda / IED and the Viet Cong before that: it teaches us real people how to deal with the situation properly.

I still say fry the bastards though. Even children must be responsible. My generation could have just as easily done the kind of vandalism (and did), we just didn't want to be that big a pricks.

I actually blame the parents (the Bush-haters) for breeding such a bunch of twats as LulzSec.

Please don't mark this down as flamebait; it really is not an invalid opinion to hate LulzSec and what it stands for, no matter how much you teenagers reading this want to agree with them. Hating reality is part of teenager-hood. We understand how you feel; we all went through it.

But calling all CEOs "sociopaths" ?? Come on man, please join us back on this planet. Sure there are the Enrons of the world, and you might hate George Bush and all that, but come on guys. You've crossed the line into stupidhood now.

It ain't the security guys fault for not anticipating all the chaos that is possible in the world ;or rather it is their fault; but not due to lack of dilligence. It's just damn hard to keep that falcon flying around you :)

Re:I disagree (0)

Saint Stephen (19450) | more than 3 years ago | (#36607578)

Excuse me "mere anarchy" not "mere chaos". Much better quote that way. Veherwrung, not Ordung, for you geeks.

Makes me laugh to see V for Vendetta be such a powerful cultural touchstone. Back in the 80s it was not so well known. I guess a metaphor for you young folks would be as if, I don't know, some Pokemon character was now driving people to destroy society or something. It was just a damn comic book written by a guy who used to sell LSD in high school guys :-) It ain't the damn sayings of Buddha or anything :)

Re:I disagree (5, Informative)

Triv (181010) | more than 3 years ago | (#36607594)

V for Vendetta? Seriously? That quote's from W.B. Yeats: Turning and turning in the widening gyre The falcon cannot hear the falconer; Things fall apart; the centre cannot hold; Mere anarchy is loosed upon the world, http://www.potw.org/archive/potw351.html [potw.org] Credit where it's due.

Re:I disagree (-1, Troll)

Saint Stephen (19450) | more than 3 years ago | (#36607614)

I said "a quote quoted" -- :-) Didn't feel like googling it. I think it's quite relevant to quote it as if Alan Moore said it; because clearly Alan Moore and not Yeats is motivating Anonymous/LulzSec/the people in spain wearing the damn masks :)

Re:I disagree (-1, Offtopic)

Saint Stephen (19450) | more than 3 years ago | (#36607634)

I swear to fucking god - look at how my posts are modded on this thread. Say something kids like (XXX = government controls internet!) (which I truly believe) = modded up. Say things in the most round about way possible saying you don't agree with Destroying All CEOS! = modded to the basement within 2 seconds. It's what I'm talking about guys. Grow up!

Re:I disagree (0, Troll)

Anonymous Coward | more than 3 years ago | (#36607684)

My generation could have just as easily done the kind of vandalism (and did), we just didn't want to be that big a pricks.

don't mod me down, but your generation are pricks.

no matter how much you teenagers reading this want to agree with them. Hating reality is part of teenager-hood. We understand how you feel; we all went through it.

don't mod me down, i'm older and more mature and you'll see my point of view when you grow up and stop being childish.

You've crossed the line into stupidhood now.

don't mod me down, but you're stupid.

Come on man, please join us back on this planet. Sure there are the Enrons of the world, and you might hate George Bush and all that, but come on guys.

don't mod me down, but come on guys, come on.

It ain't the security guys fault for not anticipating all the chaos that is possible in the world ;or rather it is their fault; but not due to lack of dilligence.

don't mod me down, but it's not the responsibility of the security guys to implement basic security.

Re:I disagree (-1, Offtopic)

Saint Stephen (19450) | more than 3 years ago | (#36607708)

Oh bullshit! Dealing with the kids now modding the slashdot scene is beyond formulaic. Say shit you like = Yay! Try to get somebody to fucking read something, maybe listen for a damn change = incur the wrath of the hordes! :)

Re:I disagree (-1, Offtopic)

mug funky (910186) | more than 3 years ago | (#36607774)

jesus christ! i'll get off your lawn, just stop yelling! your breath smells like mothballs!

Re:I disagree (1)

Anonymous Coward | more than 3 years ago | (#36607792)

Dealing with the kids now modding the slashdot scene is beyond formulaic.

don't mod me down, if you do you must be a kid.

Say shit you like = Yay!

don't mod me down, yay.

Try to get somebody to fucking read something, maybe listen for a damn change = incur the wrath of the hordes!

don't mod me down, my post shouldn't be modded down.

here's a tip: instead of coming to the baseless conclusion that this is a generational thing maybe ask why certain people feel that way, you'll get a better response than your branding of a generation as 'stupid' and 'pricks'. you get modded down your post has 'back in my day we were smarter and more considerate and your opinion is stupid' superiority complex overtones.

FWIW i didn't mod you.

Re:I disagree (0, Offtopic)

mug funky (910186) | more than 3 years ago | (#36607768)

don't complain about your modding. none of the people you're arguing with modded you.

Re:I disagree (3, Insightful)

Raenex (947668) | more than 3 years ago | (#36607902)

I swear to fucking god - look at how my posts are modded on this thread.

Don't bring up Bush and claim your post isn't flamebait. I mean, seriously, this is what you said:

"I actually blame the parents (the Bush-haters) for breeding such a bunch of twats as LulzSec. Please don't mark this down as flamebait"

Re:I disagree (1)

DNS-and-BIND (461968) | more than 3 years ago | (#36608464)

Funny - a couple of years ago, bringing up Bush-hatred into totally unrelated conversations was considered obligatory, something normal people would do. It was serious and sane and anyone who modded flamebait was in league with Bu$hitler. People seriously used Bu$hitler, on this website, and were, in their tiny minds, not using flamebait. Look up "Bush Derangement Syndrome".

Re:I disagree (2)

Opportunist (166417) | more than 3 years ago | (#36607954)

CEO sociopaths? Well, maybe to a degree, but that isn't the underlying cause. Greed is rather the reason. Greed, but not (only) on the CEO's side.

The CEO is under pressure, like everyone else in the company: He has to perform, and he has to perform well. He has to generate revenue, and lots of it. Else he's being replaced by one who does.

The sociopath CEO now does it without remorse. The conscious CEO does it because he rationalizes that a lot of people have invested their money, probably all their life savings, into the stocks of that company and he has a responsibility to do his best to justify that trust. That's the beauty of the system, nobody is a sociopath, everyone can rationalize what he does. Your boss fires you, who's knee deep in dept, but he can rationalize it because he has to fire someone from the team or he has to fire everyone 'cause his budget doesn't allow him to continue the project else. His boss in turn, who signed the budget, couldn't give him more because he, in turn, only had so much money to spend and he doesn't even know you, he only knows that if he distributes his money well, a lot of people will be able to keep their jobs. This chain goes up to the CEO, who in turn rationalizes his layoffs with the responsibility to the investors. Who, in turn, don't even know what they invest in because that's something their bank's investment manager does. Who in turn can rationalize that he has to do his best to invest that money in those companies that perform best because people trusted him with money to invest for them.

You see, nobody has to be a sociopath anymore to be an asshole.

Regarding Lulzsec (5, Interesting)

Anonymous Coward | more than 3 years ago | (#36607574)

LulzSec might have ended, but I can guarantee you the exact same stuff is happening underground, except this time you probably won't know all your information has been stolen. Other than exposing corrupt whitehats I don't really agree with their actions, but I'm not sure if the alternative of keeping it in the hands of underground blackhats and IRC scriptkiddies is any better (not that is wasn't going on during LulzSec as well, but still).

Regardless, the AntiSec movement seems to be picking up some steam, at least within Brazil (protests are planned for July 2nd), and the first AntiSec release has just been posted to Pirate Bay: http://thepiratebay.org/torrent/6502765 [thepiratebay.org] with more promised tomorrow.

Regardless of their "supposed" script kiddie status (they did break into a hacking contest website and turned down the 10k), I think it was smart for them to disband and take up a greater cause, and I guess time will tell if they are successful or just run out of water.

Re:Regarding Lulzsec (1)

essayservices (2242884) | more than 3 years ago | (#36607818)

i think people do this ... yeh..!!! want only their ISO27k and their PCI-DSS, they want them to display to others that they are,.. n diss is the reality.

Re:Regarding Lulzsec (1)

Opportunist (166417) | more than 3 years ago | (#36607962)

Could you please quote someone else for a link like this?

Re:Regarding Lulzsec (1)

inglorion_on_the_net (1965514) | more than 3 years ago | (#36608178)

Regardless, the AntiSec movement seems to be picking up some steam

WTF? A group actually opposed to computer security, and they are picking up steam? What ... is the rationale behind this?

Re:Regarding Lulzsec (0)

Anonymous Coward | more than 3 years ago | (#36608518)

read what the antisec movement is first and you'll realize they aren't opposed to security, they're opposed to the industry that exploits the vulns to blackmail/sucker companies into paying them money.

Re:Regarding Lulzsec (0)

Anonymous Coward | more than 3 years ago | (#36609016)

Yes it's picking up a bit of steam, just enough steam to inspire who know just enough to be dangerous to create the Governments 'need' to substantiate taking more of our freedoms. That along side of convincing the Ameican't Public that there's a real need for more three letter agencies. My take on it, invest into social media outlets, and intelligence budgets.

War is expensive! Teach our kids to be nationalistic, use social media to reinforce behavior, finally make the transition from lower/lower-middle class more seamless into military branches outside of high school. Last but not least, if they're going to be lazy, stupid, and complacent. Why not take advantage? Hell, just think you could eventually be higher echelon government someday too!

Hail Aristocracy

Prediction: .XXX domain = plans for control of net (-1, Offtopic)

Saint Stephen (19450) | more than 3 years ago | (#36607586)

I will grant the paranoid out there one thing: it seems pretty clear that once XXX becomes "the place on the net for porn", regulatory agencies will try to push porn everywhere else off the net, and push hard. The argument will be it's OK because you can just go to XXX. But it will be a shoehorn to control things in a larger way. That much seems pretty clear.

Re:Prediction: .XXX domain = plans for control of (0)

Anonymous Coward | more than 3 years ago | (#36607748)

I will grant the paranoid out there one thing: it seems pretty clear that once XXX becomes "the place on the net for porn", regulatory agencies will try to push porn everywhere else off the net, and push hard. The argument will be it's OK because you can just go to XXX. But it will be a shoehorn to control things in a larger way. That much seems pretty clear.

How is that even legal?

Re:Prediction: .XXX domain = plans for control of (1)

SuricouRaven (1897204) | more than 3 years ago | (#36608228)

Technicalities. In theory ICANN could easily ban porn from .com, .net, .org, etc - and, as they are still heavily influenced by the US government, they may do so if the right(ie, wrong) politicians come to power. The legal bit wouldn't even be hard - firstly, they could argue that they arn't really a branch of the government (Which is technically true) and secondly, within the US, pornography - or more specifically, the legally obscene - is already illegal. It's just that very few police departments consider that law worth the effort of enforcing.

The real problem such an effort would come up against would be the country-code TLDs. The US has no influence there, not even through it's proxy ICANN. So the worst case scenario is that all the porn sites leave .com - the respectable ones set up in .xxx, and the less-respectable ones set up in the country-code TLDs so they can continue using their google-manipulating, email-spamming ways as before. Nothing is really changed, but the self-declared defenders of the family can pat themselves on the back for defending the country against the pernicious pornography.

The obvious next step after that would be to filter the porn out from overseas, a Great Firewall of America, but I can't see that happening for a long time. Not because the anti-porn forces wouldn't want to, but because it takes years to push the envelope that far.

Re:Prediction: .XXX domain = plans for control of (1)

jpate (1356395) | more than 3 years ago | (#36608502)

the legally obscene - is already illegal

what are you talking about

Re:Prediction: .XXX domain = plans for control of (1)

SenseiLeNoir (699164) | more than 3 years ago | (#36609150)

he meant: what is defined in the "legal" world or in terms of law as obscene is already illegal.

this is different from saying "the obscene is illegal" as different people have different views of what is obscene.

That is what he meant, thought it was obvious, i guess not.

Re:Prediction: .XXX domain = plans for control of (-1)

xiayou (2316372) | more than 3 years ago | (#36607860)

what the hell is this..!!!, just shut up.!!!

Re:Prediction: .XXX domain = plans for control of (0)

reasterling (1942300) | more than 3 years ago | (#36608658)

regulatory agencies will try to push porn everywhere else off the net

What is wrong with that? You seem to think that a change in name equals a change in location. So what if your favorit porn site now ends in xxx instead of com or whatever? This would be a tremendous help to all us parents who do not want porn in our house. And before you say that this is just another "think about the children" reaction you should know that it is already illegal for a minor to be exposed to porn. This would only help us stay in the law better. I for one welcome the day when I can set up my own bind server with all xxx tld sent to 127.0.0.1 or [::1]. Of course this would also be a tremendous help to most businesses who need to avoid sexual harassment lawsuits.

This is not censorship. The government would simply be demonstrating good grouping skills. This seems very much like the unix way. User files are in the home dir, config files are in etc, constantly changing sys files are in var, and your porn is in the .xxx folder. I personally welcome a decently regulated much more expanded top level domain naming system. I think there should be a .home for our private home networks. Perhaps we could have .fire for the local fire department, or .police, .library, .postoffice etc... I think it would be far simpler to type cityname.service or even address.city.state to reach your house.

Re:Prediction: .XXX domain = plans for control of (1)

selven (1556643) | more than 3 years ago | (#36608974)

you should know that it is already illegal for a minor to be exposed to porn. This would only help us stay in the law better.

Of course this would also be a tremendous help to most businesses who need to avoid sexual harassment lawsuits.

So you need a bad law to protect you from other bad laws. Got it.

"Arcane" (1)

tylersoze (789256) | more than 3 years ago | (#36607588)

Arcane is not really the right word there. There's nothing "arcane" about security through obscurity. Perhaps they meant "archaic"?

Re:"Arcane" (0)

Anonymous Coward | more than 3 years ago | (#36607610)

I was thinking the same thing. The idea of "security through obscurity" is insane, not arcane.

Re:"Arcane" (3, Informative)

carpenoctem63141 (2266368) | more than 3 years ago | (#36607654)

Actually, arcane means something is known to few/obscure. So an arcane security method could be interpreted as a security method that relies on obscurity.

Re:"Arcane" (0)

Anonymous Coward | more than 3 years ago | (#36608946)

Arcane is not really the right word there. There's nothing "arcane" about security through obscurity. Perhaps they meant "archaic"?

They'd still be wrong. There is nothing either arcane or archaic about obscurity as a security technique. It's not wise to rely solely on it, but it is quite often a very useful layer in a larger security model.

A little vandalism goes a long way (1)

mykos (1627575) | more than 3 years ago | (#36607606)

Lulzsec's resounding accomplishment is that it will wake organizations up about the state of their security, and maybe even get us a few anti-negligence laws for the companies who think of security as an afterthought.

Screw vandalism, especially on "soft targets" (5, Interesting)

schnell (163007) | more than 3 years ago | (#36607772)

Here's the thing: information security, just like any other type of security or insurance, is completely relative.

My dinky little websites have adequate capacity to serve the few hundreds of people a day who visit them, but would not withstand a Slashdotting or DDoS. My house is secure enough to resist a burglar, but not secure enough to resist a Navy SEAL strike team. Does this mean I'm negligent? No, it means that I could spend thousands of dollars on additional infrastructure for security or capacity but I choose not to because it's highly unlikely I would need to.

That's why the example of LulzSec is pathethic and not instructional. There are lots of "soft targets" on the Internet (in terms of security or capacity) that you could take down pretty easily if you wanted to, just because those sites can't justify full-time security teams or massively extensible infrastructures. I'm not talking about high-profile sites like Sony or the CIA, but stuff like EVE login servers or some county in Arizona. A bunch of douchebag script kiddies taking down some MMO server doesn't necessarily mean that anyone was truly "negligent," it just means that they picked easy targets. And there is not, nor will ever be, a shortage of easy targets on the Internet if you're willing to aim at those.

Re:Screw vandalism, especially on "soft targets" (0)

Anonymous Coward | more than 3 years ago | (#36607904)

I think that it makes people question these "small" websites and ask, is my information on this website? It isn't as much an eye opener for the operators but the users...

Re:Screw vandalism, especially on "soft targets" (2)

SuricouRaven (1897204) | more than 3 years ago | (#36608238)

Most users reuse passwords, anyway. Crack MothersKnittingForum's user list via a basic SQL injection attack, and it's almost guaranteed that some of those users will have the same password to access their email, facebook and paypal accounts.

Re:Screw vandalism, especially on "soft targets" (2)

antifoidulus (807088) | more than 3 years ago | (#36608036)

Often times these sites are in fact "negligent" in how they operate. Many were using outdated software with known vulnerabilities or were very poorly configured etc. Your little site in your example almost certainly will not get hacked if you follow some very basic security guidelines. For example, a quick google search turns up this page on apache security [petefreitag.com] . It took 5 seconds of searching, and would probably only take an hour or two to implement and test, and yet how many sites out there aren't following a lot of these guidelines? Apache is free and these guidelines cost very little to implement and test, so I doubt that someone can claim that they were too "expensive".

Your analogy isn't apt, for most of these sites it was like they installed a security system in their house then neglected to arm it or lock the door. Pretty much anyone that is looking for something to hack can come right in.

Re:Screw vandalism, especially on "soft targets" (1)

Flaming Foobar (597181) | more than 3 years ago | (#36608820)

For example, a quick google search turns up this page on apache security [petefreitag.com] .

There isn't really much there that will significantly improve security, except the suggestions to keep Apache up-to-date and maybe installing mod_security. For instance, hiding the Apache version number might actually decrease security since now you might miss yourself you are out of date. It's not going to prevent any attack from happening.

Re:Screw vandalism, especially on "soft targets" (0)

Anonymous Coward | more than 3 years ago | (#36608072)

My dinky little websites have adequate capacity to serve the few hundreds of people a day who visit them, but would not withstand a Slashdotting or DDoS. My house is secure enough to resist a burglar, but not secure enough to resist a Navy SEAL strike team. Does this mean I'm negligent? No, it means that I could spend thousands of dollars on additional infrastructure for security or capacity but I choose not to because it's highly unlikely I would need to.

The problem with this is that software can be mathematically proven to be secure or not, the real world can't. Creating a perfectly secure software system is entirely possible, there really isn't an excuse for collapsing in a broken pile when someone flicks a toothpick at you.

You also fail massively for trying to conflate DDoS and data compromise as the same thing. DDoS is merely a flooding which eats out your capacity; if your pipe isn't wide enough then you're boned, sure. The thing about that is that although the site is offline which is inconvenient to users and may cost you money if you rely on site ads that no-one is actually seeing, no actual data is lost. Having your fortress drown under a broken dam is fine, having the contents of all the safes break out and float away is not.

Re:Screw vandalism, especially on "soft targets" (3, Interesting)

wvmarle (1070040) | more than 3 years ago | (#36608076)

I don't agree with your analogy, as physical and digital security are too different. Not many houses can stand a SEAL attack, yet it is perfectly possible to connect a computer to the Internet with zero vulnerabilities (think OpenBSD).

Secondly, after a few decades of research that is still ongoing, there are plenty of known practices that make it easy to quite thoroughly secure a server. These issues include (list from memory, mainly related to recent attacks where this was the exact vulnerability):

  • ssl set up to log in without password,
  • SQL injection prevention (just escaping the input prevents most if not all of them - many libraries do this out of the box for you),
  • set a session cookie after log-in, and use it,
  • not storing passwords as plaintext but as (salted) hash - a preventative measure for in case you do get hacked,
  • separate databases, and giving the web-facing script a separate user in the database with minimum permissions - so in case the server does get hacked the attacker still can not see much,
  • a port-forwarding firewall letting through only traffic to the ports you need.

That's what I can think of, from the top of my hat. All of them are easy to implement - and when implemented will prevent most attacks from happening. Sure you won't be immune to zero-day attacks on your web server software, or other services. But it limits the attack vectors a lot already.

Not following such "best practice" standards I would call negligence.

Now I readily admit that my own server is also not configured perfectly, there is a bit of "security through obscurity" too of course. Yet I have a software-firewall blocking all but whitelisted ports, my SQL queries are sent to the database through a library that does the escaping and so for me, preventing SQL injection attacks automatically. No-one else has ssl access, so no way you can social engineer the password from me. Oh yeah and I don't need to store any personal details of visitors there, that also helps.

Most of these attacks appear to be SQL injection related. And that is easy to prevent: the MySQLdb module for Python is doing that for you already. That only leaves tests like type checking ("I expect an integer value - let's see if this string can be converted to integer"), and value checking ("this string should be no more than 20 characters", "this should be a positive integer, not larger than 100").

And indeed there will always be lots of soft targets - yet companies that take user's personal details must not be a soft target. High-profile web sites should also know that they will be a target of hackers (the higher the profile, the bigger the lulz for a successful attack after all), and as such have also no excuse to be a soft target. Yet it is several of those that have been proven to be pretty soft targets.

Re:Screw vandalism, especially on "soft targets" (1)

drsmithy (35869) | more than 3 years ago | (#36608214)

Not many houses can stand a SEAL attack, yet it is perfectly possible to connect a computer to the Internet with zero vulnerabilities (think OpenBSD).

Not many houses are built as a small, mostly buried concrete cube with no doors or windows, which is basically what the building equivalent of OpenBSD is.

As soon as you make that OpenBSD system usable by adding functionality, the attack vectors start to open up dramatically.

Re:Screw vandalism, especially on "soft targets" (2)

thegarbz (1787294) | more than 3 years ago | (#36608360)

I don't agree with your analogy, as physical and digital security are too different. Not many houses can stand a SEAL attack, yet it is perfectly possible to connect a computer to the Internet with zero vulnerabilities...

No such thing good sir. Open BSD may stop blaster or some windows virus attaching itself to your system but does zero against attacks on the software that actually make it usable. Rarely are online attacks directed at the operating system hosting the front end. SQL Injection attacks make a database accessible regardless of the system, Vulnerabilities [apache.org] in your HTTP server can give you access to the root of your system, a myriad of poorly coded PHP or other server side code could give access to a system.

If you think not using Windows is the solution to your security concerns then you are acting as negligently as all the people who got caught out in the recent attacks. Windows itself is also quite secure when well patched, put behind a firewall with no ports open, but just like your mythical bulletproof BSD box it would also be quite useless.

Re:Screw vandalism, especially on "soft targets" (1)

wvmarle (1070040) | more than 3 years ago | (#36608398)

The difference with using an out-of-the-box secure system is that at least you know that only what you explicitly open, is open. Nothing else. And the next step is of course to make sure that you do not open anything any more than you intend to.

Re:Screw vandalism, especially on "soft targets" (1)

DrBoumBoum (926687) | more than 3 years ago | (#36608746)

my SQL queries are sent to the database through a library that does the escaping

Just a question in passing, why do you need to send SQL text to the database in the first place? Why not use stored procedures? It seems simpler to me and also cleaner from an architecture perspective (i.e., separating database model from application logic). It also prevents any and all kind of attack against the database, making them impossible even if you for instance forget to escape your strings somewhere.

Re:Screw vandalism, especially on "soft targets" (1)

wvmarle (1070040) | more than 3 years ago | (#36609472)

Well six, seven years ago when I built it up, stored procedures didn't exist in MySQL. I believe it's possible now but not sure whether Debian stable has that version included. That's already a major reason.

Secondly most queries are done through a library call, not by sending the actual SQL command. Like db.query(db, fields, where, options, ...). There is nothing more fancy in it than reading information, no calculations or whatever - simply not needed. Really the most basic use of a db.

Re:Screw vandalism, especially on "soft targets" (2)

Tom (822) | more than 3 years ago | (#36608250)

I claim that a good part of that is a myth.

Securing your house the same as a bank vault is unreasonable, because the physical changes required are massive, and costly, and require infrastructure.

Removing telnet and moving to SSH is not even in the same category.

Many of the "soft targets" are not soft because someone decided that a lock and a deadbolt are enough for their threat scenario, and the windows don't need to be reinforced - they are soft because nobody thought about threat scenarios at all.

Also, because quite frankly, developers suck. We don't let people who know about beauty and composition, but not about structural analysis build houses. But we do let people who know nothing about writing secure software write our e-commerce applications. No surprise they're breaking down left, right and center. There is something to the old saying that if architects would build houses the way programmers write software, the first woodpecker to come along would destroy civilization.

And that's why LulzSec is important. Exactly because they didn't hit the hit-profile targets, but the second or third tier - the servers of some importance, not your personal blog, but not the White House, either. Because those are the people who commonly think the least about security. The bullshit mantra "we are not a target" is still strong in those circles. If that changes, that alone and nothing else, it would be a huge step forward.

Re:Screw vandalism, especially on "soft targets" (1)

pandrijeczko (588093) | more than 3 years ago | (#36608356)

It's actually a very good point.

LulzSec made no mention of how long, prior to launching the attacks, they had spent actually *SELECTING* their targets - it could have been something they'd planned for months in advance, making lists of potential targets and choosing those which would not only get maximum publicity for themselves, but also because they were the easiest in the list to attack.

Not that I condone anything hackers do anyway, but LulzSec actually made some big mistakes in the targets they chose - if a hacking group is seen to be "sticking it to the man" then they may get a degree of admiration and support from the general populace. But attacking sites like the Sony Network and Eve Online where that same general populace gets some of their entertainment from is not going to win them much in the way of support.

It could be argued that better targets would have been banks because of the current bad feeling the general populace has against rich bankers - one therefore has to ask the question therefore if they did *TRY* to hack banking sites but simply could not get in to do any damage; therefore are they nothing more than a bunch of script kiddies with very limited hacking skills.

not everything is relative (2)

sourcerror (1718066) | more than 3 years ago | (#36608522)

DDoSing is very hard to counter and small sites can be DDoSed by legitimate requests as well (see Slashdotted). Also, you don't leak sensitive data while being down. However SQL injection is just fucking pathetic. There's no excuse for that. That's developer negligence. I'm not excusing LulzSec for it, they comitted a crime etc., but it's like leaving your frontdoor open, being robbed, and then lamenting about "what the world has come to".
Also shared PHP hosting sites are vulnerable to other malicious user, but that's also more of a money problem not direct negligence.

Re:A little vandalism goes a long way (2, Funny)

Opportunist (166417) | more than 3 years ago | (#36607970)

Anti-negligence laws? I'd rather guess we'll be seeing some anti-hacker laws.

Why legislate corporations when you can legislate people?

Re:A little vandalism goes a long way (1)

mykos (1627575) | more than 3 years ago | (#36608088)

This is, sadly, the way it will likely go. Rather then a reasonable response, like "we already have laws against hackers, so how about you get better security", we'll probably get something closer to "PATRIOT ACT 2: WARRANTLESS WIRETAPPING BOOGALOO"

Hell, yeah! (-1)

Anonymous Coward | more than 3 years ago | (#36607642)

I myself since the beginning of this year am work on a branch for one of the largest companies in the world which produces several websites worldwide and yesterday posted a small piece of 10-lines SQL code (a procedure) for another employee on a pastebin service.

Guess what? He told me I should have sent by e-mail and was being a freak because I used this instead of 'just e-mailing him' (guess what 2: I don't use my private e-mail account in their computers - and carry along to work with me my laptop - because they've a #epic #fail security). Of course, as the corporate e-mail was not working and the piece of code was not worth commiting to a versioning system or something else that time I used a posting service...

I even went so far as to set it to private and time limiting it to a *** single day of life even thought it was just a simple procedure that at most revealed that the project (that's not classified or something) used databases and stored something related to... itself.

Guess what? The guy went so far as to tell a temporary team leader about that, who alerted me to 'erase it' once it was already copied. So you see two bad business practice here: a) failed to notice the irrelevance of the piece of code; b) management being ok with just deleting something dangerously pasted to all the h4x0rs outta there to see, instead of enforcing good practices.

Hello, it was something very simple and common, possible being found anywhere else. But I understand why. The QA team doesn't test for security [really], neither there's someone to review the code (even thought it's high visibility) and the in-house framework (and there's **** afraid of changing it / used in almost all high visibility websites; and boy, I'm really talking about high visibility here: mi/bi+ dollar companies) is full of bugs [that gets hidden after configuring the server to production mode]. Oh, have I not told you that the development environment isn't set properly?

Okay, enough talking. I don't want to identify myself for obvious reasons. At least there's some reasons I've hope this will change and I'm working in some other cases, away from the mess.

Re:Hell, yeah! (1)

Nursie (632944) | more than 3 years ago | (#36607762)

You're an idiot and should be fired.

You don't post company info on third party sites, end of story. Oh, and there's no such thing as too small for source control.

I have probably just been trolled.

Re:Hell, yeah! (0)

Anonymous Coward | more than 3 years ago | (#36607826)

You're an idiot and should be fired.

You don't post company info on third party sites, end of story. Oh, and there's no such thing as too small for source control.

IHPBT. IMHL. HAND.

FTFY.

Good for the Industry (0)

Anonymous Coward | more than 3 years ago | (#36607662)

Lulzsec will ultimately be used as a case study by IT managers to get proper funding and approval for security projects from the C-level executives. For the next year or so anyway... until the PHB types forget about it and stop caring.

Hacktivism? Teenage scum! (0, Flamebait)

davegravy (1019182) | more than 3 years ago | (#36607672)

A related story at the Guardian suggests that governmental attempts to control the internet are spurring these activities.

These hackers are to the internet as street thugs are to a dark alley! Catch 'em and Guantanamize 'em!

These are acts of activism based on a desire for a better and free society, you say?

Oh please! Next you'll be telling me that many of these hacking act thingies require education, intellect, and creativity beyond that of an average person...

Re:Hacktivism? Teenage scum! (0)

Anonymous Coward | more than 3 years ago | (#36607756)

Oh shut up.

It's not even possible! (1)

Anonymous Coward | more than 3 years ago | (#36607674)

Given that these "rogues" or "hackers" are well skilled with network technology, what do these governments think they can do if the are capable of setting up their own internet? They know how to make the hardware; they know how to make the software; they know how to send communications over different spectrums. The governments would have to have complete control and ability to scramble communications over all possible channels. And even then, a new communication channel can be found and used to transfer electronic signals.

It's a futile, stupid effort. I can set up my own intranet... and then what? The government comes in and takes it away... ok, then build another. They'd have to make it so I couldn't buy certain pieces of hardware. Then the same corporations that profit from that hardware would cry foul for dipping in to their revenue stream. Now you get the government fighting against the same corporations they protected, and well, let's face it, the government will back down.

The scales of justice are weighed in both gold and greed.

Re:It's not even possible! (1)

SuricouRaven (1897204) | more than 3 years ago | (#36608252)

1. Build reciever.
2. Track signal.
3. Send in police.
4. Pound-me-in-the-ass-prison for unlicenced use of a radio transmitter.
5. Publicise, to scare off any others who might try it.

IT knows, they just can't keep up (2)

SuperKendall (25149) | more than 3 years ago | (#36607688)

I don't think people are asleep at the switch, at all.

I also don't think they are relying on security through obscurity.

In large companies I have worked for, there are a lot of very competent people that care a lot about security. But the thing is, security is a minor consideration to spend time and money on compared to making working systems.

Obviously it would be better if that would change, but I don't think honestly it can until someone has had the lesson REALLY driven home to them by a major security issue.

I would bet that within five years Sony security is actually pretty good. It is a good wake-up call to the industry, but remember that generally the alarm clock is only really heard by the owner of the house it rings in...

Simple reason: Nobody wants security (5, Insightful)

Opportunist (166417) | more than 3 years ago | (#36607736)

Nobody wants security. Everyone wants compliance.

From an auditor's point of view, it's very easy to explain the reason why the security in most companies is at a level that's not even laughable. No company is interested in it. What they want is certificates, they want their ISO27k and their PCI-DSS, but not because they want them to know for themselves that they're secure, they want them to display to others that they are, so they can get contracts or are compliant with legal requirements to be allowed to do something.

Now, some might think security and compliance with security requirements is the same. Both mean that you "want" security. And that's the fallacy. Security is something you want yourself. You want security because you want to be secure. Security is in this case the primary interest and the focus by itself. Compliance is something that is forced onto you. You want security because someone else wants you to be secure. Security is in this case only the means to the goal, be it to conform with legal requirements to continue operations or be it to be allowed to process credit card payment.

Within the last decade or so, the number of companies where I actually had the idea that they wanted security for themselves, even if only as a side effect to the compliance requirements, was very, very low. Most want to get done with it, preferably fast and without hassle. If the compliance requirement is that your door is locked and barred but doesn't say anything about your windows, they won't even listen to you if you tell them they have no windows but just big holes in the wall. Their door is sealed, that suffices to be compliant. The windows? Not part of the compliance requirement, we don't care.

Re:Simple reason: Nobody wants security (1)

greg1104 (461138) | more than 3 years ago | (#36607950)

I'm with you on the compliance vs. security angle. Recently I've started working with people who want me to certify I comply with HIPAA guidelines for touching private health care data. The emphasis on paperwork over real security practices there is mind-boggling. I'm been put into an uncomfortable position because I can't morally agree to these policies unless I really mean it--which means I'm facing a huge security expense overhead added to my business--while my competitors do a shady job but mark all the checkboxes that they are compliant. Guess who wins the bids?

Re:Simple reason: Nobody wants security (1)

pandrijeczko (588093) | more than 3 years ago | (#36608440)

I do security hardening and auditing for a number of customers and I have been tempted to drop in the odd profanity into the reports I produce for them, purely to see if anyone actually reads them or not.

I've certainly been on a number of calls with my customers where questions are asked which are very clearly answered within the reports I send to them.

As far as I can see, they just want something to wave at auditors as completed so that the auditors can put a tick in a box.

Re:Simple reason: Nobody wants security (5, Insightful)

Tom (822) | more than 3 years ago | (#36608216)

Disclaimer: I've worked in compliance until recently, but my background is security.

The problem you outline is real, but you are missing a point: Compliance got traction because companies don't invest in security. The risk/reward just doesn't work out. A million credit cards lost? The PR to fix that is a lot cheaper than the security investment to prevent it. And the real damage isn't for you, it's for the credit card holders and their companies.

That's why compliance became so big, because too many people realized that unless you force them, companies won't do security. The same way that airbags in cars didn't become standard issue until some laws were passed. Human beings are horrible at risk management for everything that falls outside our daily experience.

The quality of your compliance managers determines if you're just following the book, or actually bringing an advantage to the company. I proud myself on IT management being happy they had me (I wasn't part of IT, to them I was an outsider from the finance department, the compliance hand of the CFO). You can do compliance in a way that IT doesn't hate and that gives you actual benefits.

Unfortunately, too few compliance managers are IT people, much less IT security experts. Which leads to them doing things "by the book". Or, as it's called in other contexts: Work-to-rule. As we all know, that's not work, that's sabotage.

Re:Simple reason: Nobody wants security (1)

ensignyu (417022) | more than 3 years ago | (#36609184)

I think maybe if some kind of financial liability was introduced, companies would take notice. Say, $50 for lost personal details (name, address), $100 per lost cc number, $5000 per lost SSN.

Smaller companies would have to use payment processor companies with better security. Larger companies and payment processors would have an incentive to not just follow best practices and minimum compliance, but actively conduct audits to reduce risk. Insurance companies would also insist on good security, in theory.

Of course, there's certainly downsides. Companies have shown time and time again that short-term profits overrule sensible decision making, even if the costs of risky behavior could bankrupt the company. On the other hand, I'm not a fan of government-mandated compliance if it's not kept to date with the latest technology and practices; time spent on compliance and paperwork could be better spent actually improving security instead of just talking about it.

And insurance companies -- not sure if they're a necessary evil, or just plain evil, and it's also not unheard of for insurance companies to go bankrupt failing to consider the risks.

But in principle, adding some kind of responsibility for losses would probably improve security overall.

Re:Simple reason: Nobody wants security (2)

pandrijeczko (588093) | more than 3 years ago | (#36608430)

It's very true.

I actually work in security for a telecoms hardware vendor and many of my customers believe that if they state that they want PCI compliance, for example, then that is all they need to do and can hand off all the dirty work of achieving that compliance to the vendors.

As a vendor, we provide servers in a "one size fits all" pre-hardened state because any additional hardening we can do usually depends on the customer's specific topology and environment - so the process we adopt is to let the customer drive the compliance standard, then we do our best to harden to it whilst ensuring the server operation is not affected.

What many customers fail to understand is that hardened servers are only a small part of the compliance, you also have to look at controlled access to the physical hardware, how long and how encrypted you store customer data, etc. etc. It therefore makes no sense for the OEM to manage that compliance.

Only yesterday I had an incident where a customer of mine applied an official update to a server and discovered some of the hardening we'd previously done 6 months ago had been put back to default settings. They were quite shocked when I told them that they should have had processes in place that state what activities should be carried out and in what order, and that we ourselves do not design the processes, just advise and work with the customer when they create those processes.

I also have many situations where two days before new systems go into production, the customer's own security team appears from nowhere with vulnerability scans and refusals to let the systems go live until they are fixed - I have no problem with what they are doing but you'd expect these security guys to be involved in the overall implementation process and to build their security work into the overall project plan in order to avoid last minute panics.

If customers *REALLY* understood compliance standards, rather than just wanting a certificate on a wall, none of the above scenarios could actually happen in the first place.

Nobody wants security, but exceptions occur (1)

EnergyScholar (801915) | more than 3 years ago | (#36609308)

What Opportunist says is true in the great majority of cases. I have seen the truth of it myself. There are, however, notable exceptions:

#1 For some years I was a senior secure-systems developer for Symantec's Norton Store. With personal details and financial information on 60+ million people, huge flows of money, plus the fact that we were a security company, we knew we had a huge glowing orange target reticle painted on us. Security was a huge aspect of corporate culture. While we were very careful to maintain COMPLIANCE with assorted standards, we were equally careful to always go above and beyond the requirements of compliance in order to achieve REAL security. The corporate culture for my (admittedly elite) team treated COMPLIANCE as the starting point for security: if we were not compliant with, e.g. PCI Standards, then we DEFINITELY had a security problem, but compliance was just the start point.

#2 When lives, possibly your own and those of your family and friends, are truly at stake, security takes on a whole new meaning. Being compromised is then not about being embarrassed or losing money, it is much more serious. There is a different gut feeling. One thinks about ALL aspects of security, not just how well the network is secured. I was once involved in such an operation. My security skills were good enough to help protect the Norton Store, but were not adequate for this standard. Instead, a high military security standard was required. When the stakes are very high, different issues arise. In my case, I became a security risk to the project because my children could not be adequately protected, leaving me vulnerable to compromise by threats or actions against my children.

'Suggests'? (1)

atari2600a (1892574) | more than 3 years ago | (#36607836)

Don't you mean 'are known to'?

warm and fuzzy. (1)

villain222 (1120485) | more than 3 years ago | (#36607936)

while i like the idea of security and keeping my stuff secure, i love the fact that this hacktivism shows one very good point. Corporations and the governments they've bought have all been chipping away at society in an attempt to go back to the good old days of serfdom, but when a few people in the masses who happen to know some shit get together, pissed off people get their message across.

governmental attempts to control the internet (2)

mark_elf (2009518) | more than 3 years ago | (#36607974)

If we make internets illegal, only criminals will have internets.

Classical deceit from The Guardian (0)

Anonymous Coward | more than 3 years ago | (#36608132)

The world is a complex place. It's difficult to trace out exactly what leads to what when it comes to human interrelationships and behaviour. But we are still trained to try our best to do so, and to optimise our society by removing the causes of bad things.

How can this be exploited by the evil?

1. They observe that something bad happens
2. They posit that this is caused directly by something they hate
3. Suddenly they have turned what they hate from a special interest for them into a joint interest for everyone

Is it newsworthy or realistic that The Guardian claims that 'three strikes'-laws caused the LulzSec hacks?

Most countries don't have anything of the sort. What was the relative contribution between this, and e.g. newspapers that claimed three-strikes law are bad? Presumably if everyone had said between themselves that three-strikes are good laws then the hackers would have gone 'oh, well, I guess I am really in a minority and most people are OK with this'. So is the cause of radicalisation the three-strikes, or is the cause the people who egg on others to become radical in the face of three-strikes? Or is three-strikes caused by something else entirely?

That said, LulzSec never referred to three-strikes to the best of my knowledge. So you are saying that, although they threw out a lot of random comments, they just never talked about the REAL underlying cause which concerned them? Doesn't seem very likely.

When you are a newspaper that is so biased you feel you need to declare it openly, you should come with a warning label.

AntiSec == security through obscurity? (2)

boron boy (858013) | more than 3 years ago | (#36608184)

LulzSec (and Anonymous) have 'demonstrated that an awful lot of people are either asleep at the switch or believed in arcane security methods like security through obscurity.

Wait what? Lulzsec showed that security though obscurity is bad? I thought the whole point to their "AntiSec" cause was to stop security companies publicly announcing vulnerabilities [wikipedia.org] . Isn't that the definition of security through obscurity?

Oh dear (1)

SmallFurryCreature (593017) | more than 3 years ago | (#36608886)

Eh, this really ain't that hard. It is similar to how the Nazi's showed us how hate is bad.

This article ain't about the agenda of Lulzsec but on what the results of their actions have revealed about IT security.

Yes, antisec is idiotic, it is however not relevant.

The large number of successful hacks recently have shown IT security is in a bad state. The motivations for those hacks are not relevant nor even that a single group did it.

Guardian Article (2)

brit74 (831798) | more than 3 years ago | (#36608202)

> "A related story at the Guardian suggests that governmental attempts to control the internet are spurring these activities."
I have to admit, I read that sentence in the summary and I scoffed. Then I read the article, and I still scoffed.

How about my interpretation of Loz Kaye's article: people who are deeply involved in some cause always find the reason "bad thing happened" to because of "bad thing that they don't like and have been working against". It reminded me a lot of Pat Robertson's claim that 9/11 happened because of the gays and feminists and abortionists. Uh huh. Sure it did.

Terminology (1)

bonch (38532) | more than 3 years ago | (#36608226)

"Hacktivism." Ugh.

The problem as I see it. (2)

Reed Solomon (897367) | more than 3 years ago | (#36608294)

The governments of the western world seem to have it in mind that criminalizing everything will protect them from some sort of boogeyman/men. Hackers, and in general people who steal whats "theirs". People who just want to share their free thought. What the people in power want is for you to second guess everything you say or do, and to live in fear of the consequences. They want to create a cyber police and regulate every aspect of our lives. For what? For profit. To maintain control. No other reason. We've seen thanks to the actions of Anonymous and wikileaks and others how deep the corruption is. We've seen first hand what happens when some group destroys an entire eco system (the gulf of mexico) compared to when someone attacks the state. Now all the cards are on the table. They want to shut it all down. They want three strikes laws. They want search and seizure laws. They want to do things without due process or warrents. They want to impose their twisted morality on the populace. They want to frame Anonymous/Wikileaks and the like and make them out to be pedophiles or terrorists or pirates or rapists. It's rather disgusting how obvious it is. And the most shocking thing of all is that they are actually SURPRISED by the retaliation they are receiving, as minimal as it is! The actions of what appear to be just a few people have terrified the companies who thought they had carte blanc to do as they pleased. However it hasn't pressed them to change their ways, but to hide behind a veneer of superiority and attempt to stop those selfish robin hoods of the internets.

Re:The problem as I see it. (1)

Intrepid imaginaut (1970940) | more than 3 years ago | (#36608520)

The governments of the western world seem to have it in mind that criminalizing everything will protect them from some sort of boogeyman/men.

I think its more that its the easiest line to sell to the voters, at least that's what the politicians believe. Maybe if they had more respect for the intelligence of their citizens and less for Saturday night psychology the world might be a better place.

Wrong line of thought (1)

Errol backfiring (1280012) | more than 3 years ago | (#36608320)

The first law of security is that if anyone get in, anyone can get in. If you make sensitive data available via the web, it is accessible via the web. By anyone. You can make it hard to access, even extremely hard to access, but not impossible. So the very first step in security is the question why the hell you would want to hand over your responsibilities to some automaton that can be accessed by anyone.

Not asleep - in a rut (2)

cheros (223479) | more than 3 years ago | (#36608498)

[disclosure: I do this for a living]

If you look over what happened over the last 5 years or so in security you'll see that nothing really new has happened. We get more sophisticated with defenses, stuff gets more expensive, but fundamentally it's deja vu all over again. 99% of what I come across suffers from a pure tactical focus - no long term thinking, no attempt at understanding the mindset of those seeking to cause harm or steal information, no strategy or root cause analysis of assaults.

The result is that defense has simply turned into an arms race. Immensely profitable for providers, no added value for the customer.

About 5 years ago we started to work on different approaches which normal risk assessment never touches. As a consequence of the insights gained we stamped out bank data theft for our clients without imposing new regimes or buying new equipment - all it took was a month worth of work. However, that requires people that can really think differently, whereas HR has moved towards cookie cutter tick box selections that seem to be aimed at filtering out exactly those people who can make a difference (the use of HR management seems to exacerbate this trend).

Security management has become predictable, and with predictability comes failure. The message is clear: start thinking differently - or lose the battle.

False assertions allows (0)

Anonymous Coward | more than 3 years ago | (#36608620)

a false set off derivitive assertions.

We cant/wont be hacked.
Our data, including data we hold on behalf of our customers wont be stolen.

If someone says they are x, they are x.
If someone knows an account number, a name, and a date of birth, they are x.
If someone knows a secret question they are x.

A trusted servers cant be hacked.
We always accept what a server says.
If a server says something happened, they it did.

People cant use attacks for an agenda.
People wont place demands on us.
If someone is attacked, it is because they dont have the security we have.

The attack didnt happen because it cant.
The attack didnt result in a significant breach of data.
The attack happened 3 months ago.
It wasnt our fault.

We want to force people to do things we want.
People wont force us to do things they want.

Not everyone cares (2)

xnpu (963139) | more than 3 years ago | (#36608702)

When doing consultancy a lot of people told me flat out they didn't care about security. Quotes like "Anyone can walk in here during lunch and steal whatever they like; why would I (as the IT director) spend $$$ on computer security when management doesn't even care to lock the door." were very common. While the logic is obviously flawed it does illustrate that it simply wasn't a priority - which is not the same as living in ignorant bliss.

Security through Obscurity (1)

Dan541 (1032000) | more than 3 years ago | (#36609242)

Anyone who doesn't believe in Security through Obscurity should post their passwords and credit card numbers on /.

Obscurity is a useful component (2)

petes_PoV (912422) | more than 3 years ago | (#36609380)

The point of security is to increase the amount of time it will (would?) take a baddie to do bad things. We know that security can NEVER provide an absolute guarantee that the wrong people won't do the wrong thing - it can only reduce the possibility of that happening.

So it is with obscurity. Provided it is not the ONLY security feature used, it has a place in reducing the visibility of a target - just as camoflage has been doing in the military for hundreds of years. It also adds to the overall difficulty of getting into a secure location (be that a website or building) and therefore has a deterrent effect: even if that's only to move the baddies along to try the next target on the list, rather than yourselves.

Where does that leave obscurity? Right where it needs to be: as a valuable tool in preventing and delaying security breaches. The key thing about it (as with all security features) is to know when it is no longer effective and then to either revamp it or replace it. However, it obviously is still effective for the vast majority of institutions and therefore should not be dismissed.

Load More Comments
Slashdot Login

Need an Account?

Forgot your password?

Submission Text Formatting Tips

We support a small subset of HTML, namely these tags:

  • b
  • i
  • p
  • br
  • a
  • ol
  • ul
  • li
  • dl
  • dt
  • dd
  • em
  • strong
  • tt
  • blockquote
  • div
  • quote
  • ecode

"ecode" can be used for code snippets, for example:

<ecode>    while(1) { do_something(); } </ecode>