Sadly, the real lesson we need to learn from Battlestar Galactica is not this. They weren't saved by old software, they were saved by not having critical systems on the network unnecessarily.
Our water and power utilities need to re-watch the pilot.
To be fair, it was both. Those ships that got the recent upgrades also got trojans that Caprica Six put in the defense mainframe with Baltar's access codes.
Why are our water and power utilities connected to the internet? Is it so that the employees controlling them can work from home? If so they are accepting too much risk relative to the benefit.
Because other replies aren't really stating it explicitly, let me add...
The water and power utilities are themselves large distributed systems. They need communications between elements just to function properly. They don't exist in a single location where people can go locally manage them in some air-gapped, offline fashion.
There is no option of not having a communication network to monitor and manage these geographically distributed elements. The question is which communication network you would use, and how you would secure it. Whether it is telephones, radio links, or people running around as messengers, it is still a communications network.
Will some "dedicated" network be any safer? If anything, I imagine the fantasy of a private network will lead to even less security. You cannot physically secure the entire signal path. You really need to treat it as untrusted and build your security on top with encryption, authentication, authorization, etc.
In addition to remote monitoring, central control over large systems clearly has benefits: quickly and automatically spinning up a power generation in one location in response to an outage or just increased demand in another one, or conversely spooling down generation in response to a large demand spike going away (many factories need to notify the grid before starting up or shutting down), shutting down water/gas flow upstream of a detected leak, or yes, working from home, which lots of people here regularly argue is a good thing.
You could absolutely make the case that it isn't worth the risk, but that isn't the same as not having benefits.
No, and it's not strictly impossible to correctly build out a SOC / SIEM and ingest all the logs you want and pay for the right engineers to make sure it all works correctly. But damned if anyone manages to do a great job in this area. It's too complex and too expensive, so almost everyone settles for "best effort."
A lot of problems are easy conceptually, but we can't manage to tackle them.
think about a grid responding to demand. The old model (like the titanic) had a remote manager phoning the site lead who phoned the control room who phoned the engineering room.
Remote management has clear benefits, don’t be obtuse. I totally agree on the security risks, but the benefits are obvious.
I'm not seeing why it has to be connected to the internet. Make it a private, air-gapped intranet for all (or most) of the benefits of being "connected", but with no entry point for someone sitting on another continent to turn off the water.
I’m glad you raised this point. What are some of the better VPNs you’ve seen for secure industrial .
I asked because of books I had read about the bad ones, where unsecured industrial control protocols were exposed wirelessly , or via vpns. And I’ve been curious if any good ones are out there .
Are you talking about the media layer or the application layer? What would be the alternative to using the internet media layer? Every utility running their own private media ? So a duplicate network of media, as broad physically as the internet, that’s not connected to the internet? That hackers could tap into, and with poorer security, because it wouldn’t be constantly probed.
From a efficiency perspective centralized anything seems better at first glance, however decentralized anything just seems more resilient in the long run like nature and/or our universe.
> the real lesson we need to learn from Battlestar Galactica
It's the same lesson that we can learn from Star Trek, Star Wars, and all the other self-aggrandising lore that humanity concocts when gazing lovingly in the mirror.
There is no greater enemy than greedy, barbaric humanity itself.
Makes it harder to catch you in a general sweep, but it probably makes it much easier if anyone decides to target you specifically. How good a tradeoff that is varies from person to person. And the difficulty of targeting a specific person is changing in an AI world. I wouldn't try to characterize it any farther than that, just to observe that it is changing. "Hey AI go individually research and target county clerks for getting direct access to their {specific system}" is much more practical today than it was 10 years ago, and will be even more so 10 years from now.
It reminds me of an interview with police detectives. They say that some criminals think that using weapons like swords and bows will make the police job harder because police is so used to deal with guns that they may have a blind spot.
The thing is: police actually have data on swords and bows, and the fact it is so unusual to commit crimes with these limit the search space and tend to make the investigation easier.
It's incredible how far back the surveillance state goes - GSM mobile phones have an IMEI number that's tied to the handset - and the SIM is tied to the subscriber, and your phone broadcasts imei to neighboring towers constantly.
I haven't really gotten really into this, but from what I can tell, anything that has to do with mobile phones is strictly worse in terms of anonimity than Wifi.
At least anything that ties a Wifi connection to you you can change in an OS setting, but if you get into faking IMEI/SIM stuff, that can very quickly get you charged with an actual crime.
One of the things about mobile phone is that there's 2 OSes on the phone: one that handles the phone stuff and the other that you as a user actually interact with. What's really scary about it is that the OS we do not think about is often licensed to the manufacturer (Apple, Samsung, etc.), closed-source, and dated. There's a lot of security firms that sell fake cell towers to law enforcement and governments and that gives them access to all of the data you send over the network. In older formats like 2G there was no encryption on anything sent over the wire.
If you dig into the fake cell tower rabbit hole you'll find what you're talking about to be an even worse problem.
Doesn't the whole SIM architecture exist so that phones don't have to be trusted? I believe IMEI can be anything in practice, so long that there isn't a blatant duplicate nearby, a bit like Ethernet MAC address. I don't know if it's legal but phone nerds seem to be editing IMEI all the time for non-Apple phones as well, using those leaked vendor tools.
I think the argument is more the IMEI side of things, one might naively expect that they could could simply change SIM and that would change ones identity and that anything like an IMEI could be easily configurable like how a MAC is on a NIC is.
Sure and of course surveil in general. To advertise capabilities one does not need a unique identifier it's clear that part of the rational for the development is to allow for control over the devices by telco's and/or the state, in a way that link layer for other networking technology did not. A while ago I brought a pixel second hand my intention to put a custom rom on it but it was locked by the carrier entirely and though unlocked the carrier simply decided to not allow their pixels to be flashed. All of that to say that obviously the decisions made where not entirely for simply because of the technical reality or for reasons beneficial to the users and lots of things that are hostile to privacy and real ownership of the device.
This seems largely to be about security by obscurity.
I was hoping it was gonna be about how our modern practices are making things less secure.
For instance, we claim we need to be able to rapidly update clients so that we can patch security vulnerabilities as they are discovered (often without involving the user at all). And there are a lot of companies that have an incentive to push this narrative because they have products which facilitate this whack-a-mole approach to security. But there's no reason to believe that new software is more secure than old software. Old software is just more likely to be known to be insecure. So anything written before it became trendy to update without your user's consent is more secure in at least one way because it is not configured to automatically update to whatever comes down the pipe from "the vendor".
Right, the sub-headline "security through antiquity" is a nod to both the oft-repeated "security through obscurity," while pointing out the fact that antiquity is sometimes underutilized or undervalued as a security mechanism (even if not tamperproof). Cyber defenses are thus best multi-pronged, which offers the best protection- by maximizing the amount of time an intruder would need to spend to determine what system it is using.
About your second comment- newer systems CAN be less secure, but not always. But even if they are, falling back on things like eLoran are important.
Sure, it can go either way, and so which version to use is a decision to be made by the user, not on their behalf by a vendor.
Consider the CrowdStrike debacle. It wouldn't have been a big deal if they could just boot to yesterday's config because today's config is broken, but neither vendor involved trusts their users enough for that kind of thing, which turned it into a disaster.
It's remarkable how much more time one has to wait just to access the same level of information (Cookie Policy, EULAs, etc).
Even with "lighter" weight HTTP Firewall utilities such as Anubis (https://github.com/techaroHQ/anubis), the average user has to pay for other's (DDoSers) misdeeds. Now no one can visit a site without a firewall unless it's static and rate-limited by IP address to avoid crashing a small home server. Some impressive LMDBs might be able to serve up to 100,000 requests per second on a lightweight PC, but then again they could still be knocked offline from a super resourceful organization. I like not putting all my eggs in one basket.
A similar bug could happen with something like Cloudflare- the computer serving up the firewall could have a bug, and it's not programmed to fall back on serving the site without the gatekeeping. If the site is prominent enough, it might routinely face DoS attacks which prevents it from being used. But if it's an uneventful day, it could still manage a lower-tech firewall and still be functional.
> Interest in magnetic tape is only increasing further today because the cost of random access memory (Ram), a form of computer memory that doesn't rely on tape, is skyrocketing.
I understand BBC may not have the technical background to critically assess this approach, but whoever using Eudora (I loved it in 2001 btw) for security should get their credentials removed via King's order. Security through "obsolescence" is no different from security through obscurity - therefore, it doesn't work. Somebody not bothering to look for holes in your software doesn't mean they don't exist - in the age of Claude - I am pretty sure I can destroy your legacy software in minutes.
> in the age of Claude - I am pretty sure I can destroy your legacy software in minutes.
Yes but you'd need to a) know that they use that particular software and b) have a reason to bother destroying it in the first place.
That is really the crux of the idea.
The client the guy in the article uses isn't secure because it has no security vulnerabilities - it is secure because nobody bothers to target Eudora users in general.
Of course as others mentioned, if the target switches from "Eudora users in general" to "that guy in particular" then the situation changes (though the attackers would still need to realize he uses Eudora - assuming this article didn't exist to reveal it anyway :-P).
But aside from that, even "in the age of Claude", i doubt anyone is wasting time and/or tokens scanning the open Internet for all sorts of old vulnerabilities in antique software that (relatively) nobody uses in hopes they catch some random passer-by as there is barely any ROI by doing that compared to taking advantage of vulnerabilities on software that people actually use.
I would be curious to know what kind of vulnerabilities the latest version of Eudora (7.1.0.9 I think) has. With how old it is (2006), surely there are several critical vulnerabilities, but all I could find when looking online is that an IMAP server or SMTP server can execute arbitrary code, which doesn't seem likely to cause a real problem, because I wouldn't expect Google, Yahoo, Microsoft, etc. to use this trick.
The article links to a vulnerability from 1998, which I expect is already fixed in the versions of Eudora people still use.
I agree it would probably be easy for AI to find exploitable bugs though.
> I understand BBC may not have the technical background...
This is BBC Future - the BBC's tech clickbait publisher - not BBC News.
BBC consists of the non-profit news bureau as well as at least a dozen for-profit clickbait and listicle publishers. BBC's ad-free mandate is only for the UK.
> in the age of Claude - I am pretty sure I can destroy your legacy software in minutes
Yep. One of our PortCos has unrestricted access to Anthropic and GPT models. With whitebox testing, it's trivial to identify vulns in legacy environments. With blackbox testing, it takes some effort but it doable with the right steering.
>But the team picked an older software version for their honeypot that had been upgraded multiple times since its release and, consequently, no hackers bothered to target it. "When we upgraded it to the new one, we had all the attacks we wanted," recalls Bishop. "I thought it was so amusing."
It feels like fantasy imo
While I could understand using outdated or not popular protocols, then software with known vulns seems crazy when we are living in world of automated, ai assisted scanners
Let's say your security budget is pretty limited, and you can say with relative certainly that there's only a 0.1% chance of any adversary bothering to check the known flaws in your FossileWare(tm) Firewall in a given month.
Vs.how many dire flaws have been found in big-name security products in the past year, that even a low-budget adversary is likely to be regularly checking for?
There is no human making a decision on what attacks to run. They check for literally everything. 20 years ago, I ran a web server and would run 'tail -f' on the access logs. I watched the bots sending requests for files that only exist on linux, then send requests for files that only exist on windows. They don't know what kind of system they are hacking. They just know that there is a computer at that IP address.
There are databases that list every known flaw in existence, and the bots just go down the list checking each and every one. And if it doesn't work, in 5 minutes, they'll run those same tests again as if something changed in those 5 minutes.
If you're getting scanned, keep logs, and have a decent way to tag log entries with the associated vuln, then you can start building statistical models of how exploit attempt probabilities fade as the target software gets older and lower market share. No, the 0.1% won't be exact. Yes, such data and models can be shared.
Paying $$$ for a LatestGreatest(tm) Firewall won't make you 100% secure either. And the $$$ might better be spent on an extra layer of swiss cheese, or better recovery capability.
I am one of those emacs users who use it for everything, it always worries me the way that it could be attacked given (particularly email some how evaling some elisp or something), Despite how easy emacs would be to exploit in many aspects I do not know of any attack done on emacs either through supply chain attack (think about how many third party libs an emacs mode might use) or one of the many ways that it's no doubt possible to get emacs to eval something the user would not want it to do. If anyone knows why or if their has been an attack on emacs I would love to know.
See "The Cuckoo's Egg" [1] by Cliff Stoll (who sometimes posts here [2]). A few related HN threads: [3] [4] [5]. The book describes tracking down a hacker in 1986 who exploited a vulnerability in early Emacs' movemail utility.
>The Irish Aviation Authority, for instance, recently decided to keep ground-based radio navigation beacons in use because supposedly the more modern satellite-based global positioning system (GPS) has proven so susceptible to jamming in recent years.
Back when my friend Jim (retired Pilot) and I visited Chicago's Approach Control facility, I asked one question "What would happen if GPS went away?", they didn't like the question one bit.
It's really not good the way we're getting rid of ground based navigation aids in the US.
There is definitely a trough of vulnerability for older machines.
For Windows 3.1/95/98 I feel they were incredibly vulnerable in the 2000s and 2010s, but now they have aged so much where getting to them is becoming a hurdle and a chore preventing attackers from making it to the target.
Reminds me of a sci-fi book I read where the protagonist goes to hack a computer but can't because it's running a 50 year old alien OS that none of his tools will run on.
That said, as a strategy it will only protect you from bots going after low-hanging fruit, not someone targeting you specifically.
Money defines the targets, and usually people running old software are thought not to have money. It is a zero sum game that shifts with the technology and ends when technology no longer is the theater where people can make or steal money.
Eh not really true at all with my experience. 100 million dollar industries commonly have old crap running for years that becomes nearly untouchable as staff rotates and everyone gets afraid to touch it.
Another reason is that a lot of tech from 20 years ago uses the QNX microkernel operating system, which is highly secure even when the software is never patched.
The problem is that most of these older devices are about to be replaced and many manufacturers have switched to Linux for their operating system. It's cheaper and requires no licensing, but far more insecure. It needs almost constant patching to stay secure because the attack surface is so large.
virus source code published in books and magazines. We don't have such threats anymore.
--
No, we do not need this anymore - today you have CAPTCHAs, convincing people to copy & paste PowerShell code on their machine and execute it with Admin privileges! :-D
I know someone who works at a data center for the IRS, and a lot of their records are all stored in PDFs. He thought it was disgusting when he first learned about it, but eventually realized that it's essentially resistant to a large scale data leak. Retrieval just isn't fast enough.
Presumably the pdfs are so large that moving any significant chunk of them over available bandwidth takes so much time, and requires so much storage, that doing so just isn't useful for the attacker.
While I don't know any of the relevant numbers involved, imagine a scenario where exfiltrating even 10% of the total data would take years. What would be the point?
A malicious actor can target individual records, but leaking a lot of them becomes impractical.
Sadly, the real lesson we need to learn from Battlestar Galactica is not this. They weren't saved by old software, they were saved by not having critical systems on the network unnecessarily.
Our water and power utilities need to re-watch the pilot.
"They weren't saved by old software, they were saved by not having critical systems on the network unnecessarily."
"Modern" software unecessarily includes and routinely unnecessarily forces network connectivity
Perhaps they were saved by an old mindset
Doing some reading over at textfiles.com can reveal how cautious people were in the 1990's about connecting to the internet
To be fair, it was both. Those ships that got the recent upgrades also got trojans that Caprica Six put in the defense mainframe with Baltar's access codes.
[flagged]
Why are our water and power utilities connected to the internet? Is it so that the employees controlling them can work from home? If so they are accepting too much risk relative to the benefit.
Because other replies aren't really stating it explicitly, let me add...
The water and power utilities are themselves large distributed systems. They need communications between elements just to function properly. They don't exist in a single location where people can go locally manage them in some air-gapped, offline fashion.
There is no option of not having a communication network to monitor and manage these geographically distributed elements. The question is which communication network you would use, and how you would secure it. Whether it is telephones, radio links, or people running around as messengers, it is still a communications network.
Will some "dedicated" network be any safer? If anything, I imagine the fantasy of a private network will lead to even less security. You cannot physically secure the entire signal path. You really need to treat it as untrusted and build your security on top with encryption, authentication, authorization, etc.
That explains why they are networked, not why internet access is required.
The problem of secure networking has been solved long ago but there is no incentive for OT solution architects to get it right.
It makes sense to have them connected for a lot of reasons.
which reasons?
In addition to remote monitoring, central control over large systems clearly has benefits: quickly and automatically spinning up a power generation in one location in response to an outage or just increased demand in another one, or conversely spooling down generation in response to a large demand spike going away (many factories need to notify the grid before starting up or shutting down), shutting down water/gas flow upstream of a detected leak, or yes, working from home, which lots of people here regularly argue is a good thing.
You could absolutely make the case that it isn't worth the risk, but that isn't the same as not having benefits.
Remote monitoring is one of them presumably
But is it completely impossible to separate the monitoring and equipment/management?
Stupid example like the equipment itself is not networked, but you could watch via a webcam and/or get metrics via image recognition.
Maybe it's safer just to have somebody work the night shift.
No, and it's not strictly impossible to correctly build out a SOC / SIEM and ingest all the logs you want and pay for the right engineers to make sure it all works correctly. But damned if anyone manages to do a great job in this area. It's too complex and too expensive, so almost everyone settles for "best effort."
A lot of problems are easy conceptually, but we can't manage to tackle them.
think about a grid responding to demand. The old model (like the titanic) had a remote manager phoning the site lead who phoned the control room who phoned the engineering room.
Remote management has clear benefits, don’t be obtuse. I totally agree on the security risks, but the benefits are obvious.
I'm not seeing why it has to be connected to the internet. Make it a private, air-gapped intranet for all (or most) of the benefits of being "connected", but with no entry point for someone sitting on another continent to turn off the water.
mostly, because setting up a separate network is harder.
a virtual network built upon the regular internet is much easier.
And yes, mostly done wrong
I’m glad you raised this point. What are some of the better VPNs you’ve seen for secure industrial .
I asked because of books I had read about the bad ones, where unsecured industrial control protocols were exposed wirelessly , or via vpns. And I’ve been curious if any good ones are out there .
Are you talking about the media layer or the application layer? What would be the alternative to using the internet media layer? Every utility running their own private media ? So a duplicate network of media, as broad physically as the internet, that’s not connected to the internet? That hackers could tap into, and with poorer security, because it wouldn’t be constantly probed.
Sounds like a good application of mesh networks.
The point is NOT older, rather decentralized!
From a efficiency perspective centralized anything seems better at first glance, however decentralized anything just seems more resilient in the long run like nature and/or our universe.
> the real lesson we need to learn from Battlestar Galactica
It's the same lesson that we can learn from Star Trek, Star Wars, and all the other self-aggrandising lore that humanity concocts when gazing lovingly in the mirror.
There is no greater enemy than greedy, barbaric humanity itself.
They're good lessons, so why insult it? Why mock quality storytelling that makes good impressions on people?
Makes it harder to catch you in a general sweep, but it probably makes it much easier if anyone decides to target you specifically. How good a tradeoff that is varies from person to person. And the difficulty of targeting a specific person is changing in an AI world. I wouldn't try to characterize it any farther than that, just to observe that it is changing. "Hey AI go individually research and target county clerks for getting direct access to their {specific system}" is much more practical today than it was 10 years ago, and will be even more so 10 years from now.
It reminds me of an interview with police detectives. They say that some criminals think that using weapons like swords and bows will make the police job harder because police is so used to deal with guns that they may have a blind spot.
The thing is: police actually have data on swords and bows, and the fact it is so unusual to commit crimes with these limit the search space and tend to make the investigation easier.
It's incredible how far back the surveillance state goes - GSM mobile phones have an IMEI number that's tied to the handset - and the SIM is tied to the subscriber, and your phone broadcasts imei to neighboring towers constantly.
I haven't really gotten really into this, but from what I can tell, anything that has to do with mobile phones is strictly worse in terms of anonimity than Wifi.
At least anything that ties a Wifi connection to you you can change in an OS setting, but if you get into faking IMEI/SIM stuff, that can very quickly get you charged with an actual crime.
One of the things about mobile phone is that there's 2 OSes on the phone: one that handles the phone stuff and the other that you as a user actually interact with. What's really scary about it is that the OS we do not think about is often licensed to the manufacturer (Apple, Samsung, etc.), closed-source, and dated. There's a lot of security firms that sell fake cell towers to law enforcement and governments and that gives them access to all of the data you send over the network. In older formats like 2G there was no encryption on anything sent over the wire.
If you dig into the fake cell tower rabbit hole you'll find what you're talking about to be an even worse problem.
I think this how modern CPUs work also.
Doesn't the whole SIM architecture exist so that phones don't have to be trusted? I believe IMEI can be anything in practice, so long that there isn't a blatant duplicate nearby, a bit like Ethernet MAC address. I don't know if it's legal but phone nerds seem to be editing IMEI all the time for non-Apple phones as well, using those leaked vendor tools.
> surveillance state
How do you suppose mobile phones are meant to work without subscriber info?
> I haven't really gotten really into this
Clearly.
I think the argument is more the IMEI side of things, one might naively expect that they could could simply change SIM and that would change ones identity and that anything like an IMEI could be easily configurable like how a MAC is on a NIC is.
IMEI is needed to allow them to identify the device's capabilities, and know if it's been reported stolen.
Sure and of course surveil in general. To advertise capabilities one does not need a unique identifier it's clear that part of the rational for the development is to allow for control over the devices by telco's and/or the state, in a way that link layer for other networking technology did not. A while ago I brought a pixel second hand my intention to put a custom rom on it but it was locked by the carrier entirely and though unlocked the carrier simply decided to not allow their pixels to be flashed. All of that to say that obviously the decisions made where not entirely for simply because of the technical reality or for reasons beneficial to the users and lots of things that are hostile to privacy and real ownership of the device.
Anything billed by the second has good (-enough) cost attribution built in.
This seems largely to be about security by obscurity.
I was hoping it was gonna be about how our modern practices are making things less secure.
For instance, we claim we need to be able to rapidly update clients so that we can patch security vulnerabilities as they are discovered (often without involving the user at all). And there are a lot of companies that have an incentive to push this narrative because they have products which facilitate this whack-a-mole approach to security. But there's no reason to believe that new software is more secure than old software. Old software is just more likely to be known to be insecure. So anything written before it became trendy to update without your user's consent is more secure in at least one way because it is not configured to automatically update to whatever comes down the pipe from "the vendor".
Right, the sub-headline "security through antiquity" is a nod to both the oft-repeated "security through obscurity," while pointing out the fact that antiquity is sometimes underutilized or undervalued as a security mechanism (even if not tamperproof). Cyber defenses are thus best multi-pronged, which offers the best protection- by maximizing the amount of time an intruder would need to spend to determine what system it is using.
About your second comment- newer systems CAN be less secure, but not always. But even if they are, falling back on things like eLoran are important.
Sure, it can go either way, and so which version to use is a decision to be made by the user, not on their behalf by a vendor.
Consider the CrowdStrike debacle. It wouldn't have been a big deal if they could just boot to yesterday's config because today's config is broken, but neither vendor involved trusts their users enough for that kind of thing, which turned it into a disaster.
Forgot about that. I intially thought you were referring to CloudFlare Captcha's, which Google and Firefox are partnering with: https://www.techtimes.com/articles/318891/20260623/cloudflar...
It's remarkable how much more time one has to wait just to access the same level of information (Cookie Policy, EULAs, etc).
Even with "lighter" weight HTTP Firewall utilities such as Anubis (https://github.com/techaroHQ/anubis), the average user has to pay for other's (DDoSers) misdeeds. Now no one can visit a site without a firewall unless it's static and rate-limited by IP address to avoid crashing a small home server. Some impressive LMDBs might be able to serve up to 100,000 requests per second on a lightweight PC, but then again they could still be knocked offline from a super resourceful organization. I like not putting all my eggs in one basket.
A similar bug could happen with something like Cloudflare- the computer serving up the firewall could have a bug, and it's not programmed to fall back on serving the site without the gatekeeping. If the site is prominent enough, it might routinely face DoS attacks which prevents it from being used. But if it's an uneventful day, it could still manage a lower-tech firewall and still be functional.
> Interest in magnetic tape is only increasing further today because the cost of random access memory (Ram), a form of computer memory that doesn't rely on tape, is skyrocketing.
hmm
Sign of quality journalism? LLM's probably would not have made such a misstake ..
I understand BBC may not have the technical background to critically assess this approach, but whoever using Eudora (I loved it in 2001 btw) for security should get their credentials removed via King's order. Security through "obsolescence" is no different from security through obscurity - therefore, it doesn't work. Somebody not bothering to look for holes in your software doesn't mean they don't exist - in the age of Claude - I am pretty sure I can destroy your legacy software in minutes.
> in the age of Claude - I am pretty sure I can destroy your legacy software in minutes.
Yes but you'd need to a) know that they use that particular software and b) have a reason to bother destroying it in the first place.
That is really the crux of the idea.
The client the guy in the article uses isn't secure because it has no security vulnerabilities - it is secure because nobody bothers to target Eudora users in general.
Of course as others mentioned, if the target switches from "Eudora users in general" to "that guy in particular" then the situation changes (though the attackers would still need to realize he uses Eudora - assuming this article didn't exist to reveal it anyway :-P).
But aside from that, even "in the age of Claude", i doubt anyone is wasting time and/or tokens scanning the open Internet for all sorts of old vulnerabilities in antique software that (relatively) nobody uses in hopes they catch some random passer-by as there is barely any ROI by doing that compared to taking advantage of vulnerabilities on software that people actually use.
I would be curious to know what kind of vulnerabilities the latest version of Eudora (7.1.0.9 I think) has. With how old it is (2006), surely there are several critical vulnerabilities, but all I could find when looking online is that an IMAP server or SMTP server can execute arbitrary code, which doesn't seem likely to cause a real problem, because I wouldn't expect Google, Yahoo, Microsoft, etc. to use this trick.
The article links to a vulnerability from 1998, which I expect is already fixed in the versions of Eudora people still use.
I agree it would probably be easy for AI to find exploitable bugs though.
> I understand BBC may not have the technical background...
This is BBC Future - the BBC's tech clickbait publisher - not BBC News.
BBC consists of the non-profit news bureau as well as at least a dozen for-profit clickbait and listicle publishers. BBC's ad-free mandate is only for the UK.
> in the age of Claude - I am pretty sure I can destroy your legacy software in minutes
Yep. One of our PortCos has unrestricted access to Anthropic and GPT models. With whitebox testing, it's trivial to identify vulns in legacy environments. With blackbox testing, it takes some effort but it doable with the right steering.
wait until you find out that a large percentage of operating system developers use mutt, alpine or mail.
>But the team picked an older software version for their honeypot that had been upgraded multiple times since its release and, consequently, no hackers bothered to target it. "When we upgraded it to the new one, we had all the attacks we wanted," recalls Bishop. "I thought it was so amusing."
It feels like fantasy imo
While I could understand using outdated or not popular protocols, then software with known vulns seems crazy when we are living in world of automated, ai assisted scanners
Let's say your security budget is pretty limited, and you can say with relative certainly that there's only a 0.1% chance of any adversary bothering to check the known flaws in your FossileWare(tm) Firewall in a given month.
Vs.how many dire flaws have been found in big-name security products in the past year, that even a low-budget adversary is likely to be regularly checking for?
There is no human making a decision on what attacks to run. They check for literally everything. 20 years ago, I ran a web server and would run 'tail -f' on the access logs. I watched the bots sending requests for files that only exist on linux, then send requests for files that only exist on windows. They don't know what kind of system they are hacking. They just know that there is a computer at that IP address.
There are databases that list every known flaw in existence, and the bots just go down the list checking each and every one. And if it doesn't work, in 5 minutes, they'll run those same tests again as if something changed in those 5 minutes.
Yep, this kind of stuff is easily automated these days and bots don't get bored.
> a 0.1% chance of any adversary bothering to check the known flaws in your FossileWare(tm) Firewall in a given month.
How would you arrive at this percentage in your risk analysis?
If you're getting scanned, keep logs, and have a decent way to tag log entries with the associated vuln, then you can start building statistical models of how exploit attempt probabilities fade as the target software gets older and lower market share. No, the 0.1% won't be exact. Yes, such data and models can be shared.
Paying $$$ for a LatestGreatest(tm) Firewall won't make you 100% secure either. And the $$$ might better be spent on an extra layer of swiss cheese, or better recovery capability.
I am one of those emacs users who use it for everything, it always worries me the way that it could be attacked given (particularly email some how evaling some elisp or something), Despite how easy emacs would be to exploit in many aspects I do not know of any attack done on emacs either through supply chain attack (think about how many third party libs an emacs mode might use) or one of the many ways that it's no doubt possible to get emacs to eval something the user would not want it to do. If anyone knows why or if their has been an attack on emacs I would love to know.
See "The Cuckoo's Egg" [1] by Cliff Stoll (who sometimes posts here [2]). A few related HN threads: [3] [4] [5]. The book describes tracking down a hacker in 1986 who exploited a vulnerability in early Emacs' movemail utility.
[1] https://en.wikipedia.org/wiki/The_Cuckoo%27s_Egg_(book)
[2] https://news.ycombinator.com/user?id=CliffStoll
[3] https://news.ycombinator.com/item?id=21830277
[4] https://news.ycombinator.com/item?id=39843930
[5] https://news.ycombinator.com/item?id=49406713
Very nice thank you!
>The Irish Aviation Authority, for instance, recently decided to keep ground-based radio navigation beacons in use because supposedly the more modern satellite-based global positioning system (GPS) has proven so susceptible to jamming in recent years.
Back when my friend Jim (retired Pilot) and I visited Chicago's Approach Control facility, I asked one question "What would happen if GPS went away?", they didn't like the question one bit.
It's really not good the way we're getting rid of ground based navigation aids in the US.
Here is a good example where this is not so. Unfortunately, my datacenter runs this vulnerable VMS release on an emulated VAX.
https://www.theregister.com/on-prem/2018/02/06/ghost-in-the-...
There is definitely a trough of vulnerability for older machines.
For Windows 3.1/95/98 I feel they were incredibly vulnerable in the 2000s and 2010s, but now they have aged so much where getting to them is becoming a hurdle and a chore preventing attackers from making it to the target.
Reminds me of a sci-fi book I read where the protagonist goes to hack a computer but can't because it's running a 50 year old alien OS that none of his tools will run on.
That said, as a strategy it will only protect you from bots going after low-hanging fruit, not someone targeting you specifically.
Money defines the targets, and usually people running old software are thought not to have money. It is a zero sum game that shifts with the technology and ends when technology no longer is the theater where people can make or steal money.
Eh not really true at all with my experience. 100 million dollar industries commonly have old crap running for years that becomes nearly untouchable as staff rotates and everyone gets afraid to touch it.
Another reason is that a lot of tech from 20 years ago uses the QNX microkernel operating system, which is highly secure even when the software is never patched.
The problem is that most of these older devices are about to be replaced and many manufacturers have switched to Linux for their operating system. It's cheaper and requires no licensing, but far more insecure. It needs almost constant patching to stay secure because the attack surface is so large.
The Irish example seems good. Keeping the old tech in parallel rather than replacing
MS-DOS: Over 45 years, and STILL NO remote holes in the default install!
Well, there is no protection against compromised floppy disk sent by snail mail.
I have also seen virus source code published in books and magazines. We don't have such threats anymore.
Yes there is. Simply don't boot it or execute the virus. There is no autorun in MS-DOS, you know...
--
virus source code published in books and magazines. We don't have such threats anymore.
--
No, we do not need this anymore - today you have CAPTCHAs, convincing people to copy & paste PowerShell code on their machine and execute it with Admin privileges! :-D
I wonder if anyone looked for vulnerabilities in the TCP/IP stack or DOS redirector.
This is terrible advice and I feel like this article will be used by managers of outdated IT systems to defend not upgrading their tech stack.
There are hospitals out there still running on windows XP. Someone's going to skim this article and say "look, we're actually being prudent"!
Things that are plenty and cheap to replace are easy to hack because if you broke them, you could always try again...
Box cutters? Plentiful, cheap, impossible to "hack".
Nuclear centrifuge software? Rare, expensive, hacked.
Daily reminder that connecting everything to the cloud was a terrible idea and should never have happened like it did.
I know someone who works at a data center for the IRS, and a lot of their records are all stored in PDFs. He thought it was disgusting when he first learned about it, but eventually realized that it's essentially resistant to a large scale data leak. Retrieval just isn't fast enough.
How is it resistant? Can't all the pdfs just be leaked?
Right, the entire PDF.
You can't just create a tiny csv of the records you want. You need to upload GBs of data which is easily noticed by any of the routers involved.
Although I mean just because somebody noticed data is being leaked they might not have the authority to stop that doge employee or whomever.
Presumably the pdfs are so large that moving any significant chunk of them over available bandwidth takes so much time, and requires so much storage, that doing so just isn't useful for the attacker.
While I don't know any of the relevant numbers involved, imagine a scenario where exfiltrating even 10% of the total data would take years. What would be the point?
A malicious actor can target individual records, but leaking a lot of them becomes impractical.