Listening to cybersecurity people freak out over Mythos is so tiring. Like, bro, your local water treatment plant runs Windows XP, your mobile provider's hardware is older than you are, and the protocol that routes internet traffic is secured by everyone just agreeing that hijacking it would be uncool.
Discussion
Replies:
18
@malwaretech be fair! We secured BGP with lots of crypto, but then left an XSS exploit in the crypto control panel allowing your entire network to get de-routed with one mis-click. https://mxsasha.eu/posts/ripe-ncc-rpki-exploit-chain/
Fuck Mythos and marketing bullshit, but AI that immensely reduces time-to-exploit is real. Companies are not prepared for it.
@malwaretech The Internet being held together by string and bubble gum is not far from the truth.
@malwaretech I think you're right about the hype level but I think there is something to the idea that all of the places which were gambling on obscurity as their primary defense are probably going to find that strategy looks even worse.
@malwaretech excellent point.
A lot of infrastructure runs outdated software.
But thankfully, most of these systems are not connected to the internet.
@malwaretech And your company CEO's password is password.
Well only hijack / hack mobile connection when it's really necessary like when your princess has escaped and you want to kidnap her back.
@malwaretech I think it would be kinda cool.
@malwaretech I work in a large company that was hacked last year. Many modern systems were compromised. The RS6000 box and several of our ancient mainframes were untouched and weren't even turned off during the lockdown or recovery. Gave them a quick once over and they kept ticking like it was 1999.
"Using encryption on the Internet is the equivalent of arranging an armored car to deliver credit card information from someone living in a cardboard box to someone living on a park bench"
(Gene Spafford)
@malwaretech I think you underestimate how ancient some of us are. I'm definitely older than anything my mobile provider owns, cos I'm older than the industry.
@malwaretech I truly don't understand it. CISOs and managers are jizzing themselves from snake oil is not new but form technical people I'd expect more.
@malwaretech now now, don't be raggin' on my local water treatment plant, they're much more up to date than that. they run Windows Vista.
@malwaretech (don't ask about the Windows NT4 machine in the PLC cabinet. nobody knows what it does but we're all too scared to turn it off in case the 5GB Maxtor hard drive in there dies during spinup)
@gsuberland @malwaretech it's scary 'cause it's true 🫣
@floe @malwaretech it's based on real events :D
@malwaretech I liked the days when we were panicking about China listening in on all our telephone calls / scooping up our mobile data.
Now we just talk directly to some American company's AI and ask them to diagnose our medical problems that we're too embarrassed to see a real doctor for.
