back to article Schneier warns of 'perfect storm': Tech is becoming autonomous, and security is garbage

With insecure computers in charge, the healthcare and transportation sectors have become a nexus of security problems, infosec veteran Bruce Schneier warned delegates at Israel Cyber Week. Schneier said that confidentiality attacks, such as leaks of personal information, are being replaced by more dangerous integrity and …

Page:

  1. Anonymous Coward
    Anonymous Coward

    'Security is failing just as technology is becoming autonomous'

    The problem is the "Dumb Fucks" generation is just too indifferent to care... One month after Amazon Alexa secretly recorded a couples conversation and forwarded it to a random entry in their phonebook.... Marriott hotels announces they're installing these devices in guests bedrooms. WTF???

    ~~~~~~~~~~~~

    https://www.bbc.co.uk/news/technology-43747421

    https://www.bbc.co.uk/news/technology-44534597

    https://www.theregister.co.uk/2018/05/24/alexa_recording_couple/

    1. Wellyboot Silver badge

      Re: 'Security is failing just as technology is becoming autonomous'

      If you can pull the plug on the thing then there's no issue, if not then accidents happen

      1. Destroy All Monsters Silver badge

        Re: 'Security is failing just as technology is becoming autonomous'

        I'm sorry the plug is an IoT device. Do you want help with that?

      2. steviebuk Silver badge

        Re: 'Security is failing just as technology is becoming autonomous'

        They'll probably embed them into the walls to stop people stealing them. And then charge you if an "accident happens" during your stay. Maybe wrapping it in tinfoil might work? (not a piss take. I wonder if it would block the mic).

      3. Doctor Syntax Silver badge

        Re: 'Security is failing just as technology is becoming autonomous'

        "If you can pull the plug on the thing then there's no issue, if not then accidents happen"

        Likelihood is that the plug doesn't get pulled until the accident's happened.

    2. Christian Berger

      It's a logical conclusion to stopping to educate people

      Back in my age, there were mandatory programming lessons at school, and things like data protection were explained on TV even in "Edutainment"-Form.

      Of course the "knowing Excel is a valuable ability"-Generation has no idea how computers work and why we should not engage in some forms of their abuse.

      At least in Germany in the 1980s there was a strong opposition to data abuse. For example there's a TV report on the "car of the future" which details an early nav-aid. It used a central computer and tracked the car via induction loops. It stated that using that data to check for speeders was obviously an abuse of it.

      1. Brian Miller

        Re: It's a logical conclusion to stopping to educate people

        Back in my age, there were mandatory programming lessons at school, and things like data protection were explained on TV even in "Edutainment"-Form.

        Back in my age, the one computer room in one of the math classrooms had two Teletype machines with paper tape units, two Ohio Scientific boxes, and a couple of Ataris. Oh, the days of the acoustic couplers! Yes, and the Sperry-Univac 90/40 was state of the art.

        So what's been learned between then and now? Nothing. A few years ago I interviewed for a position with a new company, and the fellow in charge told be he knew nothing of the what needed to be done. Frightening. When there are idiots in charge, all chaos follows.

        1. oldfartuk

          Re: It's a logical conclusion to stopping to educate people

          I learned FORTRAN on a DEC PBP8, and a teletype. Later we got green screen monitors and it was the SPACE age. Hacking was easy. Everyone's pass word was 'password;' or '012345676'. The Sysop left the operator manual lying around, i took it home and read it, and was intrigued to find out if you wrote a transaction file to the tape drive , it automatically gave you /roots privs. Thus we learned to hack. I made a black block, a device out of a coupel of 74 series TTL logic gate chips and an acoustic coupler, that produced the telephone exchange tone signals, and lo, we became a telephone exchange and could roam freely, exchanging sweet nothings at 2600 Hz with all the lady telephone exchanges.

          Who said romance was dead.

    3. spold Silver badge

      Re: 'Security is failing just as technology is becoming autonomous'

      Share [your data, grunts, farts etc.] and Enjoy!

      1. tom dial Silver badge

        Re: 'Security is failing just as technology is becoming autonomous'

        It is reasonable to ask if there was any time since the first two computers attached to the ARPANET when security was not failing. Technologically, it seems to have been a losing matter since then, the major difference over time being in the average proclivities of the user population.

    4. JohnFen

      Re: 'Security is failing just as technology is becoming autonomous'

      "Marriott hotels announces they're installing these devices in guests bedrooms. WTF???"

      They are? Well, I guess I won't stay in Marriotts anymore.

  2. wyatt
    Thumb Up

    Only takes someone in a digger to chop a fibre and we're all safe again.

    1. Anonymous Coward
      Anonymous Coward

      don't you watch Black Mirror?

      Try that, and drones be on you in 2 minutes, they'll erase you and reflash you with a new personality.

      1. Anonymous Coward
        Anonymous Coward

        Re: don't you watch Black Mirror?

        "Try that, and drones be on you in 2 minutes, they'll erase you and reflash you with a new personality."

        You think the guys that drive the diggers and backhoes that cut cables have personalities that can be reflashed?

    2. Anonymous Coward
      Anonymous Coward

      It's only a matter of time before they get the digger too.

      I'm sorry Dave. I'm afraid I can't let you dig here.

  3. DropBear
    Devil

    Which reminds me...

    I'd love to read about the BOFH butting heads with rogue IoT he isn't the puppet-master of...

  4. Warm Braw

    Click Here To Kill Everybody

    The anchor tag seems to be missing...

    1. LeahroyNake

      Re: Click Here To Kill Everybody

      I am really tempted to leave the paperback on my desk to see if I get any comments, BOFH style.

  5. commandline
    Megaphone

    ahum, dumb fucks ?

    Calling people "dumb fucks" is exactly the crux of the security problem. An insulting attitude based on assumptions, prejudice and a sense of superiority vested in aggressiveness, not knowledge.

    Since 199x I have failed at promoting professional blue team security as a viable route to affordable and effective security, because "red team" is just so much more I dont really know what.

    Offensive security is something to be done in a lab or as part of the SDLC. Otherwise it is just a costly mess and makes people dependent while keeping them stupid.

    This is the exact reason why there is so much shit poor security in place and society has dwinled down into a spiral of fear, uncertainty, doubt.

    Also, vulnerability patching has proven a great way to market products, never noticed you "dumb fuck" ? When a vulnerability hits the news, it usually means it has already been patched so there is an actual incentive to purchase the product now.

    1. BlartVersenwaldIII
      Devil

      Re: ahum, dumb fucks ?

      I believe GP is referring to the facebook-using masses who have no care or understanding of privacy or security, rather than actuall calling people dumb fucks themselves.

      In case you weren't aware, Zuckerberg famously did a Ratner and called facebook users "dumb fucks";

      Zuck: Yeah so if you ever need info about anyone at Harvard

      Zuck: Just ask

      Zuck: I have over 4,000 emails, pictures, addresses, SNS

      [Redacted Friend's Name]: What? How'd you manage that one?

      Zuck: People just submitted it.

      Zuck: I don't know why.

      Zuck: They "trust me"

      Zuck: Dumb fucks

    2. Aodhhan

      Re: ahum, dumb fucks ?

      Calling an entire generation of individuals, in which a good majority haven't been given the skills to think about and look at 2nd, 3rd and 4th order effects, "dumb fucks" isn't entirely out of line--especially when it comes to information security as a whole (not just a profession).

      So yes, it is a security problem for those who download the latest 'game preview' only to find out it's actually an application spreading malware. Yes, it's a security problem, when the generation doesn't learn from such actions and repeats these insecure acts in a habitual manner--then continues to spread to family devices on their home network or via email attachments.

      Offensive security should NOT be contained to only the lab. Not to mention, offensive security has very little to do with the SDLC. Code review and offensive security is two different things; not to be confused with penetration testing.

      So, before you begin harping at people about what the 'problem with security' is--you should first spend about 7-10 years in the field so you completely understand it.

      Calling people dumb fucks is not the reason for poor security, or responsible for a society in fear and uncertainty. Nor is it responsible for poor patching practices. Good grief. If you really believe this, then you're a snowflake who will never thaw out. Would you like your crayons in a box of 8 or 16?

      1. JimC

        Re: ahum, dumb fucks ?

        No, calling your user base dumb fucks is diagnostic of an industry that has completely lost the plot. If your products aren't fit for the mass population as it exists then by definition they aren't fit for the mass market.

        An industry which believes that if its too difficult or too expensive to deliver a satisfactory service whilst still making a tiny minority rich then they should be allowed to deliver rubbish, ignore the law or be socially irresponsible.

        1. Charles 9

          Re: ahum, dumb fucks ?

          "No, calling your user base dumb fucks is diagnostic of an industry that has completely lost the plot."

          No, calling the user base dumb fucks is diagnostic of a target audience essentially Too Dumb To Live. As Douglas Adams once noted, complete fools can ruin in ways that no one should have to imagine. Why do we have keyboards that have the word "Any" on them? Why do we need to have warning labels like "Caution: HOT" on coffee cups? As a comedian once said, You Can't Fix Stupid, yet stupid is everywhere, outnumbering us.

          1. Anonymous Coward
            Anonymous Coward

            Re: ahum, dumb fucks ?

            > Why do we need to have warning labels like "Caution: HOT" on coffee cups?

            Because: Americans?

            1. Adrian 4

              Re: ahum, dumb fucks ?

              We don't have Caution: HOT on coffee cups because of dumb fucks. We have it because of lawyers.

              Any idiot knows - or hopes - their coffee is hot. But if it says so on the cup, there's less chance that when they accidentally spill it on their lap that they'll be able blame the vendor.

              It's not information. It's arse-covering. But yes, Americans.

              1. Charles 9

                Re: ahum, dumb fucks ?

                "Any idiot knows - or hopes - their coffee is hot."

                That's your problem. You're hoping. Some people really ARE idiotic enough to not realize that coffee can be HOT. Remember, the lawyers wouldn't be suing and companies wouldn't be doing CYA moves if it hadn't actually happened in the past. I once read the story of a woman so absent-minded that she took off her (thick, as she was extremely near-sighted) glasses whenever she started to drive, oblivious to the fact one needs decent vision in order to drive.

                1. Not That Andrew

                  Re: ahum, dumb fucks ?

                  The warnings are there because McDonalds was selling takeaway coffee at temperatures well over 70 degrees C closer to 90 degrees C. After being warned multiple times that was dangerous. A woman accidentally spilled a cup on herself, causing 3rd degree burns to her legs and pelvis. Which required reconstructive surgery. Something that a hot cup of coffee generally doesn't do.

                  McDonalds refused to cover her medical costs so she sued for them and won, And was giving several millions in punitive damages as well (which IIRC she hadn't asked for). The punitive damages were reduced (but not eliminated) on appeal, but the case was upheld.

          2. jasonbrown1965

            Re: ahum, dumb fucks ?

            Um, no again.

            I'm reminded of the old joke about Windows being like a gold-plated Rolls Royce of the information world - but that blows up once every six months or so, killing everyone inside.

            The alternative seems to be Linux, which takes us back to the days of pull choke, depress alternator button, spitting on your hands, hand cranking engine, and praying. At least for the average user who does not "just" want to terminal ANYTHING - they just want to hop in, turn the key, shift into drive and go.

        2. DCFusor

          Re: ahum, dumb fucks ?

          It IS expensive and it IS difficult to produce anything remotely "idiot proof" - which would be behind the times, feature wise, require redesign of almost everything including the internet and its weak protocols that have too much trust.

          And then the market - consisting of said dumb fucks - would decide, as they have already if you've noticed, that it isn't worth it (even if they are wrong, as I think most of us would agree) Because collectively - dumb fucks isn't a bad description.

          If you think otherwise, you're welcome to try to make the right thing for an extremely diverse user base with extremely varying use cases and see if you can be next one to get rich. Only the existing cronyism by the big boys getting governments to create regulatory moats, provide infrastructure that's hard to change, and your lack of skill and money stand in the way.. Should be easy?

          And the dumb fucks will pick the shiny with the most performance per buck, or the one they think will buy them status anyway (see, for example automobiles, or well, Apple).

          Yes, if we did buildings like we did software, the first woodpecker to come along would be the end of indoors. How old is that saying?

          How about "A person is smart, but people are a dumb herd animal" (MIB)?

          Ranting about how human nature should be different has a long history of virtue signaling followed by failure..

          "You lost this time, kid - but you don't have to like it." (Indiana Jones)

          1. DCFusor

            Re: ahum, dumb fucks ?

            FWIW, I've been designing hard and software since before most here were born and 4 whole K of core was a big deal (we didn't do bytes yet, twin triodes were being replaced by transistors, and IC's were still a dream).

            I had the above explained to me so many times, I gave up trying to make things perfect, and got stuck with the "good enough", though I didn't have to like it.

            And I learned the hard way that sometimes *I* am the one doing dumb fuck things. There is no cure, and saying you've never been that dummy is just vanity. If you've done any amount of this you know that it's an exercise in humiliation - when you find that bug and see how you messed up...it's always your own fault. And almost always humiliatingly stupid - in hindsight. Which isn't possible to have before; they call that foresight and you should know the old saw about which is more accurate. For everyone.

            It's amazing we don't go around with dents in our foreheads from this ongoing experience - and that's the so-called competent ones. Only the incompetent think they can pull off any sort of perfection. Demanding it of others means you have no idea yourself, have never tried, or have some very lax judgement of your own failings you don't apply to others.

            1. Paul 195

              Re: ahum, dumb fucks ?

              @DCFusor - I wish I could upvote your post more than once. Given the number of people on the El Reg forums who are IT professionals in different capacities, we are the people who have collectively built the insecure mess the "dumb fucks" (or otherwise) are stuck with. A little more humility from all of us commentards would be welcome.

              1. This post has been deleted by its author

              2. commandline

                Re: ahum, dumb fucks ?

                Exactly my point.

                I'm not sure if I should thank you for bringing this across, or not.

                Most people who think technical lack the ambition, motivation (or capacity) to look outside and beyond the technical/logical box they are working in. The world is knows many more parameters so to speak.

                Trying to bring across the perspective of people who actually pay your bills to tech has often proven hard. Not to say impossible. Tech has this semi-religious unidirectional view which is often disconcerting to people who are not at all spending time on technicalities and just want to move on with the work they are doing, despite technology.

                It is troubling to read so few of the commenters manage to actually grasp anything I've written down.

    3. Anonymous Coward
      Anonymous Coward

      Re: ahum, dumb fucks ?

      "Dumb fucks" hasn't ever come out of my mouth, no idiot, moron, and any other synonym. I might "think" it, but that's as far as that goes. I started being a teaching assistant at the university at age 13 and along the way learned the different ways people approach things. Once I have it nailed, explanations about what happened, what they expected to happen, and how they should try to do it in the future a real time saver. It's an investment forward. I sure as Hell know that my bosses appreciated that approach. It's in all my evaluations. I like teaching. That "aha!" moment is priceless. Literally.

      I also spent a quarter century as a sysadmin, sysop, and technical adviser on CompuServe in multiple fora. I've no respect for people that treat others poorly. Yes, it seems a Sysiphysian task at times, but again, guiding others is a good reason to do that job. And, quite often, you'd see those people jumping in to help others.

      Lastly, Ive worked in a dozen fields of engineering, half dozen of analysis, and whatever else the Navy required. The only box I notice is the one people assume separates them which doesn't really exist. It's all math, of several types, but relationships between things are what you need to understand. Change the units, use a different constant or three, and poof! You can translate approaches between different fields. It just so happens, once you show someone that trick a time, or three, they "get" it and start using it themselves.

      Finest complement I was ever given was by the Chairwoman of the Department of Statistics and Computer Science. At the beginning of the quarter she pointed at me and said if they have any trouble, see me. Lots of smiles around as if it was a joke. She said next, I could explain things if they didn't quite understand what we just went over.

      So, "dumb fucks" is something you won't here me say.

      1. Anonymous Coward
        Anonymous Coward

        Re: ahum, dumb fucks ?

        I believe that most people don't care about how their computer works, but rather that it just does work. Part of the problem is that a great many people basically just need and very possibly would like an Internet appliance. Something that's basically immutable from an OS and security standpoint. The fact that to be on the Internet one needed a computer has kept the price of computers down for all of us, hobbyists like me and professionals like many of you. I think if a company creates such a beast the cost of computers will increase dramatically. Would a company start with OpenBSD as the base OS and like Apple limit the hardware that it was licensed for? Maybe put the OS on a microSD card that could be swapped out or refreshed at a licensed computer shop?

        1. Charles 9

          Re: ahum, dumb fucks ?

          "The fact that to be on the Internet one needed a computer has kept the price of computers down for all of us, hobbyists like me and professionals like many of you. I think if a company creates such a beast the cost of computers will increase dramatically."

          The 90's called. They want their dial-up Internet appliance back. Remember the Mail Station? The original WebTV and Microsoft Network, which hooked up to the TV?

          1. Anonymous Coward
            Anonymous Coward

            Re: ahum, dumb fucks ?

            Charles 9

            TBH I don't although as I'm in my 50s I'm old enough to remember those. My apologies for not being more clear about what might appear to be failed Internet appliances. Did those give one the same access as to the Internet as a computer?

            1. Charles 9

              Re: ahum, dumb fucks ?

              The WebTV at least had a web browser (MSN might have as well). That for most people is the Internet right there.

  6. Destroy All Monsters Silver badge

    I will be in my home

    Watching old episode of Bubblegum Crisis.

  7. Will Godfrey Silver badge
    Unhappy

    We're in for a rough time

    He's absolutely right of course, but the people who should know this were not there, wouldn't listen if they were, and won't do anything that makes the slightest dent in their obscene profits (or those of their friends).

    1. Yet Another Anonymous coward Silver badge

      Re: We're in for a rough time

      but the people who should know this were not there,

      I suspect the Iranian uranium enrichment lab IT dept weren't invited

  8. Mephistro
    Devil

    One day, ...

    ... we'll have regulations for IT products regarding their security, safety and makers and sellers responsibilities. Said regulations wiil be sane, well informed, well enforced and with a potent bite, both in terms of fines and even prison terms.

    Nah, I was jesting.

    We'll have anti-gravity and FTL travel long before that!

    1. Zippy's Sausage Factory

      Re: One day, ...

      We'll never have those regulations. We'll probably get populist politicians who want to ban computers long before that.

      1. Anonymous Coward
        Anonymous Coward

        We'll probably get populist politicians who want to ban computers long before that.

        No, how could they tweet otherwise?

        1. Charles 9

          Re: We'll probably get populist politicians who want to ban computers long before that.

          By telegeaph, of course. If it worked before the Civil War, it can work now.

      2. find users who cut cat tail

        Re: One day, ...

        The thing that worries me is that I can extrapolate -- without too much effort -- the current technology and society to a state in which ‘ban computers’ would be a reasonable proposition.

        Sure, it would break lots of things. Awful lots of things.. One big problem is the inability to re-create intermediate technologies. We might go back to middle ages, or Renaissance, but 70s technologies are much harder. They require too many resources that need other technologies and too many other things working to be re-created from scratch.

        So, in essence, once we might never [for some value of never] be able to get back to the current technological level after a global disaster/breakdown/war/ban/... And yet, I can imagine banning computers being the lesser evil. Barely, but still.

        1. doublelayer Silver badge

          Re: One day, ...

          Ok. Now I'm curious. Since I can't think of anything that would get rid of all computers while leaving humans, what type of situation can you think of where computers would be banned? And does your theory also account for the populace to comply with said ban? I'd really like to hear your theories, because I'm not thinking that way at all.

          1. Anonymous Coward
            Anonymous Coward

            Re: One day, ...

            > Since I can't think of anything that would get rid of all computers while leaving humans ...

            Oh that's easy. Creationists and other (similar thinking) nutjobs, if they get well out of hand.

          2. Charles 9

            Re: One day, ...

            Say a computer glitch starts World War III and people actually survive it. As for fiction, read up on the Dune universe and the Butlerian Jihad.

    2. Destroy All Monsters Silver badge

Page:

POST COMMENT House rules

Not a member of The Register? Create a new account here.

  • Enter your comment

  • Add an icon

Anonymous cowards cannot choose their icon

Other stories you might like