News for hackers. Stuff that matters.
Re:VNC Roulette by ekianjo on Sunday March 27, 2016 @02:55AM (#11369175)
> Yet if some brick-and-mortar business is robbed because the owner left the front door unlocked, people would rightfully put the onus mostly on the store owner.

No, there were days when people did not even lock their cars and their houses (but maybe you are too young to have known that time where you live) because it was not expected that anyone would actually rob anything. Especially in communities where everyone knew everyone else. And if a robbery happened, the blame would still have been put on the thief, not the owner.

Re:VNC Roulette by yoha on Sunday March 27, 2016 @03:13AM (#11369214)
This is a sensible argument, but here is my counterpoint.

Such situation rely on mutual trust, and only work on small scales (village, loose neighborhood). On the Internet, there are billions of people that live close by.

I think the main discrepancy is that people really do not understand either that the Internet connect them to everyone or how vast the world really is.

Re:VNC Roulette by stickfigure on Sunday March 27, 2016 @03:24AM (#11369224)
there were days when people did not even lock their cars and their houses

These are still are such days. There still are thousands of communities, even in California, where you can get away with this. The difference is not time but population density. There was probably never a time when you could leave your home unlocked and unguarded in urban cities.

Re:VNC Roulette by seabee on Sunday March 27, 2016 @03:55AM (#11369275)
Roman poets and everyday people's curses demonstrate the need for security two millennia ago, even.
Re:VNC Roulette by galfarragem on Sunday March 27, 2016 @11:05AM (#11370157)
>>The difference is not time but population density. There was probably never a time when you could leave your home unlocked and unguarded in urban cities.

There was and not so long ago (e.g. 40 years ago in Portugal or Poland. Probably many other countries). So I would change your statement:

The difference is not time but population density and specially politics/religion.

Re:VNC Roulette by SixSigma on Sunday March 27, 2016 @12:05PM (#11370398)
What did those people have that was worth stealing ? Plates, spoons and linen.
Re:VNC Roulette by return0 on Sunday March 27, 2016 @05:18AM (#11369427)
Re:VNC Roulette by atemerev on Sunday March 27, 2016 @04:27AM (#11369331)
In Geneva or Zurich, it was until very recently. Even now you probably will get away with it (not recommended, though).
Re:VNC Roulette by milesf on Sunday March 27, 2016 @11:46AM (#11370335)
I'm 46, and yes I remember those days. In fact I live in Canada, and in my neighbourhood it is not uncommon for people to leave their doors unlocked. But if I lived in a different neighbourhood with a high crime rate, my doors would not only be locked, but probably bolted and an alarm system would be set every time I left the building.

The burden and responsibility to protect my home is mine. This isn't an either/or as to who to blame, it's a both/and. So back to the link. If you have a high-value service like an electrical grid, or dam, or nuclear plant that is open to the Internet (the most crime-ridden neighbourhood on the planet), do you really honesty think the media's typical response of "hackers broke in to..." is the correct narrative?

Re:VNC Roulette by tdkl on Sunday March 27, 2016 @12:23PM (#11370459)
> do you really honesty think the media's typical response of "hackers broke in to..." is the correct narrative?

Of course it isn't, but when did media stop at that ? Link baits and ad revenue are more tempting then integrity.

Freedom of press, monetization and responsibility - pick two.

Re:VNC Roulette by milesf on Sunday March 27, 2016 @12:45PM (#11370532)
I pick number four: education. Which goes back to my point, that we need some sort of public awareness day on what Internet security _really_ is, or something - I don't really care what it is - to change the narrative. Otherwise we're going to have some huge disaster to some major infrastructure because of an unprotected remote connection like the article shows, and the company that committed it will likely cover up the cause.
Re:VNC Roulette by mikehollinger on Sunday March 27, 2016 @08:59AM (#11369820)
People make well-meaning assumptions about security. For example, most of the oscilloscopes that we use at work have remote access turned on with a trivial password (the scopes themselves run windows, and have a VNC server installed [1]).

If you go read Tektronix's instructions - their screenshots show "no authentication" selected.

This itself isn't really an issue, since the networks that we're connecting these to are isolated, inbound-only lab networks. We know that. Our lab admins know that. The network security guys know that. There are exceptions filed for the IPs of these devices.

However, if someone ever -changed- that network configuration and opened it up to the rest of the corporate network (or for some terrible reason, the internet), those scopes would be just as ripe for takedown as the stuff shown in TFA.

It just takes that small network change to enable something -else- to access the WWW (code download for security updates, anyone?) that exposes our other items on the network. In fact, I can think of several reasons why someone might expose a VNC:

1. Actual remote control -within- a facility, but probably in the deployment guide says "use a secure network"

2. Someone wrote a cool Web GUI to "modernize" something, and used VNC (undocumented and poorly-configured) to pull off what they pulled off

3. Someone exposed a subnet to the internet to enable remote access for something -else- which was probably properly-secured, but happened to -also- expose the thing hosting the VNC server.

[1] http://www.tek.com/support/faqs/how-do-you-set-vnc-dpo7000-d...

Re:VNC Roulette by jarcane on Sunday March 27, 2016 @04:09AM (#11369299)
I live in one of the largest cities in Finland, and I routinely see people leave their bicycles unlocked in the town center, because bike theft is so rare that most people don't worry about it, or only take minimal precautions.

Meanwhile, in my tiny town in the States bike theft was basically the single most common form of crime, and I know of one house I would walk by every week that would openly have as many as half-a-dozen stolen bikes displayed for sale in their front yard.

Re:VNC Roulette by morsch on Sunday March 27, 2016 @08:51AM (#11369801)
About 4000 bikes were stolen in Helsinki ([0], pop. 600k) in 2014. This is about the same number as in the city I live in (Germany, around the same population), where I'd never leave a bike unlocked, and where bike theft is considered a problem. Though I am sure there are places where it's much worse, and conversely that it's much better in other cities in Finland.

[0] http://www.helsinkitimes.fi/finland/finland-news/domestic/10...

Re:VNC Roulette by sunstone on Sunday March 27, 2016 @01:09PM (#11370614)
In Japan street crime is very low but both bicycles and umbrellas are 'borrowed' on a routine basis. Kind of like an informal bike sharing system. Consequently most bicycles are of the $80 made in China variety.
Re:VNC Roulette by jay_kyburz on Sunday March 27, 2016 @04:01PM (#11371284)
Here in Canberra Australia I would regularly come back to my bike to find new marks in the plastic around my chain where somebody had tried to cut through. Your chain has to go through both wheels if you have quick release on the front, and you can't leave any clip on lights or your water bottle or it will be gone.

A few years ago I watched a junky go from bike to bike in a bike rack testing each lock to see if it would open easily. Right in plain view of everybody. When I confronted him he launched into some long and carefully rehearsed sob story about how his friend told him to come and get his bike but didn't know which one it was.

Re:VNC Roulette by clolege on Sunday March 27, 2016 @07:39AM (#11369658)
I actually accidentally left my bike beside a busy street last night here in Seoul unlocked. I went back and got it today (Sunday night) and not a single person had touched it.

I don't think that it's population density as much as the shared culture of the place you live. I would have totally blamed myself if my bike wasn't there today, and I think it would be stupid to blame anyone else.

Re:VNC Roulette by digi_owl on Sunday March 27, 2016 @08:26AM (#11369750)
Density, shared culture, and perhaps a functioning social services. Thus there is less of a incentive for petty crime, as basic needs are covered via less risky means.
Re:VNC Roulette by glaze on Sunday March 27, 2016 @01:10PM (#11370624)
I wouldn't leave my bike unlocked in Helsinki. Just last year my bike was stolen near the Parliament house (Kiasma) even though it was locked to the stand.
Re:VNC Roulette by mobutu on Sunday March 27, 2016 @08:20AM (#11369735)
You most likely do not live in Helsinki or anywhere near so called "pk-seutu".
Re:VNC Roulette by SixSigma on Sunday March 27, 2016 @07:05AM (#11369606)
Meanwhile in Jyvaskyla on the JAMK student facebook page :

"Hi everyone, my bike is stolen last week. If you see it anywhere please text me! Thanks !"

Re:VNC Roulette by jakub_h on Sunday March 27, 2016 @08:10AM (#11369712)
> No, there were days when people did not even lock their cars and their houses

That must have been an extremely long time ago: http://www.ancientresource.com/lots/roman/romankeys_locks.ht...

Re:VNC Roulette by sqren on Sunday March 27, 2016 @08:21AM (#11369739)
Just because locks have existed for thousands of years doesn't mean they are used everywhere. When I lived on the countryside in Australia we didn't lock the doors. That's not "an extremely long time ago" ;)
Re:VNC Roulette by jakub_h on Sunday March 27, 2016 @08:35AM (#11369766)
> When I lived on the countryside in Australia we didn't lock the doors.

Well of course you don't; the robbers die while still crossing the perilous deserts and/or trying to avoid lethal wildlife.

Re:VNC Roulette by ekianjo on Sunday March 27, 2016 @01:01PM (#11370584)
> That must have been an extremely long time ago: http://www.ancientresource.com/lots/roman/romankeys_locks.ht....

Nope. I can tell there are still people alive these days who remember that this was still the case in most places of Western Europe.

Re:VNC Roulette by Ensorceled on Sunday March 27, 2016 @05:34AM (#11369456)
Most often people had nothing to steal and often couldn't afford good locks anyway. When the last of my grandparents 13 kids left the house and they actually started to have enough money to buy nice stuff, they also bought and used a lock.
Re:VNC Roulette by SixSigma on Sunday March 27, 2016 @07:03AM (#11369603)
> people did not even lock their cars and their houses

when you have nothing worth stealing, it is not worth investing in security

Re:VNC Roulette by riskable on Sunday March 27, 2016 @10:49AM (#11370106)
While I agree with the sentiment for physical objects it doesn't apply to things connected to the Internet. An old "smart" TV may have no resale value whatsoever but that doesn't mean it has no value from an attacker's perspective.

From the attacker's perspective something like a connected smart TV has extremely high value as a mechanism for further penetrating a network. Black boxes that no one can login to under normal circumstances are the perfect secret strongholds to maintain a persistent presence on any given network.

Re:VNC Roulette by csomar on Sunday March 27, 2016 @05:24AM (#11369436)
These days still exist. And nearby some people even leave their keys on the cars. However, in a city, you just can't do it. Too many risks and people barely know each other.

Now comes the Internet. It's a huge giga-city. Expect robbery, larceny, hacking, and more.

Re:VNC Roulette by fallenshell on Sunday March 27, 2016 @10:05AM (#11369977)
Not only that, it's a huge, almost anonymous city...
Re:VNC Roulette by dave2000 on Sunday March 27, 2016 @08:38AM (#11369770)
That not locking the door stuff was simply because back then people didn't fetish objects, and also because they were too poor to have anything worth stealing. Rich people always made sure their stuff was protected (from the poor).
Re:VNC Roulette by drdaeman on Sunday March 27, 2016 @02:16PM (#11370865)
But do we blame Google when their robot indexes some completely unprotected webpage that the host owner didn't mean to be public but haven't did anything to claim so?
Re:VNC Roulette by wyager on Sunday March 27, 2016 @03:43PM (#11371199)
This is more a feature of location than time. There are still locations where unlocked doors are the norm.

FWIW, crime rates have been monotonically decreasing for a long time.