The Mirai Botnet Is Proof the Security Industry Is Broken

Re:The Mirai Botnet Is Proof the Security Industry Is Broken by iregistered4 on Tuesday November 01, 2016 @03:05PM (#12849120)

" Ok, I am aware of how it works, but I'm not talking pentests or hardening. I'm talking simple, cheap design choices in this case, that could've eliminated the whole Mirai debauchery."

Then you are not talking about the security industry or its failure to work are you? Its a failure in the development industry to have basic security awareness.

If you don't engage the security industry for pentests or consulting. You can't go any blame them when you get hacked.

[ Parent | on HN ]

Re:The Mirai Botnet Is Proof the Security Industry Is Broken by pbhjpbhj on Tuesday November 01, 2016 @08:31PM (#12851375)

>Its a failure in the development industry to have basic security awareness. //

Is that really it? Surely even a high-school level developer will realise that having a device connected to the wild web with a default user:pass will be hacked easily.

I'd have thought the problem is not wanting to support customer calls saying "we changed the password and now can't access our device". So default user:pass and no prompt to change it (and a backdoor just in case) means lower support costs.

[ Parent | on HN ]

Re:The Mirai Botnet Is Proof the Security Industry Is Broken by aidenn0 on Wednesday November 02, 2016 @01:03AM (#12852378)

No, that dev will say "It will be behind a NAT, so it's fine to have a default user:pass"

[ Parent | on HN ]