Why older tech is sometimes safer from hackers(www.bbc.com)
33 pointsby tchalla3 hours ago12 comments
  • chrisvls34 minutes ago
    Sadly, the real lesson we need to learn from Battlestar Galactica is not this. They weren't saved by old software, they were saved by not having critical systems on the network unnecessarily.

    Our water and power utilities need to re-watch the pilot.

    • fhdkweig31 minutes ago
      To be fair, it was both. Those ships that got the recent upgrades also got trojans that Caprica Six put in the defense mainframe with Baltar's access codes.
  • jerfan hour ago
    Makes it harder to catch you in a general sweep, but it probably makes it much easier if anyone decides to target you specifically. How good a tradeoff that is varies from person to person. And the difficulty of targeting a specific person is changing in an AI world. I wouldn't try to characterize it any farther than that, just to observe that it is changing. "Hey AI go individually research and target county clerks for getting direct access to their {specific system}" is much more practical today than it was 10 years ago, and will be even more so 10 years from now.
  • thataccount6 minutes ago
    Money defines the targets, and usually people running old software are thought not to have money. It is a zero sum game that shifts with the technology and ends when technology no longer is the theater where people can make or steal money.
  • torginusan hour ago
    It's incredible how far back the surveillance state goes - GSM mobile phones have an IMEI number that's tied to the handset - and the SIM is tied to the subscriber, and your phone broadcasts imei to neighboring towers constantly.

    I haven't really gotten really into this, but from what I can tell, anything that has to do with mobile phones is strictly worse in terms of anonimity than Wifi.

    At least anything that ties a Wifi connection to you you can change in an OS setting, but if you get into faking IMEI/SIM stuff, that can very quickly get you charged with an actual crime.

    • rkozik1989an hour ago
      One of the things about mobile phone is that there's 2 OSes on the phone: one that handles the phone stuff and the other that you as a user actually interact with. What's really scary about it is that the OS we do not think about is often licensed to the manufacturer (Apple, Samsung, etc.), closed-source, and dated. There's a lot of security firms that sell fake cell towers to law enforcement and governments and that gives them access to all of the data you send over the network. In older formats like 2G there was no encryption on anything sent over the wire.

      If you dig into the fake cell tower rabbit hole you'll find what you're talking about to be an even worse problem.

    • rithdmc26 minutes ago
      Anything billed by the second has good (-enough) cost attribution built in.
  • chasil16 minutes ago
    Here is a good example where this is not so. Unfortunately, my datacenter runs this vulnerable VMS release on an emulated VAX.

    https://www.theregister.com/on-prem/2018/02/06/ghost-in-the-...

  • high_na_euvan hour ago
    >But the team picked an older software version for their honeypot that had been upgraded multiple times since its release and, consequently, no hackers bothered to target it. "When we upgraded it to the new one, we had all the attacks we wanted," recalls Bishop. "I thought it was so amusing."

    It feels like fantasy imo

    While I could understand using outdated or not popular protocols, then software with known vulns seems crazy when we are living in world of automated, ai assisted scanners

    • bell-cotan hour ago
      Let's say your security budget is pretty limited, and you can say with relative certainly that there's only a 0.1% chance of any adversary bothering to check the known flaws in your FossileWare(tm) Firewall in a given month.

      Vs.how many dire flaws have been found in big-name security products in the past year, that even a low-budget adversary is likely to be regularly checking for?

      • skinfaxi3 minutes ago
        > a 0.1% chance of any adversary bothering to check the known flaws in your FossileWare(tm) Firewall in a given month.

        How would you arrive at this percentage in your risk analysis?

      • fhdkweig35 minutes ago
        There is no human making a decision on what attacks to run. They check for literally everything. 20 years ago, I ran a web server and would run 'tail -f' on the access logs. I watched the bots sending requests for files that only exist on linux, then send requests for files that only exist on windows. They don't know what kind of system they are hacking. They just know that there is a computer at that IP address.

        There are databases that list every known flaw in existence, and the bots just go down the list checking each and every one. And if it doesn't work, in 5 minutes, they'll run those same tests again as if something changed in those 5 minutes.

  • danielvaughn4 minutes ago
    I know someone who works at a data center for the IRS, and a lot of their records are all stored in PDFs. He thought it was disgusting when he first learned about it, but eventually realized that it's essentially resistant to a large scale data leak. Retrieval just isn't fast enough.
    • Zambyte2 minutes ago
      How is it resistant? Can't all the pdfs just be leaked?
  • rossng26 minutes ago
    > Interest in magnetic tape is only increasing further today because the cost of random access memory (Ram), a form of computer memory that doesn't rely on tape, is skyrocketing.

    hmm

  • postexitusan hour ago
    I understand BBC may not have the technical background to critically assess this approach, but whoever using Eudora (I loved it in 2001 btw) for security should get their credentials removed via King's order. Security through "obsolescence" is no different from security through obscurity - therefore, it doesn't work. Somebody not bothering to look for holes in your software doesn't mean they don't exist - in the age of Claude - I am pretty sure I can destroy your legacy software in minutes.
    • alephnerd6 minutes ago
      > I understand BBC may not have the technical background...

      This is BBC Future - the BBC's tech clickbait publisher - not BBC News.

      BBC consists of the non-profit news bureau as well as at least a dozen for-profit clickbait and listicle publishers. BBC's ad-free mandate is only for the UK.

      > in the age of Claude - I am pretty sure I can destroy your legacy software in minutes

      Yep. One of our PortCos has unrestricted access to Anthropic and GPT models. With whitebox testing, it's trivial to identify vulns in legacy environments. With blackbox testing, it takes some effort but it doable with the right steering.

  • hanneshdc6 minutes ago
    This is terrible advice and I feel like this article will be used by managers of outdated IT systems to defend not upgrading their tech stack.

    There are hospitals out there still running on windows XP. Someone's going to skim this article and say "look, we're actually being prudent"!

  • bell-cot3 hours ago
    MS-DOS: Over 45 years, and STILL NO remote holes in the default install!
    • dolmen22 minutes ago
      Well, there is no protection against compromised floppy disk sent by snail mail.

      I have also seen virus source code published in books and magazines. We don't have such threats anymore.

  • railwatchingan hour ago
    [flagged]