printer friendly version

From the editor’s desk: Presenting … how you were hacked

“It’s all fun and games until you hit the wall.” Someone said that to me once (an American, so I don’t know if that’s a common saying in the US). At the time I thought he watched too much reality TV.

These days, however, I think I have a better understanding of what the phrase means. At the time he was working for SCO, a company that made an awesome version of Unix back in the day. After some business dealings, the company decided its business model wouldn’t be based on software that was popular in many small- to medium-sized businesses, and that was loved by almost everyone who came into contact with it (I may be a little biased here, but meeting the CEO and other execs in Santa Cruz was an experience; I have never seen people so passionate about what they did, not even professional marketers who are paid to be excited). But the new bosses decided they would make a fortune by suing people using open source software.

Needless to say the company was under the influence of another company with good reason to badmouth Linux, but that’s another story. Needless to say, their route down was fairly straight with no time for somersaults or any taking in of the scenery.

Not that SCO has anything to do with this editorial. However, I think it may be time to accept that the wall has been hit and to take a step back and re-evaluate. Remember back in 2016 when Mirai became famous? In case not, “In 2016, Mirai showed the massive destructive potential of DDoS attacks as a result of insecure consumer IoT (Internet of Things) devices. Mirai’s attacks exploited only a small number of devices and vulnerabilities and used basic password guessing techniques” (www.securitysa.com/56500n). It’s back and more advanced than ever, see www.securitysa.com/*mirai1 (redirects to https://arstechnica.com/information-technology/2019/03/mirai-botnet-aims-to-wrap-its-tentacles-around-a-new-crop-of-iot-devices/).

While the old version was known for targeting “routers, network storage devices, NVRs, and IP cameras”, the new variant of Mirai adds 11 new exploits, including “WePresent WiPG-1000 Wireless Presentation systems, and in LG Supersign TVs … as well as new credentials to use in brute force against devices.” You can read more at www.securitysa.com/*mirai2 (redirects to https://unit42.paloaltonetworks.com/new-mirai-variant-targets-enterprise-wireless-presentation-display-systems/).

So now your projector and your TV can be weaponised against you. It really is time we forget about physical and logical security, IoT security and anything else security and focus on security. If it’s electronic, it’s a risk. That should be simple enough.

Remember Stuxnet (https://en.wikipedia.org/wiki/Stuxnet) malware was installed in a highly secure environment that was ‘air-gapped’ – another stupid word that means it had no electronic connection to the outside world. How hard could it be to get into your network, home Wi-Fi or campus?

Andrew Seldon

Editor

Share this article:

Further reading: