Hacker News Reader

Comment by highwaylights | Hacker News Reader

“But what about security? Are you sure you want to stay on an older version of Mac OS? — Thankfully I’m tech-savvy enough to know what I’m doing. The two Macs I use most are still on High Sierra and Mojave, and haven’t received security updates in quite a while. I haven’t had any security-related problem whatsoever.”

How do people keep thinking nonsense like this, and then repeating it online to endanger other non-technical folks who also don’t know better?

Author has no idea if he has had any security problems, because most malware isn’t about to alert you to it’s presence.

You don’t run out-of-support software on an internet-connected computer.

View on HN

https://nvd.nist.gov/vuln/detail/CVE-2018-4192

https://nvd.nist.gov/vuln/detail/CVE-2019-8601

Remote execution vulnerabilities happen in JavaScriptCore. Tech-savvy won’t save you, all it takes is some malicious ad code or some hacked server providing malicious JS (or media files, etc. etc.)

Are there any proof-of-concept exploits for these issues anywhere that people could try out for themselves?

I think it would go a long way to convincing people if you could for example visit a website that eg. changes your desktop background when you visit it, to show how dangerous it is to run unpatched systems.

There are so many documented vulnerabilities that only apply to certain scenarios, that people (myself included) just think, "Hey, that sounds very theoretical, I don't think it applies in my case"

They’re a bit of a pain to implement but it might be worth doing…?

I wonder if they are actually possible. Remote code execution in the javascript engine does sound dangerous, but then you also have to get past address space randomisation, and then you need another exploit to escape the sandbox...

Right, all of which get patched every update as well. In theory chaining them together is doable, it’s just effort.

I've been asking every chance I get whether these security issues affecting unsupported operating systems are actually being exploited in the wild. Three times I've asked, yet so far, no one has shown any proof whatsoever. Add to that proof of Spectre and Meltdown drive-by exploitation in the wild, today.

While I do not condone the use of an insecure version of the OS, herd immunity is an underrated factor. Unless you're targeted, malware developers don't spend too much time on 0.5% market share, just like web developers don't optimise for unknown browsers.

Prove me wrong.

Well, it hasn't happened for quite a few years, but it was quite common years ago to get drive by ad malware on up to date systems even. It's the main reason I started turning off JavaScript, and later using ad blockers. I can't imagine it's impossible today.

It's the prevention paradox all over again.

With Sepctre mitigations rolling out in under a month to almost all PCs, of course there is less incentive to build an exploit. But we know how it was when 90% of PCs were unpatched XP boxes.

Wannacry used the exploit from EternalBlue to create one of the most famous ransomware worms in recent memory, and wasn't the only malware to leverage that one exploit: https://arstechnica.com/information-technology/2019/05/etern... https://en.wikipedia.org/wiki/WannaCry_ransomware_attack

Despite lots and lots of POCs, I haven't seen attackers use spectre in the wild yet. Maybe sophisticated actors are using it but they haven't been caught yet, or more likely they just use more traditional and reliable ways to get info leaks. But if traditional info leaks dwindle, they may turn to speculative execution attacks.

The level of access required to make Spectre work, basically shoehorning microcode into the CPU, means that you'd already have some deep hooks in the box anyway. Easier to use other methods at that point.

Spectre does not require changing the CPU's microcode. You just need to be able to run native code or even javascript. https://security.googleblog.com/2021/03/a-spectre-proof-of-c... https://leaky.page/

“Prove me wrong.”

No. That’s the point. The burden of proof isn’t on anyone to disprove your untestable theory about market penetration (although in the case of JS vulnerabilities your premise is completely baseless anyway).

That’s like saying “you can’t get cancer from smoking if you immediately drink a herbal tea after every cigarette because of it’s mystical healing properties. Prove me wrong.”

I don't think it's untestable. All you need is a counterexample or two to prove it incorrect.

Unless your proposition is that there are groups exploiting minority unsupported OSes but that they all remain successfully undiscovered, like Russell's teapot[0].

But as others point out, there actually is at least one known counterexample - WannaCry/EternalBlue.

[0] https://en.wikipedia.org/wiki/Russell%27s_teapot

I'm not the one making the claim here.

The claim is other people saying "don't use an old OS/mitigations turned off because of drive-by malware."

I am the one asking for proof of this. I know the vulnerability is real, but is there malware on the web, right now, that I might chance upon and risk my data?

I think you're right. If the vulnerability is there and we know about it, it should be straightforward to write a proof-of-concept that anyone on a vulnerable system can experience for themselves.

e.g. If a JavascriptCore vulnerability allows RCE on a Mac running whatever old version, write something to exploit it and execute the "say" command on that Mac, so anyone running that version can go to that webpage and literally see "wow this is a real exploit that actually works and anyone can abuse".

I'd love to see that. Kind of like the XSS script alert triggers, stuff where you can just paste a bit of code and prove that it -is- exploitable, without it actually doing anything harmful.

AFAIK there is a proof of concept for Spectre or another one of those speculative bugs, but it's academic, so not actually malware on a shady website that tries to steal my bitcoin.

Adblock is the most effective security application we have today.

I run out-of-support software on an internet-connected computer, and I'm aware of the risks. I'm just really careful and I acknowledge that I'm at risk every time I go online.

I assume the author thinks the same way.

It's impossible to be careful if you aren't doing security updates, because there's literally no way that you can even be aware of most of the dangers. These things are designed to be covert. It really is more like driving a car with no safety features that might fall apart at any moment because you think your reaction times are very good. The car might fail in a way that you cannot even see, based on vulnerabilities in the car that you are not aware of

Hyperbole much? Do you really think the potential consequences of driving the car of your analogy are comparable to the potential consequences of using an out of support operating aystem on your laptop?

You have purposefully misinterpreted my analogy in a bad faith way. The point is not to compare the severity, but to compare the total invisibility of the danger. That's why it's an analogy and not totally equivalent, it is only comparable in some ways... I swear to God sometimes Hacker News is so tiring

There are safety features, they are just out of date.

I think a more accurate analogy would be like driving a car frozen with the safety features from the year 2010. Millions of people do this.

Or driving a car without patching the firmware. Again, this is common.

I agree the risk is unknowable, but I think it’s estimateable enough so that it can be accepted or rejected.

> I think a more accurate analogy would be like driving a car frozen with the safety features from the year 2010. Millions of people do this.

I don't think it's any more accurate really, because whilst newer cars can said to be safer with more recent features, there's nothing that can compromise a 2010 crash structure or airbag without you noticing. The same cannot be said for internet connected machines.

No, it’s like driving a car whose airbag is known to have a fault that will send shards of material into the driver’s face in the event of an accident. (A real issue that many manufacturers had to issue a recall for.)

This is actually a great analogy now, because Apple (or whoever) regularly issue “recalls” for their known-insecure software in the form of software updates. If you follow the discussion in the info sec community surrounding these updates, often the vulnerabilities that are patched are being actively exploited.

One recent iOS update that comes to mind is one that patched an issue where a PDF sent via iMessage could give remote code execution with no user interaction or visibility. (Actively exploited.)

So yeah, you can drive around with your faulty airbag if the possibility of getting your face mangled doesn’t bother you. Or you can just follow the recall procedure, which is a bit inconvenient but it seems much less inconvenient than facial reconstruction.

And if you don’t care about your data being compromised and sold to bad actors, who may then steal your identity and cause a LOT of trouble for you, then by all means run known-insecure software. That seems like very poor risk assessment to me.

> So yeah, you can drive around with your faulty airbag if the possibility of getting your face mangled doesn’t bother you. Or you can just follow the recall procedure, which is a bit inconvenient but it seems much less inconvenient than facial reconstruction.

An interesting example, in that the airbag recall took many years due to the volume of units that needed to be recalled. So no matter what you wanted, you were stuck driving around for a few years with a known risk in your face (literally).

The risk is not at all estimateable, since you have no idea what the vulnerabilities are

> Hyperbole much?

Nah, I’d say GP was within the limits of hyperbole /s

“I acknowledge that I’m at risk every time I go online..

I assume the author thinks the same way.”

Just from reading the article, it does not seem that the author thinks the same way at all.

There are a scary number of tech people who think that as long as you don't click on an obvious virus ("download more RAM!" or "win free iPhone") then you're totally safe

Meh you probably are if you're like me, a nobody.

Most non targeted viruses will just wait for you to copy paste some crypto private keys or credit card numbers, or encrypt your files and ask for a ransom. Hackers just want money and it's honestly a numbers' game.

Most tech people who use crypto use a hardware wallet, most banks today will get you your money back (although the merchant ends up losing money if not insured) + you can just limit your card spending if not planning a big buy, and ransomware is a non issue for me since I keep everything important on a couple external disks.

Now if you work at a big corporation you probably have a work pc that's kept updated and where you face the same security issues as anyone else.

And if you're a journalist or brag about the millions you made in bitcoin on twitter then you become targeted for more sophisticated attacks.

>tech people who think if you do X then you're totally safe

Most tech people who think this aren't in a cricical enough position to worry about something more than a keylogger or ransomware, but if you're a network engineer at Google and think this then you shouldn't be working there.

Do you seriously think most vulnerabilities are used only for famous targets? Whatever gives you the illusion of safety I guess

There's plenty of examples of 0day drive-by attacks being deployed to general public targets through ad-networks.

What’s one example?

The first Google result is: https://www.webtitan.com/blog/massive-malvertising-campaign-...

> the zero-day vulnerability has allowed the group to break out of the iframes and display malicious code to visitors and perform redirects

That is of course something that shouldn't happen, but it's not a particularly severe threat.

So, botnets are a myth, I guess?

1.5 million people pay for AOL still [0].

It’s not that botnets are a myth, but there’s some users who actually do click on scams and let people remote into their machines.

Just because botnets are real doesn’t invalidate GP’s points.

[0] https://www.google.com/search?q=aol+number+of+customers&ie=U...

> then you're totally safe

I don’t know anyone who thinks they are totally safe.

But I know a lot of tech savvy people who don’t run anti-virus or any countermeasures and think they are acceptably safe.

I know it’s cliche to link to xkcd, but this comic seems relevant… https://xkcd.com/463/

Of course there are pros and cons to this position, but just to state a con: anti-virus is usually running with elevated (if not maximum) permissions, tends to load basically any input and once in a while tries to be clever by using self-written interpreters or something along the lines of that.

Using a native AV that does basic heuristic detection is fine and dandy and usually comes with a low performance penalty and requires few rights that other parts of the system do not already have.

Using a non-root user for the daily grind and switching to elevated privileges only if required, running a PiHole (or a software adblocker) and monitoring outgoing traffic using Littlesnitch or LuLu likely comes at a better attack surface/performance/security trade-off, though, AFAIK.

I think the point is that on controlled images like voting machines you shouldn’t be installing anything at all this an anti-virus is unnecessary.

Ah, excuse me. I was not referring to the XKCD at all, I should have been clearer. Agreed, as usual „it depends“.

Most of the countermeasures that are sold (such as AntiVirus software) are pretty much snake oil. The single easiest and most important thing you can do to keep your systems safe is to keep them updated.

I don’t think it’s nonsense.

It’s important to be conscious of security, but that doesn’t mean automatically upgrading to everything all the time. There’s no way, that I know of, to be completely secure so I’d rather be conscious than a false feeling of safety.

I run Catalina 10.15.7 and I think I run it secure enough. Of course maybe I’m rooted and all sorts of bad stuff, but I don’t think so. Of course, maybe the most recent version has an unknown zero day (negative day?) and would also be rooted.

I think it’s naive to have a blanket rule like never run out of support software because sometimes we must. I run old devices that aren’t patchable or supported because they still have use (YouTube/Netflix) and I use them in an appropriate way, I think. I won’t conduct banking, but if someone breaches my Netflix account, I don’t care much. If it’s part of a botnet, I don’t care much. Of course it’s inconvenient and I don’t want to harm others, but then I also don’t want to keep buying dumb terminals for things and companies don’t seem to be changing their support timelines.

This isn’t even mentioning stuff that’s risky like continuing to run my smart lightbulbs even though Phillips stopped supporting them years ago.

I believe in calm technology and I’m not going to keep replacing stuff just because it has a non-zero risk.

>If it’s part of a botnet, I don’t care much. Of course it’s inconvenient and I don’t want to harm others.

“Letting your machines become part of a botnet is nbd” is quite the take.

That’s not it at all. I just don’t think there’s a great risk of my machines being part of a botnet. Past performance doesn’t guarantee future performance but so far I’m a few decades in and no botnets so far (knock on wood).

I think people have different perspective or objective of security.

I would tend to think the author would be mainly concerned about having his bank account data leaked and loosing money or having some online account hacked and loosing access to it.

As your rightly said, the author might already run some malicious program without knowing but as it doesn't impact his life in any meaningful way, that is totally virtual to him and sort of not existing then.

Yikes, yeah. I wonder if this person is tech-savvy enough to check their machines for botnet nodes.

How does one do that?

Probably wireshark + process manager.

I use littlesnitch and watch for any unknown outbound connections.

I once had tripwire setup and would look for any system changes but it got to be too much work.

> You don’t run out-of-support software on an internet-connected computer.

The rail industry, alas, begs to differ.

What have you seen?

Search newspaper headlines dated within the last 10 or 5 years?

Lots of Windows 2000/XP and horribly-outdated Linux.

They were acceptable decisions made back in the days before railways started deciding to network all the things, which wasn't really foreseeable at the time... and railway stuff tends to last 20-40 years.

Is this a dig at OS/2?

No, because that's actually still supported:

https://www.arcanoae.com/arcaos/

https://www.ecomstation.com

Nothing is safe, Mr. tech-savvy

Thank God someone else said it.

https://en.wikipedia.org/wiki/Dunning%E2%80%93Kruger_effect

Reply on news.ycombinator.com