Comment by unimpressive | Hacker News Reader

Comment by unimpressive | Hacker News Reader

I don't have much time to write this comment. But before I head to school I'd like to posit that these sorts of attacks are largely our fault.

When I say "our", I mean the loose knit group of sysadmins, self proclaimed "computer people", hackers, phreakers, security experts, and government officials trying to quell the increasing lurch of botnets and malware that has gone on since the Eternal September.

Botnets get big because users don't know any better, users don't know better partly out of laziness, partly because they feel they can't know any better. I don't know of a single site I can point to and say "If you really give a shit about not getting your credit card data stolen, go here." Instead as far as I can tell the majority of users in this demographic have their needs "met" by fraudsters selling bogus antivirus packages and weird proprietary utilities.

If you want a computing environment that can survive open, it needs users who can use open.

I agree, the problem however is that threats are constantly evolving and getting more complicated. Even most IT people don't understand the threats properly (I know I struggle).

It used to be that could just tell people to install a security suite on their computer and they'd be mostly OK. I don't think that's really true any longer.

You could also partly lay the blame at Microsoft's door in getting users to start connecting to internet with an OS designed without any reasonable security (Windows 95).

Now that we have operating systems with better security it's hard to change people's usage patterns to take advantage of that.

If she has Microsoft Security Essentials installed, doesn't run unknown software, and doesn't give out her password, what more could my mother, as a layman, reasonably be expected to do? I understand there are all sorts of complicated steps she could take if she had good intuition about sniffing out bad guys, but she doesn't. Isn't the problem with the crappy software, not her?

The fundamental problem is that bad guys can come up with new attack methods faster than we can educate or produce reliable user friendly software to counter their methods.

Even a sophisticated user is just as vulnerable in many cases. If I give personal information to a third party site that I presume to be trustworthy (say a government site) there's no way I can know if someone is going to find SQLi vulnerabilities in that site next week and exfiltrate all of that data.

Speaking of such, I just recently accidentally happened across an SQLi vulnerability on a government site containing confidential information of tens of millions of people.

That's just the way the Internet is right now.

New attack methods are not the problem. If there is new technology there will always be a new attack method. Right now the existing attack methods are the problem. Specifically, that technology is being developed using the same lack of basic security standards and thus the same old attacks keep working.

SQLi should not be a thing. At all. It's the most trivial fucking thing in the world to validate data before you use it in an SQL query, and people get it wrong, every single day. Security isn't hard, it's just tedious.

Use a router that monitors spikes in traffic. Check the logs occasionally (weekly?).

Turn the computer off when you're not using it.

My traffic has lots of spikes. Some days I download HD video, some days I don't.

If I look at the logs, it's all connections to CDNs with weird hostnames. How do I know which ones are legit and which ones might be part of a DDOS?

Also CC numbers are 16 bytes long, would just get lost in all the noise..

Maybe I should say, spikes in outgoing traffic.

The internet is not safe for banking, and I don't see any way it can be made safe.

It is safe for banking. Have you heard of encryption?

That is assuming your endpoint is secure.

Most people's personal finance is probably safe to do on the Internet because of legal requirements on banks. Small businesses are another matter.

Oh, encryption. Why didn't anyone else think of that!

Have you noticed the spate of attacks against SSL lately? BEAST, CRIME, Lucky 13, RC4 in general? https://en.wikipedia.org/wiki/BEAST_%28computer_security%29#... Not profitable for some things, maybe, but definitely worth mounting such an attack for banking info.

Have you noticed that the certificate authority system is totally broken? http://www.theregister.co.uk/2011/04/11/state_of_ssl_analysi... Heard of DigiNotar? Comodo? http://arstechnica.com/security/2011/09/comodo-hacker-i-hack... These aren't hypothetical attacks! Google got MITM'd by Iran https://blog.mozilla.org/security/2011/08/29/fraudulent-goog...

A well-orchestrated DDoS attack sends packets at the rate of the noise floor of each "owned" host involved. Such a spike should be undetectable.

Reasonably? That's pretty much good. Add what another comment said about not giving out personal information, but having a good AV like MSSE, using automated Windows Updates, use an updated browser (even if it's just the latest version of IE), don't run untrusted software, and having strong passwords (using something like LastPass to remember them all but still retain convenience) is basically all you can reasonably ask an average user to do. And for the most part, that's good enough.

Sure, there's evolving threats, there's drive-bys that will slip around all of this, there's ways attackers could still get through. But as scary as it all is, anything beyond these steps gets into the territory of major inconvenience. The problem with that is, the more intrusive and inconvenient the security becomes, the less likely people are going to be to actually use and remember their security practices. If mom can't repeat it at her book club, it's not going to be effective. And to be honest, these types of attacks that bypass these restrictions are exceedingly rare when it comes to mom and grandma. The biggest threat there is phishing and malware. Corporate security has professionals enforcing a policy that meets the business's own requirements.

So to answer your question, yes, that's all you can reasonably do. In most cases, you'll be pretty well protected with just that, and those steps aren't too complicated to follow or remember.

Reply on news.ycombinator.com