Apparently these protocols were originally designed to run over serial links, with being on a point-to-point-with-only-trusted-buddies ânetworkâ counting as the security architecture(which can work, if your conduits are nice and hard and you donât have malicious insiders); but the dark desire to keep using the legacy software while also reaping the savings of piggybacking on the new commodity network tech unfortunately didnât inspire anyone to build a suitably bulletproof encapsulation mechanism to protect the legacy traffic.
Not much different than what youâd see if you tapped into a ModBus or DMX-512 network, except that people donât usually tunnel those over god-knows-what awful network; and nobody can jack your bank account by messing with theater lighting.
Nobody will pay to build a vault until the bank gets robbed many, many times.
The surprising part is that nobody has thought to make security a selling point. Clearly, their marketing people explained that nobody cares about that. Right now, they may be right.
Securi-what?
Iâve been out of the industry for 20 years now, but this was exactly correct then, and AFAIK it still is.
Its not like its difficult to tunnel through the internet these days. Its just like telnetting through an ssh tunnel, and ssh provides better security (IMHO) than using public key infrastructure.
One way to get it fixed is each time there is a breach, fine Visa, Mastercard, American Express and Discover for not securing data. If they lose enough money, they will then fix the issue in no time.
Hold bankers accountable? Great idea! Then we can end world hunger, or maybe reverse climate change.
Hey I can dream canât I?
Like everything else, They Just Donât Care. And they wonât care till it hits them to the tune of tens (or hundreds) of millions of dollars. Otherwise itâs easier and cheaper just to churn out shit. That applies to everything from mobile to cars to banks to utilities to whatever.
It is worth remembering that anything involving âsecurityâ is almost never as easy as it look(SSH-ing, for instance, almost uniformly refers to SSH-2, for a variety of good reasons involving the weakness of SSH-1; just as âSSLâ tends to actually mean 'TLS versions greater than 1 because the older ones were broken"); but in general the point is sound.
The currrent situation is a security disaster; but itâs hard to blame whatever engineers where told "we need something simple and cheap to implement on limited hardware connected via trusted hard-linesâ for the fact that the protocol is a massacre when run insecurely over a commodity ethernet arrangement. The task of building a multi-vendor-compatible secure tunnelling mechanism is probably pretty nasty, possibly nastier than just re-doing the the design for untrusted networks; but it seems unfair to blame the original designers. At almost any scale, some bus will be treated as âphysically secure, efficiency is what mattersâ, and all sorts of security horrors will be perpetrated therein in the name of performance(in the case of PC compatibles, the most obvious example is things on the PCI bus that are allowed to DMA; that is basically the key to the kingdom; but itâs also a vital technique for saving CPU cycles and, barring Thunderbolt and similar, only affects cards physically inserted into the chassis, so isnât a huge concern).
Naively using a protocol that depends on externally provided link-layer security is a pretty egregious sin; but it isnât really the sin of the people who designed that protocol, there are circumstances where link-layer security is largely assured by physical means and anything on top of that is excess. The really ugly bit is the fact that the move from physically segregated serial lines to various flavors of network tunnelling did not include a suitably robust VPN-like implementation.
In the least, even before the Age of Raspi Boards, they could buy a cheapo router, flash it with OpenWRT, and run OpenVPN.
Fuck money, we get critical SCADA systems running unsecured.
Security is a selling point. All sorts of products are marketed as having that security stuff, after all.
The problem is that security is a legally meaningless term. All that is necessary to market your productâs security as a feature is to write down the words in your marketing literature.
Right. But the people doing the buying arenât qualified to test oral pH, much less the security of a network or protocol. Iâm sure the executives wherever you work would be very impressed when the PCI standards come out with a big bold sticker on the front saying â100% completely unhackable. Use this system or elseâ.
Security is a selling point, but the Payment Card Industry doesnât lose any money if it lies in itâs marketing copy. Not much that is.
Hell, the switchover to Chip and Pin in the US is going to make the PCI standards body rich as fuck, and the standards can also be fully backwards compatible, because theyâre no more secure than the last set of standards, but use a ânewâ technology, so it must be better, right?
Thatâs what really scares me. If we can blow up very well-protected uranium enrichment centrifuges in Iran with just a tiny amount of social engineering, then imagine what can possibly happen to general infrastructure that isnât under the microscope?
Fortunately, however, criminals have not yet taken advantage of these weaknesses.
Really? How could anyone know?
This topic was automatically closed after 5 days. New replies are no longer allowed.
