[<prev] [next>] [<thread-prev] [thread-next>] [day] [month] [year] [list]
Message-ID: <5411CE6D.1080206@redhat.com>
Date: Thu, 11 Sep 2014 10:31:41 -0600
From: Kurt Seifried <kseifried@...hat.com>
To: oss-security@...ts.openwall.com
Subject: Re: pinocchio tmp vuln
On 11/09/14 04:12 AM, John Haxby wrote:
> Imagine an internet-connected TV that has the potential to overheat and
> catch fire due to some bug. Some script-kiddie thinks that it would be
> fun to use one of the other vulns to break in and cause the TV to catch
> fire. At night. When the owners are asleep ...
>
> Security education is important.
>
> jch
There are much worse things:
1) imagine internet connected ovens all with a virus that puts them into
self cleaning mode (e.g. get as hot as you can) on Xmas day, thus
literally millions of dinners/etc getting burnt and stinking up the house
2) Imagine a network connected kettle that has a software safety to
prevent overheat... the attacker tells it to get as hot as possible
until it melts/catches fire. My boss has such a kettle, luckily the
overhead is "in hardware" apparently...
3) Imagine your dishwasher full of heated steam under pressure telling
you it's ok to be opened... you get a face full of steam and burned
4) your Internet connected smoke alarm, which can receive software
updates automatically (e.g. the NEST protect now owned by Google) is
programmed to not alert on fires between say midnight and 8am while
you're sleeping.. and your kettle is catching fire.
5) self driving cars - existing car software is terrible (like all
software): http://www.wired.com/2014/08/car-hacking-chart/
6) all the internet connected medical devices, from Dave Dittrich's
slides in 2003 (can't find an older copy):
http://www.slidefinder.net/l/looking_vulnerabilities_dave_dittrich_university/vulnerabilities/29749404/p2
We've already crossed the bridge of software flaws being able to kill
people, luckily there's not much economic incentive for the bad guys to
exploit them ... yet. Would you pay 2 bitcoins to unbrick your car?
--
Kurt Seifried -- Red Hat -- Product Security -- Cloud
PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
Download attachment "signature.asc" of type "application/pgp-signature" (820 bytes)
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
