I haven't blogged about computer (in)security for awhile -- but not for any lack of material. Certainly the confrontation between the FBI and Apple about unlocking the iPhone used by one of the San Bernardino shooters has been all over the news. And because that story
is all over, there's little point in me adding my two cents worth. I'll wait to comment at least until there's a court decision on the matter to comment upon.
 |
If only it were this simple ... |
I take it back. I
will comment upfront on one aspect of the situation. Apple is to be commended for building a product that's actually secure -- a praiseworthy technical and managerial achievement no matter which side of the legal controversy you happen to be on. Keep reading to get an inkling how rare such achievement is.
Remember how (apparently) the US and Israel once impeded the Iranian uranium-enrichment program with the
Stuxnet worm? Remember how the attack on the Iranian centrifuges was deemed so sophisticated that technologically advanced nation-states
had to be involved? This next item may not count as progress, but it
is news: "
An Easy Way for Hackers to Remotely Burn Industrial Motors." To wit:
... Now a researcher has found an easy way for low-skilled hackers to cause
physical damage remotely with a single action—and some of the devices
his hack targets are readily accessible over the Internet.
and also:
... At least four makers of variable-frequency drives all have the same
vulnerability: they have both read and write capability and don’t
require authentication to prevent unauthorized parties from easily
writing to the devices to re-set the speed of a motor. What’s more, the
variable drives announce the top speed at which motors connected to them
should safely operate, allowing hackers to determine the necessary
frequency to send the device into a danger zone.
Not good design. Flat out, not good.