[<prev] [next>] [<thread-prev] [day] [month] [year] [list]
Message-Id: <B802AC79-88F1-478F-9CB1-40EFD4AD78A1@gmail.com>
Date: Thu, 11 Sep 2014 21:04:33 +0300
From: Mikko Korpela <mikko.korpela@...il.com>
To: "oss-security@...ts.openwall.com" <oss-security@...ts.openwall.com>
Subject: Re: pinocchio tmp vuln
Ok :D - I'll give up.
I love you guys.
Just please next time when randomly greppig strings cotaining word tmp just please read the code and ask from the developer what is this all about and could this be a security issue.
--
Mikko Korpela
> Kurt Seifried <kseifried@...hat.com> kirjoitti 11.9.2014 kello 19.31:
>
>> On 11/09/14 04:12 AM, John Haxby wrote:
>> Imagine an internet-connected TV that has the potential to overheat and
>> catch fire due to some bug. Some script-kiddie thinks that it would be
>> fun to use one of the other vulns to break in and cause the TV to catch
>> fire. At night. When the owners are asleep ...
>>
>> Security education is important.
>>
>> jch
>
> There are much worse things:
>
> 1) imagine internet connected ovens all with a virus that puts them into
> self cleaning mode (e.g. get as hot as you can) on Xmas day, thus
> literally millions of dinners/etc getting burnt and stinking up the house
>
> 2) Imagine a network connected kettle that has a software safety to
> prevent overheat... the attacker tells it to get as hot as possible
> until it melts/catches fire. My boss has such a kettle, luckily the
> overhead is "in hardware" apparently...
>
> 3) Imagine your dishwasher full of heated steam under pressure telling
> you it's ok to be opened... you get a face full of steam and burned
>
> 4) your Internet connected smoke alarm, which can receive software
> updates automatically (e.g. the NEST protect now owned by Google) is
> programmed to not alert on fires between say midnight and 8am while
> you're sleeping.. and your kettle is catching fire.
>
> 5) self driving cars - existing car software is terrible (like all
> software): http://www.wired.com/2014/08/car-hacking-chart/
>
> 6) all the internet connected medical devices, from Dave Dittrich's
> slides in 2003 (can't find an older copy):
> http://www.slidefinder.net/l/looking_vulnerabilities_dave_dittrich_university/vulnerabilities/29749404/p2
>
> We've already crossed the bridge of software flaws being able to kill
> people, luckily there's not much economic incentive for the bad guys to
> exploit them ... yet. Would you pay 2 bitcoins to unbrick your car?
>
> --
> Kurt Seifried -- Red Hat -- Product Security -- Cloud
> PGP A90B F995 7350 148F 66BF 7554 160D 4553 5E26 7993
>
Powered by blists - more mailing lists
Please check out the
Open Source Software Security Wiki, which is counterpart to this
mailing list.
Confused about mailing lists and their use?
Read about mailing lists on Wikipedia
and check out these
guidelines on proper formatting of your messages.
