5 ms·

A poorly documented or undocumented (debugging) backdoor in a chip marketed for ATMs and medical hardware, enabled by default, at the very least qualifies as re

A poorly documented or undocumented (debugging) backdoor in a chip marketed for ATMs and medical hardware, enabled by default, at the very least qualifies as reckless endangerment.

sandworm101 1mo ago
Not really. A properly designed network should take account for such things as unknown/irreparable flaws. An irreparable backdoor in a device can be mitigated with a gatekeeper, something akin to a firewall that will not allow a threat actor to have access to a faulty device. The real recklessness would be allowing an ATM unfettered access to the internet on the assumption that the manufacturer has already protected the device from every known and unknown threat.
- michaelmrose 1mo ago
  Both can be negligent at once.
- esseph 1mo ago
  I was basically going to quote your whole statement here and then point to the more than 19 US states that have had Water Treatment plants forced to disconnect much of their Operational Technology systems.
  - sandworm101 1mo ago
    And those disconnects would be that effective gatekeeper. Maybe overkill, but "air gapping" is a often a reasonable mitigation.
    - saidnooneever 1mo ago
      it is not overkill to airgap OT tech. having it on the internet is really braindead. most ones that are routable are hackable real easily. the only reason no one does it is because they dont need to or dont want to. more people should do this. there should be laws to prevent such systems to be connected to others. main problem is often billing systems and sometimes OT stuff will need things like weather info or external data which makes it harder or more expensive to effectively airgap. remote places are also a pain to maintain if u cant connect into them. this is why most of these places rely on not being routable over most internet, so u vpn to some place and connect in from there. Sibsequently many engineers will not properly secure OT because its not routable. then a routing mistake happen at ISP and oops all the boxes are rooted -_-. airgapping is not overkill.
saidnooneever 1mo ago
ofcourse. its just a difference between 'ooh china is evil' or 'derp some company has shit processes' which on a certain level is quite a big difference, though for most consumers will indeed boil down to the same.

A poorly documented or undocumented (debugging) backdoor in a chip marketed for ATMs and medical hardware, enabled by default, at the very least qualifies as reckless endangerment.

sandworm101 1mo ago

Not really. A properly designed network should take account for such things as unknown/irreparable flaws. An irreparable backdoor in a device can be mitigated with a gatekeeper, something akin to a firewall that will not allow a threat actor to have access to a faulty device. The real recklessness would be allowing an ATM unfettered access to the internet on the assumption that the manufacturer has already protected the device from every known and unknown threat.

michaelmrose 1mo ago
Both can be negligent at once.
esseph 1mo ago
I was basically going to quote your whole statement here and then point to the more than 19 US states that have had Water Treatment plants forced to disconnect much of their Operational Technology systems.
- sandworm101 1mo ago
  And those disconnects would be that effective gatekeeper. Maybe overkill, but "air gapping" is a often a reasonable mitigation.
  - saidnooneever 1mo ago
    it is not overkill to airgap OT tech. having it on the internet is really braindead. most ones that are routable are hackable real easily. the only reason no one does it is because they dont need to or dont want to. more people should do this. there should be laws to prevent such systems to be connected to others. main problem is often billing systems and sometimes OT stuff will need things like weather info or external data which makes it harder or more expensive to effectively airgap. remote places are also a pain to maintain if u cant connect into them. this is why most of these places rely on not being routable over most internet, so u vpn to some place and connect in from there. Sibsequently many engineers will not properly secure OT because its not routable. then a routing mistake happen at ISP and oops all the boxes are rooted -_-. airgapping is not overkill.

saidnooneever 1mo ago

ofcourse. its just a difference between 'ooh china is evil' or 'derp some company has shit processes' which on a certain level is quite a big difference, though for most consumers will indeed boil down to the same.