Security quotes of the week
Much of our security ideas and concepts are based on the days when
sysadmins ruled the world. They were like a massive T-Rex ruling their
domain, instilling fear into those beneath them. Today in security we are
trying to build Jurassic Park, except there are no dinosaurs, they all went
extinct. Maybe we can use horses instead, nobody will notice
... probably. Most security leaders and security conferences are the same
people saying the same things for the last ten years. If any of it worked
even a little, I think we'd notice by now.
— Josh
Bressers
Now this may in fact be innocent, but to my mind it is at least possible
that someone had noticed the potentially vulnerable controller in the code,
had experimented with it and found the coding error. Then they realised
that if they could quietly fix it, they could open up a critical
vulnerability in one of the world’s most popular content management
systems, which they could then exploit.
— Fiona Coulter
(Thanks to Paul Wise.)
Earlier this month, the group of computer scientists passed the logs to
Paul Vixie. In the
world of DNS experts, there’s no higher authority. Vixie
wrote central strands of the DNS code that makes the internet work. After
studying the logs, he concluded, “The parties were communicating in a
secretive fashion. The operative word is secretive. This is more akin to
what criminal syndicates do if they are putting together a project.” Put
differently, the logs suggested that [Donald] Trump and
Alfa [Bank] had configured
something like a digital hotline connecting the two entities, shutting out
the rest of the world, and designed to obscure its own existence. Over the
summer, the scientists observed the communications trail from a distance.
— Franklin
Foer in Slate on a strange connection between a Trump server and a
Russian bank