Hacker News Reader

Comment by high_na_euv | Hacker News Reader

>But the team picked an older software version for their honeypot that had been upgraded multiple times since its release and, consequently, no hackers bothered to target it. "When we upgraded it to the new one, we had all the attacks we wanted," recalls Bishop. "I thought it was so amusing."

It feels like fantasy imo

While I could understand using outdated or not popular protocols, then software with known vulns seems crazy when we are living in world of automated, ai assisted scanners

View on HN

Let's say your security budget is pretty limited, and you can say with relative certainly that there's only a 0.1% chance of any adversary bothering to check the known flaws in your FossileWare(tm) Firewall in a given month.

Vs.how many dire flaws have been found in big-name security products in the past year, that even a low-budget adversary is likely to be regularly checking for?

There is no human making a decision on what attacks to run. They check for literally everything. 20 years ago, I ran a web server and would run 'tail -f' on the access logs. I watched the bots sending requests for files that only exist on linux, then send requests for files that only exist on windows. They don't know what kind of system they are hacking. They just know that there is a computer at that IP address.

There are databases that list every known flaw in existence, and the bots just go down the list checking each and every one. And if it doesn't work, in 5 minutes, they'll run those same tests again as if something changed in those 5 minutes.

Yep, this kind of stuff is easily automated these days and bots don't get bored.

> a 0.1% chance of any adversary bothering to check the known flaws in your FossileWare(tm) Firewall in a given month.

How would you arrive at this percentage in your risk analysis?

If you're getting scanned, keep logs, and have a decent way to tag log entries with the associated vuln, then you can start building statistical models of how exploit attempt probabilities fade as the target software gets older and lower market share. No, the 0.1% won't be exact. Yes, such data and models can be shared.

Paying $$$ for a LatestGreatest(tm) Firewall won't make you 100% secure either. And the $$$ might better be spent on an extra layer of swiss cheese, or better recovery capability.

Reply on news.ycombinator.com