Hacker News Reader

Comment by 2OEH8eoCRo0 | Hacker News Reader

Read-only access is mostly an illusion that itself can be hacked to gain control.

I have a read only temperature sensor in my old-school non-computerized refrigerator and freezer. Hack until the cows come home but it still can't turn off my freezer.

Off topic but "hack until the cows come home" put a smile on my face.

Good. You've got a read-only widget that monitors your freezer.

If it were hacked to start delivering temperature readings that were dangerously-high while you were out of town, then: Would you keep the food, or discard it?

1) you'd wonder what broke 2) you'd wonder why it fixed itself 3) you'd check the ice cream when you got home 4) ice cream is fine, must have been a bug in the temperature reporting.

I also keep a marble on a shot glass of ice ;) but I am not good at religiously checking it every time I open the freezer. It's a sanity check for the sensor.

Air-gapping, network segregation, data diodes, etc. are all real things. It's possible to make a read-only refrigerator that is "unhackable". I have a temperature monitor in my refrigerator right now. Hack that monitor and it doesn't affect my refrigerator at all.

not in this case where a thermosensor can do nothing but monitor a temperature.

Yeah? We had an old Unix server that printed its logs in realtime to a dot matrix printer. How are you going to gain control of that?

Read-only is a strong control with lots of solid implementations.

Depending on the make and model, send a reverse feed code and then overwrite with block characters. You will know that something bad happened, but you won't know what.

That makes it inconvenient to read, not impossible. E.g. use transmitted instead of reflected light (shine a bright light behind the paper) to see how much ink is in each place.

So overwrite with random patterns of dots. You could "arms race" this all the way to the point where you need a scanning electron microscope.

But this line of discussion is entirely missing my original point.

Reply on news.ycombinator.com