• 0 Posts
  • 459 Comments
Joined 1 year ago
cake
Cake day: April 13th, 2024

help-circle








  • I’d start with the following, and refine if necessary:

    “Gaining unauthorized access to a protected computer resource by technical means.”

    • Port scanning --> Not hacking because there isn’t any access to resources gained*
    • Using default passwords that weren’t changed --> Not hacking because the resource wasn’t protected*
    • Sending spam --> Not hacking because there isn’t any access to resources gained
    • Beating the admin with a wrench until he tells you the key --> Not hacking because it’s not by technical means.
    • Accessing teacher SSN’s published on the state website in the HTML --> Not hacking because the resource wasn’t protected, and on the contrary was actively published**
    • Distributed denial of service attack --> Not hacking because there isn’t any access to resources gained

    * Those first two actually happened in 2001 here in Switzerland when the WEF visitors list was on a database server with default password, they had to let a guy (David S.) go free
    ** The governor and his idiot troupe eventually stopped their grandstanding and didn’t file charges against Josh Renaud of the St. Louis Post-Dispatch reporter, luckily








  • This week I heard from a network group lead of a university hospital, that they have a similar issue. Some medical devices that come with control computers can’t be upgraded, because they were only certified for medical use with the specific software they came with.

    They just isolate those devices as much as possible on the network, not much else to do, when there is no official support and recertification for upgrading. And of course nobody wants to spend half a million on a new imaging device when the old one is still fine except for the OS of the control computer.

    Sounds like a shitty place to be, I pity those guys.

    That said, if you were talking about normal client computers then it’s inexcusable.