InfoSec Island
infosecisland.com · Group blog · on HN since 2009
InfoSec Island is a group blog on information security topics, including SCADA systems, data breaches, cloud security, and password tools.
What HN saysHN links it for SCADA exposure pieces and data-wiping advice. Commenters cite it on SCADA air gaps, SSD wiping, and a KeePass vulnerability.
17HN people shared it
15linked it in comments
10stories submitted
17story points
8 years agolast shared
2009people per year2026
Most-shared posts
- 116696 FACT CHECK SCADA Systems Are Online Now5 people · first shared 2011
- 2Health Insurer Loses 1.5 Million Patient Records1 people · 8 points · first shared 2009 · discussion on HN
- 3ENISA Cloud Security Risk Assessment: An Interview with Giles Hogben1 people · 1 points · first shared 2009 · discussion on HN
- 4Exclusive Video of XerXeS DoS Attack1 people · 1 points · first shared 2010 · 1 comments on HN
- 5Why I Won’t Teach You To Track Terrorists Online1 people · 1 points · first shared 2012 · discussion on HN
- 6Emerging Technologies that can Reduce PCI Scope1 people · 1 points · first shared 2009 · discussion on HN
- 7Federal Data Security Law: ‘Careful What You Wish For’1 people · 1 points · first shared 2009 · discussion on HN
- 8Component Directory Lockdown – New in Firefox 3.61 people · 1 points · first shared 2009 · discussion on HN
- 9Hacker exposes global warming researcher1 people · 1 points · first shared 2009 · discussion on HN
- 10Road Map for an Application/Software Security Architect (Part 3)1 people · 1 points · first shared 2009 · discussion on HN
- 11A Taxonomy of Social Networking Data1 people · 1 points · first shared 2009 · discussion on HN
- 1221386 Facebook Like Button Privacy Violation Security Risk1 people · first shared 2015
- 13Aa043ae12a09714b10a9f400d16aba67.jpg1 people · first shared 2017
- 1421776 KeePass Vulnerability Exposes Password Lists1 people · first shared 2017
- 1522518 How to Protect against Denial of Service Attacks Refresher1 people · first shared 2014
What HN people wrote when they linked it
Devilboy · 2012-12-17
Public key crypto schemes (RSA, elliptic curve etc.) are vulnerable to some variation of Shor's algorithm. We'll have to move to quantum crypto when this happens. Hell for all I know D-Wave's machines can already break RSA for the DHS.
http://www.infosecisland.com/blogview/19707-The-Emerging-Threat-to-Pub…
The 256 bit key size is still the recommended maximum since no increase will help against quantum computers.
blasdel · 2011-11-14
https://www.infosecisland.com/blogview/16696-FACT-CHECK-SCADA-Systems-…
https://infosecisland.com/blogview/16770-SCADA-Air-Gaps-Do-Not-Exist.h…
I tried to submit this and the followup article a while ago, but the domain was blacklisted by pg so the stories get autokilled.
bluehavana · 2011-08-29
If you ever have to wipe an SSD the wear-leveling will totally mess with your wipe process. It is always best practice to just do full disk encryption on SSDs, even if you aren't taking it out of the house/office.
Edit: Reference https://www.infosecisland.com/blogview/13722-SSDs-and-the-Importance-o…
kalleboo · 2018-05-11
The "you can recover overwritten data" thing is a myth. There was a paper that showed a theory behind it (for old drives using a different technology than is used today), but there's no proof anyone has ever actually done it. http://www.infosecisland.com/blogview/16130-The-Urban-Legend-of-Multip…
wglb · 2017-03-23
musesum · 2017-01-12
> Rory Sutherland is vice-chairman of Ogilvy Group UK
I wonder if the OP observations of "(box-ticking, arse-covering, fatuous self-exculpating emails, the collection of ever more stupid metrics)" occurs more often in the advertising business? I searched for a chart that broke down stupid metrics by industry, but the closest one I could find is this: http://www.infosecisland.com/uploads/remoteimg/aa043ae12a09714b10a9f40…
Piskvorrr · 2015-03-26
Why not? What is the crucial difference, from the unauthorised intrusion POV? "This should not happen, therefore it cannot happen" is not an appropriate response here. http://www.infosecisland.com/blogview/16696-FACT-CHECK-SCADA-Systems-A…
(Note that I didn't mention anything about webservers, or Internet; are you sure the in-flight entertainment systems are separated from the control network by anything else than a firewall rule? See other embedded systems, and how secure they are. Start with...IDK, Toyota's gas pedal code, see how well such safety-critical code was written: https://users.ece.cmu.edu/~koopman/pubs/koopman14_toyota_ua_slides.pdf )
dandelion_lover · 2015-02-02
I wish it was true.
http://www.infosecisland.com/blogview/21386-Facebook-Like-Button--Priv…
septerr · 2014-06-11
When they said in their post that they were working to neutralize the attack, I started wondering how they are doing that. If anyone else is curious, this article - http://www.infosecisland.com/blogview/22518-How-to-Protect-against-Den… - briefly describes how DDoS are neutralized.
msantos · 2014-03-13
IMO Boeing and Rolls-Royce (the engine manufacturer) know more about that plane than Malaysia Airlines is letting off right now.
Ref: (43:18) https://www.youtube.com/watch?feature=player_detailpage&v=2LosYIFU…
Digging an oldie, Boeing still runs SCADA on both 747 and older 777. Going as far as reading engine stats in realtime via telnet.(http://www.infosecisland.com/blogview/16696-FACT-CHECK-SCADA-Systems-A…
dredmorbius · 2013-01-25
Monitoring and support backdoors are common and pervasive in most networking gear. This isn't something that should be considered lightly.
There's been some hullaboo about Chinese manufacturers putting backdoor access into their devices, Huawei Technologies and ZTE Corporation particularly: http://www.infosecisland.com/blogview/21930-China-Has-Backdoor-Access-…
Legally mandated backdoors exist on Cisco gear as well: http://www.forbes.com/2010/02/03/hackers-networking-equipment-technolo…
rbanffy · 2011-09-26
Original article: https://www.infosecisland.com/blogview/16696-FACT-CHECK-SCADA-Systems-…
runjake · 2011-09-26
Non-blogspam link: https://www.infosecisland.com/blogview/16696-FACT-CHECK-SCADA-Systems-…
shabble · 2011-08-18
I'm reminded of the recent HBGary hack/infodump which contained a lot of material about creating software to ease/simplify sockpuppeting and plausible background generation for the US government.
One article: https://www.infosecisland.com/blogview/12250-HBGary-Federal-Document-o…
Dozens of others, including probably the leaked docs themselves via Google.
iuguy · 2011-07-29
It's full name is the Certified Information Systems Security Professional. There's a good writeup of the problems with CISSP here:
https://infosecisland.com/blogview/15450-My-Canons-on-ISC-Ethics-Such-…
and here:
http://erratasec.blogspot.com/2011/07/ethical-problems-of-cissp-and-is…
It's often described as 'a mile wide and an inch deep'. However, it's not really the example of broad security knowledge it sets out to be and is considered a joke certification in my niche (technical security).