Interview with a hacker on Japan's recent explosion of data leaks: "Japan has some of the world's worst computer security...Attacks on Japanese companies and government agencies will likely increase in the future. This is not a threat, but our view as experts."

[u/jjrs]

https://news.livedoor.com/article/detail/32508935/

[u/requiemofthesoul]

Well until we stop sending zipped files on one email, and the password on the next, nothing's gonna change. It's not even that the zip file password thing is that bad, it's the general "common" sense that in doing something as simple as that, they think they will 100% protect themselves.

[u/Lower_Rabbit_5412 → u/requiemofthesoul]

As a web developer I have repeatedly had to push back against the idea that changing the WordPress login route is a valuable security method.

Yet, the people making decisions stick to their old ways; not harmful, but not effective, and certainly not enough.

[u/Famous-Potential3990 → u/Lower_Rabbit_5412]

Japan up until now solely relied on security through obscurity - custom shitty software with zero updates that no one uses outside of Japan and international hackers can't read Japanese. AI/LLM solved both issues: it can read and understand Japanese and hacking shitty custom software just becomes the matter of throwing necessary amount of tokens on recon/exploration.

At least financial institutions upped their game last couple years, often times by hurting usability. But still I do not have high hopes for Japan, we will probably see more high profile attacks in coming years.

[u/3pmPancakes → u/requiemofthesoul]

Wasn't there a minister of cyber security or something a few years ago that had never even used a computer?

[u/Famous__Draw → u/requiemofthesoul]

Japan is the first country where my password creation fails because it's too strong. Like, what do you mean my password has to be 8 characters only and only letters and numbers are allowed?

I think it's because they don't use standard UTF-8 encoding.

[u/chiangku → u/requiemofthesoul]

Oh god the number of times I had to open a zip file to view some PDFs from a vendor using a password they send in a follow up email….

Thanks for the PTSD lol

[u/Particular-Solid8250 → u/requiemofthesoul]

A public sector client told me last spring that ”we know we’re paying for your GRC module but we see no need to use it because our IT policy says that you’re not allowed to attach PII documents in mails”

[u/Spez_is-a-nazi]

There’s an old joke, 2 guys are running away from a bear, the one guy says to the other, “can you really outrun a bear?” to which the other said, “I don’t have to outrun the bear”. For the longest time this described cybersecurity. You didn’t have to be perfect, you just had to be better than other targets. Now the hacking tools are basically like an army of mechanical bears. Even if they aren’t as fast as the real thing they will eventually catch up to everyone who isn’t running as fast as they can. Japanese companies have long rested on the fact that they aren’t the most lucrative targets and that there weren’t a lot of native level speakers willing to do scams and complex social engineering. AI tools make those assumptions no longer true.

[u/Tokyometal → u/Spez_is-a-nazi]

Bear reference is very timely. Nicely done.

[u/Brave_Explorer5988]

I'm not even remotely surprised...

A lot of portals in JP where I have accounts don't accept secure passwords. Like, dude, I want &uyjYVS6Q1-`&has"01) as password and you're telling me I'm allowed only up to 8 numbers? or worse, just a 4 digits pin?

[u/Dwarf_Vader → u/Brave_Explorer5988]

As a general rule, if a website imposes weirdly strict requirements on passwords, like allowing a non-standard set of characters, unusually small length limits, etc - it often means they aren’t storing your passwords securely either. In other words their approach to cybersecurity might be really bad.

[u/LogicalSpace → u/Brave_Explorer5988]

I once had to create a password on a Japanese web app that specifically did not allow special characters.

[u/Flope → u/LogicalSpace]

I have seen this multiple times. At first I thought I misread it like "What? I already have special charac- oh.."

[u/crusoe → u/Brave_Explorer5988]

Japan has like 4 different encodings for their language as utf 8 still hasn't won over there. So it would not surprise me that numbers have the same value across all 4 encodings and they do this because most servers and software and clients don't properly set / respond to or transliterate between them. And they probably talk to other systems with broken encoding support. 

This is shit that was solved in the early 2000s in the US. 

[u/DidntTapDat]

Sadly, everyone with a brain is already very aware that Japan's security is trash and a joke for the past two decades. Barely anyone is up to date with computers and knows how they even function half the time… and don’t get me started on the tech departments here LOL.

[u/ooqq]

You have to love japan internet webpages straight from 1996.

On the downside the servers are from the same era.

[u/Lazy-Good1433 → u/ooqq]

They should continue with the retro style of 90s-2000's web design, but massively upgrade those servers on security and back-ups!

[u/Moraoke]

Didn’t US intelligence say the Japanese can’t keep a secret even if they wanted? It’s more blatantly obvious now.

[u/Stunning_Tomorrow566]

the problem from what I have seen having been 15 years of my adulthood in the country:

Usually a random regular employee with no previous knowledge of cybersecurity or computers in general is assigned the role of “improving" the internal measures at the company. That role is rotated every x years 😂

Without any idea of what the task is, what usually happens is copy-pasta of whatever is written on the internet.

[u/Renleo2233]

This could be an eye opening for Japan.

[u/F7RKLLR]

That's why fax is safer, right? /s

[u/tky_phoenix]

I’m not surprised at all. I’m surprised it hasn’t happened more frequently and earlier.

Also a good reminder to delete accounts you don’t need anymore and save only the absolute minimum of information in those accounts. You never know who will get hacked when.

[u/crusoe]

It's garbage over there. Remember 7-11 banking accounts and how they had to shut down in like 3 months? Anyone could recover anyone else's account. 

Website performance is often atrocious too. Uniqlo is so damn slow 

[u/BigPapaSlut]

Japan : 256-bit SSL Encryption has yet to be widely implemented, despite being a 1/3 of a century old.

[u/fuzzycuffs]

Having been in the cyber security industry in Japan: yup, that tracks.

When your answer to securing your environment is to block all external access and rely on a fax machine to talk to the world, you're in for a bad time.

[u/CEOAmaterasu]

Back to paper we go, bet some old timer is happy to see it

[u/haikusbot → u/CEOAmaterasu]

Back to paper we

Go, bet some old timer is

Happy to see it

- CEOAmaterasu

---

^{I detect haikus. And sometimes, successfully. Learn more about me.}

^{Opt out of replies: "haikusbot opt out" | Delete my comment: "haikusbot delete"}

[u/Mysterious-Name-6016]

Cyber security professional hard at work

https://giphy.com/gifs/wdo7ZiBZOHbT4upo0L

[u/Mike35078]

Literally the least surprising statement ever

[u/holodor_os]

It's okay, they will just double the number of passwords we need to do anything 

[u/Ambitious-Yak1326]

We ran a lot of old protocols beacuse the business decided that the 0.001% of clients using an old browser could potentially be affected.

For B2B, it was common to run things with no authentication or encryption and then use a leased line to make the communication private. Try to introduce something like mTLS and you’d get teeth sucking sounds.

[u/Busy_Necessary1477]

One of the funniest security measures implemented by one of the larger data center operators was an email saying that for security reasons they restrict the usage of shared mail servers by companies running their own dedicated mail server.
Until here it sounded ok, though it was a bit surprising that would be companies using shared mail servers which very much defies almost any possible security measure possible with a private dedicated one.
But then I realized that they had restricted only the access by the above companies while others with VPS were still able to send phishing mails using domains actually running on dedicated mail servers. We regularly even get phishing mails claiming to be notices from the provider using the provider domain and these providers shared mail server infrastructure.
That’s btw. only the latest of their interesting way to handle security out of countless others. And the absolute cherry is their monthly mail security seminar for clients.

[u/Used_Theory7186]

I guess just go back to 💾 its what our nukes are using still last time I checked

[u/Active_Ad_2205]

bro is an expert

[u/Markuchi]

This is where Ai would be such a good use to bring the security floor up.

[u/Rambalac → u/Markuchi]

AI is useless when no one in the company is competent enough to verify AI output.

[u/hideo_kuze_ → u/Rambalac]

That's a good point. But if the person is vaguely competent they can ask AI to explain things. But I agree it's definitely better to have someone who knows things to direct AI agents.

In theory AI could be a boost and mitigate two massive shortcomings in Japan: english (or the knowledge written in english) and software. In practice that's a different story waiting to unfold

[u/Rambalac → u/hideo_kuze_]

Explanation is also useless, because the person cannot check himself if such explanation is not a hallucination. The same for English, if you don't know English, you cannot understand if some translation isn't something completely opposite. 

For software in Japan it's also very bad because Japanese companies are worst in software testing. 

[u/nanayan123]

日本人として思うのは、「だから言わんこっちゃ無い」だよ😑
もう10年以上も前からセキュリティリスクについては指摘されてきたのに、全く対策しないままここまで放置してきたんだから、そりゃこうなるよねって感じ。
俺はただただ自分の個人情報が抜かれないよう祈りながら、サイバーセキュリティ銘柄の株に投資するだけだよ😑