Editorials http://www.decryptedtech.com Mon, 27 Sep 2021 02:57:33 -0400 Joomla! - Open Source Content Management en-gb Vendors - once again - rule the security world, especially in Health Care http://www.decryptedtech.com/vendors-once-again-rule-the-security-world-especially-in-health-care http://www.decryptedtech.com/vendors-once-again-rule-the-security-world-especially-in-health-care Vendors - once again - rule the security world, especially in Health Care

It seems that is the time once again to talk about the relationship between software vendors and the security posture of different business verticals. Why are we beating this particular dead horse? Well with the Covid-19 Pandemic, the rush to shift to remote work force and an increase in attacker activity aimed at the remote workforce and healthcare you would think that there would be an increase level of effort to fix vulnerabilities in remote access and healthcare services software. If you thought that, you would be wrong. Instead during this time, we are seeing more software vendors pushing FDA as law and healthcare organizations even refusing opportunities to patch critical software. This on top of an extremely slow response to threat to the remote workplace.

In March of 2020 as the common response to Covid-19 was to isolate and move from an on-site workplace to a heavy remote one we saw far too many companies making this move without the proper safeguards in place. BYOD policies were suddenly implemented, and corporate assets were opened to the outside world. Threat actors went into overdrive as they went on the hunt for not only truly insecure companies, but also ways to leverage existing vulnerabilities that are commonly left on the table. We have talked about this problem before, so we will not belabor it too much here. The big issue is that once the normal routine was established far too many organizations did little to nothing to improve their security posture and remained open to attack. This was even more prevalent in the healthcare industry.

In healthcare, almost more than any other industry, the idea of 100% up-time drives the security posture. I often hear comments like; “we can’t take that down”, “our vendor does not support that”, “we can’t have anti-malware on that”, along with a host of other excuses when it comes to security tools and prevention measures. Let me give you a very concrete example of this.

A healthcare organization runs a clinical application (it does not matter what the application is). The organization is looking to patch a key subsystem (.net, esxi, etc.), they reach out to the vendor and are told they cannot update as their clinical application is not supported on the updated version. Now the host system is vulnerable to attack all because of pressure by the vendor. We can see the same logic being applied to clinical applications when it comes to security tools. An organization my want to install an advanced EDR/XDR solution on all systems to help prevent Ransomware but are unable to due to dependencies of the EDR/XDR solution that cannot be upgraded. Conversely, if they do have the proper dependencies, the EDR/XDR must have too many exceptions and blind spots to make it of any real value on the device.

Although these examples are seen in many other business verticals, we see them more clearly in Healthcare. Vendors throw around FDA protections to prevent any real security in their apps and have no interest in taking ownership for the vulnerabilities their introduce. This has left healthcare very exposed at a time when they need to be able to provide services to people. The attackers know this and have doubled (or in in some cases, tripled) their efforts. The are very aware of the fertile hunting ground they have and know they are very likely to get the money they ask for. New and improved ransomware as a service models mean that we can expect to see a continued rise in these types of attacks. That is unless some significant changes are made.

To change this trend both software vendors and healthcare organizations need to step up and take more ownership of this issue. On the healthcare organization side, they need to invest in better and more consistent security tools, redundancies, backup systems, proper network segmentation, as well as requiring vendors to be responsible for the failings of their software. There must be a fundamental top-down shift in perspective as well. Security needs to be a priority instead of it being driven by the needs of the application. This does not mean you put lives in danger, but it does mean you allow for proper testing, patching, down time and security tools to be put in place to prevent the use of those tools as an attack vector. Failing being allowed to do those things then the application needs to be a locked off as possible. Believe me when I say that attackers do not care if they disrupt a hospital’s efforts. In fact, they are counting on the impact to force the payment of the ransom.

In the future we need to see more healthcare organizations spend on securing and stabilizing their own systems and infrastructure and less on purchasing bitcoin “in case” of an incident. If we cannot make this shift the trend of attacks aimed at healthcare organizations will not only continue, it will expand.

sean.kalinich@decryptedtech.com (Sean Kalinich) Editorials Tue, 02 Mar 2021 12:12:24 -0500
As Work from Home Increases with COVID-19 Cases are We Looking at a Playground for Threat Actors? http://www.decryptedtech.com/as-work-from-home-increases-with-covid-19-cases-are-we-looking-at-a-playground-for-threat-actors http://www.decryptedtech.com/as-work-from-home-increases-with-covid-19-cases-are-we-looking-at-a-playground-for-threat-actors As Work from Home Increases with COVID-19 Cases are We Looking at a Playground for Threat Actors?

In December 2019 a new virus was detected in Wuhan China, this virus (COVID-19 or the Coronavirus) has spread rapidly through out China and the rest of the world. With its apparent ease of transmission and difficulty in detecting (early stages can look like the Flu), many companies are looking into allowing employees to work from home more in an effort to slow down the spread of this potentially deadly virus. The question is, are these companies really ready to have so many people connecting in from home, or are we potentially opening or a massive hole that threat actors are bound to exploit.

There are 101,601 confirmed cases of the Coronavirus globally (as of this writing, by the time of publication it could be much higher). Not all of these people were in quarantine when detected and almost all of them exposed others to the virus, this means the number of potential cases is exponentially higher than the number of actual cases (not to mention the shortage of test kits). Anyone that has had incidental contact with one of the 101,000+ should avoid contact with others until they pass through the incubation period (about 12-14 days). When it comes to most adults being out of work for that length of time might not be an option and with the number of potential cases the lack of employees would have a significant impact on the business. It is a perfect setup for remote work, where applicable.

Setting up a proper remote work environment is not going to be an easy task and we are sure that many businesses will move to set this up quickly and not truly in a security focuses manner. The possibility of insecure connections, weak encryption, and security controls has to have some of the existing APT group drooling in anticipation of the number of unprotected targets. After all APT groups can get into businesses and organizations that actually do have a security focused remote work policy, it just takes more effort. These pop up work from home situations are bound to be ripe for the taking as, in most cases, there is just not enough time and/or money to set them up with proper protections.

I am not saying that these companies should not let their potentially sick employees stay home. In fact, I personally feel that if someone is sick, regardless of the malady, they should not be at work where it can spread. I am saying that in 2020, companies should be much more prepared to accommodate for this given the technology and the tools that are currently available. We should not be in a situation where an employer, or employee, should have to make the choice between going to work and potentially infecting others with a deadly virus, and working from home. Granted not every job can be worked remotely, but in cases where it can, having the right tools in place can help when the time comes.

But wait, there’s more.
So far, we have only touched on basic remote workers, we have not scratched the surface of the potential impact from security and IT operations teams being affected by COVID—19. If and when these teams are impacted the situation looks even worse. You will now have a massive increase in potentially unsecure remote connections (maybe from home devices) hitting unprepared servers and with a minimal staff to protect and keep them running (yes, even cloud services). It is not a pretty picture at all, but it is one that we are heading into right now with a good deal of speed. Organizations of all sizes should have already been looking at what they need to allow a more secure and effective remote workforce, including the potential need to allow for IT security and operations staff to function. Remotely, but as with most things the ball does not move until there is a major event.
COVID-19 has not even hit critical mass yet and there is no vaccine or cure insight. We are bound to have many more confirmed cases which will (sadly) mean more potentially exposed businesses out there. Unless something changes rapidly we are looking at some very uncertain times in the security field as well as a high cost in human lives and while I firmly believe the human lives are much, much more important, we still do have to account for the potential impacts of so many insecure business and organizations.

sean.kalinich@decryptedtech.com (Sean Kalinich) Editorials Fri, 06 Mar 2020 18:09:59 -0500
With More and More Hardware Flaws Found, How Will the Security Industry Respond? http://www.decryptedtech.com/with-more-and-more-hardware-flaws-found-how-will-the-security-industry-respond http://www.decryptedtech.com/with-more-and-more-hardware-flaws-found-how-will-the-security-industry-respond With More and More Hardware Flaws Found, How Will the Security Industry Respond?







sean.kalinich@decryptedtech.com (Sean Kalinich) Editorials Fri, 06 Mar 2020 18:01:52 -0500
New Tech, Stale Tech, and the Diminishing Security Skill Set http://www.decryptedtech.com/new-tech-stale-tech-and-the-diminishing-security-skill-set http://www.decryptedtech.com/new-tech-stale-tech-and-the-diminishing-security-skill-set New Tech, Stale Tech, and the Diminishing Security Skill Set

Although not a new subject here at DecryptedTech we thought it was time for us to dive into three of serious issues in the security world (out of many). The three we are covering today are emerging technologies, stale technologies and how the security, and IT, skill set seems to be diminishing. All three are cause for concern and often seen as at least contributing factors in breaches. What make this more interesting is that in many cases the three are connected.

New Tech -
New technologies are cool, they are sexy, and sadly are often put in places they do not belong. IoT or connected items are often put in corporate networks without regard to their security implications. The same can be said for automation items (control systems for hospitality, etc.) These technologies are often not secure (a massive understatement) but are put in admin or publicly accessible networks with no thought about the possible ramifications. While working for a hospitality company I was once informed by a vendor that their lighting control system HAD to be on the admin network as it could not support routing. This product was purchased without being allowed any security review or vetting. The fact that the vendor’s statement turned out to be false showed that even the people who built the product did not understand how it fit into a production network.
This is a theme I have observed over and over again. A technology is presented without fully understanding (or perhaps caring) about the security implications and is accepted. In some cases, it is accepted because it’s from an “industry standard” company, and in others it is a push from the business side of an organization. The net effect is still the introduction of something that weakens the overall security posture. When you add that to an environment that does not have, or want to pay, for competent security and network professionals you have a big problem.

Let’s think about what we have seen with some of the emerging technologies lately. The Auto Hacking Village at Def Con is full of examples of vendors not understanding security or even basic QA and testing processes in development. It is full bore: make something and get it on the street and fix the bugs later. It is like the gaming industry’s market strategy has invaded all of the other verticals. Even having security tools in place are often not enough. Frequently, this is due to improperly configured security tools, lack of patching those same tools, or an undertrained staff that is trying to use them.

Stale Tech -
Stale Technologies are almost as bad as new tech (possibly worse). With new tech you still have the possibility of patches to fix or mitigate security concerns, but stale tech rarely has that option. To throw out another anecdotal example (I know you guys love these): I encountered a client who had multiple switches in their environment that were End of Life, End of Sale AND End of Support. When I asked them about these items the response was that the Network Engineer was very familiar with them and comfortable. The switches had a lifetime replacement for failed hardware so they had not seen the need to change them. Now this is something of an extreme example, but it is not uncommon to see outdated hardware and software in place simply because the team supporting them cannot adjust to new standards. This is true on both the vendor and client side and it helps to depreciate the security posture of any organization.

Outside of the skill set or ability to change is the ever popular fiduciary excuse. Companies will not spend the money to replace old hardware or software as needed. And vendors will not spend the money needed to overhaul a product to meet the current threat landscape. Even basic patches for operating systems are often put off longer than acceptable to prevent financial losses due to downtime. This is one area where breach insurance has hurt many corporate security practices. If there is no major financial impact from not patching, then it gets pushed off. These little flaws in software and hardware are well known to attackers and are going to be exploited; even with security tools in place. In some cases this is due to improperly configured security tools, lack of patching those same tools, or an undertrained staff that is trying to use them. (Are you seeing the pattern here?)
Diminishing Skill Sets -

A few years ago, I asked multiple people at BlackHat and Def Con if they felt that there was a diminishing skill set in the security industry. The answer was interesting. For the most part I heard that it was not as simple as people not knowing what to do, but that they are becoming more and more reliant on their tools to feed them the correct information. The “skills” of manual threat hunting or manual security sweeps are not being taught as often and the people that have the skill are gradually exiting the work place. If we think about how often security tools are not properly configured, updated, etc. this means that many organizations are relying on bad, or at best, incomplete, data to maintain their security environment. With techs and analysts not able to pull back and validate the data or to ensure their tools are actually running correctly, we have a situation where they could be blind to things going on in their own backyard.
Now let’s add in another factor here. Far too many companies are not willing to invest in the time to train their people in more advanced skills. They are perfectly happy with only teaching them what they need to do to pull the data from the existing tools. They put the onus of education and training back on the individual employee while not providing the time or any extra compensation. You can end up with a couple of directions from the employee side. On the one hand the person stays and continues to work as taught and collect the 8-5 paycheck, and on the other they spend their time and money to get better trained and look for a better (and possibly higher paying) job. Neither of those really helps in the end. This is something of an oversimplification, but in looking at the reasons people have left former IT jobs, lack of access to training (while being required to stay current on new hardware/software) was nearly always mentioned. In most cases right after salary and work/life balance.

So where am I going with all of this? It’s simple: if you read some of the articles out there you might feel that a breach is inevitable and the attackers have the upper hand. This is a fairly accurate assessment when you consider the number of breaches per year and that, traditionally, the attacker does have the upper hand. However, there are real things that can and should be done in regards to properly vetting new tech (and pushing vendors to do so as well), retiring old and insecure software that cannot be properly patched, and investing in employees so they have the right training and can use more than the automated tools.

sean.kalinich@decryptedtech.com (Sean Kalinich) Editorials Tue, 19 Mar 2019 17:15:00 -0400
When updates go wrong, horribly wrong http://www.decryptedtech.com/when-updates-go-wrong-horribly-wrong http://www.decryptedtech.com/when-updates-go-wrong-horribly-wrong When updates go wrong, horribly wrong

When you think about operating system updates you probably do not think about the security team. Sure, there are security patches and such, but those are on the operations team and not really pushed out by the security team. Well, that is when they are done properly by the OS vendor.

The challenge comes when parts of the core operating system are either not properly coded or, as in the case of Microsoft on more than one occasion, properly signed and packaged. In more than one instance over the last few years Microsoft has forgotten to sign a couple of critical dlls in the OS. One of these relates to the DNS subsystem and the other relates to the DCOM subsystem. Both (when not signed) appear to be members of various malware families and can be quarantined by multiple anti-malware applications. Now, here is the scary part; if either of these does get quarantined the OS can have a bit of an issue.

So how does this involve the security team? Well they have to be ready to safelist files, restore files from the quarantine folder or (in extreme cases) identify a version of the files that do not get flagged so that they can be restored to the affected systems. Events like this can become a massive fire-drill if there is no update testing or planning and a nightmare when it is a forced update that you have no chance to test. Having gone through this type of event more than once, I can personally say you do not want to have this happen.

Which brings me to the second part of how this impacts, and involves, the security team. Because this is such a known issue, it can (and has) delayed patches for vulnerabilities to prevent massive outages in the past when the operations team had more control over when updates happened. This means that the security teams have to be more observant in looking for those indications of compromise in the environment. Not having better quality controls around packaged updates leaves environments vulnerable. Windows 10 was supposed to correct that by forcing certain updates without much chance to stop them, this is great until you push out bad updates.

In short, the potential for bad updates creates an excuse to not update to newer operating systems where a bad update might be forced and to not push out all security updates when they should be. I mean as it is. Most corporations do not update just to avoid the downtime associated with them, now add in the potential for massive impact (nothing like all of your servers not booting) and it is a healthy recipe for leaving systems open. I have said it before, and I will probably say it until I die, the security ball is being dropped on the OS and application vendor side in a HUGE way. There is no reason that unsigned code should be used anymore, much less unsigned updates pushed out for critical part of an OS or application. These are mistakes that generate issues and keep things stagnant from a security perspective. It needs to change or we will continue to be an “when, not if” industry.

sean.kalinich@decryptedtech.com (Sean Kalinich) Editorials Mon, 04 Feb 2019 12:07:09 -0500
Leaked emails are the new "IT" when it comes to swaying the debate http://www.decryptedtech.com/leaked-emails-are-the-new-it-when-it-comes-to-swaying-the-debate http://www.decryptedtech.com/leaked-emails-are-the-new-it-when-it-comes-to-swaying-the-debate Leaked emails are the new



sean.kalinich@decryptedtech.com (Sean Kalinich) Editorials Wed, 12 Jul 2017 05:19:00 -0400
New WikiLeaks Vault7 reveals show nothing that is all that new http://www.decryptedtech.com/new-wikileaks-vault7-reveals-show-nothing-that-is-all-that-new http://www.decryptedtech.com/new-wikileaks-vault7-reveals-show-nothing-that-is-all-that-new New WikiLeaks Vault7 reveals show nothing that is all that new

WikiLeaks is at it again with their "Vault 7" releases. This time part of the dump features a nice little took kit for continued exploitation of some Linux systems. The tool kit is called OutlawCountry and is, to be perfectly honest, not much more than a remote management, monitoring and exfiltration tool. It is intended to run in the background on a system after a vulnerability has been exploited to allow the payload to be pushed. It looks very similar to a tool that the NSA used for years and has now become the commercial product Kaseya.

The release of the news prompted some sites to claim that Linux, as a whole, is now at greater risk. The simple truth is that this is not really the case. There is no such thing as a secure OS, but you can make things more difficult for attackers. Both Windows and *nix based systems have vulnerabilities in them that, when left alone, can be a playground for attackers. To the uninitiated securing Linux can be much more difficult, but to the Linux crowd it is just another day to take some basic precautions to prevent all but the most determined attacker from getting into your system.

What I find most interesting is that some of the tricks that Linux users use to lock down their systems can also be turned around in Windows. Locking out service accounts, making system directories read-only, hardening firewall rules (Iptables) can are not specific to Linux. Sadly, most corporations and end users will not take these measures in Windows as it can make your user experience pretty shitty. There is also the nasty issue of third party applications not functioning with the increase security profile.  
Once again, we are back to the fact that third party vendors, and even users can and do have a massive impact on how secure systems are kept. Not how secure they can be, but how secure you are often allowed to get them. The NSA, CIA, and the "bad guys" all are well aware of this and are more than willing to use this to their advantage. The information that WikiLeaks is pushing out is just not all the surprising and does not mean that the Operating Systems we use are any less secure now than they were before the leaks, we are just becoming more aware of the tools that government agencies are using to pull data out of them...

Gives me a warm feeling inside, how about you?

sean.kalinich@decryptedtech.com (Sean Kalinich) Editorials Mon, 03 Jul 2017 08:46:46 -0400
Is HBM a viable technology for GPUs? Yes, Yes it is… just not right now http://www.decryptedtech.com/is-hbm-a-viable-technology-for-gpus-yes-yes-it-is-just-not-right-now http://www.decryptedtech.com/is-hbm-a-viable-technology-for-gpus-yes-yes-it-is-just-not-right-now Is HBM a viable technology for GPUs? Yes, Yes it is… just not right now

Over the last couple of days, we have received information that would indicate nVidia is not moving to HBM 2 for their consumer GPUs (outside of some extremely high-end models). Instead, they appear to be focusing on improvements found in GDDR5X and GDDR6. Conversely, AMD appears to be focusing on HBM for many of their high-end and even some mid-range cards. The two very different paths has sparked something of a debate amongst fans of both products (as you can imagine). The questions are, why chose one over the other at this point and is HBM a truly viable option for AMD?

When AMD made the decision to move to HBM there was a lot of chatter about potential improved performance and how this move would position AMD above nVidia. The reality of this was that while there was a significant performance gain to be had by moving to HBM, AMD was plagued with supply issues which made the card very hard to get. This issue gave nVidia time to respond and to do so without the need to fight through the supply challenges that HBM brings to the table. We saw high-end cards leveraging GDDR5X to pull off some amazing performance although the prices were higher in the end.

AMD for their part fell back to their old stand-by; offer the same or similar performance for a lower price. The logic here seemed to be that it would keep their cards as a lower cost alternative for gaming and for VR/AR vs nVidia while the VR headset makers worked on reducing price. This makes sense on the surface as an AMD based system will cost you much less than an Intel/nVidia one if you are looking for AR. The problem is that AR is just not there yet for most consumers. The prices of the headsets as well as the changing landscape means it is not the driving force in building most PCs. Pure gaming performance is what the majority is looking for at this point.

Now this does not mean there is no market for AMD, quite the opposite in fact. AMD based GPUs when combined with HBM are well positioned for crypto currency mining. They do a great job compared to nVidia and are currently in high demand for people looking to convert PCs into mining machines. Some say that buying these cards is too much of an investment compared to custom ASICs, but AMD is not going to warn potential buyers away from this endeavor.

Now that I have digressed far off of the point, I will try to get back on topic.

HBM as a technology is fantastic. It provides a significant increase in bandwidth over GDDR of any flavor and can increase the overall throughput of data for the right kind of processor. It marries up very well to the highly parallel GPUs from AMD and allows their full potential to be realized. Moving to HBM was and still is a no brainer for AMD…, which is where the challenge is. AMD’s high-end GPUs would probably not do well with GDDR5(X) so they almost have no choice when it comes to memory. nVidia, on the other hand, has options due to their current GPU designs. They can use GDDR5, GRRD5X and GDDR6 to keep high-performing products in consumers’ hands and take advantage of HBM for segments that they want. AMD, currently, does not have that option if they want to remain performance competitive.

As we said last year, HBM supply issues are going to impact adoption of this technology for GPUs and eventually CPUs. Until these are addressed, we would not expect to see wide spread adoption. AMD, on their own, do not generate enough sales pressure to make manufacturers want to fix things just yet. With improvements in Ryzen and the potential gaming impact of Threadripper (with its 64 PCIe 3.0 lanes) things could change as consumers could see the advantage of an all AMD platform. Sadly, those changes would not really have an impact on HBM supply until 2H 2018 at the earliest. Still if AMD can grab some market share from both Intel and nVidia over the next few months, we could see a significant shift in the ecosystem for future AMD GPUs. This in turn will force nVidia to respond and we all win.

sean.kalinich@decryptedtech.com (Sean Kalinich) Editorials Tue, 20 Jun 2017 15:08:58 -0400
Did Intel Repond to Threadripper, or just to Ryzen in General? http://www.decryptedtech.com/did-intel-repond-to-threadripper-or-just-to-ryzen-in-general http://www.decryptedtech.com/did-intel-repond-to-threadripper-or-just-to-ryzen-in-general Did Intel Repond to Threadripper, or just to Ryzen in General?








sean.kalinich@decryptedtech.com (Sean Kalinich) Editorials Wed, 07 Jun 2017 10:34:00 -0400
Where are we now with VR? http://www.decryptedtech.com/where-are-we-now-with-vr http://www.decryptedtech.com/where-are-we-now-with-vr Where are we now with VR?

This is going to be a little bit of a departure from how we would normally approach covering specific technology. Instead of addressing the state of hardware based on what we have actually worked with, we are going to look at VR from the standpoint of a consumer looking to buy for the first time. There are a couple of reasons to do this; the first is that we do not have either an Oculus Rift, HTC Vive or any other PC based VR technology. We do have the Oculus powered Gear VR, but that is in a category all on its own which we will cover in some detail below.  So with the preface out of the way, let’s get started

VR has been “out” and available for a little while now with more companies jumping on the bandwagon each month. We have heard that Computex had a number of new VR products that were shown off making the market even deeper. However, no matter how deep the pool is there will always be a few products that will rise to the surface. In this case the two major, PC based, products that have risen to the top are the Oculus Rift and the HTC Vive. Yes, there are others, but these two seem to be the ones most talked about so we will be taking our look at these two.

Compelling features:
Finding the compelling features of a product is not always an easy thing to do. Most of the time the reasoning behind a purchase is very subjective. There is an old phrase; “if you think it is a good deal, then it is”. This pretty much sums up almost every technology purchase. If you want to buy a product, I mean really want to buy it, then you will find the reasons to buy it (think Smart Phones). With a newer technology like VR these preset ideas are usually not built in like they would be for other forms of technology. The fan boys have not had the time to gather and sniff things out. Mostly this is due to adoption costs, but can also be due to a genuine lack of information about the products themselves. Online articles boasting of the virtues of VR and in-store demos are just not enough for most consumers. They cannot see the compelling reason to fork over a ton of money (which we cover below)… yet. The amount of real world information is in short supply so VR companies are taking an interesting path to getting the word out. I like to call this near-VR.

Here is where we talk about the GearVR and all of the other near-VR products like it. These products take your smartphone and turn it into a VR system. You do not have the computing or graphical power of a PC or even a gaming console, but you can get small-scale near-VR games and applications that give you a taste of what it possible with VR. This taste of VR is one of the reasons that Oculus invested in the Gear VR system. By giving people a small taste of VR you get them to want more and to wonder what they could do with the next step up. Samsung themselves made a very smart move with their S8 Launch when they gave away a Gear VR with controller to anyone that pre-ordered an S8 phone. Not only did they increase potential sales, but also they now have a large number of people that will be exposed to the wonders of VR. There are challenges with the Gear VR and controller including losing track of the controller due to Bluetooth issues (or power saving), head tracking issues, comfort, and audio irregularities amongst others. These challenges (and the cost of some apps) will put a few people off, but many more will crave an improved solution. To be honest, this is what happened to me. I find the Gear VR clunky and problematic, but I can see the potential and wonder what some of my favorite games would look like in VR. I started looking into it almost immediately… and hit the big bad wall of the massive cost of getting into full PC based VR.

When we have asked about VR and if people are looking into it, one of the biggest issues is simply cost. Right now, the Oculus Rift will set you back between $500 and $600 while the HTC Vive will put an $800 or so dent in your budget. These costs are just for the VR headsets and accessories themselves, we have not even gotten into back-end costs. This is a significant amount of money for the average consumer (it is a significant cost for us as well) to purchase a new technology that has some high performance requirements.

However, with both the Oculus and the Vive there are back end costs that will affect you VR budget as well. Both devices require a powerful GPU to run them. With the Vive the minimum requirement is an nVidia GTX 970 or Radeon R9 480 just to push the graphical environment. For the Oculus the minimum is listed as an nVidia GTX 960. These GPUs are not cheap with the GTX 960 popping up online around $250.  Just the GPU requirements alone can significantly increase the cost of getting VR into your environment and these are the minimums. Recommended requirements push the GPU costs up into the $400 range.

To add more into this, the low cost of the Oculus is, in part, because it only ships with a standard Xbox One controller and not a set of hand controllers like the Vive has. If you want to get hand controllers, you will need to drop another $100.

The funny thing is that these two products are the more reasonable priced products on the market. The Microsoft HoloLens (pre-sale developer edition) costs $3000, although it is fully self-contained and does not require a PC.  It is not hard to see where a major roadblock to VR adoption by the mainstream is even with the near-VR products.

Lack of applications and software:
This last piece is just a simple fact of life with a new technology. There are not all that many games, and applications that are ready for VR… well let me rephrase that; there are not that many good games and apps that are ready for VR. In looking through the catalog of apps and games for the Gear VR there are a good number of them, but most are boring and are not going to hold much interest for the price the developer is asking. Do you want to spend $10-20 on a game that does not have a good presentation or looks bad?  Most people are not going to do that and they are certainly not going to drop $800+ on a solution on the hopes that they can find a few good games to play in VR.

VR is a cool technology with a lot of potential. Sadly, no one has really tapped that potential in a compelling or meaningful way. The tech is great and even looks great, but it is too expensive, lacks a good ecosystem of games and apps and there is nothing really compelling about it other than it is cool. We have said this before and we will say it again, until someone comes out with a killer application, VR will remain a niche product with a ton of untapped potential. We do fully expect someone to do so, just not in the very near future. Unless I miss my mark, I will say that VR will not gain market acceptance until the cost of VR ready GPUs and the headsets themselves drop in price. The earliest we can see this happening is in 2H 2018, but it could be much longer than that.

sean.kalinich@decryptedtech.com (Sean Kalinich) Editorials Thu, 01 Jun 2017 15:50:54 -0400