Comments

Who? • January 12, 2018 4:16 PM

This one, in my humble opinion, is not exactly a security flaw—it is the way Intel ME firmware is expected to work and the very reason its password must be never left at its default value. It is the reason BIOS setup must be password protected too.

https://arstechnica.com/information-technology/2018/01/researcher-finds-another-security-flaw-in-intel-management-firmware/

What comes next? The fact that disabling and re-enabling AMT in BIOS resets the password to its default (“admin”) value, allowing anyone with access to the BIOS setup to exploit the “security flaw” found by F-Secure?

echo • January 12, 2018 4:25 PM

Microsoft is adding the Signal protocol to Skype but is sitting on the fence by not enabling encryption by default. While still collecting metadata and making users who enable encryption stand out this isn’t properly embracing user security.

https://yro.slashdot.org/story/18/01/11/1848206/microsoft-partners-with-signal-to-bring-end-to-end-encryption-to-skype

Microsoft earlier backed always mobile connected computers.

http://www.idownloadblog.com/2017/05/31/microsoft-always-connected-pcs/

Future phones will have their FM chip enabled.

https://hardware.slashdot.org/story/18/01/10/2246225/future-samsung-phones-will-have-a-working-fm-radio-chip

@who?

Thanks for the Intel ME warning. I’m still making sense of my laptops. They are fully patched and Intel ME is switched off. This is another item on my to-do list.

Who? • January 12, 2018 4:50 PM

@ echo

Intel ME is a worrisome technology. At first I though it was just a badly coded remote management technology intended to please big corporations, that was probably being exploited by the intelligence community as a consequence of its multiple bugs. In the last days I learned how much despise Intel has to its customers (e.g., releasing the Coffee Lake microarchitecture they knew was vulnerable) so I would not be surprised this technology is a full-featured backdoor to the microphone, camera, disk, memory and other devices into our computers.

The best you can do is sealing it as much as you can, so it cannot be configured (either remotely or locally) and filtering/isolating it if it is possible. Leaving it unconfigured (i.e. with default password enabled) seems dangerous, at least if your UEFI firmware setup does not allow you to block the keyboard access to Option ROMs while booting.

Who? • January 12, 2018 4:57 PM

@ echo

However, even if your BIOS/UEFI setup allows blocking keyboard access to Option ROMs during boot, and the setup itself is password-protected, leaving Intel ME unconfigured is dangerous as this management technology can be remotely configured by using the right digital certificates.

Anonymous2b • January 12, 2018 4:58 PM

@gordo and others interested in the political process regarding Section 702 re-authorization

“Click the link at the bottom of the page to email your Senator today and tell them to oppose bill S. 139.”

[…]

“S. 139 now heads to the Senate, which we expect to vote by January 19. The Senate has already considered stronger bills to rein in NSA surveillance, and we call on the Senate to reject this terrible bill coming out of the House.”

https://www.eff.org/deeplinks/2018/01/house-fails-protect-americans-unconstitutional-nsa-surveillance

albert • January 12, 2018 5:03 PM

“…“The Army faces a complex and challenging environment where the expanding distribution of cyberspace and EMS [electromagnetic spectrum] technologies will continue to narrow the combat power advantage that the Army has had over potential adversaries.”…”

From “The U.S. Army Concept for Cyberspace and Electronic Warfare Operations 2025-2040”

https://fas.org/irp/doddir/army/tp525-8-6.pdf?utm_source=Secrecy+News&utm_campaign=f7d210f40f-EMAIL_CAMPAIGN_2018_01_12&utm_medium=email&utm_term=0_654cfcc056-f7d210f40f-

Though generic in overview, it appears that the Army has an accurate understanding of the issues concerning Electronic Warfare and vulnerability of hardware/software in the CyberSpace arena.

. .. . .. — ….

Anonymous2c • January 12, 2018 5:39 PM

Does it even matter to write US Senators about the reauthorization of Section 702?

For example, regarding the debate in Congress over the reauthorization of the Patriot Act in 2005:

… “While I [Risen] was on book leave, Lichtblau was in an agonizing position. Barred by his editors from working on the NSA story, he was instead assigned to cover the debate in Congress over the reauthorization of the Patriot Act. But Lichtblau knew that the debate over how to strike the proper balance between national security and civil liberties was a charade so long as the existence of the NSA’s domestic spying program was hidden from public view. The White House allowed Congress to publicly debate the balance, even while George W. Bush had already secretly decided what that balance would be. “Knowing about the NSA program, I found it increasingly awkward to write about all the back-and-forth haranguing with a straight face,” Lichtblau later wrote in his 2008 book, “Bush’s Law: The Remaking of American Justice.” “After getting back to the office from one congressional hearing that I covered on the Patriot Act that spring of 2005, I walked straight over to Rebecca Corbett’s desk in frustration to suggest that maybe someone else should cover the whole debate in Congress; in light of what we knew, I told her, I no longer felt comfortable covering what seemed a bit like a Washington game of three-card monte. … I was stuck on the story.”

While covering one congressional hearing, Lichtblau listened as Harman called for tighter restrictions on the Patriot Act to prevent abuses of civil liberties. Lichtblau knew that Harman had been briefed on the NSA program and had called the Times to kill our story, so he followed her out into the hall to talk about it. But when he asked her how she could square her demands for limits on the Patriot Act with what she knew about the NSA program, Harman chided him for raising the matter. “Shooing away her aides, she grabbed me by the arm and drew me a few feet away to a more remote section of the Capitol corridor,” he wrote in his book. “‘You should not be talking about that here,’ she scolded me in a whisper. ‘They don’t even know about that,’ she said, gesturing to her aides, who were now looking on at the conversation with obvious befuddlement. ‘The Times did the right thing by not publishing that story.’”” …
https://theintercept.com/2018/01/03/my-life-as-a-new-york-times-reporter-in-the-shadow-of-the-war-on-terror/

echo • January 12, 2018 6:00 PM

The Shadow Factory is a play dramatising the experiences of a community playing its role in preparing for resistance in a frightening time.

https://www.brianmay.com/brian/brianssb/brianssbjan18a.html#04

Southampton is home to our only hope of victory: the Spitfire. But when the Luftwaffe drops 2,300 bombs in three devastating raids, the city goes up in flames and the Woolston Supermarine Spitfire factory is destroyed. From the ashes, a story of chaos, courage and community spirit emerges.

https://en.wikipedia.org/wiki/British_shadow_factories

Anonymous2c • January 12, 2018 6:20 PM

I am currently re-considering my web browsing habits. To KISS I tend to boot live CDs or DVDs. Thus defaults matter (minimal tweaking). Is it wise to try to use current live media; for example updated for current Meltdown and Spectre vulnerabilities, when available?

Questions:

1) Has anyone tried booting the Knoppix 8.1 DVD “toram”? Any success or how much ram did you have? I assume it is better to use the DVD than a Knoppix CD that hasn’t been updated for years.

2) When using free Wi-FI hotspots, does it make sense to enable DNSCrypt (an option with live CD TENS formally lps)?

3) Two good things about Tails are its’ frequent updates and documentation. But if I want to use Tails for its’ Unsafe Browser I assume I may attracting extra scrutiny regardless when surfing the web. Are there ways to maybe decrease extra scrutiny when using Tails if all you want to use it for is its’ Unsafe Browser. For example, not randomize Mac address.

4) Is it worth considering VPNs? KISS says don’t bother.

5) Any ideas?

A list of live media
https://en.wikipedia.org/wiki/List_of_live_CDs

An incomplete comparison of live media
https://en.wikipedia.org/wiki/Comparison_of_Linux_distributions#Live_media

hmm • January 12, 2018 8:09 PM

Donald Trump claimed he didn’t say something today. This is what we’re reduced to.

Sitting Senators with a relatively (comparably amazing) good track record for veritas said, wait for it, that Trump is basically a ridiculous anything-goes fantasy enthusiast who will say anything for perceived momentary expediency. He apparently stayed up all night texting people asking them what they thought of the thing he didn’t say.

As if we needed another example of it, but dishonesty is.. reasonably provable here.
Per definition of reasonable. Naturally.

Sitting Republicans are refusing to acknowledge what was said, claiming specific forgetfulness.
A DOZEN elected officials are pretending their memory is sub-1-day for specific racist POTUS quotes.

So that was interesting politically, it might have been a powederkeg 10 years ago. Now? A footnote.

In the same day our new potential nuclear “enemy” North Korea’s leader was said to “probably” have a “very good” relationship with the same sitting, lying US President, you know without mentioning the whole nuclear detente and sea of fire and impending regime decapitation thing.

Now I don’t want to hearken back to a day of hiding under desks, but at one point we relied on the fear of nuclear hellfire to prevent same. As it turns out, similar mechanics are at play today. The only reason you aren’t somewhere around 2000 degrees is the fear of insane imperial retribution, backed up by the cold resolve and stoic demeanor to deliver it. Which implies honesty, or at least a competent bluff.

We are at the point where that bluff has been fully removed, Oz is a man behind a curtain, and he’s kind of a f*cking moron, liar, racist, and now he’s still pretending to be Oz as we see him speaking into the microphone.

It’s time, scarecrows, lions. Even the dog gets it.

Mike Barno • January 12, 2018 8:25 PM

In one of @ Bruce Schneier’s books, he discusses the use of language taboos as one of the ways that societies enforce community values.

One of these has been shattered in the USA, and perhaps around the world.

Thanks to Potus45, serious journalistic media now have to use the word ‘shitholes’ in their ledes and chirons.

Commander Covfefe wins another bet!

Mike Barno • January 12, 2018 8:32 PM

Sorry, I rechecked, no official transcript is available but the consensus seems to be “shithole countries”. No “s” after the hole.

65535 • January 13, 2018 12:54 AM

@ Who

“…even if your BIOS/UEFI setup allows blocking keyboard access to Option ROMs during boot, and the setup itself is password-protected, leaving Intel ME unconfigured is dangerous as this management technology can be remotely configured by using the right digital certificates.”-Who

Can you explain the fix you recommend. I did not quite see any solution that you indicated would work without disabling UEFI. I am somewhat at a loss.

I did read the Arstechnica article and watch the YouTube video with the Fsecure guy. I got the impression the Fsecure guy said to disable ME/AMT altogether.

I look at the new Intel alert and say it basically said to look at the Mitigations for security vulnerability documented in INTEL-SA-00075 May 1, 2017. Here are the main steps listed [for large organization there is a script]:

[Intel]

“The procedural steps for implementing the mitigation are as follows:
1. Unprovisioning Intel manageability SKU clients to mitigate unprivileged network attacker from gaining system privileges
2. Disabling or removing the Local Manageability Service (LMS) to mitigate unprivileged local attacker from gaining system privileges
3. Optionally configuring local manageability configuration restrictions”

From what I can see this also entails disabling UEFI because of the possibility of Out of Band network hacks which then change the ME to be suspetible to a veriety of attacks.

Are you recommending a ME supervisor password change to mitigate an “evil maid” style of attack where the computer is tamper’d or the UEFI is reset by an individual with physical access? How do you do this- just a password change?

tyr • January 13, 2018 2:10 AM

@hmm

The Rus are already holding hiding under desk
drills. They can see what is going on around
them quite clearly.
What I found equally interesting is their new
use of nuclear weapons strategy. The old days
of MAD no longer apply and there is no safety
to screw around with them. Retards who think
they can get away with ‘cold war’ crap need to
update their thinking and stop pretending that
they can turn the clock back to the 1950s. We
already did that one and as Heraclitus said
you cannot step into the same river twice.

What is amazing is the fools who think that the
USSR collapsed because communism didn’t work.
Their failure was central planning practices
and those would collapse a capitalist society
just as surely.

One thing is certain a nuclear winter after an
exchange of missles will end the whining about
disappearing glaciation the same way Krakatoa
took down civilization in the 530s beginning a
400 year dark ages.

We had a much better drill than duck and cover
when I was a kid. In the event of nuclear war
bend over grab your ankles and kiss your ass
goodbye.

Wesley Parish • January 13, 2018 3:53 AM

I was unsure about the appropriateness of referring to this, but since the 45th President of the United States has already been referred to in this forum, here goes:

Citing ‘Reasonable’ Concerns, Health Experts Say Trump Physical Should Include Neurological Exam
ht tps://www.commondreams.org/news/2018/01/12/citing-reasonable-concerns-health-experts-say-trump-physical-should-include

They go on to cite “increasing concern” about Trump’s mental capacity, including his

Declining faculties for complex thought, rambling speech, difficulty completing a thought;
Episodes of slurred speech;
Failure to recognize old friends;
Frequent repetition of the same concepts;
Decreased fine motor coordination;
Difficulties reading, listening, and comprehending;
Suspect judgment, planning, problem solving, and impulse control;
Markedly declining vocabulary in recent years, with over-reliance on superlatives.

Fair enough. Professional Armed Forces don’t take known psychopaths.

Did I miss something? • January 13, 2018 6:17 AM

I find myself rererereading this, scouring for comprehensive tidbits of speculative hints.

They can’t mean resorting back to header analysis, it’s gotta be the underlying encrypted data streams/packets are predictable or reliably so?

keiner • January 13, 2018 6:25 AM

definitely missed something:

It’s the concept: stare at the data with zero brain activity to find the pattern…

Try it! Works reliably! 🙂

Rachel • January 13, 2018 6:42 AM

Tyr JG4 Clive

having mused over a variety of your comments on comparable themes
Merged with my incomprehension of the practice of self identifying within narrow, limited yet all encompassing parameters ( for example Liberal Left, Alt-Right etc.)
what about a new paradigm.
those in public office are subject to a qualitative Human Being rating to replace their label of political inclinations. Thus rating would be comprised if both ones actual actions and consequences of policy- countering short term memory syndrome. And – public perception of their Human Being rating.
The other rule is that one cannot self designate ones Human Being rating. It can only be imposed externally calculated by the above components. Note, it is a qualitative rating determined by algos. Not a strictly linear quantative figure.
Blockchain tech creates an indelible public record of the above accounting. Finally putting the tech to good use.

Sheila • January 13, 2018 6:49 AM

My read no dude food.

We’re all going to hell in a hand-basket anyway, wasting away in front of screens. The body now that fat is the norm, is irrelevant. And dude anyway, there are surgeries and pharmaceuticals to fix what’s ailing you; and then of course there’s the pollution and Trump and tsunamis, and no I’m not afraid; and yeah what about robots and genetics stuff, I’m not worried. So just live it up. Scarf.

Who? • January 13, 2018 7:24 AM

@echo, @65535

Evdokimov practical advice for those impacted by the AMT vulnerability is simple, “just un-configure it via disabling AMT in the BIOS setup.”

Disabling AMT in the BIOS setup and leaving it this way may, or may not, work; I am not really sure Intel ME/AMT is truly disabled. I understand “unprovisioned and off” (or even “unprovisioned and permanently off”) should work as expected but, then, why is there a hidden flag to meet NSA’s HAP requirements? Just ask for Intel AMT being permanently disabled in the BIOS setup when ordering a new batch of computers!

The most dangerous thing you can do, however, is just un-configuring it:

https://software.intel.com/en-us/articles/remote-configuration-for-intel-amt

In the unconfigured state it can be provisioned from a remote location using a digital certificate (note the management engine itself includes a lot of root certificates by default).

Sadly I have no good advice about disabling AMT. I would say no one outside Intel really knows how the management engine works, what does it do and how can it be effectively stopped. My advice is:

  1. If possible, installing a NIC not supported by Intel ME on the computer and using it to talk to the world instead of the on-board Ethernet port (or Wi-Fi card) that comes with the computer.
  2. Setting up an external (hardware) firewall to protect the network. This firewall should strictly (i.e., “block all” by default) filter both ingress and egress traffic. A software firewall on the computer that has the management engine does not work, as Intel ME has full access to supported NICs and sits between the network card and the operating system network drivers.

About “disabling UEFI” I suspect it is not possible. Right now you can just enable a “legacy” compatibility layer and an optional Compatibility Support Module (CSM), but UEFI itself remains on your computer. This feature will be dropped in two years, as soon as the “UEFI class 2” specification is withdrawn. So do not count on it.

You can, however, disable the IPv4 and IPv6 network stacks on the UEFI firmware (if your setup program allows it), the UEFI capsule firmware updates (so no one can send you a bad firmware update through your operating system) and any other sort of “remote management” feature.

As an additional security layer I have AMT configured, to avoid remote provisioning or even local provisioning by means of USB drives. If possible, listening interfaces are on an isolated network (Internet access is done over a NIC not supported by Intel ME). If not possible, I use a hardware firewall. I restrict traffic allowed to each computer on my network (e.g., http/https traffic is allowed only from one computer on some sort of DMZ), domain, ntp and ssh are allowed from/to other computers. AMT running on an isolated network (obviously we cannot use the term “airgapped” here) may be useful, but it should be never exposed to the [more dangerous than ever] Internet.

z80 • January 13, 2018 7:56 AM

Lenovo does an internal audit of it’s RackSwitch and BladeCenter switches (previously Nortel) and discovers a backdoor called “HP backdoor” from around 2004.

Quote: A source code revision history audit revealed that this authentication bypass mechanism was added in 2004 when ENOS was owned by Nortel’s Blade Server Switch Business Unit (BSSBU). The mechanism was authorized by Nortel and added at the request of a BSSBU OEM customer.

https://support.lenovo.com/de/en/product_security/len-16095

z80 • January 13, 2018 8:09 AM

“What Really Happened with Vista: An Insider’s Retrospective”.
Article about the development of Vista and the SnakeOil industry.

Quote: Our “friends”, the antivirus vendors, turned around and sued us, claiming we were blocking their livelihood and abusing our monopoly power! With friends like that, who needs enemies? They just wanted their old solutions to keep working even if that meant reducing the security of our mutual customer – the very thing they were supposed to be improving.

https://benbobsworld.blogspot.de/2017/06/what-really-happened-with-vista.html

JG4 • January 13, 2018 9:02 AM

I’ve probably commented before on the gifted writer, Bill Bonner, who wrote Financial Reckoning Day. In that book, he tells the story that one of Napoleon’s lieutenants got down on his knees and begged Napoleon not to invade Russia. The Nazis made a similar mistake and also were defeated by winter.

Two of the outcomes of Napoleon’s leadership were the canning process for food preservation and the multidimensional graph showing troop numbers as a function of time and location. That graph is a sobering reminder of the perils of military adventure. Someone linked it long ago and I probably relinked it.

@tyr – I’ve mentioned The Great Frost before, which makes the Potato Genocide look like a walk in the park. There also was “The Year Without a Summer” Thanks for pointing out the contribution of a volcanic eruption to the Dark Ages. These events put a heavy premium on food and energy stores.

https://en.wikipedia.org/wiki/Irish_Famine_(1740–41)

https://stairnaheireann.net/2015/11/02/bliain-an-air-year-of-slaughter-irish-famine-of-1740-1741/

https://en.wikipedia.org/wiki/Year_Without_a_Summer

https://en.wikipedia.org/wiki/Extreme_weather_events_of_535%E2%80%93536

My thinking on politics was stimulated by an essay that Jim Kunstler (speaking of energy) wrote many years ago about how the Democrats are the Mommy party and the Republicans are the Daddy party, as exemplied by Dick Cheney, who was a serious businessman. Kunstler (the translation is artist) had an example of someone nurturing among the ranks of the Democrats. Bernie Sanders would do. Those two impulses, to nurture the group/members and to take care of business, are present in most people. Which one dominates an individual’s thinking could influence which party they join. My favorite of Kunstler’s columns is “Two Peckerheads, which is well worth a few minutes. It may be the highest example of his snap, crackle and pop. We could guess that quirks of culture, genetics, epigenetics and experience would produce different value systems in each person. Psychopths and sociopaths are just special cases, and almost everyone is capable of sociopathic behavior toward the outgroup, which is shorthand for any neighboring tribe that we don’t like. My thinking about politics was further stimulated by Doug Casey in a story about how Democrats and Republicans, given the chance, would leave each other freezing in the rain. I’ve linked it before. It’s a short step from tribalism to the ingroup vs. outgroup and blameshifting. That was part of the Nazi consolidation of power. I linked some of this guy’s brilliant work before.

http://slatestarcodex.com/2014/09/30/i-can-tolerate-anything-except-the-outgroup/

I mentioned compelling “specific performance,” which is an important legal term of art. Blockchain arguably is a kinder and gentler approach to compelling performance than wearable guilliotines. The problem with politicians, other than their inability to say “conflict of interest,” is that they say one thing and do another. If there were a way, e.g., using the blockchain, to compell performance, that would be very valuable. The deeper problem is the difficulty of predicting the future effect of present action. That creates an opportunity for politicians to arbitrage the tradeoffs, or as some might call it, “strip-mine the future.” From quarks to galaxies, dollars to donuts, neurochemistry to politics, it’s all transfer functions, always and everywhere, all the way up and down the scales of time, distance, and networks.

here’s what I picked up yesterday. there actually were a lot of interesting headlines beyond these, but I am trying to be a good netizen and color inside the lines.

https://www.nakedcapitalism.com/2018/01/links-11218.html
…
Meltdown and Spectre

Intel’s telling some customers to avoid its fix for the Spectre and Meltdown attacks — because of a big bug Business Insider (David L)

Here’s how, and why, the Spectre and Meltdown patches will hurt performance ars technica

Keeping Spectre secret The Verge

[…When national security interests trump your health security interests.]

170 Million in U.S. Drink Radioactive Tap Water. Trump Nominee Faked Data to Hide Cancer Risk EWG (WM)

…

Public • January 13, 2018 9:47 AM

@ Rachel

<

blockquote>public perception of their Human Being rating.

say -v Humanoid “Good Heavens! I am going to be run by human disguised as a robot”

Rex Rollman • January 13, 2018 11:45 AM

“Intel ME is a worrisome technology.”

Indeed. While Intel ME has a valid use, preventing people from turning it off has basically turned it into a mandatory backdoor. The only thing I can’t figure out is if Intel is just this arrogant or if they are doing it at the behest of the government.

just wondering 33 • January 13, 2018 3:12 PM

@Who, 65535, echo

Can you tell from Intel’s spec sheets if AMT, ME, or whatever, is a problem for a specific Apple model? If so what should you look for? Or is there a way to check Apple’s literature? There are a lot of old (2012) Macbook Pros, with DVD and with straight forward ram upgrades to 16 GB, with specs like this:

“Advanced Technologies

Intel® Turbo Boost Technology ‡ 2.0
Intel® vPro™ Technology ‡ No
Intel® Hyper-Threading Technology ‡ Yes
Intel® Virtualization Technology (VT-x) ‡ Yes
Intel® Virtualization Technology for Directed I/O (VT-d) ‡ Yes
Intel® VT-x with Extended Page Tables (EPT) ‡ Yes
Intel® 64 ‡ Yes
Instruction Set 64-bit
Instruction Set Extensions Intel® AVX
Intel® My WiFi Technology Yes
4G WiMAX Wireless Technology Yes
Idle States Yes
Enhanced Intel SpeedStep® Technology Yes
Intel® Demand Based Switching No
Thermal Monitoring Technologies Yes
Intel® Fast Memory Access Yes
Intel® Flex Memory Access Yes
Intel® Identity Protection Technology ‡ Yes

Security & Reliability

Intel® AES New Instructions Yes
Secure Key Yes
Intel® Trusted Execution Technology ‡ No
Execute Disable Bit ‡ Yes
Anti-Theft Technology Yes"

https://ark.intel.com/products/65708
https://en.wikipedia.org/wiki/Intel_Core_i5

65535 • January 13, 2018 3:15 PM

@echo and Who?

“Evdokimov emphasizes the vulnerability is not associated with a remote code execution… Evdokimov emphasized the flaw Embedi researchers found was a logical vulnerability, details of which he also could not disclose… the vulnerability impacts only Intel PCs, laptops and servers with the enabled Intel AMT feature turned on…He said the vulnerability could allow an attacker to gain a remote access to AMT services such as the keyboard, video and mouse (KVM), IDE Redirection, Serial over LAN and BIOS setup and editing… the researcher wrote about the “backdoor” capabilities of Intel ME subsystem (access to DRAM, out-of-band access to a network interface and other administration and control capabilities used by Intel AMT technology). It is scary to have this subsystem inside each computer system, but it is unrelated.”-The threat post

[comments]

“For the rise in traffic to ports 16992 and 16993 over the past few months — what were the sources and destinations?” -The threat post

This clears up some of the details. There are two different flaws, one local and one remote. I also see the above commenter has two of the correct ME/AMT ports which it uses [there are 6 known ports].

As I understand the 3 steps of disabling ME/AMT you not only Unprovisioning the ME engine you tear out the Local Manageability Service, plug ports: 16992, 16993, 16994, 16995, 623, and 664:

“1. Unprovisioning Intel manageability SKU clients to mitigate unprivileged network attacker from gaining system privileges
2. Disabling or removing the Local Manageability Service (LMS) to mitigate unprivileged local attacker from gaining system privileges
3. Optionally configuring local manageability configuration restrictions” -Intel

“You can confirm the Local Management Service (LMS) and variants of it like MicroLMS are properly disabled by confirming there is no socket listening on the Intel® ME Internet Assigned Names Authority (IANA) ports on the client: 16992, 16993, 16994, 16995, 623, and 664.ME… is an application listening on the Intel® ME IANA ports: netstat -na | findstr “\<16993> \<16992> \<16994> \<16995> \<623> \<664>” -Intel

ht tps://www.intel.com/content/dam/support/us/en/documents/technologies/intel-active-management-technology-intel-amt/intc-sa-00075_mitigation_guide-r1.2.pdf

Now, to the problem of the UEFI shell with semi-browser capabilities problem. Most of my clients complain that they to understand or want the UEFI Sub-system below their OS. It is configured by each board manufacture with ME/AMT on or possibly off and probably has undocumented calls to the mothership. Most diagrams place it right under the OS but I suspect it is lower – say close to the bios level because is can control the boot sequence, passwords, and number of passwords before lockup of secure boot. That is just a guess.

“The most dangerous thing you can do, however, is just un-configuring it: ht tps://software.intel.com/en-us/articles/remote-configuration-for-intel-amt …In the unconfigured state it can be provisioned from a remote location using a digital certificate (note the management engine itself includes a lot of root certificates by default)…Sadly I have no good advice about disabling AMT.”-Who?

As you note the Compatibility Support Mode could possibly allow parts of the UEFI to still operate. But, last year I visited clients about this problem and opened the Bios/UEFI and unprovisioned the ME using as the “AMT Configuration Utility”, removed the Local Management Service with difficulty, plugged the various ports and disabled the UEFI leaving only legacy BIOS mode running with the Compatibility Support Module for various OS which don’t support UEFI. Then I ran the Intel Detection Tool and found the machines were no longer “affected”.

After several of those operations, I simply tested disabling the UEFI sub-system and then ran the Intel Detection Tool to only find that the system was not “Affected”. That was a head scratcher. I started to investigate.

The Local Management Service is the current problem but the windows shops I support use AD and can tighten down who can reboot machines which seems to be necessary for the current attack where the evil maid or co-worker re-provisions or reinstalls the necessary components and opens the ports to allow remote execution and control of the machine.

Thus, I gathered from the Threat post article that only certain years and chip builds are affected – then I realized that those years corresponded with the wide spread implementation of UEFI and secure boot.

I am guessing that ME/AMT uses the UEFI shell for out of band communications before reaching the OS. If you remove that sub-structure many problem go away. I will stay I am not sure exactly how safe UEFI disabling is.

Also, I used to work on machines or a large company that used the DB/DE 9 port with a converter to an RJ45 jack for out of band management. That was in 2004 to 2005 range. So, this ME/AMT problem maybe wider than what is published in the press – sure you had to get extra code from Intel to make it work but it did work.

To summarize my fix:
1] Complete the 3 steps in INTEL-SA-00075 Mitigation Guide
2] Disable the UEFI and only use BIOS even with compatibility mode
3] Run the Intel Detection Tool to validate saftey

This is not a perfect solution. If any of you have better solutions please give me the details.

[to prevent auto-run all the above URLs are fractured]

Next, is the Meltdown and Spectre attacks. I have seen fairly good documentation on Meltdown but thin documentation on Spectre. Because of that I cannot determin the dangers. I will leave that to others.

65535 • January 13, 2018 3:31 PM

@ just wondering 33

“Can you tell from Intel’s spec sheets if AMT, ME, or whatever, is a problem for a specific Apple model?”

Not me.

Very few of the Windows shops I service use Apple products. I know the Apple “ecosystem” pushed out a patch for some machines.

If there are any Apple experts on this board please speak up.

hooodathunkit • January 13, 2018 4:04 PM

@tyr “Their failure was central planning practices and those would collapse a capitalist society just as surely.”
Capitalism is characterized by (wait for it!) little or no central planning.

@JG4, @Bauke Jan Douma
You are searching for the genius Charles-Joseph Minard, French civil engineer and 1800s developer of infographics; whose best known work is Carte figurative des pertes successives en hommes de l’Armée Française dans la campagne de Russie 1812-1813. An overview of his other works is a delight as well.

hmm • January 13, 2018 4:15 PM

“The only thing I can’t figure out is if Intel is just this arrogant or if they are doing it at the behest of the government.”

Or a combination…

just wondering 33 • January 13, 2018 4:28 PM

@65535

For Apple supported hardware for security updates, Meltdown and Spectre are discussed in updates between 6 December and 8 January.
https://support.apple.com/en-us/HT201222

You wrote “Very few of the Windows shops I service use Apple products. I know the Apple “ecosystem” pushed out a patch for some machines.”

Since Apple pushed patches for Meltdown and Spectre does that answer the questions above?

Apple has made it fairly straight forward to check that recent MacIntoshes are running the most up to date firmware.
“EFI check
A new security tool called “eficheck” that ships with High Sierra runs a weekly under-the-hood checkup, checking your system firmware against a list of “known good” firmware and making sure it hasn’t been modified. Most Mac users will never see any evidence that it’s running or doing anything. If the tool does detect something fishy, you’ll see a nondescript warning dialog asking you to send a report to Apple, which may help the company diagnose the problem and come up with a fix (in a series of deleted tweets, one of the tool’s creators encouraged users to do this if you ever see the popup, but specifically told Hackintosh users not to bother).”
https://arstechnica.com/gadgets/2017/09/macos-10-13-high-sierra-the-ars-technica-review/9/#h6

https://mobile.twitter.com/XenoKovah
https://eclecticlight.co/2017/09/24/high-sierra-automatically-checks-efi-firmware-each-week/
https://arstechnica.com/information-technology/2017/09/an-alarming-number-of-macs-remain-vulnerable-to-stealthy-firmware-hacks/

Hackintosh link
https://arstechnica.com/gadgets/2017/05/hackintoshes-keep-giving-apples-frustrated-pros-a-place-to-go/ ; this link is sort of fun to read and for looking at photos

Alejandro • January 13, 2018 6:00 PM

In case you haven’t seen it, Intel has a statement out on the ME/Meltdown/Spectre issues:

“Intel® Management Engine Critical Firmware Update (Intel-SA-00086”

A tool is available for Linux and Windows machines to see if your device is vulnerable:

https://www.intel.com/content/www/us/en/support/articles/000025619/software.html

Tool download at:

https://downloadcenter.intel.com/download/27150?v=t

My windows machines were not vulnerable. I assume that’s because I did the most recent Windows update(s) which fixed Windows, (but not the CPU or it’s firmware).

I read elsewhere it’s quite impossible for mere mortals to disable the Intel ME. Apparently a few wizards have tackled the issue and came up with something, but it’s contorted and really hard to do.

Anura • January 13, 2018 6:21 PM

@hooodathunkit

Capitalism is characterized by (wait for it!) little or no central planning.

Capitalism is characterized by the property ownership rules, and the incentive created by those rules leads to greater centralization of wealth; without government intervention, it just leads to a centrally-planned economy. The Soviet Union was, in a sense, just state capitalism.

Socialism is not, however, characterized by central planning – most socialists generally seek a decentralized economy in my experience. Communism, in its truest form, is a form of anarchism (stateless, moneyless economy based on voluntary association and direct democratic control of resources).

Centralization of wealth and decision making is a huge problem, whether in the US or the former USSR.

echo • January 13, 2018 6:25 PM

I’m still sussing my laptops but firmware is patched and Intel AMT is switched off and no Intel tools etcetera are installed in the OS. (I’m slowly getting around to patching AMT too.) I also have user updateable firmware switched off. Apart from this I’m an ordinary user and won’t be using them in a concrete bunker. (I have installed 3G modems too!)

The downloadable tool said I wasn’t vulnerable either. I felt it best to patch to move past this vulnerability anyway.

I won’t be installing patches to remove this firmware but they are obtainable here:

https://www.theregister.co.uk/2017/12/06/intel_management_engine_pwned_by_buffer_overflow/

Dai Zovi observed that in addition to these vendor options, “the security community has responded to distrust of the ME by developing a number of open source projects to disable it,” such as me_cleaner and Heads.

https://github.com/corna/me_cleaner
https://trmm.net/Heads

65535 • January 13, 2018 7:11 PM

@ Who?

“I understand “unprovisioned and off” (or even “unprovisioned and permanently off”) should work as expected but, then, why is there a hidden flag to meet NSA’s HAP requirements?”-Who

That is a good question.

When this ME/AMT vulnerability bubbled to a head researchers started to looking into disecting it and flipping the HAP bit with uneven success.

But, I believe several groups had found a way to get into minix kernel and re-write the ME/AMT micro code to successfully flip the HAP bit while keep other parts intact to keep your machine working. The ME kernel seems to have an active shell with communication to the mothership.

BleepinpComputer has an article on it.

‘Researchers Find a Way to Disable Much-Hated Intel ME Component Courtesy of the NSA’

“Positive Technologies experts revealed they discovered a hidden bit inside the firmware code, which when flipped (set to “1”) it will disable ME after ME has done its job and booted up the main processor.”

And note hacker group has been exploiting the ME engine to penetrate firewalls
“Furthermore, one cyber-espionage group has already started using other Intel ME vulnerabilities to avoid firewalls and steal data from victims.”-bleepingcomputer

I was not aware of this in the wild attack.

https://www.bleepingcomputer.com/news/hardware/researchers-find-a-way-to-disable-much-hated-intel-me-component-courtesy-of-the-nsa/

[Platinum attack]

“…bad news is that Microsoft discovered malware created by a cyber-espionage group that abuses the Intel AMT SOL interface to steal data from infected computers… Microsoft can’t say if these state-sponsored hackers found a secret way to enable this feature on infected hosts, or they just found it active and decided to use it…feature has been spotted with malware deployed against organizations and government agencies in South and Southeast Asia. The group that deployed this malware is only known under a codename given to it by Microsoft researchers — PLATINUM.”-Bleepingcomputer

https://www.bleepingcomputer.com/news/security/malware-uses-obscure-intel-cpu-feature-to-steal-data-and-avoid-firewalls/

To all experts in the firewall area, how dangerous is the above hack?

Here is Positive Technologies solution:

http://blog.ptsecurity.com/2017/08/disabling-intel-me.html

Sakaki’s EFI Install Guide/Disabling the Intel Management Engine:

https://wiki.gentoo.org/wiki/Sakaki%27s_EFI_Install_Guide/Disabling_the_Intel_Management_Engine

Purism’s rewrite of ME which takes a half of one hour and works on skylake:

https://puri.sm/learn/intel-me/

Me_cleaner on github

https://github.com/corna/me_cleaner

All of the above are complex operations.

For those experts interested in disabling ME please let me know which method is the best?

Thanks

@ just wondering 33

I cannot tell you.

I am not an apple expert. Other posters probably can. You seem to know plenty about it yourself.

tyr • January 13, 2018 11:30 PM

@Rachael

Having been involved in politics I’m
not sure any externally applied solution
has the magic answer to the problem. If
you read Leviathan (Hobbes) power is never
where it appears to be in any political
system. Most are constructed to give an
appearance of control to the populace as
a sop to sentimentality. Like a black box
with levers all labelled as connected to
the system but actually none of them are
connected to anything that really counts.

You also have the public figureheads who
pose and tweet and lie plausibily for the
amusement of the masses. Behind them is
the seedy bunch who fears exposure of
their existence more than they fear the
plague. This is the real secret of the IC
TLAs as currently constituted, as long as
they can hide behind classifying everything
they can get away with horrors that would
get a normal citizen hanged from the tree
next to them.

They have overstepped their boundaries by
mission creep and wound up controlling the
press and the media. This does not bode well
for any nationstate that allows it to happen.

That’s why the big stink over ‘fake news’.
Any rational individual can find the track
record of falsity that indicts all of the
media since the Creel commission faked USA
into WW1 in europe. The citizens were against
becoming involved in what they saw as a
ridiculous squabble between the queen of
Englands cousins which had no effect on USA.

Far too hypocritical to just declare war and
attempt to win it. We have to be faked into
actions that would make Goebbels blush at the
fakery just to keep the armaments industry
churning out useless crap.

The only hope is to invest in a popcorn
factory and be excellent to those around you.

gordo • January 13, 2018 11:44 PM

@ tyr,

Speaking of central planning…

Shoshana Zuboff: No escape from the Panopticon – Posted on 14 Oct, 2017
What is happening to humanity in our information civilization?
https://sciencenode.org/feature/shoshana-zuboff,-part-one-no-escape-from-the-panopticon.php

Shoshana Zuboff: Rendering reality and cash cows – Posted on 17 Oct, 2017
Part two of our conversation with Shoshana Zuboff follows the logic of surveillance capitalism, its origins, and what we can do about it.
https://sciencenode.org/feature/shoshana-zuboff,-part-two-rendering-reality.php

Who? • January 14, 2018 9:31 AM

@ 65535

To all experts in the firewall area, how dangerous is the above hack?

Not very dangerous, if you have non-AMT based hardware firewalls. As I said before a software firewall on a computer that runs the management engine cannot really stop it, as Intel ME has full access to supported NICs and sits between the network card and the operating system network drivers. In other words, Intel ME has full access to the computer hardware (memory, devices, network interface cards…) and the operating system (that runs behind the Intel ME technology) cannot really restrict it.

My advice? Using external firewalls built on non-AMT hardware (e.g., PC Engines Alix/APU/APU2 devices, Fireboxes, or old SPARC, SPARC64, MIPS, Alpha architectures running OpenBSD…) to protect your valuable computing devices, strictly authorizing both ingress and egress traffic on a “block all” default configuration. Blocking ingress traffic by default is not enough.

Some time ago I learned in this forum that a rogue AMT device can use http/https-like traffic to communicate with remote servers through firewalls. So do not blindly assign rules to allow this class of traffic to all your computers. My choice is allowing only one, non-AMT, machine to browse on the Internet.

echo • January 14, 2018 9:33 AM

@who? @65535

I finally completed my firmware patching so both uefi/bios and Intel AMT are done. The process was awkward because the IHV has officially dropped support for my model. Updates required creating a bootable CD or stepping back a Windows version. There were a few funnies though:

A.) Windows caused issues with hiding interrupting boot to access the uefi/bio. (Something to do with OS/eufi integration?) B.) Toggling Intel AMT in firmware automatically activates it even if toggled straight off again which causes it to undo provision after exiting uefi/bios. C.) Disable user firmware updates has gone walkies in latest uefi firmware. D.) Intel tool claimed no vulnerabilities existed even when the AMT firmware update changelog claimed a critical vulnerability existed. E.) A fresh install of Windows installed the Intel ME driver even though AMT was switched off. F.) Because Intel MT was switched off Windows did not install Intel ME device management software.

and

A.) Disabling LAN boot and changing boot priorities gets rid of firmware trying to boot from a remote managed server.

None of this is hugely technical or obfuscated but there are issues:

A.) Retailers of used computers don’t update firmware before resale. B.) Defaults are not privacy friendly. C.) It’s easy to forget or miss something if this is a none routine or an unfamiliar task.

Final tasks:

When I organise myself passwards and fingerprint ready need configuring. I also need to examine built in FDE (full disk encryption) versus proprietary and annoyingly incompatible solutions, and the security chip and secure boot.

P.S. My mouse has updated firmware to prevent a remote vulnerability.

CallMeLateForSupper • January 14, 2018 9:52 AM

Smart luggage is a thing? Apparently.

“Can’t remove the lithium battery from your smart luggage? Consider it grounded.”
https://www.washingtonpost.com/lifestyle/travel/cant-remove-the-lithium-battery-from-your-smart-luggage-then-consider-it-grounded/2018/01/12/c6119f6a-f63e-11e7-a9e3-ab18ce41436a_story.html
(Yes, nasty URL. I agree.)

Phone recharging port; GPS tracker; electronic lock; built-in digital scale. Of course. We work hard, so why shouldn’t we have what we need?? (face-plant)

einer • January 14, 2018 10:37 AM

@Who?

Better: Have separated LANs for internal/productive machines only and a set of machines with browsers in a different network, to be accessed via VNC for browsing only. No data or anything relevant (passwords) on the machines for browsing.

And different machines/networks for shopping/banking and “browsing” in general.

Segmentation rules.

Rome Fell From Within • January 14, 2018 10:54 AM

France
‘Smartphones are “literally using the power of billion-dollar computers to figure out what to feed you,” Mr. Harris said. That’s why you can’t look away.

This fall, France plans to ban mobile phones from primary and secondary schools, including between classes and during lunch breaks. “We must come up with a way of protecting pupils from loss of concentration via screens and phones,” said French education minister Jean-Michel Blanquer.

Canada
In Canada Prime Minister Justin Trudeau met with Mr. Harris at the Global Progress Summit in Montreal last September. The PM’s office wouldn’t provide details of the session, but if the federal government is considering restrictions on cellphone use, it wouldn’t be alone.

Destroyers of Society
The evidence for this goes beyond the carping of Luddites. It’s there, cold and hard, in a growing body of research by psychiatrists, neuroscientists, marketers and public health experts. What these people say – and what their research shows – is that smartphones are causing real damage to our minds and relationships, measurable in seconds shaved off the average attention span, reduced brain power, declines in work-life balance and hours less of family time.
They have impaired our ability to remember. They make it more difficult to daydream and think creatively. They make us more vulnerable to anxiety. They make parents ignore their children. And they are addictive, if not in the contested clinical sense then for all intents and purposes.’
https://www.theglobeandmail.com/technology/your-smartphone-is-making-you-stupid/article37511900/

Given the immense amount of negative press, Facebook is radically scaling back feeding its intentionally programmed addicts. They’ve ‘woken up’ and are using the site much less rather than accept Marks’ self-serving offer of Universal Income.
Praise must go to Europe and Canada for rejecting intrusive American shareholder value based data-mining technology. Even Wall St realizes corporate profits cannot be allowed to mentally incapacitate innocent human life.
It will be interesting to see how China’s Communist Party is forced to scale back its destructive surveillance state and leadership in AI. Who will rule humans OR profit-driven technology?

A consensus is building throughout The World to apply the brakes to projects originally seeded through American Military ‘Intelligence’. Do we realize that ultimate security ultimately destroys society FROM WITHIN?

Sustainable Technology to Increase Quality of Life
The solutions are sustainable guidelines and regulations to prevent destructive new ways to monetize ourselves through unlimited data-mining and surveillance*.

Why not use non-GMO, organic crop cultivation or humane livestock standards as examples?
Here Canada and France are taking the first steps to implement Sustainable Technology beginning with the urgent task of save their own children. They are cultivating the rich human rewards of families today while building future world leadership and a truly quality high standard of living.

  • Homework: examine the degraded relationship between USA and England, fake news, unprecedented political meltdowns and gross income inequality. All traceable to profitable yet out-of-control surveillance technology. Do you want more or less?

albert • January 14, 2018 1:27 PM

@Rome, et al,

Look at it from the kids POV. Why bother with school? They have instant access to everything the school has, plus things the school doesn’t have, like sites that deflate corporate propaganda, expose human rights abuses, etc.

Of course they have access to more knowledge than we ever did, but one doesn’t gain wisdom from knowledge. Great teachers and involved parents are priceless resources.

Pocket calculators didn’t exist when I was in school. Recently, I bought some full function scientific calculators for a buck apiece in the dollar store.

The times they are a changin’, indeed.

. .. . .. — ….

65535 • January 14, 2018 4:07 PM

@ Who?

“Not very dangerous, if you have non-AMT based hardware firewalls. As I said before a software firewall on a computer that runs the management engine cannot really stop it, as Intel ME has full access to supported NICs and sits between the network card and the operating system network drivers.”

That is somewhat of a relief… assuming a non-AMT based hardware. Thanks.

@ echo

“…finally completed my firmware patching so both uefi/bios and Intel AMT are done. The process was awkward because the IHV has officially dropped support for my model. Updates required creating a bootable CD or stepping back a Windows version. There were a few funnies though…”

That is good information! You are now the go-to person for ME/AMT issues. Keep up the good work.

Yes, I don’t really trust the Intel Detection Tool to give me the straight data – but it was all I had.

Alyer Babtu • January 14, 2018 4:25 PM

@Rome in re homework

Cecil Chesterton and Hillaire Belloc’s book “The Party System” (pub. 1911) could be an account of today’s UK and USA pseudo-politics of apparent debate, and also visits fake news. One could also go back to the late 1700’s and see fake news manipulate politics in France, or Henry VII’s England.

Someone (Orwell ?) said something like see who you are not allowed to criticize and you will have found your oppressor. By this standard, both main US political parties, the progressive left, the alt right, etc, etc. etc. are oppressors. Strangely, this standard makes Trump not an oppressor; everone is invited to flame him. Sumfin’ funny goin’ on heah.

The long noted zeroth order approximation is that all news is fake, but in different ways, so a careful wide reading can discern something of what is really going on. It’s tough homework.

It seems to provide helpful aperceptive background and mental armor to read some real philosophers, for example Aristotle (as a start, Politics, Ethics, Rhetoric, Topics, Posterior Analytics), Aurel Kolnai (especially writings on utopias of the left and right), and G. K. Chesterton (Cecil’s brother, good detox for one’s common sense). The biographies of all these writers are worth a look also. Extra credit *.

echo • January 14, 2018 4:58 PM

@65535

OMG. I am real security expert now! I feel oh so grownsie upsie.

@who?

I will need to buy a new router/firewall at some point. I will bear in mind AMT port blocking. Thanks.

65535 • January 14, 2018 6:51 PM

@ echo and others

I am glad your new title is Security Expert. I will add “grownsie upsie” to my dictionary.

[False alarm in Hawaii]:

“January 13, Hawaiians received a terrifying message on their phones… “BALLISTIC MISSILE THREAT INBOUND TO HAWAII. SEEK IMMEDIATE SHELTER. THIS IS NOT A DRILL.” …Vern Miyagi, Hawaii’s Emergency Management Agency Administrator, also took the podium at the press conference to apologize.”-arstechnia

https://arstechnica.com/tech-policy/2018/01/after-false-hawaii-missile-notice-fcc-launches-investigation/

Hum, maybe Vern should get “grownsie upsie” or at least a bit more careful with his alerts.

tyr • January 14, 2018 11:02 PM

@Gordo

Thamks. I talked to Zuboff about something she
said about the Great Transformation book analysis
of society in email a few years ago.

You might want to check out Mark Blyths last
two Youtube videos. Some of it is fun stuff.

@all

The hawaii episode is an ugly one since I have
heard young people ignorant of warfare that
will commit suicide to avoid being involved.
That’s a failure of education pure and simple
but no one seems to care much.

Best you can do is ‘trust but verify’ since
culture is not your friend in more ways than
one.

Clive Robinson • January 14, 2018 11:43 PM

@ 65535,

Hum, maybe Vern should get “grownsie upsie” or at least a bit more careful with his alerts.

As Hawaii is not currently painted in “glow in the dark” colours, we can now call it a “false alarm” and some will end up calling it “The biggest ‘fake news’ story of 2018” before the year is three weeks old…

But maybe we should look at the background to this story a little bit. For years more like decades now the US has been drumming up the old “war drum” with North Korea. North Korea has by and large kept it’s self to it’s self.

Untill very recently the US has derided NK as some backwards hill billy like nation of peasant surfs/slaves for reasons of it’s own, which involve actively provoking the North from the South with war games etc. But now the “public consumption” point of view needs US citizens to believe the North Koreans are all of a sudden an “Existential Threat to the Great American way of life”. Which means one or the other or possibly both views are propaganda lies from the USG…

History shows that the US acting as an invading force, post Pacific war forced partition on the Korean peninsula, much against the recorded wishes of the Korean people, which created real friction. The reasons this happened were and still are politicaly complex. But put simply although Stalin got control of a chunk of Korea by joining the Pacific war just before Japan surrendered there was already a “communist” leadership effectively in place in the north of Korea. These “communists” were actively supplying Mao Zedong in china with food, troops and weapons to fight the Chinese Nationalists, which the US were supporting in a lot more than name. Due to Stalin’s behaviour over the East European Nations there were quite real fears that despotic leaders calling themselves communists were trying to take over the world. Whilst the rest of the world could not defend it’s self having become war torn in one way or another going back in some cases not just prior to WWII but also prior to WWI. Depending on what evedince you gather and prioritize you end up with one argument that says Russia Provoked a war, another that NK provoked a war, another SK provoked a war, oh and that the US provoked a war as part of it’s “Anti-Communist” behaviours. The point is that the US in effect put inplace a divided Korea and that was, as far as many Koreans were concerned, the base cause of the conflict arising between North and South that ended up in a war the South could not win and the US enflamed in various ways. Ways that went on to include mass bombing and the use of chemical weapons in the north to wipe out around 1/3rd of the population. Oh and when that did not work the US commander in the field called for the use of Nuclear weapons being another.

The point is China felt in debt to the North Koreas both morally and ideologicaly with supplies of food and military aid comming from Russia, there was in effect no way the US was going to win on numbers. Mao effectively said they could keep putting troops into Korea that the US could never match. It was this numbers game that caused the call for nuclear weapon usage, and when refused by US politico’s simply confirmed what the final outcome of the war was going to be.

After 1953 NK became more issolated and it’s communist in name leadership became a hereditary dictatorship, along the old “King Game” rules. But with out the “God Excuse” for absolute power that would have been called “Divine Right” in previous times. Hence the nickname of “The Hermit Kingdom”, but importantly Western Intelligence had little or no information. If left alone NK would have probably colapsed some time ago however the endless “US threat” and provoking behaviour from SK gave the NK leadership leverage with both China and Russia, which it still has fairly firm relationships with today.

However what people forget is that the NK leadership saw other nations like Russian, China, India and Pakistan getting compleatly different behaviour from the US after they gained nuclear weapons. Thus the NK leadership realised that the way to keep the US and occasional half mad war mongering SK leaders “out of it’s yard” was to develop it’s own capability the US was so scared of in virtually every act and deed it carried out.

Mad as the media in the West portray NK and it’s leadership they do act in ways you would expect from a “Rational Actor” whilst the US has not (unless you call enriching the US MIC at any cost rational). US diplomats “talk piece and make offers” but each and every time the US politicos find excuses to not agree to what it has commited to. We see this behaviour with Palastine, Iran and other places. To the point most are fairly convinced that the US word is of no worth.

What many in the US won’t have heard is that the SK Premiere is not currently playing to the US Playbook, which with the Olympics opening very soon SK has politly refused the US trying to get Intel and Military resources into SK under the old security pretext that caused so many problems for the Greek Government. Worse as far as the US is concerned is the friendly talks between NK and SK have started again which will probably move to new Six Nations talks, but with a high probability the US will get marginalised or left out in all but name. Because the rest of the world is getting tired of the US attitude of using peace talks as an excuse for “fake news” then follow through with military action. When even the normaly compliant UN is voicing not just concerns but serious doubts about US integrity, you can see that the winds are starting to change the direction they blow from…

Which must be a significant worry for those in the US responsible for foreign policy, and to a greater degree than they would admit the behaviours of the US IC… Worse the MIC has taken a hit with SK not taking their mainly usless anti-missile missile system as expected…

Now with tensions about Hawaii being inside the range of NK ICBM delivery systems and potential nuclear weapons, at just the right time for the US MIC, IC and foreign policy wonks the missile warning system just happens to go into action despite several fail safe processes being involved…

    “How Convenient for someone”

All of a sudden talking heads get to do their stuff and undesirable news re NK and SK getting friendly again is kept off of the front pages…

It will be interesting to see how this plays out. But a small wager that NK will come out with some if not all the blaim appears to be “a racing certainty”…

What do you reckon the other popular existential nations such as China, Iran and Russia come in for a big dollop of blaim in some way?

For instance with the UN flexing it’s wings,

    Iranian hackers getting into and triggering the warning system with unverified for National Security reasons but –supposadly– positive Cyber-attribution

Must be in the front runners 😉

Oh but not forgetting the old “little green men / weather balloon” let loose from “the grassy knoll” a rank outsider but some will wager on it…

Ratio • January 15, 2018 4:00 AM

Iran’s Cyber Threat: Espionage, Sabotage, and Revenge:

  • Offensive cyber operations have become a core tool of Iranian statecraft, providing Tehran less risky opportunities to gather information and retaliate against perceived enemies at home and abroad.
  • Just as Iran uses proxies to project its regional power, Tehran often masks its cyber operations using proxies to maintain plausible deniability. Yet there are clear indications that such operations are conducted by Iranians and frequently can be linked to the country’s security apparatus, namely the Ministry of Intelligence and Islamic Revolutionary Guard Corps.
  • Iran’s cyber capabilities appear to be indigenously developed, arising from local universities and hacking communities. This ecosystem is unique, involving diverse state-aligned operators with differing capabilities and affiliations. Over the decade that Iranians have been engaged in cyber operations, threat actors seemingly arise from nowhere and operate in a dedicated manner until their campaigns dissipate, often due to their discovery by researchers.
  • Though Iran is generally perceived as a third-tier cyber power—lacking the capabilities of China, Russia, and the United States—it has effectively exploited the lack of preparedness of targets inside and outside Iran. Just as Russia’s compromise of Democratic Party institutions during the 2016 U.S. presidential election demonstrated that information warfare can be conducted through basic tactics, Iran’s simple means have exacted sometimes enormous political and financial costs on unsuspecting adversaries.
  • The same Iranian actors responsible for espionage against the private sector also conduct surveillance of human rights defenders. These attacks on Iranian civil society often foreshadow the tactics and tools that will be employed against other targets and better describe the risks posed by Iranian cyberwarfare.
  • Through technical forensics of cyber attacks, researchers documenting these campaigns can provide a unique window into the worldview and capabilities of Iran’s security services and how it responds to a rapidly changing technological and geopolitical environment.

(Direct link to report in Persian: تھدید سایبری ایران: جاسوسی، خرابکاری و انتقام)

mike acker • January 15, 2018 6:10 AM

Our current spate of computer security debackles has its roots in 3 fundamental issues

  1. software having excessive capabilities;
  2. neglecting to authenticate important transactions;
  3. total disregard for product liability.

These are not things that can be fixed in the user department; they apply to the OEMs. Business for the FTC.

Rachel • January 15, 2018 7:03 AM

CalMeLateForSupper

Smart luggage. BYO crowbar? The luggage that had ownership of the live gps tracking tech was actually losing money per unit sold. Their solution was to market to the corporate world relying on annual subscriptions. Thats right, the luggage requires an annual fee to work. So totally disruptive dude

echo • January 15, 2018 9:09 AM

@mike acker

I believe what you say is true across the board especially within large organisations. I note Intel used the excuse “works as designed it’s not our fault the bad guys used this in other ways” excuse twice. Once with AMT and again with Meltdown etcetera.

I believe public education of the science (and to some degree the law) is helpful as too is the right corporate culture among other things.

I’m still trying to understand security as a field. I have to begin somewhere…

https://en.wikipedia.org/wiki/Security

albert • January 15, 2018 1:02 PM

Something stinks in the Hawaiian affair.

Having lived through to MAD 50’s, I can tell you we had many tests of the ’emergency broadcast system’. The announcer always said, “This is a test”, and that was displayed visually (on TV) as well. You DO NOT use real warning messages.

Anyone with at least two brain cells connected together should know that the US military is the only source for ICBM threat information.

There should -never- be non-military personnel in control of such warnings.

“…”We are working to evaluate everything in the sequence of today’s activities, so a single person will not be able to make an error that triggers another false alarm,” Ige said….”

Idiots! “…single person will not be able to make an error…” The lack of intelligence in these people is mind-boggling.

The quality of public ‘service’ employees needs to be evaluated. Perhaps they’ll wait until someone dies or is injured before these problems are corrected.

. .. . .. — ….

65535 • January 15, 2018 2:42 PM

@ Clive Robinson

The Korean war was before my time and quite a while ago. You give an interesting take on it. You know a lot about history. All school kids including myself briefly study it. May historians just brush it off as an unfinished part of WW2 and the vacuum caused the the Japanese defeat. I really don’t know. It is kind of like the opium war being told first by the Brits and then by Chinese. Two very different views. You view contains some details I was not aware of… but then I am not a historian. Also, I fear we are getting into some political hot points which Bruce S. tries to avoid.

As for the recent false alarm it is somewhat odd. There seem to some political statement after it.

@ albert

“Something stinks in the Hawaiian affair… There should -never- be non-military personnel in control of such warnings.” –albert

It does smell funny

“State officials and the U.S. military’s Pacific Command confirmed that there was no actual threat to the state.”-reuters

ht tps://www.reuters.com/article/us-usa-missiles-falsealarm/us-militarys-pacific-command-says-ballistic-missile-warning-sent-in-error-to-hawaii-idUSKBN1F20U1

As I understand, the Pacific Command denied the alarm almost immediately in a tweet – but that new was not well disseminated.

To be honest I didn’t hear about it for a while and only after it was issued and cleared up.

Richard • January 15, 2018 3:01 PM

I absolutely love Japanese food. But some of those dishes seem a bit over the top. I love the simplicity of Asian food.

But boy did that calamari, fried chicken and Ashai look great.

Clive Robinson • January 15, 2018 3:02 PM

@ echo,

I’m still trying to understand security as a field. I have to begin somewhere…

There are two basic types of Security, those that in the tangible physical universe and those that are in the intangible information universe.

Very roughly what ever anti-security things that work in the physical universe will also work in the information universe. But the opposite is not true there are many things that work in the information universe that do not work in the physical universe. Thus you can view the physical world as roughly being a subset of the information world. Likewise be carefull with real world physical universe assumptions they usually do not apply in the information universe.

Understand why we have the differences…

That is in the physical world why your location is in one place at one time and you are constrained by energy/matter and the speed of light. But in the information universe you can be at many places apparently at the same time thus be “An army of one”. Whilst physical duplication has significant costs, yet information duplication has near zero cost. Likewise tools and other force multipliers have physical universe costs but near zero cost in the information universe. Appreciate why this near zero cost has very significant implications. Especially that likewise unlike the physical universe there is effectively no Distance Cost metric in the information world, thus real world economics has real problems in the information universe.

Further understand that information is not constrained to the physical universe but we are. Thus information is impressed / modulated on matter / energy, which is how we do the three basic things,

1, Communicate information
2, Store information
3, Process information

What is unknown and belived by some is that as information has not tangible form of it’s own, it is not constrained by either forces or the speed of light, only the matter it is impressed upon or the energy it is modulated on are.

By now most people who have not come across this thinking before start to feel a sense of conflict behind the eyes. Relax that is normal.

One of the concequences of this is the “None, One, Many” assumption of our real world experience. That is there can be “none of something” sometging can be unique or just “one of something” or there can be “many of something”. That is why the first of anything tangible has significant cost yet many have less but no where near zero cost, they all wear out the tools so each next copy is fractionaly different than the previous copy and contains more process noise. Information duplication in digital form in effect does not suffer from difference in the copies and thus each copy having near zero cost is in effect the same as the first instance. Thus in the information world the real cost is the design stages, with duplication having near zero cost. Hence an army of information automatons has the same cost as an individual automaton.

Oh one last thing, the physical universe is believed to be finite, however the information universe is belived to be unbounded. Thus the amount of information that can be held in the physical universe is finite. Thus it is not possible to know everything as creatures of a physical universe.

Don’t sweat this, but keep it in the back of your mind, as you progress in security one thing you will trip over regularly is where people bring assumptions in from their real world experience but forget the information universe is not constrained by those physical universe assumptions… It’s kind of like astronauts in free space find things don’t drop thus it takes way way longer to find things you let go off.

albert • January 15, 2018 4:40 PM

It’ll be interesting to see what the (so called) investigation turn up. I also wonder about how warning information travels through the system. How many hands must it past through before it ‘s broadcast? Or is it (God help us) an Ai system.

I like a good conspiracy theory as much as the next guy, but I’m not ready to call it PSYOPS…yet. It’s probably just good old-fashioned incompetence. There’s a lot of that going around lately.

. .. . .. — ….

moo • January 15, 2018 5:12 PM

Saw this on Hacker News:
https://www.bloomberg.com/view/articles/2018-01-12/uber-looks-great-when-the-police-barge-in

Uber’s Montreal office got raided by law enforcement looking for evidence of tax evasion. As soon as a raid starts, Uber employees have been trained to page some people in their central office in the U.S. Those people are “specially trained” to activate a system that remotely locks down all the computers in the office being raided, preventing any sensitive documents from being “in plain view” on those computers.

Aside from how close this flirts with obstruction of justice, its interesting from a security point of view. I wonder how easily hackers could activate the same system, shutting down an entire Uber office for an hour or two?

Clive Robinson • January 15, 2018 5:13 PM

@ Albert,

I like a good conspiracy theory as much as the next guy, but I’m not ready to call it PSYOPS…yet. It’s probably just good old-fashioned incompetence.

The trouble is there is very rarely “a good conspiracy theory” as in same old same old, dull improbable and needing some invisible group of all powerfull men in grey suits etc.

Trouble is life is also same old same old, dull improbable and needing some invisable group to put the fun back…

You know it’s getting tedious when you actually want the Iranians to have hacked in via some old forgoton telephone pair connected to some 1970’s CIA equipment on a mountain in India powered by a bunch of old Radioisotope Thermal Generators, that did not get blown away in a blizard and melt their way to certain destruction through a glacier…

Anonymous2c • January 15, 2018 5:27 PM

@Moderator, All

At times I wish Schneier on Security (SOS) would offer 200, 500, 1000, or user specified (up to a limit) Latest Comments, or thereabouts, in addition to 100 Latest Comments.

At times I like to take a break from SOS without losing my time stamp from before (see below). It would be nice to be able to break for a week or so and not miss too many comments. At times recently 100 Comments may go by in about a day or less.

A) Standard Operating Procedure for reading SOS from “100 Latest Comments”
1) goto last place read in 100 recent comments (search for time stamp from last time)

2) click on links (once per thread) from there towards most recent comment

3) at this point a number of threads will probably be open (with some redundancies)

4) with this technique complete comments can be viewed in context readily (page-up, page down, search) and start, usually, at a
relevant point in time within a thread

5) delete old threads periodically

6) shortly (hour, day, week) goto 1)

B) Does anybody have other ideas about how to cope with missing comments based on infrequent checking?

65535 • January 15, 2018 5:36 PM

@ moo

“…Uber employees have been trained to page some people in their central office in the U.S. Those people are “specially trained” to activate a system that remotely locks down all the computers in the office being raided, preventing any sensitive documents from being “in plain view” on those computers.”-bloomberg

https://www.bloomberg.com/view/articles/2018-01-12/uber-looks-great-when-the-police-barge-in

Hum, interesting concept. If it is legal why not do it.

Any lawyers on this board who could give an opinion on the obstruction of justice or evidence tampering end of this deal?

Anonymous2c • January 15, 2018 6:41 PM

I’m looking for some marketing ideas for getting SOHO or residential customers to purchase their own (wifi or not) inexpensive routers in addition their ISP, if any, router or modem. Any recommendations for router vendors? Is AC necessary? Is Meltdown or Spectre relevant? Is gigabit ethernet relevant or for what? For Comcast’s bundled Phone Service do you need to use Comcast’s Modem/Router?

Are changes with Net Neutrality or the ability of ISPs to sell customer data relevant?

Below are some excerpts from various links, many dated. Any other ideas or links?

“The decision is ultimately up to you and depends on what you want. If you’re happy with your combined router/modem unit and you don’t want any additional features it doesn’t provide, you’ll probably just want to stick with the box your ISP gave you. It’s just easier to set up and use.

On the other hand, if you want the latest wireless hardware or additional features, you can get them by purchasing your own router and connecting it to your modem. You’re trading some simplicity for more power and choice.

If you’re renting that combined router/modem from a cable Internet provider, there’s also another option — you can generally buy your own router to eliminate the router service fee from your monthly cable Internet bills. This doesn’t apply to ADSL, fiber, or satellite connections — just cable.”
https://www.howtogeek.com/187439/should-you-buy-a-router-if-your-isp-gives-you-a-combined-routermodem/

“And Dual Channel..
Most ISP kit is still only 2.4GHz.
And ISP’s quite often charge full RRP…

If the OP can live with all the disadvantages and get away with just buying a cheap Gigabit switch , that’s the way to go.
But if you want/need n or ac WiFi, or Dual Channel, or other advanced features, the disadvantage of buying your own is only going to be an issue if you have connectivity problems..

If you’re getting a “free” modem, but still want to buy your own, store the freebie as a backup to switch in before you call your ISP help-line to resolve any line issues.

I use my own device, but have the device supplied by my ISP in a cupboard just in case I have any issues (at which time I can use their standard device – otherwise they don’t do the same level of troubleshooting).

I’ve found a couple of problems with most ISP provided devices :-

1) they use Fast Ethernet (100Mbps) rather than Gigabit (1000Mbps) LAN ports – no impact on your Internet speed, but restricts the speed you can move things around your network at home
2) they have far inferior WiFi (most are single band N, and don’t allow replacement of standard antennas)

But always be prepared to have the ISP device connected to a single computer to avoid the “I’m sorry, but we don’t support that [far superior] device”, or “It must be caused by your Network settings”.
https://www.lifehacker.com.au/2014/05/ask-lh-should-i-buy-my-own-router-or-use-one-from-my-isp/

How to Ditch Your Rented Modem and Buy Your Own
https://finance.yahoo.com/news/how-to-ditch-your-rented-modem-and-buy-your-own-99344850559.html

http://www.tomshardware.com/answers/id-1744085/buy-higher-end-router-support-higher-end-isp-package.html

“Tip: A guest Wi-Fi network can help secure your computers

Newer wireless routers often include an option, not enabled by default, to create a second network that only provides access to your Internet connection while walling off any computers, printers, backup drives or other devices on your network.

On Apple’s AirPort routers, for example, you can create a guest network with a few clicks in its Airport Utility program. You may need to mouse around a little more in the Web-based configuration interfaces of other routers — on my Asus model, it’s right there on the home page, but D-Link puts it behind an “Advanced” category.

Give the network a name that makes its guest-access purpose somewhat obvious; since your guests won’t have access to your own files, you don’t need to choose an incredibly complex password.

If you don’t want to bother with a password and do want passersby to know they’re welcome to borrow a little bandwidth (assuming your Internet provider doesn’t ban that), name your network “openwireless.org.” That address points to the site of the Open Wireless Movement, a group of tech-industry organizations that advocates sharing Wi-Fi — and has posted some handy cheat sheets about configuring many routers for guest access.”
https://www.usatoday.com/story/tech/columnist/2013/08/18/cable-modem-alternatives-internet/2661689/

“Editor’s Note: make sure that you pick a router with gigabit network ports on it, otherwise you’ll be limiting yourself should you decide to upgrade your internet connection in the future. For instance, this Netgear N600 cable modem works with Comcast, has gigabit ports, supports up to 340 Mbps and even includes Wi-Fi, but this $44 Motorola only supports 100Mb LAN connections and doesn’t have Wi-Fi.”
https://www.howtogeek.com/186941/buy-your-cable-modem-instead-of-renting-it-to-save-4-8-per-month/

http://www.majorgeeks.com/content/page/how_to_improve_your_wireless_network_performance.html

… “Home Network Design
1.
The Internet Service Provider (ISP) may provide
a cable modem with routing and wireless
capabilities as part of the consumer contract.
To maximize the home user’s administration
control over the routing and wireless device,
deploy a separate personally-owned routing
device (a) that connects to the ISP provided
router/cable modem. Figure 1 depicts a typical
home network configuration that provides the
home user with the network infrastructure to
support multiple systems as well as wireless
networking and IP telephony services (b).
Figure 1: Typical SOHO Configuration
2.
Implement WPA2 on Wireless Network
The wireless network should be protected using
Wi-Fi Protected Access 2 (WPA2) instead of
WEP (Wired Equivalent Privacy). Using current
technology, WEP encryption can be broken in
minutes (if not seconds) by an attacker, which
afterwards allows the attacker to view all traffic
passed on the wireless network. It is important
to note that older client systems and access
points may not support WPA2 and will require a
software or hardware upgrade. When researching
for suitable replacement devices, ensure that the
device is WPA2-Personal certified.
3.
Limit Administration to Internal Network
Administration of home networking devices
should be from the internal-facing network.
When given the option, external remote
administration should be disabled for network
devices. Disabling remote administration
prevents an attacker from changing and
possibly compromising the home network.” …
https://fas.org/irp/nsa/best_practices.pdf

Anonymous2c • January 15, 2018 7:10 PM

How might a multi-unit residential building (new construction apartments or duplexes) be wired for internet, phone and tv?

The two main ISPs in this area are Verizon FIOS and Comcast XFINITY. Any pros and cons links or input regarding the Comcast vs. Verizon choice for small business or residential when available? Is satellite worth considering? What VOIP vendors are worth considering?

Both Verizon FIOS and Comcast XFINITY are currently available in this neighborhood. Tenants will be responsible for their own TV and Internet, and presumably, Phone. How might a multi-unit residential building (new construction apartments or duplexes) be wired; perhaps with an equipment closet to facilitate aesthetics, security, and ease of switching among ISP vendors. For example, ask Verizon to keep their ONTs in the equipment closet(s) or in individual apartments? Should individual apartments have wall plates with coax and ethernet connections (with Comcast or Verizon substituting their competitor’s equipment or connections in an equipment closet as much as possible)? Tenants will be responsible for their own TV and Internet, and presumably, Phone. Should satellite vendors be included? Any relevant sources, ideas or suggestions would be appreciated.

One interest is to avoid vendor lock-in. Thus minimize switching costs and switching hassle as much as possible so tenants have relatively competitive choices?

Anonymous2c • January 15, 2018 7:36 PM

Regarding the Steele Dossier, “Asked if the Times story didn’t mesh with his view of the FBI probe, Mr. Simpson answered, “Exactly.”
It was at that point Mr. Steele severed his FBI ties, Mr. Simpson said.”
https://www.washingtontimes.com/news/2018/jan/14/simpson-upset-new-york-times-passed-on-trump-russi/

“I keep promising a big post or series of posts on the Glenn Simpson transcript. And I keep doing quick posts to summarize what the transcript says about controversial topics. In this one, I’ll look at what it says about whether FBI paid Christopher Steele and how the relationship went south.”
https://www.emptywheel.net/2018/01/14/what-glenn-simpson-said-about-the-relationship-with-the-fbi/

Nick P • January 15, 2018 9:53 PM

Two, nice quotes from comment section of an article about FBI considering any tech company evil if they don’t provide assistance to identify or decrypt their protected products:

“Then the FBI lambasted the glove industry for enabling criminals to commit crimes without leaving fingerprints. The evil geniuses of the glove cartel are making the jobs of police everywhere much more difficult, and should be forced to work on gloves that leave fingerprints when used to commit crimes.” (JoeCool)

“Ahh, I wondered what those fingerless gloves were for.” (Anonymous)

We need a whole list of stuff like this that criminals use in physical space. Then, someone like Bruce can deliver the examples to Congress or courts asking we force suppliers of physical goods to do all of this if we’re going to do it to suppliers of digital goods. After all, public security via surveillance is an end that justifies any and all means no matter what the cost to privacy or 3rd parties. Right? 😉

Another I remember was that all cameras have to upload copies of any pictures they take to the Feds to combat pornography, esp child pornography. I added that possessing any other kind of camera gets you life. They all have to be turned in like the gun grabs. Even the antiques because we don’t let terrorists use antique COMSEC devices or machine guns, now do we?

Ratio • January 15, 2018 11:00 PM

@Nick P,

Two, nice quotes from comment section of an article about FBI considering any tech company evil if they don’t provide assistance to identify or decrypt their protected products: […]

The article: FBI Says Device Encryption Is ‘Evil’ And A Threat To Public Safety.

After all, public security via surveillance is an end that justifies any and all means no matter what the cost to privacy or 3rd parties. Right? 😉

Hah! How could they ever respond to that one?

“After all, privacy is an end that justifies any and all means, no matter what the cost to public safety.”

Oh, right. It’s almost as if they didn’t even need to change their narrative at all…

uh oh • January 15, 2018 11:33 PM

we force suppliers of physical goods to do all of this if we’re going to do it to suppliers of digital goods. … Right? 😉

Sure, I could easily argue in favour of that point.

possessing any other kind of camera gets you life. They all have to be turned in like the gun grabs. Even the antiques because we don’t let terrorists use antique COMSEC devices or machine guns, now do we?

Great! It’s not enough to have “gun grabs” that also go along with the “creative accounting” of valuable antiquities, but now we could get to pay for a “cash for cameras” scheme? Good plan 😛

Clive Robinson • January 16, 2018 12:35 AM

@ Moo, 65535,

Aside from how close this flirts with obstruction of justice, its interesting from a security point of view.

It’s actually not that close to obstruction of justice, depending on how you set things up. But it is based on practices that predate computers by a very long way and is technology that is still used today one way or another without question or suspicion as anti-theft devices/technology.

But Uber might have added a twist that has long been discussed on this blog mainly by @Nick P and myself.

Firstly though remember what I say from time to time,

1, Technology is agnostic to use, it’s the directing mind that decides that.

2, The good or bad use of technology is based on the point of view of the observer not the act.

That second point is important because it’s what the US FBI/DoJ are trying to manipulate to get changes over encryption policy so they can willfully invade your privacy without let or hinderence from the legislators and judiciary. That is they want to treat your records all of them like “third party business records” that can be obtained without oversight of the judiciary.

Historically banks and retail outfits had cash registers that often had high values of cash in them. Thus they got raided by people with guns etc who would take the money by fource. Using “guard labour” only made the “take with force” issues worse. Thus the banks and stores started using the technology of the time to minimize their losses to such raiders. The official reason was “To Protect Staff” the real reason as always was “To Protect Profits”, so not much has changed there then…

The technology basically took the cash into a strong point or safe that raiders could not get into before outside forces arrived. Such “buying time for response” is a standard physical security method and why safes and the like have their security measured in “time” by Underwriter’s Laboratory (UL) and equivalent.

Thus the technology was “gravity balls”, ‘pneumatic tube” and “Drop Safes”. The only one you don’t see still in use today in the Western world is “gravity balls”, that have been replaced by pneumatic tube or armourd cash dispensers like ATMs. Many banks still have “Night Safe” hatches today which is a drop safe. Likewise you will see smaller retail outlets with little “strong boxes” bolted to a strong point close to the cash register that has a slot in the top and a blunt metal blade to push high denomination notes into it. There are also some electronic point of sale systems that will in effect “swallow the cash draw” when an alarm is sounded.

All Uber has done technology wise is apply the same thinking process to their files.

However the “left without evidence” suggests that they have not just applied encryption techniques to the files they have gone a stage further by having the server holding the files at some other place.

If you look back on this blog you will find that @Nick P have talked about using not just out of jurisdiction file storage, but also how to safely use multiple jurisdictions that all have to agree to access. This is controled by “Directing Minds” in each out of jurisdiction location along with duress key phrases etc and auto deleation / spoilage of data by a timed process.

By the way before people start talking about “obviously criminal intent” etc with the auto deletion / spoilage, again it is based on a physical security anti-theft device. In many parts of the world paper bank notes are shipped around in containers that if not opened the correct way release a dye and sometimes other noxious chemicals like skunk spray to make the bank notes worthless to raiders.

The important thing to remember legaly is that if these automatic measures are put in place as “anti-theft” or “Intellectual Property Security” systems as company policy prior to any action by the authorities or others then it is Security not Obstruction.

If the police trigger such systems they can request assistance by employees. But the employees are entitled to seek independent legal advise before complying/denying any such request, which obviously takes time… By which time the automatic systems will have taken over.

With regards “fast logout” those “crotch-cam” sensors under desks that detect “emoloyee present” for attendance logging are rather better than wrist or other personally attached RFIDs be they “near field” or “low power”. Even simple foot area preasure plates work better if the user is security conscious. The reason that RFIDs get used in so many situations and often work baddly is that they are not used correctly. An RFID is a “token” of identity not a “person present” device. So emoloyees will leave tokens on desks etc when they go to the toilet or smoke break… Preasure plates may be “accidentally” tricked with heavy handbags / briefcases etc. But “crotch-cams” take a quite deliberate effort to trick, and that can be used for instant dismissal.

The point to remember when it comes to “obstruction of justice” is it is judged by a “state of mind at the time”. Not what was originally might/might not have been in a security systems designers head.

There are other tricks a prosecuter might try but they would have to demonstrate beyond reasonable doubt that it was a very deliberate design to thwart Law Enforcment rather than protect IP which is a requirment in law to do, if you do not want shareholders starting civil claims.

A prosecuter trying to show beyond reasonable doubt that the design was to thwart LE is near impossible if those involved are cautious. Especially if the potential defendents know that it’s in all their interests by a long way to say nothing in a neutral way. In an international corporate environment it’s even easier, those that design the system –not implement or operate it– stay out of the jurisdictions where they might be prosecuted.

Many legal systems accept the fact that in white collar crime involving corporations finding an actuall “Directing Mind” is near impossible. Thus rather than go to great expense to try and basicaly fail, they use regulation and fines not legislation and time as the solution. Unfortunatly though the fines sound large to the average person they are often seen as sufficiently inconsequential by carefully structured international corporations that they are a “cost of business” payed by the customers not shareholders or directors. Worse still in some cases the fines can be “offset against taxes”… It’s why the EU are putting in place much harsher fine systems for data protection to stop such behaviour.

echo • January 16, 2018 5:47 AM

@clive

I have noticed one UK public sector organsation leaving whistleblowers in a legal limbo where prejudicial information relating to their employment is left on record rendering them both A.) Exonerated by a tribunal and B.) Unemployable. The organisational response has been a shrug and C.) This is a historical record and there is no legal requirement to delete it.

I have also witnessed what I perceive as deliberate delays and decisions which on the surface make sense but are a little coercive in retrospect. When a points of no return is reached gates are progressively slammed behind and this is usually only noticed when it is too late. I perceive this as an administrative abuse of power for the security of the organisation and people who perceive their best interests are aligned with the organisation even where the end goal is professionally and/or legally dubious. Is this a real thing?

This may be a little tenuous but I feel this is a software equiavlent of the physical protections you described.

Rachel • January 16, 2018 6:01 AM

Anonymous2c

any chance you can use a more distinctive handle? I note Mr Schneier requests Anonymous not be used generally. Anyway, good feedback about comments. I understand Mr Schneier appreciates it. I too found it hard to keep up and desired a top 500.. I’m sure it’s common.
I had to forgo the top 100 with the introduction of the ‘click here to read more’ . So I definitely miss a lot. For one thing I only read the top 100 offline, on the go. And the click follow through takes me to the TOP of the new page. Requiring I hand scroll through 150msgs, to the truncated message – oh look there was just two words to go. Back I go, repeat.

Nick P

pens can be used to write coded messages. The tri-colour ones are far more dangerous.
For some reason (?) your post reminded me of a sleepy bayside recreation area in the outer suburbs of Brisbane Australia. A family picnic kind of place. The council decided fairly recently the whole area required surveillance cameras fitted with audio. So all conversations are being recorded. The mayor said the usual ‘ well its just for the bad guys’ thing

Mr Mojo Risin • January 16, 2018 7:11 AM

Reading Wulff’s book, ha ha, wolf in sheep’s clothing? Lamb in wolf’s clothing. It is a skewer. No one dare uses Godwin’s law on Trump — because it is so obvious. FBI, CIA rah rah rah.

Bill Cosby for President in 2000, with sleeping Donald Trump as his running mate. 😉

Seriously. Back on topic, not trolling. Point is we can do this. We are pushing ahead and Democracy is staying true and free, as well as the internet. We need strong government, we need the FBI, we need the CIA. And we need geniuses working to keep our networks free.

As Deadpool said, “whose xyz did I have to fondle to get this”…

Routers Example • January 16, 2018 7:21 AM

@Anonymous2c
Thanks for the router configuration information.

Imagine you are battling against a team of ruthless psychopaths who’s main goal is to analyze every packet sent on your home network (especially those to the Internet) then monetize by sharing with Big-Data.

Our crazy USA FCC also recently made it legal for ISPs to perform deep packet inspection on your Internet data (NO privacy). They are now free to insert advertising too. My ISP has partnered with the NSA since 2005 examining data packets at the borders. Now in 2017 they have turned inward, legally eavesdropping on innocent American citizens. Your intimate dossier is secretly sold to law enforcement by a simple request, without any court supervision.

Its worse as router companies want to data mine you too by forcing a verified cloud account. Just like social media but worse.

The solution is easy in theory by not putting trust in for-profit corporations. Incidentally the recent Consumer Electronics show was consumed by insecure data-mining products. We are the products!
Never use any smart device (or at least cannot physically isolated).

Here is a comprehensive low-risk solution to isolate data-mining computing devices from each other and from your trusted wired home network. First only purchase a modem/router that can be immediately reflashed (before first use) with an open-source OS like DD-WRT:
ftp://ftp.dd-wrt.com/betas/2018/01-07-2018-r34411/.
Install the modem behind ISP modem. In the Basic Setup and set the DNS to somethin like 192.168.5.100

VPN companies would rather you install their software GUI on each device. No! Rather default to encrypt everything that leaves the house. Then the encryption may be inferior (read cheaper for the VPN). Here is AES 256 for PIA:
https://flashrouters.zendesk.com/hc/en-us/articles/115000717413-Private-Internet-Access-PIA-OpenVPN-Strong-Encryption-DD-WRT-Router-Setup-Guide

Exceptions
Some sources like Netflix don’t allow VPNs. Here is one solution: Your WRT OS router is serially chained behind the ISP modem. Don’t touch it.
Feed a dedicated Ethernet cable connecting from the ISP modem to the streaming device. Netflix already encrypts its content to also prevent ISP snooping. The 4K Amazon Fire is free for Prime members. Both are advertising free so its a deal for $15/month. This choice offers a superior solution to the coming personalized intrusive ATSC 3.0 OTA broadcasts. (No wonder Apple wants to buy Netflix)/

Is this system secure? Probably from Big Data but not from black-box elements of the intelligence agencies. Watch the movie American Made for a good example of who is running ‘the show’.

Clive Robinson • January 16, 2018 9:02 AM

@ echo,

The organisational response has been a shrug and C.) This is a historical record and there is no legal requirement to delete it.

Who ever said that is a bit of an idiot. It is a known false instrument that is in effect being used for the purposes of “fraud”.

There is case law about that sort of thing. The “This is a historical record” is actually a false argument, because it is not notorised as such along with an attached mark / record stating it is “a known prejudicial false record” and must not be used with out the mark / record being attached as well as a refrence to the tribunal decision. Also it should be fully audited to know who has had access when and why.

Which is why there are established proceadures that have been used in Government and the courts for a very long time now for having such files sealed for upto 100years and held only in the Public Records Office (in Kew South West London).

The rules are there for the protection of both parties as making known to be malicious falshoods is take quite seriously in English Courts and damages can be significant aside from other criminal charges (like malfeasance in public office had an open ended tarrif). Oh it’s also an offense to supply detrimental or false records when a request for a refrence is made to an organisation in the UK. To prevent detrimental code being used a court can make as part of the judgment an agreed refrence mandatory.

So the statment maker is not just on the edge of thin ice but well beyond the point where a contact with reality and an icy bath is overdue.

Clive Robinson • January 16, 2018 10:32 AM

US financial crisis ignored yet again

It’s probably lost on a lot of people in the US but your politicians are fiscally irresponsible to the point of no return and beyond.

You have an ageing population and a significant fall in tax base and working age population etc. It is not a good way to die (look at Japan) but it’s happening.

But one thing that could be safely done is cut back on out of control defence spending, which is the MIC milking “Security Theatre” for all it can. But your elected politico’s don’t want to go there, whilst also giving away hugh tax benifits to the top 1% of the population, which will also further their inflation proof “Rent Seeking Behaviours” at the expense of the other 99% of US population.

China has recognised this US problem by “downrating” US credit worthyness thus in effect upping the interest due by the US on it’s trillions of debt, which it is at best inadequately servicing…

There is of course another way which is increase GDP, but that requires an increase in work force. There are three ways this can be done,

1, Force the retirment age up.
2, Force the work entry age down.
3, Increase the working age population.

Forcing the retirment age up has the downside of also pushing average wages up. Whilst this will marginaly increase the tax take it will have other detrimental effects.

Forcing the work entry age down means less time on education therefore a less skilled workforce. As GDP normalised to head of population has a correlation with educational attainment, this might be likewise a bad idea.

Which leaves increasing the working age population. As the birth rate is declining and the average age is increasing. The US has a problem. To grow GDP to pay for increasing numbers of retirees means you either have to bring down the average age, or up the numbers of working age people. Thus the choice between euthanasia and immigration… As the US has had a falling average age for the past couple of years maybe the politicos are trying euthanasia in some way. As this is most likely to fall on the bottom half of society, people might want to find out how it is being done…

Personally if it was me I’d vote for policies that would increase the population, oh and alowing more well trained individuals in as they would have a significant effect on increasing GDP fairly promptly now…

Any way it appears I am not alone in these thoughts. Have a read of,

https://tinyurl.com/yc25xttq

It puts hard fiscal numbers flesh on the bones of the problem…

Clive Robinson • January 16, 2018 12:15 PM

@ Bruce,

Another bio-app on Apple assists murder investigation story for your files,

http://www.bbc.com/news/technology-42663297

Apparently the bio-app provided crucial evidence at a Germany trial, in which a refugee claiming to be 17 has been accused of rape and murder. The defendent refused to give his pin to the police however an unnamed company recovered the bio-app data which shows two unusuall bursts of “stair climbing” a little while after the murder.

Apparently a police investigator of similar build to the suspect recreated how the police believe the suspect disposed of the body. The recreation was carried out at the location where the body was found and the investigators movement data on the same app also indicated “climbing stairs”…

This same reading should however give rise to a degree of suspicion because the investigator and presumably the murderer did not actually climb or descend any stairs. Thus the bio-app was misreading the body movments involved.

echo • January 16, 2018 12:16 PM

@Clive

Thank you for your opinion. I will likely be unable to find a link (as I’m playing catch up with research). This item was reported in the mainstream media and from what I recall them saying this was a known trick this particular public sector organisation played. I hope your opinion helps inspire a narrative for anyone caught in this misfortune.

Clive Robinson • January 16, 2018 12:21 PM

On a more fun historical note.

It would appear it was not “little scabbers” who was responsible for the plague eperdemic –we call the black death– that wiped out a third of Europes population. Apparently it was infact “The Great Unwashed” humans and their lice and flea ridden clothing, that was likewise unwashed,

http://www.bbc.com/news/science-environment-42690577

Speaking of which after reading the article, for some strange reason I feel in need of a bath 😉

Clive Robinson • January 16, 2018 12:53 PM

WhatsApp vulnerable to Android malware

Since the denise of Italian company HackingTeam, the vacuum they left behind appears to be being filled by the creators of the SkyGoFree Android malware.

Importantly it appears the malware which is currently confined to an area around where HackingTeam used to be can perform an endrun attack around the Whatsapp aplication allowing exfiltration of the messages etc.

https://www.theregister.co.uk/2018/01/16/skygofree_android_spyware/

This appears to be a sophisticated piece of malware written by those with more than a little experience in doing so, hence the mention of HackingTeam may will be an indicator that past employees may be involved at some level.

What it also confirms is what I’ve repeatedly said about Signal and Whatsapp and similar supposadly secure messaging systems. Sophisticated attackers will not bother attacking the app when they can more simply do an “end run attack” to get at the HCI and read the message plaintext.

This sort of end run attack can always defeate any security app as long as the communications end point reaches further than the security end point… The only solution is to move the security end point off of the communications end point device Smart phone etc) onto another device where the only communications path is through the human mind.

It’s time the likes of Moxie Marlinspike resolved this issue by having a two part application. The first part running on the “Communications Device”, the second running on a non communications based “Display Device” that provides the human readable display. The path between the two going through the human in a securely encrypted way that is also “human friendly / readable”. The likes of a stream cipher that outputs in five letter groups might be one workable solution.

Davey • January 16, 2018 1:17 PM

Howdy, folks!

I wanted to share an anecdote about the US government’s concern over using foreign-made hard- and software. On a couple occasions, I have worked for US government contractors in a non-classified technical role, at a non-classified facility, in a non-classified limb off the Executive branch.

Back in the mid-2000’s, I went back to work at my old job. (Bad idea – I found that I grown up and no longer fit the culture. It ended badly.) The IT department fitted me with a brand new Lenovo desktop PC, which was one of a small group that they ordered.

About a month down the road, the IT director (who was a good friend) came into my office and told me that the Headquarters security people in DC had pitched a fit over the decision to buy Lenovo machines. They asked for the IP addresses of the Lenovo units and basically told my friend that they would closely inspect packets leaving those IP addresses for suspect traffic. We were both a bit freaked to think that we had personally gotten the undivided attention of the U.S. Dept. of _______.

The fact that some government people suspect foreign wares is quite unsurprising to me, considering the fact that I also had to report all contacts and communications with citizens of certain nations…

Thoth • January 16, 2018 6:49 PM

@Clive Robinson

As much as we can rant about the insecurities of using a smartphone or desktop to do our secure comms, I think we can consider that all secure comms not done via military style security is good as defeated.

Some might like to use ARM TrustZone-like Secure Enclaves and such to protect their algorithms and HCI interface or a variant of the ARM TZ which is Intel SGX or AMD PSP for security to mitigate the issue.

But it seems after Spectre and Meltdown, none of the Enclave technology, especially not the Intel SGX, can ever be relied on security anymore.

I remembered I previously posted a Github link containing works on using Spectre and Meltdown to compromise the Intel SGX and as we know, ARM TZ has been defeated in the past before due to bad implementation from Qualcomm and now Meltdown and Spectre can also affect ARM Cortex A series with the ARM TZ partition.

There is no secure compute on desktops or smartphones due to Spectre and Meltdown and these two seems to be the final blow at the myth of the security and privacy protection these Enclave technologies have attempted to promise.

Clive Robinson • January 17, 2018 3:58 AM

@ Thoth,

There is no secure compute on desktops or smartphones due to Spectre and Meltdown and these two seems to be the final blow at the myth of the security and privacy protection these Enclave technologies have attempted to promise.

In a way I’m glad Meltdown and Spectre have come to light as it alows me to say a little more than I could in the past about secure design.

As I’ve pointed out in the past secure design is not particularly difficult, it’s knowing how the laws of physics apply and how to stop energy that has information impressed/modulated upon it from getting out from one part of the design into another. At the basic level you are talking about making the system up of many segregated parts that have no connection with each other, except via “choke points” that have their bandwidth and timing strictly controlled.

However the result of building equipment that way is large, slow, heavy and expensive. As people who have seen what is now called TEMPEST equipment used in the 1960’s will know. Some of it despite the other downsides was kept in service even upgraded untill well into the late 1980’s ( http://www.cryptomuseum.com/crypto/uk/bid610/index.htm )

This sort of design kind of “flys in the face” of most modern highly integrated design where everything is not just shared but has a myriad of interconects with bandwidths that are getting closer to the old “DC to Daylight and beyond” that unrestricted free space has. In fact if you did not care about the TEMPES aspects the whole of a system like the BID610 and BID700 could be easily put on a 1-2USD microprocessor or SoC system.

Thus modern design is about shared resources that are “main bus” connected thus in effect have no segregation let alone physical seperation and there are no choke points to constrain the flows of information.

Thus in embbeded systems you end up with a block of Flash ROM, a block of RAM, CPU and I/O block. Virtually every thing done in software thus all functions are together in the Flash ROM, all secrets in the ROM the only thing providing only a semblance of segregation is the software which is generally too complex to be considered “Fully Tested”. Thus anything with access to the RAM can get at the various in use secrets and anything that can get at ROM can get at design secrets such as algorithms. The only protection being at the CPU level of the computing stack. Thus anything that can reach down like Rowhammer can change not just secrets but the access to them. Likewise anything that goes around the CPU such as DMA I/O or any of many attacks from the levels below the CPU.

But in theory such attacks can be spotted in various ways or more easily designed out. Which was what the Castles-v-Prisons design was in part about, as others are finally comming to realise.

As I’ve mentioned we’ve not heard the last of these below ISA on the computing stack attacks, and eventually people will realise that the old “large, slow, heavy and expensive” designs worked. Thus think they are the way to go to get “secure” but “functionally limited” systems. Without realising there are alternative solutions now available made possible by parallel redundant systems that are in effect massively segregated not just electrically but in time as well.

If you think back to C-v-P the prototype for prison testing consisted of two microprocessors. One that ran the desired sub function and one that acted as a MMU controled not by the prison CPU but the hypervisor CPU to shared memory needed for IPC. What I did not make clear at the time was that the IPC memory would be encrypted and that Key Managment (KeyMan) would also be controled by the hypervisor system.

As you have been thinking about C-v-P you will realise what advantages having the main memory encrypted under many different keys will have. That is each prison comms channel will have it’s own key to talk to it’s IPC partner be they up stream or down stream functionaly. Provided the design of both the MMU and Crypto unit is secure then shared resource security becomes possible at the extra expense of KeyMan.

If you think about it, if a single CPU system had it’s process and kernal resources encrypted by a per process encryption key. An attack from one process on breaking the page tables would just give encrypted data from another process space, thus it’s security would be equivalent to that of the crypto system in use.

The specific details as always are a little more complex than the overview but I think you can see how the idea works out in practice.

JG4 • January 17, 2018 6:41 AM

Thanks for the excellent discussion and information. I hope that the sharper knives in the drawer were able to connect the dots yesterday from my Dante paraphrase to the Japanese brain-function fMRI observation system. That’s why I put the headlines into the Risen post. Even brains leak side-channel into EEGs and the bright illumination of an MRI system. EEG data are notoriously noisy and lack the dimensionality of MRI. The knuckle-draggers probably use polygraphs because the technology of EEG is too finicky. We might guess that will change, because low-noise amplifiers are a lot cheaper than large magnets. And computing makes it ever easier to extract useful information.

Can’t recall if I posted this before, but it is useful in considering security. Even if you know the transfer functions of a three-body system exactly, you still cannot make predictions without knowing the exact state of the system at a point in time. In the Newtonian worldview, you could predict all future states from the present, but in point of fact, quantum mechanics guarantees that even with the best information possible (limited by the uncertainty principle), your system will diverge from the predicted trajectory. That doesn’t generally apply to conventional digital computing systems, which diverge for other reasons like cosmic ray hits, natural radioactivity of cpu materials and rowhammer.

http://epsilontheory.com/three-body-problem/

We can note that Intel made the same mistake as Microsoft, in effect assuming that their computing systems always will run in a protected environment. The flaw in that thinking has been clear for roughly 20 years, and neither have addressed it adequately. In C-v-P, the ideal case is that the crypto blocks are custom-made to fit between the other pieces.

nice graphical data presentation. thanks for the tips about Tufte, Minard and the art history guy

https://image.ibb.co/e53o7R/Five_Horsemen_Jan_16_2018.png

https://www.nakedcapitalism.com/2018/01/200pm-water-cooler-1162018.html

…[the TAILS distribution spell-checker went nuts on the Crapification section, flagging many words as mis-spelled, even though they’re not. perhaps one of the sharper knives in the drawer can run a hex editor on the original and this version to see some hidden characters that tripped up the spell-checker. it’s the first time that I’ve seen this happen]

Crapification Watch

“I think Google has stopped in­dex­ing the old­er parts of the We­b. I think I can prove it. Google’s com­pe­ti­tion is do­ing bet­ter” [Tim Bray] (Bray works for Amazon, but has great credibility for his standards work). “This isn’t just a proof, it’s a rock-n-roll proof. Back in 2006, I pub­lished a re­view of Lou Reed’s Rock n Roll An­i­mal al­bum. Back in 2008, Brent Sim­mons pub­lished That New Sound, about The Clash’s Lon­don Calling. Here’s a chal­lenge: Can you find ei­ther of these with Google? Even if you read them first and can care­ful­ly con­jure up exact-match strings, and then use the “site:” pre­fix? I can’t. [Up­date: Now you can, be­cause this piece went a lit­tle vi­ral. But you sure couldn’t ear­li­er in the day.]… My men­tal mod­el of the Web is as a per­ma­nen­t, long-lived store of humanity’s in­tel­lec­tu­al her­itage. For this to be use­ful, it needs to be in­dexed, just like a li­brary. Google ap­par­ent­ly doesn’t share that view.” I’ve had the same experience; I will search Google for words I know I have written, and they won’t come up. But it’s good to have my experience validated, as we say, by a personage who is not a random blogger.

…[a nice example of transfer functions in systems analysis. could just as easily be control signals in a cpu]

Neoliberal Epidemics

“How could differences in ‘control over destiny’ lead to socio-economic inequalities in health? A synthesis of theories and pathways in the living environment.” [PubMed]. “We conducted the first synthesis of theories on causal associations and pathways connecting degree of control in the living environment to socio-economic inequalities in health-related outcomes. We identified the main theories about how differences in ‘control over destiny’ could lead to socio-economic inequalities in health, and conceptualised these at three distinct explanatory levels: micro/personal; meso/community; and macro/societal.” Handy diagram:

https://www.nakedcapitalism.com/wp-content/uploads/2018/01/diagrram.jpg

…

“AI learns how to fool speech-to-text. That’s bad news for voice assistants” [The Next Web]. “A pair of computer scientists at the University of California, Berkeley developed an AI-based attack that targets speech-to-text systems. With their method, no matter what an audio file sounds like, the text output will be whatever the attacker wants it to be.” So much for transcripts…

…

echo • January 17, 2018 9:44 AM

I have been very impressed with the thought which went into post WWII era systems. Today many things are very impressive too in their own way and democratised. Would it be fair to say that the dialogue is now about creating high assurance democratised systems?

@JG4

Thanks for the decision making and inequality link.

Thoth • January 17, 2018 8:28 PM

@all

2FA schemes doesn’t take off because:

  • they are too technical
  • they are too cumbersome
  • they require too much gadgets and dependencies
  • the 2nd factor is insecure (i.e. SMS) and makes very little difference

These are the fatal mistakes that make 2FA schemes probably are going to trip up against.

Google’s GMail team noticed this trend and are trying to increase the hit probabilities of their detection system but it’s not going to solve the 2FA problem until they fix everything above.

Even with 2FA enabled, the session cannot be considered provably secure since there’s the OS, browser, software and hardware stack and everything in between to consider which Meltdown and Spectre kinda showed the nasty side of assuming security on any one layer and the consequences of breaking that assumption.

Link: http://www.theregister.co.uk/2018/01/17/no_one_uses_two_factor_authentication/

tyr • January 18, 2018 3:57 AM

@Clive

1, Force the retirment age up.
2, Force the work entry age down.
3, Increase the working age population.

1 is pretty counterproductive unless you believe
in the wisdom of all the aged.

2 the educational system is so abysmal that giving
young people something udeful to do won’t ruin
anything.

3 is easy it is called welcoming immigrants so you
can tax them for generations while you overwork
them.

Since the current moronics don’t want any of the
extended childhood to be productive and immigrants
are tagged as the root of all problems. All you have
left is to make a geriatric welfare state disguised
as industry.

I was quite bemused by (subject change) the merkin
plan to arm 30,000 of Murray Bookchins deep ecology
anarchists in Syria (the Kurds). Like most of the
junior ossifer wet dreams of the recent past what
could possibly go wrong with this one.

I am also amazed that they seem to be mis-reading
NKs last missle test and worrying about the west coast
when NK could reach that for years. Now they can
reach the east coast. That’s why they are more
relaxed in NK circles.

I’m glad the omnipotent rus are running the world
now…: ^ )

I just watched a documentary about Sibel Edmonds so
the current investigations have little danger of
exposing much in the way of truth while selling a
lot of popcorn on the side.

justina colmena • January 18, 2018 12:51 PM

“Dude Food”

Ick. I see that fat male Sumo wrestlers are eating all too well while skinny “beautiful” girls and women are forced to remain on a strict diet. I do not want it in the United States.

justina colmena • January 18, 2018 1:16 PM

@Thoth, Clive

There is no secure compute on desktops or smartphones due to Spectre and Meltdown and these two seems to be the final blow at the myth of the security and privacy protection these Enclave technologies have attempted to promise.

People didn’t realize that until Bitcoin reached $10,000/BTC. I can’t even read my own e-mail or log into my own bank account until those Chinese chipheads fix the broken-by-design made-to-fail consumer-level computer hardware they sell to us in the U.S.

Oh, yeah, we gave up the right to manufacture our own electronics in the United States when Obama signed us on to the top-secret Trans-Pacific Partnership trade deal through the ultra-secretive Trilateral Commission.

  1. Force the retirment age up.
  2. Force the work entry age down.
  3. Increase the working age population.

We need a way off disability, too. There are people who choose to be blind and rich rather than poor and seeing, or missing a leg and rich, rather than poor and able to walk. MAYHEM. Major disability fraud. Organized crime. Many, many doctors are complicit. They screwed up the laws on it, too.

I’m “mentally” disabled. Permanently and irrevocably barred by law from any number of professions as well as from owning firearms, because of false medico-legalistic allegations of mental illness at law. No way out under current law. Mental health records cannot be expunged. Not enough money to rent even the most rudimentary place of abode, but it’s supposed to be such a sweet gig under Omertà that I’m supposed to shut up about it so I don’t ruin it for everyone else.

It’s gas mask time. We are so far beyond any pretense of “civil” or “legal” with this, it is not even funny.

Sancho_P • January 18, 2018 5:15 PM

@tyr, Clive Robinson

What’s called GDP is similar to our speed on the way to hell.
With all our technics, communication, knowledge and science it seems we avoid to see the context.
Max GDP for our canoe is a physical constant, and we are far beyond that point.
GDP is not a solution, it is part of the problem.
To increase the GDP means to increase the problem.

We humans are completely unproductive. Standing at the top of the food chain we are pure consumers, not only futile but hostile to nature.
To ”increase the population” means to increase the problem.

Clive Robinson • January 18, 2018 8:00 PM

@ Sancho_P,

To ”increase the population” means to increase the problem.

There is more than one way to increase the population in a given area.

Whilst a decrease in the worlds population is to some people desirable, it’s not happening the way they want.

As a perhaps over generalised observation, as a geographic region moves from agrarian to industrial society the birth rate drops. The argument for the larger birthrate is supprising to many not to do with lack of contraception, but death rate of infants/children and the need to have sufficient children to provide food / shelter / etc when the parents are too old to carry on agrarian labour. This normally means five ti six children depending on the sex ratio.

In essence in agrarian societies your “Children are your pension”. However what most people do not think of in industrial societies is that children are your pension as well. That is it is a percentage of the economically active that pays for your retirment, not what you put by in terms of a pension fund or scheme whilst you work. Without a growing economy and GDP there would be no way for people to retire before they became infirm. That is quite literally “Work till you drop”.

To make matters worse there is a belief in employers for the “highly skilled” to be not just necessary but also payed as little as possible. Thus they spend six to ten years being economically inactive whilst getting Further Education and large debts. Realistically ten years is one quater of your economically active life…

Thus the whole system as currently set up is compleatly unsustainable.

The question thus arises do you work the 50years our great grandparents did by going to work at 14 and retiring at 65 to be in a physical state that you have maybe 10 years retired in economic penury. Which is economically sustainable. Or do you spend 25 years learning incuring around 5 years of debt which will take 20 years to pay off then try and earn sufficient excess income in the next 20years so you can try and live another 25-30years on the interest of your 20years of savings… Which is not just unsustainable it’s impossible, especially as the lack of resources means the bulk of the population has to pay the “rent seekers” everything they earn above subsistance (or even more) so the 1% or less can have a very good lifestyle into their 110year expected lives. The fact that the average US lifespan has drooped yet again whilst that of the upper 10% of the population has increased should be ring big bells and waving large flags that the US economy is well and truly broken to the point it is killing by far the majority of people faster year on year…

If you know how to solve this sing out loud and proud because few politicos even want to acknowledge theres a problem, because they know in their scrawny little spines that the citizens might just decide to follow the advice of an earlier politician about feeding the tree of liberty. With the politicos and their string pullers getting to be the first fertilizer… Then again as the US has about ten times the average standard of living and other Western Nations about twice, it might not be the US citizens feeding US politicos to the tree of liberty. But one of many nations deciding enough is enough and not to play the game the US way any longer.

The Obama “insurance policy” of secret very one sided trade negotiations fell through. And the clock is running quite fast as those trillions of debt and interest keep mounting up. The US has had it’s credit worthyness downgraded recently which means those interest rates on the debts goes up… Some people think that the US will pass the point of no return in the early part of the next Presidential term, others put it a term or two later few put it much further if US politicos keep spending what they have not got…

tyr • January 19, 2018 12:30 AM

@Clive

As long as the Federal Reserve has a printing
press we won’t run out of money. However it
may become worthless outside USA which might
cause some readjustments to the system.

Someone (probably the embedded Turks) decided
that arming lots of Kurds in Syria might be a
bad idea. : ^ ) As I recall the Romans never
passed out weapons to their enemies. Though
some became enemies after being friends like
Teutoberger Wald. It was the high watermark
of their expansionism.

The real trouble with making everybody into an
enemy to keep your budget coming in (IC plan)
is that you wind up surrounded on all sides by
folk who won’t lift a finger to help if you
need help. This kind of policy is what had the
wehrmacht killing the SS in the last days of
WW2 because they kept stirring up civilians
behind the lines adding more enemies behind
them.

Clive Robinson • January 19, 2018 2:13 AM

@ tyr,

As I recall the Romans never passed out weapons to their enemies.

I’d say look up the history of the Romans in Britain, with regards the peacful Iceni and the taking of ceremonial swords, forcing of userus loans and other atrocities. The result being in AD 60ish “Boadicea” –as the later Roman’s called her– raising the tribes and destroying Colchester, London and St Albans.

But you only get the later Roman writings as the Iceni although having records did not have them in written form… Thus their side of the story is unknow. However enough was written by Roman writers to know that she almost certainly was a wronged woman in many ways.

From an American point of view there is an important historical lesson in there about how Empires fall.

Sometimes it’s not the “Barbarians at the gate” but the poison from within giving rise to madness and worse.

Ivan Petkel • January 19, 2018 3:13 AM

Just a reminder: Today exactly 20 years to 19 January 2038. I just wonder how many IoT-installations using signed 32-bit value for the time are sold today and will still be there “in the field” in 2038?

Sancho_P • January 19, 2018 3:38 PM

@Clive Robinson

”Without a growing economy and GDP there would be no way for people to retire before they became infirm.”
The reason you mention for the imperative need of a growing economy is one of the often cited killer arguments.
However, it neglects the use of sophisticated tools, machinery, resources and immense external (not human, e.g. fossile) energy.
It may be that a lot of our working force is lost on unneeded products and activities (e.g. war, luxury), but after all, the need of growth to sustain our pensions is dubious.
Better management would do the same.

”Thus the whole system as currently set up is completely unsustainable.”
That’s right, but hopefully they will find out only after us.

tyr • January 19, 2018 9:50 PM

@Clive Sancho P.

Apres Moi the deluge.

Caesar Gallic Wars used to be required reading
for educated folk since it detailed how to get
a leg up on enemies when you were outnumbered.
Divide and conquer being the base idea. I have
not seen anyone who advocated multiplying of
your enemies by random acts of stupidity.

However everyone has a plan that will not work.

That plan usually starts This is the only way
to solve problem X. Falls in the same category
as If this is allowed to happen it will be the
end of civilization as we know it. That one is
a dead giveaway that the argument against is
bogus since it has never proved to be true in
the past. No reason to believe it will be true
now.

Immigration is the stopgap to maintain retirements
otherwise you overburden society with declining
population. Since most societies could care less
about children except for those known as primitive
there is no easy answer for misguided economists.

Clive Robinson • January 20, 2018 12:04 AM

@ tyr, Sancho_P,

Immigration is the stopgap to maintain retirements

I wish people would stop defining a mobile workforce over a wide area,as “immigration” as the word carries significant negative connotations by those seeking control of economic resources.

But yes a mobile work force is a temporary solution to “some problems” but by no means all.

One scary solution to the retirment issue is that of healthcare starving / rationing. That is the older you get the less access you are given to health care, or in the US version of the system the more expensive you make it. Thus the less access to resources you have the shorter your life becomes. In effect you get given a “no choice” offer, remain economicaly productive longer or die younger…

Such policies disadvantage “blue collar” workers over “White collar” workers due to industrial and manual labour infirmities, three times over. Firstly because of the much higher incidence of such longterm infirmities. Secondly the lower rates of pay during the working life time means less adiquate provison. Thirdly Health Care insurance companies full well know this and thus make blue collar policies more expensive…

Something you can read between the lines of a certain political parties arguments over Obama Care which tried to even things up. Or if you prefere the truth a little more raw, it is those with an “unjustified sense of entitlement” using every trick they can to ensure they get the entitlement at the expense of every one else.

There is a basic principle of social parity, that is in effect a tithe, where every one pays a petcentage of their income for “social goods” such as infrastructure both physical and social. Those with an unjustified sense of entitlement believe that not only are they are exempt from such payments, but that infact they are owed the full and immediate benifit of social goods paid for fully by those they consider lesser individuals…

It’s the thinking behind the “status gap” those with an unjustified sense of entitlement belive is theirs by right of who they think they are (some call it “spoiled brat” syndrome).

JG4 • January 20, 2018 8:02 AM

Thanks for the continued great discussion and ideas. I’ve mentioned system identification a few times and started to describe it. This is a beautiful example of a practical use. We can think of this as a flavor of deconvolution, where the words and content are separated from the physical channel characteristics (loosely, the larynx and mouth).

I’m surprise that they missed my main concern, which is the ability to perfectly spoof anyone’s voice. As bad as Matthew Weigman’s misdeeds were, they pale in comparison to the focused disruption that could be brought to bear on political dissidents. Another major concern is that with perfect information about everyone, no one will be immune to coercion in service of the State, its psychopaths and sociopaths.

https://theintercept.com/2018/01/19/voice-recognition-technology-nsa/
…
These and other classified documents provided by former NSA contractor Edward Snowden reveal that the NSA has developed technology not just to record and transcribe private conversations but to automatically identify the speakers.
[…this is disinformation, because every powered cell phone is doing this]
Americans most regularly encounter this technology, known as speaker recognition, or speaker identification, when they wake up Amazon’s Alexa or call their bank. But a decade before voice commands like “Hello Siri” and “OK Google” became common household phrases, the NSA was using speaker recognition to monitor terrorists, politicians, drug lords, spies, and even agency employees.
[…this is a flavor of system identification]
The technology works by analyzing the physical and behavioral features that make each person’s voice distinctive, such as the pitch, shape of the mouth, and length of the larynx. An algorithm then creates a dynamic computer model of the individual’s vocal characteristics. This is what’s popularly referred to as a “voiceprint.” The entire process — capturing a few spoken words, turning those words into a voiceprint, and comparing that representation to other “voiceprints” already stored in the database — can happen almost instantaneously. Although the NSA is known to rely on finger and face prints to identify targets, voiceprints, according to a 2008 agency document, are “where NSA reigns supreme.”
…
“Dramatic” Results
A partial history of the NSA’s development of speaker recognition technology can be reconstructed from nearly a decade’s worth of internal newsletters from the Signals Intelligence Directorate, or SID. By turns boastful and terse, the SIDtoday memos detail the transformation of voice recognition from a shaky forensic science conducted by human examiners into an automated algorithmic program drawing on massive troves of voice data. In particular, the memos highlight the ways in which U.S. analysts worked closely alongside British counterparts at the Government Communications Headquarters, or GCHQ, to process bulk voice recordings from counterterrorism efforts in Iraq and Afghanistan. GCHQ, which declined to answer detailed questions for this article, praised its systems in internal newsletters for “playing an important part in our relationship with NSA.”
…

JG4 • January 20, 2018 8:23 AM

@Rachel – Thanks again for the tips on electrolytes. My estimate for the out-of-pocket for the last hospital episode was not far off – the tally is close to $3K. I think that I said that I’ve been feeling better since I started getting enough magnesium, but potassium, calcium and sodium may help even more. My initial recognition of the magnesium problem seems to date to mid-June 2017. In recent weeks, I’ve been much more careful to get enough potassium, which has a surpringly large recommendation of 4.7 grams per day. It has been rare that I got enough potassium over the past 30 years. My glucose levels are better and more stable, my cognitive abilities are almost like the good old days and I don’t have the abdominal pain. These twin deficits underly at least some of the lifestyle diseases caused by “the diet of commerce,” which is overloaded with hydogenated oils, starches and sodium, while being deficient in potassium and magnesium. The return of cognitive abilities probably is incomplete, as there always is residual damage in living systems that are pushed out of equilibrium. The effect of my writing may be obvious. That got me thinking about lithium again and I searched to try and find our discussion of the Danish lithium study. If we live long enough, we all will get dementia. I was able to find the mention of “happy water” and today I was able to find the NYT version of the story. One of the links that I suggested for happy water was broken. The subject of mineral supplements, in the absence of sufficient dietary intake, is worth a short excursion off-topic, as it may improve our cognitive abilities.

https://www.nakedcapitalism.com/2018/01/links-12018.html

…

Google CEO Sundar Pichai says AI is more profound than electricity or fire The Verge (David L). “‘He would say that, now wouldn’t he?’”

How to tame the tech titans Economist

…

Big Brother is Watching You Watch

Finding Your Voice Intercept (Bill B)

Can Software Predict Crime? Maybe So, but No Better Than a Human New York Times (David L)

Imperial Collapse Watch

CDC to Scale Back Work in Dozens of Foreign Countries Amid Funding Worries Wall Street Journal

Trump Is Turning the State Department into a Global Weapons Dealer Alternet (Kevin W)

…[possible further evidence that the FBI are dirty and always have been. they may have been weaponized by the Obama/Clinton administration]

Fierce battle erupts over declassifying intelligence report The Hill:

Scores of Republicans viewed the controversial memo in secure settings at the Capitol and concluded it contains hard evidence that the special counsel investigation into whether Trump’s campaign officials had improper contacts with Russia were sparked by the politically motivated actions of senior FBI and Department of Justice (DOJ) officials.

…

Clive Robinson • January 20, 2018 9:02 PM

@ Sancho_P, tyr,

Before discussing possible solutions it’s mandatory to understand the situation.

Unfortunately in life that little requirment is moot more often than not.

The starting point is recognizing there is a problem in the first place. Most Western Governments know without doubt that there is a problem. But… the citizens in the main do not. By far the largest part of the problem is Western Governments do not want the population realizing there is a very real problem.

Why that might be so is perhaps the 9/10ths of getting the problem solved.

But how do you get a government to stop,

  1. Lying to the citizens.
    2, Withholding information from the citizens.

Oh and then there are the “Markets”, they are designed to hide the fact that for all but a few they are robbing people blind. Most “pay in pensions” via emplouers etc are in effect badly run, and over charge, which whilst you might not notice in times of higher inflation bite realy hard when interest rates are realy low.

I could go on, but it’s probably safest to say that large pots of money which pension funds generaly are, atract the worst forms of “shark”. One such a decade ago was “Hedge Funds” which were bamboozling fund managers into handing over lots of pension money with very high fees and wild promises of profit… Sensible people were saying “Do NOT touch” but many pension funds forked over capital that shrank via the high fees (3% or more). Oh and then did not get the rewards prommised in part because “Hedge Funds” are way way to risky oh and they also have another set of fees for earnings (2% or more). Put politely the managers were “eating the sugar befor the candy could be made to go into the sweet shop”…

But “shush don’t say anything” after all where do the campaign funds come from? That’s right the people that manage those hedge funds and similar…

tyr • January 21, 2018 2:05 AM

@Clive. Sancho P.

It is hard to get people to understand something
when their livelihood depends on not understanding
it. Markets are a creation of the State but moderns
envision them as something disconnected from the
governments. They are also as new as an electric
toothbrush.

The slippery slope that allowed them to disconnect
from oversight is one of the greatest shell games
ever pulled off on a population.

USA seniors are a cash cow for the medical folks
you can make big money off the government and big
pharma is right there to help you by doping them
to the gills so they don’t notice much. Medical
tourism is a partial solution but not everyone
can afford to shop internationally just for a
repair.

Popcorn season has arrived with the refusal to
keep government open while blaming someone else.
The Soviet Union collapsed because it couldn’t
keep food on the supermarket shelf. We can’t seem
to do something as simple as keeping government
running. I have never met a voter who thought it
was part of their mandate to a representative.

It is hard not to feel entitled if you paid into
something your entire working life. : ^ )

Clive Robinson • January 21, 2018 6:55 AM

@ tyr, Sancho_P,

It is hard not to feel entitled if you paid into something your entire working life.

If you have paid in fairly then yes you have a good reason to expect fair treatment.

But those who are “unjustly self entitled” do all they can to pay nothing let alone fairly. They would rather spend their money buying the legislatures. Have a look at the latest US tax legislation to see a “shell game in progress” that is who gets the sunset clause and who does not. Then figure how many times that can be used to buy citizens votes, whilst giving more and more to their paymasters…

Likewise the “unjustly self entitled” either buy a hospital or health care insurer, or invest in one using an “off shore” financial vehical or similar. So not only do they get a nice return on the investment, no or “efficient” taxes but also part of the deal being they are always head of the que for all health care, but also first for the big discounts or waived fees. Thus in effect they get it better a lot better than for free…

That’s all part and parcel of the “Free Market” game. Economists try to keep it under the carpet with the “hidden knowledge” argument that it’s “the consumers fault” for not asking the right questions prior to purchase thus not just allowing but actively funding the dishonest behaviour… But then you need to see who pays for those economists nice offices, accademic tenures, conferences and meetings at the likes of the Davos Summit etc…

As has been oft remarked “follow the money” and see which pocket it comes from and which pocket it greases on the way in. But take care grease is slippery stuff and those not taking sufficient care have been known to slip up and fall a very long and sometimes terminating way, journalists and whistle blowers alike.

Sancho_P • January 21, 2018 5:40 PM

@Clive Robinson, tyr

Yes, there are many bad people out there.
But (re growth):
”Most Western Governments know without doubt that there is a problem.”
I don’t think so.
It is difficult to distinct between disingenuity or stupidity, especially because from the latter there are so many flavors of it.
However, in this case to be disingenuous would be purely evil, against the own family, against the own breed.
This is unlikely for such a lot of humans, from economists to politicos, from scientists to philosophers.

I think it’s their narrow view, their walled garden, their lack of experiencing our beautiful world, nature, diversity, cultures and the universe.
They may study from books for years and years, but no one [1] in costumes and ties can understand life in a two week’s vacation.

Disingenuous or simply stupid, it doesn’t matter.
In just a couple of years they will sell us shockingly bad news regarding our fate and how we, the sheeple, since decades failed to see that permanent growth is deadly.

This might be similar with security: In a couple of years they will sell us that the “security thing” must be fixed before we run our world on IT …

[1]
esp. not the old white men …

Anonymous2b • January 28, 2018 2:59 PM

@Rachel

Regarding 100 Latest Comments you wrote

“I too found it hard to keep up and desired a top 500.. I’m sure it’s common.
I had to forgo the top 100 with the introduction of the ‘click here to read more’ . So I definitely miss a lot. For one thing I only read the top 100 offline, on the go. And the click follow through takes me to the TOP of the new page. Requiring I hand scroll through 150msgs, to the truncated message – oh look there was just two words to go. Back I go, repeat.”

I seem to recall Bruce or the Moderator asking or telling a frequent, or long time, contributor to this blog something like adjust your usage method or learn to live with it.

btw,
I think clicking on “Read More –>” usually, but perhaps not always, takes me to the correct spot to continue to read when I click that link as “Open Link in New Tab” when using Firefox or Safari.

Anonymous2b • January 28, 2018 3:54 PM

@Routers Example

You wrote

“Imagine you are battling against a team of ruthless psychopaths who’s main goal is to analyze every packet sent on your home network (especially those to the Internet) then monetize by sharing with Big-Data.”
+1

Our crazy USA FCC also recently made it legal for ISPs to perform deep packet inspection on your Internet data (NO privacy). They are now free to insert advertising too. My ISP has partnered with the NSA since 2005 examining data packets at the borders. Now in 2017 they have turned inward, legally eavesdropping on innocent American citizens. Your intimate dossier is secretly sold to law enforcement by a simple request, without any court supervision.”

+1; your on a roll; I’ll stop interrupting you now.

“Its worse as router companies want to data mine you too by forcing a verified cloud account. Just like social media but worse.

The solution is easy in theory by not putting trust in for-profit corporations. Incidentally the recent Consumer Electronics show was consumed by insecure data-mining products. We are the products!
Never use any smart device (or at least cannot physically isolated).

Here is a comprehensive low-risk solution to isolate data-mining computing devices from each other and from your trusted wired home network. First only purchase a modem/router that can be immediately reflashed (before first use) with an open-source OS like DD-WRT:
ftp://ftp.dd-wrt.com/betas/2018/01-07-2018-r34411/.
Install the modem behind ISP modem. In the Basic Setup and set the DNS to somethin like 192.168.5.100

VPN companies would rather you install their software GUI on each device. No! Rather default to encrypt everything that leaves the house. Then the encryption may be inferior (read cheaper for the VPN). Here is AES 256 for PIA:
https://flashrouters.zendesk.com/hc/en-us/articles/115000717413-Private-Internet-Access-PIA-OpenVPN-Strong-Encryption-DD-WRT-Router-Setup-Guide

Exceptions
Some sources like Netflix don’t allow VPNs. Here is one solution: Your WRT OS router is serially chained behind the ISP modem. Don’t touch it.
Feed a dedicated Ethernet cable connecting from the ISP modem to the streaming device. Netflix already encrypts its content to also prevent ISP snooping. The 4K Amazon Fire is free for Prime members. Both are advertising free so its a deal for $15/month. This choice offers a superior solution to the coming personalized intrusive ATSC 3.0 OTA broadcasts. (No wonder Apple wants to buy Netflix)/

Is this system secure? Probably from Big Data but not from black-box elements of the intelligence agencies. Watch the movie American Made for a good example of who is running ‘the show’.”

FWIW, many more +1s, although I have limited expertise.

Our surveillance states seem to function with most of us clueless. Most of my customers are low tech, support costs are an issue, and, at least at times, I am tired of learning. One of these days, I may mess around with router flashing. Until then, I’ll probably stick with Apple Airport Routers,
https://www.apple.com/shop/product/MC414LL/A/airport-express?fnode=58
https://www.apple.com/shop/product/ME918LL/A/airport-extreme?fnode=58
which are sometimes available used, or refurbished at
https://www.apple.com/shop/browse/home/specialdeals/mac * from this web page, sometimes, when Mac Accessories is not greyed out

On rare occasions I have port forwarded, double NAT enabled for guest Wi-Fi on Apple routers.

Question for all:
With routers using “Double NAT”, is it common to have to have to use port forwarding with paid for VPNs?

Someone at Apple told me that since they are still selling these routers they will probably provide security patches for 5 more years, even if those routers are discontinued. Regardless, Apple recently patched its’ routers against the “Krack” attack.
https://support.apple.com/en-us/HT201222 Apple security updates

Echo Device +1 877-264-9747 • January 7, 2020 6:42 AM

Need Alexa Troubleshooting for issues like Fix Amazon Echo 73001 Error, Fix Alexa Error 6:1:103:10:3, Alexa Won’t Connect to WiFi, How to Connect Alexa to WiFi, Echo Registration Failure Error, How to Reset Echo Dot, Alexa Device Offline, Echo Dot Offline, Alexa Not Responding, Alexa Slow to Respond, How to Connect Alexa to WiFi, Alexa Not Discovering Devices, Alexa Having Trouble Understanding, or looking for experts to help you in Alexa Setup, How to Setup Alexa, How to Setup Echo Dot, Echo Dot Setup, etc, dial +1 877-264-9747 Alexa Helpline Number anytime or visit echodevice.support.

Electron0x63 • January 7, 2020 10:58 AM

Dude food?

Is that rumored to have aphrodisiac qualities or to cure impotence?

Or if it does not have such qualities naturally, is it artificially enhanced somehow?

There’s a whole yin-yang nightclub effect to the “scene” where such food is often prepared and served professionally, and Asians and especially Japanese have certain ways of talking about things like that vis-à-vis male versus female.

dwayne johnson • July 3, 2020 2:02 AM

Alexa Helpline’s experts available 24/7 to help you troubleshoot Alexa issues that troubles you a lot like Amazon Echo Error 73001, Alexa Error 61103103, Alexa Won’t Connect to WiFi, How to Connect Alexa to WiFi, Connect Amazon Echo to WiFi, Echo Registration Failure Error, Reset Echo Dot, Alexa Device Offline, Echo Dot Offline, Alexa Not Responding, Alexa Slow to Respond, How to Connect Bose Speaker to Alexa, How to Connect Bose Speaker to Echo Dot, how to make a video call on echo show, how to video chat with echo show, how to connect security camera to Alexa, how to connect SiriusXM to Alexa, SiriusXM not working on Alexa, Alexa Setup Help, Alexa Echo Dot Setup, Echo Dot Setup, Alexa App Helpline, Alexa App Offline, and more, but no worries now, call Alexa Helpline Number Toll-Free at +1 800-795-6963 for instant support.
Smart Echo Help

How To Reset Echo Dot

Echo Dot Setup

Setup Alexa

How To Connect Alexa To WiFi

Alexa Slow To Respond

Alexa Device Offline

Amazon Echo Error 73001

Alexa Having Trouble Understanding

Alexa Not Responding

Blink Camera Not Recording • December 23, 2020 4:26 AM

When you have found that your Blink Camera Not Recording for a long time, you should check the cables, batteries inside the camera, power connection, wifi device, etc. All of these things are the main factors behind Blink Camera Not Recording Clips. This is why we would like to suggest you call us on given Blink Security Cameras. So, don’t think much and reach Blink Camera Customer Service Number Toll-Free at 1 800-983-7116, experts there 24/7.

Blink Camera Not Recording Clips

Blink Security Camera

Security Cam Helpline

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.