Comments
Sofa • April 5, 2019 5:24 PM
Someone posted this in an earlier thread this week:
Michigan Medical Practice Folds After Ransomware Attack
I thought it was interesting. The value of backups should not be underestimated.
- Sofa
Jabba • April 5, 2019 6:31 PM
@sherma “Does anyone know if this is true?”
Worse than being true or false it is not relevant. Attackers attack the end points, not the encryption.
Sherman Jerrold • April 5, 2019 7:30 PM
@jabba,
So, if I understand correctly, the only time the encrypted file would be an ‘end point’ and vulnerable to attack, is when it is plugged into a computer connected to the internet. And, since this is very seldom and in those rare cases, almost always less than a minute in duration, would that not likely greatly reduce the amount of time it would be visible/vulnerable? To prevent that usb drive from being a connected ‘end point’ I keep a printed copy of that encrypted password file and referring to it.
MarkH • April 5, 2019 10:37 PM
Death by Automation, continued …
Killer robots aren’t usually person-shaped.
A couple of weeks ago, we had some dialogue about the Boeing 737 MAX crash in Ethiopia, in which an automatic system — intended (ironically) to make the plane safer — was suspected of being a causative factor.
This was my summary, which omitted that the cockpit includes handwheels by which the stabilizer can be manually controlled.
A commenter with the handle Huey Pilot gave a pilot’s perspective on how to respond to misbehavior by this kind of automatic system.
More recently, news stories have reported that the doomed pilots apparently did the right thing: they shut off the automatic system, and attempted to use the manual trim wheels to put the stabilizer back into a safe position.
However, a short time later, they switched the automatic system back on. Reportedly, they were heard on the cockpit voice reporter saying that manual trim wasn’t working … for me, a puzzling and mysterious sequence of events.
But a new report today suggests a possible explanation: if the stabilizer is already in a strongly nose-down position, the manual trim wheels may not work if a pilot is also pulling back on the yoke. In other words, the pilot might need to let go of the yoke in order to manually correct the trim*.
It’s only a hypothesis that this is what happened, but it could explain the flight recorder information. Reportedly, older 737 models had this idiosyncrasy. Perhaps newer models are immune …
More will be revealed as the investigation continues. But it already seems likely that this “robot” in the 737’s software put the cockpit crew in a situation in which they had to rapidly execute a series of non-intuitive actions (that is, requiring left-brain reasoning and recall of training information) in order to have the possibility of saving it.
At a high altitude, they would have had a fighting chance. A few hundred meters above the ground, everything was stacked against them.
Someday, perhaps soon, airliners may be flown exclusively by computer. Until then, it’s imperative that pilot inputs override/countermand the automated systems.
In the annals of Boeing, the Associated Grocers B-29 crash is considered a turning point in the company’s history. The way things are looking at the moment, this 737 MAX scandal will be an even stronger earthquake.
- If the plane is pointed at the ground, especially at low altitude, every fiber of the pilots’ being says to pull the yoke back; to release the yoke in such a situation would require (a) a very clear understanding of what is wrong, and (b) extreme presence of mind and ability to do, while confronting primal terror, what feels like absolutely the wrong thing.
Who? • April 6, 2019 6:56 AM
@ Sherman Jerrold
No, Jabba is referring to the computers themselves as end points, Think on encryption as a pipe made of a nearly unbreakable alloy. If you want to see what is inside that pipe you can either break it (the hard way) or look into it from one of its extremes (much easier). Breaking encryption is usually harder than breaking the computers that do it.
CallMeLateForSupper • April 6, 2019 7:36 AM
Brian Krebs is reporting that the dirt-bag-in-chief of the Yucatan ATM skimmer ring has been arrested. In 2015 Krebs wrote an interesting 3-part article about that “enterprise”.
https://krebsonsecurity.com/2019/04/alleged-chief-of-romanian-atm-skimming-gang-arrested-in-mexico/
albert • April 6, 2019 11:33 AM
@MarkH,
I agree with your assessment.
I’m wondering if there was any altitude input to the MCAS system. There should have been a minimum altitude below which the MCAS would be disabled. Forcing a nose down attitude at 100 feet is suicide.
The cause of the problem is a classic in computer-controlled systems. That is trying to compensate for hardware issues by using software. As usual, cost is the major factor.
It would be interesting to see the history of the MCAS within the Boeing management structure, but that’s not likely to happen. There were long-standing issues with the trim control system. I’m sure Boeing doesn’t want that rock turned over.
. .. . .. — ….
Frankly • April 6, 2019 11:38 AM
On getting through border security, the Schneier method: the underlying assumption is that border security officials understand security and will believe that you have no way to unlock your own computer until you get home. Unlikely. Instead, they will keep insisting that you can unlock your own computer — “That’s how everyone’s computer works! Of course you know your own password! Why are you trying to trick me?” And you will sit for hours in a tiny interrogation room.
You’re better off with the VeraCrypt system of a second password that opens a second version of the operating system and data. They won’t be examining it closely enough to know it’s a decoy.
Another Mouse • April 6, 2019 11:51 AM
@Albert – but the MCAS never commanded the plane in a nose down situation, at least as far as it’s own inputs see. MCAS always just brought the nose back to a safe angle, as in both cases the angle of attack sensor showed the A/C nose up. In my opinion the only way making the system less error prone is adding more input data. Like true airspeed, attitude from the ADIRUs and most important the second (third??) AoA sensor, possibly with some clever probability based input value “compare and weight” algorithm.
I’m curious what level iaw DO-178B the SW was initially classified, now for sure certification will be according to requirements of level A.
Alejandro • April 6, 2019 12:13 PM
I thought I posted a comment here about tax software security, but it’s not here, so either I didn’t click something right or it was taken down.
If it was taken down I sincerely apologize for violating the rules because this is a good place and has my respect.
Does anyone remember seeing it?
Douglas L Coulter • April 6, 2019 12:18 PM
Mentour pilot and co pilot replicate MCAS issues in simulator –
https://www.youtube.com/watch?v=TlinocVHpzk
This guy is very credible – good track record. I note that it wasn’t easy, they set up a situation with plenty of time to recover, and they studied what to do beforehand.
The other thing to know if you didn’t, is that shutting off the auto-trim leaves a jackscrew unmovable other than by handwheels – note how hard it was in the video above, and how many turns (and how much time) it took for both of them cranking for their life on the handles you have to fold out to get enough torque to do it.
Takes two strong guys and some time. The crashes seemed to have neither.
Thus tempting others to turn the electricity back on in the hopes of getting the motor to do that cranking, but this time in the right direction….
Sherman Jerrold • April 6, 2019 12:47 PM
reply to:
Who? • April 6, 2019 6:56 AM
@ Sherman Jerrold
No, Jabba is referring to the computers themselves as end points, Think on encryption as a pipe made of a nearly unbreakable alloy. If you want to see what is inside that pipe you can either break it (the hard way) or look into it from one of its extremes (much easier). Breaking encryption is usually harder than breaking the computers that do it.
I understand that and agree with the theory. However, in my case, the internet computer is uncompromised (running from a read-only Linux CD) and does not have the encrypted files on an internal hard drive, while the other computer storing the encrypted files is fully ‘airgapped’ and uncompromised, I can’t think of a way that an outsider can ‘look into either end of the pipe’.
I think/hope my reasoning is sound given these circumstances. Can anyone think of a flaw in that?
Also, as a hypothetical only, while I’ve never tried it, regarding going through Airport security with a laptop, I think you could also create a dual boot with Windows (as a decoy with no private data) and a Linux distro. And, you would boot into Windows and let them rummage around in it with safety.
Also, would a Micro-SD card (the size of your little fingernail) be detected in the normal scanning activities? Could it safely carry your personal data if it were put in place of a shirt collar-stay or some other unobtrusive place?
Douglas L Coulter • April 6, 2019 12:52 PM
Ah, I didn’t give the best link above.
Here’s the TL;DR version, start around 16:48 to see a real re-enactment from a simulator cockpit (but without the crash, they started at high altitude…not 500 ft as did the ones that didn’t make it).
https://www.youtube.com/watch?v=xixM_cwSLcQ
name.withheld.for.obvious.reasons • April 6, 2019 1:51 PM
Having come across this lately I thought sharing this resource was in the spirit of its mission. The site https://www.documentcloud.org was the result of an award to the Knight News Grand Challenge. What is available is amazing, the FOIA requests from publishers and investigative journalists. One could spend endless hours just looking at requests from such venerable sources as muckrock for example.
MarkH • April 6, 2019 1:57 PM
@albert:
The Ethiopian plane reached the ground with an enormous (negative) vertical airspeed. It excavated a large crater, and disintegrated into very small pieces.
In other words, by the time the ship approached 100 feet AGL, it was very far beyond saving.
That being said, it’s easy to think up “sanity checks” to disable or limit MCAS. Given the reckless design choice to use a single AOA sensor, airspeed and vertical airspeed could be checked to invalidate a high AOA reading*, for example.
However, most such checks would have rendered to MCAS code much more complex. Perhaps the simplest, would have been to limit stabilizer deflection compared to where it was steadily positioned ten minutes before … there is no situation (short of gross failure) in which a large stabilizer change is appropriate in a short period of time.
Probably the Boeing logic was, when MCAS fails the crew will promptly notice and shut it off. Also, because they failed to foresee that MCAS would iterate (change trim and then reset over and over), they assumed that the maximum trim change would be too small to cause a serious problem. Had these assumptions been correct, it would have made sense to keep the MCAS code as simple as possible.
I agree with you that Boeing may well want to keep their managerial process secret, but I suggest that (a) enough is already known to make the process fairly clear, and (b) the inquiries resulting from this scandal may well entail a lot of disclosure, whether Boeing likes it or not.
- Perhaps a case could be made for some module in the avionics to correlate the air data sensors, along with the radar altimeter, computed engine thrust, and perhaps GPS. For an airplane in one piece, laws of physics impose limits on the mutual relations of these parameters.
This module could raise an alarm when an “impossible” relationship is detected, and perhaps even suggest which sensor is most likely malfunctioning.
If such a system were in place, MCAS could have been designed to self-disable in case the single AOA sensor was suspect.
Alyer Babtu • April 6, 2019 2:22 PM
@MarkH
limits on the mutual relations of these parameters
This, and other recent debacles (e.g. self driving cars) in other areas suggests generally for algorithmic and AI controls and systems the need for some qualitative/quantitative analysis of dynamics (à la Andronov, Vitt, Khaikin [1], Conley [2], Arnold etc.) covering the input space, the control system as a multidimensional mapping, the output space and the part of the output space reachable by the system. Perhaps someone on this blog is aware of such work ?
-
Theory of oscillators. By A.A. Andronov, A.A. Vitt and S.E. Khaikin.
-
Charles Conley, Isolated invariant sets and the Morse index.
name.withheld.for.obvious.reasons • April 6, 2019 2:29 PM
After reviewing a few FIOA requests made by the EFF, I came across this order. It is the first time I’d seen the use of phrase (kinda like the use of non-public in section 309 of the 2014 IAA/HR4186) “un-minimized”. Given the context of the order, I am concerned as to its meaning. I’ve include a portion of the order here…does anyone else see something out-of-sorts here?
TITLE: Primary Order and Warrant
RELEASE: 20 August 2018
EFF-V-DOJ 16-CV-02041 Document 24
Page 9 of 12
…
In addition, the United States shall follow:
Procedures for un-minimized information
REDACTED
7. The United States has requested the Court to issue order(s) to persons whose assistance its necessary to implement the authorities approved herein. Accordingly, the Court has issued secondary orders to the following specified persons:
REDACTED
Page 10 of 12
to include affiliates, subsidiaries, and assigns or other successors in interest to said specified persons.
With regard to facilities, places, premises, and/or property targeted herein, the said specified persons shall:
(A) furnish the FBI all information, facilities, or technical other assistance necessary to effect the authorities granted; and
(B) maintain all records concerning this matter, or the aid furnished to the FBI, under the security procedures previously approved by the Attorney General and the Director of Central Intelligence (or the Director of National Intelligence) that have been or will be furnished to the specified persons and are on file with this Court.
The United States shall compensate any such persons providing assistance at the prevailing rate for all assistance furnished in connection with the activities described herein.
Clive Robinson • April 6, 2019 3:04 PM
@ Douglas L Coulter,
Very formal these days, nice to see you pop up I hope you are well and your home experiments are still progressing nicely.
I’m still not entirely sure what happened to the 737MAX’s system you would think that turning it off and turning it on again should not have made things worse, but apparently it did.
I can’t remember the link I saw the information on but they basically said it had a sawbuck effect where it adjusted the flight controls negatively but turning it off and on again not only did not clear the problem it made it worse as it advanced the flight controls more negatively each time.
I’m wondering if that was caused by a mechanical effect such as advancing a lead screw or the equivalent each time but never reseting it. I thought at the time of reading it, it sounded wierd like the person reporting it had been misinformed, but your comment about the jackscrew,
- Thus tempting others to turn the electricity back on in the hopes of getting the motor to do that cranking, but this time in the right direction….
Makes me think they were probably correct.
In which case neither the flight crew or SOBs had any chance what so ever as the sensible thing to do ie reset the system would have very very rapidly taken you well beyond the point of no return.
If that is the case then there is a software sysyems architect working at Boeing that has the blood of 300+ people on their hands.
Not that they would be entirely to blaim systems and factory acceptance testing should have pulled this error out within the first few tests, which makes me wonder if there realy was proper testing carried out…
If not then there is a senior manager who should be doing life times three hundred along with several others.
Flight systems even down to the simplest component or single line of code are “Safety Critical” and thus must always be tested to the fullest extent of the requirments and if you are sensible beyond requirments. It’s what I used to do with other Safety Critical Systems for Industrial Control Systems (SC-ICS) in the oil industry and medical electronics so it’s not exactly an “industry specific” requirment it’s widely known as I suspect you and one or two others here already know.
I guess we will have to wait for final reports etc, but one thing that is becoming clear is “self certification” in the airframe business is now officialy a “failed model” and should be halted rapidly, irespective of what heavily lobbied politicos might say about “responsible business” and “small government”.
As for Boeing perhaps paying a minimum of $5million to the families of every person who has died plus a similar sized amount for each child they had, might wake the industry up a little, along with say a minimum of three execs doing life plus sentences in “special administration” centers over and above any fines the Government profits by.
Basically just let the execs rat each other out and pick the top three or more who can’t pass the buck. Their actions “were take risk for profit” let them profit by their risk choices.
SpaceLifeForm • April 6, 2019 3:07 PM
@Sherman
You basically have addressed your opsec I think. But if not, here are some possible things to consider.
Paper (proven if you can secure it)
Double Encryption (see Vault7)
Air Gap (a good start)
Endpoint attack (see microcode timing)
Faraday Cage (protect the Air Gap)
Hand Carry from Faraday Cage (paper)
Did I mention paper? (no electronics)
Just because you can go full bore Air Gap with a Faraday Cage, DOES NOT MEAN you can walk out with a USB Key and not LEAK info!
Maybe a Floppy. But can not trust even that. Depends if your protected machine is old enough.
Paper is Safe. Retype/scan the ciphertext. Send. Destroy.
Sherman Jerrold • April 6, 2019 4:24 PM
@SpaceLifeForm, @jabba, @who,
Thank you for all the good info. As @SpaceLifeForm mentioned, for awhile now I have (and recommend to others) a paper copy kept in a safe place for password retention and protection. I live in an are with almost no ‘techies’ nearby, so local endpoint attack less likely (running Linux from a live read-only CD). I have a homebuilt Tesla coil in the garage so I use a Faraday Box (sheet steel with no gaps at door or hinge) to protect sensitive devices nearby (using an RF sniffer I found T-coil emissions dropped dramatically at ~25 feet). But, I don’t feel a Faraday cage is needed for my junk-box internet computer (the one usually running Linux from a live read-only CD).
And, thanks for mentioning vault 7, I’ll read up on double encryption.
Alejandro • April 6, 2019 8:28 PM
I did my taxes about two months ago with Turbo Tax, got my refund, (less than expected) and all was well. I thought.
I hadn’t used or opened TTax since. But, just recently I checked my network monitor and found TTax was attempting to make hundreds of connections to “download.esd.intuit.com” at various Akamai addresses such as 184.27.180.x, 23.52.190.x, 96.17.64.x, 104.89.0.x. None made it through due to previously firewalling TTax.exe from the internet. I only allowed it on the LAN. (Windows 10 firewall.)
I uninstalled TTax and the problem ceased. All tax forms and data will still be retained. You might want to do the same. (No harm in keeping/saving the installation file.)
I don’t know what data was being sent or received, maybe all very innocent, but the thing is I didn’t need or want either since I wasn’t using the app anymore.
The IRS has really FAILED taxpayers by NOT allowing us to e-File directly with the IRS.
You MUST use a private vendor to e-File, and they play by their own rules. I think this should have been handled by the IRS many years ago now. Currently your options are to paper file direct to the IRS (and/or your state) OR submit to the untrustworthy corporation. It’s not right, but we have no recourse.
MarkH • April 7, 2019 4:01 AM
@Clive:
Reportedly, Boeing uses a scale with a few gradations used to categorize how critical any system or component is for flight safety.
According to Boeing’s own review, MCAS should have been rated at the highest level, but in the event was classified one level lower. Had it been classified correctly, the design would have been required to use redundant sensors … and most likely, the 737 MAX would still have an accident-free record.
Even with a lot of good rules in place, it’s not easy to prevent this kind of mistake in which misclassification leads to application of the wrong rule set.
As I’ve mentioned a couple of times already, MCAS was supposed to be limited to a small stabilizer adjustment … which was a big reason why its inappropriate activation was thought to pose little danger.
Apparently, in the stuck sensor case where AOA appears to be excessive, MCAS makes its limited deflection … but roughly a minute later sort of “wakes up” and again advances the jackscrew de novo.
In both of the crash cases, multiple cycles seem to have occurred, producing large cumulative deflections of the stabilizer. In the same internal review, Boeing concluded that the original safety analysis failed to anticipate this scenario, which for me is a most startling lapse.
Dizzent • April 8, 2019 1:18 AM
“Even with a lot of good rules in place, it’s not easy to prevent this kind of mistake in which misclassification leads to application of the wrong rule set.”
The real issue is the FAA allowing Boeing to self-certify without even looking at these things.
Boeing is apparently not even obliged to farm out a 2nd system of eyeballs for verification?
The entire FAA mission needs overhauled. This is what regulatory capture looks like.
JG4 • April 8, 2019 9:17 AM
I was able to figure where Anura is going. To clarify, “We have to destroy freedom in order to save it.” Just as GWB destroyed capitalism in order to save it, thus far, sort of. Freedom’s just another word for entropy maximization. The question is who receives the resulting Gibbs free energy.
You’re not going to like magnitude 10 and magnitude 11 events. I managed to connect the dots this weekend that these things have be described in higher dimensionality, because Richter only captures ground motion. You need to capture overpressure, overtemperature and tektite debris overburden in the threat model. Rise time of the overpressure can be as important as the peak pressure.
https://www.nakedcapitalism.com/2019/04/links-4-8-19.html
…
Big Brother IS Watching You Watch
On the Pavement with Wikileaks Craig Murray
The Sun Never Sets on the Espionage Act Foreign Policy in Focus
Chelsea Manning’s ‘Don’t Tread on Me’ Moment American Conservative
MTA’s Initial Foray Into Facial Recognition at High Speed Is a Bust WSJ
Big Tech must pay for access to America’s ‘digital oil’ FT. Rana Faroohar
Facebook are ‘morally bankrupt, pathological liars’ – NZ Privacy Commissioner NZ Herald (MG)
UK to keep social networks in check with internet safety regulator CNET
…
Bruce Schneier • April 8, 2019 10:49 AM
“You’re better off with the VeraCrypt system of a second password that opens a second version of the operating system and data. They won’t be examining it closely enough to know it’s a decoy.”
My worry about this tactic is that it is deceptive. Honestly not being able to unlock your device seems safer.
Anon E. Moose • April 8, 2019 3:14 PM
@Alejandro
“You MUST use a private vendor to e-File, and they play by their own rules. I think this should have been handled by the IRS many years ago now. Currently your options are to paper file direct to the IRS (and/or your state) OR submit to the untrustworthy corporation. It’s not right, but we have no recourse.”
The IRS is not known for always applying best security practices.
https://krebsonsecurity.com/2016/02/irs-390k-more-victims-of-irs-gov-weakness/
https://krebsonsecurity.com/2016/03/thieves-nab-irs-pins-to-hijack-tax-refunds/
https://krebsonsecurity.com/2018/01/file-your-taxes-before-scammers-do-it-for-you/
Anon E. Moose • April 8, 2019 3:20 PM
@Clive @MarkH @Douglas L Coulter
Any discussion about engineering redundant mission critical systems should include Feynman’s Appendix to the Rogers Commission Report. Many engineering decisions were made by NASA management that did not reflect the gravity of the situation.
Appendix F – Personal observations on the reliability of the Shuttle
by R. P. Feynman
https://science.ksc.nasa.gov/shuttle/missions/51-l/docs/rogers-commission/Appendix-F.txt
Clive Robinson • April 8, 2019 5:00 PM
@ Bruce,
My worry about this tactic is that it is deceptive. Honestly not being able to unlock your device seems safer.
I agree, but there is a minor fly in the ointment,
- Proving to the various Homeland Security, LEO’s and Judiciary that you genuinely do not know.
Especially when you know that their current and future pay checks are kind of dependent on them not believing a word you say…
Judges in particular can take some considerable venal pleasure in locking people up indefinitely on contempt charges, just to prove “they are the ones wearing the trousers”.
Likewise Federal authorities in the FBI are known to perjury themselves in court, if they think it will help get a conviction and too few judges do what they should do which is stop the prosecution, order a prosecution of the FBI officers involved and also award restitution to a sizable amoubt be made.
Then of course there are the DoJ representatives pushing every which way to deny defendents their rights.
Thus people should consider if they personaly want to go up against this beyond authoritarian system. If you are famous and have not just sizable but appropriate resources behind you, if might just be worth the risk.
But for other unknown mortals except to maybe friends and family and their employers, it’s realy not worth the risk. So leave the kit behind even if you think it’s clean, it may well not be one way or another by the time you get to court…
Compartmentalizm • April 8, 2019 5:25 PM
‘“He stated that he had to immediately stop the analysis and shut off his computer to halt the corruption,” Mr. Ivanovich said.’
https://www.nytimes.com/2019/04/08/us/chinese-woman-mar-a-lago.html
Addendum • April 8, 2019 6:31 PM
After initial analysis I realized I was not the first to note the leak, or leeks.
https://techcrunch.com/2019/04/08/secret-service-mar-a-lago/
Clive Robinson • April 8, 2019 6:33 PM
@ Anon E. Moose,
Any discussion about engineering redundant mission critical systems should include Feynman’s Appendix to the Rogers Commission Report.
I used to work in the “Offshore Oil Industry” though less well known there are numerous examples known. Not least is “Bluewater Horizon” and a company very closely related to one of the string pullers of GWB. That company has a history of bad choices especially to do with “Downhole Blowout Preventors”[1]
Shortly before I started in the industry there was the Alexander L. Kielland disaster. Thus my first job was being involved with the design and installation of a system on the DF97 to instrument it to stop the same happening there. The next disaster most remember is Piper Alpha, another platform I had associations with and still regarded as the worst off shore disaster by many. But in between there were lots of accidents that most have never heard about because people did not die, or in some cases even get injured. Even though as in one case hugh chunks of a flywheel that broke up went tearing through an accomodation block, taking atleast one bed still warm from it’s occupant off out to sea.
It’s now very difficult to find information on many of these accidents. Take Brent field platform E, more commonly known as Brent Spar, it had a troubled history, but all you will readily find is the dust up between Royal Dutch Shell and Greenpeace over how it was to be decommissioned and disposed of.
Sadly with the loss of information on the accidents and some disasters, the history behind what went wrong is also forgoton, and history has a habit of demonstrating that those who do not learn from the past are oft cursed to relive it.
In a few months time a lone piper will be heard reminding many of “absent friends” and for some loved ones. Some of us will raise a wee dram in their memory, lest we forget.
[1] Yes I know in the US it’s spelt ‘Preventers’ but us old UK-Cit’s spell it ‘Preventors’.
Jeff • April 9, 2019 7:44 AM
Behold, here is the astonishing list of Chromium services blocked in the new Microsoft browser:
Safe browsing, Speech input, Nearby messages, Google Pay, Link Doctor, Drive API, Ad blocking, Chrome OS hardware id, User data sync, Device registration, Spellcheck, Google Maps Time zone, Suggest, Google Cloud Storage, Translate, Cloud Print, SmartLock, Google DNS, Form Fill, Supervised Profiles, Push Notifications, Address Format, WebStore, Network Location, Extension Store, Network Time, Maps Geolocation, Favicon service, Google Now, Google Cloud Messaging, Single sign-on (Gaia), Content Hash Fetcher, Flighting Service, Component Updater Service, RAPPORT service, Chrome OS monitor calibration, Chrome OS device management, Android app password sync, Offline Page Service Feedback, Domain Reliability Monitoring, Data Reduction Proxy, Chrome Cleanup, Developer Tools Remote, Debugging, iOS Promotion Service, One Google Bar Download, Brand Code Configuration Fetcher, WebRTC Logging, Captive Portal Service.
Of course MS then replaces with in its own data collection. A commenter states ‘if Ad Block+ and/or UBlock Origin isn’t to be allowed in the new MS Browser… it’s a NO-GO from the very start.’
https://www.ghacks.net/2019/04/09/microsoft-edge-google-features-disabled/
Choose:
1) Google Data-Mining
2) Microsoft Data-Mining
3) Neither
Instead I selected this privacy based Chromium browser:
https://iridiumbrowser.de/
Improve Web Security with Firejail Sandboxing
I’ve upgraded my Debian based operational security by running untrusted browsers/apps using Firejail:
Firejail is an easy to use SUID sandbox program that reduces the risk of security breaches by restricting the running environment of untrusted applications using Linux namespaces, seccomp-bpf and Linux capabilities.
Most users will not require ANY custom configuration – SIMPLY install Firejail from the repository.
https://wiki.archlinux.org/index.php/Firejail
Palemoon and Waterfox browsers use all of Linux sandboxing security features.
Unfortunately Chromium is more system intrusive and is limited to using only one of the three security features [1].
Debian licensing won’t allow these secret phone-home security breaches. To me data-mining (without GDPR explicit consent) is malware.
In use, Chromium limits bookmarks as Google wants you to ‘search’ every site through them.
Their plan is to disable the use of ad-blockers.
The best browser extensions run only in developer mode which have to be manually reinstalled whenever the browser is updated.
With its design emphasis on data-mining and serving ads, the Chromium browser is on a terminal trajectory. At least for those concerned about privacy.
[1] Chromium has its own sandboxing application but it too uses Google binaries
Alejandro • April 9, 2019 8:37 AM
“Congress Is About to Ban the Government From Offering Free Online Tax Filing. Thank TurboTax.”
The “House Ways and Means Committee… passed the Taxpayer First Act, a wide-ranging bill making several administrative changes to the IRS…”:
“In one of its provisions, the bill makes it illegal for the IRS to create its own online system of tax filing. Companies like Intuit, the maker of TurboTax, and H&R Block have lobbied for years to block the IRS from creating such a system. If the tax agency created its own program, which would be similar to programs other developed countries have, it would threaten the industry’s profits.”
And so it came to be the IRS was bought off by the corporations. Once the ink is dry, the price of doing your taxes will have no upper limit. I shudder to think what will happen to our so called private financial data. Yes, there will be free e-filing for the completely destitute full of exceptions and loopholes to make it almost useless.
I will be paper filing again. Frankly, it’s not that hard for most people, especially now that taking the standard deduction is basically the best way for most people. Fill in the blanks and let IRS deal with it. Basically, do what you did last year. In some ways it’s better because you don’t have to ponder questions like “have you retired from the railroad since last time” or “list all income from foreign oil companies”, etc.
@Anon E. Moose: BTW, Turbo Tax hand a big hand in the multiple returns scam that the IRS gets blame for. And, their record for privacy is abysmal.
vas pup • April 10, 2019 12:10 PM
Should cyber-security be more chameleon, less rhino?
https://www.bbc.com/news/business-47724438
“But some think the industry needs to be less rhinoceros and more chameleon, camouflaging itself against attack.
“We need to bring prevention back into the game,” says Yuval Danieli, vice president of customer services at Israeli cyber-security firm Morphisec.
“Most of the world is busy with detection and remediation – threat hunting – instead of preventing the cyber-attack before it occurs.”
Morphisec – born out of research done at Ben-Gurion University – has developed what it calls “moving target security”. It’s a way of scrambling the names, locations and references of each file and software application in a computer’s memory to make it harder for malware to get its teeth stuck in to your system.
The mutation occurs each time the computer is turned on so the system is never configured the same way twice. The firm’s tech is used to protect the London Stock Exchange and Japanese industrial robotics firm Yaskawa, as well as bank and hotel chains.”
“Yuval Elovici, head of the cyber-security research centre at Ben-Gurion University, warns that even this method isn’t 100% reliable.
“The obvious way to attack an air-gapped machine is to compromise it during the supply chain when it is being built,” he says.
“So you then have a compromised air-gapped computer in a nuclear power station that came with the malware – the attacker never has to enter the premises.”
Indeed, in October last year, Bloomberg Businessweek alleged that Chinese spies had managed to insert chips on servers made in China that could be activated once the machines were plugged in overseas. The servers were manufactured for US firm Super Micro Computer Inc”
“While air gapping is impractical for many businesses, so-called “co-operative cyber-security” is being seen as another way to thwart the hackers.
Imagine there are four firms working together: Barclays, Microsoft, Google and a cyber-security company, say.
Each of the four firms gives a piece of data to each other. They don’t know what the data is that they are protecting, but they hold it in their networks.
In order to access sensitive information from any of the firms, attackers would need to hack all four networks and work out which piece of data is missing, to be able to make any sense of the files stolen.
“If the likelihood of breaking into a single network is 1%, then to penetrate four different networks, the likelihood would become 0.000001%,” explains Alon Cohen, founder of cyber-security firm nsKnox and former chief technology officer for the Israeli military.”
“There is no such thing as an unhackable computer, the only thing that exists is the gap between what you build and what people know how to hack today.””
WhiskerInMenlo • April 10, 2019 10:27 PM
Extending zero day attacks by abusing spam and phishing report systems.
It might be a thing, what would it take to defend against it.
Today I saw a US-CERT US-CERT … message in my mail box that was tagged as a phishing attack message by google. I looked at it and compared it with known good messages from CERT and it was not a phishing attack. This was about: “AR19-100A: MAR-10135536-8 – North Korean Trojan: HOPLIGHT” notice.
The secret sauce behind Google and other mail service filtering includes customer tagging and feedback.
What if agents of evil wanted to extend the life of a specific zero day attack or targeted phishing attack. One way would be to trick filters into hiding messages alerting individuals companies and administrators. This one was apparently about N. Korea but we have elections in our future. What if our email boxes could be tricked into tossing a specific set of email into spam folders as a vector of influence and tampering.
See, if you trust links: https://www.us-cert.gov/ncas/analysis-reports/AR19-100A and https://www.us-cert.gov/ncas/current-activity/2019/04/10/North-Korean-Malicious-Cyber-Activity The expense of 1000-100000 gmail accounts is almost zero and generating piles of negative and bogus spam and phishing reports quick as a click or two, faster with automation. Also see: https://support.google.com/mail/answer/1366858
name.withheld.for.obvious.reasons • April 11, 2019 5:02 AM
ALERT: 1045 UTC
LOCATION: London, England
EVENT: Assange, Julian — Asylum in Ecuador, on Ecuadorian Territory (Embassy)
Julian Assange has just been taken from the Ecuadorian embassy in London by the Metropolitan police. Metro police entered the building and carried out Julian Assange, approximately six plain closed police hauled him out of the embassy much like they were carrying a casket at a funeral. Julian repeated stated that “The UK must resist.”
Please contact your local critter ASAP.
name.withheld.for.obvious.reasons • April 11, 2019 9:20 AM
ALERT: 11 April, 1015 EDT
EVENT: U.S. DOMESTIC NEWS CENSORSHIP
——BEGIN EVENT——–
Holy crap, just went to the Democracy Now site for their coverage of the arrest of Julian Assange and received a nothing burger–video unavailable. What country are we in, I am coming from a U.S. domestic IP address space and have been shown the literal door–to censorship of a news sight.
——BEGIN EVENT——–
Oh my, check your ammo caches.
Mesh WiFi • April 11, 2019 1:41 PM
From a privacy/security perspective on mesh networking might
Linksys/Velop be preferable to
Eero (bought by Amazon) or Google Wi-Fi?
Any other ideas for cost-effective solutions?
Mesh Wi-Fi • April 11, 2019 1:53 PM
Regarding Democracy Now and Assange:
“GLENN GREENWALD: I think the most important fact is that the arrest warrant, according to Assange’s longtime lawyer Jennifer Robinson, is based on allegations that Assange conspired or collaborated with Chelsea Manning with regard to the 2010 leaks of Iraq and Afghanistan war logs and diplomatic cables—a theory that the Obama Justice Department tried for a long time to pursue, but found no evidence for, in order to be able to justify prosecuting Assange and not face the accusation that they were endangering press freedoms by prosecuting Assange for something The New York Times and The Guardian and every other media outlet in the world routinely does, which is publish classified information.
Even if it were true that Assange collaborated with Manning—and, again, the Justice Department of President Obama looked everywhere and found no evidence of that—it would still be a grave threat to press freedoms, because journalists all the time work with their sources in order to obtain classified information so that they can report on it. It’s the criminalization of journalism by the Trump Justice Department and the gravest threat to press freedom, by far, under the Trump presidency, infinitely worse than having Donald Trump tweet mean things about various reporters at CNN or NBC. And every journalist in the world should be raising their voice as loudly as possible to protest and denounce this.
AMY GOODMAN: And can you explain, Glenn, exactly what you understand, why it is that the Ecuadorean Embassy has revoked the asylum, allowing the British authorities to come inside, what’s going on with President Moreno and his charges that Julian Assange was involved in releasing photos, which Assange has vehemently denied?
GLENN GREENWALD: Well, I interviewed former President Rafael Correa late last year. And he, of course, did something quite extraordinary, which was for six years stood up for Ecuadorean sovereignty and for international law and refused to be bullied by the U.S. and the U.K., which tried everything it could to coerce him or threaten him to withdraw the asylum protection for Assange. He was a very unusual leader of a small country, who famously said, for example, “If the U.S. wants to have military bases in Ecuador, they have to allow us to have military bases in Miami.” He was against imperialism and allowing Ecuador to be a vassal state of the U.S. and the U.K.”
https://www.democracynow.org/2019/4/11/julian_assange_of_wikileaks_arrested_in
EvilKiru • April 11, 2019 2:25 PM
@name.withheld.for.obvious.reasons • April 11, 2019 9:20 AM
https://www dot democracynow dot org/ worked for me from a domestic US IP address.
1&1~=Umm • April 11, 2019 8:34 PM
@WhiskerInMenlo:
“What if agents of evil wanted to extend the life of a specific zero day attack or targeted phishing attack. One way would be to trick filters into hiding messages alerting individuals companies and administrators.”
I know you are not the only person to have thought of this 😉
Somebody I know who uses both social media and You-Tube ‘reports as spam’ or it’s equivalent every ‘auto-suggestion’ or similar nonsence. It started a ‘thinking hinky’ process along those lines. The only trouble I could see was being able to get sufficient clicks on the ‘report as’ button.
If what my friend is doing is having any effect or not I don’t know. But if it makes them feel like they are ‘doing something’ more power to their ‘click finger’.
Alyer Babtu • April 12, 2019 10:52 AM
https://www.vox.com/future-perfect/2019/4/10/18275618/simulation-hypothesis-matrix-rizwan-virk
If this is “true” (?!!), hacking may really be an “existential” threat.
Footnote to gripe: The Matrix gets mentioned as the canonical example, but all the themes there are in World on a Wire from 25 years before.
Bob Paddock • April 12, 2019 11:10 AM
@Alyer Babtu
Frauchiger-Renner Paradox Clarifies Where Our Views of Reality Go Wrong From Quanta Magazine:
“New Quantum Paradox Clarifies Where Our Views of Reality Go Wrong:
A thought experiment has shaken up the world of quantum foundations, forcing physicists to clarify how various quantum interpretations (such as many-worlds and the Copenhagen interpretation) abandon seemingly sensible assumptions about reality.” — https://www.quantamagazine.org/frauchiger-renner-paradox-clarifies-where-our-views-of-reality-go-wrong-20181203
More recently:
“How Our Universe Could Emerge as a Hologram:
Physicists have devised a holographic model of “de Sitter space,” the term for a universe like ours, that could give us new clues about the origin of space and time.”
— https://www.quantamagazine.org/how-our-universe-could-emerge-as-a-hologram-20190221
Scientists such as Edwin C. May tell us that Time does not exist…
Alyer Babtu • April 12, 2019 12:53 PM
@Bob Paddock
So you’re saying we are simulations inside a quantum computer, and we each are in our own quantum computer bubble … I like it !
VinnyG • April 14, 2019 8:28 AM
@Alejandro re: tax software – Is it possible that you had an “automatic updates” option enabled in Turbo Tax, and the program was phoning home to check for those? I use H&R Block Tax Edge. I find it excellent for the Federal return and “good enough” for the State version. I haven’t observed any serious privacy or security aberrations. Unfortunately, there are currently only the two serious players in the market, which is further damnation for the IRS e-filing decision. I continue to file paper anyway, but there is no justification that I can see to distinguish between the two filing modes. To be clear, I do not think that the IRS should develop and make available a full tax and deduction calculation program (any more than they should hire and make freely available tax accountants to calculate and file paper returns for taxpayers at no cost.) I think that sort of product should remain the province of private enterprise. Frankly, I wouldn’t trust the results if IRS did offer such a product. IMO they should, however, offer a simple toolkit with e-forms that can be easily be completed and submitted using results calculated by the tax payer (manually or using a third-party program.)
Subscribe to comments on this entry
Leave a comment
Sidebar photo of Bruce Schneier by Joe MacInnis.
Sherman Jerrold • April 5, 2019 5:15 PM
As a relative amateur on encrypting, I have been experimenting with a couple of free portable tools for Windows and my Linux system has Bcrypt (utilizing the blowfish encryption algorithm created by none other than Bruce Schneier in 1993).
I use a single tool to encrypt my personal text password file and a few files that have highly personal info and feel that is enough, since those files are not permanently resident on any computer connected to the internet. And, I don’t know many people locally that would have the desire or skills to break the encryption on such mundane files.
One thing I read in a circa 2000 encryption book from the library is that if you use two competent encryption tools (encrypting the results of the first encryption with the second method) that the results are almost ‘impossible’ to decrypt.
Does anyone know if this is true?
Thanks