Comments

Ismar • May 17, 2019 4:43 PM

Thought I take advantage of my geo-location and post first in this weeks Squid Blog.

This time is is something more personal and to do with a recent email exchange I had with Bruce (using the same email address provided while posting this entry).

Namely, immediately after exchanging an email with Bruce (which I have done numerous times over the years) and asking him for some assistance (which he was happy to provide despite his very busy schedule) I got locked out of my email account.
Message received from my email provider was that my email might have been used in a spamming attempt and it was therefore locked.

I have since managed to rectify and unlock my email using a combination of 2FA and additional verification mechanisms but the question remains if my email was indeed hacked and used to spam or are there other ways of impersonating email senders which would appear legitimate to the anti-spaming engines and such can be used to lock people out of their accounts (at least for a while) ?

I am assuming here that Bruce did not simple report me (that would not make sense based on the exchange we had at the time) for smapping him 🙂 .

Any comments are more then welcome …

Steve • May 17, 2019 5:27 PM

Ismar
Some email systems have the ability to lock accounts after X number of failed login attempts.

Also, gmail will use the IP address location as an indicator. gmail has issues when people use VPNs – well – google has issues when people use VPNs. A VPN doesn’t help them track you and your data in the way they like.

My email server watches these attempts and after 3 failed attempts, we block the source IP, which is almost always from a country known for nefarious internet activities. We are aggressive with outside IPs, but also watch normal corporate LAN locations for failed attempts. We just don’t block those IPs. Occasionally, one of our real users gets impacted by this policy. They have to connect through a VPN to regain access to their account.

PDR • May 17, 2019 5:52 PM

Gmail in the Crosshairs
Google tracks a lot of what you buy, even if you purchased it elsewhere, like in a store or from Amazon.

Google’s privacy page says that only you can view your purchases. But it says “Information about your orders may also be saved with your activity in other Google services ” and that you can see and delete this information on a separate “My Activity” page.

Except you can’t. Google’s activity controls page doesn’t give you any ability to manage the data it stores on Purchases.
https://www.cnbc.com/2019/05/17/google-gmail-tracks-purchase-history-how-to-delete-it.html

Instead of Breaking up Facebook/Google, the EU May Force it to Share its Data
Margrethe Vestager, the EU’s competition commissioner, thinks competition has to be preserved for innovation to thrive, and that unregulated markets are prone to forming monopolies.
Vestager, whose directorate recently slapped Google with a $1.7 billion fine for alleged unfair practices in the online advertising market, thinks there’s a better way: She says it could be much more powerful and direct if tech titans like Facebook were required to give other companies access to important data [1].

“We think much more about access to data when it comes to, for instance, misuse of position of a monopoly,” she said. ”If you have no access to data, you won’t be able to make it in the market because you cannot access potential customers.” https://qz.com/1622036/break-up-facebook-eus-margrethe-vestager-favors-making-it-share-data-instead/

[1] Yes! Open SensorVault data

The Love of Tariffs
The World’s most powerful man does not like The World’s richest man. In fact, to be blunt, the two hate each other.
The daily barbs at the Washington Post only exasperate the feud.
The latest 25% tariffs are also aimed to pester Amazon. Yet the subject goes unreported.

In response monopoly Amazon insists its small business owners largely eat the tax by only raising the price Amazon pays by a meager 3%. Fair is fair right? https://www.sfgate.com/business/article/Amazon-is-the-third-superpower-heightening-the-13853379.php

India: Data is a National Asset
Others say India’s objective is more far-reaching: to create a “China-like situation” where the barriers to foreign players “progressively become higher,” said Nikhil Pahwa, a technology expert who has written extensively on Indian government policy.

The government sees “data as a national asset and control of the Internet economy as a nationalistic objective,” he said. https://www.sfgate.com/business/article/International-pushback-disrupts-Amazon-s-momentum-13836199.php

Weather • May 17, 2019 6:26 PM

Ismar
Back in the day you could login to a email server and send mail as them, but not really wanting to look further up the link.
Now you can get other sites to do the forwarding,
Yes a diff email address was me.

Gunter Königsmann • May 18, 2019 1:31 AM

@Ismar: My mail addresses ended up on blacklists several times. Once because I mentioned 1000000$ and perhaps another typical spam subject on a mailing list which in turn sent the same mail to many dormant mail accounts, all of this being red flags. Once because someone spoofed my email address, once because someone sharing the mail server with me actually sent spam. Once because my computer used a non-resolvable domain name and once because a big telecommunications firm had a fight with my domain hosted. And once because I used an pre-alpha version of a mail client that did things you would expect from this mail client but that some spam checker knew my mail client wouldn’t do. Normally it is this kind of thing that puts you on a blacklist. Wow… as I expect not all blacklists to tell why they list you I guess I got lucky to always have hit the right ones…

sad world • May 18, 2019 2:52 AM

Sorry it’s not about security but rather squid safety: Octopus farming is ‘unethical and a threat to the food chain’: ‘The group, led by Professor Jennifer Jacquet of New York University, argues that octopuses are highly intelligent, curious creatures. Farming them intensively would probably cause large numbers of deaths from stress. “We can see no reason why, in the 21st century, a sophisticated, complex animal should become the source of mass-produced food,”…’

The Pull • May 18, 2019 8:54 AM

florida election systems hacked in 2016 and fbi didn’t report it to anyone, and they can not say if the databases were messed with or not

https://www.politico.com/story/2019/05/16/florida-voting-hack-russia-1449198

etc

severe and really cool hack of some upscale cisco routers
mentions red balloon who are quickly gaining a reputation for being bad asses
remote root vulnerability, and they compromise trust anchor using fpga exploit
well worth a read if you are into bad asses hacks

https://www.wired.com/story/cisco-router-bug-secure-boot-trust-anchor/

Router bugs, of course, are so scary partially because if you compromise the router, you compromise everything downstream which is not encrypted (and everything poorly encrypted)

new details in AV hack, trend micro admits it was hacked
https://www.cbronline.com/news/trend-micro-symantec-fxmsp

Clive Robinson • May 18, 2019 12:01 PM

@ The Pull,

Security researchers figured out how to remote control plans

Made me smile 😉

More seriously Software Defined Radio (SDR) gave the EU regulators a very nasty turn back in the 1990’s.

Up untill then they had assumed that the RT&TTE Directive and the regulatory framework it evolved gave them all the control they realy wanted. The premise being using weird modulation modes would keep the likes of scanners that had come to the fore in the couple or so decades preceading firmly under control.

The first knock to their confidence was the “Digital IF and Demodulator” in the 1980’s. That alowed the complex IF to be brought down close to baseband where even 8bit microcontrolers like the Z80 could digitally decode many very specialized narrow band modulation schemes.

For instance I was involved with the design of one[1] to use with the Diplomatic Wireless Services “Piccolo six tone” modems. The commercial equivalent from Racal (LA1117) was part of a 6U rack code named “Kaynard”[2] using several higher end 68K processors and weighing in at a struggle for a couple of fit soldiers and a lot of bashed up tables and door frames. The Z80 version we designed was tiny in comparison (see fig 6.b in [1]) as it was designed for “stay behind brick” teams usage not temporary Diplomatic Missions.

Shortly there after similar small low cost add ons were getting attached to scanners and other wide spectrum receivers.

However the real shocker was the Digital Radio Mondial (DRM) Show when a couple of students demoed a board that was both a fully compliant receiver and also transmitter as well as several other modes including wide band FM Stereo not just for the 88-108Mhz “Band II” standard but various different TV systems.

Since then as far as the CEPT baseband standards are concerned it’s a cheap microcontroler board and a fast upload of software…

From now onwards even very broadband modulation systems are fair game for a cheap micro board. You can find on the Internet several “Web-SDR” systems that cover from under 2MHz all the way up well into the bottom of the centemetric microwave bands, for six or more simultanious users.

So any modulation system no matter how complex unless it has Crypto Secure (CS) Grade Authentication is going to be fair game for spoofing.

The problem is way to few communications systems designers realy grock what “CS Grade” realy means in terms of “the whole system”.

[1] https://apps.dtic.mil/dtic/tr/fulltext/u2/a215692.pdf

[2] https://www.cryptomuseum.com/spy/frm4750/index.htm

The Pull • May 18, 2019 4:57 PM

@Clive Robinson

Oh, I am all for thwarting people’s remote control plans. 😉

Just what I do…

I have a cheapo SDR system, and a more expensive one, which is portable and runs something like from 70mhz to 7 ghz — been awhile, but has been very fun. Have thought up all sorts of projects, but never ended up putting much into usage.

Grew up with police scanners, then in the 90s enjoyed the time when everyone’s phone was open and available. (I am horrible, I know, but what a golden age.) (Was similar to the golden age of hacking where you could just compromise anyone, my app: https://packetstormsecurity.com/files/11526/godmessage.zip.html )

I have thought about either creating a fuzzing system for my SDR system, or a privacy enhancing tool. Also experimented around with some surveillance projects.

Some stuff that sounds cool is a jamming system for privacy, what do you think about that? Illegal as heck, but would be nice to make your own privacy bubble when you wanted to talk to someone out in a field.

😉

PS Thanks for sharing your experience, you are a Serious OG (Old Gangster).

19 May 2019 00:00:00 • May 19, 2019 11:07 AM

First House Republican to “flip” on Trump regarding conspiracy or obstruction

“Here are my principal conclusions:
1. Attorney General Barr has deliberately misrepresented Mueller’s report.
2. President Trump has engaged in impeachable conduct.
3. Partisanship has eroded our system of checks and balances.
4. Few members of Congress have read the report.”

https://twitter.com/justinamash/status/1129831615952236546

19 May 2019 00:00:00 • May 19, 2019 11:25 AM

https://www.emptywheel.net/2019/05/17/in-a-bid-to-jettison-flynn-trump-suggests-hope-hicks-and-steve-bannon-lied-to-the-fbi/#comment-790904

From comments “OldTulsaDude says:
May 17, 2019 at 1:44 pm

With impeachment and removal impossible due to a complicit Senate, the best strategy for a Democratic contender for the WH [white house] may be a promise of criminal prosecution for the deeds of Individual-1 [President Trump] once he is out of office. It is about time someone in a blue jersey makes the actions and consequences personal.
Reply

bmaz says:
May 17, 2019 at 1:53 pm

For the nine millionth time, the question is NOT about actual articles of impeachment being voted on and sent to the Senate for trial. That is now, and has been all along absolutely BOGUS disinformation.

The issue is merely opening an impeachment inquiry in order to solidify the House investigatory power with a direct Constitutional underpinning. When people, whether here or anywhere else, talk about the “impossibility” of removal by the Senate, they do the public and the Constitution a severe disservice. PLEASE stop doing this.
Reply
    pjb says:
    May 17, 2019 at 3:03 pm

    Aren’t there really two important reasons for beginning a formal impeachment inquiry? One is clearly as you say, to “solidify the House investigatory power with a direct Constitutional underpinning” for purposes of maximizing the House’s position in Court to enforce its subpoenas. The other is to educate the electorate who cannot or will not read a 445 page single-spaced report or follow the ins-and-outs of emoluments cases, security clearance overrules or other of this President’s manifold abuses of office? People like to watch good tv shows, like impeachment hearings can be. Who knows, if done correctly, it might ultimately sway public opinion to the extent a Senate vote on removal might become feasible (even if that’s not the issue today)? Or soften Trump’s seemingly monolithic support within his party to encourage a primary challenge?
    Reply
        bmaz says:
        May 17, 2019 at 3:42 pm

        Oh, absolutely. But with the complete refusal of the Administration to comply with any oversight whatsoever, it is imperative to get that power immediately.
        Reply
            OldTulsaDude says:
            May 17, 2019 at 4:52 pm

            I agree that an impeachment inquiry is necessary, and the sooner the better. Regardless, political realities still apply.
            Reply
                bmaz says:
                May 17, 2019 at 5:06 pm

                I am of the opinion that the oath of office to defend the Constitution is not for only when it is politically expedient. Since the start of this Union, men and women have died to defend the Constitution..."

Faustus • May 19, 2019 12:24 PM

This boing boing post points to an interesting paper on how the source of a leaked “The Hateful 8” trailer was tracked down:

https://boingboing.net/2019/05/18/watermarks-r-us.html

What strikes me is the paper’s application of postmodern theory-speak to the subject of counter forensics.

Although I find Theory to be an interesting way to reveal hidden contradictions and hidden motives in cultural artifacts in service of freeing us from subtle control strategies (Monsieur Teste: “He had killed his puppet!”), in this case Theory doesn’t seem to add much except the option of publishing in a Theory oriented journal.

JG4 • May 19, 2019 1:16 PM

@Faustus – A nice recipe for unobtrusive steganography. The threat model is that most of the mathematics PhDs in North America are actively working to defeat anything you might choose to do.

https://www.nakedcapitalism.com/2019/05/links-5-19-19.html
…

Big Brother IS Watching You Watch

Police Are Feeding Celebrity Photos into Facial Recognition Software to Solve Crimes Motherboard

Why parents should think twice about tracking apps for their kids Conversation
…

https://www.nakedcapitalism.com/2019/05/links-5-18-19.html
…

Big Brother Is Watching You Watch

Google uses Gmail to track a history of things you buy — and it’s hard to delete CNBC

Secret tracking device found in Navy email to Navy Times amid leak investigation raises legal, ethical questions Military Times
…

MarkH • May 19, 2019 1:38 PM

It will come as no surprise to regular readers of this blog, that Bluetooth is a rat’s nest of security vulnerabilities.

Even so, I learned some interesting things from this Wired article.

  1. The current standard is about 3,000 pages in length, and offers a bewildering variety of variants requested by manufacturers over the years.

Given that seemingly simple protocols from expert cryptographers, which can be described on one sheet of paper, have been found to have vulnerabilities, what can we expect? But …

  1. The God-awful complexity of the standard may have discouraged attackers so far, in a kind of Security By Obscurity.

The article offers an example:

… a smart padlock known as BoxLock. The device had been designed to use a Bluetooth Low Energy configuration called “Just Works Mode,” which lets devices pair without any passwords or other cryptographic protections. As a result, McAfee researchers could connect to any lock, analyze the device’s BLE commands, and discern which gave the unlock order. Further, BoxLock had configured this command to be in read/write mode, so once the attackers knew what to target, they could initiate an unlock. BoxLock has since patched the vulnerabilities.

Obviously, the product designers made dumb decisions. Even so, the complexity of Bluetooth made it easier for them to step into those holes.

A90210 • May 19, 2019 2:53 PM

From https://twitter.com/Delavegalaw/status/1108983327287992320

“The Myth of Watergate [‘The Watergate scandal was a major political scandal that occurred in the United States during 1972 to 1974, following a break-in by five men at the Democratic National Committee (DNC) headquarters at the Watergate office complex in Washington, D.C. on June 17, 1972, and President Richard Nixon’s administration’s subsequent attempt to cover up his involvement.’ [1]] Bipartisanship”

https://www.nytimes.com/2018/08/13/opinion/watergate-republican-party.html 2018

“Reporters and political commentators often express frustrated surprise at the steadfast support of President Trump from most Republicans in the House and Senate. But they shouldn’t — it has happened before. …”

[1] https://en.wikipedia.org/wiki/Watergate_scandal

Martin • May 19, 2019 6:17 PM

@A90210

President Trump was elected President of U.S.A. per the requirements of the constitution. After a $35,000,000 (cost was $10 / citizen) investigation was completed no legal charges have surfaced relating to how the election was conducted. He is the president. Please stop cluttering this security blog with your disappointment in the outcome of the election. To me it is not interesting or relevant. Thanks.

1&1~=Umm • May 19, 2019 9:31 PM

@Martin:

“After a $35,000,000 (cost was $10 / citizen)”

Hmm last time I looked the US population had passed 300 million…

MrC • May 20, 2019 1:41 AM

@Martin:

And last time I checked, the forfeitures from Manafort more than covered the cost of the investigation.

Clive Robinson • May 20, 2019 8:48 AM

@ The Pull,

Some stuff that sounds cool is a jamming system for privacy, what do you think about that? Illegal as heck, but would be nice to make your own privacy bubble when you wanted to talk to someone

The problem with jamming systems is the power per Hertz of bandwidth. Put another way a jammer with 1KW output across 100Mhz is 10W/MHz or 10mW/Khz which is well below that of a Hand held Two (HT) way radio that you can pick up for $30 or less.

It’s actually not that difficult these days to make a 1W Frequency Hopping transmitter that using appropriate digital techniques only uses around 1.2KHz bandwidth to give acceptable audio that jumps around a 100MHz block of the UHF band very easily.

With the likes of small drones and shotgun mikes talking in a field is nolonger the place to get privacy. Your best bet would be along the lines of a fairly deep hole in the ground. So meeting at a preagreed spot in the sewers or other underground tunnel system that does not have cables could be a better bet.

Another possibly better way might be to use “full head” motorcycle helmets with in ear cannal ear pieces, and no voice throat mikes. You can buy such equipment fairly cheaply for use as “Motorbike pillion intercom” currently so it dors not look out of place.

If you can not get throat or whisper mikes then you may need to add a random vibrator to the hard shell of the helmet. To stop the use of various types of laser mic etc to try and pick up the audio from the helmet hard shell, actually riding a motorbike down twisted lanes with over hanging trees, bridges, cables etc would also help.

Getting privacy is getting harder day by day as new technologies become available to those looking to invade it. As a result your tactics have to change to keep ahead.

As for jammers being “illegal” it’s one of those awkward questions to answer. The actuall answer in the main is not only jurisdiction based but often not technical but boils down to “state of mind”. For instance an old style car ignition coil and mechanical points, will if the capacitor becomes disconnected become a fairly effective very broadband noise transmitter… Likewise any equipment opperated inside your own property boarders is again likely to be not illegal.

As with many things where technology and law collide the legislation often makes little sense to anyone, thus the law has to be tested by argument and such arguments become guidence for the future. In the US the DoJ and FBI frequently play “tag team” to bend the legislation by bringing court cases where the degendent can not go through refuting leagle argument. It’s most certainly an abuse of process and one many are aware of but look the other way…

The Pull • May 20, 2019 9:28 AM

@Clive Robinson

Oooh, cool stuff, thank you for the tips. (I am not a spy, nor a criminal. But, if I was either, I would be a good guy, not bad.)

I can see where someone would have the wrong idea about me, though I do not work anywhere special, and my work is very boring and not interesting.

But, I have noticed some unusual flight maneuvers when I go outside my regular routine, such as going to see a movie, or going to a mall, or something.

So, this can be useful as a sanity check. To flush out surveillance, and to get some alone time.

🙂

Patriot • May 20, 2019 10:05 AM

@ Martin

 You are exactly right: this is not the place for sour grapes about politics.  If one wants to spew some vinegar, there are plenty of zoos to visit like the Washington Post's website. They make money from conflict; it's tiring to even watch.

 I like the <a href="https://crypto.stackexchange.com/">Cryptography Stack Exchange</a> website, but that is not the place for personal opinions.  This blog fills the void:  if we have an opinion to voice about security, we can do it.

 I don't have any security news tips this week, but my computer was hacked--a rootkit--and that was big security news to me. Using Fedora 29, rkhunter skipped a few tests, and I did some digging:  deleted log files, privilege escalation, a hidden port, a packet sniffer.

 Maybe the cryptography that I do raised some attention.

Lomax • May 20, 2019 11:01 AM

I’m certain Mr. Schneier must know about this already but other forumites might want to read this.

Online account hijackers received a taste of ironic punishment this week. KrebsOnSecurity has learned that hackers stole the database from the popular hijacker forum OGusers on May 12th, obtaining email addresses, hashed passwords, IP addresses and private messages for nearly 113,000 forum users.

The story is on https://krebsonsecurity.com/2019/05/account-hijacking-forum-ogusers-hacked/

albert • May 20, 2019 1:23 PM

@Clive,

“…Likewise any equipment opperated inside your own property boarders is again likely to be not illegal….”

Not true in the US. Any interference in regulated frequency bands*, whether intentional or not, is subject to action by the FCC, regardless of your location.

Old tech auto spark coils were fine broadband noise generators, especially with non-resistive spark plug cables:) Better results could be gotten by attaching long wires to a spark plug cable. NOTE: Illegal, only use in an emergency for a simple SOS transmitter (which may have happened, ICR).

  • last I checked, below ~20Hz was OK, as well as above very high GHz ranges.
    . .. . .. — ….

Martin • May 20, 2019 3:42 PM

@1&1~=Umm

Yes “After a $35,000,000 (cost was $10 / citizen) investigation…” should have been typed as “After a $35,000,000 (cost was $.10 / citizen) investigation…”; decimals points are important and I screwed up. The $.10 is a round number assuming there are 329 million U.S.A. citizens.

“The current population of the United States of America is 328,818,145 as of Monday, May 20, 2019, based on the latest United Nations estimates.” per https://www.worldometers.info/world-population/us-population/

The point was the investigation was well funded and extensive.

The Pull • May 20, 2019 4:52 PM

@Clive, @albert

“Not true in the US. Any interference in regulated frequency bands*, whether intentional or not, is subject to action by the FCC, regardless of your location.”

I am aware of that.

Clive’s advice on ways to break surveillance helped me, though. Let me know if you know any clever methods, Albert. 🙂

I have seen some evidence I may be under surveillance. I have worked for the government, and been involved in some things which could cause another gov agency, or a foreign agency to target me. If I still worked for the gov, I would not be requesting outside assistance. Heh heh. 🙂

Really, just need to do a sanity check. Something to force them to change methodologies and give me more visible evidence.

As noted, I have seen some seeming evidence when breaking my regular schedule and going to places like movie theaters or malls. Which seems maybe “more then just my imagination”. Though, I can not fathom how anyone would spend resources on me.

I am all to happy to have them waste their time on me, and resources, if that is the case.

Just as long as they do not put a video camera in my bathroom, anyway. 😉 😛

🙂

albert • May 20, 2019 6:17 PM

@The Pull, @Clive,

I guess a Cone of Silence is out?

Any interference with regulated frequency allocations is illegal, so I wouldn’t recommend it. I believe that the FBI (and probably other TLAs) have devices to block/interfere with cell phone traffic in certain localized ’emergency’ ‘incidents’.

As communications move toward the low infrared bands, signals begin to behave more like light, and less like radio waves. It’s possible that that a maser-like system could collimate microwave beams to thwart interception. No doubt research has been done on this.

What you can do legally. Sweep the house and vehicles for tracking/spying devices as a first step. Cell phones can be tracked easily by LE, so use a burner. Those aren’t illegal. It would be interesting to have a couple of friends follow you to see if you’re being followed. Collecting license numbers would be a start. They wouldn’t be breaking the law. If they were stopped, it wouldn’t be by the trackers, that’s for sure. It would be by regular uniformed police. If they haven’t broken any traffic laws, it would be a dead giveaway.

Don’t forget, it’s not only the gov’t that tracks people.

Perhaps it’s only paranoia on your part.

Hopefully, it’s not a case of what Paul Krassner calls “Reality Paranoia”, “when you think people are out to get you, and they really are!”

P.S. I got paranoid and deleted several paragraphs 🙂
. .. . .. — ….

Patriot • May 20, 2019 7:05 PM

@ The Pull @ albert

 We must be very careful with jamming (denial), with monitoring or using certain frequency bands, and with sending encrypted radio messages, especially in and around Airstrip One (Great Britain) and the City on a Hill (U.S.A).

 It is not just that some of this stuff is illegal in many countries: it can be a felony.  For example, it is a mistake to buy a scanner in one country and stick it in your luggage to take back home.  If that scanner sweeps unauthorized bands, then you may have just committed a felony, depending on where you live.

 Tell people who want to have fun with RF to just go down to their local radio store and buy a scanner--it is likely to be compliant with local laws.  And tell them to buy an engineering phone if they want to look at GSM towers, etc. (and the fake ones that pop up).

 Anyone who does jamming for fun leaves a significant trail of metacontent, one way or another, and special law enforcement teams exist in many countries whose function is to find people who are jamming, transmitting, or collecting illegally.

The Pull • May 20, 2019 8:35 PM

@Patriot

There’s a few apps for android which can give you a ton of diagnostic cell tower info, which the android api gives access to. Forget the name of the app I used to use, but it would nicely plot out locations of all nearby cell towers and provide a lot of diagnostic info.

On legality of jamming, I was simply aware it is something the FCC would not like you to do, without the appropriate license.

And, yes, with my SDR kit, I can get some cell tower software going, but would also research the laws there, if I thought about doing so. I have some leeway in these matters being a verifiable “security researcher”.

@Albert

Yeah, in my case, I have had china fixate on me for a few reasons. I am in the States, so it is not legal for them to surveil me. Therefore, it is a non-stressor for me. More of a curiousity.

And, like I said, sanity check.

I think it would be funny if they were researching me, as I do absolutely nothing serious in my current job, nor in most of my former jobs.

The Pull • May 20, 2019 8:48 PM

@Albert

I should add, as a disclaimer, I am not up on all the laws and regulations, and obviously only intended to get lawful examples. I was thinking of a jammer as some sort of system that might be lawful to use in the country, or in a parking garage, etc sort of scenarios. (ie, where there shouldn’t be anything sending and receiving, so you would not be blocking anything).

As I am lazy, Clive’s suggestions for blocking such theoretical bugs and long distance mics I instantly grabbed onto as possibilities.

What is a cone of silence anyway? (Without me googling it…)

Patriot • May 21, 2019 2:35 AM

This latest climacteric in the conflict between the current U.S. administration and Huawei may bode well for news junkies. No matter which way it goes, there are huge security implications.

It’s a very unwelcome escalation in the brewing hostilities between the two nuclear-armed states. It is as if the world will have a choice as to where its data will go for analysis: Maryland or Shanghai, Google or Huawei. Some people do not want to hear about the battle of civilizations, but here it is folks: there can only be one.

This is a big deal. This is a new stage in the Crypto War, the Meta Crypto War, a fight to see who gets to backdoor everything and snoop on you as you play Candy Crush or Chinese checkers. Let’s see: Google follows U.S. pressure even with the open hostility between Google’s executives and the current U.S. president. Google can kiss their influence and business in China good-bye. $o, how can thi$ be explained? How could Google, who are the $alt of the earth, give up their hope$ of leading in China?

I simply cannot wait for the leak to come about Google-Ft. Meade (if such collusion really exists–is water wet?). That would be a torpedo into Google’s titanic and blithe control of the earth’s data.

There are two sides to this story: yes, the security concerns about Huawei are genuine and substantial, but on the other hand we have a greedy vampire squid called Google that should not be given a freer hand to spy upon, and manipulate, so many people with such impunity.

Patriot • May 21, 2019 3:00 AM

Here is how Huawei’s loss of Android is going to effect people.

WeChat just became more important. They run third-party apps inside Android, and these are widely used in the PRC, especially on phones such as the OPPO. Inside the PRC, people enjoy very nice services on WeChat, and basically everyone has it. It is how most people pay for things (via QR codes), how they communicate (audio, video, messages, share files), how they send money to each other (red packets or transfers), how they order food, and how they get a taxi or find their location on a map. WeChat is also used in South Korea and it is big in some smaller countries such as Laos.

This pressure on Huawei is unlikely to have much of an effect in the PRC, and that, of course, is a gigantic market.

Patriot • May 21, 2019 3:06 AM

Here is how Huawei’s loss of Android is going to effect people.

WeChat just became more important. They run third-party apps inside Android, and these are widely used in the PRC, especially on phones such as the OPPO. Inside the PRC, people enjoy very nice services on WeChat, and basically everyone has it. It is how most people pay for things (via QR codes), how they communicate (audio, video, messages, sharing files), how they send money to each other (red packets or transfers), how they order food, and how they get a taxi or find their location on a map. And it is their social media. WeChat is also used in South Korea, and it is big in some smaller countries such as Laos.

This pressure on Huawei is unlikely to have much of an effect in the PRC. Most people in the PRC will probably not notice, but on the other hand this might be akin to the Tesco-Lotus crackdown that happened some time ago. One wonders if this will spread to Apple.

Apple does good business in the PRC; it has many shops. Many people are proud of their pricey Apple phone. I would not be surprised at all to see Apple get the axe in the PRC because of this attack on Huawei, which is how a lot of Chinese folks will see this.

1&1~=Umm • May 21, 2019 3:47 AM

@ Patriot:

“This pressure on Huawei is unlikely to have much of an effect in the PRC.”

Huawei is the worlds second largest supplier of Android phones, after Samsung, to both companies the US market whilst important is not as significant as the US politicos like to think it is. However as you note China is an increasingly important market to US companies including Apple.

But perhaps less well known is the ‘licencing’ Huawei pay to a large number of US companies some of which are actually quite dependent on Huawei for income, which the US Gov has in effect chopped off from US companies…

If the US is not carefull it’s going to start to paint it’s self into a corner. When Trump and Co say ‘Our way or no way’ or the equivalent they are likely to find the ‘No way’ option will hurt them rather more than they expect.

Especially as it looks like Huawei have already taken steps to design out US technology, due to earlier rumblings,

https://www.bbc.com/news/business-48345742

One thing that keeps comming up with 5G is how the FCC are pushing the upper ends of the Microwave spectrum, yet other countries are not. Contrary to what the politicos might have been told about ‘US leading edge research’ at those frequencies, it does not matter. Those frequencies are not realy suitable for ‘mobile’ use. Which means a fall back to 3G/4G and LTE for the foreseeable future…

Whilst the US appears to be trying particularly hard for a Pyrrhic victory they are also becoming increasingly issolated. When ‘the cows come home’ on this in the US economy the current administration will not be there (two term rule).

But one thing you can be sure of is that other nations such as India are not going to sit idly by waiting for the dust to settle, they will out of self interest take steps that will result in the loss of more US jobs etc to them and not just in software.

A90210 • May 21, 2019 11:51 AM

@MrC, Martin, Patriot, 1&1~=Umm

As some of you may know, as of around 12 February 2019, the Mueller investigation was ‘in the black’.

https://www.usatoday.com/story/news/politics/2019/02/12/mueller-russia-investigation-costs/2736507002/

28,600,000 Approx. Fines, forfeitures, and restitutions

25,500,000 Mueller costs

03,100,000 (USD)

Of course, Mueller is still working for the USG. Perhaps on the Mystery Apellant or Roger Stone associate Andrew Miller stuff [1], but nobody, at least in public, seems to know what he is up to.

[1] https://nlpc.org/2019/05/17/feds-still-want-witness-testimony-in-mueller-probe-but-why/
“From Courthouse News Service by Britain Eakin:

Challenging the lack of cooperation by former Roger Stone associate Andrew Miller, prosecutors told the D.C. Circuit Thursday that the grand jury that worked with special counsel Robert Mueller still needs Miller’s testimony.

Filed this morning by the U.S. Attorney’s Office for the District of Columbia, the government’s 21-page opposition brief [ https://www.courthousenews.com/wp-content/uploads/2019/05/miller-opp-stay.pdf ] indicates that the grand jury empaneled by Mueller is likely still working, and that more criminal charges related to Miller’s testimony are possible.

The grand jury working with Mueller had subpoenaed Miller in May 2018 for testimony concerning Stone’s relationship to WikiLeaks, its founder Julian Assange and Guccifer 2.0, a fake persona …”

Misc. links:

Mueller Report (searchable)

https://assets.documentcloud.org/documents/6002293/190322-Redacted-Mueller-Report.pdf ; PDF, 150 MB, and somebody once said, AFAIK, perhaps read at least the two: Introductions, Conclusions and Executive Summaries (or search using your favorite keyword(s))

https://www.emptywheel.net/2019/02/22/yesterday-noel-francisco-raised-the-stakes-on-the-mystery-appellant/ ; Mystery Appellant, February

Faustus • May 21, 2019 12:39 PM

@ Patriot

I am curious about your Fedora 29 hack. Have you identified the route of infection?

Do you load software outside of the main repos? Do you use security software like noscript and https everywhere on your browser? Do you use browser add-ons beyond these? Do you share usb drives between machines or with other people?

What port was the malware using? How did you determine there was a key logger?

I am always looking for new things to look for in my network security system. I appreciate any information you can share.

Sherman Jay • May 21, 2019 2:19 PM

@ Patriot @ Faustus

I was concerned by the report of rootkits in Fedora 29. In checking other resources, it seems that rootkits, while not common, do attack Linux. Trying to be careful without jumping over the line into paranoid, I’ve changed my junker, air-gapped Internet computer. It now runs from an eccentric CD version of linux. When I turn it off, everything evaporates (I hope and believe).

We now truly seem to be besieged on all sides:
https://www.truthdig.com/articles/the-creepy-new-addition-to-mcdonalds-menu/

And, recently I’ve been getting more phishing phone calls about phony insurance premiums, phony first-responder non-profits I need to support (just give us your credit card number – to paraphrase the Crapital-One TV ad “who’s in your wallet”), and ‘Bill Gate$’ called to warn me my Windows computer was infected over the internet. I’d laugh if it weren’t so serious a threat to some ‘less informed’ people I’ve had at my clinics.

A90210 • May 21, 2019 5:28 PM

https://www.theguardian.com/science/2019/may/11/neuroscientist-dr-hannah-critchlow-science-of-fate-interview

“… You devote a chapter to the formation of belief – how our genes, traits and experiences shape our views. Does this mean genes play a role in our political views, say whether we’re a leaver or a remainer?

Hannah Critchlow: There have definitely been studies that have looked at different brain profiles associated with ideology. People who are very conservative seem to have a much larger volume and a much more sensitive amygdala – the area of the brain that is involved in perceptions of fear. People who are more liberal seem to have a greater weighting on the region of the brain that is engaged in future planning and more collaborative partnerships. They don’t seem sensitive to immediate threats; instead, they are looking to the future. What we see in propaganda through the centuries is that if you heighten someone’s fear response using environmental manipulation, you are more likely to make them vote in a rightwing way.

So what does neuroscience tell us about how you might go about changing someone’s mind or winning an argument?

Hannah Critchlow: It’s very difficult. Once you have built up a perception of the world, you will ignore any information to the contrary. Your brain is already taking up about 20% of your energy, so changing the way that you think is going to be quite cognitively costly. And it might be quite socially costly too. …”

A90210 • May 21, 2019 5:52 PM

https://theintercept.com/2019/05/20/republican-justin-amash-gets-what-top-democrats-dont-its-time-to-impeach-trump/

“… [Representative] Amash joins more than 900 former federal prosecutors, from both Republican and Democratic administrations, who believe Trump’s behavior, as outlined by Mueller, would have resulted in “multiple felony charges for obstruction of justice” were he a private citizen and not the president of the United States. [1] Conservative law professor J.W. Verret, a former member of the Trump transition team, has written how the “elaborate pattern of obstruction” uncovered by the report is, at a minimum, enough “to get the impeachment process started. [2]”

[1] https://medium.com/@dojalumni/statement-by-former-federal-prosecutors-8ab7691c2aa1

[2] https://www.theatlantic.com/ideas/archive/2019/04/gop-staffer-advocates-trumps-impeachment/587785/

also

https://theintercept.com/2019/05/20/facebook-data-phone-carriers-ads-credit-score/
“Thanks to Facebook, Your Cellphone Company Is Watching You More Closely Than Ever”

https://theintercept.com/2019/05/21/why-you-should-care-about-donald-trumps-war-on-whistleblowers/ ; Scahill 10 minutes

https://theintercept.com/2019/05/17/us-media-journalists-iran-coverage/
“Four Simple Steps the U.S. Media Could Take to [try to] Prevent a Trump War With Iran”

A90210 • May 21, 2019 6:02 PM

Does anybody have any thoughts, preferably security related, about elections: EU, Brexit, Austria, Australia, Philippines, India, or other?

name.withheld.for.obvious.reasons • May 22, 2019 12:22 AM

Reviewing the documents from the most recent ACLU FIOA requests, Savage NYT FOIA Bates MCT Third Tranche [Part 1], suggests that the FBI or other LEA’s have engaged in behavior that is clearly problematic and suggests that the FBI will do the right thing (Right!). In criminal cases, federal or otherwise, the review or monitoring of “privileged communication” between parties is supposedly honored by their claimed minimization procedures.

There are three interesting components of this clause; the word back up and back-up, and, the fact that deleted is not deleted, and, that retrieval of these communications can be allowed. This is troubling in that the government can suppress evidence that law enforcement officials may be in possession of privileged communications given that FISC orders are not subject to discovery. This is the subversion or independent counsel for individuals charged by the government in a legal proceeding. In short, the government reserves the right to cheat a citizen charged by the government. This is exactly what the framers were afraid of, the use of unlimited resources targeted at individuals makes the citizen a subject (ironic). The American Bar Association should be up in arms (and torches) about this legal subversion.

This seems highly suspect in that the following caveat is provided for (page 20, privileged communications minimization procedures):

“Any electronic versions of the privileged communications that are not available to any end user but are available to a systems administrator as an archival back-up will be restricted and destroyed in accordance with normal business practices and will not be made available to any other person expect as permitted by the FISC. In the event the FBI archival back up data is used to restore an electronic storage system, the FBI will ensure the previously deleted privileged communications will not be accessible to any user and will be deleted from any restored system: and”

name.withheld.for.obvious.reasons • May 22, 2019 12:31 AM

These continuing convolution, convulsion, and contradiction of jurist prudence and legal efficacy, legal and court procedures, and the re-writing of basic concepts in law is down right depressing. My ability to remain hopeful that the government will engage the citizenry in an honest and faithful manner is waning. The primacy that government is claiming over the citizen is making a mockery of citizenship. The core legitimacy of governance relies on its citizenry, and when the citizen is no longer valued or honored, what is basis or claim government can make either to itself or the people to which they claim is governed?

Our republic, Mr. Franklin, is not recognizable–so we didn’t keep it.

Clive Robinson • May 22, 2019 4:20 AM

@ Sherman Jay,

Trying to be careful without jumping over the line into paranoid, I’ve changed my junker, air-gapped Internet computer. It now runs from an eccentric CD version of linux. When I turn it off, everything evaporates (I hope and believe).

The way things are going you have to start asking “Can you be paranoid enough to stay free?”.

It’s fairly clear that Gluegle are subverting not just browsers but internet standards, to make “collect it all” their primary mission. Then there is Peter Theil and Palantir with it’s database on everyone. Whilst there was a lot of noise about Facebook and Cambridge Analytica, they were but one of many corporates recording not just every word you type, but in the case of some such as Glugle even the biometric of your typing cadence. Then there are the Internet Service Provoders, that are now not just recording but actively tagging your data packets…

There is a long list possibly including your employer spying on you before we even get to talk about SigInt agencies and Law Enforcment.

Many years ago before such spying started I realised that I could not keep up with the tricks malware writers and others were coming up with. Thus I decided to segregate all my personal work computers from any kind of publically available network. As WiFi became available, I decided not to play because as far as I was concerned, the fact you could monitor it on the street outside “made it public” some years later as we know Glugle cycled by recording all the WiFi ID’s etc…

Looking back, I can see other areas where at the time I thought I was being a bit extream, but with hindsight I now know I was perhaps not paranoid enough. Esspecially since the old joke about a ton of concreate and the Challenger Deep in the Mariana Trench is now not sufficient. As you may have heard back in April Victor Vescovo achieved a new record descent to 10,928m) / 35,849ft becoming the first person to dive the Challenger Deep twice, thus it’s now a “tourist spot” and people will be taking anything that’s not nailed down, including that supposadly secure computer 😉

The point being technology makes fools of us all given a little time and trying to stay even moderatly secure increasingly difficult. Especially when so many people think they can make a fortune out of any data they can grab.

It’s the reason why I have no IoT in my property nor will I have for as long as there are other ways. Likewise “smart meters” and the like. After all do I realy need my data going more than half way around the world to China and back again?

George • May 22, 2019 4:53 AM

@Clive Robinson wrote, “It’s fairly clear that Gluegle are subverting not just browsers but internet standards, to make “collect it all” their primary mission. Then there is Peter Theil and Palantir with it’s database on everyone. Whilst there was a lot of noise about Facebook and Cambridge Analytica, they were but one of many corporates recording not just every word you type, but in the case of some such as Glugle even the biometric of your typing cadence. Then there are the Internet Service Provoders, that are now not just recording but actively tagging your data packets…”

Intersting revelations. There must be a list of pro’s and con’s of surveillance orchestrated from different perspectives.

As Facebook probably have concluded years ago, the most realistic profiles lies in our mobile computing usage. As the amount of bandwidth and data exponentially increases due to mobile innovations both technically and socially, the surveillance folks of various purposes may eventually run into a laws of physics problem. At the moment, tagging data packets appear to be the most future proof solution. IMHO

WiskersInMenlo • May 22, 2019 5:39 AM

Is there a way to have secure voting and privacy?

A secret ballot by its nature is nearly impossible to audit.
Digital systems are opaque to audit by individuals without a CS degree.
Thus the ballot itself needs to be a physical thing that can be managed by humans. Yet like cash money transactions it is still hard. Chain of custody systems for evidence are a model for managing the physical media.

Tabulation of the ballots quickly, requires automated tools. Automation can be done by multiple reader systems for redundancy. Two teams, two vendors, single data source.

But how does voter Bob know his ballot was or was not in the ballot box?
How does a court prove tampering?

Should a reader at the polling site scan the ballot and print a cryptographic secure hash of the ballot? Should the ballot have random boxes the voter can mark to help generate a hash not reversible to votes cast. Can a check system then verify the hash at a later time?

Perhaps boxes spanning perforation lines so a set of pages is doubly linked to a ballot receipt. And none of the tiny #2 pencil tiny box marks of 50s tech ..

Ballot readers should be multiple purpose. i.e. reader and ballot design should be robust and simple enough for schools to use for routine multi choice tests.

Bingo card and Keno tickets are interesting hand mark on paper models .

Bob Paddock • May 22, 2019 7:06 AM

@1&1~=Umm

“If the US is not carefull it’s going to start to paint it’s self into a corner. When Trump and Co say ‘Our way or no way’ or the equivalent they are likely to find the ‘No way’ option will hurt them rather more than they expect.”

Something overlooked by most everyone is that modern technology requires quantities of Rare Earth Oxides. China is the only source of these Oxides.

A recent issue of Coal Age magazine went in to the details:

https://www.coalage.com/features/kentucky-pilot-plant-produces-rare-earths-controversy/

gordo • May 22, 2019 11:00 AM

It looks like we should expect to see more of these kinds of independent reports.

Facebook found hosting masses of far right EU disinformation networks
By Natasha Lomas

The bogus mainly far-right disinformation networks were not identified by Facebook — but had been reported to it by campaign group Avaaz — which says the fake pages had more Facebook followers and interactions than all the main EU far right and anti-EU parties combined.

[. . .]

One major ongoing issue where political disinformation and Facebook’s platform is concerned is that how the company enforces its own rules remains entirely opaque.

https://techcrunch.com/2019/05/22/facebook-found-hosting-masses-of-far-right-eu-disinformation-networks/

albert • May 22, 2019 11:31 AM

@The Pull,

The Cone of Silence:
https://en.wikipedia.org/wiki/Cone_of_Silence_(Get_Smart)

Not pertinent, but interesting: US quiet zone (RF):
https://en.wikipedia.org/wiki/United_States_National_Radio_Quiet_Zone
..

@WiskersInMenlo,

There’s a shipload of discussion on voting systems in prior editions of this blog.
#Paper ballots overseen by local party reps seem to be the best system.
#Anything using computers and/or the Internet should be avoided.
That’s my takeaway on the subject.
. .. . .. — ….

1&1~=Umm • May 22, 2019 11:42 AM

@ Bob Paddock,

“Something overlooked by most everyone is that modern technology requires quantities of Rare Earth Oxides. China is the only source of these Oxides.”

It’s been mentioned on this blog one or two times in the past decade, back when China used it as a way to get hold of Western IP. I remember someone very specificaly warned it was a security threat that short term US managment and politicos were walking into.

One or two people claimed at the time it was all rubish because there was some old hole in Nevada or some place…

Well wherever the hole is I guess it’s still there and Western tech has haemorrhaged into China one way or another…

No sign of the neigh-sayers these days… But then they snipe and when the truth comes along, oh look they are nolonger around, or have changed their handle…

A90210 • May 22, 2019 12:22 PM

Some election MSM posts

https://www.nytimes.com/2019/05/19/world/europe/european-parliament-elections-populists.html

https://www.theguardian.com/politics/2019/may/21/brexit-party-nigel-farage-italy-digital-populists-five-star-movement

https://www.nytimes.com/2019/05/21/opinion/austria-russia-vice-chancellor.html Opinion

https://www.nytimes.com/2019/05/22/opinion/poland-law-and-justice.html Opinion

Other

https://www.ecfr.eu/specials/what_europeans_really_want_five_myths_debunked

Bob Paddock • May 22, 2019 2:00 PM

@1&1~=Umm

“One or two people claimed at the time it was all rubish because there was some old hole in Nevada or some place…”

That would be the raw material, Rare Earth Elements (REE). Only China turns them into usable Oxides at the moment. Finding REEs that are not contaminated with natural Thorium or Uranium is the real challenge. US Regulations say such REEs must be treated as nuclear waste. So places that are already mining just bury the REEs back in the ground rather than deal with the burdensome nuclear regulations inflicted on them if they tried to refine them.

Sherman Jay • May 22, 2019 5:46 PM

Dear @ Clive @ Patriot @ Faustus @ Albert and many others, thank you for all the excellent info you provide.

I’d like to offer the following Rudimentary Analysis of Suspicious Internet traffic. I know this is not a highly technically exhaustive procedure, but I’m using the simple reasoning and methods I know.

After booting from a Linux CD on the junker internet computer and visiting my ‘daily regular’ sites, I observed all kinds of ‘RX/TX Internet traffic’ being reported.

So, I ran a bunch of tests.
I rebooted into the Linux CD and after connecting to the internet and initiating no browser, there was no ‘traffic’ through the connection for a few minutes.

I then visited only ‘non-commercial sites’ (sites that I knew were not loaded with G0000Gley and Farcebook tracking cookies) and found that the ‘RX/TX traffic’ only occurred at approp. times when loading pages or interacting with the sites.

I then visited a gocomicsDOTcom page (knowing that it loaded lots of G0000Gley, Farcebook and other tracking cookies, etc.) and the ‘RX/TX traffic’ went crazy and kept up bursts of RX/TX activity every 5-10 seconds even after leaving that site. When I closed the browser (deleting ‘everything’ hist., cookies, cache, etc.), the ‘RX/TX traffic’ stopped.

I know/hope that, by running from a CD, when I shut the computer down, ‘everthing’ evaporates and Gparted continues to report the swap partition on the HDD has remained unused).

As I write this with the internet connection still open and only a text editor running I’ve not seen any ‘RX/TX traffic’.

However, I’m sure that my ISP is ‘hoovering-up’ all the info it can about my ‘Internet travels’.

A few days ago, I ran a quick experiment in ISP identifying computers. I took a ‘famous brand’ laptop to a semi-public WiFi location and connected it running Linux from CD with a ‘semi-random number’ as the computer ‘name’ during the boot process. The WiFi network identified the laptop by that name. I then shut the laptop down and ran another version of Linux from CD creating a different computer name at boot. I then connected to the WiFi network and — It still recognized the laptop by the old name. This seems to indicate that the ISP was actually identifying the laptop by another means: perhaps the CPU serial? I would like to know how the ISP identified the laptop and if there is any way of preventing that, since that is likely a means that the ISP and other trackers (G0000Gley, Farcebook, etc.) might be using.

p.s. The Schneier site (as we would expect) showed no suspicious ‘RX/TX traffic’

22 May 2019 00:00:00 • May 22, 2019 6:52 PM

@Sherman Jay

“I would like to know how the ISP identified the laptop …”

WiFi MAC address?

22 May 2019 00:00:00 • May 22, 2019 7:17 PM

Democracy Now and

a) Austria
b) Australia
c) Brexit
d) European Parliament Elections

a) “Austria Calls Snap Election After Far-Right Leader Caught in Corruption Scandal”
https://www.democracynow.org/2019/5/20/headlines/austria_calls_snap_election_after_far_right_leader_caught_in_corruption_scandal

b) “Australian Voters Choose Conservative PM Morrison Over Opponent Who Vowed to Tackle Climate Change”
https://www.democracynow.org/2019/5/20/headlines/australian_voters_choose_conservative_pm_morrison_over_opponent_who_vowed_to_tackle_climate_change

c) “U.K. in Crisis: Facing No Deal, Parliament Votes on Brexit After Rejecting May’s Plan for Third Time”
https://www.democracynow.org/2019/4/1/uk_in_crisis_facing_no_deal

c) “EU Leaders Extend Brexit Deadline to Oct. 31”
https://www.democracynow.org/2019/4/11/headlines/eu_leaders_extend_brexit_deadline_to_oct_31

d) “Protesters Take to the Streets Ahead of European Parliament Elections”
https://www.democracynow.org/2019/5/20/headlines/protesters_take_to_the_streets_ahead_of_european_parliament_elections

Sherman Jay • May 22, 2019 11:43 PM

@ 22 May 2019 00:00:00

Thanks for the info. WiFi MAC address? Ahhh, I hadn’t thought about that. Good idea, that seems more likely than trying to access the CPU serial number. And, it would have to be available to the network and wouldn’t change even though the ‘name changed’.

I ran a search for what might be used and found very little. I have to admit it’s effectively impossible to keep up with the incredible barrage of info we’re hit with these days.

Weather • May 23, 2019 12:51 AM

Sherman
A old hack use t/wireshark etc to find the Mac of a IP address on the same switch/hub send raw packets from google.c with the Mac of the one switch/hub/router uplink of the switch and synic syn/back and you can mitm on a switch without ARP poisoning. Or nmap them. 😉

Weather • May 23, 2019 1:00 AM

Inet(google 126.0.0.0)
,
ISP(Mac 55)
,
Router(Mac 66)
, ,
Switch. Switch
, ,
You. Target

You send 126.0.0.0 with Mac 66 opens up Nat for nmap, match syn/back without sending packets sniffer

1&1~=Umm • May 23, 2019 5:12 AM

@Bob Paddock:

“US Regulations say such REEs must be treated as nuclear waste.”

In some respects, –such as no safe limit– not an unreasonable approach.

However the “there is no safe limit” for ionizing materials is not actually supported by scientific evidence…

Anyone who has granite in their lives such as that used in buildings they live/work in or land they live on, will often find their background radiation levels are higher. Likewise all sorts of old style manufactured goods such as some Victorian era glass, second world war and later equipment including wrist watches and cockpit instruments and many medical instruments from the Victorian era onwards right upto today can give you an “annual limit” in way less time. Oh and do I dare mention “soft X-rays”? from CRT’s used for over 7 decades in very close human proximity, not just in scientific and engineering equipment but those of home entertainment and office working as well…

Even some foods we eat or cigarettes some smoke will cause ionizing materials to enter the body in much higher quantities…

I’m by no means saying ionizing materials are safe, but mankinds ancesters have lived with them as have most creatures during their on going evolution including those around natural fission nuclear reactors[1]. In a region that we have conjectured for many years that life evolved in and subsequently moved out and around the rest of the planet[2].

We also know that our bodies have evolved to the point where we have not just some tollerance of things in our environment but ways to deal with them up to a point. In fact some things we actually need in small quantities will surely kill us in larger quantities.

Thus it would not be unreasonable to suggest that our relation to ionizing materials may well be non-linear. Studies from the likes of the Chernobyl site suggest that not only is the wildlife surviving but thriving without any more signs of harm from ionizing radiation than you will find in many other areas where there has not been a release of ionizing materials.

[1] Natural Fission Nuclear Reactors, were predicted to have been possible back in the 1950’s. In the early 1970’s the nuclear materials from the Oklo Mine, located in –then French– Gabon not far from the equator on the West coast of Africa were coming up short by around 1/6… Which was of significant concern as auditing of fissile materials was and still is a major part of nuclear non proliferation. The resulting investigation gave issotope signitures indicitive of fission and thus the most likely cause. Later evidence has tended to confirm this.

Wesley Parish • May 23, 2019 5:18 AM

Something interesting came up in connection with the US-PRC trade war farce:

Trump Administration Could Blacklist China’s Hikvision, a Surveillance Firm
https://www.nytimes.com/2019/05/21/us/politics/hikvision-trump.html

Adding to those concerns are the global human rights implications of China’s extensive surveillance industry, which it increasingly uses to keep tabs on its own citizens. The Chinese have used surveillance technology, including facial recognition systems and closed-circuit television cameras, to target the Turkic-speaking Uighurs, who have accused the Chinese government of discriminating against their culture and religion.

Of course, the Trump administration, which has shown such admirable interest in the well-being of the vulnerable, such as the asylum seekers on the southern US border /sarcasm off … will gleefully jump on the Human Rights aspect as justification …

Meanwhile, back at the kibbutz

Apartheid Arms: Why Israel Sells Military Equipment to Human Rights Violators
http://www.palestinechronicle.com/apartheid-arms-why-israel-sells-military-equipment-to-human-rights-violators/

An in-depth report released in Hebrew by Amnesty International’s Israeli chapter provides a damning picture of Israeli arms exports to countries that violate human rights. This report provides solid evidence that over the past 20 years, Israeli military exports went to at least eight countries that have been known for serious violations of human rights: (snip) United Arab Emirates – which has imprisoned government critics and human rights activists – received Israeli spyware software, including the infamous “Pegasus” spyware

Which gives me an uneasy feeling that one day when this current far-right wave has become a tsunami, Jews may be forced to praise Israel for supplying their persecutors with surveillance tools, because otherwise they would’ve been persecuted inefficiently. And as we all know, “efficiency” trumps Human Rights. And besides, Oceaxe’s Dictum in Voyage To Arcturus is the current reigning interpretation in Washington, D.C.,

Oceaxe gave a beautiful sneer as she took a step toward the river. “Better men than you — better in every sense of the word — are walking about with foreign wills inside them. You may be as moral as you like, Maskull, but the fact remains, animals were made to be eaten, and simple natures were made to be absorbed.”

“And human rights count for nothing!”

She had bent over the river’s edge, to wash her arms and hands, but glanced up over her shoulder to answer his remark. “They do count. But we only regard a man as human for just as long as he’s able to hold his own with others.”

Faustus • May 23, 2019 10:11 AM

@ Sherman Jay

Thank you for the kind words. I really appreciate your positivity on this blog.

As “@May 22” suggests, the OS you use doesn’t normally affect the Layer 2 attributes of your device, especially the Mac addresses. Switches and routers on your network cache the MAC – Lan IP address associations and the probably cache MAC – Device Name associations too.

If you reboot your router and any switches on your LAN does the name persist? You can also manually override the Mac address thru Linux. This will probably remove the association.

HTML5 provides Web Sockets for direct communication between browser and server. This may be a lot of the TX/RX you see. They enable rich web interfaces, and certainly can be used to extract data. But I don’t think they are more suspicious that any other kind of javascript. Noscript does a good job of shutting down most data extraction while still retaining decent usability.

gordo • May 23, 2019 10:34 AM

Pwned…

How Silicon Valley gamed Europe’s privacy rules

Politico.eu Updated 5/23/19

Weeks before Europe’s new rules became law, the search giant contacted all websites, both inside the EU and elsewhere, that relied on the company’s dominant advertising services, informing these publishers that they would now have to solicit people’s consent to collect data on Google’s behalf.

Under Europe’s new privacy standards, the tech giant must get people’s permission to target them with digital advertising. But by forcing publishers to do this work for Google — the search giant said if websites did not comply, they would not be able to use the company’s advertising services — it added an additional line to the company’s revamped privacy settings, which allowed Google to take ownership of people’s data from publishers that it then could use for its own undefined purposes.

https://www.politico.eu/article/europe-data-protection-gdpr-general-data-protection-regulation-facebook-google/

MarkH • May 23, 2019 4:23 PM

.
Assange Update

As soon as Julian Assange was arrested in the Ecuadorean embassy in London, the US started the process to extradite him, on the basis of a single “hacking” indictment which had been made secretly the previous year.

Today, the US has added 17 counts of violating the Espionage Act in a superseding indictment.

It’s no surprise that the US had more charges up its sleeve, considering past characterizations of Assange’s alleged offenses.

Reportedly, in its attempt at extradition, the US will need to guarantee to the UK that Assange would face no additional charges for any prior conduct after he would be sent to the United States, so the federal prosecutors are facing some sort of deadline to finalize their list of charges.

Unlike the previous hacking charge, which alleges that Assange participated in attempted illegal access, the new charges are essentially for publication of secrets illegally furnished by Chelsea Manning.

Accordingly, these charges are for actions typical of those taken by journalists working to uncover government conduct/misconduct, and seem to be on a collision course with the first amendment to the US constitution.

Apparently, the prosecution’s argument will be that the nature of Assange’s actions, and of the wikileaks operation, are distinct from journalism as traditionally understood.

However, that supposed dividing line would be subtle and difficult, and the implications for press freedom very serious.

In another development, Sweden is considering reviving at least one sexual assault charge against Assange, and pressing its own extradition case.

That could have interesting implications, because Swedish law forbids extradition for crimes deemed to be political in nature or motivation.

So, if Sweden were to classify the US charges as political, extradition to Sweden could shield Assange from extradition to the US … provided that he would then spend the remainder of his life without setting foot in any state that has an extradition treaty with the US.

Clive Robinson • May 23, 2019 7:25 PM

If people want to read more on the latest Julian Assange they can have a look at,

https://www.cbsnews.com/news/julian-assange-indicted-on-18-federal-charges-related-to-wikileaks-release-of-chelsea-manning-docs-today-2019-05-23/

The CBS viewpoint is that the 17 new charges have not yet been revealed but appear from what has been said, the charges appear to be the equivalent of “aiding and abetting” and “consipracy”.

I guess the USG having spent many millions of dollars messing with Ecuadorian politics and then giving massive bribes are keen to get some return on their investment.

But at the end of the day it’s just petty vindictivness of old war hawks and IC seniors being shown to be impotent to the world that has made them waste ridiculous amounts of taxpayer dollars that could have been better spent on other things rather than pointlessly increasing the US debt.

With such idiotic behaviour being shown you have to wonder if any of those involved have any credibility what so ever…

Speaking of idiocy no doubt the Australian Government will start bleating again. Julian Assange having been not an Australian citizen, and ignored by the Australian Government whilst in the equadorian embassy in London, now there is the opportunity to get their hands on him they have been anouncing that they want him back. No doubt to drag him of an inbound flight and shove him straight on a US flight without his feet touching free Australian soil.

Clive Robinson • May 23, 2019 8:04 PM

@ gordo,

My opinion of Glugle is so low it’s lower than a shakes ass in a wheel rut and sinking faster than a lead kipper in the Marianas Trench…

However my thoughts on the matter would need carefull and some what difficult translation into “Suitable For Work” language 😉

There is however a little hole in Glugle’s plan that might just blow their foot off a little below the neck (one can but hope).

To get user consent, the user has to have both javascript and cookies enabled. If they don’t they might get a blank page, but so far in European sites I’ve visited that is rare to the point of I think just one. The rest have alowed me to continue into their web sites both unasked and unhindered…

A side effect also appears to happen with Europeans visiting Australian blogs that use Glugle related “Atom” software to alow comments to be made. No matter what method you used even anonymous their software did not alow a European to post (unless they VPNed). However in the past couple of days the behaviour has changed a little and you get requested to register with Atom. Which is in a way rather telling about what Glugle are doing with that software… They appear to be even more rapacious than the US IC “collect it all” behaviour…

Another issue that might arise is Glugle collecting user biometrics via their search engine and other interactive systems…

As anyone who observes a key by key entry into the Glugle search box or click on their capatcha images, if you have javascript enabled then each key press / click causes data to be sent to Glugle which alows for the user key press cadence timing etc to be captured quite effectively…

Which begs the question,

    Is there no evil that Glugle won’t commit?

name.withheld.for.obvious.reasons • May 24, 2019 2:04 AM

A wider context…

Conference held at Hudson Institute 16 April 2019 (Youtube Video)

The meeting is attended by former appointees in various governments, from the U.S. to France and India.

Under Secretary, a former G.H. Bush flunky (didn’t get his name), in a sense followed Trump with the strategy of dealing with the EU using a “protection racket” approach. He is nervous with the European position; Boeing and Airbus, Trump would pull the trigger. This former under-secretary suggested that Germany’s economic performance (running surplus of over 8% is unacceptable) cannot be sustained—perceptively?!?

The EU representative spoke plainly, the EU is concerned with the unilateralism being exercised by the United States.

Let’s hope for the best. EU, US, and India with France as the probable lone EU member state that participates in a strategic naval hegemony. An exercise where the French join the US to show mobility via Suez to Indian Ocean that demonstrates reach.

More interested in chasing Google about privacy than defending against China, was the under-secretary’s opinion (WTF).

OBSERVATIONS:
France and India appear to be on board with the U.S. thuggery. United front against the Chinese challenge, China can be made to comply with the Indio-Pacific primacy. India is stating that U.S. only can achieve this strategic answer to the threat of their adversary, China.

Italy, Greece, possibly Spain, and a number of southern states of the EU are not a participant in the EU/US/India hegemony.

Spending is the crux of the push by US to force the thugs, in order to be co-thugs, in this strategic alignment that will force the alignment of Russia and China. Huawei is considered a threat as the U.S. claims supply chain supremacy (what a laugh). This is what happens when flunkies graduate from some institutional joke-a-versity or stink-tank.

Yegers (sp?) (China’s Muslim problem) are brought up as an issue, what about the U.S., Brazil, Hungary, Poland, N. Korea, Saudi Arabia, Syria, Iran, Israel, Lebanon, Palestine, Venezuela, Argentina, Myanmar, or Australia and the other new tyrannies?

Jockeying for primacy in the ring-of-death, this know-nothings play patty cake with rockets, bombs, missiles, and guns as if the pieces on the board are theirs…

The believe that only the “strong” and “respected” can achieve whatever, is carried to the degree that it resembles a farcical Shakespearian tragedy, I just wonder which one is the jester? Where be your jibes now.

albert • May 24, 2019 12:05 PM

@Sherman Jay,

I read somewhere that you can change you MAC address in Terminal.
ht tp://www.aboutlinux.info/2005/09/how-to-change-mac-address-of-your.html

Let us know how you fare…

. .. . .. — ….

Sherman Jay • May 24, 2019 1:28 PM

@albert,
Thanks for that link, I’ll check it out.

I just finished reading: https://www.howtogeek.com/192173/HOW-AND-WHY-TO-CHANGE-YOUR-MAC-ADDRESS-ON-WINDOWS-LINUX-AND-MAC/

They also mentioned the command line MAC address change for Linux.

“in my spare time” I will go to that ‘semi-public’ wifi spot and try connecting, disconnecting changing the MAC address and then connecting again to see if that clears their identification of my computer.

Also,
@ Clive Robinson,
I feel only anger and disgust for Amazin and G00gley. They are huge corporate thugs. I do whatever I can to avoid aiding them in any way. Can’t avoid all the G00gley tracking fonts, ads and other crap on many commercial sites, but I use duckduckgo for searchint. And, we will NEVER buy anything from Amazin I intentionally buy tech/computer products from smaller more honest companies (local whenever possible).

I remember when my cousin was actively running a small publishing firm and he was distraught at Amazin and G00gley stealing and scanning millions of books, some of them still in copyright.

MarkH • May 24, 2019 2:44 PM

@Clive:

Australia has publicly claimed Assange as its citizen, since his arrest.

Assange has been an Australian citizen continuously — without lapse — since his birth.

Australia can, within limits, revoke citizenship based on conduct. Arguably, Australia could have done this to Assange while he was in the Ecuadorean embassy, but did not. The special power of revocation, enacted in 2015, has been used only about a dozen times … and not against Assange.

Rather than revoking his citizenship, Australia issued a new passport for Assange while he was still in the embassy, his previous passport having expired.

You seem to recall that Assange publicly renounced his citizenship. While I trust your sincerity, I haven’t yet found any record of him doing so.

Legally, however, such a statement has no effect. Australia has a process for citizens who wish to relinquish their citizenship: they must execute a formal application, which the government may accept or reject at its discretion.

My guess, is that many states have comparable procedures, for very practical reasons. Citizens may wish to terminate their citizenship for reasons of personal convenience, including:

• avoidance of taxes
• evading payment of past taxes, legal fines, or civil judgments
• evading payment of ordinary debts
• evading alimony or child support payments
• evasion of compulsory military service
• escape from jurisdiction for actual or alleged crimes

It’s easy to see that states might not grant a termination of citizenship in some of these cases.

I find no evidence that Assange ever made an application to terminate his Australian citizenship.

Now that Ecuador has “suspended” his citizenship (whatever the hell that means), Assange and Australia are stuck with each other. When he leaves the UK, under whatever scenario, he will be traveling with an Australian passport.

While I personally don’t care a whit about Assange as an individual, I am very concerned about the potential for abuse and harmful precedent in his prosecution.

However, I think that his “boosters” have been pessimistic. The notion that he would be waterboarded or sent to Gitmo is pure fantasy.

If the present charges are all there will be — and as I explained above, the US must soon have a “final” list — then his future is probably not very dark.

The 18 espionage counts are very likely to die in the US court system. We still have a constitution here, it still protects the right of the press to publish news regardless of the source, and the argument that Assange isn’t a “real” journalist is very weak indeed. Every journalism organization in the United States will support Assange’s legal case with great strength.

Even Fox News will remove its tongue from Trump’s arsehole long enough to make a friend-of-the-court brief in Assange’s favor — they depend on the first amendment too.

There’s a long history of federal court rulings in favor of press freedom, and I don’t see that trend turning around just yet.

The previous count, of conspiracy to hack, also seems highly debatable, if not quite weak. Good legal counsel — and Assange will have the best — will pepper it with buckshot.

Even if Assange were convicted, his sentence would likely be for less time than he spent attempting to evade extradition.

The UK might well refuse to extradite him, precisely because the charges against him are so sketchy.

But if I were his counsel, I would invite him to consider waiving extradition. The US has the most corrupt president in its history, who knows that Assange helped him to win the election. His best bet might be speedy trial, with a good chance of acquittal, and a pardon from Trump if he’s convicted.

Symphony for the Devil • May 24, 2019 3:05 PM

@Sherman Jay

Tails used to have an interesting tool for randomizing MAC addresses: random, random from the same vendor, and so on.

Clive Robinson, however, IIRC, in the past has warned about changing MAC addresses.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.