Comments

SpaceLifeForm • July 9, 2021 5:02 PM

Voting’s Hash Problem: When the System for Verifying the Integrity of Voting Software Lacks Integrity Itself

hxtps://zetter.substack.com/p/votings-hash-problem-when-the-system

Letting the vendor conduct verification checks of its own software was the equivalent of the fox guarding the hen house, one voting systems examiner for the state said.

[No surprise, they have always been suspect]

Fake • July 9, 2021 5:42 PM

” Kaseya, a provider of remote software updates and other services to between 800,000 and 1 million end-users, instructs customers to disable antivirus and other security applications’ ability to scrutinize and possibly raise alarms about Kaseya’s trusted software updates. ”

No Name posted that in

https://www.schneier.com/blog/archives/2021/07/details-of-the-revil-ransomware-attack.html/#comment-383424

If people, corporations, management… Think that that is OKAY… I’m floored, FLOORED.

ARE THEY KIDDING? You manage my permissions and you want me to disable my anti virus, are you going to install your own?

No? I’m floored.

https://www.barrons.com/articles/software-as-a-disservice-security-shortcuts-are-exposing-computers-to-hackers-51625844951

echo • July 9, 2021 11:04 PM

https://www.tehrantimes.com/news/462804/China-plans-to-form-alliance-with-Iran-Pakistan-and-Turkey

China plans to form alliance with Iran, Pakistan, and Turkey to undermine U.S. hegemony: professor

“In conjunction with all this, it seems that Chinese military analysts also support building new alliances related to the Middle East (West Asia), including, for example, the formation of a (Turkish-Iranian-Pakistani) alliance, in their desire to discourage India from cooperating with the “Quartet” sponsored by Washington to contain China,” Nadia Helmy tells the Tehran Times.

According to the professor of political science at Beni Suef University, China wants to send a “clear signal to Washington that Beijing does not intend in the future to be satisfied with playing an economic and commercial role only, but rather has the ambition to turn into a geopolitical and military actor. It has a worthy place in the international balance of power.”

I’m not taking any of this at face value as even academics can have an axe to grind. The issue of “establishment” academics and academics whose personal politics drives their work is quite old. Bodies like the UN and universities have had to deal with this in the past so they are very aware of it.

Journalists are journalists. It can be easy to nod along with the received view or what appears to be popular and stenagraphic journalism, while it has its place, can allow unfiltered agendas to grace the page. When this happens I always find what they leave out as opposed to what they put in to be more interesting. This usually gets my radar twitching.

It is notable international affairs are largely accountable to UN obligations in principle if not always in practice…

https://en.irna.ir/news/84398188/The-G20-faces-three-big-tests

Tehran, IRNA – Since the start of the COVID-19 pandemic, we’ve heard a lot about global solidarity. Unfortunately, words by themselves will not end the pandemic – or curb the impact of the climate crisis. Now is the moment to show what solidarity means in practice. As G20 Finance Ministers meet in Venice, they face three crucial solidarity tests: on vaccines, on extending an economic lifeline to the developing world, and on climate.

I find it quite odd they put the leading paragraph directly under the photograph of the UN Secretary General.

The EU position on the broad range of these issues is more about economic development. As well as giving nearly half of vaccine production away to less developed countries the basic sceme is to encourage the building of factories so these countries can make their own in future. This obviously comes with an amount of responsibility such as personnel and safety standards among other things. This would fit with the general point of view that civic structures are a security issue. Indeed, this is reflected in the EU founding treaties and UK MOD position papers among others. Cash handouts are mentioned nowhere. In fact the EU has never written blank cheques for development even with EU member states. As Hungary is finding out this past week cash is being linked to the rule of law (specifically in Hungary’s case human rights law) including Covid-19 relief cash.

EU human rights law is governed via the European Convention and the ECHR (European Court of Human Rights). The European Convention is a vehicle to bring into law UN human rights obligations which the Sectretary General is rather keen on as it is his job to ensure they are implimented…

echo • July 9, 2021 11:32 PM

https://therecord.media/biden-raises-ransomware-topic-during-putin-phone-call/

Following a series of impactful ransomware attacks that hit companies like Colonial Pipeline, JBS Foods America, and Kaseya, causing widespread havoc across the US, President Joe Biden raised the topic of ransomware attacks carried out by gangs of Russian criminals during a phone call today with Russian President Vladimir Putin.

“The President […] underscored the need for President Putin to take action to disrupt these ransomware groups,” Jen Psaki, White House press secretary, said today during the daily White House press briefing.

“REvil operates in Russia and other countries around the world, and we do not have new information suggesting the Russian government directed these attacks […] but we also believe they have a responsability to take action.”

“The President made clear the United States will take any necessary action to defend its people and critical infrastructure,” Psaki said.

This is really quite a clever approach. To a large degree it defuses US domestic hardliners who see reds under the bed every time they sneeze. While indirect iIt also sidelines the general body of hardline dialogue which is experienced domestically ona range of fronts from economics to discrimination.

http://www.constitution.ru/en/10003000-01.htm

We, the multinational people of the Russian Federation, united by a common fate on our land, establishing human rights and freedoms, civic peace and accord, preserving the historically established state unity, proceeding from the universally recognized principles of equality and self-determination of peoples, revering the memory of ancestors who have conveyed to us the love for the Fatherland, belief in the good and justice, reviving the sovereign statehood of Russia and asserting the firmness of its democratic basic, striving to ensure the well-being and prosperity of Russia, proceeding from the responsibility for our Fatherland before the present and future generations, recognizing ourselves as part of the world community, adopt the CONSTITUTION OF THE RUSSIAN FEDERATION.

Then there is the issue of the rule of law. After reading through this the other month it crossed my mind that Putin’s stated position, which I assume to be made for nationalistic and other reasons, was questionable. Russia has its own qualities and situation to deal with and ruling a country can be easier said than done. At the same time it is a serious issue and as is being revealed in the UK post Brexit the rule of law does matter even if the current regime has a cavalier attitude towards it. By placing the rule of law at the centre of the discussion different questions begin to be asked.

Russia is a member state of the Council of Europe hence ratifying the European Convention. Now, the Duma did pass a law making Russian law primary but in practice this does land Russia in hot water with the EU. Hungary is going through this right now and getting rather a kicking.

While authoritarian rulers can appear strong there is always the whiff of reactivity and weakness about them and they can come unstuck as per Haiti. Putin got into power partly because he was a favourite of Yeltsin and partly because Yeltisin wanted an immunity deal. Yeltsin got this but the instant Put got the keys to the kingdom Yeltsin was yestedays man. Putin as we know from his own comments is holding out for an appropriate successor. However, I feel that the rule of law and pluraity and human rights is the direction Russian could and should travel in and these are not orthogonal to being a successful nation. Indeed, it does seem to be the case the more successful nations tend to be arranged around these lines.

AmeriKKKa • July 10, 2021 5:42 AM

Unbanking, internet disconnection, no-fly/red flag orders, and housing/employment denial are going to be the next big pushes in retaliating against wrongthinkers. None require laws, all can be accomplished via internal revolution and mob pressure. The government won’t need to act, just stand out of the way and wait for a new social credit system to be developed and rolled out by private industry in conjunction with big tech. You don’t need a Facebook account, Facebook already has huge dossiers on everyone who isn’t a member.

No Name • July 10, 2021 11:59 AM

Upacking Accellion and Clop ransomware. What really happened.

  1. Accellion has 2 content firewall/file-transfer products, one on-prem and another cloud.
  2. They have 187 employees according to LI. Often that number can include former employees, so the count is likely lower.
  3. Their cloud product is certified moderate for FedRAMP.
  4. They announced they were breached around the same time as the Microsoft. Their products interoperate with O365.
  5. In order to get FedRAMP certified they had to attest that they complied with NIST 800-53. But it is impossible for a company with 187 employees and an offshore development team in 3 different countries to comply with NIST 800-53. It is against the law to design or support FedRAMP certified technology offshore. This relates to a 2010 Obama Executive Order and other regulations.
  6. FireEye/Mandiant investigated this attack, issuing their final report March 1, 2021. It solely focuses on exploit. There’s no mention of Accellion insiders, negligence or lack of FedRAMP controls. ht tps://www.accellion.com/company/security-updates/mandiant-issues-final-report-regarding-accellion-fta-attack/
  7. In December 2020 at least one of Accellion’s Senior Engineering Managers left Accellion when they were under attack. Their profile shows that this person managed distributed offshore development teams (Ukraine, India, Singapore) while at Accellion. It also shows that they transitioned to developing their Android application in 2014.
  8. This Accellion’s cloud product sheet from 2014. I suspect there might not be a lot of difference between their on-prem and cloud product. Yet they adamantly maintained that their cloud version is safe ht tps://www.accellion.com/sites/default/files/wysiwyg/ds_mobile-app.pdf
  9. This Engineering Manager is a foreign national too and their profile recommendations shows that they hired all of their overseas development team themselves. In a company of this size everyone has access to production. There’s no controls on commits. Especially when the development team has a 15 hour time-zone difference.
  10. Encryption is illegal in Ukraine and India, yet required under FedRAMP. Who controlled Accellion’s code? Likely no one. Did Mandiant assess their Configuration Management controls and investigate all employees and contractors? I doubt it. Whenever there is a breach they solely identify a vulnerability and never divulge how it occurred. But if insiders are purposely designing these vulnerabilities shouldn’t the Government and public be informed? If we don’t identify how common this is, we won’t be able to stop it.
  11. A few weeks ago the US, South Korea and Ukrainian police raided 21 buildings in Kiev associated with the Clop ransomware gang, which is supposedly behind this Accellion attack. Did they arrest any Ukrainian Accellion employees?
  12. What about the Accellion employees that lied to CoalFire to get FedRAMP certified? They certainly didn’t divulge their Ukrainian development team or they wouldn’t have gotten certified. ht tps://www.zdnet.com/article/ukranian-police-partner-with-us-south-korea-for-raid-on-clop-ransomware-members/
  13. July 8, 2021 Morgan Stanley announced that they were breached 6 months earlier by Accellion through one of their vendors who used the on-prem version. But Accellion’s FedRAMP certification wasn’t high enough for regulated US data. So Morgan Stanley’s vendors were correct to remain on the on-prem version.
  14. Jen Easterly is the head of Morgan Stanley’s Cyber. Congress just confirmed her last week to head up DHS/CISA. Jen Easterly wants to reform FISMA. FISMA is the US Government’s procurement requirements pertaining to NIST 800-53 (a lot more onerous than ISO 27001). I saw her state that self-attestation hasn’t worked and that additional regulation is required to enforce FISMA. I hope that she recognizes the shortfalls in FedRAMP too. FedRAMP is a DHS program.
  15. What’s notable is that Morgan Stanley has repeatedly experienced insider data theft over the past few years. Employees and contractors alike. They even had servers with unencrypted data stolen from data centers. So I very much look forward to the changes that Jen Easterly will be implementing at DHS.
  16. All of the money recovered from the Clop ransomware gang was in US Dollars. Scroll down for photo. This tells me that the attackers had someone in the US converting the bitcoin to dollars. Meanwhile FireEye blamed Russia as usual. ht tps://www.npu.gov.ua/news/kiberzlochini/kiberpolicziya-vikrila-xakerske-ugrupovannya-u-rozpovsyudzhenni-virusu-shifruvalnika-ta-nanesenni-inozemnim-kompaniyam-piv-milyarda-dolariv-zbitkiv/ AND ht tps://beta.darkreading.com/attacks-breaches/accellion-data-breach-resulted-in-extortion-attempts-against-multiple-victims
  17. There’s lots of lawsuits already filed, but I wonder if any Plaintiff’s will scrutinize DHS FedRAMP program during discovery. While their on-prem version wasn’t assessed during the FedRAMP certification process, their staff was. That surely provided a high level of confidence for those doing business with them that the company was compliant with NIST 800-53. But they obviously are not.
  18. The US Government jettisons contractor fraud to whistleblowers. Meaning even when the US Government knows that there’s fraud involved in a federal contract, they don’t prosecute even it is jail time. So there’s little incentive for Government vendors to comply with any laws. The only way for the Federal Government to stop a fraudulent vendor is if a Whistleblower (employee of the vendor) files a False Claim. This means they have to give up their career to do this since it is public information that they are suing an employer. Here’s a case about IBM for $265 Million contract that’s been in court since 2012. The court admits there was fraud, but so far no one is willing to do anything about it. So when the US Government cries about all of these breaches they have no one to blame but themselves and their inability to uphold existing laws. ht tps://www.fedscoop.com/irs-false-claims-act-case-ibm/

Private citizens should never be responsible for enforcing Federal law. That’s ludicrous.

I won’t say what more I know. But this story is not over. This pay to play has to stop. Every company in FedRAMP needs to be reassessed to ensure that their development, staff and data is NOT offshored. THIS is the problem.

PK • July 10, 2021 12:26 PM

If you read German, and if you’re interested in one of the largest financial scandals in Germany then all these three books are very good.
https://www.goodreads.com/book/show/57557223-wirecard
https://www.goodreads.com/book/show/55942379-die-wirecard-story
https://www.goodreads.com/book/show/56984983-bad-company

If you don’t read German then here is a summary in English:
https://en.wikipedia.org/wiki/Wirecard

The company is at the center of an international financial scandal. Allegations of accounting malpractices had trailed the company since the early days of its incorporation, reaching a peak in 2019 after the Financial Times published a series of investigations along with whistleblower complaints and internal documents. On 25 June 2020, Wirecard filed for insolvency after revelations that €1.9 billion was “missing”.[7][8] Long-time CEO Markus Braun subsequently resigned and was later arrested, and former COO Jan Marsalek, after being fired from his position and board seat, disappeared and remains a fugitive wanted by the German police.

echo • July 10, 2021 12:58 PM

https://www.theatlantic.com/ideas/archive/2021/07/jonathan-rauch-americas-competing-totalistic-ideologies/619386/

This is an interesting article. It covers issues like polarision, law and conventions, technology and social engineering, philosophical thought and so forth. I have my own take on the issues and don’t entirely agree with the author on a number of points and think he makes a few mistakes and contradictions but as a broad brush it’s passable enough.

No Name • July 10, 2021 1:07 PM

@PK

I have much respect for Germany’s commitment to data protection. Thank you for bringing Wirecard back into focus. This was a case of international fraud.

Just like at Accellion’s former developer is allowed to remain in the US and transition into financial services, now Wirecard is being rebranded as NIUM after billions went missing.

Wirecard’s Indian operations are starting up again in the United States as NIUM
ht tps://www.dealstreetasia.com/stories/nium-wirecard-india-operations-249822/

Last paragraph shows that their new CEO, Prajit Nanu is moving to San Francisco to move Wirecard to the USA.

Same exact type of payments business that the Accellion manager now works for. San Francisco is overloaded with these unregulated fintechs.

Meanwhile Chime has been emptying out customer accounts. Same type of company.
ht tps://arstechnica.com/gadgets/2021/07/the-chime-banking-app-has-been-closing-accounts-not-returning-money/

Travis • July 10, 2021 5:26 PM

This massive heatwave – we are the culprits.
All out digital environment, server parks and datacenters generate massive amount of heat. Law of physics – it just don’t disappear, it must go somewhere.

Even HTTPS is the culprit. Each TLS transaction takes more energy than pain HTTP and that energy transforms partly to heat. This “HTTPS Everywhere” movement is just plain idiotic. Not all servers need HTTPS.

So my advice – cut down your online life, nobody needs FB or Twitter ot those massive datacenters. Strip down HTTPS where it makes no sense.

We caused that climate change, that massive heat wave and now people are suffering and die!

Clive Robinson • July 10, 2021 8:37 PM

@ Travis,

HTTPS Everywhere” movement is just plain idiotic. Not all servers need HTTPS

Is the wrong argument it’s actually about privacy and user security for every Internet user.

The “authorities will know the content” of most servers simply by “web crawling them”, that’s assumed.

Thus the argument is about the protection of the “user” under “collect it all” and an “uncertain future”.

Let’s say you have a liking for cartoons of dancing hamsters as you find them amusing. On the surface, harmless enough.

Now let’s suppose the next Chinese leader looks sufficiently like a “hamster” that subversive people in China start refering to him as “the hamster”.

We know the NSA “collects it all” from routers all over the world, it’s not unreasonable to surmise that the Chinese State SigInt agencies do similar.

Without HTTPS they may well have your hamster prefrence in their “NSA Bluffdale Utah” equivalent.

You being unaware of the “Hamster” connection go on a once in a life time holiday with your family to see the “Great Wall of China” etc. You have a great time untill that moment in the departure lounge the Chinese State police arrest you and your family…

It does not have to be China or hamsters, it could be any number of places around the world, after all the House of Saud do have the reputation of being not just US NSA trained but chopping up journalists in consulates in other countries.

SpaceLifeForm • July 10, 2021 11:40 PM

@ JonKnowsNothing, ALL

I must agree with @jfslowik on this.

If you care about security at any level, do not go to DEFCON.

It is already a hot-spot, and will be a super-spreader event. Just don’t go.

You don’t need to catch Delta, and then catch Delta. And then spread it.

hxtps://twitter.com/jfslowik/status/1414050013966082052

flat • July 10, 2021 11:45 PM

@echo

“I find it quite odd they put the leading paragraph directly under the photograph of the UN Secretary General.”

I can’t get what is odd about where they put the photograph in that UN Secretary General op-ed?

Travis • July 11, 2021 7:26 AM

@ Clive Robinson

You are so shortsighted.

HTTPS don’t provide ANY security or privacy.
This is fake illusion.

https://www.wired.com/2010/03/packet-forensics/
https://arstechnica.com/information-technology/2012/09/big-brother-meets-big-data-the-next-wave-in-net-surveillance-tech/

You are thinking you are communicating with the real “www.schneier.com” blog because certificate looks right, fingerprint looks right? LEA goes and takes from CA duplicate of the certificate so that even fingerprint looks right and then creates duplicate site. It’s so easy to do on the network level redirection. Even I can do it, only give me the certificate.

The only difference between Chinese and Americans is that while latter just go and get the copy of the certificate (I think NSA has them all), Chinese need to hack the CA first. Only minor obstacle, detour.

Sorry, but that HTTPS don’t provide any security or privacy. This is fake illusion constructed around CA’s, that leak like 30 years rusted bucket. We have now already long seen how certificates are stolen and used to create a fake illusion. Starting from Stuxnet.

But while that HTTPS don’t provide any security or privacy help, it has a deep impact on world climate. Millions and millions cryptokeys calculated constantly, demanding processor time turning into heat. Any why? For fake illusions, because blog owner is a security guru and it doesn’t look solid, if he doesn’t use HTTPS?
People start pointing fingers?

It’s time to admit that this “HTTPS Everywhere” movement is just plain idiotic, complete waste and failure. Whoever wants, can take HTTPS traffic easily apart with fake certificates. There’s no serious government now who can’t do it, China and Russia does it for some time already, now the technology is so widespread that even small dictator countries can do it.

metaschima • July 11, 2021 8:42 AM

I was busy and didn’t get a chance to post about the Kaspersky PRNG issue. I personally use Bitwarden which appears to use Openssl’s md_rand() function. Honestly not a bad way to generate random numbers, but why not just use /dev/urandom ? I’m quite positive that urandom is a much better CRNG. Here’s a script you can run on *nix systems, including android to generate random numbers using /dev/urandom. You can adjust the i == 20 to the length of the password you want.

dd if=/dev/urandom count=1 2> /dev/null | od -t a -w1 | awk '{ if (length($2) == 1) { printf $2; i++ }; if (i == 20) { printf "\\n"; exit(0); };}'

Winter • July 11, 2021 10:05 AM

@Travis
“HTTPS don’t provide ANY security or privacy. This is fake illusion.”

That has been the line of the TLA’s for a long time now. But while CAs might be bad, the encryption is not. “Let’s Encrypt” has done a good job here. If all traffic is encrypted, eavesdropping becomes expensive, and those who really need the encryption are not sticking out.

@Travis
“But while that HTTPS don’t provide any security or privacy help, it has a deep impact on world climate.”

“Think of the children!!!” has become “Think of the climate!!!!”

Just as bogus.

It is not HTTPS that kills us, nor taking showers, watching TV, or even flying. It is using energy. Climate Change cannot be stopped by reducing energy use. It can only be stopped by phasing out all fossil fuels. Let’s use HTTPS and all encryption needed to fight that revolution.

chainsaw parade • July 11, 2021 10:23 AM

If you’ve been using DuckDuckGo Tor v2 .onion, now is the time to update your bookmarks!

The new v3 .onion for DuckDuckGo search via Tor is:

https://duckduckgogg42xjoc72x3sjasowoarfbgcmvfimaftt6twagswzczad.onion/html

Please note the “html” at the end, which for some reason makes searches work when they otherwise wouldn’t without it.

This news comes from this post by a DDG staff member.

It is important to update today, as soon v2 .onion services won’t work!

See, also: https://support.torproject.org/onionservices/#v2-deprecation.

You look like a good Joe • July 11, 2021 10:28 AM

@Travis
“HTTPS don’t provide ANY security or privacy. This is fake illusion.”

Which is why (as a good American who recites the pledge and salutes the flag everyday streaming on my blog) I have created a new plugin for browsers called, “HTTPS Nowhere. I designed it for people like you.

MY BRAINS ARE GOING INTO MY FEET • July 11, 2021 10:57 AM

(url fractured to prevent autorun)

My mind is fractured to prevent this as well.

No Name • July 11, 2021 11:58 AM

Question about encryption keys.

When encryption keys are compromised – does it imply either:

  1. Insider purposely leaked them; or
  2. Their claims that the data is encrypted and keys secure is not a true statement

On July 8, 2021 it was announced that the encryption keys were compromised (4th paragraph) https://www.zdnet.com/article/morgan-stanley-announces-breach-of-customer-ssns-through-accellion-fta-vulnerability/

Here’s how they handle encryption
https://www.accellion.com/secure-email/lock-down-your-sensitive-data-with-powerful-data-encryption/

The media and US government often assumes that hacking is linear. When it never is.

They also incorrectly assume that encryption protects data. But if a system is designed or supported by staff in a country that either bans encryption or is banned from having keys, then there’s no encryption possible. I would hope that experts in this group tell the truth about this because this one admission would serve to stop the pervasive fraud in tech today.

While the other recent noisy ransomware events turned up no victims, this one likely has victims that cannot announce that they are.

Who uses this service? Those that need to transfer encrypted documents more than 10MB. What type of documents might this be?

Look at the company in the middle of this. Not the technology vendor nor the victim. Look at the “monkey in the middle” – their locations, job openings (notice the search terms), industry focus and their Wikipedia. Most all of their employees are in South Asia. Look at the Solutions tab specifically Managed Services and Technology Solutions.

A long held indicator of fraud is lots of mergers and acquisitions. It obscures record keeping, especially in the bigger institutions such as government or global industry. In a situation such as this, regulated and restricted customers might not realize they are outsourced to another country.

The other day the new FTC chair announced they are stopping all mergers. Then on Friday Biden announced the same thing by executive order. It’s not about antitrust, it is about national security. Lots of sensitive tech companies were purchased in the last few years and no one know who they are really dealing with. Biden’s EO allows the US to undo mergers that were previously approved. I can make my own list.

The FTC is experiencing a massive surge in merger filings. https://www.politico.com/news/2021/07/06/ftc-staffers-public-appearances-498386

Now they legally get to say no to all.

The US Government allows bureaucrats without any technical experience to make technological decisions, hence the USA is extremely exposed, both the private sector and government. But the truth is – this vulnerability is not linear, there’s quite a few monkeys in the middle.

Too many monkeys on our back too. It’s an apt idiom.

The FAR needs to ban private technology companies. The tech company “breached” was founded in Asia, developed in Ukraine and is funded in the Cayman Islands – yet they are approved to sell to the Government for regulated data that can impact national security.

The monkey in the middle has GSA contract vehicles and supposedly is a Cybersecurity and risk expert.

Final comment – if transporting data is too dangerous. Stop transporting it. There’s other options. Sensitive data shouldn’t ever move.

Clive Robinson • July 11, 2021 12:29 PM

@ Travis,

You are so shortsighted.

And you are being rude for no good reason.

Not a good way to start when you’ve apparently not even analyzed the problems is it?

First off HTTPS electricity usage on the Internet is a very small fraction compared with other electricity usage, such as Crypto-coins and basic infrastructure.

So whilst removing it will only make a small change in consumption, if your secondary argument is true more than half of that will be down to the “collect it all” idiots.

But if you step back a pace or two most will see all you are realy saying is,

“The boat is leaky lets burn it to ashes…”

That is you’ve made absolutly no acknowledgment to “user privacy” or apparently even care.

As it turns out even if the SigInt agencies do have the CA keys etc they still have to make a significant investment in resources, whilst for most users the overhead of HTTPS comes almost at zero cost.

So fine HTTPS burns electricity, so do most other things in your life. The measurments I made on a mobile phone some years ago, suggested that the power involved was a lot less than a standard flash light burned.

But what you are not seeing from your ivory tower or are deliberately chosing to ignore is what are you going to replace HTTPS with?

That’s actually the real problem, every system that is not hierarchical has so far failed, and all hierarchical systems have identical failings to CA’s…

So time for you to stop throwing it at the fan, and “man-up” and come up with some concreate proposals for a replacment to HTTPS that works.

If you can not people will probably either shake their heads or laugh at you. Either way the message you think is so important will be lost to the four winds, that drive those windmills you are tilting at.

Truth.is.stranger.than.fiction • July 11, 2021 12:41 PM

The truth about encryption is that it only works if the data never leaves the US.

Microsoft and Facebook own the undersea cables. It’s a technological wonder of the world. https://www.theverge.com/2019/2/28/18244357/microsoft-facebook-marea-cable-16qam-20-percent-speed-boost

Data is transferred to countries where there’s no regulatory oversight or reciprocity. Then it can be sold with abandon. And it is. It doesn’t just happen to Americans.

But bless those Germans. No one would dare do this to them.

RSA was sold last year to the Ontario Teacher’s Pension Fund and private equity that purchased FireEye too.

Clive Robinson • July 11, 2021 12:51 PM

@ No Name,

The tech company “breached” was founded in Asia, developed in Ukraine and is funded in the Cayman Islands – yet they are approved to sell to the Government for regulated data that can impact national security.

Yes and that’s how neo-cons move tax money into their pockets when they don’t have boondoggle products like the F35 etc to act as “financial vehicles” so the few can profit off of the many.

It’s the “Great American Dream” at work, “Corporate / Hedge Fund” style, now there are too many US Citizens to just fence off land to grow apple trees etc on.

Basically these “financial vehicles” are a scam run by a defacto cartel built by the US legislators over the past century. If you or I tried it we would find our toes hardly touching the ground on the way to a Federal Supermax… Why because the “big fish” do not want the “little fish” they prey on getting large enough to be a threat in any way what so ever, so they would find any and every way they could to kill you off, not just by legislation or regulation.

But hey “The Great American Dream the Corporate way” enjoy it whilst you still can.

Travis • July 11, 2021 1:08 PM

@ Clive Robinson

So that HTTPS use would be justified first we must be sure that particular site is not already compromized by three-letter-agency – not cloned via duplicate certificate. Without that all use of HTTPS is just pointless.

First give us solution how we all can verify any website originality.
As I showed, certificate fingerprint can match. Show us solution to that and then I agree that HTTPS can be useful.

Clive Robinson • July 11, 2021 2:04 PM

@ Travis,

So that HTTPS use would be justified first we must be sure that particular site is not already compromized by three-letter-agency

That old strawman argument realy?

It’s based on a false assumption of “omnipotence in all things”.

It’s like me saying that you must not breath untill you’ve proved beyond doubt you breathing is required for you to be safe from burglars…

You can no more prove you are safe from burglars than a website can prove it’s secure from every kind of attack… Which is actually what you are asking for with “that particular site is not already compromized”.

In other words you are saying you must be right in your opinion because people have to jump through your impossible to traverse hoops…

Grow up that is not how security has ever worked, nor can it.

As I said you avoiding putting forward concrete proposals for your alternative to HTTPS just makes you look silly realy silly, and trying to be even further evasive makes you look worse a whole lot worse. In your words,

the industry is full of charlatans

So why paint yourself to look exactly like one by your actions.

If you have an altetnative to HTTPS then say so, if not well don’t let the door hit you on the way out.

Travis • July 11, 2021 5:19 PM

Hi guys! I see I am not the only Travis here, what a coincidence! Anyway, I just wanted to say how lovely SSL is. I use it on every site! HTTPS Everywhere, when switched on and the icon “red” to block unsafe sights is really helpful.

Thanks for all of the advice and nice to meet you Travis!

it's written all over your underwear • July 11, 2021 6:49 PM

Tuning Into Medical Implants With The RTL-SDR

With a bit of luck, you’ll live your whole life without needing an implanted medical device. But if you do end up getting the news that your doctor will be installing an active transmitter inside your body, you might as well <a href="https://hackaday.com/2021/07/11/tuning-into-medical-implants-with-the-rtl-sdr/">crack out</a> the software defined radio (SDR) and <a href="https://analogist.net/post/decoding-radio-ph-capsules-with-rtl_433/">see if you can’t decode its transmission like [James Wu] recently did</a>.

Before the Medtronic Bravo Reflux Capsule was attached to his lower esophagus, [James] got a good look at a demo unit of the pencil-width gadget. Despite the medical technician telling him the device used a “Bluetooth-like” communications protocol to transmit his esophageal pH to a wearable receiver, the big 433 emblazoned on the hardware made him think it was worth taking a closer look at the documentation. Sure enough, its entry in the FCC database not only confirmed the radio transmitted a 433.92 MHz OOK-PWM encoded signal, but it even broke down the contents of each packet. If only it was always that easy, right?

Of course he still had to put this information into practice, so the next step was to craft a configuration file for the popular rtl_433 program which split each packet into its principle parts. This part of the write-up is particularly interesting for those who might be looking to pull data in from their own 433 MHz sensors, medical or otherwise

Unfortunately, there was still one piece of the puzzle missing. [James] knew which field was the pH value from the FCC database, but the 16-bit integer he was receiving didn’t make any sense. After some more research into the hardware, which uncovered another attempt at decoding the transmissions from the early days of the RTL-SDR project, he realized what he was actually seeing was the combination of two 8-bit pH measurements that are sent out simultaneously.

We were pleasantly surprised to see how much public information [James] was able to find about the Medtronic Bravo Reflux Capsule, but in a perfect world, this would be the norm. You deserve to know everything there is to know about a piece of electronics that’s going to be placed inside your body, but so far, the movement towards open hardware medical devices has struggled to gain much traction.

Travis • July 11, 2021 7:07 PM

@ Clive Robinson

OK, you wanted good argument?

Let’s say for a argument sake I wake up one day and Chinese government just for fun have created clone of the schneier.com blog. They have clone certificate and they have programmed some bots.

Bot #1 : Clive Robinson – they fuse broken English with overly long texts from science books and that bot answers to everyone. Plausible, just as real.

Bot #2 : SpaceLifeForm is a tougher cookie – a paranoid Android (remember, we are talking about bots here). Since he is paranoid, they programmed him to use simple sentences, some cryptic messages, mysterious links etc. Again plausible, just like the real one.

Bot #3 : Winter – simplest bot of those three ones. Under different names he spams constantly the blog and then comes back under the real name and suggests the moderator to clean up everything. This keeps blog alive, traffic ongoing, again, very plausible.

But how I can be sure I ended up in real blog or in Chinese copy? Normally I’d check the certificate. Since this is direct clone, this check is useless.

HTTPS provides 2 services – site identify and traffic encryption. Both are in this case useless – cloned certificate doesn’t provide any solid proof and traffic encryption is also useless – maybe my ISP can’t see directly what I’m writing right now, but they can see from the logs what sites I accessed and then they can come and read it freely here. So traffic encryption here is also completely useless.

And actually the same problem affects most of the web sites – HTTPS is mostly useless.

So – how I can be sure I communicate with the real blog or Chinese copy?

echo • July 11, 2021 7:28 PM

https://www.theguardian.com/commentisfree/2021/jul/11/fame-compassion-handforth-parish-council-viral

First, we have to tackle online abuse. The online safety bill that will soon be progressing through parliament could become a landmark piece of legislation – a world first – in addressing this scourge. To be effective, it needs to significantly reduce the number and reach of anonymous social media accounts (the source of most misinformation and hate online) and enforce a new duty of care on social media sites towards their users. These platforms have, for too long, benefited from a laissez-faire system of governance that has allowed misinformation and abuse to spread with impunity. The government needs to catch up.

Second, we should substantially enhance the standards of behaviour expected of local and national politicians. Two quick and effective changes could help to make this happen. It should become the norm – enforced by legal action if necessary – that local councillors either resign or are removed from their post for a fixed period if they are found to have contravened their authority’s code of conduct. No such provision exists and, as I have documented before, this means that councillors found guilty of racism, sexism or homophobia can continue in their role. This unconscionable practice legitimises bad behaviour, low standards and poor governance. If we are to attract a wider demographic to stand in elections, we must redouble our efforts to make the environment they enter as safe as possible.

Further, I would like to see a law introduced to tackle lying in politics at every level. Compassion in Politics, for which I am an ambassador, is campaigning to make it illegal for politicians to wilfully and repeatedly lie to the public. Given the serious nature of their position and the responsibilities they have to the public, the least we can expect is that politicians will be honest, open and transparent.

Last, I think we should be looking to nurture an ethos of compassion, inclusion and kindness in every level of society, in every aspect of our economy, and in every layer of government. These are the values that have helped to save and protect lives through the Covid crisis and brightened the darkest of our days. We should bring compassion training into schools and workplaces and devolve more power, autonomy and resources to local communities. We cannot expect to resolve complicated problems such as pandemics, climate breakdown and inequality if we fight among ourselves. Take it from someone who has met many new people in the past few months – kindness and compassion are more likely to win you friends and influence than their opposites.

https://www.theguardian.com/world/2021/jul/11/labour-to-vote-against-tory-hate-speech-bill

Government plans to “safeguard” free speech in universities would allow Holocaust deniers, anti-vaccination groups and conspiracy theorists to take legal action against higher education organisations that denied them a platform to air their views, Labour said last night.

[…]

Kate Green, the shadow education secretary, said the government was wasting time helping people whose only aim was to cause division and spread hate. “It is shocking that the Conservatives are introducing a new law to give Holocaust deniers, anti-vaxxers and people harmful to public interest the opportunity to sue their way to a platform at universities.”

A briefing paper on the bill for Universities UK, which represents 140 universities, says: “There is significant concern over what the unintended consequences of this bill could be.

“For example, this bill could make it easier for those who promote conspiracy theories or ‘alternative facts’ to speak on university campuses – as well as provide them with the opportunity to take the university or students’ union to court if they feel they have been denied a platform.” It also raises concerns that the bill could “lead to courts becoming filled with minor disputes, while incurring significant cost, time and reputational damage to universities, and ultimately detracting from their efforts to champion freedom of speech”, it said.

The long erosion of standards by people who won a lottery and erosion instititions and reason and give and take has been going on for a long time. Cocky shoot from the hip “free speech” mercenaries working for billionaire non doms haven’t been helpful either.

You can have all the cryptography in the world and machines which go “ping” but if power is abused and your brain is overwhelmed by junk the end point, you, is already compromised. It makes sense therefore to do something about it.

Winter • July 12, 2021 1:13 AM

@Travis (new one)
“HTTPS provides 2 services – site identify and traffic encryption.”

The encryption still protects my communications from eavesdropping by everyone else. So that still works. As it is, I have less to fear from the Chinese than from local and USA companies and TLAs.

What you are advocating is to protect the environment by not using envelopes for my surface mail anymore unless I have verified the trustworthiness of the address and everyone who works there. Nuts, squared, or you have an agenda against privacy.

lurker • July 12, 2021 1:17 AM

@Travis, et al.
https is only one small part of the wanton extravagance raising the entropy of the planet. Maybe you could turn your guns on .js and .css too. Why is it necessary or desirable to download 120kB of javascript and stylesheets to show on screen 2kB of simply formatted plain text? An efficiency of 1.6% max., because we havent yet deduced how much grinding of gears went on server-side in the giving and taking…

SpaceLifeForm • July 12, 2021 2:36 AM

@ Travis

I believe you are mixing up multiple threat models.

What exactly is your threat model that you are concerned about?

The article that you linked to is really about a software supply chain problem.

The initial entry almost certainly was not directly an https issue.

That the MSP (the CA MonPass) happened to be in the certificate business was likely not relevant, other than it was used as the stepping stone to get inside another business because the CA provided a deliverable to their customers. See SolarWinds and Kaseya.

It is true that the entire CA model, TLS, and DNS have plenty of flaws.

But, at least, TLS provides a cost on attackers. It stops simple MITM.

As to a TLA compromising a website, I do not believe they would go to the effort to clone a website. There are other avenues they normally would use before that.

Those that try the clone route usually are trying to combine typos and/or phishing with typos. They would not normally be a TLA.

If they have a specific investigation going on, first they would do the subpoena route, and, if necessary, an NSL.

So, again, what is the threat model you are looking at?

P.S. Thanks for the compliment. I’m not really paranoid, just realistic.

echo • July 12, 2021 3:42 AM

https://theconversation.com/semiconductors-chinese-takeover-of-uks-leading-chipmaker-doesnt-need-a-security-review-heres-why-164210

Semiconductors: Chinese takeover of UK’s leading chipmaker doesn’t need a security review – here’s why

I don’t know enough about the technical details or IP or customers requirements to make an informed comment.

I am old enough to remember how the UK government was very interventionist and was familiar with strategic national policy even if the execution wasn’t always very good. Since then after a few issteps the government decided to get out of supporting broad industry and focused entirely on military. Strategic policy wasn’t just dropped but the UK ended up lacking legislation to enable strategic policy and decision making if the need arose. It is only now the dim glimmer of half baked legislation has been implemented.

It’s not just poliy or plant which matters but sense of direction and ownership and emotional investment. I’ve lived through a time when government embraced privatisation and market forces to a point which other OECD nations (including the US) thought a bit extreme. National icons such as ICI are no more after management tried to get clever. Marconi went bust after similar mistakes. Mediam and small business manuafacture never really recovered after WWII and has been in long term decline. Much more could be manufactured in the UK but there is a resistance to creating capability for small quantity rapid turnaround design to factory gate manufacture. As a result a lot of manufacture demand off British companies simply goes overseas while those same overseas companies are keen to hire British designers.

UK productivity remains on average 20% worse than the rest of the EU. Welfare levels are among the lowest in Europe.

Meanwhile we need another four Pinewood studios yesterday.

I’m leaving a lot out as it is too much to remember but most of this was before the author of this article was born.

Clive Robinson • July 12, 2021 5:01 AM

@echo:

Some reading to pursue

ht tps://www.entrepreneur.com/author/hamza-mudassir2

The author appears to be a MBA from Cambridge, with strong ties to Asia.

Started becoming noticed when George “white lines” Osbourne was having the big China sell off.

Mostly on line pieces are very recent and basically are Europe is Failing to Asia and should sell whilst it still has value.

Analysis of semiconductor industry some what simplistic and based on a little too much industry hype and lack of actual knowledge.

The reason the plant is in the financial state it’s in was because it was deliberately run down when it was in the hands of International Rectifier(IR), which turned it into a bit of a lemon after stripping IP (as will now happen to ARM).

The argument for having wafer production in the UK especially one with very fast response times is the same as for having the UK’s own independent vaccine production.

The nonsense about 486 chips and 3nm transistors realy only applies in very limited circumstances and China will not be making 3nm due to EU and US export restrictions on another X-Philips company.

One of the largest uses of semiconductor by physical area is power electronics which are the rather necessary glue between Computer Components and real world control. An area that the company specialised in and why IR purchased them.

Something the article Hamza Mudassir does not appear to want to acknowledge in the quest to “sell it all off cheap” to Asia.

As for what the Chinese are getting, thay are not even paying 1cent on the dollar, I won’t call it the deal of the century because I’m sure there will be more idiocy to follow, but… I suspect it will be on the leader board.

As for the authors quips about UK industry since WWII he fails to mention the three major causes,

1, Following US dictated policy.
2, Chronic under investment by Government.
3, The stupidity of the middleman kleptocracy.

The latter especially made production in the UK unproductive at best which is why much of it was and still is outsourced to nations that have their own political agenda and effectively a strangle hold on any supply chain. Something I hope readers here now have a better than average understanding of, thus can realise why certain people want these “fire sales” concluded as rapidly as possible. Because for once it looks like the US might just be moving in the right direction with the power to “unroll” fire sales that have already happened. If the Biden administrarion is serious about it or not is another matter but it atleast raises a flag on the issue.

Winter • July 12, 2021 6:34 AM

@Clive
“2, Chronic under investment by Government”

Especially, education resulting in a chronic skills shortages. The contrast with Germany is illuminating.

Fake • July 12, 2021 7:56 AM

just resurfacing the following from about:

“The truth about encryption is that it only works if the data never leaves the US.”

FALSE, don’t even need to demonstrate it’s the whole conversation about points lines and multiple dimensions.

btw computer is on now for the first time in years, and i installed a ublock *schneier script.

i might’ve been reading the above out of context but TIA is not all knowing, if she was she’d be OoWL,

ADFGVX • July 12, 2021 12:03 PM

Israeli Businessman Charged With Contacting Foreign Agent, Passing Info to Iran

A well-known Israeli businessman was charged Monday with contact with a foreign agent and passing information to the enemy.

According to the charges, Yaakub Abu al-Kiyan passed on information regarding Defense Minister Benny Gantz to an Iraqi agent who was in contact with Iranian agents.

It’s a standard City-Hall-style criminal prosecution. The charges are vague and unsubstantiated, and the particulars of the matter are difficult or impossible to ascertain to any standard of probable cause, let alone proof beyond a reasonable doubt.

As a “businessman” with many foreign contacts and no special access to Israeli government classified information he cannot reasonably be held responsible for keeping state secrets to which he has no position of being privy.

So Yaakub Abu al-Kiyan went to prison for revealing to Iraqi and Iranian agents that Benny Gantz is a jackass, but the fact that Israel’s Defense Minister is a bloody fool of a braying jackass happens to be a state secret of the Israeli government, and Israel’s enemies would not have known that.

Now this Benny Gantz wouldn’t have had anything to do with that condo demolition in Florida? Which began while it was still occupied and killed many of the residents? And the hostile IDF forces who invaded the U.S.A. and infiltrated the emergency response team?

Winter • July 12, 2021 12:10 PM

@Clive
“Mostly on line pieces are very recent and basically are Europe is Failing to Asia and should sell whilst it still has value.”

The mystery to me is why the British stuck to this idea for 75 years, ie, three generations.

There has been a neo-con/economic liberalism (old school) dogma that the future is in services and physical production is for low wage countries. Moreover, the Anglo-Saxon world bets heavily on “IP”, enforcing it as a tax on trade from outsourced production.

It is obviously clear by now that this simply does not work. The USA can enforce their IP tax on the world. The UK cannot.

ADFGVX • July 12, 2021 1:00 PM

@ Winter

Moreover, the Anglo-Saxon world bets heavily on “IP”, enforcing it as a tax on trade from outsourced production

“IP” or “Intellectual Property” is a form of involuntary servitude exemplified by barratry or excessive and gratuitous service of process in court as well as a stagnant employment market dominated by corporate wage slavery and indentured servitude under various non-compete agreements and non-disclosure agreements and similar contracts imposed under circumstances of coercion or human trafficking rather than on a basis of free employment at will in a free market.

Such conditions of employment violate Abolition, enacted as the the Thirteenth Amendment of the Constitution of the United States of America, to wit,

Section 1. Neither slavery nor involuntary servitude, except as a punishment for crime whereof the party shall have been duly convicted, shall exist within the United States, or any place subject to their jurisdiction.

Section 2. Congress shall have power to enforce this article by appropriate legislation.

lurker • July 12, 2021 1:43 PM

@Clive, echo
One of the largest uses of semiconductor by physical area is power electronics…

the Chinese might be anxious to remove the Siemens logo off the automated vehicles highly visible at their modernised seaports. They also had low yields in their earlier attempts to build their own controllers for high speed trains.

SpaceLifeForm • July 12, 2021 4:52 PM

@ ADFGVX

LOL.

“Nice business you have there. Be a shame if something happened”

“For $2k per month, our elite technical support staff will make sure that SSHD is not running on your server.”

(mumbles.. Fail to pay, we reactivate the security hole. Your choice.)

This is exactly why you must manage your own kit. No outsourcing.

Clive Robinson • July 12, 2021 4:55 PM

@ SpaceLifeForm, ALL,

If disabling SSH on the server is a mitigation, why is SSH even running on a server that does not require it?

Remote access for remote managment has had a bad reputation security wise as long as people have been doining it.

In part it should be easier to avoid the trips, pits and deadfalls of such things these days… But for some reason it appears not.

I’ve kind of noticed in the past that it’s less likely to be errors down at the communications end of things than the User Interface end of things…

To me this suggests a number of issues, not least of which is having “hand holding” UI’s and scripts etc to replace “actuall knowledge with menus and scripts”.

Thus each time we appear to “step forward” we actually end up taking a couple of steps back… That is,

1, The user lacks knowledge.
2, The knowedge is insecurely replaced with over complexity.
3, The over complexity is never tested sufficiently.

I don’t know what other peoples feelings are on this but to me it looks like “Dumb down to keep costs down”.

As I mentioned the other day, yes I appreciate that “outsourcing” to gain access to greater expertise is in theory a good idea for small organisations that can not get access to expertise any other way.

However the problem though is these “Professional Service Contracts” all appear to be more about “lawyers comming up with SLA’s” that disincentivise any actuall “expertise” becoming available…

Clive Robinson • July 12, 2021 5:18 PM

@ lurker,

They also had low yields in their earlier attempts to build their own controllers for high speed trains.

I still have some “tendrils” reaching out into that industry, and the stories I’ve been told are shall we say “on par” with some of the claims about US Gov Intel agencies and Russian Oil centers and Iranian Centrifuges.

Lot’s of “un-named spooks persons” and the like, and much that sounds like “inflation for budget expansion” (so called “fund raisers” by those with a conspiracy flair).

Difficult to know what has some germ of truth in it or not.

However stories of trins being buried with back hoes and the like which sound even more fantastical have been confirmed by the Chinese Government themselves…

So “pays your money makes your choice” of story.

One thing China is actually known to be significantly worried about since Stuxnet and similar is down tail supply chain poisoning. They are concerned not so much about spying but deliberate “reputational attacks”. The fact they think the US Government for purely political reasons would put in not just malware but deliberate faults that might harm other nations Citizens including those in the US actual says rather a lot about how low things have got. The fact that China do not have actual control over the inyernals of on chip CPU’s actially does worry them, especially as the likes of Siemens actuall does have a significant reputation for being in bed not just with BIS bit the NSA.

Clive Robinson • July 12, 2021 5:41 PM

@ Winter,

It is obviously clear by now that this simply does not work. The USA can enforce their IP tax on the world. The UK cannot.

You did read point 1 didn’t you?

They call it “The special relationship” if I called it what it actually is I’d probably get “edited from above” as I have in the past.

Clive Robinson • July 12, 2021 5:47 PM

@ Winter,

Especially, education resulting in a chronic skills shortages. The contrast with Germany is illuminating.

So is the comparison with the US. In the 1970’s we used to joke about the UK being “five years behind the US” in crime and the like. Most thought it was “street crime” others woke up in the 80’s,and 90’s and with Financial Crisis 1 you would have thought everyone would have got the message, but no, the blinkers/blinders are still on the old carthorses in Whitehall…

US CERT • July 12, 2021 8:23 PM

@ SpaceLifeForm • July 12, 2021 6:15 PM

‘Cobalt Strike thread by @hacks4pancakes’

Her attitude is totally wrong. Cobalt Strike author knows very well that his creation is used to hack US businesses, big ones, but he still does nothing and continues to developing that so called “ethical tool”. This guy has no ethics at all. Raphael Mudge should be hanged on the town square by his balls. Maybe others will learn then.

ps. and that chick calls herself ‘Full Spectrum Cyber-Warrior Princess’

Someone has escaped from the mental hospital for sure…

This ‘article’ shows for sure where the present infosec problem lies – some wannabe ‘warrior princess’ chick on speed defends the imminent criminal and even paints him as a hero. Whoa!

ADFGVX • July 12, 2021 9:06 PM

@ US CERT

Lesley Carhart
Cybersecurity pro, martial artist, gamer, marksman, the worst yogi, lock picker, humanist, L14 Neutral Good rogue.
(I don’t post work stuff on Insta.)
tisiphone.net

Well chicka chicka boom boom. Imagine some of the feds are finally learning to pick up girls. Or maybe it’s just wishful thinking.

But that “marksman” business is never lone wolf with a girl like that. It’s too social. There’s always a boyfriend or two and a male bodyguard somewhere in the background. Police union connections.

ps. and that chick calls herself ‘Full Spectrum Cyber-Warrior Princess’

Someone has escaped from the mental hospital for sure…

You’re on the money with something here, because another girl is showing up. Check the social photos. Buddy or two with a resemblance to the other gal.

hxxps://www.pinterest.com/brookeriehl92/work-out/

Former(?) MH therapist, fashionista type, too much money to account for, bodybuilder boyfriends out the wazoo.

That’s a professional crime family gun rights revocation. It’s bought and paid for and they call it a “right wing nut job” with a civil commitment to a mental institution.

Gun rights revoked in court. Books are closed. Crime family pays up. And who’s going on social media as a “marksman” with a real life photo? You get recognized shot and killed on the orders of the consigliere if you aren’t “family” on that scene. That’s why 15 minutes of fame is enough for anyone who’s an outsider to get off the property.

ADFGVX • July 12, 2021 9:51 PM

Cobalt Strike?

See photo for blue color of the ore.

hxxps://www.mining-journal.com/energy-minerals-news/news/1407627/drc-starts-up-new-cobalt-body

We’re looking at a false front for a lot of other hacking activity — a strike by law enforcement labor unions — yet another absolute no-holds-barred demand of theirs — arbitrary unlimited police access to all consumer-level electronics or else.

IUPA, FBIAA, IAPC, fraternal orders of police, police guilds — they all act like they’re the Swiss Guard in perfect purity of purpose and good faith fighting off the Irish Republican Army and imposing “sus law” on all same-nation subjects and foreign persons of interest.

SpaceLifeForm • July 12, 2021 10:07 PM

@ US CERT

I only wanted to point out the complexity of Cobalt Strike. I was not taking any sides. As you are aware, tools can be good be used for good or for bad.

It’s not a good view to attack the messenger.

The infosec problem actually lies with the lack of maintenance and the failure to actually pay tech folk to take care of the kit.

The infosec problem is actually due to incompetent management. Any competent IT person can explain that problem.

There are plenty of competent IT folk not doing IT these days. They know the problems to look for, but they have just walked away, because the management is so incompetent, and so toxic, that it just is not worth the stress. You can not pay them enough to put up with the bullshit.

It is important to note that Cobalt Strike was designed for Windows. Which way too many orgs do not want to put the effort into to keep secure.

So, sure, just ignore the elephant behind the curtain which is Windows.

ADFGVX • July 12, 2021 10:22 PM

@ SpaceLifeForm, US CERT

It’s not a good view to attack the messenger.

That would be the consigliere I mentioned.

The infosec problem actually lies with the lack of maintenance and the failure to actually pay tech folk to take care of the kit.

The infosec problem is actually due to incompetent management. Any competent IT person can explain that problem.

There’s a corporate H.R. department with an entrenched government-like bureaucracy, and putting more people on the company-town corporate salary-and-benefits dole is not going to solve endemic problems of serious organized crime within the corporation.

There are plenty of competent IT folk not doing IT these days. They know the problems to look for, but they have just walked away, because the management is so incompetent, and so toxic, that it just is not worth the stress. You can not pay them enough to put up with the bullshit.

Crime families took over, and the “books are closed” with all that intellectual property bullshit.

It is important to note that Cobalt Strike was designed for Windows. Which way too many orgs do not want to put the effort into to keep secure.

So, sure, just ignore the elephant behind the curtain which is Windows.

Microsoft Office on Microsoft Windows is used as a crime family “library” or repository of documents voluntarily made available to crime bosses and mafia capi as well as police union leadership.

ADFGVX • July 12, 2021 10:36 PM

hxxps://www.npr.org/2021/07/11/1013903857/wellington-paranormal-cw-new-zealand-cops

In ‘Wellington Paranormal,’ Clueless Kiwi Cops Meet Dryly Deadpan Demons

Just like the show….

Winter • July 13, 2021 12:53 AM

@SpaceLifeForm
“I only wanted to point out the complexity of Cobalt Strike. I was not taking any sides. As you are aware, tools can be good be used for good or for bad.”

But you mentioned a female infosec expert who dares to go into the limelight to advocate good infosec and to advertise the trade to young people.

Such behavior is deemed intolerable for a woman by the right wing nutters trolling the intertubes.

I have read her blogs and seen some of her talks and she is a voice of reason and prudence in the snake-oil invested computer security field. In short, I am willing to believe Lesley any time over any collection of fact-free right wing nutters who have shown to ignore every fact they do not like.

Yes, I happily take sides in this case.

ADFGVX • July 13, 2021 1:25 AM

@ Winter

But you mentioned a female infosec expert who dares to go into the limelight to advocate good infosec and to advertise the trade to young people.

Good grief.. We don’t need another licensed, registered, bonded, and insured TRADE at work on the job in the industry, Ma’am.

We are all aware of online vices and proclivities that preclude good INFOSEC practices.

Limelights, grandstanding, “advocacy,” gratuitous legal actions, barratry, and service of process in a court of law do not make for good INFOSEC.

Such behavior is deemed intolerable for a woman by the right wing nutters trolling the intertubes.

Some of the ladies need to get off their mental health sex offender agenda, and stop digging in guy’s shorts for their nuts.

There are way too many female “experts” who insist on catering to a certain stereotype of the average male internet user and cable television viewer.

Male experts have no choice but to simply walk off the property when the jock-strapped bodybuilders and bodyguards show up on the scene with their female co-workers.

I have read her blogs and seen some of her talks and she is a voice of reason and prudence in the snake-oil invested computer security field. In short, I am willing to believe Lesley any time over any collection of fact-free right wing nutters who have shown to ignore every fact they do not like.

Once again, you’re cutting a bit too much hair and putting out too many eyes, Ma’am. But in a sense, that’s the way it’s going to be if the only men you care to associate with are liberal male-gender-conformant beer-drinking football-fan internet users who think below the belt instead of using their brains.

I’m not being sexist, either. In fact not at all. There are plenty of male jackasses I could criticize for every female who cares to publish “facts” or “opinions” on the subject of INFOSEC.

It’s just that there’s a certain particular female who shows up in the company of a large crowd of the worst of the worst men outside any supermax security federal prison complex.

What about Reality Winner? How’s she doing for a female INFOSEC expert?

No relation to Jana Winter, by any chance? After The Intercept felt some heat from the big law and many of its prime movers left.

Winter • July 13, 2021 2:05 AM

@ADFGVX
I appreciate the gesture, but you do not have to illustrate my point so extensively.

Clive Robinson • July 13, 2021 2:19 AM

@ SpaceLifeForm, Winter,

I’m always amused by the “Holy Roman Empire Attitude” solution of “lock up knowledge and those that hold it” because it always fails one way or another…

In my early career I made the mistake of working for Government money. Who tried to steal my work and “lock it up”. Whilst some of it has yet to be “re-discovered” most of it has, and more often than not by those who would be regarded as “the bad guys” who generally have the bigger incentive to think about such things… Then it gets into the open community about 8-15 years after I thought it up. I suspect I was not alone in this as “ideas come of age”. I suspect some get embittered others just shrug, me I find it faintly ammusing as I’ve never been overly interested in the trappings of money, fame, status etc, I just want people to learn.

And that’s the fun part…

Not just the learning but seeing the “self important” “self righteous” demanding “Do as I say”, whilst trying to hide how the “did”…

I find the simplest pin for their bubble of pretention is to ask them “How did you learn to be such a bad driver?”…

But rudely as it might be framed the point is germane, they learned “on the road” by “being dangerous” and a few survive the proces,to become at best only moderately dangerous…

The point about “the tool in question” is it is a training tool, and as any nervous parent should know “you have to take off the training wheels”.

We’ve seen here a couple of examples of “Holy Roman Empire Attitude, Bad Parenting” having a rant… They both try to hide their ID’s but one froths to much at the mouth to do that. Ask yourself why they “rant” or more correctly where their cognative bias against others learning to defend themselves comes from?

Could it be that they reached their limits long ago?

SpaceLifeForm • July 13, 2021 2:26 AM

There is Snake Oil, and then there is FUD.

hxtps://arxiv.org/abs/2107.04940

Clive Robinson • July 13, 2021 2:47 AM

@ SpaceLifeForm,

There is Snake Oil, and then there is FUD.

I know there is going to be “trouble at t’pass” for saying this,

“Don’t run with scissors, unless you have to…”

I can just hear certain people girding their loins.

As my father used to observe half a century or more ago on a variation on Cisero’s words,

Rules are for the blind obedience of fools, the implicit following by others and the guidence of wisemen.

He would pause and add the rider of,

True fools, are as hard to find as wisemen, but few if any think they are the former, whilst too many think they are the latter.

Funny how the problem has got worse in as little as half a century…

Winter • July 13, 2021 2:47 AM

@SLF
“There is Snake Oil, and then there is FUD.”

Nah, I do not think there is any sane cryptographer who would advice to roll your own crypto. That is like being your own doctor, or to defend yourself in court.

ADFGVX • July 13, 2021 2:49 AM

Winter • July 13, 2021 2:05 AM

@ADFGVX
I appreciate the gesture, but you do not have to illustrate my point so extensively.

Thank you for confirming my suspicions.

Do you need more female “experts?”

How about Shasta Pomeroy, Alaska’s first and only Crime Scene Investigator // rape kit processor. Really. CSI as seen on TV. Fairbanks City Hall // small town police department?

hxxps://www.bbc.com/news/world-us-canada-56726020

hxxps://www.whitepages.com/name/Shasta-Pomeroy/North-Pole-AK

And all those random child pornography charges on which suspects under other investigations are hit with no warning in federal court downtown Fairbanks, Alaska?

Commissioned and non-commissioned officers from nearby military bases running the local, state, city, city, borough, and federal court systems for the whole region — makes me wonder if the so-called child pornography isn’t some sort of substitute charge for classified information or espionage, especially when the FBI local calls it “sextortion” and the charges are being railroaded out of the local Air Force or Army base.

hxxps://www.fbi.gov/contact-us/field-offices/anchorage/news/press-releases/fbi-warns-of-sextortion-attempts-in-alaska

Clive Robinson • July 13, 2021 3:24 AM

@ ADFGVX,

Do you need more female “experts?”

We certainly need more good practitioners, that is not in doubt.

Do they need to be “female” no, no more than they need to be “male”.

What is needed is,

1, Training.
2, Opportunities.
3, Progressive working.

I’ve spent a good chunk of my professional career encoraging others, both women and men. Part of that was getting them to leave certain things on the orher side of the door to the one marked knowledge, such as preconceptions.

What we do not need is those with “agendas” for their own status, god alone knows what harm they’ve caused over the centuries, but it’s large (look up “satanic child abuse”).

What we realy, realy do not need is the bull crap gender politics thought up by the inadiquate to gain worthless political status and what they foolishly see is power.

Such people are worse than those old “fuddy duddy” boat anchor conservative types that think their daughters and grand daughters place is in effect “Cooking the perfect baked beans on toast so grandson jonny can grow to be a man to take his rightfull place” just as their grandfather did…

Society when alowed generaly moves forwards in the right direction when alowed to. There is an old saying about “Now’t as queer as folk”, but also “Folk is just folk when you get to know them”.

However nearly always where you find strange constraints applied to society it is by those who seek status and power inspite of their obvious inabilities to handle either. Often their only skill is to “take” and they have no concept of society which requires give as well, just their suppposed “superiority” which is actually a fiction in their own minds.

Winter • July 13, 2021 3:26 AM

@ADFGVX
Really, I appreciate the gesture, but you do not have to illustrate my point so extensively yet again.

Your misogyny is already crystal clear as an illustration of the American right.

ADFGVX • July 13, 2021 4:20 AM

@ Clive Robinson

We certainly need more good practitioners, that is not in doubt.

Do they need to be “female” no, no more than they need to be “male”.

What is needed is,

1, Training.
2, Opportunities.
3, Progressive working.

None of that stuff matters, because you’re not going get good practitioners in any technical or scientific field of work in a a social environment where your co-workers are stabbing you in the back and with false sex charges and schoolyard bullies have grown up to be workplace bullies.

@ Winter • July 13, 2021 3:26 AM

Really, I appreciate the gesture, but you do not have to illustrate my point so extensively yet again.

Your misogyny is already crystal clear as an illustration of the American right.

Not so. Where do you come up with this “gesture” business, if it’s not Italian Mafia? There are plenty of women on the right who do not sell themselves so cheaply. INFOSEC isn’t or shouldn’t be about being loose or liberal. But there’s some gal who becomes an expert all of a sudden at a relatively young age, and other women are expected to suck up to her even if they are older or more experienced or else they are self-hating misogynists — except it turns out she’s a protégée of an older man who’s a capo or a crime boss — sleeping her way up the organized crime ladder somehow. And if a guy isn’t fast enough to pick her up on a date, or tip his hat whatever, then he’s out on a sexual harassment charge, or else considered a “slug” — too slow on the pick-up on the workplace dating scene, which exists regardless of whether he’s married or has his own relationships and friendships outside of work.

Winter • July 13, 2021 4:41 AM

@ADFGVX
You cannot stop, can you?

A lot of dedication, I see. Maybe you should realize that moral outrage can be lead to addiction to online outrage. I know that the author is a woman, but I think you should learn about her work, for your own mental health.

ht tps://www.newworldai.com/your-brain-is-hardwired-for-outrage/

ht tps://www.eudemonicproject.org/ideas/how-social-media-amplifies-moral-outrage

Winter • July 13, 2021 5:56 AM

@ADFGVX
I am always flabbergasted by people who can seamlessly go from criticizing a female cybersecurity pro for speaking out to death camps in just five comments.

Please, elaborate how Lesley Carhart is connected to death camps, locking up people, or killing them? I cannot make the connection.

echo • July 13, 2021 7:41 AM

@Clive

In my early career I made the mistake of working for Government money. Who tried to steal my work and “lock it up”. Whilst some of it has yet to be “re-discovered” most of it has, and more often than not by those who would be regarded as “the bad guys” who generally have the bigger incentive to think about such things… Then it gets into the open community about 8-15 years after I thought it up. I suspect I was not alone in this as “ideas come of age”. I suspect some get embittered others just shrug, me I find it faintly ammusing as I’ve never been overly interested in the trappings of money, fame, status etc, I just want people to learn.

Both the public and private sector have their pluses and minuses and propoganda. Late last night I was reading of Google “rediscovering” an idea of mine from long enough ago most people won’t remember and it’s not the first time either. It was one of a clutch of ideas I had during what I consider to be my most creative period. Not that I was adverse to using or building on others ideas too. Google and the use of technology as a means to an end aside I’m disappointed the commentary I discovered even from alleged technical people doesn’t get excited about the concepts themselves, nor does anyone comment on previous implementations. The first thought which went through my mind was too many possibly proficient men in their own sphere were bikeshedding legends in their own minds without much imagination but then the situation they are in may lack avenues to so it’s hard to say.

There are plenty of people who are more intellectually brilliant than me or more accomplished or simply more successful in personal ways than me so I’m not boasting.

I find people who want power or fame for their own sake are not reliable or trustworthy and ertainly not ones to aspire to or emulate as they have flexible morals when this is at stake but also kick the ladder away. Not everyone with power or fame is like this and credit to them.

We certainly need more good practitioners, that is not in doubt.

Do they need to be “female” no, no more than they need to be “male”.

What is needed is,

1, Training.
2, Opportunities.
3, Progressive working.

It doesn’t work like that. I wish it did but the reality is it doesn’t and you later go on to confuse the general with the specific, leave out important fields like organisational theory, sociology, the neuro-psycho-social stack, media studies, biases and flaws with academic funding and commissioning of research, law and legacy law. Then there is the dreaded “gender studies” which can produce useful work and other less so useful work. The mistake you’re making is to race to the headline and assume time is a linear progression and history is tidy if not in your mental model then your presentation.

The topic is a minefield and in some senses is worse with “rational actors” who lack an intersectional view (broad spectrum and multi-layered) and personal experience of being on the receiving end, or those who are too wrapped up with their own subjective autobiographical history and make basic errors with analysis of science and the law.

I’m currently working on a case I want to bring which involves issues as complex as this. The lawyer I eventually found does get the right kind of basic building blocks and isn’t letting ivory tower specialism or careerism get in the way. Since first wanting to bring a case of a lot of evidence relating to things has been shaken out of the system which helps support my claim I’m not the only one saying it nor were events a one off and, yes, there were barriers in place to obtaining the evidence. A case I have my eye on currently working its way through the system raises a number of similar issues to the case I want to bring.

@ADFGVX

But there’s some gal who becomes an expert all of a sudden at a relatively young age, and other women are expected to suck up to her even if they are older or more experienced or else they are self-hating misogynists

Without discussing details I read of a notable high profile incident in the media concerning one young woman versus the Alt-Right. The Alt-Right manufactured the entire thing from beginning to end. Another young woman who also happened to be a coder at the time also got media attention for per perspective on the incident while pursuing a sucessful coding career. To get some perspective and untangle this incident as well as a lot of hot air generated by mass media about “pinkification” of products you have to step back from this and look back in time some years. You also need to know something about the industry and gender studies to have a proper perspective and sense of context. I know because I was there and involved at the time and had a none zero influence on policy. What happened later is nonsense.

In the same way some men will look at each other and mentally attach significance and weight to what a man says because they are men there are plenty of women who will puff up a woman’s reputation because she is a woman. The actually truth of the situation one way or another is not always the same. It can also be more complex and indirect and “shoot from the hip” and “meet the next deadline” articles from either side add more heat than light. The media especially can be a long way from the truth or genesis of events. I know this because I have known people who were the people behind the headlines and what they told me and what the media printed are not always the same.

Over time I’ve also left my fingerprint on the media a few times though thankfully was not the focus of attention so slinked by without being noticed. The one time I did appear in the media was actually a restaging of events not the actual events themselves and is so long ago and so obscure I doubt anyone would make a connection. Actually, no there was another time which was quite embarassing in hindsight but again it’s so remote and has fallen so far down the memory whole it is unlikely anyone will join the dots. I have also turned down media appearances or declined to be mentioned in a story. I feel the public interest element isn’t always there to justify putting my neck on the line or simply couldn’t handle it on a personal level.

The reason why I won’t generally engage with you and have been ignoring you so far is I’m picking up the whiff of something not quite right about what you are saying. Your comments are absent context and nuance and you’re flipping this way and that. The different signals are not lining up.

Stupid • July 13, 2021 8:42 AM

Who tried to steal my work and “lock it up”

Plagarism is so bad, copyright reduces creative works but plagarism kills them.

License: CC-BY-SA 4.0

walking by • July 13, 2021 8:45 AM

@ Clive Robinson

It is true that you can’t lock up the information, information is free. That’s why all those LEA backdoors, Lawful interception interfaces etc can’t remain secret forever. Eventually they are discovered and abused by criminals.

What’s wrong currently with Cobalt Strike is that this thing is designed to be undiscoverable. So bad guys started abuse that and use it massively against US and EU. However from the history we know a lot of examples that when some inventor saw that his creation is used for bad thinks, he stopped the development to not aid those.

Yes, knife can be used for bad and good. But things are not so black and white here. Cobalt Strike sells, one of its selling point is undetectability. Yet this thing is buried deep inside a lot of networks. When author tells to public how to detect it, he loses his selling point and a lot of money.

So in the end we reach again to the old dilemma – money or ethics. You can earn a lot of money working for the covernment [deliberate misspelling as they always try to cover and hide things] and do bad things. Or you can be poor but do a good things. Very old dilemma.

Clive Robinson • July 13, 2021 8:49 AM

@ echo,

It doesn’t work like that.

Rome was not built in a day, nor was it’s buildings gone in half a century. But the Roman Empire it’s politics and other froth ended centuries ago.

One reason thu buildings are still there is they built it on solid foundations. The three points I give are foundations nothing more.

As to the rest, they come and go like waves washing up on a beach, and are an artifact of the nature of mankind back before it was mankind.

The lizard is ever present but like the gecko it can change to hide it’s true colours.

Winter • July 13, 2021 9:56 AM

@Clive
“Rome was not built in a day, nor was it’s buildings gone in half a century. ”

The Uk and USA were able to destroy their economic future in 75 years. They did so because they did not want to do point 1:

@Clive
“What is needed is,
1, Training.”

The dismal access to good education and training in the USA and UK for the lower classes destroyed the economic prospects of several generations since WWII.

Without a well educated and trained workforce, it becomes difficult to compete in the innovative industry.

At least for the USA, it is clear they banked on getting well trained immigrants to replace their own crop. Take any US scientific paper, and many, if not most (or even all) the authors were trained elsewhere and only entered a USA university to complete the last stage of their education (for a lot of money). The UK tries to do something like that with Oxbridge. However, the UK have no way to employ these people after they finish.

The USA still can and do import the workforce to people the high-tech industry. However, these people can also migrate back and continue back home in competition with the USA. Which is exactly what China is now doing. If India ever gets its act together (not soon, I agree), that will start quite an exodus.

walking by • July 13, 2021 10:51 AM

@ Clive Robinson

Opportunity is good, progressive work is good but training…?
Even monkey or circus bear can be trained to do one thing.
Pavlov reflex.

Basis of any education is the desire to learn. This is very common misconception that teachers teach and students therefore learn. No. Teacher is always a pathfinder, he shows the way, ignites the passion, supports student on this path. Desire to learn must come from the student.

What draws people to cybersecurity? Money and glamour. I don’t see any passion or true desire to learn…

Winter • July 13, 2021 11:32 AM

@walking
“Teacher is always a pathfinder, he shows the way, ignites the passion, supports student on this path. Desire to learn must come from the student.”

That is not how Navy Seals get good soldiers. It is also not how you learn reading and math, or programming or opsec. All these require training, lots of it. That is also how you learn to fly, or become a dentist or surgeon.

walking by • July 13, 2021 12:18 PM

@ Winter

Navy don’t need any thinkers. Navy needs killers who can kill without any remorse or emotions. The basis of their training is first to destroy you as a person until you are one step from breaking. Then they rebuilt you. This is the basis of any special force training whether it be SAS, Navy or Spetznas. They kill all the humanity inside you, drive you to the edge of committing suicide and then give you a chance. After that you are thankful and do whatever they ask you, without even thinking.

Winter, Infosec field don’t need robots that can’t think.
Next time you decide to comment try to understand the concept.
Navy and infosec are quite different (although millitary nowadays had hijacked infosec). Or maybe you are Navy trained and spam here without any remorse because they killed all your humanity in the course of training?

Winter • July 13, 2021 12:51 PM

@Walking
“Winter, Infosec field don’t need robots that can’t think.”

Think about that next time you sit in a dentist’s chair, or an airplane. Think about the experience if the dentist or pilot did not have made their endless hours of training. Same with your favorite sports teams or individual.

This whole “pathfinding” in education does not produce skilled craftsmen/women nor good doctors, programmers or writers.

- • July 13, 2021 1:18 PM

@Winter:

The handle “walking by” is making obviously “bell-pushing” points as a covert way to bell-ring an argument (it used tp be called PAPD prior DSDM IV),

1, Even monkey or circus bear can be trained to do one thing. Pavlov reflex.

2, What draws people to cybersecurity? Money and glamour. I don’t see any passion or true desire to learn.

We saw this behaviour yesterday under a different handle (Travis).

Best left treated as a Troll.

lurker • July 13, 2021 1:36 PM

@Winter,@walking

@walking
“…Desire to learn must come from the student.”

That is not how Navy Seals get good soldiers. It is also not how you learn reading and math, or programming or opsec. All these require training, lots of it. That is also how you learn to fly, or become a dentist or surgeon.

How many Seals, airline pilots, dentists, mathematicians, are conscripts? The good ones wanted to learn and required only light guidance from their teachers. The mediocre ones wanted to learn too, but their lesser ability needed much more input from the teachers to keep them moving forward on the path of learning. It is left as an exercise for the reader to determine why so many poor ones did not gain enlightenment.

These last two posts from @Winter deviate sufficiently from his usual rationality that they could be a new iteration of the Winterbot…

lurker • July 13, 2021 1:50 PM

Maybe WinterBot just consumed spoiled oil?
There’s massive heatwave, spoiled and rotten
oil can make robot do a strange things!

[Can’t add, doesn’t even try.]

SpaceLifeForm • July 13, 2021 2:39 PM

@ –

I agree. Especially because ‘Travis’ never responded to my question about threat model.

I provided the question and provided the oppurtunity to clarify, but, crickets.

ADFGVX • July 13, 2021 3:02 PM

@ walking by

Or maybe you are Navy trained and spam here without any remorse because they killed all your humanity in the course of training?

Air Force.

SpaceLifeForm • July 13, 2021 3:41 PM

No wonder that disabling ssh is a mitigation.

There are thousands of SERV-U servers that have the same ssh keys.

hxtps://mobile.twitter.com/dabdine/status/1414806647554203649

This is in reference to that which I posted earlier. Just including the link again here for convenience.

hxtps://arstechnica.com/gadgets/2021/07/microsoft-discovers-critical-solarwinds-zero-day-under-active-attack/

Travis • July 13, 2021 4:30 PM

@ Moderator

Yes, delete EVERYTHING, including SpaceLifeForm “threat model” spamming since I don’t see any meaningful discussion development.

And oh, who cares if SERV-U has decades of leaking history, despite changing owners several times.

https://www.securityfocus.com/bid/2052/info

Yep, nooone needs that info, meaningless, only Winter spamming here is really important. Leave only his spam, delete everything else, no good discussion here, only name calling.

- • July 13, 2021 4:36 PM

@SpaceLifeForm:
@Clive Robinson:
@Winter:

I provided the question and provided the oppurtunity to clarify, but, crickets.

You will note that at,

https://www.schneier.com/blog/archives/2021/07/friday-squid-blogging-squid-related-game.html/#comment-383528

@travis was given a couple of “put up or shutups” of,

1,

“As I said you avoiding putting forward concrete proposals for your alternative to HTTPS just makes you look silly realy silly, and trying to be even further evasive makes you look worse a whole lot worse.”

2,

“If you have an altetnative to HTTPS then say so, if not well don’t let the door hit you on the way out.”

Which I would have thought could not be any clearer, but all you’ve got is just more of the same old, same old nonsense, like 5th hand Russian Cabbage soup.

SpaceLifeForm • July 13, 2021 5:30 PM

@ Travis

I didn’t answer because threat model was self-explanatory.

I understand the scenario you have described. Yes, it is possible, but as I said, that is not likely.

My question to you is simple:

What is YOUR threat model that YOU are paranoid about?

You have failed to answer that.

Fake • July 13, 2021 5:31 PM

@Clive,

is it worse or is it amplified/directed?

i’ve never been sure of such an astonishment, but we could certainly chalk it up to changes in society without any real data. that part is easy.

Travis • July 13, 2021 6:03 PM

@ SpaceLifeForm

If you don’t know the solutions or don’t want to start the discussion then don’t invent the excuses like “but why you need it?”.

Seems like time to leave for good.

SpaceLifeForm • July 13, 2021 10:10 PM

@ Travis

Bottom line: You can not trust the internet. By design, it is not secure.

If one is up to no good, they probably should not be criming on the internet.

Ultimately, the best you can hope for is face-to-face communications.

You know, like in old times.

SpaceLifeForm • July 13, 2021 10:30 PM

@ Fake

Breaking news! Fahrenheit degrees are smaller than Celsius degrees.

Apple has decimal point shortage! Fractions are not available!

ADFGVX • July 13, 2021 10:45 PM

@ echo

The reason why I won’t generally engage with you and have been ignoring you so far is I’m picking up the whiff of something not quite right about what you are saying. Your comments are absent context and nuance and you’re flipping this way and that. The different signals are not lining up.

As a long-time targeted individual, I wouldn’t doubt you’re an FBI or other federal agent trying to “profile” me as a target for hostile investigation and if you aren’t, I’m reasonably sure there are lurkers or other posters on this forum doing just that.

In my day-to-day existence, I am used to being beaten and bullied and treated by authorities as a monster or some sort of wild animal rather than a human being, and that my suffering gives great pleasure to the ladies and gentlemen of the district.

SpaceLifeForm • July 13, 2021 11:13 PM

hxtps://therecord.media/microsoft-links-serv-u-zero-day-attacks-to-chinese-hacking-group/

According to a Censys search query, there are more than 8,200 SolarWinds Serv-U systems exposing their SSH port online, a number that had remained steady since last week, when the patches were released.

Fake • July 14, 2021 7:18 AM

“Despite this potential for security impact, the characteristics and causes of vulnerabilities in cryptographic software are not well understood. In this work, we conduct the first comprehensive analysis of cryptographic libraries and the vulnerabilities affecting them. We collect data from the National Vulnerability Database, individual project repositories and mailing lists, and other relevant sources for eight widely used cryptographic libraries.
Among our most interesting findings is that only 27.2% of vulnerabilities in cryptographic libraries are cryptographic issues while 37.2% of vulnerabilities are memory safety issues, indicating that systems-level bugs are a greater security concern than the actual cryptographic procedures.”

interesting breakdown, but depending on the level of actual analysis which was all know is/was preliminary we can assume >27.2% vulnerabilities.

also, it covers “widely used” crypto. thus a ryo point would be excluded.

@slf, i don’t follow your fud comment. or was this the specific address? also, don’t shoot me to trying to have some fun with the whitened temperatures.

SpaceLifeForm • July 14, 2021 3:25 PM

@ Fake

I found the article to be FUDly because it used old historical bug reports.

It is known that openSSL had lots of problems, a lot of them due to crufty code trying to support out-of-date ciphers.

I also found that the authors have no history.

It seems to me that the article really had no point. If they really wanted to contribute, they would look at current code, versus review of old code bug reports.

I liked the F/C point btw. No snark directed at you, but at the vendor.

vas pup • July 14, 2021 4:55 PM

Antibiotics use in Africa: Machine learning vs. magic medicine

https://www.dw.com/en/antibiotics-use-in-africa-machine-learning-vs-magic-medicine/a-58097028

“Swiss researchers and doctors in Africa have developed a digital tool to help clinicians prescribe fewer antibiotics, or only when they are really needed.

In fact, antibiotics can do more harm than good when they are wrongly prescribed.

For a start, researchers have long suggested that the more we use antibiotics, the less effective they are against infections. Then there’s the cost of — essentially — wasted medication. They just don’t work against viruses. It’s money down the drain.

“They can also prolong an illness,” says Kavishe. “Maybe the child doesn’t have diarrhea, but you give them an antibiotic and it causes diarrhea as a side effect.”
Reducing the use of antibiotics

Kavishe is one of a number of primary healthcare workers who have been collaborating with a Swiss-based research project called DYNAMIC.”

Read the whole article if interested for more details.

Winter • July 15, 2021 1:09 AM

@vas pu @SLF
“Antibiotics use in Africa: Machine learning vs. magic medicine”

The problem is not that doctors do not know when to prescribe antibiotics and when not. The problem is that patients demand and insist on getting antibiotics even for diseases where they absolutely do not work at all.

IT is so bad that in countries with very strict guidelines on the prescription of antibiotics, patients shop for doctors who flout the rules.

SpaceLifeForm • July 15, 2021 1:47 AM

@ Winter

Not only do people insist on taking an antibiotic when it will not work (they have a virus), they do not realize the major side effect. The antibiotic will attack the bacteria in their gut, which are extremely important for a well functioning immune system.

Basically, you never want to take an antibiotic unless absolutely necessary.

And of course, even when the antibiotic is warranted, they don’t finish the full course, because they feel better. Bad move.

ADFGVX • July 15, 2021 2:01 AM

@ Winter

The problem is not that doctors do not know when to prescribe antibiotics and when not.

There are ALWAYS problems with inappropriate and unnecessary prescriptions, antibiotics can cause hearing loss and other harmful side effects.

The problem is that patients demand and insist on getting antibiotics even for diseases where they absolutely do not work at all.

Of all the drugs commonly abused on the street, antibiotics don’t seem to rise immediately the the top of the list in most people’s minds, but what’s in them, and why are people so desperate?

IT is so bad that in countries with very strict guidelines on the prescription of antibiotics, patients shop for doctors who flout the rules.

So are antibiotic drugs then being adulterated with opiates or other narcotics? The fact that you’d need a doctor’s prescription to get a certain drug is probably a good sign in most cases that you don’t need the drug or the doctor at all then.

And what about antiviral “cocktails” sold to treat HIV+AIDS, HEPATITIS C, etc.? Like there’s a raw oyster with a shot of liquor or an olive on a toothpick in a martini glass, and you’d better live it up while you are still alive because you’ve been served with a diagnosis and a prognosis.

Winter • July 15, 2021 2:29 AM

@ADFGVX
“So are antibiotic drugs then being adulterated with opiates or other narcotics?”

Your response does not make sense.

People are ill and want to be cured. They have heard about this wonder drug that pulls people from death’s claws and want it. They have no idea what it means to say that that was a drug for a different disease.

Drugs are on prescription because ALL medical interventions have side effects and people will not know what is and is not beneficial (at one time, rich people were drinking uranium water for health). Creating strains of “super-bugs” that cannot be treated anymore is one of them. Never enter an Indian hospital because you can end up with untreatable infections due to antibiotic abuse.

Clive Robinson • July 15, 2021 5:07 AM

@

The fact that you’d need a doctor’s prescription to get a certain drug is probably a good sign in most cases that you don’t need the drug or the doctor at all then.

That is not just utter nonsense it’s beyond bizarre.

What happens is,

1, You are feeling normal (well)
2, For some reason you start to feel unwell.
3, You very probably have no idea as to why you feel unwell just that you do.
4, You do not wish to get worse or even die so you seek out a way to become well.
5, You go to a doctor or even a computer and enter an interrogatory process to find out what your symptoms are as “feeling unwell” is not much use to anybody.
6, From a multitude of previous interrogations and statistical methods information about the disease or pathogen is teased out.

At which point with a certain probability one or more disease types or classes of disease types are identified as the probable cause.

From a similar process to 6 various treatments have been found to work with some diseases or disease types.

Some started from some quite bizarre sounding folk remidies such as putting green veined cheese in wound dressings.

As science developed in the late Victorian era researchers pulled out the individual components of the folk remedies and identified which ones promoted healing and which ones did not.

Over time what were found in folk remedies had orher similar chemicals found.

As for,

There are ALWAYS problems with inappropriate and unnecessary prescriptions,

The same is true for folk remedies and eating food, or drinking even water. Yes drink too much water and it can kill you, and has done so to people even quite recently.

Sometimes you show an understanding of science to a high degree, other times you just peomote totally irrational ideas.

For instance,

Of all the drugs commonly abused on the street, antibiotics don’t seem to rise immediately the the top of the list in most people’s minds, but what’s in them, and why are people so desperate?

Street drugs are not consumed by people afraid of dying of some disease that killed their parents or grand parents in less than a week as little as half a century ago.

Anti-biotics saved millions of lives and became the “wonder drug” of it’s time.

People who feel quite unwell can feel as though they are about to die. Trust me on this having nearly died of sepsis I know exactly how they felt.

However feeling unwell is subjective, I routinely ignore symptoms that thirty or fourty years ago would have sent me scurrying to the Drs or even the emergancy room. Why do I not do so now? Because I’ve learnt what they are telling me to expect next and what to do about it. Do I get it wrong sometimes? Yes but then I try to learn from it.

Others do not try to learn…

They just demand as many “self entitled” people do. They assume they are right not by learning or logic but by cognative bias. They also happen to be the ones that have a habit of killing themselves long before their natural term because they don’t learn. Unfortunately they also have the bad habit of killing others.

Ask the question “How many people in the US Drunk Drive?” even though they have damaged their vehicles previously, injured themselves or others, been arrested and convicted… And eventually die young in an alcohol related way be it wrapping themselves around a bridge support or from liver failure or other clearly identified risk of consuming alcohol[1]?

Similar with Smoking?

More than half the people in the US who die untimely deaths can be shown to have abused either or both nicotine and alcohol.

They could have stopped but they knew better, they knew with unswerving certainty that the Drs were lying to them, likewise they knew all sorts of things for which there was no logic, reason or statistics. So they carry on and die young usually leaving a significant mess behind.

[1] I’ve recently been informed that someone I used to work with has been found dead at home having drunk themselves to death with a ltr of grain spirits every day for the past few years. They were not even out of middle age by modern values, but they were stupid, they were vain, they clearly had narcissistic personality disorders and they failed to learn and people stopped “giving him what he thought was his due”. His wife left and took the children and the house, and he started attacking people including police officers just because he was “self entitled”… and the rest of the world knew better and steered well clear of him unless they could take profit from him. I suspect the funeral will be a lonely one at best…

Winter • July 15, 2021 5:56 AM

@Clive, @ADFGVX
“More than half the people in the US who die untimely deaths can be shown to have abused either or both nicotine and alcohol.”

Maybe not quite half, but close:

Up to 40 percent of annual deaths from each of five leading US causes are preventable
ht tps://www.cdc.gov/media/releases/2014/p0501-preventable-deaths.html
(url fractured for your protection)

  • Heart disease risks include tobacco use, high blood pressure, high cholesterol, type 2 diabetes, poor diet, overweight, and lack of physical activity.
  • Cancer risks include tobacco use, poor diet, lack of physical activity, overweight, sun exposure, certain hormones, alcohol, some viruses and bacteria, ionizing radiation, and certain chemicals and other substances.
  • Chronic respiratory disease risks include tobacco smoke, second-hand smoke exposure, other indoor air pollutants, outdoor air pollutants, allergens, and exposure to occupational agents.
  • Stroke risks include high blood pressure, high cholesterol, heart disease, diabetes, overweight, previous stroke, tobacco use, alcohol use, and lack of physical activity.
  • Unintentional injury risks include lack of seatbelt use, lack of motorcycle helmet use, unsafe consumer products, drug and alcohol use (including prescription drug misuse), exposure to occupational hazards, and unsafe home and community environments.

Clive Robinson • July 15, 2021 10:40 AM

@ Winter,

Unintentional injury risks…

Apparently there is quite some dispute over these figires, and has been for quite some time, due to the way “State Agencies” report what gets described as “accidental deaths”.

Apparently reporting things as accidents rather than what they are which is homicides and similar saves a lot of paperwork, expenditure, and political face…

It’s likely @JonKnowsNothing has more upto date figures than those I’ve been shown in the past but apparently the discrepancy is quite large.

I looked into “the official figures” a few years ago when our host reported 37,000 deaths on US roads and I was shall we say more than somewhat surprised as it was around 20 times the UK rate. Even when reworked per head of population it was still three to four times that of the UK and other Major European countries were at the time…

Winter • July 15, 2021 11:58 AM

@Clive
“Even when reworked per head of population it was still three to four times that of the UK and other Major European countries were at the time…”

It seems to be “better” now, ~twice the number. But it is indeed very high. Main reasons I see given are DUI (hardly any enforcement) and bad roads. Also, the USA are organized around driving a car, with inadequate public transport and large distances, which means more driving in miles and hours. Also, the test for a US driver’s license is a joke. It takes a year and more of lessons to pass our local driver’s exam (theory&practice).

But, basically, it seems that Americans care less about other people dying. So they do less to make the roads safer.

JonKnowsNothing • July 15, 2021 2:26 PM

@Winter

re: But, basically, it seems that Americans care less about other people dying. So they do less to make the roads safer.

It all depends on the money and has very little to do with “emotional attachment to fellow humans”.

Roads are owned and maintained by a whole bunch of different groups.

  1. Driveways – private owners
  2. Private roads – generally maintained by the people living along the road
  3. County roads – maintained by county workers and status varies by use: farm road or business road etc
  4. City roads – maintained by cities and not counties. Generally broken into residential, business, commercial, industrial uses.
  5. State highways and freeways – California has only a few toll roads (pay to use) and these are mostly bridges like in San Francisco. State roads may intersect with county road uses with cooperative maintenance.
  6. Federal Interstate highways – Federal funding for maintenance.

When the tax pie gets cut up, and the trickle down ends up as a drip, there is not enough funding to maintain the existing highways and making design changes requires a more determined effort.

When evaluating dangerous roads, a number of considerations are made to determine when or if the road will be altered.

  1. Original design capacity. If a rural area now becomes a commute hub and the road was designed for 5-10 cars per hour at 35 mph and now carries 100-500 cars per hour at 70-80 mph that is a problem but not of the original design.
  2. Cost of mitigations vs rerouting. Adding stripes or widening lanes. Paint is cheaper than bulldozing a shoulder
  3. Cost of rerouting or major alteration. Buying up land to widen or reroute a roadway is costly and while it may seem a no-brainer to buy up that “empty pasture with just a few cows” that is holding up the new 500 cars designed to run 125mph, those cows might be dairy cows and those dairies have been there for much longer than the previously widened highway now bottle necked near the fields. (1)

There are formulas used by the relevant organizations about which roads get what. You have to have N-deaths, N-impacts, N-mitigations, N-funding and more. (2)

Roads in the USA are not built or meant to last very long. They are not Roman Engineered roads. They are the cheapest roads that can be built and built fast. No one here cares about a road that will last centuries because our cities and houses are only designed for 50 years. It’s easier and cheaper for us to bulldoze it and rebuild it than build it to last 100 years. (3)

===

1, A infamous stretch of highway in California (there are many) has been fought over for decades. The highway is actually a by-pass meant to take semi trucks off the farm roads into Silicon Valley. This by-pass has become a major access point to San Jose, California and the interchanges (stop signs) along with the head-on collisions plus the accidents of cars and trucks skidding off turns due to high speed travel because the banked curves were designed for 20mph (tractors and farm vehicles) and not designed for muscle cars racing to Oligarch Paradise, has had a very high death rate for decades. It is one of many sections of roadway where you have every chance of not getting to work or coming home, ever.

2, A local road maintained by the county and state has horrendous car accidents, the majority of fatalities are head-on collisions as the road is 1 lane each way, no passing, 11 miles long, no shoulder, no turn outs. The fatalities are people known to the community but their deaths do not cross the thresholds needed to make the road safer. There are competing interests that keep that road in the same place, in the same 2 lane design and the same annual death rate.

3, The definition of “old” or “antique” varies in the USA and old roads just have potholes in them. If the pothole gets filled every few years the road lasts another couple. If they don’t then the road and nearby houses get sold to a big developer under “urban renewal” proposals, displacing the people already there and replacing them with oligarchs. One current method of road building is that the big developer will put in all the roads, lanes, avenues and on-ramps, along with signage and street lights and stop light systems. Once the housing tract sells out, the ownership may go to the city or an impound system is set up and the home owners pay fees towards the maintenance of the infrastructure. Often the maintenance is done by the city workers rather than private contractors. It depends on the legal language of the agreements (developer, city, home owner).

Travis • July 15, 2021 6:25 PM

“HTTPS Nowhere” is one hell of a browser extension!

I can finally surf the net in the clear, without the pesky SSL in the way.

Besides, isn’t this what every true red blooded American would do? You know you want it.

SpaceLifeForm • July 15, 2021 9:57 PM

@ JonKnowsNothing

One of, if not the biggest problem with road maintenance, is to make sure there is proper water drainage. Here is an example of a road that is well designed to carry water away.

hxtps://boingboing.net/2021/07/15/arizona-floods-swept-this-prius-down-a-street-caught-on-video.html

JG4 • July 15, 2021 10:14 PM

It’s all surveillance all the time. Smart money is better informed, by way of a circular definition. In most cases, there is no better way to be informed than spying.

https://www.nakedcapitalism.com/2021/07/links-7-15-2021.html
…

Big Brother Is Watching You Watch

Inside the Industry That Unmasks People at Scale Vice

Inside Facebook’s Data Wars NYT

Concern trolls and power grabs: Inside Big Tech’s angry, geeky, often petty war for your privacy Protocol
…

ADFGVX • July 15, 2021 11:07 PM

@ JG4

Concern trolls and power grabs

Those are financial concerns versus emotional concerns.

The same confusion exists in Finnish as it does in English.

The Finns have such “concerns” in the sense of “movements,” liikutuksia typically of emotional or religious awakening, but a very similar term liikeitä is also used for business entities or concerns, sometimes also occasionally translated “movements” or “motions” in English.

The Swedes find Finnish liikutuksia and liikeitä to be exceptionally creepy, because the Swedish word lik refers to a dead body or corpse, not to a movement or motion.

There is something very, very low-class about “concern trolls”, sort of like the “heartbroken” ex-boyfriend whose heart was literally “broken” by a bullet from an overly friendly police officer’s service pistol.

JonKnowsNothing • July 16, 2021 1:21 AM

@SpaceLifeForm

re: Cars and Floods or Surge Tides

Cars generally float just enough to tip over.

Often people consider cars to be a safe haven when faced with a natural disaster or event. People attempt to escape by car from the raging fires only to be caught in a gridlock on the roadway or to have their escape route blocked by debris or fallen trees. High winds can flip a car in no time at all. Trees have spontaneously fallen over and landed on cars too.

There is also a “teeny engineering failure” in cars, that when the motor dies and the electrical systems short out, the windows do not roll down and some doors will auto-lock.

In Houston Texas, there are many underpasses and the general area is just above sea level. There is the great shipping and oil tanker channel running from Houston down to the Gulf. As part of the American Rain Forrest the area gets lots of rain and the run off fills the underpasses similar to a flash flood. Drowning by car on a high speed road traversing an underpass is not uncommon.

During the Big Northridge Earthquake, a fair few people did not want to get stuck under the many overpasses, some of which failed and fell onto the road below. Similar failings happened in the Loma Prieta earthquake.

I went the long way round to work for a very long time, not only to avoid the potential of another block falling but avoiding the many construction zones retrofitting the remaining uprights.

Mother Nature isn’t just Turkish Delight.

===

ht tps://en.wikipedia.org/wiki/1994_Northridge_earthquake
ht tps://en.wikipedia.org/wiki/1994_Northridge_earthquake#Transportation

ht tps://en.wikipedia.org/wiki/1989_Loma_Prieta_earthquake
ht tps://en.wikipedia.org/wiki/1989_Loma_Prieta_earthquake#San_Francisco%E2%80%93Oakland_Bay_Bridge
ht tps://en.wikipedia.org/wiki/1989_Loma_Prieta_earthquake#Oakland_and_Interstate_880/Cypress_Viaduct

ht tps://en.wikipedia.org/wiki/Turkish_delight
ht tps://en.wikipedia.org/wiki/The_Lion,_the_Witch_and_the_Wardrobe

(url fractured to prevent autorun)

Winter • July 16, 2021 4:51 AM

One big draw back of electrical cars has been remedied:

Ford Fragrance Shows Petrol Fans They Won’t Miss out with Mustang Mach-E GT
ht tps://media.ford.com/content/fordmedia/feu/en/news/2021/07/14/ford-mach-eau.html

Ford has created a premium fragrance for those who crave the performance of the new all-electric Mustang Mach-E GT yet still hold a fondness for the evocative smells of traditional petrol cars.

In a Ford-commissioned survey, one in five drivers said the smell of petrol is what they’d miss most when swapping to an electric vehicle, with almost 70 per cent claiming they would miss the smell of petrol to some degree. Petrol also ranked as a more popular scent than both wine and cheese, and almost identically to the smell of new books.

They will surely solve the other main obstacle to electrical drivingeventually: The lack of a roaring motor sound.

Clive Robinson • July 16, 2021 6:11 AM

@ Winter,

They will surely solve the other main obstacle to electrical drivingeventually: The lack of a roaring motor sound.

One of the reasons I stopped riding my push bike was Prius drivers.

In the UK we drive on the left, and cyclists are expected to exist in the left hand gutter by many drivers.

Thus as a cyclist who wants to turn right you have real problems, the first is to get out of the gutter, the second is not to get crushed by drivers who just do not look to the left, and the tgird is the dickhead motorists who think they can still get around you even when you are actively moving to the right.

The problem is that at some point as a cyclist you have to stop looking over your right shoulder for the dickheads and start looking for the equivalent comming towards you on your right.

When cars made “noise” you could use your ears as an early warning system for the dickheads comming up behind you thus get some in time warning.

The Prius however went quiet when the dickheads foot came off the gas behind you, and only at the very last moment when they stamped on it to get the power to get around you did it make noise. By which time it was too late for the cyclist. I got hit twice by Prius drivers in less than six months when I’d not had a turning right incident for over a decade privious to that[1]…

So yeah, that engine noise is important to other road users.

[1] That incident was a Post Office van also turning right who did it at sufficient speed to crack bones in my hand and wrist of my outstretched arm the law requires cyclists to use to indicate they are turnning. And it must have been more than a decade and a half prior to that, that I’d had a turning right injury, when a woman in an expensive car turned right out of the road I was turning into and scooped me up onto her very expensive bonnet.

Winter • July 16, 2021 7:02 AM

@Clive
“When cars made “noise” you could use your ears as an early warning system for the dickheads comming up behind you thus get some in time warning.”

This is then for you:
New EVs in EU emit pedestrian noise starting today, London mulls ‘futuristic’ e-bus noises
https://electrek.co/2019/07/01/electric-cars-eu-noise/

Another plan was to detect pedestrians&cyclists and emit directed noise to them.

I see a market looming of “ring sounds” for cars.

echo • July 16, 2021 8:28 AM

I had a bicyle and decided to get rid of it when cars annoyed me too much and I felt the road environment was unsafe.

Thankfully the hugely annoying skateboard craze has gone away again. Now it is all e-scooters. Not only are they silent but the people (almost always men and almost always wearing urban grunge which blends in with the urban environment) have no lights. I don’t want to be surprised by them and stop or move depending on the situation and be mown down by a car.

On the issue of walking I have noticed if I wear a big skirt which flares out in a 1950’s style people unconciously make extra space relative to the edge of the skirt. This is quite an odd feeling especially in a crowded shopping centre with people moving past each other by inches as I exist in my own bubble. Most of my flared skirts including the shorter ones are fairly high contrast so quite noticeable during day or night. I have noticed if I’m wearing a pencil skirt walking along a relatively narrow pavement most people will squeeze past. If I’m aping Dior’s “New Look” most people will walk around parked cars or even cross over. On the data so far I am fairly sure this is not a one off.

Travis Ormandy (@traviso) • July 16, 2021 8:50 AM

Guys, especially SpaceLifeForm!!!
I found a huge hole.
Who want’s to see it?

SpaceLifeForm • July 16, 2021 4:09 PM

Now, the real Tavis Ormandy (@taviso) actually did have something interesting to note today.

hxtps://www.twitter.com/taviso/status/

This is neat, @cube0x8 has x64 support working for loadlibrary! That allows a native Linux process to dlopen() a 64-bit dll, really useful for fuzzing. Let us know if you want to help test.

hxtps://github.com/cube0x8/loadlibrary/tree/x64

[see the readme at the github link. This is seriously impressive work]

SpaceLifeForm • July 16, 2021 4:19 PM

Corrected link, not sure how it got chopped.

hxtps://www.twitter.com/taviso/status/1416135128846196737

SpaceLifeForm • July 17, 2021 2:21 AM

@ Fake

Does this ring a bell?

hxtps://linux.slashdot.org/story/13/09/19/0227238/linus-torvalds-admits-hes-been-asked-to-insert-backdoor-into-linux

[he did not actually, but maybe it was a hint]

Fake • July 17, 2021 7:49 AM

@slf,

yes but not one of the ones i’ve been rooting around for, no big deal i’m trying to keep a little quiet w the floods &&. keep your eyes peeled on other forums there’s some of us who’re on hn sd lo so keep an eye out for old friends.

hopefully everyone is okay, we’ve had ALOT of rain here too but none of the failing infrastructure as of yet.

i’m switching back over to fedora and home+garden when i’m back off of this platform i’ll start rebuilding a catalog.

Leave a comment

Login

Allowed HTML <a href="URL"> • <em> <cite> <i> • <strong> <b> • <sub> <sup> • <ul> <ol> <li> • <blockquote> <pre> Markdown Extra syntax via https://michelf.ca/projects/php-markdown/extra/

Sidebar photo of Bruce Schneier by Joe MacInnis.