Researchers have found possible evidence of paternal care among bigfin reef squid.
As usual, you can also use this squid post to talk about the security stories in the news that I haven’t covered.
Read my blog posting guidelines here.
Miss Piggy • September 10, 2021 5:26 PM
@ matthew_d_green
I am the CIO of Tether
hxtps://coinmarketcap.com/alexandria/article/is-tether-untouchable-the-latest-twist-in-a-long-running-drama
William Shakespeare • September 10, 2021 5:46 PM
@ matthew_d_green, Kermit The Frog, Miss Piggy
I am the CIO of Tether
“All the world’s a stage”
name.withheld.for.obvious.reasons • September 10, 2021 8:06 PM
10 Sept 2021National Security Rulings and Standing, or Not
You have to be a pretzel artisan to achieve the number of folds and manifolds it takes to make such a summary seem even plausible–to my mind this is laughable and suggests that the courts are far from just and prudent. Now two courts have argued against themselves, courtroom dissonance.
Jewel v NSA
A story not reported, 17 Aug 2021, the 9th Circuit denied appeal to the Jewel v NSA, after 13 years of attempting to crack the national security state. The judge, J.S. White in a shadow docket type decision, asserted that because government surveillance is always legal, their could be no finding that would allow to reach the merit of standing. No one, can bring a case respecting surveillance irrespective of facts.
Less than Supreme
Less than a month later, the Supreme Court follows the same type of procedural exercise and reaching a finding that says “everyone” has standing. Anyone can sue a person providing material support in the case of a medical procedure, abortion. The irony, once again, is that irrespective of the truth, only a court determination, can one be afforded the venue of a court without having been a party to the events detailed by the suit. Go ahead punk, make my lawsuit (thinking of some weird tailoring type threat).
name.withheld.for.obvious.reasons • September 10, 2021 8:29 PM
10 Sept 2021 — Rejecting Civil Society in the name of Public Trust
Consider that congressional and state representatives are placing continuous calls to various parts of the country claiming they have placed a bomb somewhere. Their propaganda outlets are also making the same calls, over and over again. When will the public demand that the fascists and cult members be ejected from any public office or position of trust. Or, does the escalation and harm that will succeed these calls be a moment of rational action. If gun extermists and the lobbyists are involved, I’d mark the probability towards zero.
It isn’t necessary to arrest them, it only requires removing them from civil society. The public trust is actively being raped by a cult that has nothing but a reflexive non-negotiable position that cannot be addressed with a political solution. One party has rejected electoral processes within the democratic republic of the United States. In other words, they have actively and continue to violate their oath of office and the public trust afforded such positions.
Side Question (helps avoid multiple posts)
Has anyone looked into commercial support of religious institutions like churches. On one such hunt, the Caymen Islands was a starting off point.
Robin • September 11, 2021 4:53 AM
Popularised account of the An0m phone sting operation :
h tps://www.theguardian.com/australia-news/2021/sep/11/inside-story-most-daring-surveillance-sting-in-history
Clive Robinson • September 11, 2021 6:22 AM
@ Robin,
Popularised account of the An0m phone sting operation
Sadly it has known inacuracies and some things that are factually incorrect.
For instance the last paragrah is provably false.
Oh and for those who want confirmation of the “God Complex” in US NatSec, there are some quotes from Stewart Barker ex NSA legal advisor who apparently has the belief that nobody should have legal protection from police state activities in the US and thus by extention anywhere in the world.
We’ve seen with the actual butchering of a journalist who worked for the Washington Post on the whim of a Saudi Prince and what the Prince then ordered to hide his guilt, why people need the protection of truely private communications.
Freezing_in_Brazil • September 11, 2021 11:31 AM
Test
Am I banned? I’m having perfectly civil posts getting banned in an inordinate amount [methinks].
Greetings from Brazil.
MarkH • September 11, 2021 12:07 PM
@Freezing_in_Brazil:
I don’t think you’re banned! In any case, I was able to read your question.
It seems that many comments from multiple participants (including me) have been lost, even when nothing in their content seemed remotely objectionable. It’s just the way commenting is behaving right now.
Although some comments with web links are getting through, it looks as though best success is for comments without them, or with at most one link.
It needs patience … or can be thought of as an opportunity to study stochastic processes!
Glad to know you’re still participating.
Curious • September 11, 2021 12:24 PM
According to an article linked on Twitter, supposedly Ray-Ban (manufacturer of shades/spectacles) has linked with Facebook to make shades that record video and still images.
https://www.axios.com/facebook-ray-ban-wayfarer-stories-5f113bfa-797f-4e2d-b99c-7d65a8726607.html
A Nonny Bunny • September 11, 2021 3:26 PM
@any moose
Ignorance of history will be the death of the West.
Not just history, disregard for the truth in general.
Leftists declare nonsense, e.g., requiring IDs to vote is racist even though all other Western countries require it, to be righteous truth.
Most Western Countries aren’t the US, though. Maybe there are particular circumstances in the US that lead to racist outcomes if you don’t address those circumstances first.
Now, I’m not an American, so I can only guess at what those circumstances might be. Fortunately, there is also the ACLU, which have nothing better to do. Just look at https://www.aclu.org/other/oppose-voter-id-legislation-fact-sheet
The two things that jump out for me most are “Minority voters disproportionately lack ID” and “Voter ID laws are enforced in a discriminatory manner.”
I can’t speak for the rest of the western world, but neither of those circumstances are the case in my country. Everyone over 14 is legally obliged to carry an ID card here. And everyone’s ID is checked equally when voting.
You’re right that requiring voter ID is not intrinsically racist. But doing it in a situation where you know minority voters disproportionately do not have one, and you don’t address that first, then it probably is.
Even if it is possibly motivated more by excluding part of the opponents’ voter base than by racism, the effective outcome is still racist.
any moose • September 11, 2021 3:58 PM
@A Nonny Bunny
“Maybe there are particular circumstances in the US that lead to racist outcomes if you don’t address those circumstances first.”
I appreciate that you are not an American. But there are no particular circumstances, it’s all political theatre. No one can cash a check or withdraw money from an account without an ID. Liquor laws are such that even those who are middle-aged are required to show ID to purchase liquor. In other words, the claim that many minorities do not possess an official ID is a lie. If leftists honestly want to assist minority voters in obtaining an official ID, which translates to the non-driver’s version of a driver’s license, leftists should assist them in doing so, perhaps traveling with them to ensure that nothing goes wrong. And if getting minority voters to the polls on election day is a problem, then leftists should rent busses for the day or volunteer to help them complete mail-in ballots. But to allow people to vote without displaying an official ID is to invite fraud.
By the way, the ACLU’s comment, “Such voters more frequently have difficulty obtaining ID, because they cannot afford or cannot obtain the underlying documents that are a prerequisite to obtaining government-issued photo ID card,” is untrue to the point of being ridiculous. If someone cannot provide sufficient documentation to obtain an official ID, they won’t be able to provide sufficient documentation to prove they are an American citizen and therefore a valid voter.
SpaceLifeForm • September 11, 2021 5:36 PM
moose and bunny spinning in the taiga
SpaceLifeForm • September 11, 2021 5:42 PM
@ ALL
Homework assignment:
Identify the 4 different CPUs in your smart phone.
Anders • September 11, 2021 5:45 PM
Continues…
hxxps://theintercept.com/2021/09/09/covid-origins-gain-of-function-research/
SpaceLifeForm • September 11, 2021 6:13 PM
If you think you are impotent, then Q.E.D.
SpaceLifeForm • September 11, 2021 6:22 PM
After 20 years, Microsoft is still Swiss Cheese
CVE-2021-40444
Anders • September 11, 2021 6:53 PM
Since i don’t know anything about US regulations, i just ask.
The Intercept under FOIA requested documents.
OK, court ordered to release them.
What prevented the owner the alter them in the first place?
Remove some sections, add some sections, alter things,
renumber them, alter metadata etc.
If you are owner, you can do anything to them. Nowadays
everything is digital, you can alter them in the heartbeat
and then say – that’s the way they were.
So i wonder – how trustworthy can any of such requested document
actually be?
Anders • September 11, 2021 6:55 PM
@SpaceLifeForm
POC is already out.
hxxps://github.com/lockedbyte/CVE-2021-40444
Who? • September 11, 2021 8:44 PM
@SpaceLifeForm
I understand the CPUs on an hypothetical smartphone may be the microprocessor (usually an ARM-style one), cellular modem, battery controller and GPU (on some models).
There is a fifth one, the SIM card low-powered processor. As other secure elements a SIM card runs on its own processor.
Who? • September 11, 2021 8:55 PM
@SpaceLifeForm
There are no four, but five different CPUs on an hypothetical smartphone:
Who? • September 11, 2021 8:57 PM
Sorry for double-posting; my post has not been published on more than ten minutes, and it is usually posted in no more than two minutes.
Clive Robinson • September 11, 2021 9:37 PM
@ SpaceLifeForm,
After 20 years, Microsoft is still Swiss Cheese
Nagh, to far north, with MS “Things go south” so think instead of the Sardinian Cheese “Casu Marzu”.
It’s the one that smells of stagnant sheep p155 and is writhing with an infestation of live Maggots and is not just dangerous to your health, it is illegal in most places where people have any real sense (which should be the case with MS Code as well… But common sense, ain’t so common as you’ld think).
lurker • September 11, 2021 11:56 PM
@docx
I’m yawning with Clive. Who can remember when Word-6 for MacOS was released? The first version with VB macros for jollity. A person above my payscale was annoyed when I told him we did not support it, and it was his problem what to do with the install CD brought back from an overseas trip.
SpaceLifeForm • September 12, 2021 1:36 AM
@ Who?
Good catch. I forgot about the battery.
Which, then leads me to wonder about flash and caps.
I found that it takes nearly 24 hours for the clock to clear even when the battery has been pulled. That, of course assumes you can actually pull the battery. Determined via a rooted device without SIM.
SpaceLifeForm • September 12, 2021 2:08 AM
@ Anders
how trustworthy can any of such requested document
actually be?
Actually, the document will probably be very legit, but heavily redacted.
More than one person has seen the document. The redactions will be there because, usually, to hide Sources and Methods, or, to prevent damage to an ongoing investigation. Mostly the latter in recent times.
If one were to try wholesale changes, they will be caught.
SpaceLifeForm • September 12, 2021 2:33 AM
@ Clive, Anders, lurker
CVE-2021-40444 is worse than many believe.
The main problem is that it can be a zero-click exploit.
It’s not just Word documents. An RTF file can be an exploit.
It is not a memory corruption problem. It is purely a logical exploit. It is logically a feature, not a bug, depending upon your point of view.
Did you know that remnants of IE still lurk in Win 10?
And the exploit chain can download unsigned CAB files and load DLLs?
Again, repeating, it can be a ZERO-CLICK EXPLOIT.
Clive Robinson • September 12, 2021 4:51 AM
@ SpaceLifeForm,
CVE-2021-40444 is worse than many believe.
Yes it very probably is.
From a brief reading the problem is in MSHTML which due to “legal action” MS made a core component of everything.
So I suspect now it’s known how to get at it one way, many other ways will follow.
As I mention from time to time there are bugs in recent MS OS’s that go back three decades or so. Why? Because MS OS’s are petrifying layer cakes. Code from NT3.5.1 is very definately “set in stone” at the bottom and the rot grows up layer by layer. Each “new” MS OS is in reality a new layer ontop of an old pile. With most new stuff realy being superficial “user land” novelties and down right nasty “Spy-on-You” stuff.
From memory the last genuinely useful MS OS “upgrade” was Win XP to get USB working, since then “tinsel tosh”.
Curious • September 12, 2021 5:36 AM
I found another linked article for the Ray-Ban/Facebook video recording shades/spectacles.
https://www.nytimes.com/2021/09/09/technology/facebook-wayfarer-stories-smart-glasses.html
Who? • September 12, 2021 5:59 AM
@SpaceLifeForm
Capacitors could be able to preserve volatile memory contents for some hours. These components cannot store the large amount of energy required to establish a link to a cellular base station, Wi-Fi access point or another bluetooth-enabled device.
Smartphones, however, have too many independent brains. You have a good point here. Why do we want a secure operating system for a smartphone when the mobile broadband modem has enough computing power and resources to read—and write—device’s memory and storage or even transmit parts of it to a remote device without our consent?
Clive Robinson • September 12, 2021 6:14 AM
@ SpaceLifeForm, Who?,
Which, then leads me to wonder about flash and caps.
Don’t forget what comes between rechargable batteries and capacitors, the so called “Super-Caps”.
You can put a number of microcontrolers into several power down modes, some of which draw so little power you can run them of energy you can harvest off of a human via a thermocouple etc.
These chips will happily run on a super-cap for a week including keeping a Real Time Clock with beta cut crystal running at 32kHz. This driving a “CRON” type system in software.
I’ve got a tichy little ALBA phone that keeps both the clock and calendar running if you pull the battery to swap one of the two SIMS or Memory Card.
Speaking of memory cards, did you know they have not just two or three CPU’s on them but some now have WiFi as well…
Anders • September 12, 2021 10:40 AM
@Clive
And not only WiFi, some are full fledged Linux servers.
hxxps://hackaday.com/2016/06/30/transcend-wifi-sd-card-is-a-tiny-linux-server/
hxxps://jamesone111.wordpress.com/2014/03/19/exploring-the-transcend-wifi-sd-card/
Clive Robinson • September 12, 2021 1:55 PM
@ Anders, SpaceLifeForm, ALL,
And not only WiFi, some are full fledged Linux servers.
Remember it started nearly a decade ago, think where it has got to by now…
Somebody I know has one in their Raspberry Pi as the main drive, and an updated version of BusyBox to login via. They use it as a fast way to do updating when doing development.
No it’s not secure, but hey “Ease of use man!” 😉
I was thinking once about building a “computing cluster” using RPi’s just for the crack of it…
The thought occurs to me that now some mobile phones new are less than RPi’s it might be fun to have a “mobile cluster” just by pushing such cards in the card slots…
It probably would be fairly naff performance wise but think of the bragging rights 😉
But on a more serious note for poor man’s espionage, you might be able to use it as a “pocket dead drop” for “lunch times” etc. You just go and sit on a bench in a park within range of the road/pavement and your contact just ambles past.
When you leave the “drop zone” you both pull the cards out of your phones and there is no trace on them that commercial forensic systems are going to find.
Anders • September 12, 2021 3:03 PM
@Clive @SpaceLifeForm @ALL
I think the “Stealing the Network” book series popularized
the “creeper box” term.
“He looked at his watch: 11h36. He still had plenty of time to install the creeper box. The creeper box was worth its weight in gold. A very small PC with a footprint of about 12x12x4cm, equipped with a single Ethernet and tri-band GSM modem, the creeper could be installed virtually anywhere there was power, GSM coverage, and Ethernet.”
This was ~10 years ago. Now we have basically all this in the form
of SD card. Most of those cards boot without the host so the only
thing you must provide is the power.
From the old research:
hxxps://forum.archive.openwrt.org/viewtopic.php?id=45820&p=9
“OK, I managed to put DLNA/Upnp and Samba servers on the card along with Ubuntu. It’s now a full computer inside my MP3 player. Nice.”
Imagine what can be done with those cards today.
Although old, “Stealing the Network” book series is still
worth reading today.
Clive Robinson • September 12, 2021 4:26 PM
@ Anders,
This was ~10 years ago.
More like 20years ago =( I’d been messing about with a Single Board Computer (SBC) that was only fractionally larger than a stick of chewing gum, and Moterola G24 tri-band GSM modules that had a USB 1.0 compatable interface and a serial interface to a GSM device.
The idea as I’ve mentioned in the past was a geo-fenced secure memory device like a large thumb drive that could only be used with keys it downloaded over the GSM module Thus if it were lost or stolen or you tried to use it at the wrong time or place no joy as the keys would not get sent to you.
So that “footprint of about 12x12x4cm” was huge in comparison.
With regards,
Imagine what can be done with those cards today.
There is more than one supplier of System on a Chip (SoC) microcontrolers that can run a full *nix system. Back about a decade and a half ago MicroChip had it’s PIC24 chips around $1.25 which quickly dropped to ~$1 with four high speed serial interfaces that could do SPI it was more powerfull than the early Micro Vaxen. Somebody ported BSD 2 onto it… Today there are 8pin microcontrollers less than 5mm by 5mm that are as powerfull…
The problem is not the size of the silicon chip but the size of the package it comes in. If you get the bare chips you could easily put a microcontroller in a USB PCB mount socket or USB cable plug…
And people are doing so with key-loggers and similar for Z-List Pen-testers to look smart…
If you want to be a good ICT “security proffessional” these days you realy have to understand digital and analog Communications including RF along with how the likes of SDR and digital bugs work.
It’s an area our host has avoided up till now, but it will be difficult to keep avoiding it on the technical side much longer.
ITsec is not ICTsec and the “C” is taking over, as the “I” becomes less and less diverse and standard SysAdmin fare.
Anders • September 12, 2021 4:56 PM
@Clive
I looked up when a second book of that series,
“How to Own a Continent” was published
Publisher : Syngress; 1st edition (May 1, 2004)
Creeper box at those measures was there in second book,
so yes close to 20 years.
hxxps://www.amazon.com/Stealing-Network-How-Own-Continent/dp/1931836051
You can now make things very small, but you still depend
on power supply size, especially if you run expended time
operation. One option is to hide the whole thing inside
USB connector shell, but you can also deliver to secretary
a nice flower pot. Usually near secretary there’s also a WiFi
and the conference room. With little bit of cleverness size
will not become a problem.
ps. go for the Stealing the Network – The Complete Series Collector’s Edition
vas pup • September 12, 2021 5:25 PM
Has the Theranos scandal changed Silicon Valley?
https://www.bbc.com/news/technology-58469882
“In Silicon Valley intellectual property is closely guarded. The ‘coke’ recipe, the secret sauce, is often the thing that gives a company value, and new technology firms are particularly sensitive to having their ideas copied or stolen.
Secrecy is important for these companies to succeed – but that ==>culture of secrecy can also be used as a smoke screen, particularly when even employees and investors don’t understand or aren’t given access to the technology itself.
This is what happened at Theranos. Journalists, investors, politicians, you name it, were all told the science was there. Yet when questions were asked they were told the technology was so secret that it could not be fully explained, analyzed or tested.”
Read the whole article if interested.
Clive Robinson • September 12, 2021 5:36 PM
@ Anders,
but you still depend on power supply size
Yup, energy storage is the world’s biggest problem yet few realise it.
There is not enough lead for traditional “Lead Acid Batteries” nor enough lithium for LiPo and family, nor enough iron for liquid batteries…
Worse we can not realy do “chemical storage” for fuel cells. We don’t have the metals, and more importantly we don’t have the technology to efficiently turn CO2 and H2O back into hydrocarbons.
Whilst there are “energy dense” fuels by the time you add in the size of the system to convert from fuel to electricity you still end up with a sizable lump that over all is grossly inefficient.
Take a nuclear battery the plutonium isotope is quite energy dense with something the size of your little finger pushing out on average 500Watts of heat for a hundred years. But either you use thermocouples or a closed cycle –sterling– engine both of which need a massive cooling system to be anything other than grossly inefficient.
You would be surprised at just how many people are working on shrinking energy storage, and all we do is move a percentage point or two in reduction every few years…
Anders • September 12, 2021 6:11 PM
@Clive @SpaceLifeForm @ALL
OK, this post will probably deleted, but nevertheless.
I’m counting that whoever likes the book, will buy it.
And download site has disclaimer too that all downloaded
items must be deleted…
But to make things more interesting let’s use some trivial
encryption. Single byte XOR 😉
3F 23 23 27 24 6D 78 78 30 3E 23 3F 22 35 79 34 38 3A 78 23 36 3B 3B 32 25 35 38 2E 78 04 32 34 15 38 38 3C 24 78 35 3B 38 35 78 3A 36 24 23 32 25 78 04 23 32 36 3B 3E 39 30 72 65 67 23 3F 32 72 65 67 19 32 23 20 38 25 3C 72 65 67 7A 72 65 67 03 3F 32 72 65 67 14 38 3A 27 3B 32 23 32 72 65 67 04 32 25 3E 32 24 72 65 67 14 38 3B 3B 32 34 23 38 25 72 65 60 24 72 65 67 12 33 3E 23 3E 38 39 79 27 33 31
Winter • September 12, 2021 10:20 PM
@Clive
“There is not enough lead for traditional “Lead Acid Batteries” nor enough lithium for LiPo and family, nor enough iron for liquid batteries…”
What about NaCl?
Mowmowfi • September 12, 2021 11:16 PM
@clive anders winter
There are a lot of radioisotopes that can be turned into a battery, calcium comes to mind with double beta negative decay,
The reason it isn’t happening is beyond me.
Mowmowfi • September 12, 2021 11:31 PM
@anders
Looking at the xor chart by dyslexia I’m guessing 0x11, centred around numbers and capital lowercase letters, but that would involved me using what little I’ve got left to accurately answer.
Clive Robinson • September 13, 2021 12:59 AM
@ Winter,
I don’t have access to that paper as it’s via Wiley…
However there is other perhaps easier designs,
https://www.pnas.org/content/pnas/114/5/834.full.pdf
But note the second problem of many
metal based rechargable batteries,
“Low discharge / recharge cycle of 100-200 before degradation and break down of physical structure”
In lithium and lead based batteries they try to get around the issue by using a reduced discharge depth. Thus ~67% with lithium and ~50% with lead. Which can get you upto a 500-1000 discharge cycles with carefull battery managment profiles. However this is at the expense of reducing the usable energy density and restricting peak discharge rates so you end up with about half the energy density and high recycling cost.
Which whilst it can be made acceptable for “grid storage” in some places (Australia N.T.) it is problematic in other areas, and especially vehicles.
We need charge/discharge cycles to be up in the 4000-10,000 range to get close to other technologies such as some liquid batteries and most mechanical and internal combustion engine systems.
Oh and for vehicles we need charge times in seconds / minutes to become practical.
Efficient energy storage, is like a game of “Wack-o-mole” you think you’ve solved one problem to discover three more have poped up else where.
Clive Robinson • September 13, 2021 1:14 AM
@ Mowmowfi,
The reason it isn’t happening is beyond me.
Well I can give you one reason,
“The N word.”
Back last century the name of certain types of Body Scanners was changed from NMRI to just MRI for just this reason.
Any where the “N word” gets used people get nervous and ask questions like “Will I still be able to have children” etc.
It’s odd to think that the “doomsday” curse of “Chernobyl” from 35years ago is still fresh in many peoples psyche, yet the reality is way way different than was expected.
Thus the question “Will Nuclear ever have a good vibe in the public eye?”.
Anders • September 13, 2021 8:47 AM
@Clive,
Let’s see what comes out from this.
hxxps://news.harvard.edu/gazette/story/2021/05/researchers-design-long-lasting-solid-state-lithium-battery/
Clive Robinson • September 13, 2021 9:46 AM
@ Anders,
Let’s see what comes out from this.
If it stops the dendrite problem and we can work out why then it’s not just lithium batteries that would benifit.
Nearly all metal based rechargable batteries have a dendrite issue, whilst some in theory can get “blown out” by superimposing an AC voltage on the charge current I’ve not seen evidence as to why it should happen.
That said those supposadly non rechargable zinc-carbon batteries can be recharged about 20 times with an AC charge current with a -20% +80% duty cycle.
Winter • September 13, 2021 10:55 AM
@Clive
“But note the second problem of many
metal based rechargable batteries,
“Low discharge / recharge cycle of 100-200 before degradation and break down of physical structure””
From the article (sorry, not public):
Here we report a Na/Cl2 battery using amorphous carbon nanospheres (aCNS) as the cathode and aluminium chloride (AlCl3) in SOCl2 as the main components in the starting electrolyte. The battery operates/cycles with a 3.5-V discharge voltage and up to 1,200 mAh g−1 capacity (based on the aCNS mass throughout this paper unless otherwise specified) over more than 200 cycles, with a Coulombic efficiency and energy efficiency (ratio of energy discharged over charging energy input per cycle) of greater than 99% and greater than 90%, respectively.
Sounds good to me.
JonKnowsNothing • September 13, 2021 11:10 AM
@All
re:Imperfections of AI/ML generated identification
An article about the wrongful identification and arrest of a UK citizen that the Italian authorities had marked as a missing but known-to-be in hiding seriously bad dude.
Last Wednesday, around 5pm, a 54-year-old British man … was cuffed while he was having a meal in a restaurant in The Hague by heavily armed police who pulled a hood over his head and dragged him out in front of dozens of terrified customers, according to media reports.
The good news, the man was released after 3 days stay as a “guest of the Dutch LEA authorities”. The bad news is the wrongful warrant is still active and has been petitioned to be withdrawn. Until the warrant is withdrawn the man faces a potential repetition of events.
The LEA also took DNA from the man and family for proof of Not-that-Dude and Not-Related-Either.
===
ht tps://ww w.theguardian.com/world/2021/sep/13/italy-urged-to-close-case-of-british-man-mistaken-for-mafia-boss
(2x url break)
Clive Robinson • September 13, 2021 11:21 AM
@ Winter, Anders,
Sounds good to me.
Well 200 cycles might be OK for cheap pocket/portable devices but it’s barely half a year for smart devices.
One of the reasons batteries were made non removable was not just that it alowed smaller form factors and higher internal volume, but it alowed much less costly construction techniques. As a sealed unit is mechanically stronger so less materials are needed not just in wall thickness but there are no “fixing points” needing stress spreading etc. Also batteries could have reduced casing, thus giving higher energy storage for a given volume.
Freezing_in_Brazil • September 13, 2021 11:48 AM
@ MarkH
It seems that many comments from multiple participants (including me) have been lost, even when nothing in their content seemed remotely objectionable. It’s just the way commenting is behaving right now.
Thank you my friend, and excuse the delayed reply. Yes, what you said makes sense.
Hope everything is well with you.
Regards
Clive Robinson • September 13, 2021 11:56 AM
@ MarkH, Freezing_in_Brazil, @SpaceLifeForm,
It’s just the way commenting is behaving right now.
It may not be “moderation”.
I’ve seen error messages when I post at the same time as another person, and noting the time when I’ve lost “new” comments it appears like a clash of posting times.
So there may be a bug in the site code.
@SpaceLifeForm and myself have both seen the funny error messages when testing things out. I suspect orhers have as well.
Anders • September 13, 2021 12:17 PM
@Clive @Winter
This has been interesting road so far,
if we look at radios.
First tube radios required 3 battery, then they reduced
them to two.
First transistor radio operated at 22.5 volt battery, then they
gradually went to lower voltage as technology improved – 9v,
4.5v, 3v, 1.5.
I needed to recharge my first cell phone every day. Then with
lithium ion small breakthrough came – almost month standby
with “dumb” cellphone, although this wasn’t just battery –
technology improved further and power consumption reduced.
Smartphones show this very nicely – again we charge them almost
daily.
So the actual breakthrough came from semiconductors and their
power consumption, not actually from battery.
Now several claim that they have solved solid lithium battery
problem. Hopefully we live long enough to see this.
hxxps://www.wired.com/story/quantumscape-solid-state-battery/
lurker • September 13, 2021 12:19 PM
@Anders, Clive
Graphite coated anode? or graphene?
I recently replaced my solar system’s SLAB (6 yr old, discharching too low, charging at too low temperature), and the literature was suggesting I get “Lead-Carbon”, ie. anode coated with graphene, as used in supercapacitors. Lead-Carbon sealed, gel or other, not yet available in my market…
Freezing_in_Brazil • September 13, 2021 12:46 PM
@ Clive, Mowmowfi
Any where the “N word” gets used people get nervous and ask questions like “Will I still be able to have children” etc.
I’d guess that is also the reason why we can’t have low radioactivity TRNG chips [back in the day we used to have Americium lightning rods all around – and smoke detectors]
(*) Though I don’t see why high profile government secrets aren’t protected with nuclear TRNG.
Who? • September 13, 2021 2:05 PM
@ Anders
The book looks really great, much better than I would have expected. I have been reading very good comments about this series for years, and its PDF edition clearly shows the quality of this work.
I will buy the hardcover edition with DVD in two months. It is available for sale yet.
SpaceLifeForm • September 13, 2021 3:21 PM
@ Clive, MarkH, Freezing_in_Brazil
Noctilucent Clouds
I suspect MariaDB is ultimately the problem when it comes to lost comments.
But, I would not conclude it is an ACID consistency problem.
Think about it.
someone • September 13, 2021 3:32 PM
@curious re: FB photo/video glasses I mostly agree with the “so what” conclusion offered in regard to potential abuse by the eyeglass wearer. There are, and have been for quite some time, a myriad of ways to stealthily capture photos of one’s immediate surroundings. I even seem to recall a device from many years ago (so many that the article was in one of the pulp science magazines) that were also built into eyeglass frames. I am somewhat more concerned by what access FeceBook itself might have without requiring the wearer to grant express permission. Is the storage optionally local-only, or is every image automatically uploaded to some cloud that FB controls (as I suspect)? If the latter, you can bet that FB will run all kinds of “AI” scripts against the images, aggressively searching for content that might benefit them financially, or might expose them to some legal liability. Also, I’m not very impressed by the supposed “abuse safeguards” cited. Those seem pretty weak. How difficult would it be, I wonder, to replace what is apparently a momentary activation switch with a “push on – push off” variety (or something more sophisticated), and connect a user-wearable battery to the power supply to enable continuous recording? My final observation is that some entity may be subsidizing the price @ $299. When my refractory prescription changed about 2 years ago, I was considering new Rayban frames of the classic “tortoise shell” variety long popular for sunglasses. I seem to recall that the frames alone were priced at nearly $250 (as an inveterate cheapskate, I had new lenses put into my existing frames…)
Clive Robinson • September 13, 2021 3:34 PM
@ JonKnowsNothing, ALL,
The bad news is the wrongful warrant is still active and has been petitioned to be withdrawn. Until the warrant is withdrawn the man faces a potential repetition of events.
What is the betting that it will be like the “no fly list” once you are on you don’t get off “just in case”…
Oh and a second bet, he has been already been pit on some “list” like the no fly list and he’s just going to get more problems down the line…
Of course it never will be anybodies fault if he tries to get justice, or god forbid next time they deep six him or people close to him.
It will all be the usual excuse of “Computer says”…
I’d like to say I’m overly pesermistic with respect to this sort of nonsense. But previous events show me as being almost wildly optimistic when it comes to people using computers not just as excuses but for petty revenge and similar (remember the man who’s wife went abroad to see relatives, then he put her on the no fly list… As it was easier than divorce).
Clive Robinson • September 13, 2021 4:00 PM
@ Freezing_in_Brazil, ALL,
Though I don’t see why high profile government secrets aren’t protected with nuclear TRNG.
Depends what you mean by “nuclear”…
Radio isotope generators have bias due to half life not just of the primary element, but others that contaminate it and the eventual “daughter products” etc.
These days people are using “Quantum TRNGs” that have gigabit output without bias[1]…
You can read up on QRBG’s,
Warning though it’s 40pages of close typed text followed bt 14 pages of refrences…
[1] Actually the output is biased, due to noise from the electronics… There is a “letter” that explains some of it,
CallMeLateForSupper • September 13, 2021 4:03 PM
FORCEDENTRY
NSO Group iMessage Zero-Click Exploit Captured in the Wild
Summary
While analyzing the phone of a Saudi activist infected with NSO Group’s Pegasus spyware, we discovered a zero-day zero-click exploit against iMessage. The exploit, which we call FORCEDENTRY, targets Apple’s image rendering library, and was effective against Apple iOS, MacOS and WatchOS devices.
We determined that the mercenary spyware company NSO Group used the vulnerability to remotely exploit and infect the latest Apple devices with the Pegasus spyware. We believe that FORCEDENTRY has been in use since at least February 2021.
The Citizen Lab disclosed the vulnerability and code to Apple, which has assigned the FORCEDENTRY vulnerability CVE-2021-30860 and describes the vulnerability as “processing a maliciously crafted PDF may lead to arbitrary code execution.”
Today, September 13th, Apple is releasing an update that patches CVE-2021-30860. We urge readers to immediately update all Apple devices.
SpaceLifeForm • September 13, 2021 4:07 PM
@ ALL
Silicon Turtles and Noctilucent Clouds
For security reasons, it may be best if you avoid BOTH Windows and any cloud.
There may be Intel Inside.
hxtps://unit42.paloaltonetworks.com/azure-container-instances/
Researchers named the vulnerability Azurescape – the first cross-account container takeover in the public cloud.
MarkH • September 13, 2021 4:22 PM
@Freezing_in_Brazil:
As far as I’m aware, smoke detectors and alarms using Am241 are still sold in the U.S. They’re still very simple in design and construction, and still get nearly “shelf life” from batteries.
The design of “chip” radioactive source miniature TRNGs is an ongoing area of development, but it’s a tough sell. They’re “hybrid” devices, much costlier to manufacture than pure electronics ICs.
And vendors today worry a lot about product disposal and recycling restrictions … in my industry, the pressure has been on for years to eliminate simple Lithium batteries.
Perhaps the main thing working against such TRNG chips is the likely low volume of demand.
Contrary to what Clive wrote, a properly designed radioactive TRNG has extraordinarily low bias, even with respect to source decay.
Clive and I argued this point months ago, with (as usual) neither persuading the other. So it goes!
SpaceLifeForm • September 13, 2021 5:29 PM
@ Clive, MarkH, Freezing_in_Brazil
The server clocks are accurate. Servers are definitely running NTP.
Anders • September 13, 2021 5:31 PM
@Who?
You are very welcome. Nice if you like it.
Yes, start is maybe slow, but things will
change starting from chapter 4,
“h3X’s Adventures in Networkland”.
And starting from part II things get
really interesting… 🙂
Anders • September 13, 2021 6:01 PM
@ALL
hxxps://tutanota.com/blog/posts/australia-surveillance-bill/
SpaceLifeForm • September 13, 2021 6:15 PM
@ FBI, ALL
Epik Fail
See what you can learn about security. You will find dots.
hxtps://www.twitter.com/chadloder/status/1437517323775086594
Anonymous has just announced a massive hack of Epik, long known as the hosting provider of choice for neonazis, right-wing extremists, and other Internet trash.
Anonymous are releasing a decade’s worth of detailed Epik customer & domain data, passwords, emails, and private keys.
SpaceLifeForm • September 13, 2021 6:42 PM
@ CallMeLateForSupper
The key point is, it’s not just phone. Desktop too. It is about backdoors.
How many other backdoors to be discovered?
Is the Panopticon purely transparent glass?
Anders • September 13, 2021 6:54 PM
@ALL
hxxps://www.intezer.com/blog/malware-analysis/vermilionstrike-reimplementation-cobaltstrike/
Clive Robinson • September 13, 2021 10:37 PM
@ SpaceLifeForm, ALL,
Researchers named the vulnerability Azurescape – The first cross-account container takeover in the public cloud.
Not realy…
Look at it this way,
Somebody walking in a field “trips, falls over, hits the ground, and breaks their neck”… So sad.
Years go by the field gets a road built on it, somebody walking down it one day “trips, falls over, hits the ground, and breaks their neck”.
Buildings put on the land that was once a field including a sky scraper. One day a person walking on the roof of the sky scraper “trips, falls over, hits the ground, and breaks their neck”. The newspaper says “First person to…” Yes they are the first person to do it off the roof of a sky scraper, but no they are in no way the first to “trip, fall over, hit the ground, and break their neck”.
So… This “Azurescape” might be the first “jail break” they know of on Microsoft Azure Cloud… But it is by no means the first “jail break” from a “restricted environment” not at all.
Go back and look at the history of “restricted environments”, say the history of *nix and why we have chroot. Also the history of web browser sand-boxes… Or even the hardware equivalent such as CPU “enclaves”. Oh and all other restricted environments we call “jails”, “sand-boxs” etc or we give other re-names such as “Virtual Machines”, “Containers”, etc.
The reality is “Escaping from a restricted environment” is almost as old as mankind. If you create a prison and put inmates inside, they will try and usually succeed to escape. What happens next is not exactly unknown either, call it “pay-back”.
It is an “old wine in a new bottle” effect, that is an “old crime” but in a “new environment”.
So not only is this attack entirely predictable, it was in fact predicted years ago before Cloud Services got going. Likewise it was predicted for Kubernetes amongst other Container Systems and oh so many other sandbox type jail systems that alow foreign code to run on a computer (look at the history of web browsers and javascript etc for an every user, every day, risk of exactly this type).
So…
1, Yes it was expected.
2, Yes similar has happened in the past repeatedly.
3, Yes as normal it used an old attack Microsoft had not fixed.
4, Yes we knew and know it is going to happen with all Cloud systems repeatedly.
5, Yes as per normal people did “stupid” to save pennies today.
6, Yes they did it without a sufficient “safety net” nor did they care.
7, Yes it’s going to make Cloud usage more expensive tommorow, again and again.
Can anyone realy say they are surprised by any of this?
So time to ask “What is all the noise about?” well,
1, State the bleeding obvious.
2, Hold Microsoft up to ridicule.
3, Push product.
The first two are obvious, the third well look for mention of “Prisma Cloud : by Palo Alto Networks”…
But seriously guys the real message is,
The CLOUD is not secure, NEVER was never can be with current knowledge.
But when you think about it, nor is the Cloud cheaper… You have no physical security you control with Cloud Computing. The only way we currently know how to make things secure against potential future vulnerabilities by outsiders is by strict segregation and issolation. Anyone telling you anything else is either not telling the truth, or effectively deluded. That is they are either “selling something” or do not understand security, nor do they understand humans, even with thousands of years of written history to learn from.
SpaceLifeForm • September 13, 2021 11:45 PM
Interesting cryptocurrency action
$317B on 9-11. Guess I’ll go to Walmart with my Litecoin.
hxtps://twitter.com/TRDXBT/status/1437472237951590402/photo/1
Clive Robinson • September 14, 2021 12:02 AM
@ MarkH, Freezing_in_Brazil, ALL,
Contrary to what Clive wrote, a properly designed radioactive TRNG has extraordinarily low bias, even with respect to source decay.
The bias is a simple fact of “the laws of nature” and you can not remove it, it’s one of the reasons for using entropy pools and crypto hashes to try to make it less detectable.
It has been found that nature does not do linear, nature works by percentages. The thing about percentages is you get exponential growth or decay, and it is this that gives you the “half life” in rather more than radio isorope decay.
The thing is that whilst 10% of what you have may decay in a time period “t” very reliably, the individual events are effectively unpredictable, so not determinable.
So all you know is that for a fixed quantity of starting radio isotope your detector will see the number of clicks in any given time period decrease thus get on average further appart.
If the radio isotope decays into stable elements then you could apply a correction factor based on measuring the number of counts in the previous time periods. The thing is as a general rule radio isotopes slide down a curve towards iron, however the half lives can be very different. Your detector can not tell you from which isotope individual counts come from, so you can not make a correction for it.
All you can do is make a guess, thus you are trying to correct unpredictable events that realy are not determinable. Your “correction” is a fully determanistic algorithm based on past averages. Thus it is determanistic psudo-noise you are adding to the source signal.
What ever else you might chose to call it two things can be said for it,
1, It is not in the slightest bit random.
2, It in no way removes bias, just moves it around predictably.
All it realy is, is a signal driven from a filtering function, that is not optimal.
SpaceLifeForm • September 14, 2021 12:07 AM
@ FBI, ALL
An example of the shady transactions on Bitcoin.
A wallet that has only had 2 transactions ever. One received, one sent.
Note the amount. This is major money laundering.
hxtps://www.blockchain.com/btc/address/32ZHZYwYATJj8jtoFvUQ9HEz7UoWnLgG5U
MarkH • September 14, 2021 12:18 AM
@Clive:
For an ionizing radiation TRNG, taking as raw data measurements of either (a) the number of detections per unit of time, or (b) the time interval between detections, gives highly biased numbers … even before one takes into account that the source activity will gradually decrease.
Such highly biased data sets require extensive conditioning, even if source decay is not considered.
As I wrote on this site about 10 months ago, “if a TRNG applies either of these methods to the detection of radioactive decay events, then the designer didn’t adequately understand the problem s/he was trying to solve.”
For a properly designed ionizing radiation TRNG, any residual bias is so microscopic that its raw numbers are of cryptographic quality without any conditioning.
Clive Robinson • September 14, 2021 1:30 AM
@ MarkH,
taking as raw data measurements of either (a) the number of detections per unit of time, or (b) the time interval between detections, gives highly biased numbers
“if a TRNG applies either of these methods to the detection of radioactive decay events, then the designer didn’t adequately understand the problem s/he was trying to solve.”
What other “raw data measurments” can they take with what they would be allowed?
Oh and that half life issue applies to all the processes involved with isotope decay in a realistic source.
SpaceLifeForm • September 14, 2021 1:46 AM
Ponzi, Inflation, and Bitcoin
Get in now, while you can still be a sucker.
Kidding. Use your spare cash, if any, to stock up on durable goods. It’s not looking good production and transportation wise for a year.
Think about things you may need 8 months from now, and ask yourself what you would do if they are not available. If you can find the goods, and can afford it now, you will actually be making money.
hxtps://www.youtube.com/watch?v=0AAUrMuMPlo
Mowmowfi • September 14, 2021 2:27 AM
@freezen
They use atomic decay as a accurate clock?..probably not good for RNG.
Calcium has a isotope at 36MeV if you get hydrogen and acerlate at 38MeV or a CW,Marx at 38MV quick enough so..more than the decay it makes a 20 year source that emits two electrons when it decays.
Energy in energy out, a AA battery that lasts 20 years, will need a hydro dam.
Clive Robinson • September 14, 2021 7:12 AM
@ SpaceLifeForm,
Think about things you may need 8 months from now, and ask yourself what you would do if they are not available.
That is not a call to be the “bum wipe king” for bears in the forest 😉
But yes two probs are going to hit at about the same time in the West,
1, The real economic down turn.
2, The supply chain issues.
It will be worse in the US because of certain policies from the executive level.
People need to start thinking like certain religions do and old pioners did,
Put by a years supply
Of non-perishable food, 2-5 years of tough working clothes and walking shoes, and hand tools and cookware to last a life time.
Of the food if you can put by food you would eat ordinarily but be heavy on the canned meat and on things like tinned fruit and what we call jam in the UK and I think you might call jelly in the US (fruit cooked in sugar to spread on bread). Find out how to “can” cheese and butter and double what you think you eat now oh and put by a good supply of longer lasting vegtable oil, you will need lots of it to cook with, especially if you start making all your food from basic ingredients.
Whilst you can survive on rice, beans, and potatoes you would not want to. But even they can be improved a lot with a good stock of spices, and remember that “Salt” was once the way people got paid for good reason. Oh start growing herbs in pots on your window ledges.
Learn how to make tea and coffee last and stay hot, large steel thermos flasks work well. If you put one tea bag in a 4pnt thermos and pour in boiling water one bag will be enough for the whole day.
If you like “milk” in your tea and cakes biscuits etc stock up on powdered milk as fresh may not be as easily available.
Food is going to get expensive so stocking up now is going to save you 20-30%. Knowing how to make bread, with and without yeast and pastry without eggs and not much butter/fat is essential. As is having access to about 4-6 ounces of meat or good protien a day. But… energy is also going to get expensive and at best unreliable. Look up “hay box” cooking of stews etc, it’s a form of slow cooking only without having to have a heating element running all the time. Also high capacity thermos flasks if they have a wide neck you can cook in them with just a kettle of boiling water.
But… Without power other things like household gas and water is going to get unreliable, as for petrol to put in your car… Think about getting yourself a fold up push bike and a back pack or if you’ve the space a full sized bike with panias etc, the larger the wheels the easier it is to ride. A friend has recently purchased an “electric fat bike” and charges the 50V cells via a couple of solar pannels on their balcony. OK they only get 15mph in the UK legally but with the “baby car” trailer has little trouble getting a weeks shopping in and getting it home, and they also use it for the over twenty mile journy to work.
But getting back to power… I’ve mentioned before that you can buy conversion kits to run generators off of bottled gas. Well they also run off of house gas and if you know how to make it “town gas” from gassification. In the UK the price per kWh for house gas and electricity actually makes it less expensive to generate your own electricity for things like running a washing machine or running an electric stove whilst also charging batteries and heating cold water to warm enough to have a shower/wash. There was a company making home CHP systems that ran of house gas / town gas, and they worked supprisingly well. However quite a few people in the energy industry got unhappy about it…
But…there is also the question of “water supply” no power often means no water… Whilst you can do “If it’s yellow let it mellow, if it’s brown flush it down” for the loo and Navy Showers from a watering can as a last resort (garden pump sprayers work better as campers will tell you) You still need a storage reservoir, that holds 45ltr/kg of water per person per day as a minimum for “carefull” living. The CDC recomends a US gallon of pottable water per person per day just for sustaining life (drinking / cooking very basic flannel/hand cloth wash). A flush of the toilet is two gallons, the average shower 20 gallons, as for washing clothes upto 40gallons per load in even modern machines but as little as 20gallons if you use the right programs, or if you use an older “top loader” 60gallons… Pre soaking of socks and underware in a half bucket of water over night could save you 10-20 gallons in the machine… Oh and stoping using certain types of deoderant will also save water in washing machines. You can with a little thought and behaviour such as knowing how to best load a machine, using a modern front loader get if down to 10 gallons or less which is better than most can do hand washing (you can not spin out dirty water as well by hand which makes the next step use more water)… Oh if you keep the water that comes out of the machine and add a little bleach and filter it, it is usually fine for flushing toilets and doing other basic cleaning tasks such as washing floors and even pre-soaking heavy duty cloths that have heavy soiling (you can even use it to water the garden but apparently it’s illegal in many places now).
But you need somewhere to store it all… which can be a bit of a problem. As a rough aproximation 1kg of food per person per day so a little over a 1/3 of a ton per person a year. Water well 3kg of pottable water per person per day just to stay alive… So in total 1-1.5 tons per person a year, that needs strong shelves and even stronger floors…
onyonf88 • September 14, 2021 9:45 AM
It appears ive been afforded a moment of peace, and so I have been hitting the books. In particular intro to applied cryto. The lesson im currently learning is block cipher DES. One of the questions I have that I cant seem to find a coherent answer for on my own, (at least one that I can make any sense out of) is in regards to the key function. The key being only 56 bits rather than the full 64. I was told 8 of the bits are for “parity” but are non-relevant to my understanding of breaking down how the key function works.
Is there anyone that is able to explain at a basic high level what parity bits are with respect to this key function? What exactly is happening under the hood?
Who? • September 14, 2021 9:48 AM
@ Anders
Thanks!
This book is like the PoC||GTFO issues. I had been reading them for years, and like them a lot. Now that NoStarch Press has released them in “dead tree” format I got the three volumes as they become available. It is nice having these issues in both PDFs (in the case of PoC “polyglot PDFs”) and physical format. I like buying good books for my library.
Stealing the Network is a valuable item for this library.
Winter • September 14, 2021 9:58 AM
@Clive, SLF
“1, The real economic down turn.
2, The supply chain issues.”
First, in a densely populated region, e.g., USA East coast, Bay Area, NW Europe etc, where you have 50-100 M people in a small area, you can forget the prepping stuff. You will not have room to stock up a year worth of supplies for your family. And if you did, you would be unable to keep hold of it when millions of people are adrift.
But why think about economic collapse? The USA is heading towards a civil war. It is not inevitable, but a section of the GOP wants it dearly. But nothing like that elsewhere. Not within 12 months at least. For the rest, things are starting to run again.
There are supply chain problems, indeed. But there is no imminent collapse brewing. Oil and gas are running, food is shipping, ships are sailing. Nothing indicated thiswill stop within 12 months. Certainly, European and Asian governments give no signs of planning to stop this any time soon.
So why should everything collapse worldwide?
Sut Vachz • September 14, 2021 11:44 AM
@ Winter
Re: a section of the GOP wants it
Even if that were so, it would go nowhere by itself. Reviewing the actual actions of both major parties over many decades, perhaps 100 years, the most likely hypothesis is that they work in concert and any opposition is only superficial, ad captum vulgi as it used to be termed. The same thing has been true in English politics for at least as long.
Clive Robinson • September 14, 2021 12:01 PM
@ onyonf88,
What exactly is happening under the hood?
Two things to consider,
1, Parity was frequently set to zero for compatability with serial comms that would be seven not 8 bits.
2, 8bits less made the NSA job 256 times easier.
Whilst both are true, one was an excuse for the other…
MarkH • September 14, 2021 1:19 PM
@onyonf88:
To respond directly to your question, if by key function you mean the key scheduling algorithm — the so-called parity bits play no part. They are discarded, and their values have no effect on key scheduling.
@Clive:
To your question from last night, I submitted a fairly detailed reply which, I was informed, was awaiting moderation. Perhaps it’s still waiting …
Freezing_in_Brazil • September 14, 2021 3:04 PM
@ MarkH, Clive Robinson, All
Thanks for the feedback, considerations and references.
Clive, where it reads ‘nuclear’ I meant radioactive.
MarkH, good to know that there are actually people working on a random number generator chip. I am an enthusiast of the endeavor, although I am aware of Bruce’s lack of enthusiasm for the idea [in line with Clive’s arguments in #388417]. I would imagine, as you say, that a very well done marketing job would be needed to bring such a product to market. There must also be legal issues. I believe it is possible to establish a satisfactory disposal regime.
But still I wonder why radioactivity is not used, at least to generate TRN for high state secrets protection.
@ SpaceLifeForm
Thanks for your feedback, observations.
SpaceLifeForm • September 14, 2021 3:45 PM
@ Winter, Clive
Supply Chain problems
I do not see major collapse. What I see is durable goods being in short supply.
The economy will function, but prices will go up for in-demand goods. The market will adjust, and suppliers will supply the in-demand goods at a price.
The durable goods will not get priority.
For example, see if you can easily find a new refrigerator/freezer. Supply chain. Hard to spot buy one. Delivery may be weeks.
Container ships are getting backed up at port, because there is not enough people. Then, even once the container is off-loaded from the ship, there are not enough truck drivers around.
The non-durable goods are getting more expensive by the day, which really impacts the poor.
Durable, non-perishable goods in a container are not going to get priority for delivery by truck.
What I am saying is, if you know that your refrigerator/freezer is near EOL, best to start the process sooner than later.
If you have no redundancy (second refrigerator/freezer), and it fails, you will not like the situation.
SpaceLifeForm • September 14, 2021 4:02 PM
Chromium V8 zero-days
My recommended fix is to use FireFox.
hxtps://thehackernews.com/2021/09/update-google-chrome-to-patch-2-new.html
someone • September 14, 2021 4:35 PM
@Clive re: generator conversion Yes, that can be done, but you make it seem more trivial than it actually is. I have a small Yamaha genny set-up for liquid propane (bottled gas). It will also run on pump gasoline, and presumably on natural gas (house gas) as well. However, the energy content per volume unit of those fuels differ considerably, and the ideal carburetor jetting will significantly differ, one from the other. While I can switch back and forth between pump gasoline and LP on my generator, it does not run nearly as well on gasoline, and tends to foul spark plugs because it is jetted for LP. You also wrote of “gasification”, was that in reference to “wood gas”, aka “producer gas”? That product is the result of destructive distillation (cracking) of wood chips (and potentially some other botanical substances) under temperatures not quite high enough to acheive open flame combustion. The end products are charcoal (this is similar to the commercial moanufacturing process for that commodity) and so-called wood gas, which is combustible for a number of purposes, including running an IC engine. In fact FEMA has (or used to have, anyway) freely available plans to construct a producer gas generator capable of fueling an IC engine of approximately 25 – 30 HP. However, again there is a bit of devilment in the details: producer gas is a mix of various volitiles, many of which are toxic and/or highly corrosive. At minimum, using it to fuel any modern engine designed to run on pump gasoline would require a very good filter to removesome of the more vile condensates, else that engine wouldn’t last too long.
someone • September 14, 2021 4:43 PM
@Winter re: prepping You might consider that civil war and economic collapse are anything but mutually exclusive. I’m lucky enough to have a remote, off-grid, location with “somewhat inconvenient” access that I couuld utilize in a true SHTF situation. I also have the means to defend it; certainly not against any kind well-organized military-grade attack, but probably well enough to make an opportunistic marauder or three keep moving in search of easier prey.
someone • September 14, 2021 4:52 PM
@SLF re: Chromium V8 zero days – Your subject states “chromium” but the linked vuln page mentions only “Chrome”. Do you know for certain that it also impacts chromium? I’ve j=ust spent a good bit of time locking down a recent install of ungoogled chromium, I would hope all that work wasn’t in vain.
SpaceLifeForm • September 14, 2021 5:20 PM
@ someone, ALL
It is all Chromium based browsers because the problems are in the V8 Javascript engine. Even Edge on Windows.
It is not clear that this specific Spook.js problem was actually addressed yet.
Silicon Turtles can be hard to spot in the wild.
hxtps://therecord.media/new-cpu-side-channel-attack-takes-aim-at-chromes-site-isolation-feature/amp/
A team of academics from universities in Australia, Israel, and the US has successfully mounted CPU side-channel attacks that recover data from Google Chrome and Chromium-based browsers protected by the Site Isolation feature.
…
Named Spook.js, the discovery is related to the Meltdown and Spectre attacks disclosed in January 2018, two CPU design flaws that could allow malicious code running on a processor to retrieve data from other apps or from secure areas of a CPU.
Clive Robinson • September 14, 2021 5:29 PM
@ Someone,
Re gas/gasoline and IC engines.
Yes you need to change the carb settings amongst other things. The point I was making though is that few people appear to know that an IC will work on a whole host of fuels from “cracked water” through most light hydrocarbons right through cracked long chain hydrocarbons. I’ve demonstrated an IC running of cracked 2lt Cola bottles.
Yes filtering is important. However again few appear to know what is mainly being filtered out is uncracked hydrocarbons. So pick the right filter materials and the filters after condensing out the partially cracked long chain hydrocatbons that are in effect tars, go back into the process. This was something well known in the 1800’s with extracting lamp oil etc from peat bog material. Idealy you want the IC to run off of cold hydrogen gas but CO and light hydrocarbons all work well enough.
Then of course there is “Bio-digester” gas and wood alcohol that IC engines can run off.
However if you need to use a very wide ranges of fuels the likes of Stirling Engines become of interest, but a large pond is needed if you want to get the best of them.
Cracking fuels especialy wood lignum is an interesting and absorbing topic in it’s own right, but probably not for a lot of readers here. It’s known that during WWII a lot of Gernan industrial processors had go the cracking of various hydrocarbons down to a fairly fine art. However the information “disappeared” as US interests took such companies over… Why is not known which is why some conspiracy theorists love talking about it, and I try to avoid it, so tend not to mention cracking in the ways I once did.
Clive Robinson • September 14, 2021 5:48 PM
@ Winter, someone, SpaceLifeForm, ALL,
The problem is supply chains.
What people tend to forget is that behind the supply chain they are interested in there are several others. Whilst it is not turtles all the way down it can take a very very long time to get them all running again. 18-36 months would not be uncomon and if a mine or oil well etc had been closed down it might take 60-300 months to get things back, if at all.
Whilst it might not sound bad, the recent lack of chips for high end cars is going to be very minor to somethings that could happen.
Simple drugs we are very dependent on in the first world and are in the UN 200 list, are made in India but some of the feed-stock India needs comes from the US which did get it’s feedstock from China, which got some of it from Africa… Only politics screwed that one up at several points…
It’s things like that you need to be very aware of but very few, even who are involved in the supply chain get to realise it untill it goes pear shapped rather rapidly, and stays that way for several seasons.
Keep an eye on “flu vaccine” this year, it could be heading for the rocks, unless some people get their acts together rather rapidly.
So you might want to consider carrying on being a serious “mask wearer” for the next year or two.
Anders • September 14, 2021 5:49 PM
On summer here was an incident when attacker downloaded
Identity card photos from the database.
hxxps://therecord.media/estonia-says-a-hacker-downloaded-286000-id-photos-from-government-database/
Today was sequel to this news.
Now we know the attacker name. He found two more critical vulnerabilities in government systems and asked monetary
reward for them, since government stalled here he started
threatening to disclosure info in hacker forums and put
photos on sale in the dark web.
Sorry, news article is so far only in Estonian and half
behind the paywall – only introduction is readable.
hxxps://ekspress.delfi.ee/artikkel/94584269/kurikuulus-hakker-ahvardab-riiki-id-kaartide-fotod-lahevad-tumeveebi-seniteadmata-turvaaukude-info-hakkerite-foorumitesse
JonKnowsNothing • September 14, 2021 6:19 PM
@ SpaceLifeForm, Winter, Clive
re: Supply Chain problems … I do not see major collapse.
Recent reports of the failure of the wheat harvest in Canada and failure of other harvests around the globe might made a dent in that view.
Failed harvests are not uncommon often affecting a local economy and the short fall made up from other suppliers. The loss of 50% of the Canadian Wheat harvest is not going to be made up easily.
The supply chain for Canadian Wheat runs from Canada to Italy to UK. Semolina Pasta is expected to rise 2x or more.
UK is has been yammering for some time about “there will be No Holiday Turkeys”, officially because of the supply chain (Brexit) but traced back to the mass slaughter of farm animals due to Slaughter House COVID and culls of all types of birds due to global viral infections.
The Romans knew to keep the population in Rome fed, as did the Pharaohs. Bread and onions are a day’s labor pay. When the onions ran out and the kohl delivery got missed, the pyramids stopped too.
SpaceLifeForm • September 14, 2021 6:20 PM
Click Here to Kill Everybody
Are you sophisticated enough to recognize an Internet scam?
hxtps://www.mediamatters.org/qanon-conspiracy-theory/multiple-qanon-influencers-are-using-paypal-raise-funds-despite-platforms
https://www.schneier.com/essays/archives/2003/12/are_you_sophisticate.html
SpaceLifeForm • September 14, 2021 6:42 PM
@ JonKnowsNothing, Winter, Clive, ALL
Excellent point
I was not connecting all of the dots when I wrote that. Mea Culpa.
There is a lot of things happening, and Mother Nature is just a Honey Badger.
The planet does not care about any one.
SpaceLifeForm • September 14, 2021 9:37 PM
Silicon Turtles
No details, only the Evil Maid knows for sure.
But, my top guess is USB.
hxtps://msrc.microsoft.com/update-guide/vulnerability/CVE-2021-38632
A successful attacker could bypass the BitLocker Device Encryption feature on the system storage device. An attacker with physical access to a powered off system could exploit this vulnerability to gain access to encrypted data.
SpaceLifeForm • September 15, 2021 12:04 AM
Old man yells at clouds while just shaking head
OMIGOD
hxtps://www.wiz.io/blog/secret-agent-exposes-azure-customers-to-unauthorized-code-execution
Remove the auth header and you are root!
This is a textbook RCE vulnerability that you would expect to see in the 90’s – it’s highly unusual to have one crop up in 2021 that can expose millions of endpoints. With a single packet, an attacker can become root on a remote machine by simply removing the authentication header. It’s that simple.
Thanks to the combination of a simple conditional statement coding mistake and an uninitialized auth struct, any request without an Authorization header has its privileges default to uid=0, gid=0, which is root.
Clive Robinson • September 15, 2021 4:06 AM
@ SpaceLifeForm, ALL,
Silicon Turtles can be hard to spot in the wild.
It does not help when people deliberatly put holes in the net to stop you catching them,
“Spook.js exploits this hole in the Site Isolation design, which apparently Google knows, but about which it also can’t do anything about, since separating JavaScript code at the subdomain level would also cripple about 13.4% of all internet sites.”
My view is Google should give those 13.4% of sites, “due warning” and in 30days at the most issue a new,set of patches to close this hole.
Clive Robinson • September 15, 2021 4:51 AM
@ JonKnowsNothing, someone, SpaceLifeForm, Winter, ALL,
Recent reports of the failure of the wheat harvest in Canada and failure of other harvests around the globe might made a dent in that view.
The big problem with the Canadian wheat, is also it is the “type of wheat” that makes it even more critical[1]. People are often very surprised at just how many types of grain there are, and that it was one of mankinds first “genetic modification” experiments thousands of years ago, and that the instances of serious food intolerance to grains is one of the highest of all foods (asside from perhaps cassava which has high quantaties of cyanide in it).
North American wheat is “hard wheat” and high in protien complexes that give your “light fluffy white loaf” it’s bounce, it also gives noodles/pasta the ability to be worked into long strands.
It’s why when you buy flour you have different labels on packets, consumer flours are actually blended from different flours to give characteristics that are desirable in one type of baking (say bread) but not in others (say pastry or cakes). So in the supermarket you see “bread flour” which has a higher concentration of hard wheat in it[2].
As I’ve noted above and in the past there are supply chains behind supply chains and in most cases very few people know anything about those supply chains they do not directly see.
If you are an “investor” type of person, knowing “who supplies who and why” can make you very wealthy, or atleast not striped butt naked on public display as a “rube”.
[1] https://www.glnc.org.au/grains/types-of-grains/wheat/
[2] One thing that occasionaly brings a wry smile to my face is “let them eat cake”. Firstly because it was never said by the lady it was attributed to, secondly it shows the ignorance of the person saying it about the type of wheats and flours. Something that even the ancient Romans knew, at the most senior of political levels, and was one of the reasons they invaded what most now call England… Oh and invading Egypt and getting control of the wheat supply there was a sure way to bring Rome to heal… Lessons from history 😉
Clive Robinson • September 15, 2021 5:15 AM
@ SpaceLifeForm,
There is a lot of things happening, and Mother Nature is just a Honey Badger.
Hey don’t knock “Stoffle” he was only doing what all prisoners aim to do 😉
https://www.youtube.com/watch?v=c36UNSoJenI
Oh the first words you hear are about Stoffle beinng hurt by a lion. What is not said is Stoffle started the fight… and it’s a rare lion that wins.
Needles to say Stoffle has become a bit of an Internet celebrity.
Clive Robinson • September 15, 2021 6:15 AM
@ SpaceLifeForm, ALL,
No details, only the Evil Maid knows for sure.
My guess is what ever the hardware interface is, it is likely to be a pre-boot attack of some form.
The roots of which go back to the earliest days of the Apple ][ design back in the mid 1970’s…
Which is why there is a hardware I/O driver hole that alows a totaly untrusted piece of hardware with a ROM on it to have unchecked code loaded into memoey, which then get linked in to the OS as it boots…
It’s a security vulnerability made in DarkNet Heaven but for very good reasons… But because it’s been built in at a fundemental level, getting all of it out is not going to happen for years, if it happens at all.
@ ALL,
Mad as it might sound to people there is a reason for such a gaping security hole, and it is for the likes of new boot devices.
Your motherboard Firmware ROM marks a point in time, so at first sight it would appear not to be able to use new technology that came after that date. This was a known problem with computers, that used to mean that to take advantage of new hardware ment your motherboard manufacturer coding support in for it and sending out new ROMs[1]. However ROMs were very very expensive per byte and even 2kByte ROMs would at one point cost more than the average person earned in a month…
Apple hit this problem with the Apple I and thus independently came up with the solution they put in the Apple ][. This in turn got picked up by IBM’s skunk works project that produced the IBM-PC, the rest they say is history and in many ways it is a problem that is still with us today and will be for the foreseeable future.
The solution that Apple came up with is the IO device has a ROM with the required code on it. As the BIOS brings the system up from hard reset after POST, the BIOS looks for IO code ROMs and if found maps the code into RAM, then links it into the IO code “jump table” so the code from the ROM runs before any Motherboard ROM IO routiens do. So the hardware is then functional to the BIOS that then looks for “boot devices” to load the OS from. If there is a boot device, then obviously the same “lack of code” issue for it applies to the OS as well. So most OSs –but not all– respect the code loaded from the IO device ROM into RAM and carry it forward for the OS to use.
Obviously this makes it the most trusted code to a standard OS… but compleatly unauthenticated which makes it a very serious security vulnerability.
Since BadBIOS and Lenovo’s little perma-malware trick there have been so-so attempts to close this hole, but as it’s a major legacy issue, you can guess just how far it has gone in reality.
So I fully expect there to be problems around this hole in atleast the next half to decade and a halfs time, maybe longer.
The “obvious solution” which is “code signing” of such IO ROM code is actually a very bad idea for many reasons. Two of which are,
1, Code signing is junk-science.
2, It brings back lock-in.
For years I’ve been waving a red flag about “code signing” and how we need to come up with a way better solution, maybe since “Solar..”. But Stuxnet did not so…
But I’m not even sure anyone is realy working on the issue due to more fundemental security problems we see with the likes of CA systems to do with “roots of trust”. Oh and the fact “Quantum-Computing” will –if it ever happens– break public key systems (yes it will cause them problems but nothing doubling the key bit length won’t solve in the near term).
But code signing is also another form of “vendor-lock-in” but more at the OS end these days. Which is why we see the likes of Apple and Google with their “walled garden” app stores that do not do what they promised (make code “safe” and malware free for users).
[1] This used to happen a lot, and systems manufacturers went out of their way to avoid doing anything about it as it was a great revenue earner via “lock-in”.
someone • September 15, 2021 11:18 AM
@SLF re: chromium V8 vuln So, Google requires a Google account log-in just to read the report detail that resulted in the CVE listings? Disgusting. I really do despise Google, way beyond my hate for MS at this point… Since I have JS disabled in unGc by default, and only switch it on in the relatively rare event that I really need to read a page and it won’t render at all without it, hopefully I’m not at too bad risk. As an aside, I have found that there are quite a few sites that attempt to enforce a JS requirement (and whose developers no doubt think that they have done so) where the content may be read by using Reader View…
Clive Robinson • September 15, 2021 1:21 PM
@ someone,
I really do despise Google, way beyond my hate for MS at this point…
Only because you can see them…
There are others like Palantir that are a whole magnitude worse. But because they are not as it were “in your face all the time” as Microsoft (Windows) and Google (Browser) are you do not realise they are worse way way worse than Facebook and Cambridge Anylitica were a little while ago.
Sut Vachz • September 15, 2021 3:07 PM
The wheels on the “bus” go round and round …
https://spectrum.ieee.org/the-scandalous-history-of-the-last-rotor-cipher-machine
SpaceLifeForm • September 15, 2021 4:49 PM
OMIGOD
Looks like Microsoft has fixed as of recent hours.
Bet someone is not happy their backdoor was burned.
Until a few hours ago, it was a one line curl command to get root remotely into a Azure Linux VM.
hxtps://www.twitter.com/GossiTheDog/status/1438090108834562054of
SpaceLifeForm • September 15, 2021 5:36 PM
Silicon Turtles
hxtps://www.trendmicro.com/en_us/research/21/i/analyzing-pegasus-spywares-zero-click-iphone-exploit-forcedentry.html
ForcedEntry’s key point is the exploit technology as it is still unknown how it is able to bypass the PAC and disable ASLR.
lurker • September 15, 2021 7:22 PM
@SpaceLifeForm: forced entry?
Nah, not when the vendor allows the use of heavy weapons like PSD & PDF in its “messaging” app. People have forgotten the meaning of the first S in SMS.
Clive Robinson • September 15, 2021 11:07 PM
@ SpaceLifeForm,
No details, only the Evil Maid knows for sure.
A funny thing happened on the way to the…
Instead of providing what should be a simple page of text detailing the “bug” the “Microsoft Resource Center” link you gave blows up on my browser and instead gives a,
“Something went wrong!“
Page… With a couple of unhelpfull buttons
But… At the bottom a box with a diagnostic contained within of,
“SecurityError: Failed to read the ‘localStorage’ property from ‘Window’: Access is denied for this document.”
Which made me smile because some “turnipseed at MS” has it ‘arse-about-face'[1] The reason it is happening is a security violation attempt by Microsoft…
[1] At times English can be such a picturesque language 😉
SpaceLifeForm • September 16, 2021 12:32 AM
@ name.withheld.for.obvious.reasons
hxtps://www.aclu.org/press-releases/federal-appeals-court-dismisses-wikimedias-challenge-nsa-internet-surveillance
Clive Robinson • September 16, 2021 12:49 AM
@ SpaceLifeForm, ALL,
Looks like Microsoft has fixed as of recent hours.
The twitter link you gave is broken…
To fix remove the mysterious “of” that got on the end of the URL and get,
https://www.twitter.com/GossiTheDog/status/1438090108834562054
A thought for you, I’ve just noticed that tail number is 19 digits long, Which aproximates to a 64bit number… What is the betting it’s not TRNG generated, but fully determanistic like a non crypto hash of a counter? I’d say fairly good, which then raises “What is the betting it’s “home grown” and probably insecure?
Clive Robinson • September 16, 2021 1:04 AM
@ SpaceLifeForm,
ForcedEntry’s key point is the exploit technology as it is still unknown how it is able to bypass the PAC and disable ASLR.
The thing about ASLR is you may not have to disable it. The “R” may not be very good, or atleast easily predictable.
Obviously as a developer of an OS you want the algorithm for “R” to be very small and very fast. The simplest “R” algorithm you could use would be,
Randn+1 = Randn + Const
And a developer might be tempted, even though it’s about as secure as wet tissue paper.
You would need access to the source code to know what the actual “R” algorithm is, but that access does not have to be first hand…
SpaceLifeForm • September 16, 2021 1:49 AM
@ Clive
The msrc link about CVE-2021-38632 had no details. I copied the only line of note. There were absolutely no details, no more useful information. It was of note to me that Microsoft actually acknowledged it. What you encountered, definitely interesting.
Not sure how I got the ‘of’ appended to the gossi link. But, yes, I suspect it is not random at all.
@ lurker
What? Are you saying that it does not mean Secret Malware Service?
SpaceLifeForm • September 16, 2021 2:11 AM
Silicon Turtles
iTimed: Cache Attacks on the Apple A10 Fusion SoC
Researchers Develop Toolkit to Test Apple Security, Find Vulnerability
hxtps://news.ncsu.edu/2021/09/hardware-security-toolkit-itimed/
SpaceLifeForm • September 16, 2021 2:30 AM
Door number 3, for the goat!
CVE-2021-40444
hxtps://www.riskiq.com/blog/external-threat-management/wizard-spider-windows-0day-exploit/
Clive Robinson • September 16, 2021 6:23 AM
@ SpaceLifeForm, ALL,
Researchers Develop Toolkit to Test Apple Security, Find Vulnerability
Handy as Apple hide so much by lifting the corner of the chip and untill now fairly deftly sweeping it under out of sight…
Which means that things as embarrassing as,
<
blockquote>“can reduce the security of OpenSSL AES-128 by 50 more bits than a straightforward adaptation of PRIME+PROBE, while requiring only half as many side channel measurement traces”
<
blockquote>
Suddenly find the astringent sun light falling upon them.
Would be interesting to be a fly on the wall in the next engineering team managment meeting…
@ ALL,
Before some one chimes in I’m being unkind to the all hallowed St xxx of Apple or some such nonsense, I’ll point out I’ve been none to kind on Intel, AMD, ARM and others over “silicon cods-ups” in their designs. Nearly all of which can be traced back to moronic marketing choices for “Specmanship”.
Lets be honest the Intel IaX86 has roots all the way back to the very early 1970’s and each flip and flop Intel made to get that extra fraction has legacy issues, primarily heating the room being the one most users notice. As for ARM they have done some surprising stuff, but they to have legacy issues.
No doubt the Open Source CPU designs will, given half a decade, start building up legacy kruft.
The real question is how best to get rid of kruft as fast as possible, without breaking stuff… No doubt there will be more than one or two PhD’s in answering that not so little problem.
But from my point of view people have been sitting on their thumbs for more than a quater of a century. That’s a quater of a century lost, so it’s about time they actually shifted them…
WhiskersInMenlo • September 16, 2021 2:18 PM
I was watching a recent MSNBC segment on the Rachel Maddow show.
The breaking news was that a now public report indicated “ping” traffic between the soviets and a Trump server. I got the impression that “ping” and “ICMP ping” distinctions were not grocked by the staff that wrote the bit.
I could not tell if this was ICMP ping packets but ping allows ICMP payload
(optional). A modified ping pair could be used to infiltrate or exfiltrate data. In general ICMP traffic is ignorable but for corporate and national secrecy issues it should not be ignored.
Other signaling methods can involve http requests that would be easy to find in logs… https[:]pickA.site/…/archives/keyThree0x2hhh8566934a1b2c3d4e5f6
Https hides and sufficiently encrypts the epemeral key that is used once to decrypt exfiltrated data.
WebServer Log file looks like:
10.0.42.144 – – [16/Sep/2021:12:05:48 -0700] “GET /favicon.ico HTTP/1.1” 404 526 “https://benind.nat/archives/keyThree0x2hhh8566934a1b2c3d4e5f6”
ICMP packets can contain time of day data so state need not be kept. Time of day can have a slow but interesting data rate simply with timing. mark and space being odd and even seconds as additional knock-knock codes. or short XOR patterns to add a layer of key space management.
SpaceLifeForm • September 16, 2021 2:33 PM
EPIKFAIL is an accurate name
FBI and others are drooling
This will provide numerous dots to Jan 6.
hxtps://www.dailydot.com/debug/epik-hack-far-right-sites-anonymous/?amp
The engineer pointed the Daily Dot to what they described as Epik’s “entire primary database,” which contains hosting account usernames and passwords, SSH keys, and even some credit card numbers—all stored in plaintext.
The data also includes Auth-Codes, passcodes that are needed to transfer a domain name between registrars. The engineer stated that with all the data in the leak, which also included admin passwords for WordPress logins, any attacker could easily take over the websites of countless Epik customers.
SpaceLifeForm • September 16, 2021 3:12 PM
EPIKFAIL
Some history can be found at this link
hxtps://malcontentment.com/anonymous-hack-of-epik-releases-reveals-a-devastating-amount-of-information/?amp
An examination of the Epik Software data released by Anonymous has security experts concluding the claims made by the shadowy organization are true, and it will be a devastating blow. “This is the Panama Papers for hate groups,” a researcher told us after reviewing just part of the 180GB of information retrieved. “In all my years, I have never seen a breach of a domain registrar to this scale. The lack of security to protect this information is breathtaking.”
Clive Robinson • September 16, 2021 3:34 PM
@ WhiskersInMenlo, ALL,
The breaking news was that a now public report indicated “ping” traffic between the soviets and a Trump server.
You would think that both sides of that would know better… But hey the world goes round.
A couple of questions arise though,
1, Which Trump Server?
2, Which way the traffic was realy going?
The server may not have had anything of use to anyone on it. That is it could have just been an Internet version of a billboard, puffing up the blowdry image.
Determining what the actual Internet traffic was, and which way information if any was flowing, is going to be a much harder task to work out…
Firstly one of the issues is the term “ping” may not mean anything at all.
We sometimes use it in a “Knowledge Domain” specific way, and sometimes in a much looser way[1], so context is important. Something a non domain specialist journalist may not be aware of, further by the time it’s been mauled by editors with political bias it could mean anything or nothing.
As you note there are many ways to modulate a carrier such as an Internet packet. Some involve the data within the packet and some the time / phase of the packet to some unknown to others time / frequency reference.
I’ve come up with probably more than my fair share of systems that have subliminal / covert channels within channels a few of which I’ve mentioned in the past.
The important thing to note though is,
Where redundancy exists communications can take advantage of it to send information both overtly and covertly.
In fact the only three questions of interest to an engineer designing a communications system are,
1, How overt/covert?
2, How reliable?
3, What bandwidth?
The rest follows on from the answers to those questions, and sometimes some engineering or legislative constraints.
Oh and remember the “equiprobable proof” that defines the secrecy model of the One Time Pad? Well it defines on heck of a lot more than just that. But it means in this case, if the designer was upto the task and the specification called for it we will unless someone talks never know what actual information flowed or why.
[1] Ping was a very generic term befor the Internet or it’s forebares existed, one meaning was to in effect say you hit a bell or gong just once as opposed to repeatedly. When the electromagnetic coil became established[2] it was used to strike a bell remotely as a form of primative communications system. Thus “ping” became “pinger” the bell device was named. In the early days of telex systems a “ping” was in effect an alarm bell to alert an operator to an incoming message. Something that remained in the ASCII control set as “Bell”. It was only later when a utility to detect remote hosts was required that “ping” got used to name it. But it has moved on sending an SMS in generic parlance is also called “give them a ping” which very recently got changed in meaning again in the public eye with a bad COVID alerting system alerting every one in what somebody named a “Ping-Storm”. So no doubt by the end of next week or the month after there will be anorher use for “ping” as a name.
[2] The early use of the electromagnetic coil or solenoid was to say somewhat odd looking back. In fact our main use of it these days in electromechanics is as an “amplifing switch” named a Relay originally called that because it replaced a human “relaying” telegraphist whose job was to receive a message of one cable and resend it on another. This was a way later development than many other uses such as controling electric arc lights.
Clive Robinson • September 16, 2021 3:59 PM
@ SpaceLifeForm, ALL,
“An examination of the Epik Software data released by Anonymous has security experts concluding the claims made by the shadowy organization are true, and it will be a devastating blow.”
But what sort of blow?
1, Existential
2, Evolutionary
Sadly I do not think this will be “existential” for the majority of far right extremists / nutbars. Whilst some may end up in jail formenting further hate, I suspect the majority will end up on some usless watch list.
What I suspect will happen is that some of the smarter or more cautious of extremists will learn from any cull that might arise. They will then simply “evolve” to a more secure system.
How much more secure is yet to be seen. However a lesson from the criminal side of communications and that recent US-Australian tie up to create a fake secure phone network to catch drug dealers and the like.
If someone is an extremist or just has unpopular views with regards to those who have some form of authority. The old saying of,
“Never look a gift horse in the mouth”
Certainly does not apply, in fact the exact opposit. Just because somebody you are “aquainted” with thinks some system is “better than sliced bread”, dors not mean,
1, They are right.
2, They are not betraying you.
Whilst,
“There is no honour amongst thieves”
Certainly does apply, it’s not just thieves that like the sight and sound of silver. Remember the Bible has a few choice words about “Fourty Pieces of Silver” as the price for hanging someone out to dry. Oh and some would turn people in just for a lot lot less.
Remember in the US the justice system is reliant on “Who turns the other in gets the best deal”. So justice is actually rarely done… As the one who can talk the most is usually the worst offender.
WhiskersInMenlo • September 16, 2021 8:03 PM
@Clive Robinson
…yes exactly..
I was listening to “breaking news” and my head exploded with possibilities.
There is coordination going on and for a multitude of reasons has yet to be sorted. A couple altered binary packages could go unnoticed. As a tool kit used by a handful there is a lot of power if only FUD generation.
Old school verbal in person is still useful but slow. Today trouble is accelerated. Command and control of trouble is hard to prove.
Mowmowfi • September 17, 2021 12:17 AM
@all
I need to sort my shit out, but agree with you.
MarkH • September 17, 2021 11:07 AM
@Freezing_in_Brazil, Clive:
For radioisotope TRNGs, the correct measurement scheme is to strobe a free running high-frequency counter when an ionizing emission is detected, and to use some of its less significant bits as the raw random data.
If (a) the detector hardware is carefully designed to limit influences which could skew its output edge to less than one clock cycle, and (b) the wrap-around time for the modular counter is small compared to the mean time between detections, then the raw data are sufficiently free from bias that they can be used for cryptographic random numbers without any post-conditioning.
Weakening of the radioactive source over time will slightly reduce the raw bit generation rate, but add no bias to the numbers.
MarkH • September 17, 2021 11:18 AM
@Freezing_in_Brazil:
I suppose it very likely that radioisotope TRNGs are is use for critical applications.
Even so, that’s a tiny market, for very specialized gadgets which are probably sold at high prices.
Depending on jurisdiction, there may be legal impediments, but ionization smoke detectors are still in mass production, as far as I’m aware.
From my work experience, manufacturers prefer not to include hazardous materials in their products because their already complicated life gets even more complicated.
Clive Robinson • September 17, 2021 12:35 PM
@ MarkH, Freezing_in_Brazil,
the correct measurement scheme is to strobe a free running high-frequency counter when an ionizing emission is detected, and to use some of its less significant bits as the raw random data.
That is not a “raw source measurment”
What it is is a time based measurment called a roulette / stroboscopic measurment.
As I’ve explained in depth in the past such systems do not measure what many think they do.
You can regard the partical detector output as an oscillator in it’s own right being used as a sampling gate signal.
The result is that as with a sampling down converter in a radio the output is in effect the difference frequency between the two oscillators. It may look random close in on an oscilloscope but if you observe it correctly you can see the sinusoidal components.
Fdiff = Fosc – Fdet
Obviously you can rearange that to come up with a time formular using the time differences from edge to edge timing.
Two points to note,
1, The average time between detector outputs still follows the half life curve.
2, The “free runing oscillator” rarely is free.
To see the effect 1 has, imagine the oscilator is of very high stability. Between each partical detector edge the average count of the oscillators cycles goes up with the decreasing half life curve. If you do not correct for that you end up with a sawtooth signal superimposed on the count. Obviously a sawtooth waveform has a harmonic content of phase related sinusoidal waves.
The problem with 2 has long been known as it was seen with pedulums on a shared beam or surface sychronising. In electronics it is known where the effect is intended as “a loose locked oscillator”. The most common form used to be when analogue was king, the colour burst signal in colour TVs and the stereo signal in FM radio stations.
Unless exceptional care is taken the oscillator will loosely lock to power supply noise, EM fields, and even the rise and fall of the temprature in the case, be it from the room AC or sunlight through a window on the instrument case. Then there are the effects of “microphonics” where either the turns in the inductor move or the plates in the capacitor move under the influance of mechanical vibration that is conducted through the instrument case or radiated as acoustic energy. Whilst all of these signals are chaotic they are still mainly determanistic not random. Worse many of them can be induced by an attacker to compleatly swamp any actual random content, which due to the issues of “dynamic range” will mean that the random is effectively lost.
I’ve actually designed several commercial products using the roulette wheel / stroboscopic principle and I can assure you that it will not stop bias from the halflife curve of a radioisotope source from appearing.
SpaceLifeForm • September 17, 2021 3:34 PM
@ WhiskersInMenlo, Clive
The ‘PING’ was likely DNS traffic.
See Durham, Sussmann.
Stiring the pot to collect the aroma of fresh metadata whiffing about.
There be ghosts, do not chase them.
Freezing_in_Brazil • September 17, 2021 4:38 PM
Clive’s arguments seem pretty solid. I think the aforementioned lock range can be remedied with expensive state-of-the art hardware [which validates MarkH’s arguments about>
I suppose it very likely that radioisotope TRNGs are used for critical applications].
As for
From my work experience, manufacturers prefer not to include hazardous materials in their products because their already complicated life gets even more complicated.
That’s for sure. 🙂
Maybe relevant to the discussion:
hxxps://jaijeet.github.io/research/PDFs/2005-CICC-Wan-Lai-Roychowdhury-Graphical-NegResInjLock.pdf
It was great to receive quality fedbacks on the topic [which attracts me a lot]. Hope we can get back to the subject [maybe in the sequel to the Friday Squid]
(*) This is a repost, since the previous one has been lost to the system
SpaceLifeForm • September 17, 2021 4:43 PM
@ ALL
OMIGOD
You are not thinking if you continue to use Microsoft products.
You are a real idiot if you have an Azure Linux instance and are not paying attention.
Microsoft is NOT retroactively patching your instance, even though it is their fault.
hxtps://www.cadosecurity.com/azure-omi-vulnerability-omigod-cve-2021-38647-now-under-exploitation/
Anders • September 17, 2021 5:16 PM
@SpaceLifeForm
That’s why you should find some time tomorrow
and see the WarpStock 2021 i posted under the new squid.
We have lived under the MS hegemony too long.
Windows is everywhere, on every corporate desktop,
same environment everywhere – AD, Exchange, Sharepoint,
Azure etc.
Too easy to take over every organization, you already know
in advance what they have there.
What we need is diversity. A change.
SpaceLifeForm • September 17, 2021 5:22 PM
@ ALL
OMIGOD
Allegedly, Microsoft is addressing the problem, NOW that there is an exploit out.
It just takes a big cluebat to hit the stubborn lazy mule upside the head to get them to wake up.
Point remains, you can not rely upon a cloud provider to actually be proactive.
SpaceLifeForm • September 17, 2021 6:02 PM
Staying below the fold
hxtps://www.technologyreview.com/2021/09/16/1035851/facebook-troll-farms-report-us-2020-election/amp/
Clive Robinson • September 17, 2021 6:16 PM
@ SpaceLifeForm, ALL,
The ‘PING’ was likely DNS traffic.
Are,you refering to the technical security matters mentioned in[1],
https://www.nytimes.com/2021/09/15/us/politics/durham-michael-sussmann-trump-russia.html
All that proves is what you and I have maintained for a very long time now,
Cyber attribution is hard, very hard.
To be honest I think it is to difficult to explain the technical merit to people not reasonably versed in covert and side channels and how you would go about implementing such systems.
After all how would you go about succinctly explaining the information bandwidth “channel redundancy gives” and how you can not just carry innocent overt information in it, but also covert information, and do it in a way that can not be proved by either the second or subsequent parties[2] in such communications.
When even security experts have problems how does anyone expect a jury not made up of domain specialists to understand it, orvget even close to understanding it?
Life is not easy when Pandora gets her hands on the genie bottle…
[1] About the only article I could find with technical detail you can put together and as it happens least politically hysterical piece I could find…
[2] See my more recent posts on how the first party can implement a covert fully deniable channel in an overt fully monitored communications channel between them and the second party, that the second party can not betray to a third party.
Clive Robinson • September 17, 2021 7:32 PM
@ SpaceLifeForm, ALL,
Point remains, you can not rely upon a cloud provider to actually be proactive.
Not quite true, their billing and marjeting depts to almost always be proactive and hyperactive respectively.
As for those doing third line support and development, they might be in some bikeshed in South West India or old Soviet republic. If Solar Winds and others are to go by.
MarkH • September 17, 2021 8:05 PM
@Freezing_in_Brazil, Clive:
The argument is mistaken. Consider the assertion “you can regard the particle detector output as an oscillator.”
For an oscillator, each cycle is causally linked to the preceding cycle: timing the zero-crossings of its output can be used to make a fairly good estimate of when the next zero-crossing will occur.
Now suppose that you’ve clocked a pair of successive decay detections in a TRNG. Every future nanosecond has the same probability for a detection: timing of recent events adds no further knowledge.
No recurring event sequence can be more fundamentally different from an oscillator; reasoning premised on periodicity is invalid.
MarkH • September 17, 2021 8:19 PM
@Freezing_in_Brazil, Clive:
If some intelligence agency is bombarding your facility with high-power beams, you have a whole host of problems (including danger to human health) which I suggest belong outside the scope of this discussion.
Other than that, the clock for the correct radioisotope TRNG need not be exceptionally accurate or stable; its function is to discriminate among events occurring at unpredictable times.
Excepting cases where the circuitry is Just Plain Broken (happens sometimes), any clock based on a crystal oscillator will do fine.
The worrisome locking case is the reverse: in a poor design, AC energy might be coupled into the detector circuitry with the effect of shifting the detection edge significantly from its “undisturbed” timing. As I wrote, the hardware must be designed with great care.
Clive Robinson • September 17, 2021 8:27 PM
@ Winter, ALL
For those interested in developing lithium battery technology,
It’s not a bad article as such, and it covers most of the bases…
But it misses out on a couple of important points.
Firstly, there is one heck of a difference between a consumer device drawing milliwatts of power and vehicals that can draw hundreds of kilowatts of power. Specifically the current in the anode of batteries. Heat generated in a battery being charged or discharged is related to I^2R losses. The easy way to get R down is to increase the “cross sectional area” of the conductor/battery, thus large area but very thin batteries would be favoured… However there are limitations on thinness, beyond a certain point it causes the energy density of the battery to drop thus battery size&weight to increase. Crazy as it sounds some people are looking at folded manifolds based around 3D fractals (don’t ask go look it up, I’ve enough trouble getting my head around fractal antenna).
The second problem not realy mentioned about vehicles is the “fill time”. When you work out the energy density of petrol/gas and how fast you can move it into a fuel tank you get a very very very high rate of energy transmission. Convert that to electrical energy and you quickly realise you are dealing with currents even big industrial spot welders can not reach. That is currents high enough to not just melt but turn into vapour all metals that would make practical conductors / connectors of usable cross sectional area.
Clive Robinson • September 17, 2021 9:05 PM
@ MarkH,
For an oscillator, each cycle is causally linked to the preceding cycle: timing the zero-crossings of its output can be used to make a fairly good estimate of when the next zero-crossing will occur.
Ever heard of a “chaotic oscillator”
http://www.scholarpedia.org/article/Transistor-based_chaotic_oscillator
Whilst they are not common in designed devices, they are in nature rather more present than the type of “periodic” oscillator you are talking about.
For instance your arm is fundementaly a structure to form a 2D chaotic oscillator due to the number of pivit points. It is only the fact that you cannot have fully universal joints due to blood supply, tendons etc that stop it being capable of reaching all points in a 2D surface and importantly continuous direction rotation.
But for a simple example of a physical chaotic oscillator you need two motors and two arms. If you fix one motor to a base and have the arm rotate parallel to the base the tip of the arm describes a circle. Now add the second motor to the tip of that first arm with a second arm above but parallel to both the base and first arm. This second arm describes a circle around the point of the first arm. However with regards to the base the tip of the second arm forms a complex pattern the shape of which is related to the speed of rotation relationship of the rotation of both arms. Because such a system is sensitive to that relationship if it varies in a determanistic fashion it is by definition chaotic.
Obviously the more rotation points you add the more interesting things get. You should realise from the likes of square, triangular, and sawtooth waves that under certain very distinct relationships when the relationships remain stable the final arm end point will trace out squares, trapezoids, triangles and even straight lines none of which to the observer have circular movments to an observers eye.
MarkH • September 18, 2021 10:10 PM
@Clive:
The electronic chaotic oscillator is new to me, though the complex gyrations of its mechanical counterpart are not. I’m glad you introduced this gadget, because can serve as good illustration of how errors of classification can happen.
I suggest that the spectrum of such an oscillator (over a long integration time) would crudely resemble some statistical distribution curves, with a weakly defined “peak” and broad “shoulders”.
The spectrum of isotope decay detection will make a better approximation to a “bell curve”.
In this sense, these phenomena have a sort of family resemblance — in the frequency domain.
To infer from such frequency domain resemblance that one type of phenomenon (deterministic causally linked) is equivalent to the other type of phenomenon (events in a large population which are weakly linked or fully independent) is invalid.
MarkH • September 18, 2021 10:39 PM
comment continued:
I’ll call a sequence of events determined by a common causation which constrains their relative timing a Type 1 sequence.
By contrast, the sequence of largely (or completely) independent events occurring in a population I’ll call Type 2.
Mundane examples of Type 1 include the ticking of a mechanical clock; an oscillator (even when chaotic); sheets of paper issuing from a copy machine or printer; the beating of our hearts.
Type 2 phenomena are also very familiar.
Sometimes at a large public event, you can see dozens (maybe even hundreds) of camera flashes per second.
Human births in a city are another example.
Earthquakes are Type 2 event sequences (as I mentioned on another thread); so are supernovas.
MarkH • September 18, 2021 10:41 PM
conclusion of comment:
Within selected constraints (for example, choice of a city in which to record times of birth), Type 2 sequences will exhibit some mean frequency over a sufficiently long interval.
That frequency is an artifact of population size and probability density. To infer from the existence of such frequency that Type 2 sequences are in any way “periodic” is a mistake. Arguments valid for Type 1 can be false for Type 2.
Clive Robinson • September 18, 2021 11:18 PM
@ MarkH,
The spectrum of isotope decay detection will make a better approximation to a “bell curve”.
And what is your reasoning for that statment?
MarkH • September 19, 2021 1:38 AM
@Clive:
I visualize a broad maximum in the neighborhood of the mean frequency. Because the intervals between decay events are extremely scattered, I suppose there to be energy spread throughout the range of the spectrum, slowly diminishing according to distance from that peak.
I wouldn’t be surprised if I’m “all wet” — perhaps it looks more like a typical noise spectrum.
Clive Robinson • September 19, 2021 9:06 AM
@ MarkH,
perhaps it looks more like a typical noise spectrum.
Have a bit further thought, remember exponential decay is a ratio against time thus not a flat distribution so is not going to look like WGN or similar distributions, (untill the decay has finally finished in which case zero).
Subscribe to comments on this entry
Sidebar photo of Bruce Schneier by Joe MacInnis.
Kermit The Frog • September 10, 2021 5:12 PM
@ matthew_d_green
I am the CIO of Tether
hxtps://nicolaborzi.medium.com/the-lawless-rollercoaster-of-bitcoin-enriches-few-investors-while-many-often-lose-everything-f9b4789444c