Posts by John_Ericsson

NASA delays Artemis II to March after hydrogen leaks bedevil countdown test

Is there a good reason to send people back to the moon?

Seems very risky and drones could do everything (and more) an astronaut could do.

Notepad++ update service hijacked in targeted state-linked attack

IOC and the "Chinese connection"

https://www.rapid7.com/blog/post/tr-chrysalis-backdoor-dive-into-lotus-blossoms-toolkit/

ATM flashes a port or two for the enterprising hacker

This is crying out for the response of "Don't worry, it's all encrypted!".

Whenever I heard those words I started to worry.

Splash-screen memories from a Bangkok ticket machine

Re: Windows, again

"Some day, Fortune 1000 CEOs will finally get the message ..."

Some day the GNU/Linux zealots will get why CEOs allow windows within the organisation. When that happens the situation WILL change.

However rather than doing that, why not create another distribution and ten more text editors.

Maximum-severity n8n flaw lets randos run your automation server

Re: Am I doing something wrong?

If it is not already done, can I suggest you name the server "bitcoin".

GNOME dev gives fans of Linux's middle-click paste the middle finger

Good on the community. MS users have to reach over to the co-pilot key, Linux users can now use the middle mouse button. 2026 the year of Linux

Welcome to Wendy's! Before your order can be taken, you must first reset this kiosk

Last year (2025) a tesco cafe kiosk dropped to the desktop. I didn't need a keyboard as it kindly gave me an one screen touchscreen.

The only thing I did was to check if I had root access, and of course I did. I left a txt document on the desktop with an message commenting on the importance of "least privilege" control. (although no doubt the file would have been wiped on reboot).

At the time I was amused by it running anti-malware, but on reflection "of course it did, and quite rightly".

My younger self would be incredibly disappointed with me, that I made no attempt to hack the system to get unlimited "big breakfasts". That said I am still worried the government with insist I am arrested under the computer misuse act for leaving that text file.

Not my image but ...

https://share.google/zMvNc3cuNDQESvdRs

21K Nissan customers' data stolen in Red Hat raid

Re: “[NAME] takes this incident very seriously“

"a third party server" (accountability? yes, but blame them not us).

TryHackMe races to add women to Christmas cyber challenge roster after backlash

Over a decade ago several UK universities signed up the the "gender blind" application process. Anything that could indicate gender was removed from the process until interview. The goal was to remove the subconscious (and I guess conscious) bias against females.

(The initiative was not just academy and it was embraced in commercial environments. I recall several stories on Radio 4 about it)

Obviously the HR staff were clapping their hands together in excitement, and to be fair the IT managers at my university were all for it. I too was more than happy to play a part (selecting candidates for interview).

Years later I asked why it was never implemented, and was told it resulted in less women being invited for interview.

I can see why that should be.

UK agri dept spent hundreds of millions upgrading to Windows 10 – just in time for end of support

The project would have been "upgrade windows 7 desktops to windows10". A project manager would have been assigned and the remit would be "to budget, no excuses" . The Project Manager delivered.

NHS left with sick PCs as suppliers resist Windows 11 treatment

Blame the Project Managers. All they care about is "on time and to budget" (and impressing their managers), this is true no matter what the size of the project. Any governance issues are dismissed with a wave of the hand (which mostly work). I lasted a few months in a NHS trust until I realised their GRC was just pretend and "getting the job done" was legitimate reason to override policy (exception requests were just rubber stamped).

EY exposes 4TB+ SQL database to open internet for who knows how long

Re: Ernst & Young

Perhaps this argument is why the media still tell us that "X" was formerly known as twitter.

Firewalls and VPNs are so complex now, they can actually make you less secure

"Keep It Simple", should be hardcoded into security policies.

In my experience it is "IT" that are driving the escalation of complexity of systems and services without considering risk of support and understanding of the services.

Air Force admits SharePoint privacy issue as reports trickle out of possible breach

It is so easy to screw up SharePoint permissions, it is so easy to unintentionally lose an intuitive ACL structure.

so many organisation employ those with the right skills, and then they leave and then...

"Hmm, can you access it now?, hmm, try again, I don't get it, hmm, once last time. Oh! that's great! I'll close the job"

MS: Hmmmm ...... access control is so flexible,

Warnings about Cisco vulns under active exploit are falling on deaf ears

Re: Smelly?

"... the person who installed it left the role."

US Navy: I can't quit you, Azure

It was before a lot of your readers were born, but in the late 1990s the US Navy IT procurement "rules" were copy and pasted onto presentations as best practice.

JLR stuck in neutral as losses skyrocket amid cyberattack cleanup

Re: Disaster Recovery Plan

There most definitely will be a DSR. It will state "restore from backup" and give a timeline of essential services being available in "days". I fully expect it would have been tested several times.

I have worked in many environments and it is chalk and cheese with companies that outsource their IT and those that don't. Outsourcing will never be able to provide the flexibility that Cyber Security requires. To request a change when outsourcing IT requires tiers of management to approve and to find funding for even the simplest of change or improvement. Those in the management tier have the direction of not submitting any change due to the expense and "leave it to the next contract". When you have your own IT staff, they are falling over themselves for projects (which is not always a good thing) and to improve services.

Cybercrooks ripped the wheels off at Jaguar Land Rover. Here's how not to get taken for a ride

Air gap everything that can be air gapped.

Then

Listen to it security team who role their eyes at the concept of air gapped network and tell you on 2025 and everything is on the internet, but not to worry as they will protect you.

Torvalds blasts tardy kernel dev: Your 'garbage' RISC-V patches are 'making the world worse'

Linus or one of “Jia Tan” sock puppet accounts? What are the rules when engaging with developers?

Your CV is not fit for the 21st century – time to get it up to scratch

Re: Ultimately it's all BS

Maybe if you want a job as a cleaner in a hotel or a ad-hoc plasterer. Knocking on door for IT is never going to work and will probably put you on top of the odd ball list.

UK retail giant M&S restores Click & Collect months after cyber attack, some services still down

There will be significant lessons in looking at what they had for a continuity plan, and its failings.

Cisco fixes two critical make-me-root bugs on Identity Services Engine components

Re: another two backdoors found?

I don’t think market share comes into it.

Re: another two backdoors found?

"Never attribute to malice that which is adequately explained by utter incompetence”

Here's what we know about the DragonForce ransomware that hit Marks & Spencer

The reporting on this by the register has been lacking.

Re: And that's why you should NEVER pay a ransom...

The hacking groups cover this by explaining that future extortion attempts on other companies would not succeed if they were known for not keeping their word. The exact wording is on forums where victims have cut and pasted the text.

British govt agents step in as Harrods becomes third mega retailer under cyberattack

The register final catching up on the news.

Microsoft OneDrive file sync apps for Windows, Mac broken for 10 months

Gentlemen, can I remind you that children read the register. While I would not seek to have the language rated at “U”, let us aim for “PG”. How about using “darn” and “cotton socks”, and as you are British “bollards”

Oracle says its cloud was in fact compromised

I thought GDPR requires the data controller to notify the ICO within 72 hrs of being made aware of a breach. Is oracle the data controller (“owner” of data) or a data processor?

Have I Been Pwned likely to ban resellers from buying subs, citing 'sh*tty behavior' and onerous support requests

In this context, what is a reseller?

Already three years late, NHS finance system replacement delayed again

To be fair, we never hear of the thousands of NHS IT projects that are delivered on time and to budget.

Oracle finance system at Europe's largest city council still falls short 2.5 years later

I often wonder if an off the shelf trusted and established application, with internal support staff can create a better and MORE FLEXIBLE service. My experience ends in 1997 when the benefit agency brought in consultants to look at the IT services, and they scrapped in house solutions and contracted out. The results were as you would expect. I remember we could not ask for bugs to be fixed because it had been signed off and we could only make a handful of “feature requests” per year

Why does the UK keep getting beaten up by IT suppliers?

Lots of reasons. However the primary reason is managers not one taking responsibility/accountability by suggesting something they could be blamed for. Once someone has suggested “X” then X it is, and we know who to blame when it al goes wrong. This attitude runs from top to bottom on the management hierarchy. In my experience poor project management is something the UK excels at.

British Museum says ex-contractor 'shut down' IT systems, wreaked havoc

“Suspicion of burglary and criminal damage”. Now the staff at the British Museum know how it feels.

Xfce 4.20 is out: Wayland support lands, but some pieces are still missing

The worst case scenario is going to happen. Both wayland and Xorg are going to have to be installed side by side for decades to come. Wayland is a vanity project. They pride themselves in doing it their way with little regard for real world needs

Watchdog finds AI tools can be used unlawfully to filter candidates by race, gender

Hold your horses. You do know that a hack to allow positive discrimination is to declare a diverse workforce as a requirement of the organisation. The organisation (HR) will produce lots of graphs about the financial benefit of diversity. Points will be awarded to select candidates and at interview based on what they can contribute to the companies diversity.

UK councils bat away DDoS barrage from pro-Russia keyboard warriors

Hopefully those dealing with the DDOS received support from a hotline that had no options related to the issue, and did not have an option to speak to someone.

On second thoughts, for IT staff that care, dealing with attacks is a fairly bad experience, hope that they do get appropriate support

Wanted. Top infosec pros willing to defend Britain on shabby salaries

They have ridiculous job titles to sound impressive when they leave. I must admit an application from a " Lead Cyber Security Expert" at GCHQ would go on top of the interview pile.

My young colleagues tell me that "job cat fishing" (or is it phishing) is also a thing, where employers big up the role that does not reflect what you will be doing.

Penn State pays DoJ $1.25M to settle cybersecurity compliance case

"Penn State abandoned its contract with **government-compliant** cloud host Box in favor of OneDrive, which doesn't meet NIST's CUI security requirements, to save money"

I've been there countless times with UK universities, that get IT to do their Information Governance. IT make a decision without consultation and when it all kicks off when they tell users to move data to the new repository they off the advice "go back to the stakeholder, explain that there is no difference in security". I can guarantee IT would have said "will it be okay if you encrypt the data on one drive?".

UK ponders USB-C as common charging standard

Re: Mandating a charging standard is idiotic

"wireless charging replaces it which could be decades away". I smiled.

NIST's security flaw database still backlogged with 17K+ unprocessed bugs. Not great

Re: It has been pining for the fjords for a while

The dismal of the CUPS vulnerability by the open source advocates and developers is FAR more worrying than the none authenticated RCE vulnerability itself.

Another OpenAI founder moves to arch-rival Anthropic

Re: "the Microsoft-backed AI house"

"Sat 2 Jun 2001".

How to spot a North Korean agent before they get comfy inside payroll

Keep an eye out on pen testing companies even those based in the UK.

I have audited companies that have employed a third party pen testing company to do their pen test (fair enough), and while the pen testing company is genuine and none malicious, they are often unable to provide meaningful assurance on the contractors they employ.

Admins using Windows Server Update Services up in arms as Microsoft deprecates feature

So more reason to remove the air gapped networks and have all the sensitive information "on the internet". WSUS requires just two ports to be open, what's the betting that the cloud "alternative" requires a whole host of URLs with ever changing IPs and multitudes of ports for our on prem servers to access them.

I will miss typing "wuauclt /reportnow and /detectnow" (although one of them didn't work, but I can never remember which so I used both.

NHS drops another billion on tech in the hope of finally going digital

Re: Place your bets...

And when it goes dreadfully wrong the NHS will defend the contractors, consultants etc.

Microsoft on a roll for terrible rebranding with Windows App

Further evidence as to what the answer is to "Do they ever stop to think?"

Open source maintainers underpaid, swamped by security, going gray

Re: If that's where we have to go . .

This will become more of an issue as companies get to grip with supply chain security. While you are rightly defending FOSS another groups of people are congratulating you for making an excellent point on the lack of assurance with Open Source and hence why it should not be used in a prod environment.

250 million-plus unused IPv4 addresses should be left alone, argues network boffin

lets jump to v8, with it being like ipv4 just bigger.