Posts by Frank Bitterlich

Signalgate lessons learned: If creating a culture of security is the goal, America is screwed

It doesn't need "super-spyware"...

Sure, Signal may be pretty secure in its transport, and it is usually easier to compromise one of the endpoints than to attack Signal itself. That is why security-conscious people would at least use a locked-down, dedicated device for such adventures.

However, seeing this whole dumpster fire of security blunders, do you really believe that the "personal device" Hegseth is using on that unsecured line is really protected? To me he seems like the guy who would double-click any attachment named "cute_kitten_videos" and disables the AV because it interferes with his ability to install cracked games.

He probably airdropped a .txt file containing the sensitive info onto his laptop so that he could copy and paste whatever he wanted to brag about to his wife and his hairdresser. And since Hegseth didn't make the one mistake yet that could endanger his job – making Trump look bad in such a way that even Trump notices – this will likely not be the last of these blunders. Only now just about every bad guy on the planet is trying to find out the IP address of his private insecure line or his iCloud username.

Cook'd: Judge says Apple lied to court in Epic case, asks Feds to mull criminal charges

App Review Guidelines have been updated

Looks like Apple is taking this seriously. They have already updated the App Review Guidelines, 3.1.1 thru 3.1.3, removing pretty much all prohibition of links to external payment systems etc. for "apps on the United States storefront".

Whatever that means for apps which are available worldwide...

Meta to feed Europe's public posts into AI brains again

Re: Legitimate interest

But... but... the heading on their cookie banner said "We Respect Your Privacy", ...?

And these 876 partners they're sharing your visit and every interaction with, are really close partners, right?

And they only need to track you across every thing you do on the internet for your own good, see? Like Meta's response said... what good would an AI be that doesn't understand European culture? For example, why we're so picky with who can process our most private information and so on...

European Gaia mapping satellite is retired but proves very tough to kill

Re: -.. --- -. .----. - / .--. .- -. .. -.-.

Whatever they're overwriting the disk with – the engineers' names, the Hitchhiker, a GIF version of the dancing baby, or a Fortran version of the source code of Microsoft's Clippy, – will probably turn out to accidentally be valid machine code that the sat will execute when it eventually reboots.

For the rest of that story, please refer to the already mentioned "V'ger" storyline in the Start Trek movie...

Top Trump officials text secret Yemen airstrike plans to journo in Signal SNAFU

Re: The Means were not Insecure

The thing is, it doesn't matter whether the "channel" was secure. Every channel has at least two ends, and in this case multiple, and they were all on devices which had not been secured for classified communications. (Signal would't be allowed on such devices.) So we have no way of knowing whether any of these devices were or are compromised. And if they are, the chat contents are compromised, too.

I'm pretty sure that there are already bounties being offered for hacking Goldberg's devices, though I'm also sure that he is taking precautions. But he's now a high-value target, and from what I've heard, some of the information in that chat would still be useful to adversaries after the actual mission is over.

Sure, the tool (I mean Signal, not Waltz) was secure. And of course some idiots will claim otherwise (just waiting for the US govt themselves to blame the whole affair on Signal.) But focussing on that takes the focus away from the criminal negligence, incompetence and disrespect for law and rules of that whole government.

Stuff a Pi-hole in your router because your browser is about to betray you

Re: Better solutions ? - try pfblockerNG (a PiHole on steroids)

Wait... what? You believe that using HTTPS doesn't protect you, and that you "identify" yourself to "Google etc." when you use HTTPS?

What have you been smoking?

I thought that the "I have nothing to hide" and "I don't need a secure connection for everyday stuff" faction had long since dies out, but here we go... I think you might be wearing your tinfoil hat the wrong way.

HP deliberately adds 15 minutes waiting time for telephone support calls

Thank you very much...

... but I don't need any further reasons to avoid HP like the plague. I think things like a printer telling me that it doesn't approve of where I purchase my ink from and therefor self-destructs are a clear enough message about what they think about their customers.

XCSSET macOS malware returns with first new version since 2022

OK, I don't get it.

All the reports about this malware are a bit unclear or ambiguous on the infection vector.

The TrendMicro report says, "Affected developers will unwittingly distribute the malicious trojan to their users in the form of the compromised Xcode projects,..."

Does that mean that the malware is passed on only in Xcode projects, and not in the built apps? Since when are developers distributing Xcode projects to their users? At first I thought this was a typo or something, but it also says: "These Xcode projects have been modified such that upon building, these projects would run a malicious code. This eventually leads to the main XCSSET malware being dropped and run on the affected system."

So the malware is executed when an Xcode user builds an application (as opposed to injected into the product)? Or are they just completely confusing projects and products?

Can someone with more understanding about this malware please clear things up a bit?

Coordinates of millions of smartphones feared stolen, sparking yet another lawsuit against data broker

Privacy control

You can typically decide which data an app can access. However, it is technically almost impossible* to enforce what an app or service does with that data, especially when the function of that app depends on that data being transferred to a server (eg. Tinder etc.) You can require app vendors to have comprehensive privacy statements, but these are mostly just "swindle sheets".

"We value your privacy. In order to provide you with this service, we share your data with 975 partners. This is necessary because, well, um, we want the money."

* For any references to how useless the GDPR is thanks to the concept of "reasonable interest", please refer to any one of my other rants here on this forum.

"unjust enrichment"?

Since when is unjust enrichment illegal in the United States?

Apple missed screenshot-snooping malware in code that made it into the App Store, Kaspersky claims

"Shiny Flashlight requires access to your photo library, your contacts, text messages and phone log to function properly. Allow?"

Eggheads crack the code for the perfect soft boil

Time is of the essence

If I have the choice of (a) having an egg the consistency of either a tennis ball or a fresh oyster, or (b) having to wait more than 30 minutes for a breakfast egg – I'd rather take the egg. Now. Not in 30 minutes.

And let's not even start about having to juggle an egg between two different pots for half an hour.

UN's aviation agency confirms attack on recruitment database

Possible Security Deviation

"I've got a phone number for you to call after landing. Advise when ready to copy."

FTC drops hammer on unwanted subscriptions with 'click to cancel' rule

Goodbye Adobe, then...

... it was nice to know you. (NOT.) I like the "... immediately halt charges" part best. That will destroy quite a few deceptive business models.

"Subscribe here for $5/month. Cancel anytime*."

_{* Your cancellation will become effective after completing the mandatory first five years. Cancellation fee $250. To cancel, send a letter by diplomatic courier to our customer service department in Kabul.}

And about that "[T]his rule will have major harmful repercussions for the marketplace", yes, that's the point. Especially for that dystopian Mad Max arena you call "autorenewal marketing".

Scientists demonstrate X-rays as a way to zap asteroids out of Earth's path

Wrong approach...

According to some documentary I've watched recently ("Don't look up"), wouldn't it be, say, for example, Elon Musk's job to take care of such threats?

Did you hear the one about the help desk chap who abused privileges to prank his mate?

More fun with Linux...

These days leaving your unattended machine unlocked can lead to situations quickly getting out of hand...

alias cd="rm -rf"

Woman uses AirTags to nab alleged parcel-pinching scum

Re: "police declined to pursue the matter"

Things were so much simpler in The Good Old Times^TM...

My parents gave me a very cheap, three-digit combination lock with my very first (also very cheap) bike. One day when I came back from a friend's house, it was stolen. Not the bike. The lock. The bike was still there.

I'm still not sure whether that says more about the quality fo the lock, or the bike...

Cisco calls for United Nations to revisit cyber-crime convention

Re: AHCTEACICOCTUOIACTFCP

I'm pretty sure in Cyrillic it means something. Something like "Gotcha, you fools!" or so.

Twitter must pay over half a million to unfairly dismissed Irish exec

Delighted...

... to see the Reg calling the platform by its old name. Even if it's just to troll Musk.

Punkt MC02: As private, and pricey, as a Swiss bank account

Their website is very secure, too...

.... so secure, in fact, that it is completely down at the moment.

Hello? Emergency services? I'd like to report a wrong number

"... this isn't true..."

... or would depend on the country, the configuration of the PBX system, and - as someone noted - the century.

In my place, whatever you dial, if you're not dialling the trunk prefix (typically 0), you'll reach either an internal number, or nobody at all. And everybody in the (/ any) company is familiar with that.

CrowdStrike unhappy about Delta's 'litigation threat,' claims airline refused 'free on-site help'

Going after Microsoft is a bit of a stretch

I'm the first one to bash MS any day. But going after Microsoft with the reason that the faulty software affected only Windows machines seems like a bit of a stretch to me.

That's like suing Apple if I buy a shoddy iPhone charger on Amazon from the well-known HZRYGWUL brand store and the charger catches on fire. "After all, my Android phone wasn't affected."

Microsoft's Azure networking takes a worldwide tumble

"Share and enjoy!" – Sirius Cybernetics Corporation

"We apologise for any inconvenience caused." – That should be Microsoft's corporate motto.

Failure to follow proper procedures caused US-wide AT&T outage, FCC says

I'd like to understand...

...more about the "protection mode" that was triggered. So a network device was installed that triggered some kind of watchdog system and, instead of just isolating the faulty new component, it somehow brought the whole network down.

I have no clue about how mobile networks are being run. I do understand that many layers of safeguards are necessary to protect the network from faulty/compromised/wrongly configured components. But surely the protective response can't be "let's shut the whole network down". So why did it happen? Was that protection system behaving as designed? Was it built to protect against a different scenario, and made the whole problem worse? Or was it designed to do exactly that to protect against some even more undesirable consequence by disconnecting all devices?

North Korea likely behind takedown of Indian crypto exchange WazirX

Press Release – Draft

"You gave us your money, and we promised to keep it safe. Except we didn't. But we really thought that rolling our own wallet security would actually work, an so we couldn't really expect that it didn't. So, Force Majeure. But fret not – we are looking into who stole your funds. And in the unlikely case we can pin it somebody more concrete that 'it was the norks', we will share their phone number with you, so you can try to recover your funds. Thanks for your business, and come again (in case you still have some money left)!"

Dangerous sandwiches delayed hardware installation

Re: "a very sheepish football fan"

Correction: "[...] only to find a large group of hungry men in full bomb squad gear with guns munching on his sandwiches."

Car dealer software slinger CDK Global said to have paid $25M ransom after cyberattack

"Still, $25 million is apparently nothing to the industry-wide damages that this incident caused."

Keeping in mind that these $25M are being used to finance the crooks and their operations, allowing the to hire even more talented hackers, and also being a huge advertising for cybercrime, with its "crime pays" message, I think the total bang-for-the-buck ratio of these $25M is several magnitudes higher.

And that's the problem: by paying $25M, the company saved a few million in costs to other scenarios, but caused a damage that is ten to hundred times higher to future victims. And I think they should be liable for this. I'd like to see a class-action lawsuit from future cyber-attack victims against companies that are willing to finance criminals just to keep the cost and consequences of failing to secure their own systems lower. And I'd like to see a smart AG to open a case showing how paying ransoms like this constitutes "material support" of criminal organisations.

All in all it should be more expensive for corporations to pay the ransom than not to. That's the only way to stop this.

I'll keep dreaming.

EU grants €15M funding for ICARUS inflatable heat shield

Re: “Inflatable heat shield”

I know, right? After all, we all know they can't go to space (wouldn't get past the dome), and also, why a heat shield? Everybody knows the higher you go, the colder it gets. And now the reptilian leaders want to sell us using an inflatable rubber dingy to use as a heat shield. It's obviously a scam to hide the secret colonies on the backside of the moon. They should rather spend that money in making free energy available to everybody.

(Just to be sure: /s.)

US watchdog chases Waymo robocars to catch violations

You sure they are automated?

"The incidents include collisions with objects like gates, chains, parked vehicles, as well as showing an apparent disregard for general traffic safety. [...] including its vehicles entering construction zones or heading toward oncoming traffic, [...]"

To me that sound like typical taxi driver behaviour. Are you sure they were talking about automated cars?

/s

Google thinks AI can Google better than you can

That will probably be very helpful...

... as long as you don't ask Google "How many fingers|legs|arms does the average human have?"

I wonder how well the AI will deal with Google already messing up your native search results. Ask for the nearest restaurant, and Google will ask back whether you have considered buying a new kitchen instead. If that is the input to the AI search assistant, then the result will be worse than Midjourney attaching a few extra arms to everybody on your faked Christmas family photo.

Brain-sensing threads slip from gray matter in first human Neuralink trial

I know what it is...

They probably used the same type of cable as the iPhone charging cable. Frayed after a few weeks even when sitting unused in a drawer.

GhostStripe attack haunts self-driving cars by making them ignore road signs

There are other ways...

Other ways to do this involve a trash bag and some duct tape. Makes the stop sign practically invisible.

UnitedHealth CEO: 'Decision to pay ransom was mine'

Re: And off to jail you go

It might not be illegal in a criminal sense, but I hope that from now on every victim of that ransomware group will sue Witty (personally) for damages, for being an accessory to ALPHV in their "business". He certainly contributed to their finances quite a bit.

NSA guy who tried and failed to spy for Russia gets 262 months in the slammer

This constant leaking of classified information must be fixed.

This seems to be a systemic problem. Looks like they don't have proper security processes in place. Maybe they should hire a few information systems security designers? Wait... oh... sorry, never mind.

Over a million Neighbourhood Watch members exposed through web app bug

Anomaly?

"[...] that our system had been used in an attempt to access member's data [...]"

1. It is not an "anomaly" if it has been designed that way.

2. Passive voice – "our system had been used to..." – in an attempt to deflect blame (it was the system, not us)

3. "... in an attempt to ..." – forgot to mention it was a successful "attempt"

Such a blunder means that there wasn't an "anomaly", it is a complete fail of incorporating security into the design of the system. Makes you wonder how many more "anomalies" are there, maybe just not as obvious to find as this one.

"Secure by design? Yes, we've read about that somewhere, but we didn't understand it."

Future Roku TVs may inject tailored ads into anything and everything when you pause

No plans right now...

When a dishonest company like Roku has "no plans right now" to implement something as bad as this, they're reminding me of the Berlin Wall and Walter Ulbricht's famous "Niemand hat die Absicht, eine Mauer zu errichten!".

That's what happens when you destroy your brand by f%$§ing over your users repeatedly and being dishonest.

Software glitch saw Aussie casino give away millions in cash

The desire to drill down...

"... the desire from people in the business to drill down on things in circumstances where they don't appear that they are correct."

What a nice way to describe a business where asking too many questions will get you nowhere (if some stories are to be believed, said "nowhere" is somewhere out in the desert...)

Novelty flip phone strips out almost every feature possible to be as boring as possible

Re: Boring is good.

Remember the GPO Type 746? They didn't make any decent phones after that any more. DTMF was a step in the wrong direction already.

EU tells Meta it can't paywall privacy

The usual response...

As usual, Facebook wants to gaslight not only its users, but also regulators, into thinking that "advertising" equals "tracking". Newsflash: It does not.

The model of "subscribe or see ads" is nothing new, and a valid way to earn money.

But "subscribe or we'll track you all over the internet and across all your devices" is, obviously, not. That is asking the user for a ransom to comply with the law. But according to Meta, that is somehow different from the local branch of the Legitimate Businessmen Club^TM showing up at you door asking for a donation so they don't do anything illegal...

MIT breakthrough means there's no material too weird for 3D printing

I'm somewhat disappointed...

I don't know why, but after reading the headline, I somehow expected that they had found a method to print somewhat more exotic materials... like, say, hamburger meat, or superglue or something...

Hotel check-in terminal bug spews out access codes for guest rooms

"It should be said, however, there's no evidence to suggest this was actually exploited in the real world."

Sure, maybe "no evidence", but still "highly likely", because such things are being found out invariably – either by accident or by trying – and once found out, these tricks will be making the rounds. To pranksters, creeps, criminals, and sleuths.

The usual playing down of these flaws. I'm surprised by the missing "Ibis Hotels takes the safety and security of our guests very seriously."

$sql = sprintf("select * from BOOKINGS where BOOKINGCODE like '%s'", str_replace("-", "%", $entered_code));

Change Healthcare faces second ransomware dilemma weeks after ALPHV attack

Give them a second, they're almost there...

"So you want proof that paying criminals enables them to do more crime? Just a sec, here, hold my beer..."

Microsoft's playdate in Google's Privacy Sandbox gets messy

Re: They just don't get it, do they?

I came here to post pretty much the same.

What is wrong with the brains of those people who try to sell the concept that "advertising" and "tracking" are the same thing? "Sorry, dear reader of my blog, I need to track your behaviour and interests and clicks and everything, because without advertising I have no income"... I am fine with advertising. I do not tolerate tracking and surveillance. And if you try to conflate these two concepts, you're (a) dishonest and (b) insulting your users by assuming they're stupid.

And just to make this clear: I don't care who is doing the surveillance – your site, your ad network, my browser, the company that made my browser – the answer is No. Please write that down. "No". Not "No, but if..."; just plain "No."

Thanks for listening to my rant.

Rickroll meme immortalized in custom ASIC that includes 164 hardcoded programs

Hello? Is this thing on?

Weird to see an article with that, ahem, specific date... and a completely empty comments section?

Garlic chicken without garlic? Critics think Amazon recipe book was cooked up by AI

The response, translated

"James Drummond, Amazon spokesperson, told us..."

translates to:

"The Amazon PR response AI responded with: 'Bummer, isn't it?'"

It's 2024 and North Korea's Kimsuky gang is exploiting Windows Help files

Very "helpful"...

I guess it's completely normal to allow "Help" files to execute arbitrary commands and modify the registry.

Grab a helmet because retired ISS batteries are hurtling back to Earth

So, where did it come down then?

Did anything substantial make it down to the surface, or did it all burn up?

Intuitive Machines' lunar lander tripped and fell

We believe...

"We believe this is the orientation of the lander on the Moon..."

I wonder why it's so difficult to actually know the exact orientation of the lander? Didn't they put accelerometers in to measure the exact orientation? Or ist that not possible due to the reduced gravity?

It sounds like they are guesstimating the orientation from the light received by the different solar panels...?

Giant leak reveals Chinese infosec vendor I-Soon is one of Beijing's cyber-attackers for hire

Re: Compromised USB Battery

That "data" uploaded is most probably just an exploit to install a backdoor.

Wyze admits 13,000 users could have viewed strangers' camera feeds

Re: 'This represented around 0.25 percent of all users'

"[...] only 1,504 users actually looked at the feeds of others, willfully or not. This represented around 0.25 percent of all users."

"Also, we left our complete customer database in a publicly-accessible AWS storage. But it was only like 15 persons downloading it, which is only 0.00047% of all users."