Posts by Michael Wojcik

The Iceman cometh, his smartwatch told the cops: Hitman jailed after gizmo links him to Brit gangland slayings

Re: Proof once again

Everyone actually has something to hide.

Some people simply don't know it. Yet.

Having AI assistants ruling our future lives? That's so sad. Alexa play Despacito

Re: Nah.

Voice-control systems are easy to build using off-the-shelf components. A few electronic pieces, CMU Sphinx, TensorFlow - you could have a pure-local voice-controlled "AI assistant" up and running in a couple of days, or maybe a week if you're technical but new to the domain.

Personally, I don't see the appeal. I find voice-controlled devices immediately and deeply obnoxious.

Re: OTT

I would really struggle to use it to measure 500ml of helium

Yes, but it's worth the effort. You'll find it an uplifting experience.

$24m in fun bux stolen from crypto-mogul. Now he fires off huge fraud charge. Like, RICO, say?

Re: It's not RICO

Oooh. Charles Stross takes one on the chin in that one.

Well, he's not a lawyer either, and he does write a good novel. (Plus, if memory serves, back in the day he was entertainingly grumpy on rec.arts.books.sf.)

I am also not in any way a lawyer, but a quick check of 18 USC 1962 leaves me wondering which RICO provision of unlawful conduct Turpin's lawyers think Truglia et alia engaged in. Maybe they can call the SIM fraud a case of interstate commerce (I have no idea what case law might say about that), and maybe SIM fraud could be construed as "racketeering activity" under 18 USC 1028 (relating to "identification documents") or 1029 ("access devices"), or one of the zillion other sections that can be used to claim racketeering.

But AIUI, that's just the start of what a plaintiff has to demonstrate to get a judge to even let a RICO civil case proceed.

Re: All the King's horses ...

I think so. I believe Krebs's latest piece on this case (linked above) mentions that an AT&T employee was complicit, not just duped, in the Turpin case. Presumably that involved ignoring the restrictions Turpin had placed on his account.

Re: All the King's horses ...

The Krebs piece is also worth reading for its portrait of another of these psychologically-abnormal IT criminals. Truglia clearly had poor social and life skills, and limited ability to empathize. He treated life like an RPG-style video game: gathering coins, buying buffs, and grinding.

HSBC suggests it might have found a... use for blockchain?

Re: Truth

I think you'll find that any distributed ledger would be vulnerable to attack in such a circumstance.

This is precisely the problem, and why BGP attacks attempting to partition the Bitcoin mining network happen around a hundred times a month.

"Such a circumstance" turns out to be quite common.

FCC's answer to scandal of AT&T, Sprint, T-Mobile US selling people's location data: Burying its head in the ground

Re: You don't understand how it works

Instead, after they leave they get big money as "consultants" that don't actually do anything, or for serving on boards that hardly ever meet.

Indeed. Pai was a Verizon employee before he was in the FCC. He's still a Verizon employee; it's just his compensation is deferred until he leaves the FCC.

'It's like they took a rug and covered it up': Flight booking web app used by scores of airlines still vuln to attack – claim

Re: "Yet again you've let them get away with an anodyne statement"

They need to get taken to task.

I have to side with Chris and the Reg on this. They were pretty clearly taken to task in the article, and explicitly mocking the Amadeus response is unnecessary. Anyone capable of critical thought will see through it; anyone not capable won't profit from being told directly.

Oh, SSH, IT please see this: Malicious servers can fsck with your PC's files during scp slurps

Secure Copy Protocol?

Surely "Secure Copy Protocol" is a bacronym. "scp" is just "secure cp", by analogy with "rcp" ("remote cp"), which in turn was named for UNIX "cp". And "cp" is just an abbreviation of "copy", not an acronym.¹

I see Wikipedia uses the "Secure Copy Protocol" phrase in the relevant article, but the contributors hedge their bets by also using "secure copy", and they don't seem to cite any source for "Secure Copy Protocol". Some of their sources in fact use "scp protocol", which to my thinking has better etymological justification.

(Sure, there's a security issue here, but it's not nearly as important as arguing over terminology.)

¹Or for pedants who adhere to the ill-founded "pronounced as a word" restriction for acronym, an "initialism".

What a cheep shot: Bird sorry after legal eagles fire DMCA takedown at scooter unlock blog

Eh, I can see how this happens. Someone higher up in management who doesn't have a clue is aimlessly searching for mentions of the company online. They run across the Boing Boing post and fire an email at Legal. Legal looks at it, rolls their eyes, tells a paralegal to send a DMCA takedown notice without even checking who wrote the post.

Since DMCA notices are effectively free to the issuer, plenty of firms send them out on the flimsiest of pretexts (often the entire process is automated) as an initial salvo.

It'd be interesting to change the economics - say, to amend the DMCA so that each takedown notice must be filed with the Library of Congress at a fee that starts at $10 and is adjusted annually for inflation. Oh, the howls from Hollywood! It'll never happen, of course. (And I admit it has an unfair asymmetry anyway, because it's generally much cheaper for attackers to copy protected content to many sites.)

Re: I doubt they'll be that cheap

$150 for a second-hand scooter that cost around $30 new, sold by J Random Ebayer? Sounds like an excellent deal! For the seller, I mean.

Seriously, if you want these at anything like a reasonable price, go to a municipal auction. Bring cash, and decide ahead of time how much you're willing to pay. Be willing to walk away if the units are in poor shape.

Re: Who remembers the cue cat?

They could possibly mitigate against this attack by pouring epoxy into the case that houses the board and using non standard screws. At least that way anyone expecting a cheap scooter has a lot more work on their hands to make it work.

I don't think this is cost-effective. What Hackaday reader doesn't have a set of security-screw bits? Anything more exotic would be prohibitively expensive for Bird. And if the case is filled with resin, just chuck the case with the board and fit a new case.

Seems to me the asymmetry here still favors the attackers (people who want to repurpose a Bird unit).

There was a recent call on Hackaday for a powerwall built from Bird scooter batteries...

Re: they soon found out when Doctorow reached out to colleagues at the EFF

And in the US, if all you need is a stern letter bearing a lawyer's letterhead, this can be done cheaply enough that pretty much anyone can afford it. If there's a legal assistance service in your area, this might even be as cheap as free.

Yep. My neighbor is a lawyer (among other pursuits) and she once wrote a stern letter of that sort for me, for a $1 retainer.

That's how these things often go. There's a quick round of bidding to see if one party will just fold immediately. Then if everyone stays in, things might start getting expensive.

Re: Even if you couldn't replace the board

Edison would have loved that.

If I could turn back time, I'd tell you to keep that old Radarange at home

precursor?

Amana (Raytheon) Radarange oven, circa sometime after 1967 – the precursor to the microwave oven

The Radarange line was a line of microwave ovens. They were not "precursors". They used microwave-generating magnetrons, just like other microwave ovens.

And by 1967, the Radarage line had been in production (by Raytheon) for about 20 years, so this wasn't even an early model - though 1967 was when Amana started selling consumer (as opposed to commercial) units.

CES flicks the off switch on massager award… and causes a buzz

Redundancy, in case one packet gets dropped.

Facebooker swatted, Kaspersky snares an NSA thief, NASA server exposed, and more

harmless fun

anyone who still thinks swatting people is harmless fun

I don't believe I've ever read an account of a swatting case where the swatter plausibly claimed he (I don't know of any female swatters) thought it was "harmless fun". Swatters are nasty, violent, and probably manifesting some form of antisocial personality disorder. They're perfectly aware that swatting is a form of violence. Was anyone surprised when swatter Mir Islam was arrested for helping to dispose of a murdered woman's body? I wasn't.

Re: Swatting

In the Finch case, Barriss (the swatter) didn't call 911. He spoofed a local number and called a non-emergency Wichita City Hall number, and someone there transferred him to the emergency services desk. Then Wichita PD took everything Barriss told them at face value, stationed themselves around Finch's house with weapons ready, and one officer fired seconds after Finch opened the door.

The department didn't do any critical thinking and an adrenaline-drunk trigger-happy asshole failed to control himself. And no, I'm not buying any "first responders have to make split-second decisions" bullshit - this is a direct consequence of police militarization, lousy training and procedures, poor screening, and a lack of consequences. You can't fix that by tweaking procedures at the 911 call center (and I don't think yours is workable anyway, to be honest).

This case has been discussed extensively by security experts and others. The Wikipedia article is decent.

Re: Why loathed care to elaborate?

Wouldn't it be great if there were some global repository of information you could query for general questions like this?

http://lmgtfy.com/?q=why+loathe+jira

It WASN'T the update, says Microsoft: Windows 7 suffers identity crisis as users hit by activation errors

Re: VA and TX in the US

Citation? I can't find any references to any such laws.

What's the fate of our Solar System? Boffins peer into giant crystal ball – ah, no, wait, that's our Sun in 10bn years

Re: Boom!

A diamond as big as the Marsport Hilton?

(Goddamnit, I just dragged that idiot Hilton back into the discussion, didn't I?)

Peak Apple: This time it's SERIOUS, Tim

Re: Too late - What happens on your iPhone stays on your iPhone.

Apple sell appliances. That has always been the strategy.

I don't think that's fair. The Apple //e wasn't an "appliance". It's only their post-1983 products that are aimed at people who just want a magic box of "stuff happens".

Kids these days.

Cyber-insurance shock: Zurich refuses to foot NotPetya ransomware clean-up bill – and claims it's 'an act of war'

Re: Eh, it’s Mondelez.

Shrug. I like cheap milk chocolate (though I avoid Nestle, as they are Satan's own foodmonger), and I don't really care whether anyone else knows, or does. I don't care if someone else eats Wonder Bread; why should they care what sort of chocolate I eat?

Re: An opposing point of view

I would have thought that contributory negligence - failure to patch - would have been the tack used by the insurance companies.

That would set a precedent with a strong chilling effect on the market.

When you insure for fire damage (in a stable, industrialized country), there are well-documented protocols to follow for the insured: building codes, fire codes, inspections, etc. It's pretty easy for the insured to be in compliance and demonstrate that.

With IT-security insurance, there are few or no regulations, depending on the business. There are no standard independent inspections, and no agreement on what you'd inspect for. Potential insurance customers know they'd have a hard time showing they weren't negligent. So if insurers look like they're going to weasel out of paying claims, the market will discount the value of IT-security insurance to the point where it's no longer a viable product.

The IT-insurance market is enough of a mess already. Policies are ill-defined, claims may be hard to prove (fires leave a lot of evidence; rootkits not so much), data for actuarial analysis is thin, the market is immature (so risk pools are small and reinsurance harder to come by), and it's largely untested in court. Apparently Zurich America have decided to risk the last, but as others have noted, there's an excellent chance this will settle out of court.

Before dipping a toe in the new ThinkPad high-end, make sure your desk is compatible

Re: Just

The whole reason I use laptops is because I'm often not at my desk. It would be tricky to use this arrangement when I'm 1300 miles away from my desk at my other house, for example.

I know many people like multiple monitors, but personally I just find it irritating. I used a multi-headed UNIX workstation¹ for several years earlier in my career, and found it ... fine, I suppose; but for the last quarter-century or so I just haven't felt the urge. There's always sufficient screen real estate for whatever I'm working on at the moment. I haven't even used virtual desktops in years, I think, not counting VMs.

Eh, tastes differ.

¹IBM RT PC running AOS 4.3, which was IBM's rebranding of BSD. X11 driving the monitors, though some of them I generally just left in character mode.

Great, you've moved your website or app to HTTPS. How do you test it? Here's a tool to make local TLS certs painless

Re: But why is it so complicated?

But this should be simple, and not require arcane knowledge, surely?

No. It is not, and does.

And that's just one collection of problems with the X.509 PKIX. There are others, and since that one was written, we've introduced a whole bunch of additional things to worry about, like algorithm deprecation, OCSP Stapling, and Certificate Transparency.

There are already plenty of toolkits and tutorials for creating test CAs and issuing certificates. That hasn't measurably changed the number of people with some understanding of the ghastly, shambling horror that is the X.509v3 PKIX (i.e., few); or the number of people who understand it well (a handful).

Valsorda is a good researcher, but frankly I don't think there's much to get excited about here. Anyone who's likely to use mkcert could probably have gotten by just fine with one of the hundreds of online tutorials using "openssl ca". True masochists could fire up Windows Server Cryptography Services instead.

People who don't test their TLS apps with certificate chains skip it because of the cognitive load, not because there aren't relatively easy tools. (Yeah, openssl ca isn't user-friendly, but it's a walk in the park compared to actually understanding the X.509 PKIX in any depth. Look at the problems caused by OpenSSL's enforcement of RFC 5280 timestamp rules - those were due to other TLS implementations generating non-conforming certificates.)

Just updated Windows 7? Can't access network shares? It isn't just you

Some people routinely have to do things with administrator permission. One of the products I work on, for example, must load a number of its assemblies from the Global Assembly Cache. Updating the GAC requires elevated privilege (thank goodness); so whenever I build that product, I have to do so as an admin.

Using domain admin for local development tasks would be idiotic, thus it's a local-admin account.

Windows is still (!) terrible at switching accounts¹ for command-line and GUI applications. So-called "Fast User Switching" is not nearly fast enough and far too cumbersome to be useful in this context. The closest thing Windows provides to hybrid limited-privilege and elevated-privilege operation within a session is strong UAC (i.e. require explicit elevation with credential prompt on the secure desktop). UAC isn't a security boundary but with the strong SecPol setting the split token does close most of the straightforward vulnerabilities.

I haven't checked whether LocalAccountTokenFilterPolicy applies to UAC-downgraded tokens as well. It'll be interesting to find out. The point, though, is that Windows continues to encourage abuse of the Local Administrators group, not so much because of failings in the base OS, but because Microsoft refuses to try to get the user interaction model and user experience correct for people who actually need routine privilege elevation. Hell, Richie did a better job in this area just by inventing setuid and su, and that was in, what, 1971?

¹Thread security tokens, to be more precise.

I'm just not sure the computer works here – the energy is all wrong

Re: No interference?

It started as a joke, but became lore when many people didn't get that it was a joke. Hackaday recently did a piece on various symbols and marks that appear on electronics, and there was some discussion (in the comments, if memory serves) of "China Export".

Re: No interference?

Cheap LED lights are likely to be false economy anyway - while the LEDs themselves might last for a decade, the electronics are often dead in a year. There are a number of stories on sites like Hackaday from people who take apart dead LED lights and repair the electronics.

Until now, if Canadian Uber drivers wanted to battle the tech giant, they had to do it in the Netherlands – for real

Re: Why Uber?

Uber drivers are still licensed [taxi] drivers. They still have to pass the same tests.

Not in the US, they're not. While there are no Federal requirements for taxi drivers in the US, many local jurisdictions require they have commercial license, and many use a medallion or similar licensing system as well.

Taxi owners usually carry, and in some jurisdictions may be required to carry, taxi insurance. Uber provides supplemental insurance to their (non-commercial) gig drivers, but I haven't seen any reliable claims that it's equivalent to taxi insurance. In any case, the two situations aren't identical.

You don't say what jurisdiction you're in, or provide any other support for your claim, so my guess is you're full of shit.

Re: Uber is a ponzi scheme

He doesn't. For precisely the reason cited.

Nor do I.

My employer has recently announced that they're "partnering with Uber" for business ground transportation, and asked us to register with the company. Nope. I'll pay for my own ground transport. It's a small concession to maintain my ethics.

Jeep hacking lawsuit shifts into gear for trial after US Supremes refuse to hit the brakes

extraordinary recall?

an extraordinary 4.8 million vehicles

I suppose that's literally true, in the sense that it's out of the ordinary, but it pales in comparison to Ford's 1980 recall of 21M vehicles. Or their 1996 14M-vehicle recall. Not picking on Ford here - they just have three of the top five. And, of course, the size of a recall will be affected by how popular the brand is, and how much the manufacturer is able to achieve efficient reuse of components and designs across the product line.

Sure, Jeeps and other FC products generally suck, to a first approximation. I don't think they're extraordinarily sucky, though. Just ordinarily.

(Also, to be fair, cars these days are much better in pretty much every way than they were in the 1970s, with a few exceptions for value or aesthetics; much better in most ways than they were in the 1980s; and significantly better than they were in the 1990s. I'm not a fan of today's huge, overpowered vehicles, but they are far more reliable than the ones I drove when I were a lad.)

Re: So...

The "phone app" shipped for your vehicle is actually a proxy and most manufacturers tell you very little about what it does.

Indeed. I declined to install the Volvo app when my wife bought her XC60 last year, and I suspect I'll never buy another new Volvo - or any other make of car. My 2015 Volvo XC70, with its blissful lack of "connectivity", might be the last new car I ever have. I know too much to trust any of the manufacturers.

Re: So...

A lot of audio systems have the option to increase the volume as the vehicle speed increases. But this can be fixed by making the communications one-way.

For many years we did not have this feature, and many of us survived.

Senator Wyden goes ballistic after US telcos caught selling people's location data yet again

Re: Just

"Things were bad previously, so they can't possibly be worse now."

Re: Re-seller

An MVNO uses a regular carrier. I would not be too sure that the carrier is not able to get to your whereabouts.

That's not in dispute. The question is whether MVNOs can also get your location data (via their agreement with the carrier) and thus also sell it. I'm not sure that's any worse (the carriers are happy to sell it to all comers, so it's not like the MVNOs would be increasing the supply), but it's conceivable that an MVNO might be able to undercut the carrier's price, or might be more likely to lose the data in a breach.

Personally, I suspect the MVNOs don't have access to the data, unless they buy it at the going rate from the carrier, so there's no additional exposure. But that's just a guess.

Excuse me, sir. You can't store your things there. Those 7 gigabytes are reserved for Windows 10

Re: I think I can spare 7Gb out of the 8Tb I'm using for storage at the moment.

Damn an 8tb primary drive must be slow compared to an SSD!

My new (employer-supplied) Dell laptop with an SSD and Win10 is much slower than my old (employer-supplied) Dell laptop with a conventional drive and Win7. "Much slower" as in building one project takes around 170% as long, on average, on the new one, compared to the old one. That's with multiple runs on both machines, and otherwise idle.

What SSD giveth, Win10 taketh away. And then some.

Hands off that Facebook block button, public officials told by judges in First Amendment row

Re: I am curious to see how this works out.

["cries". Argh.]

Irrelevant to the existing case, which is about government officials using a particular feature of a social-media platform for what can be seen as official statements, and whether such officials can block readers or respondents.

In the Facebook case, Randall had a Facebook page she treated as an official government forum. The court ruled she cannot block someone from that page, because it serves as such a forum.

In the Twitter case, the courts have ruled that Trump is using his Twitter account as an official channel of public communication, and so he is not allowed to block people from it. Same reasoning: when acting as a public official, your right to restrict access to your public communications is limited.

Your example says nothing about where the communication is taking place, and in particular whether it might reasonably be considered an official channel. More importantly, in this context, you're not asking about whether the official making the statement is trying to block access to the channel. And that's what these cases are about.

Finally, in the US, an official acting as such has very limited scope to suppress any expression, regardless of who might consider it "hate speech". SCOTUS has (unfortunately) given the FCC considerable leeway in constraining expression in certain media in certain circumstances,¹ but that doesn't apply to social media.

In short: No.

On the other hand, nothing prevents Facebook or other soc-med companies from blocking or removing anything they (don't) want. Freedom of the press is for those who own the presses. They're not obliged to reproduce anyone's expression.

¹Based on a medieval dread of communications which can "penetrate walls". Seriously, that decision was just short of calling radio witchcraft. A pathetic display of the fear of change.

Re: Unexpected consequences

would the government have the right to block Russian trolls from posting?

Assuming you're talking about the US Federal government, and by "the right" you mean whether such action is likely to withstand scrutiny by SCOTUS, then probably no. The First Amendment's prohibition on prior restrictions on the press does not apply only to publications by citizens.

With the States I think it's less clear. Common wisdom is that the Bill of Rights, including the First Amendment, applies to the States only due to the Fourteenth Amendment. And the Fourteenth does refer explicitly to citizenship: "No State shall make or enforce any law which shall abridge the privileges or immunities of citizens...". The second clause, requiring due process, applies to "any person", but doesn't appear to cover freedom of expression.

That leaves the third clause, the famous "equal protection" one. That applies to "any person". But does it mean that all rights of citizens are automatically conferred on non-citizens? Historically it has not been interpreted that way, of course; otherwise there'd be no advantage to holding citizenship.

There are also questions of jurisdiction. The equal-protection clause applies to "any person within [the state's] jurisdiction", and typically Russian trolls aren't physically in any of the US states. And how exactly would a state go about banning some activity on a website anyway? Does the site need to be controlled by a party resident in the state? Or with a "physical presence", the rule used for assessing sales tax for Internet sales?

IANAL and all that.

If not, are we just inviting more intrusion and interference in our political process by foreign governments?

Irrelevant. I don't think you're going to find a bottle big enough for that genii. Foreign governments interfere with one another; that's a thing that has never not been true, for as long as governments have existed.

You were told to clean up our systems, not delete 8,000 crucial files

Re: The roots

As GUI based desktops became the norm, apps were strongly encouraged if not actualy forced to follow the desktop style guides, thus making it reletively easy for most users to get the hang of many new apps, at least at the most basic level.

I don't think that helped much, if at all. In my experience, UI standardization mostly provided users with a false sense of confidence and made it more difficult to recognize changes in context, so they'd erroneously try to apply knowledge about one application to another.

UI standards also constrain innovation. Often that's a good thing - GUI products that depart from the platform's UI standards often have abysmal user interaction models and user experiences. (Antivirus products are usually a good example of this, for some reason; apparently developers of security pablum all think they're great UI designers as well.) But it also means we're still using OSes with foolish "desktop" metaphors like Recycle Bin.

Border guards probe 'suspicious bulge' in man's trousers to find he's packing fluffies

Re: IT angle?

Needs more upvotes. There must be a fair number of Reg old-timers who remember UUoC awards.

LA Times knocked out, HackerOne slips up and – amazingly – router security still sucks

Re: Something's fishy

Kind of a tame article. I suggest a Google Images search for "parasitic isopod". Then read Wong's This Book is Full of Spiders.

Re: Something's fishy

Fortunately, she survived.

I find this story dubious. Surely anyone who's struck by lightning while being attacked by a shark gains shark-based superpowers. I'd expect at least the proportional strength of a shark and the ability to have a cartilage skeleton rather than bones.

Fraudster convicted of online banking thefts using… whatever the hell this thing is

Re: Revenge of the 80's

Are you sure that wasn't a 556, for Dual Tone?

Nah, it was a 555. We were just messing about generating single tones. I think my friend hoped to eventually build a working blue box, but probably lost interest before he got that far.

And that your muse didn't have a surname starting with 'W'?

If you're referring to my reference to Steve Ciarcia - no, it was definitely Steve Ciarcia, of Byte magazine's "Circuit Cellar" column. (And later his own Circuit Cellar magazine.)

New side-channel leak: Boffins bash operating system page caches until they spill secrets

dubious "fix" for QueryWorkingSetEx

The fix requires the PROCESS_QUERY_INFORMATION flag for QueryWorkingSetEx instead of PROCESS_QUERY_LIMITED_INFORMATION, so less privileged processes cannot directly access page cache information.

This approach - requiring higher privileges for an existing function - has limited merit. Applications which rely on the function (here QueryWorkingSetEx) will either lose functionality, or more likely will be changed to run with higher privilege; so vulnerabilities in those applications become more dangerous.

The Windows security model is already flawed with respect to a number of query operations. For example, excess privilege is needed to query whether a known process is still running - a common requirement, and not one that should require special privilege. The benefit of removing that side channel is dwarfed by the privilege leak.

PROCESS_QUERY_LIMITED_INFORMATION was introduced in Vista / Server 2008 (if memory serves) specifically to improve privilege granularity, following the principle of least privilege. This change reduces its usefulness.

Re: What the Bot?

There's a side channel in this vulnerability, not just a covert channel. The side channel is page cache presence.

Fake 'U's! Phishing creeps use homebrew fonts as message ciphers to evade filters

Re: People stil falling for the fake email.

Yes, people still fall for cons that other people find obvious.

Blaming users for security errors has gotten us nowhere. There are many users, they vary widely, and we're not going to be able to train them all to resist all attacks. In fact, we're not going to be able to train any of them to resist all attacks. IT security experts get spearphished. Constant, perfect vigilance is impossible.

We have to build safer systems. We can't build safer users.