Posts by cyberdemon

Bogus Kaseya VSA patches circulate, booby-trapped with remote-access tool

the phishing emails contain "an attachment named 'SecurityUpdates.exe'

Sounds legit..

UK's data watchdog probes use of private email to discuss government business at the Department of Health

Never mind Email

At least that is potentially auditable. But what about "Crony Government by WhatsApp"

Radioactive hybrid terror pigs have made themselves a home in Fukushima's exclusion zone

"given that the radioactivity levels are reckoned to be lethal."

No, Cs-137 is reckoned to be lethal, but the levels really are not so lethal.

The stupidity lies in " Indeed, surveys of the local boar population found they are contaminated by up to 300 times the safe human dosage of the lethal isotope caesium-137 [PDF]. "

The "safe limit" according to the PDF is set at 4 millirem/year. The pigs were exposed to 300 times that, which is 1200 millirem / year.

1200 millirem is pitifully non-lethal. It is equivalent to 12 millisieverts, where 4-5 Sieverts is actually the LD50/30 value for acute radiation exposure in humans.

And we're talking per year, so we'd probably assume the LD50 to be even higher for a dose spread over a whole year.

So while Cs-137 itself certainly is lethal, the "safe limit" is set so low, that even "300 times the safe limit" while sounding really scary, it is still 400 times lower than the dose that might kill you.

The disconnect between these "safe limits" and what is actually an "unsafe level" is IMO one of the main things that has killed the nuclear industry. Radiation is so easily "detectable" but impossible to see and therefore impossible for the public to quantify what the detector reading means.

So we set the limits based on a model that basically says "there is no safe limit", so we will set it at background. And because Cs-137 is a short-lived isotope, background for that isotope is basically zero.

IT for service providers biz Kaseya defers decision about SaaS restoration following supply chain attack

REvil demands US$70m for 'universal decryptor'

A better headline:

Doctor REvil holds world to ransom for "70 Meeeeellion Dollars!"

This nonsense [YWdlbnQuY3J0] means I'm looking for a file called agent.crt!

WTF?

They obfuscated this in a powershell script with a base64 string.. why?

So that they could pull the wool over the eyes of the Dutch Institute for Vulnerability Disclosure and appear that “They showed a genuine commitment to do the right thing,” by providing a magical detection tool?

Or because they are so cynical that they expect their recently-pwned customers to double click on an obfuscated powershell script and run it, rather than just telling them to look for a file called agent.crt?

Leaked print spooler exploit lets Windows users remotely execute code as system on your domain controller

Re: You can use group policy to allow non admins to install print drivers.

Yes exactly if only Windows supported libusb properly then you wouldn't need kernel drivers for most things.

But anyone who has tried using libusb-win32 has encountered a world of pain, because windows sucks. so there :P

Re: What the ever-loving frak ?

More like, what the frak is a print spooler doing accepting "drivers" from network clients?

Or, what the frak is a printer doing requiring a 'driver' running with system priveleges?

i.e. Why the ducking fuck are printer drivers not standardised, or at least run in unpriveleged userspace?

8-month suspended sentence for script kiddie who DDoS'd Labour candidate in runup to 2019 UK general election

Re: impressively balanced

An impressively balanced comment, have an upvote

FYI: Today's computer chips are so advanced, they are more 'mercurial' than precise – and here's the proof

Re: Error detection

Nah, they'll just hide the errors under layer upon inscrutable layer of neural network, and a few arithmetic glitches will probably benefit the model as a whole.

So instead of being a function of its input and training data, and coming to a conclusion like "black person == criminal" it will say something like "bork bork bork, today's unperson of the day is.. Richard Buttleoyce"

UK Special Forces soldiers' personal data was floating around WhatsApp in a leaked Army spreadsheet

Example != Definition

"Military Intelligence" is the best example of an oxymoron ever invented.

Microsoft unveils its latest Cosmos DB lure for developers: More free stuff and an emulator for Linux

Re: CosmosDB is a bizarre choice

+1 for Postgres/JSONB.

Azure services fall over in Europe, Microsoft works on fix

> One of these days we'll automate these outage articles with some kind of AI

Oh yes just train up a generative text model in Azure AI Cloud ... Oh wait

Blessed are the cryptographers, labelling them criminal enablers is just foolish

> Born liars, the lot of 'em ...

Obviously that's hyperbole and not quite true. But there is certainly some survivor bias going on. :)

Any politician who cannot / does not lie, will not last very long in politics. (which sadly is a world where being honest about anything, especially your own mistakes, is the biggest mistake you can make)

The most successful politicians are born liars (so said Nico Machiavelli)

> those who are supposed to protect us and our privacy are one of the most immediate threats to it.

This.

"nothing to hide (from us) = nothing to fear (from us)" obviously makes a massive assumption about the benevolence of authority..

George Orwell literally wrote the book on this. It said that if an authoritarian system is allowed to exist in the first place, then it can guarantee its own stability in perpetuity by making up fake enemies and eradicating the idea of privacy, so that anyone could become the next enemy of the state, simply by disagreeing with whatever the party line is at the time.

Maybe we trust our government (hah!) But in cryptography land, taking account of the most obvious human factors like leaks of master backdoor keys, what is visible to the authorities is just as visible to the criminal neighbours anyway. So authoritarian government or not, banning strong encryption is obviously plain stupid, and that should have been the end of the argument, filed alongside the banning of opaque walls.

What's more, since when have real criminals respected a ban on anything?? :|

> Knives, cars, bolt-cutters, hydraulic jacks etc. etc.

Not to mention Computers.

@Jake

The point is, exactly that they are opportunists.

They don't go smashing the window of every car on the street (although they may try the doors) but if they see an expensive item through the window, they are likely to smash it and run.

It's a compulsive, risk-addictive behaviour, much like gambling. I once met a self confessed serial burglar who was trying to get straight, he'd scream out WHY do you bastards leave your stuff on the seat??!

I hadn't even noticed the unoccupied car with the handbag on the front seat.

If that handbag had been in the glovebox, he wouldn't have seen it and would've walked straight past, unperturbed.

Microsoft bins Azure Blockchain without explanation, gives users four months to move

Re: Not to worry

Plenty. But all of these would-be customers are locked-in with Oracle.

Where meetings go to die: Microsoft Teams outage lets customers skip that collaboration call they've been dreading

Re: "Microsoft? Roll out a catastrophically badly tested update? Surely not."

Hire people to test our code? Pay them money? Ha!

No, people pay us money and data to test our code. You have a spelling error in 'users'.

Penguin takeover: We tried running some GUI Linux apps on Windows the official way – and nothing exploded

Re: That's not the MS I grew to hate 25 years ago.

The MS you grew to hate 25 years ago was all about Embrace, Extend, Extinguish..

Has that changed?

MS are now making money off the backs of open source devs, while at the same time wresting control away from the open source community. And when they bought both LinkedIn and GitHub, they bought control over the reputations of individuals in that community.

They are just as evil as they were back in the Bill Gates days, but it's easier for them to hide because every tech company and its dog is doing the 'evil' thing now.. Even Google dropped 'don't be evil' from its corporate constitution. Amazon, Facebook, Google and even governments such as the CCP are all competing to see who can be the most evil these days, but Microsoft were evil before it was cool.

China has a satellite with an arm – and America worries it could be used to snatch other spacecraft

Re: Beat that!

You forgot to pick your icon, and your coat.

Go on, out you go.

Google is updating Meet so at least you won't have to look at your hollow, careworn face

May I just say

This article reminds me of how much I love the journalistic style at El Reg :D

Thanks "Richard Speed", you made my day.

Microsoft OneDrive for Windows 7 drives off a cliff for business users

Re: linshare

Interesting, never heard of it. But the website gives me odd feelings..

It indeed "looks" very polished, especially the design of their front page. But little details like the spelling of things like "In LinShare every actions and user activity is recorded within the plateform"

and "If confidentiality and traceability are paramount for your business file transfert, the LinShare is your solution and better yet it’s free ! We also offer high quality support services provided by our IT teams to suit your network at best."

just make me not want to go near it with a barge pole.

A subtle hint that it is time to move..

.. away from OneDrive??

Syncthing-over-Wireguard works wonders !

> I use Windows 7 to make sure that shite like OneDrive doesn't work ;)

I use Linux to make sure that shite like Windows doesn't work ;)

After years of dragging its feet, FCC finally starts tackling America's robocall scourge

Re: I am not sure if this is possible ...

I am getting scam calls from "HMRC" almost every day. Every time it is the same number as my own (mobile) number, but with the last 3 digits randomised. It's an aggressive scam: "criminal action is being taken against you, pay the fine now to avoid going to court"

The caller ID system both here in the UK, and apparently in the US too, is completely unfit for purpose. But the old system and the people who operate it are too well entrenched to change.

Spy agency GCHQ told me Gmail's more secure than Microsoft 365, insists British MP as facepalming security bods tell him to zip it

highly skilled professionals

are what crapita are best known for! Right, Dave?

(The public contracts & lobbying department, that is)

PHP repository moved to GitHub after malicious code inserted under creator Rasmus Lerdorf's name

Open source projects like PHP wouldn't be such a big attack vector if:

a) silicon valley & the tech industry at large wasn't making $beellions of cash off the back of them; or

b) silicon valley & the tech industry at large contributed some chump change actual engineer time to their maintenance

Satellites, space debris may have already brightened night skies 10% globally – and it's going to get worse

Re: Blankety Blank

Click them with your middle mouse button instead then!

The links you mentioned have always opened in the current tab for me (unless I middle click them) and I don't see anything wrong with that.

(Also Chromium on Linux)

Ruby off the Rails: Code library yanked over license blunder, sparks chaos for half a million projects

surely not

Even if I were still alive, I don't think I could tell people to cease and desist using or distributing code that I had released as GPL or MIT previously, could I?

Hacktivists breach Verkada and view 150,000 CCTV cams in hospitals, prisons, a Tesla factory, even Cloudflare HQ

Verkada

Such a great name for a CCTV camera monitoring employees' performance :(

They should Verkada on securing their bloody systems

MPs slam UK's £22bn Test and Trace programme for failing to provide evidence that it slows COVID pandemic

Re: 22 billion

All this makes me shudder in horror when I wonder who will be picked to cock up the "Digital Vaccine Passport" database when it is inevitably tendered for..

Microsoft settles £200,000+ claims against tech support scammers who ran global ripoff from cottage in Surrey

Re: And prosecution?

I came to the comments section to say the same. Why the @@@@ is this not a criminal matter?

So, have Microsoft at least passed their file to the police?

Presumably by the time the courts order compensation to the actual victims, this lot will have no money left, having just paid it to Microsoft (and squirrelled the rest of it away in the bahamas)

Popular open-source library SDL moving development to GitHub despite 'calamitous design choices' in git

Re: Calamitous design decisions in git

And then there's Git's submodules (which can definitely be called calamitous) , subtrees (which are a better implementation but an even worse user interface) vs mercurial's subrepositories, which I've never used, but I'm assuming are much better designed than Git's two competing attempts at the same thing.

ByteDance sues Tencent over lack of link love on its messaging services

Sorry, but WTF is a Medical Influencer?

see title

GitLab removes its 'starter' tier: Users must either pay 5x more or lose features

Re: mainstream

I know somewhere that DOES offer all the titles you want in one place, no tracking every millisecond you spend looking at each title before it autoplays in your face, no surreptitiously nudging you to watch what someone wants you to watch, no bullshit.

I wish that studios could just have a bitcoin address or something, so that I could get what I want AND pay for it.

Dropbox basically decimates workforce, COO logs off: Cloud biz promises to be 'more efficient and nimble'

> I don't want all this bollocks, I just want to synchronise, backup and sometimes share some files.

Exaxtly.

And when they decided to drop Linux users unless they use an outdated filesystem, it didn't even do that anymore.

They could have just ceased "official support" for other filesystems. But no, they decided to make their software try to force Linux users to migrate their filesystem. To me as a paid customer, that was aggressive, pig-headed and rude.

So Rather than migrate backwards from Btrfs to Ext4, I migrated from paid Dropbox to FOSS Syncthing, and never looked back.

JetBrains' build automation software eyed as possible enabler of SolarWinds hack

> Personally I bet it was intel

And you thought you were joking!

Considering SolarWinds was used by Intel too, even though Intel probably almost certainly wasn't a vector as you jest, it could be a vector in future!

If those guys got their hands on Intel's Management Engine special super-secret CIA keys, then the whole world is pwned.

What happens when a Chrome extension with 2m+ users changes hands, raises red flags, doesn't document updates? Let's find out

Easy solution: Build everything from source!

Run Slackware! Review the source of all packages line by line before you compile them from source! Throw out those binary blobs! Shun your Broadcom and your NVidia, and your Intel backdoored silicon, run it all on OpenSPARC on an FPGA! You will be immune from all bait-and-switch attacks.

What do you mean it's slow and it doesn't work?? :(

Brexit freezes 81,000 UK-registered .eu domains – and you've all got three months to get them back

Oh well

At least Leave.eu is no more..

Oh, wait..

Lenovo ThinkPad Carbon X1 Gen 8: No boundaries were pushed in the making of this laptop – and that's OK

built like a brick house

This is El Reg, not the BBC.

The phrase is "Built like a brick shithouse"!

SolarWinds releases known attack timeline, new data suggests hackers may have done a dummy run last year

Re: Signed updates

Of course they were signed!

Read the original FireEye report - it makes for grim reading.

This is why I prefer to do my updates manually, at least a few days late. But given that this 'update' lay dormant for 2 weeks before pwning the system, even that strategy may not have helped.

I really detest the idea of automatic software updates. It makes it too easy for a bait-and-switch by the software developer, a rogue employee, or someone who stole their signing key.

Search history can calculate better credit ratings than pay slips, says International Monetary Fund

Re: ? I don't think that is saying much.

Yes exactly.

One of those "Study shows that Bears tend to defecate in foliated areas, Pope confesses that he is a Catholic" articles.

Who'd have thought that a handful of regulated data on a person's financial transactions on a report output by a database written in COBOL in 1985, are less useful a predictor of this person's future financial solvency, than unregulated billions of data points about that person's everyday life, their romantic, erotic, gambling, purchasing habits, innermost thoughts, worries and secrets, the YouTube videos they watch, the friends they keep, the car they want, the holiday they are planning, the company they keep, and the Company they work for.

GitHub will no longer present a cookie notification banner – because it's scrapping non-essential cookies

Re: > GitHub .. has the power to collect and analyze the data itself.

It's also worth noting that the "usual suspects" of Google Analytics, doubleclick et al were all on my blocklist, (or rather, not on my whitelist) so they weren't tracking me anyway.

But if I block GitHub's cookies, GitHub stops working. So Microsoft can still track me, but now I can't stop them.

> I never understood that particular conspiracy theory.

That's because it's a fake one, propagated to discredit conspiracy theories in general. :P

Fake conspiracy theory: 5G gives you coronavirus. The Coronavirius vaccine contains microchips which track your every move

Reality (conspiracy or not): 5G contains microchips which track your every move

(part of how it works - see: https://blog.huawei.com/2020/08/17/the-wonders-of-5g-beamforming/ )

> GitHub .. has the power to collect and analyze the data itself.

Yes exactly. It takes power out of the hands of the usual Web tracking, analytics and other surveillance capitalists, and keeps it in the hands of Microsoft.

What could go wrong? :D

It's better to burn out than fade Huawei: UK rolls out schedule for rip-and-replace rules

Firmware updates

> Oh and you probably don't want to know how much of that kit hasn't had its firmware updated in ten years per more.

Am I the only one here who thinks that's a good thing?

Oh here, have this encrypted binary blob and flash your rootfs with it. I've even signed it, to say it definitely came from me. Will I show you what's in it? Don't be so paranoid! Just make sure you install it regularly every time I release a new one!

Of course, I'm not stupid, I know that zero-days exist in almost everything these days and that kit should be patched to plug them, but really, embedded stuff with a limited feature set like a 5G modem shouldn't NEED a complicated OS that is capable of executing arbitrary code, and if it's written right, there shouldn't be anything to update until the specification changes.

Right..

So in future all cheap IT gear to come from Weihua, Mao Telecoms, Alibaba, Taobao...

Other approved suppliers include: Mossad, GRU, CIA, Intel, MS & Google but they are a bit more expensive, re-badged Taobao units with the phone-home address updated.

Will this improve the UK's national security situation? Nope, it probably makes it worse (by poking a very powerful and already rather angry adversary)

Will it improve the British economy? Nope.. Certainly not for the 1000-2000 UK Huawei employees, many at the brand new Huawei UK HQ in Reading..

Will it appease the Labour peers and get Oliver Dowden CBE, out of hot water at Minifun?

Yes, Minister!

Uri Geller calls off 20-year ban on Pokémon trading card that 'stole' his 'signature image'

He at least deserves a "Me and my Spoon" column in the Private Eye!

Mysterious Utah monolith mysteriously disappears without trace

boo

I am disappointed to learn that this was not a solid ingot of metal.

By it being called a monolith I had assumed as such.

Considering the colonisation of Mars? Werner Herzog would like a word

Re: There’s hope yet!

So far nobody seems to have mentioned the lack of not just an atmosphere on Mars but a magnetosphere..

The ionising radiation on Mars that it receives from from the Sun is orders of magnitude more than that seen in the vicinity of Pripyat, Fukushimka etc. and is comparable to earth after an apocalyptic nuclear war, except without a breathable atmosphere.

No matter how much we have fucked up the Earth, it will be better than Mars for a very long time.

I for one will welcome Mr Musk to make his home there.. Send Bezos, Zuck and SatNads too!

I work therefore I ache: Logitech aims to ease WFH pains with Ergo M575 trackball mouse

> Pretty sure these existed back in the late 90's early 2000's - not a new idea...

But does it have the MagSpeed scroll wheel of the MX Master?

If so, I will buy one.