Posts by Henry 8

Open source project fools AI scrapers with poisoned font

The problem there is still the presumption that the consumer of your html is either a) a "real genuine human" interacting with the webpage in a way that you expect "real genuine humans" to do so, or b) an evil AI bit that must be stopped. Consider the following:

1. accessibility devices/screen readers/etc

2. search engines

3. browser plugins (ever head of tampermonkey?)

4. legitimate crawlers (maybe I'm a researcher trying to map usage of the phrase WibblySplong across some set of websites. I've written little scripts that "curl https://ticket-sales.com | grep "Tickets available" to run via cron and mail me. Yes there are still plenty of sites where that works today, though obviously none of the big ones)

5. web archive tools

6. etc etc etc

I'll end by quoting the opening sentence of the RFC 1866 abstract: "The Hypertext Markup Language (HTML) is a simple markup language used to create hypertext documents that are platform independent. (emphasis mine)

Accessibility nightmare

"Screen readers used for those with visual impairment also have trouble with it too". Presumably it also fails (I.e. displays the raw nonsense version rather than the "real" content) if you override the site's suggested font, whether that's for accessibility, personal preference, or any other legitimate reason.

Sounds like a cute tech demo but completely impractical for real use.

Clear your calendar, Drupal user: You have a critically urgent patch to install

Drupal CMS

"To reiterate, this vulnerability is found in Drupal core, the bare-bones version of Drupal designed for developers, and not Drupal CMS..."

Umm. Drupal CMS is just a nicely packaged version of Drupal, and (from Drupal's site) "Drupal CMS 2.0 is built on top of Drupal Core 11.3". Thus users of Drupal CMS should absolutely be ready to update.

Cursor-Opus agent snuffs out startup’s production database

If I were to run: curl https://example.com/rm_r_f.sh | sudo bash, I think it's fair that I take the blame for giving a random untrusted third party the ability to run arbitrary shell commands on my server when it all goes horribly wrong.

If I give an AI bot the ability to run arbitrary shell commands on my server: same comment.

Microsoft releases Windows Server update fix to fix its April update fixes

Re: so....

Access the disk somehow (e.g. turn off and mount the volume if it's a VM, boot from a Linux iso if physical, etc).

Replace c:\windows\system32\osk.exe with cmd.exe

Boot, open the on screen keyboard at the login screen, get a system cmd prompt instead.

Hope you can run wusa /uninstall or whatever

Profit?

(See also KB5009557 etc which similarly knackered lsass leading to endless reboots of DCs)

NHS pays £46K to prep next Microsoft licensing round

"with a valuecost of about £774 million."

FTFY.

US state laws push age checks into the operating system

Whilst DB48X is available as an app, it looks primarily to be firmware installable on specific calculator hardware i.e. an OS (though perhaps not "general purpose" but OTOH IANAL, HTH)

Microsoft reportedly eyes E7 tier to make AI agents pay their way – like the humans they'll replace

Skynet

Don't give the AI ideas about "terminating employees"

UK copper fired after faking keyboard taps using photo frame

Re: Typical HR

Number of key presses is an awful measure of productivity, but a police officer who is willing to lie and deceive at work has no business being a police officer.

Logitech macOS mouse mayhem traced to expired dev certificate

Re: Why is prof relying on a dev cert?

https://www.reddit.com/r/logitech/comments/1q66q1l/comment/nyeck29/?utm_source=share&utm_medium=mweb3x&utm_name=mweb3xcss&utm_term=1&utm_content=share_button

"There is some misunderstanding of what the certificate is. It has no online connection dependency. It is a developer certification that is extremely common on macOS apps"

That makes it sound like it's just a code signing certificate. Note "Developer certification", not "certificate from a development environment"

Microsoft reports 7.8-rated zero day, plus 56 more in December Patch Tuesday

Re: Ohhh No

There was a big change in how the Linux kernel assigns CVEs a year or two ago: basically any bug in the kernel hrs one. Quoting e.g. Suse,

"it’s important to understand that this means almost any change merged into a stable kernel now receives a CVE ID, often without rigorous upfront security categorization. Consequently, many assigned CVE IDs may relate to changes with no significant security impact. "

Cloudflare broke itself – and a big chunk of the Internet – with a bad database query

Re: Who watches the global kill switches? -- Rust is well named.

The underlying error - hit when the file discussed became much larger - was in rust code, actually:

"The FL2 Rust code that makes the check and was the source of the unhandled error is shown below:"

A quick Google suggests "FL2" is their rust-based replacement to "FL" which is written in .... PHP.

This isn't intended to be a rust vs PHP comment, though When you move a large complex piece of software from X to Y you are going to introduce (or reintroduce) bugs unless you have a thorough testing regime.

End well, this won't: UK commissioner suggests govt stops kids from using VPNs

Goddamn autocorrect. I have nothing against the Cornish and have no reason to circumvent them.

The UK pornwall, OTOH ...

"This could be achieved by amending the Online Safety Act to bring in an additional provision which would require VPN providers in the UK to put in place Highly Effective Age Assurance..."

Surely for this idiotic idea to work we would require VPN providers *outside* the UK to implement checks. Those of us *in* the UK will not be able to use a UK VPN provider to circumvent the Cornwall.

Birmingham City Council's £131M Oracle rebuild in danger as go-live nears

Re: A future case study in why big IT projects fail

The University of Cambridge has a current "HR transformation programme" called myHR. Google will lead you to announcements that this "will launch in the summer of 2024". I'll let you guess how smoothly that's going.

Stop flooding us with AI-based grant applications, begs Health Institute

Malgorirhms

As i read this story, I see an advert from a Highly Profitable Enterprise scroll in the background behind the story. Tagline: "Are AI challenges slowing you down?"

Google’s Gemini refuses to play Chess against the mighty Atari 2600 after realizing it can't match ancient console

The only winning move is not to play.

Microsoft is about to retire default outbound access for VMs in Azure

Re: "things will break"

"Things always break - even especially when they're not supposed to". FTFY

Signal shuts the blinds on Microsoft Recall with the power of DRM

Re: Copying

If something is shown to a human, it can be copied. Even if I have to write it out with actual pen and paper, pop it in an envelope and go to the post office to get the copy to you

Microsoft revives DOS-era Edit in a modern shell

Those who do not understand (how to exit) vim are doomed to reimplement it, poorly.

:wq

Re: I think there's a lot to be said...

What an awkful pun.

Ghost in the shell script: Boffins reckon they can catch bugs before programs run

Re: Two easy bash script tests

4) set -u, to make using an undeclared variable an error (good for catching typos like FILENAME=$(foo) ; rm -f $FILENME)

'Once in a lifetime' IT outage at city council hit datacenter, but no files lost

Working differently

"Our services are still running, they're just working differently". I'll have to remmber that one the next I announce unexpected downtime to my users!

1,000s of Palo Alto Networks firewalls hijacked as miscreants exploit critical hole

Exploit details

The watchTowr writeup at https://labs.watchtowr.com/pots-and-pans-aka-an-sslvpn-palo-alto-pan-os-cve-2024-0012-and-cve-2024-9474/ has the exploit details.

1. Set an HTTP header of "X-Pan-Authcheck: off" which basically turns off authentication (!!)

2. Specify user=`$myEvilCommand` (yes, backticks...) which gets expanded via a PHP call that passes $user straight through to a shell (!!!!)

Words fail me.

'Alarming' security bugs lay low in Linux's needrestart utility for 10 years

Re: General Linux utility

The Qualys post everyone is linking to says "The Qualys Threat Research Unit (TRU) has identified five Local Privilege Escalation (LPE) vulnerabilities within the needrestart component, which is installed by default on Ubuntu Server. " which seems to have been widely misinterpreted (in every report I've seen on this issue) as "this is a bug in Ubuntu Server"

Why the long name? Okta discloses auth bypass bug affecting 52-character usernames

Double hashing?

> Passing the input through the SHA-256 algorithm can mitigate this, she said.

Unless your sha256'ed password happens to end up starting with a null, in which case you're in for a world of pain : https://blog.ircmaxell.com/2015/03/security-issue-combining-bcrypt-with.html

Summary: your bcrypt implementation perhaps uses null-terminated strings to know when to stop, as is traditional. Hashing algorithims like sha256 can end up returning a raw byte string, and so a sha256 hash might end up starting with a null byte. Thus, re-hashing the hash might mean you're really calling bcrypt(\0MySuperSecretPasswordHash) might be functionally equivalent to bcrypt(\0MyTotallyDifferentPasswordHash), or indeed just bcrypt(\0)

Campaigners claim 'Privacy Preserving Attribution' in Firefox does the opposite

"which can give advertisers the information they needwant to get their scummy paws on"

FTFY

I didn't touch a thing – just some cables and a monitor – and my computer broke

Re: Yeah, sure. Nothing changed. Pinky promise.

https://www.ncbi.nlm.nih.gov/pmc/articles/PMC7494048/ describes the standards to follow when naming human genes. I quote from the section on replacing problematic nomenclature : "symbols that affect data handling and retrieval, e.g. all symbols that auto-converted to dates in Microsoft Excel have been changed (SEPT1 is now SEPTIN1; MARCH1 is now MARCHF1 etc);"

Mega city council's Oracle ERP system still not legally safe, compliant... 2 years after rollout

You seem to be assuming that it's not possible to just successfully implement a new financial system for a large public organisation without then needing to perform _any_ kind of investigation.

Oh right. I'll get my coat.

AI hallucinates software packages and devs download them – even if potentially poisoned with malware

Re: So nobody ever tried the commands before publishing?

Bad guess. The README (which has now been updated) explicltly told users to run the command "pip install $WRONG_PACKAGE". FWIW it looks like the reason for installing the $WRONG_PACKAGE was just to facilitate downloading some data files, and this has now been replaced with a simple "git clone" command.

Attacks on UK fiber networks mount: Operators beg govt to step in

Re: Using phrases such as "Genetically predisposed to violence" ...

P(brexiteer | supports death penalty) != P(supports death penalty | brexiteer)

The Rev Bayes wants a word...

40 years since Elite became the most fun you could have with 22 kilobytes

The Google-provided analytics.js that is downloaded with this story (along with pretty much every webpage we all visit...) is 52kB, so over twice as big as Elite. I know which of those two products I think has brought more value to the world.

(yes I know my browser probably caches analytics.js and doesn't redownload it on every page I browse to, but that's not the point)

If your DNS queries LoOk liKE tHIs, it's not a ransom note, it's a security improvement

Re: Colour me surprised (in upper case)

The comment about email addresses is not strictly true. The domain part (after the @) is case-insensitive, but the local part (before the @) "MUST be interpreted and assigned semantics only by the host specified in the domain part of the address" (RFC 5321). Whilst in practice many mail servers will handle the local part in a case-insensitive manner, one shouldn't rely on that behaviour.

KCL external review blames whole IT team for mega-outage, leaves managers unshamed

"the core College IT systems and data and file storage were backed up on a different location of the same storage unit"

I'm sorry, but whatever organisational problems might also have been at play in the sorry episode, any sysadmin who thinks that copying data to the "same storage unit" can in any way count as a backup is incompetent.

Adobe preps emergency Flash patch for bug hackers are exploiting

Re: Meanwhile, Adobe plans to make Flash harder to maintain

One just has to register for distribution rights, once, for free. Took me about 2 minutes to fill in the form and get an automatic response. Yes, it's mildly annoying that they're taking away the old enterprise download links, but it's not difficult to use the replacement - I've been doing so for months.

Microsoft whips out PowerApps – now your Pointy Haired Boss can write software, too!

IFTTT

I haven't done a full comparison of the available features, but the "send email when there's a new tweet" thing sounds awfully like what one can already do (totally for free) on ifttt.com ("If this, then that"). That site also has a great many recipes that others have already written if one wants to copy something to get started.

Shingled drives get SpectraLogic archive down to 9 cents/GB

Independent failures?

The statement "probability of data loss to 1 in over 2 million years when properly monitored and maintained" sounds rather fishy to me. What are the chances that they've taken "failure rate for a single disk" and just multiplied that up N times, assuming that all failures are independent? Even if you declare lightning strikes and earthquakes as outside the calculation, disks that are hosted in the same environment, and which were probably all made in the same production run, don't have independent failure rates.

PINs easily pinched with iPhone-attached thermal imaging kit

So the article says that this technique doesn't work on keypads with metal keys. Well fair enough, but I've used a far lower-tech solution to bypass keypads (er, obviously, only to get in to areas where I *should* have had access but didn't have the code to hand...). Just look for the keys that have the slightly greasy residue from people's fingers - far easier, cheaper and lower-tech than thermal imaging cameras!

Phone hacking blitz hammers UK.biz's poor VoIP handsets

Thinly-veiled advert?

I agree that sysadmins should remember to include VoIP in their assessment of network security etc. However, I'm afraid I'm always going to be sceptical of a company-produced "study" which essentially ends in an advert where they tell you that the same company just so happens to sell a product which can help solve $problem_covered_in_report

Dell charges £16 TO INSTALL FIREFOX on PCs – Mozilla is miffed

Re: RE: service charge

I would be rather surprised if Dell were actually paying someone to sit for 10 minutes in front of a computer and hit "next". For the Windows machines I look after, I tick a box, and Firefox will automatically install on a computer of my choice. And for the case of the Dell website, the customer has already ticked the box for them!

Backdoor root login found in Barracuda gear - and Barracuda is OK with this

Re: 2 Class C's = "large range"?

"A /24" is a) shorter than "class C", and b) factually correct. Both are virtues, no?

Re: ...firewall off port 22 completely.

Nope, sorry, no mention of port 24 anywhere. The paragraph you're referring to did mention some /24 subnets. 192.168.200.0/24 means the addresses from 192.168.200.0 to 192.168.200.255. Go and read about subnets and netmasks

Re: 2 Class C's = "large range"?

CIDR has been around for 20 years now. Why do so many people who allegedly know about IT still think that class a/b/c networks exist?