Posts by Doctor Syntax

Huge ransomware outbreak spreads in Ukraine and beyond

Re: Possible Password Generator to recover files etc

Useful if it works but AIUI that was for the original Petya. If that's the payload then fine but current reports say it isn't.

Re: The next stage

Try telling that to HMG. OTOH the comment about a Bitcoin exchange manager and bat sounds possible.

"someone talking about it attacking the MFT of NTFS - that's a more severe attack than the MBR."

Providing the files themselves aren't corrupted something like photorec reads the sectors, tries to work out what they are and copies the results out to fresh media. Obviously it depends on the extent to which the files are fragmented. If the files are encrypted then it depends on whether they're overwritten. The only experience I had with this was with ransomware that wrote out the encrypts as new files and deleted the old ones which, of course, just marked the files' sectors as free but didn't do anything to the contents. The only problem was sorting out real images from junk heap of odds & sods from the browser cache.

If it's just the MBR being encrypted then presumably something like Photorec should recover files. However according to https://www.infosecurity-magazine.com/news/ukraine-businesses-petya-ransomware/ it encrypts files as well as the MBR.

Watchdog slaps NHS for failure to tackle correspondence backlog

Re: Bah!

"They should be jointly and severably liable. SBS and Sopra Steria cocked this up. Just send them the bill and leave it to them to sort out who pays what."

From TFA The NHS Shared Business Services is a joint venture between the Department of Health and Sopra Steria set up in 2004 to provide support services to the NHS.

It's not SBS & Spora Steria, it's DoH & Sopra Steria so any costs involved in working out how to split the costs will be at public expense, as will the cost of fixing it.

Former GDS head Mike Bracken quits Co-op

Re: Huge payoff for Mike...

OK, who remembers their old divi number? Ours was 1101 which seems a nice binary number if you're not superstitious.

Good

That was my first reaction. But then I read that he'd left to do whatever it is he does on a larger scale.

The 'DUP' joins El Reg’s illustrious online standards converter

I wonder when May will get deduped.

Re: Or half a million Archers

Surely it should be 1,000 Bernies.

50th anniversary of the ATM opens debate about mobile payments

Without cash how do you do a cash in the back pocket deal? Asked out of sheer curiosity of course.

Para 3... "depisit checks"

What's a check!? Damned Yank-isms!

What's a depisit?

HMS Windows XP: Britain's newest warship running Swiss Cheese OS

"Most what? Warships? Banks? Pensioners?"

As far as I can arrange it pensioners round here are running Linux.

Isn't it called Windows for Warships?

We'll drag Microsoft in front of Supremes over Irish email spat – DoJ

Re: Why not start a relocate?

"So they definitely have contingency plans."

Presumably the German arrangements are part of those.

One day the US might look back with regret on the days when it had a tech industry.

Re: Doubling up

"I presume the suggestion is that there should be new US legislation allowing them to retrieve things held overseas without bothering to consult with that nation's government/law enforcement."

Given the attitude they've taken I'd have thought they'd want US legislation that makes it quite clear that the US's jurisdiction is limited to the US and that the appropriate treaty arrangements must be used.

Re: They already have a legal route

" Even if there were anything in Irish law to prevent Microsoft's US employees handing that data over if they have access then there's no way to enforce it."

1. Big fines - and even bigger if it gets strung out until next May.

2. Privacy Figleaf completely shrivelled out of existence.

Oh what a tangled web we weave when first we practice to deceive.

"The issue, overall, is fairly complex"

It shouldn't be. There are treaties in place which lay out due processes to be followed which would have enabled the relevant prosecutor to get the information they wanted without trampling on anyone else's sovereignty. For reasons best known only to themselves - arrogance, ignorance or indolence - the US authorities have opted to ignore them. The apparent complexity arises out of that.

"${US Co} contracts with ${NonUS Co} for data center and storage service located physically outside the US ... Where does the US government go for assistance when they find a US-based (alleged) criminal enterprise is using ${US Co}'s service for its email and data processing needs?"

To exactly the same place where they should have gone in this case. To the courts of the country where the servers are operating via the MLAT which exists for this exact purpose.

It's called due process of law. Of course other countries' courts might take a dim view of that well-known US abuse of process, the fishing expedition.

Software glitch led to London Ambulance Service outage – report

I particularly liked the way their fourth review was to review what they should have learned from previous balls-ups and didn't.

Re: Oracle "Recycle bin"

"So you ask the database to delete something, then you have to ask the database to *really* delete it."

Or maybe really, really delete it. Or even really, really really delete it.

My brief encounter with Oracle simply left me with the feeling that it was thoroughly obfuscated. I'm glad I was able to make my living with saner alternatives.

US engineer in the clink for wrecking ex-bosses' smart meter radio masts with Pink Floyd lyrics

"So the next time I'm drunk and hacking, I won't be bitter."

Just do it in the right spirit.

Re: A member of the University Rock Climbing Club

Amateurs. In my first year at KCL the Tower of London was taken over. Someone had noticed that the guard hut door opened outwards. Smuggle in a long enough length of rope...

Re: "Sack employee without changing passwords he had access to? Root passwords? "

"Still, it does sound a little like blaming the victim though, doesn't it?"

Not really. They were both abusing basic security, albeit in two different ways. If, say, this guy had been more adept at covering his tracks and there was a current employee might easily have come under suspicion. Changing the passwords ought to be routine and is in everyone's interest.

"As far as a master hacking ring. That's insane. That is... I mean I wish I had that skill."

He didn't need to. Sack employee without changing passwords he had access to? Root passwords? The company should have been charged as well.

Researchers blind autonomous cars by tricking LIDAR

Re: Interesting research

"outside ... its design parameters (since corrected)"

If I were to trust my life to an automatous vehicle (and with trials permitted on public roads I might have no choice) I'd want the design parameters to cover what actually can happen on the roads, however unlikely. A vehicle from one carriage way turning across another at a road junction doesn't sound like something that ought to have been outside design parameters in the first place. Correcting design parameters after obvious omissions have come up against reality isn't the best way to proceed. And just wait until one of these ventures down a Devon lane with passing places.

Re: Interesting research

"t is worth mentioning, btw, that current production systems use optic and/or radar "vision", with LIDAR being very much an emergent technology in this application. At least one manufacturer (Tesla) currently has no plans to use LIDAR in their cars."

And radar is surely going to be subject to the same attacks. The "dar" in their names is a clue - it means "direction and ranging" in both cases. Optical sensors are also going to be subject to dazzling, at least in low light levels.

"At least one manufacturer (Tesla) currently has no plans to use LIDAR in their cars."

And Tesla has already been shown to miss a large object in front of it under adverse seeing conditions.

"M25 grinds to a standstill."

In other words it'll be completely ineffective.

Re: So what would you do if you were blinded while driving?

"You'd slow to a stop and pull over to the best of your ability, using your last memory of the road ahead."

Not so easy if it's on a multilane road and is now blind to traffic between itself and the side of the road. If multiple vehicles are being attacked there may already be a stationary vehicle at the side of the road waiting to be hit from behind.

Idea to encrypt stuff on the web at rest hits the IETF's Standard Track

Re: Essentially it's a move toward untrusted hosting, which sounds like any cloud server to me

"Toss up between trust and major inefficiency."

You sound surprised that implementing something, in this case trust, should have a computational cost greater than not implementing it.

Google hit with record antitrust fine of €2.4bn by Europe

Re: Next up -Microsoft...

"Microsoft are constantly trying to force me to use Edge and Bing, just because I use Windows... How is that ANY different?"

Yes, other market abuses are available. But why do you expect a news article to deal with other issues which aren't in the news today (and if they were would have their own article)?

Encrypted chat app Telegram warned by Russian regulator: 'comply or goodbye'

"Refusal of terminal encryption in a single country will make tens of millions of people vulnerable to ... blackmail [by] the corrupt officials.”

Could this have something to do with it?

US Copyright Office suggests 'right to repair' laws a good idea

The first sentence of the second paragraph of the executive summary (executive summary - six and a half pages: do executives read that far?): "In enacting section 1201, Congress aimed to create a legal foundation to launch the global digital online marketplace for copyrighted works."

Is everyone OK with putting an act of Congress and global in the same sentence?

Microsoft recommends you ignore Microsoft-recommended update

Re: "and a security improvements"

No, it was several security improvement.

Linus Torvalds slams 'pure garbage' from 'clowns' at Grsecurity

Re: Ego Overload

"Torvalds is a joke"

I say, isn't that a bit ad hominem?

Re: Ego Overload

"Adults swear, and by golly he's fully entitled to use the full length and bredth of the English lexicon to get his points across."

Actually he's made life a bit more difficult for the usual suspects this time. He didn't swear.

"I don't think you understand how libel works"

Imagine this reaching court.

Both sides would set out to prove the truth of their positions. How?

They could call expert witnesses. Who would have to be acknowledged as the leading expert on the Linux kernel?

Men charged with theft of free newspapers

"It's advertised as free at the point of consumption."

Unless it's printed on rice paper consuming it seems a bad idea.

"The paper isn't really free, it's paid for by the advertising companies. The assumption is that every paper handed out will be read by at least one person, and thus the fee set for the advertising space."

True. But the public (including the accused*) aren't party to the agreements so why should they be bound by them?

*Unless they're running the sort of circulation-boosting scam mentioned elsewhere.

Re: Nothing is 'free'

"'Free' is not the same as 'worthless' or 'without value'. Just how many commentators on here don't realise this is outstanding."

I think you're missing a couple of points here. One is that commentards are free to apply their own evaluations of the said rag and do find it to be worthless other than as a raw material. The other is that if the papers are offered to be taken away free of payment without clearly displayed T&Cs than it becomes difficult to characterise taking away large numbers as theft.

"Apparently it is not allowed to dispose of household waste in a public litter bin."

So why is it legal for marketroids to dispose of non-household waste in my letter box?

"an admonishment not to be seen in front of the courts again"

Preferably delivered to the prosecution.

"It would get really boring if all obvious things had to be written down."

OTOH it's useful to quote what you're replying to, especially with the way threading works in these parts.

Australian govt promises to push Five Eyes nations to break encryption

"Do politicians not have technical advisers to tell them why this is such a bad idea?"

No they have advisers who tell them what they want to hear.

Re: Conservative = tech-illiterate ?

Why do especially conservative governments tend to act completely incompetent and/or illiterate with regard to technology in gerneral and encryption in particular?

FTFY. Conservative governments have no monopoly in this respect. We've had plenty of experience with Labour govts. being just as bad whilst paying lip-service to technology (the white heat of this scientific revolution etc).

UK parliamentary email compromised after 'sustained and determined cyber attack'

"How? They're all a collection of pompous, self-obsessed, talent free clowns,"

Generalise much? I agree the Lords are somewhat better, as some of them are appointed specifically for expertise elsewhere.

But even accepting your description at face value they're currently a collection of pompous, self-obsessed, talent free clowns who have just had a nasty shock about their online security and are, therefore, likely to be receptive to being told about such things right now.

BTW, why not improve the quality of Parliament by standing yourself? Or would being dismissed out of hand as a pompous, self-obsessed and talent free clown put you off?

OK, it's fun to make fun of MPs. But we should be able to do better than that. We should be turning this into a teaching opportunity.

For instance Liam Fox, who is a minister, is reported by the Beeb as saying "And it's a warning to everybody, whether they are in Parliament or elsewhere, that they need to do everything possible to maintain their own cyber-security." El Reg should ask him - or reach out to him if they really must - what part he sees end-to-end encryption playing in this. Because I doubt more than the minutest handful of them realise the role that has to play in securing everyday services that we all use.

Re: If it did not have 2FA or certs it was asking to be hacked

"But random sequences of characters?"

That looks like random keyboard mashing than anything computer generated. Look at the pairs of adjacent keys in there.

Researchers solve screen glare nightmare with 'moth-eye' antireflective film

"Ambient light is everywhere,"

"The bleedin' obvious"

Intel's Skylake and Kaby Lake CPUs have nasty hyper-threading bug

Re: Linux to the rescue?

"Current Linux distros (Ubuntu from at least 15.04 on) have a "3rd party driver" feature to update the CPU microcode. Both, for AMD and Intel."

Such mechanisms have existed since the days of oops-I-can't-divide. So why are Debian saying it can't be fixed except by motherboard firmware?

Does current firmware shut the door on such mechanisms? That might be done for security reasons - block malware that attempts to rewrite microcode - but if so there needs to be a better way to fix it than depending on motherboard manufacturers getting round to distributing upgrades, always assuming they can be bothered.

Re: This is gonna suck.

"Do Not Take Your Computer To Best Buy!"

Similar businesses are available in other countries.