Posts by Joe Dietz

X says passkey reset isn't about a security issue – it's to finally kill off twitter.com

I'm all for getting rid of passwords, but passkeys != security

Passkeys have security value because it stops password reuse across domains and eliminates the need to write them down if I didn't and forces the attacker to shift tactics. But stopping credential theft outright, not as much.

For years now attacks have shifted focused on post-authentication credentials. It doesn't matter at all how you authenticate an account if you leave the resulting shared secret lying about on your local device waiting for somebody to drop by and read it/use it. OAuth tokens are particularly bad here because they are frequently not validated against other factors like the sending host (or even if they are, clever reverse proxies are not that unheard of), or even password resets (looking at YOU Gmail password resets!), have a long lifespan (again Google) and are frequently renewable (Google).

How malware vaccines could stop ransomware's rampage

I run a ransomware research system. We make no effort at all to cloak that we are running samples in a virtual machine. For certain _some_ do refuse to run when they detect the virtual machine... But we get healthy malicious activity from at least 30% of them. This is mostly payload execution, so in the real world the bits you want to hide from anti-virus and avoid analysis have already come and done their thing. So, while running vmware tools does prevent some infections... it's not a sure thing. It's cheap insurance though, so why not?

Chinese gang used ArcGIS as a backdoor for a year – and no one noticed

Re: They didnt have EDR obv

Read-only is a nice if you happen to be able to do it, and nearly impossible in most situations. There is a reason application control (aka whitelisting) hasn't taken the security world by storm. Outside of fixed function devices... just doesn't work in practice. But even that doesn't actually stop so-called 'in memory' attacks. Scripting existing binaries together without needing to write to the disk is very much a thing in many modern attacks.

They didnt have EDR obv

Its proffesional incompetence to rely only on antivirus. This should have been picked up by behavioral monitoring much sooner than a year+.

AV is pretty much a broken clock and has nearly no security value relative to its false positive rate at all.

Hundreds of millions of business PCs are still on Windows 10 as D-Day nears

I'm going to hold them to this promise of no more updating...

I've taken the view that no more updates is what I'm after. Honestly, about the only thing I *might* need an update for is a network facing unauthenticated 0day in the kernel. But I do have a firewall, so not that scared about it either. And for the rest, patched or not, your just as vulnerable since nearly all attacks involve HUMAN BEINGS sitting at the keyboard clicking on things. Can't patch that.

I for one welcome the new more stable windows 10 without 'updates' to break shit constantly.

Microsoft Surface 7 laptop: Nice hardware, shame about the OS

Re: I've long wanted an ARM laptop (for Linux)

You can run linux natively just fine if thats what you want to do. The firmware unlike a mac isnt locked. Just turn off secureboot and go.

Well it might actually be the hardware...

I have the same device but the 16GB version and run visual studio, docker, WSL2 (Unbuntu) and a virtual machine (running windows 11 arm) quite routinely. I only get about 3 hours battery doing that of course, but way better than the 1 hour I'm used too with an intel based system. But I too experience the occasional freeze-up train-wreck. It seems to be the nVME that may be the issue, I run some i/o stress tests routinely as part of my software build and any time they run, system stops responding. I've never had that problem with a similar ARM laptop that has a proper samsung nVME in it.

And yeah... the copilot button was a waste of paint. You can remap it of course to something useful.

Microsoft inches toward Rusty Windows drivers, production use still a no-no

Barking up the wrong tree as usual.

Most vulnerable drivers are vulnerable because the design exposes APIs that do dangerous things to anybody that happens to be able to load the driver. (I'm looking at _YOU_ DELL, HP, ASUS! ... and many many others...) an actual _exploit_ is rare and kind of a 'meh' issue when the design level problems are a bigger issue.

Forget the Space Force! Trump needs to create a Cyber Force, says think tank

This sounds far too intellectual

Why would anybody think the orange one would be interested in something that was thought out planned, or worst of all desired by experts?

Tested: Microsoft Recall can still capture credit cards and passwords, a treasure trove for crooks

Solution problematizing

The whole thing is very much a classic find a problem my solution solves! NPU being the solution DuJour. And ironically having created a massive (privacy) problem they are not using the NPU to solve it! Brilliant sh*t!

I expect whoever dreamed up copilot wasn't aware of 'browser tabs' which is more or less the reigning scheme for handling remembering wtf I was last doing... and its working just fine thank you.

Clear Linux OS terminated as Intel trims the fat

This is classic Intel. They get into something, pour lots of money into it and find a few customers... but do not become an instant success overnight... management pulls the plug hard and customers find out because the folks they worked with at Intel stop showing up to previously scheduled meetings. Nobody with more than a few years' experience would ever adopt an Intel technology that wasn't a core CPU chip because they don't have any staying power. Which of course is why they can't seem to find any markets outside of their core CPUs... nobody wants to work with Intel and get burned when they pull the rug out from under them suddenly in two years' time.

The only surprising thing here is that this distro had a 10 year run.

Open, free, and completely ignored: The strange afterlife of Symbian

Re: Of course we know how Nokia's dalliance with Windows turned out

I'm probably one of maybe 7 people... but I really miss Windows Phone. It was so much better than the Android I had to settle with. The real problem with Nokia using Windows was getting acquired by Microsoft which left no other device maker willing to look at it and the new Msft CEO only too happy to emphasize that the only future at Microsoft was Azure. If Nokia had remained independent with Windows Phone as an equal competitor to Android, Windows Phone would still be here and we'd still have the brilliant Nokia hardware.

Intel's leaders have stopped pretending – and it's about time

The first step to recovery is admitting you have a problem. Hopefully a step now taken.

NASA boss-to-be gets spaced as proposed budget cuts detailed

afterall why should space science be special?

If we aren't going to do R&D for things that matter directly to people - like medical research... why would we then continue to fund things that only indirectly make my life better?

I've no idea what motivates the fool, but his goal is fairly obvious - destroy the USA as a superpower... and NASA is very much symbolic of the USA being a superpower... its gotta go.

(basically, it's pretty simple: take the literal meaning of anything he says and invert it - that is what he actually intends to do).

Actors' union complains about Epic Games cloning Darth Vader

Overall, my impression of unions is that it is akin to buying into a homeowners association. You are giving taxing powers to Karen down the street (union dues) who will decide what color you can paint your house and when (the contract).... and potentially Karen is actually a member of a crime family too boot since the nature of their structure and activities is so closely aligned to extortion anyways. And once an HOA or union is created it is nearly impossible to dissolve even when it has by its own actions driven down the resale values it supposedly exists to protect. It only makes sense if you really want to live that way. And some do.

Satellite phone tech coming to your mobe this year – but who pays for it?

Re: This is What'll Happen

Totally agree, it's a service that has some appeal to me, but I live in one of the areas of the world that doesn't have continuous cell tower coverage. I actually DO pay about $20/mo for a Garmin InReach messenger, and I used a SPOT previous... so while I have rigorous questions about the reliability of a cell phone-based service, I would actually pay something to not have to carry a second device with me when I'm out and about roaming off the grid. As such... these services are probably a bad thing for Garmin and the existing satellite operators for small messaging services (Inmarsat, Iridium), but probably not going to be that widely used generally.

Not even Intel's top bosses know what's on CEO Lip-Bu Tan's chopping block

One could argue that it is _sticking_ with 'the core' for too long that has been the downfall of Intel. X86 had it decades.

Europe signs off on €10.6B IRIS² satellite broadband deal

Its obviously a govt project... but

... how exactly how do you spend $10B if you are going to use 'already existing' assets to build it?

The sad tale of the Alpha massacre

Try it with mv

In the dawm of time I downloaded something called "linux" onto recyled NT3.1 floppies donated to our school by Microsoft. Rushed home installed for several hours. Acheived root.... typed: "mv / /tmp" ... and things got weird fast. Think that bug was fixed somewhere in the 0.98 kernel release.

Sysadmins rage over Apple’s ‘nightmarish’ SSL/TLS cert lifespan cuts plot

This sort of reminds me of the trend in retail of check my ID when I buy beer. I'm nearly 50. I'm not sure what purpose this actually serves. You can check my id all you want, but it doesn't stop me from handing off the beer to the teenager waiting outside one bit. (I don't do this... but it all comes down to trust eventually doesn't it?).

TLS is broken, cert longevity has nearly nothing to do with that. It's broken because the CAs don't really do their job either because they are run by MBAs or because they exist to be shady... and due to politics browsers end up trusting a lot of CAs that I don't really want to trust ever. Furthermore, unless you actually use DNSSEC fully the domain I'm connecting too isn't necessarily mapped to an authoritative IP address...which can have a perfectly valid cert from letsencrypt.

CrowdStrike's Blue Screen blunder: Could eBPF have saved the day?

Re: Would eBPF really have helped here?

Security software is just like this. It doesn't matter if it's in the kernel or runs in userspace etc. (well actually it matters quite a lot - userspace is NOT effective and has terrible performance and compatibility problems).. But by its very nature security software MUST be able to modify the running system... which means if f's up... your system may not run anymore. This time it was a BSOD in there driver due to some quality issues, but simply blocking particular processes due to a detection false would have the exact same result in windows (BSOD and a looping one at that).

The actual _issue_ here is that McAfee did all this in 2007, 2009 etc. and Kurtz was CTO at McAfee... and apparently did not take those lessons to his new organization. Security software must be built and supported with a culture of obsessive safety and not just from 'attackers'. Which means testing... but also looking at designs critically and avoiding ones that are going to fail in interesting ways. Culture comes from the top.

Amazon, Tesla, Meta considered harmful to democracy

My effective tax rate is about 48% largely due to many many layers of taxation between me and the federal government... for which I'm not entirely clear that I'm getting a good deal in return and my vote against such things never works... so I question if democracy is really helping me either. Joining a union just seems like putting the president of the HOA (you know the one) in charge of how much you can make. It's just another tax you have to pay to reduce your freedom to do things. No thank you.

CISA boss: Makers of insecure software must stop enabling today's cyber villains

Very much an easy thing to say... and obviously the view of somebody that has never built any software, nor has to actually pay for the result. The thing about software is it just doesn't work that way. You can design with the best of intentions build in quality at every step and really grind on it... and still have bugs. NASA is an interesting example. They spend some crazy amount _per line_ of code and still crash into Mars about half of the time when they do something new.

The truth is security is an manageable risk that is in the rounding error of the net productivity that software brings to the user.. even if its insecure by design, especially given that insecure by design is the only _usable_ design. I mean hell.. the internet isn't very secure.. but we get by.

CrowdStrike hires outside security outfits to review troubled Falcon code

I write this kind of code for security software. I didn't write crowdstrike, but I did write a competitor or two. Crwd seems to have taken an approach of pre-compiling search trees and directly loading those into their kernel filter driver. Every cycle counts since the job is to eliminate system i/o events against a vast corpus of rules as fast as possible. However, I've always taken the approach of building search trees dynamically directly from the source content on the endpoint since you can do much more validation against what the sensor can actually support and avoid this kind of f'up. The tradeoff is that rules are shipped in source form to the endpoint and are readable by anybody that cares to look. I suspect Crwd was all paranoid about people reading them and decided to ship compiled search trees instead which has some risky edge cases between sensor code and compiled content as aptly demonstrated here.

San Francisco set to ban rent-hiking algorithms used by landlords

Re: Communists.

I recently had a bit of a road trip through the 'fly over states'. Literal ghost towns everywhere... with lots of infrastructure and housing.... Just not enough people to keep it working. Pretty sure Missouri has the internet, nothing stops many of us from working from Missouri except a will to live in Missouri.

There isn't a housing shortage. There is simply an unequal distribution of it. Turns out if you to live in 'not Missouri' place you have to pay more... and anybody whining about that price might consider Missouri.

CrowdStrike CEO summoned to explain epic fail to US Homeland Security committee

Re: Patchpocalypse now

Culture is very much at the root here... And McAfee was toxic. There were lessons learned at McAfee with the 5958 incident. Some good, some bad. Ultimately 5958 led to the internal stagnation of the organization and why McAfee just isn't really a relevant player anymore. And yes, he was in the room then as CTO.

US senator claims UnitedHealth's CEO, board appointed 'unqualified' CISO

CISO isn't a technical role

It's my job to talk with CISOs. I've discovered there are a few types:

1) former 'technical' person. Probably worked on a SOC team or did some red teaming at some point in their carrier. They view CISO as 'defend the network'. These guys tend to fail in the boardroom but tend do a competent job with what little budget they get.

2) former 'cops'. Law enforcement, legal backgrounds, program managers for TLAs etc. They view being a CISO as 'risk management'. Do somewhat better with the board room, but also tend to be a bit brittle since they have impostor syndrome pretty hard with their technical team that reports to them.

2b) Subset of 2 that has done X things that have now 'solved security'. These are the ones that get hacked hard.

And finally, I'll take objection to the Senators statement:

"The cyberattack against UHG could have been prevented had UHG followed industry best practices," said Wyden, concluding his rousing letter-cum-tirade. "UHG's failure to follow those best practices, and the harm that resulted, is the responsibility of the company's senior officials including UHG's CEO and board of directors"

MFA is a good thing, but the REAL question is how did somebody already have credentials? They were already breached, and they still haven't found root cause.

Snowflake denies miscreants melted its security to steal data from top customers

Okta and MFA has nothing to do with it.

If you have a renewable token with access to things... that is a post authentication token. It's a shared secret between you and whatever API that honors it. If I as an attacker happen to read it out of your browser's session data... (which is exactly what an info stealer like Lumastealer which is the specific variant cited here does) I have the exact same access as you do, and if its renewable, I can get new tokens just as easily. Info stealers aren't after your passwords as much because to use them they need to also defeat MFA... but who needs a password if you already have access with a token?

NASA and ESA take a close look at Europe's International Habitation Module

Bet this never flies.

The program is going to get cancelled or redirected yet again or simply underfunded until one of those happen.

Google guru roasts useless phishing tests, calls for fire drill-style overhaul

You can't fix people, but you CAN fix tools!

Actual blog post link: https://security.googleblog.com/2024/05/on-fire-drills-and-phishing-tests.html

And a hearty hear hear! "You can't fix people, but you CAN fix tools! "

Microsoft really does not want Windows 11 running on ancient PCs

Re: Is it really beyond the wit of Microsoft ...

They do release a non-popcnt OS build. It is called Windows 10.

Re: Is it really beyond the wit of Microsoft ...

popcnt is a very useful instruction... it returns the number of bits set to 1 in a word of memory. This sounds trivial, but it's a huge perf boost since this is a very common thing to need to do, and the obvious for loop alternative is fast... but not as fast. You _could_ dynamically detect it, there is a CPUID bit that indicates if it is supported, but then you would have to dynamically replace every possible location of it with a call to some other routine, or somehow trap an exception, retry etc. It's just not practical to dynamically support using it since the effort to do so negates the performance advantage of the instruction.

All that said, the min CPU spec is really about security and the colossal screwup that is meltdown/spectre. Forcing out chipsets that bleed information due to meltdown/spectre/etc and can't really be effectively mitigated, or worse the mitigations further drag down performance is required to have basic security guarantees. SSE4.2 just comes along for the ride. Sure, use the older machine for something by running linux on it... just make sure it isn't anything important.

Microsoft has done a really _terrible_ job of actually explaining the hardware motivations here. Simply terrible.

Uncle Sam, 15 US states launch antitrust war on Apple

My kids disagree

Crypto scams more costly to the US than ransomware, Feds say

Re: Not reporting ransomware attacks?

The SEC has reporting rules now. They are being used by attackers as leverage to get people to pay ransom now.... pay or we'll turn you in. Even dumber though is that recently a health care provider was issued a fine after reporting an attack... for exposing patient records (to the attacker). As with most regulation, reporting largely doesn't accomplish what was intended and has some really perverse incentives built into it. Blaming the victim is probably not the solution.

Yeah, that is some bad ransomware data.... and sort of calls into question the rest of the report. Ransomware from chain analysis was at least $1.1_BILLION last year. (https://www.chainalysis.com/blog/ransomware-2024/) 2X from 2022. That does NOT include the MASSIVE costs of incident response with or without paying a ransom. I think you could find single incidents that might have costs more than $52m last year.

IT suppliers hacked off with Uncle Sam's demands in aftermath of cyberattacks

Well yes... This is EXACTLY why anything the government is involved with is so ridiculously expensive. You literally have to charge them 3-4x what you would charge anybody else as a paperwork tax... and since so few vendors can even get certified, its not like 'open bids' have competition a great deal of the time, you the vendor having achieved the activation energy to deal with the government can in fact name your price and they have to pay it. Not that they care, not like its the governments money anyways...

Travel app Kayak offers Boeing 737 Max 9 filter after that door plug drama

Its not just the door plugs...

It's obvious Boeing is culturally bankrupt. It's not just the MAX fiasco. And the door plug was one week after a previous 'ground them all' inspection where there where loose bolts on a safety critical system in the tail assembly. This shit should be checked and rechecked... probably IS being checked and rechecked and it's still wrong.

The Starliner program has also had some serious issues. And not just the ones on flight hardware where it didn't quite make it to orbit. They managed to also take _checkout photos_ to document the state of the parachutes on a drop test that clearly showed one of the parachutes was NOT connected to the airframe... and somebody then proceeded to pack the parachutes in that state. I'm sure they are ISO compliant in more ways that I could even imagine... but compliant isn't the same thing as giving a damn about quality. I mean good news! 2 out of the 3 parachutes opened, good thing for redundancy... but wow, they had _photos_.

Why we update... Data-thief malware exploits SmartScreen on unpatched Windows PCs

Re: I know that data has to be stored somewhere...

Exactly this. Cloud applications depend on your client application being able to keep tokens secret. Android and iOS were designed with this in mind and generally a client app can store its tokens with reasonable assurance that other apps (aka malware) can't read them. Windows, Linux, Unix, OSX where all designed long before 'the web' was really a thing. Client apps store data as _you_. As such any application you are running (aka malware) can read any data you can read... including your tokens. Running Linux doesn't make you safe here, it just makes you less likely to be a target in the first place... but that is only the market share of "Linux on the desktop" being essentially a rounding error and thus irrelevant to a malware business.

Re: Geolocation data ? On a PC ?

Nobody cares where you live, they care to know where google or whoever thinks you are living. This is so when they use the tokens they just harvested, they can spoof the correct geolocation and not set off any alarms in the cloud services from a token performing 'time travel'. Time travel detection (aka you are suddenly in SE Asia, despite logging in from Redmond Washington not 5 minutes ago) is bread and butter of cloud identity security.

https://upsight.ai/blog/beyond-passwords-decoding-the-vulnerability-of-identity-tokens

Be honest. Would you pay off a ransomware crew?

A one time payment is nice, but what we need is a recurring revenue stream...

Ransomware is a business, not a tactic. The trend in this business is towards 'Surprise backups' of victim data. Ransome isn't quite the right word; blackmail is more like it.

Imagine you have gained control over a law firm, it has many people's secrets in their files and a professional obligation to protect those secrets. You could 'sell' a onetime license to the law firm so they can avoid using their backup.... Or you could sell an _annual_ subscription service of not telling others about all of their secrets. Any MBA will tell you that the recurring revenue is better... and so much harder to defend against.

Electric vehicles earn shocking report card for reliability

As an EV fan... still rings true

I've had I think 6 EVs now:

- 1 Chevy Spark EV died due to a minor crash that caused the insurance to total it due to the cost of electronics.

- 1 Chevy Bolt EV was sold on the used market at a loss - it was basically a Chevy malibu and had tons of software glitches and piss poor design possibly due to the retro fit.

- 1 Tesla Model X died 30 minutes after delivery upon arriving home. Some sort of central computer had stopped working. This was a COVID build, so Elon himself may have fitted the QA failed part from the scrap bin in it himself. Twas returned to Tesla.

- 1 Chevy Spark EV died after 2 years due to the charge controller failing. GM was unable to find a replacement board after 9 months of it sitting at the dealer... I got a buy out check from them.

... Kia rental EV was 'fine'.. but it was a rental so who knows what happened after I returned it 9 months of me driving it around....

- current Nissan Leaf - still going strong. Very boring car... but I've high hopes of it having a natural end as a result.

The Chevy Spark EV is still my favorite... But I suspect the fundamental problem is that people expect more from EVs due to the price, so the normal build quality issues stand out more and when it does go wrong, its very wrong. What you might accept in a $25k malibu, you are going to be pissed about in a $37k bolt.

Your password hygiene remains atrocious, says NordPass

Passwords are all vanity if you leave the post auth token laying about.

The real action is in getting post authentication tokens. All I need to do is read your tokens out of your profile directory and I _am_ you to whatever you happened to be logged into. I don't need your username or your password, and I don't care if your MFA is legit or SMS. I'm still _you_.

3CX thought supply chain attack was a false positive

VT is just a static check...

Malware and the AV engines that VT is aggregating across are so 1990s. Attackers don't send you malware. They sent you _links_ to malware, or better yet they Macgyver it from bits you already have on disk using duct tape and zip-ties. In this case a fairly pedestrian dll abuse to download malware as part of an update.

As such, checking your binaries against VT isn't going to flag anything, and a goodly amount of the time neither is your AV scanner. This was a multi-stage attack - the malware part that VT would be able to flag is downloaded much later in the attack.

Watchdog: Broadcom buy of VMware may be bad for competition

NSS: "Broadcom buy of VMware may be bad for competition"

Duh, but hardware as to why it would be bad? Seriously? Hardware is just going to keep on working with vmware, it's nearly impossible for it to not. You should be far, far more concerned about the _virtual hardware_ being inaccessible. The choice is VMW or "the cloud". AWS, Google and Azure look forward to this acquisition no doubt, THAT is the bad you should be worried about.

South Korea moves to resolve WWII dispute with Japan that troubles tech supply chains

Fear the future? Change the past.

I'm pretty sure my Irish and Scotts ancestors didn't come to the USA because they woke up one morning and decided to emigrate. There were reasons; possibly including judicial murder, starvation and general religious suppression. Those same ancestors went on to homestead in the west, in some cases literally over the graves of the previous inhabitants. Apologies are owed all around... but this is an accounting that simply can't be settled. Learn and live for the future.

Russian charged with smuggling US counterintel tech to Motherland

Is linking to the Kaspersky report that you quoted at length under sanction? Cite your sources please.

For password protection, dump LastPass for open source Bitwarden

Re: Someone else's computer

That's the problem though. Your control over the system is the weak point of using your local system to store passwords! You have access to all of your data all of the time, ergo so does any attacker that you happen to let in though a momentary lapse of humanity. And beyond that, the password itself isn't really that interesting, the hot new trend is local token theft. I don't need your password if you already authenticated for me, I have something better - a token! Again, if you are NOT asked for a password on each and every API call that your browser/application might be making, and if you are in control of your system, the same attacker can just read your keystrokes too.

It's all a shell game. The only "secure" device I might trust is inherently entirely out of my control because it won't let me control my own data.

Re: Someone else's computer

Unless you are prompted for a password each and every time you need to access your secrets... They really aren't any safer locally than in the cloud. https://www.upsightsecurity.com/post/data-protection-api-or-now-you-have-two-problems

Malicious Microsoft-signed Windows drivers wielded in cyberattacks

Re: Bu-but...

Having gone through this process... The vetting is done by a 3rd party CA issuing an EV certificate to the company. That certificate is used to sign submissions to the Microsoft signing process. (before Microsoft did the signing directly, the CA cert was used to sign the drivers since the CA had a Microsoft issued cross-cert). The 'Extended Validation' in an EV cert is... 1) can you pay $400? 2) Do you have an attorney that will attest that you are you and answer a phone call to repeat the same?

I suspect the latter is the weak link since it is not clear how the attorney is vetted as actually being a member of their respective bar association, nor would I trust in professional ethics in all places equally. (see also: the Panama papers). Some number of years back Microsoft was talking about doing the vetting directly and cutting out the 3rd party CAs entirely. Probably a good move, but I've not heard much about it since.

Re: Bu-but...

Signing does provide security value in several ways - there is an audit chain to some extent - somebody somewhere does in fact have to swear they are up to no good and sign contracts to that effect. Not everything has to be a technical solution. The second way is actually fairly important - it's very difficult to create a polymorphic driver because of the signing requirement - while there are lots of 'bad' drivers and many more abusable drivers out there... the number is not infinite, and you can in fact build effective rulesets around them.

The dystopian part here is that as a driver developer... quite a lot of process to get through to ship some code. Annoying, I don't like it, but I'm not arguing against it either.