Posts by BBRush

Citrix NetScaler security snafus get even worse amid more 0-day reports

Re: Is it just me, or does anyone else notice how fragile these "protection" devices are?

Because the people paying the bills have read the glossy sales crap and lack the technical cynicism to understand it for what it is?

Certainties in life: Death, taxes, and critical Citrix vulns under attack

Re: Anon Cowards on full force here

That could be because every use case is different If you want a VPN and use a NetScaler for it, maybe a PaloAlto or Cisco VPN appliance is a better option. Application gateway? Kong? Load Balancing? F5?

Wanting one (very expensive, difficult to configure securely) device that does everything at the same time might be a requirement, or it culd just be that the Citrix licenses you bought for XenApp gave you the VM version of NetScaler at the same time.

Meta Muse AI app flaw lets local malware redirect dictation traffic

Re: Imagine

People are lazy and want boring repetetive shit to be done by other things/people. This type of service is ideal for that purpose.

If you are young, you probably have a Meta account linked to your Instagram. if you are middle-aged, the same but with FB. This app is free. It's all too easy, but also, as the article said, too greedy. They could have made a serious security choice, but likely avoided it because Meta.

OpenAI commits $1B in AI credits to frontline cyber defenders

Would it not be better...

To spend less than 1B USD on building lsome sort of guardrails into the models so that they could not be used to carry out this sort of attack instead, or using the rest to try and convince other model makers to do the same?

CISA: Most exploited vulnerabilities should have been eradicated decades ago

Unless it is cost neutral...

... any changes to software production will be ignored.

Fixing bugs has been "revenue protection" for as long as I can remember and that's a poor, poor cousin to "revenue generation". These days, with the bastardised "agile" workflows and short times to market, that's going to be even more of a push. throw in a statutory duty to maximise revenue and eps for shareholders and it's hard to see why a software company would want to spend all that time/money/effort fixing old crap code (unless they have to).

Yes, there are exceptions, but they seem to be rare.

More than 100 water systems were hit in July cyberattacks

Re: If CISA wants to be useful

Honestly? I suspect they would really quite enjoy doing something that rewarding and useful. Sadly, DoGE/Trump gutted them at the start of the second term and I don't think they have the people or the budget to do that now.

Hell, it took them a while to find the money for MiTRE.

Trump wants to grant private cyber firms a license to hack back

Re: Eligible Bidders must show...

Maybe this is all a masterful plan to find people that have been causing harm that now want to go legit, so he can round them up and send them to El Salvador or something!!!

The US's definition of 'cyber' is pretty wide/vague, so I guess you could employ your contractors for almost anything, but, in reality, i think the letters of marque will be useless compared to, say, Black Axe's known willingness to hack people up that cross them once they know who they are.

At least a PMC knows who's likely going to be shooting at him.

Cloudflare teams up with big browsers to help websites tell welcome from unwelcome visitors

That's lovely, but...

When are they going to stop being the phisher's CDN of choice?

I could honestly care a little less about bots crawling over the websites I look after (and the subsequent blocking by Akamai/CloudFlare, etc), but having all of the phishing hosted behind CloudFlare and it not really being taken out in a timely manner really pisses me off.

The last time CF had problems we saw a big drop in phishing. Just saying...

Rockstar Games faces full hearing over alleged union busting

Re: Without unions

I disagree.

Faced with what has become rapacious capitalism and exploitation of the workforce (H1B /(indenture in the US as an example), the case for representation of workers is at least as strong as during the industrial revolution. Modern corporations have proved repeatedly that they cannot be relied on to do the right thing for their employees, so something needs to be on the other side of the argument.

Some unions may be more militant than others, some might be less effective than others, but a body to represent workers and their rights under law cannot be seen as a bad thing.

Elon Musk is now worth more than $1,000,000,000,000

On the one hand....

...I really want this to go badly and tank, wipe the smile off that w***ers face for a while. Let him experience consequence for a single, brief moment. He won't GAS about that, I don't think he can, but it would be nice.

But on the other hand, I can't see how this will not work out for him. He's moved all of the stuff that people want to invest in into a single place and then, in a master-stroke, given himself utter control over it. He has a legion of Meme-Minions and fanboys and the tactic backing of a hugely corrupt major world power so, unfortunately, I can't see how this will not succeed.

Disgruntled 0-day hunter 'humiliated' by Microsoft pledges 'bone shattering drop' as Redmond calls cops

Maximising investor value...

Why invest in somehting that COSTS money compared to doing something that maximises value to shareholders (of which execs are among)?

Windows and Azure/O365 users are effectively a captive audience and can be fleeced. Moving to an alternative (GCP, FOSS) would take, in the short term at least) far more money than more SMEs and maybe large businesses could stomach for the perceived gain. Throw in the change in base technology, dual running during a transition and it starts getting very expensive and not without the risk that the same thing will happen with the next system.

This is the sad reality of today's enterprise. The shitness is here and here to stay.

SpaceX pitches itself as integrated interplanetary proto-monopolist in IPO filing

Yeeeaaaah, Nah

Bad financials, total control to Musk, no voting rights for little people, a mission statement that reads like a k-hole fever dream...

Nah, no way. It just feels like the IPO is there to personally enrich Musk from the wallets of the fanboys and the investors that sense a quick buck.

Britain's £6B armoured sickener Ajax cleared for duty despite injuring troops

Re: Not just one cause

Never going to happen. That would mean that there was a wrong decision, which means someoen was wrong, which would mean blame and that could not happen.

Also, too much money in the project now and too much time between now and a replacement for the goverment to trumpet an acheivement in delivering a new vehicle. So, as usual, the crew are going to have to suck it up and hope that something comes along as a mid life update that will stop them going permanently deaf and/or injured.

Locked, stocked, and losing budget: AI vendor lock-in bites back

Re: Chickens

Turned rouge? Damn commie chickens and their redness.

You'd never have this problem with rogue chickens, or guerilla chickens. Or probably chicken gorillas

Cybersec is a thankless job: expanding workload and shrinking pay packet

Re: Successful teams get overlooked, same as it ever was

There is no doubt that communicating metrics to management in this field helps lift the profile of these teams, but only if done properly and only if the higher levels are actually receptive and supportive of the work. If you have a good manager that communicates well and is trusted by the C-suite, that also understand risk, threats, etc, then it's all good (mostly). If you have a poor management chain (like a CISO that claims every nmap scan or ping-sweep as an attack, then you're on a hiding to nothing.

I spent a long time as a meat-shield for a large software/hardware supplier in the US. I was good enough at it that no researcher broke the responsibile disclosure timescales. One of the products was, and still is, a dumpster fire of security nastiness. In part due to me and tthe team, the leadership just deprioritised fixing security. It burned me out. It's still a dumpster fire. I still won't have it in my new company.

Trump to UK: Stop taxing our big beautiful tech corps or face tariff tsunami

Honestly, fuckit

Tax on sales generated in the UK by US companies and tell the Orange Man-baby to do one. There's only really one way to deal with a bully and this is bullying.

BOFH: If the meatbags can't agree on aircon, AI will decide for them

I remember one job, back in the good old days (when Y2k was the biggest problem...) when the lab AC was the biggest problem at work. Where my team sat, in the middle of a testing lab full of equipment, it was always hot, which we complained about. When it was eventually fixed for us, the people sitting at the ends of the lab were coming in and working with fleeces and gloves because it was never meat-locker temps for them.

It turned out that there was an epic combination of poorly sited sensors and a seized row of duct fans that were causing the issue.

Great place, lovely environment. A shame the place was nearly levelled when Buncefield went up a few years later.

RAF eyes cheap drone-killer as Typhoon jet tests laser-guided rockets

Wolverine....

No argument there, integration with the Typhoon's existing kit would be possible, but there is already a version of the Texan (AT 6x Wolverine, and yes, I went down the Wikipedia rabbithole a bit looking up stuff after your tip!) that has all the necessary stuff for exactly this type of role. I think even the Afghan Air Force used them at one point before the withdrawl.

I'd be interested to see a price comparison based on conversion/integration time/cost for the Typhoon compared to purchase price/delivery time for the AT 6. Flight time would be way cheaper, same with maintenance costs. It's not like the pilots would need to be trained from the ground up either, they've already learned on them.

Re: Cannon

Then why mount them on Typhons? The RAF has an existing platform that would work for this with an existing rep for low intensity/CoIn warfare: Tucano. It's also much cheaper to buy and fly than the Typhoon and, with a back-seater, they could handle the weapons leaving the pilot free to fly.

Or just do what Ukraine has done and mount a minigun in an AN-24 and fly alongside the drones to shoot them.

Microsoft hints at bit bunkers for war zones

LOAC1

Strong rules already exist about the targeting of civilian infrastructure in wars (Law of Armed Conflict), but these are routinely ignored by countries that do not accept them or just do not care what they where the drones end up (insert your own list of countries here).

MS might be better to try and push all countries to accept that a) civilian infrastructure should never be targeted and b) civilian infrastructure should never be used by the military (this making it a legitimate target), but good luck with that.

Of course, they could also threaten to withold services from combatants that target their DCs, but the removal of Teams might be a price some people are willing to pay.

Marching orders delayed: Veterans' Digital ID off to a slow start

Re: What do they expect?

Paper can also be forged or lost/stolen in exactly the same way as [badly designed/implemented] digital IDs can.

Yes: If the main service goes down, then a digital ID can't be checked, but if a paper ID requires the checker to know what a fake looks like (instead of having a strong authentication method to verify the user) how reliable is that at identifying a person?

Let's be honest here, digital IDs are the future but their use is based on having a good set of use cases, a solid, SECURE design and a well implemented (and secure) delivery. In the case of the UK, I think that it needs also to have a really honest and persuasive way of communicating why it is a good idea. No one has done that last bit yet and the use cases all seem disjointed, isolated and badly communicated..

I'm also going to say that, with the current crop of main consultancies (Crapita, Fujitsu, etc) having a solid, secure design and implementation is likely going to be a challenge.

Probably not the best security in the world: Carlsberg wristbands spill visitor pics

Disclosure times

Having been on both sides of the disclosure coin, I can understand Carlsberg's point (that it takes time), but a 90 days (industry standard?) disclosure date _should_ be enough for something relatively straighforward.

What's not cool is the lack of response from Carlsberg. At the very least they should be acknowledging the mails sent and offering some sort of calming platitudes to make the slow response time slightly less bitter. Not replying, not being honest about the progress of a vulnerability is the quickest and easiest way to get zero-dayed. Oh look! Look what happened here!

Parachutists told to check software after jumper dangled from a plane

Re: Better mockup needed...

Current jumper here too (AFFi with but a mere 900 jumps) and the video shows pretty clearly (to me anyway) that the flap pulled the reserve pud down far enough to pull the reserve pin and trigger the reserve. Yes, they might have had a mockup, but I'd put money on the fact that it does not have a representation of the wing on it and so their ground-based trainign would not have picked this up. If they'd done the same jump on a Twin Otter, I don't think it would have been a problem because of the size of the door and the distance from the front to the trailing edge.

On similar incidents, I saw something nearly identical happen this summer whilst I was filming a 10-way speed formation competition. A jumper clipped the corner of the door in the exit hard enough to pop the reserve. Luckily the dive out meant that the pilot/freebag and reserve missed the stabiliser (and me) and they _just_ had a long ride down from altitude.

Sadly, the two other relatively recent incidents that have involved mass/balance going wrong have been very deadly (Umeå and Örebro) and have taken too many friends from the sport. Loading/seating should be a priority for jumping, but simple things like being aware of your equipment is up there as a personal prio.

Re: Software for parachute jumps ?

The pilot might well be running an iPad, but the manifest could have been using Burble or SkyWin for their manifesting. No idea what they were using for mass/balance ahead of loading.

Aisuru botnet turns Q3 into a terabit-scale stress test for the entire internet

Re: Stupid question

I don't think anyone is trying to DDoS them. They just have the most hooks into DDoS protection (via their customers and *cough* people hosting skit behind them), so it is easy for them to report on large botnets like this.

I would be shocked if Akamai is not saying the same thing somewhere (because they have a similar level of insight into network traffic).

Re: Stupid question

I'd say that could well be part of it (for some countries/actors), but if this is available for just a few dollars (and large botnets are), then the market is really anyone that will pay.

You can DDoS a website, then threaten them that you will do it again unless they pay. Some people will pay, so as long as you earn more in ransom than the subscription, it's a 'W'.Once you know people will pay and you are in profit, put that cash back into the system and keep on rolling.

As an absolut lowest case, an aggreived kid with pocket money to hand can use it to DoS a game server that's banned them for cheating, or a school that has given them bad grades.

Cabling survived dungeons and fish factories, until a lazy user took the network down

Re: What is it with managers and training costs?

Had something similar to that once before when I handed my notice in at a job.

Boss (massive bully) called me in and told me that he was putting me on gardening leave for the rest of my notice period (yay!) and taking some of my accrued holiday for my attendance at a mandatory course a few months previous (WTF??). A course that had been free, on-site and which he had insisted that we (the team) must come in early and stay late on the training days so that we could clear off the work we would be missing because of the course.

HR was in the meeting and looked embarassed. I found out he got sacked a few months after I left.

VMware isn’t budging in its pursuit of Siemens for alleged unpaid licenses

Re: so june 2027

If the practice is not illegal and fulfills the US parent company's primary requirement to drive shareholder value, then that is what they will do, right?

Ex-CISA officials, CISOs dispel 'hacklore,' spread cybersecurity truths

Re: Is this really the priority?

Also not forgetting that a lot of the QR code phishing came through otherwise well configured mail servers without a problem because it was "just" an image file. Users then took out their mobiles and scanned the QR code away from all the protections of the managed corporate devices.

So they can be a legit source of effective phishing, more so than a link or a pdf with a link.

Back to the article, I kind of agree with what they are trying to do, but at the same time, personal IT security is a mindset and small things can be important attack vectors if your role changes or you go to a part of the world that has a different set of surveillance goals.

Microsoft is building datacenter superclusters that span continents

Re: a big FU to the GDPR, right?

Which, sadly, appears to be the case with the larger providers.

If your margins are more than that and you know that you're rarely (if ever) going to get fined the full 4% and, even then, not for several years of appeals and reductions for actually paying, it makes perfect sense for a company that is legally obliged to put shareholder interests first.

Cisco creating new security model using 30 years of data describing cyber-dramas and saves

Open Source?

Wow, kind of impressed with that and may actually get me to have a deeper look at it.

Again, I have to state that I do not believe that LLMs are ready for the big time wrt, well, doing almost anything, but a specifically trained model such as this that can give advice on potential solutions is a better assistant than something like ChatGPT (IMHO).

Boffins: cloud computing's on-demand biz model is failing us

Re: Remember

"It was the main selling point of the cloud - you can add resources quickly in the event of surge of traffic and scale down when you don't need it."

The harsh reality is that the science is not a key market for the larger providers and, as such, it is niche and expensive, meaning the cloud provider will charge way more for this kind of flexibility, assuming they make it easy for the research team to even scale down to 0 or scale up to 11 when needed.

Cloud computing is market driven and exists for the masses, their generic workloads and the profits they make for the business, not the small, specific, low margin/cheap use cases.

Ex-CISA head thinks AI might fix code so fast we won't need security teams

Does not really solve the problem for companies...

I could see this approach working if everyone ran everything in the cloud and build pipelines could update continuously with fixes as the AI DAST/SAST tooling found vulnerabilties and fixed them,

BUTT...

This does not fix the problem with operating systems being vulnerable to things (as they are not 'cloud') nor will it help with locally deployed apps (unless there is near constant updating of the apps), nor will it help with testing compatibility for clients that consume the updates, or the changing user experience.

I'm torn here between marvelling at the vision of people that think AI can save the world (even when it seems like the use cases are scraping the bottom of the barrel with a plan to throw it against the wall and see what sticks) and the shot-sightedness of the same people's understanding of how normal enterprise IT works.

Former UK prime minister Sunak becomes human Clippy for Microsoft, Anthropic

Genius!

"Known for creating systems that defy logic and often require a forced restart, Sunak will continue to serve as an MP on the Conservative backbenches."

And yes, I now need to go find paper towels to clear tea off my keyboard.

Have a beer for that one!

Ex-NASA chief: China likely to land humans on Moon before Uncle Sam does again

Re: And?

The purpose is to have a permananet presence on the moon and 'control' it for the purposes of further expansion in the Solar System.

I doubt that the US will be going up there for the good of humanity (well, not in the current climate), but I doubt even less that China would.

BOFH: The auditor is asking too many questions. We have just the laptop for that

There is only one way... ->

Europe slams online tat bazaar AliExpress for dodging obligation to stop dodgy traders

New? Hell no! It's been in use for years!

Defense Department signs OpenAI for $200 million 'frontier AI' pilot project

Asimov's laws

Why in the hell are these companies not explicitly tying in Asimov's laws to AI systems now?

Oh, that's right, profit...

Automatic UK-to-US English converter produced amazing mistakes by the vanload

Re: Whoops

The "Trousers - Pants - Shorts" debate is the one that keeps giving for me. Trying to explain that, or at least the differences between British English and US English versions of them, to Swedes is always fun.

UK Ministry of Defence is spending less with US biz, and more with Europeans

Re: The GCAP is (currently) a British/Italian/Japanese project.

I do not entirely agree.

I think making the military responsible is a good thing, but the revolving door between MoD/Armed Forces and the arms companies needs to be stamped on hard. If you have responsibility for making decisions on kit, it should be for the benefit of the people using it, not for your personal gain in fiuve years when you don't come off your next list and fancy supplementing your pension with some private sector work.

Other than that, yes. Kit takes far too long to develop, costs faaaar too much and frequently is not fit for the purpose that it was designed, specced or bought for.

After that 2024 Windows fiasco, CrowdStrike has a plan – job cuts, leaning on AI

Re: Great idea

But they have such cool free t-shirts! I for one will miss the ability to avoid another day of laundry if they fold.

M&S takes systems offline as 'cyber incident' lingers

Re: British Library - comms good, actions bad

It could also be a question of how the organisaiton is perceived in the market and whether this could affect their position within it. Commercial entities may not want competitiors, investors or shareholders getting the unfettered/honest updates, whereas a public body may have more ability to be honest over and above the required disclosures.

Sharing IOCs and post incident reports, even redacted, to allow others in a market sector to protect themselves could be seen as nearly heresy in the commercial world.

Trump kills clearances for infosec's SentinelOne, ex-CISA boss Chris Krebs

Re: How pathetic can you get ?

FAKE GNUS!!!

He's also saving the US from the tyrany of lefty-woke showers:

https://www.whitehouse.gov/fact-sheets/2025/04/fact-sheet-president-donald-j-trump-makes-americas-showers-great-again/

Where's the slow handclap emoji?

System builders say server prices set to spike as Trump plays customs cowboy

Re: muppet show

He failed to make money running a casino ffs. IN VEGAS.

That alone should tell you all you need to know about his business acument.

Musk's xAI swallows Musk's X in ego-friendly, all-stock deal

And absolutely not financial chicanery to inflate the value of something. No. No way would that happen.

Governments can't seem to stop asking for secret backdoors

Re: Gibson already predicted the outcome: Columbian Data Havens

Upvote (and a beer) for the Snowcrash reference

Wanted. Top infosec pros willing to defend Britain on shabby salaries

Re: I wish their managers the best of luck

Not a .gov story, but related to a US software company...

Similar to London salary weighting, the only way the company could attract people from the bigger (and sexier) Silicon Valley companies was with money. Sadly HR made the banding inflexible, so people had to be hired at senior levels to get a salary that could let the hiring manager compete with the likes of Adobe, Amazon, etc. New grads were getting hired in California as "Senior..." tech grades and poisoning the whole system in other locations (around the US and worldwide) with their lack of experience.

Back on topic though, governments the world over need to learn that they are not going to attract the best talent with their salaries. They might attract the ones that want to work for them, but that's not necessarily the best talent and is certainly not the right way to retain them long term.

NASA's Astrobees need a new buzz – any ideas for the space-dwelling bots?

3D Pong tournament. Best of 501, winner gets bragging rights for the first robot to win a ball game in Spaaaaaaaaace

Chinese national cuffed on charges of running 'likely the world's largest botnet ever'

Wang cuffed, shirley?

Raspberry Pi Pico cracks BitLocker in under a minute

Re: Hurt Locker

I'll wait for the sports version: Gym Locker