Re: Goodbye Chrome
Or learn Linux ...
359 publicly visible posts • joined 20 Apr 2019
This is the usual pushback I get from developers who don't want to implement security: prove this bad practice (process separation, address isolation, unsalted hash, buffer overrun, double frees, integer overflow, etc.) can be hacked easily and show me the hack. Security is built in layers with the principle of zero trust applied liberally. Each and every component must do its security properly.
The goal is not have obvious flaws which can be exploited.
AWS itself probably protects its own secrets in a completely separate CPU+memory (simplifying it a bit here) but many companies run their VMSs/ (EC2s/K8s pods, lambdas) with all kinds of secrets and PII.
One can imagine a nation-state just deploying 1000's of EC2s and K8s pods scraping data for years, mining the data, and then giving it to their state-sponsored hackers.
Not all companies use patents for blocking. And then there are patent trolls. Patent portfolios are revenue generators too. Having seen some of patents get licensed by my former employers, I have come to respect that as a business angle.
Patents are also an independent way for others to understand what you have done instead of relying on your resume. No method is foolproof, however.
Two of my neighbors have Ring cameras. They have videos of a guy who breaks into our mailboxes. The police can't do anything.
I have a few Simple questions:
1. Is the username/password combo the only authentication required?
2. What is the data retention policy when the video is shared with the police?
3. Is there a right to be able to get a copy of the data?
4. Are the police or private companies mining the data?
Having programmed modules for exchange and outlook, I’m still surprised that the thing actually works.
My IT admin in a previous company told me that a rule of thumb is 1 IT Engineer per Exchange server. I may be off, but I doubt by too much.
GSuite seems to work for most use cases.
Thanks for answering the question about the practical accuracy which was bothering me.
Machine guns take into account many items like recoil, change in balance due to the movement of cartridges, gas discharge, etc.
Question: could an automated pistol be used on a crowd of people? Sadly, I am less worried about militaries or regular criminals using it and more about mass shooters.
For all of us who have been in his position, you try to work with the system you have. And we probably have had CEOs who ignored even the basics. In this case, the CEO went one step further and fired the messenger. I doubt he had time to go to the SEC. They would not even let him give an honest report to the board and went around him. The report is pretty damning. And every claim in that report probably has many pieces of supporting evidence.
Try writing a whistleblower complaint with evidence to back it up without showing it, ensuring that you don't give out proprietary information, only make claims that are obvious.
This is solid 6 months of work.
I realized that this was an intense piece of work for many reasons:
1. Mudge needed to keep proprietary information out.
2. Mudge needed to have attorneys go through every one of his claims and ensure that they were backed up by evidence he had or could ask for
3. This kind of filtering and wording takes time
4. One single false claim will cause him to lose credibility
5. He has stuck to claims which are easy to prove
6. He has used the complaint to go after a CEO who was a fool (bright technically but not in security, privacy, people skills, law, etc.)
The best thing for Twitter is to fire the CEO. Immediately.
Yes,I do know that strcpy CAN be used safely if all the input parameters are validated, but why tempt fate? Any static code analyzer should have flagged it. I read the MSFT report, and it wasn't clear how strcpy crept in. It should have been caught eons ago. I have known of hackers introducing specific bugs like this.
From the Verge
https://www.theverge.com/2022/8/12/23303411/zoom-defcon-root-access-privilege-escalation-hack-patrick-wardle
Patrick Wardle states
The exploit works by targeting the installer for the Zoom application, which needs to run with special user permissions in order to install or remove the main Zoom application from a computer. Though the installer requires a user to enter their password on first adding the application to the system, Wardle found that an auto-update function then continually ran in the background with superuser privileges.
When Zoom issued an update, the updater function would install the new package after checking that it had been cryptographically signed by Zoom. But a bug in how the checking method was implemented meant that giving the updater any file with the same name as Zoom’s signing certificate would be enough to pass the test—so an attacker could substitute any kind of malware program and have it be run by the updater with elevated privilege.
Automated AV scanners that rely on pure pattern matching will not be able to get anywhere if they don't decrypt the payload. That means the AV scanner first have to determine what kind of malware something is, decrypt the payload, then the strings in the payload, and then, finally, perform a pattern match. They might skip a level of encryption somewhere.
Should not be too hard but the AV scanners may be limited if the decryption and compression software is (slightly) proprietary, forcing you to run the malware for analysis
Have been tearing apart systems for years. Haven't seen a single system that doesn't connect back to the motherland. Plus the vulnerabilities are fairly simple to exploit. All that is needed is a registry in China for state hackers to use as a jumping-off point to download surveillance software.
Partnerships are a reality. Collaborations are a reality. Two companies may need to work together on projects, account payments, approvals, etc. Many times a company will create separate groups: employees who deal with IBM and, separately, employees who deal with MSFT. It is normal for these employees to collaborate with their customers and vendors on a very close basis.
The best examples are employees of audit companies, which by the very nature of their tasks, can't be the audited company's employees.
After looking at the Decentralized finance apps for over a year, I have come to the conclusion that the code is about as buggy as any other application code.
Moreover, being decentralized is a boon to hackers.
Security practices don’t exist.
Reporting issues come back with: prove to that a bug can be exploited. The better approach is to ensure each block is secure and consistent.
The thing is that making this much money gets into the programmers head and they think they are Supermen.
I work with insurance companies (not for) on security issues and, to tell the truth, they are not the bad guys. They are the people who are behind lots of the features like proximity sensors, lane assist/drift sensors, etc. They have number-crunchers who find patterns and force car companies to change their ways.
For example, their lawyers must already be talking to Honda, telling them that they will not absorb the cost of any theft. And Honda may quietly cover the cost.
I do see state-sponsored attacks by Russia being attempted.
I also think Biden is giving a heads-up to the industry folks.
OTOH, what we don't know are the tools that NSA will use to block the attacks. In the industry, the going mantra is: state-sponsored cyber-attacks require the NSA to step in.
Putin never realized that democracies look splintered and slow but on the whole are much more powerful than dictatorships. He just handed the West the keys to Russia. They are going to grind him down and destroy the Russian army and the economy once and for all.
Most processor vendors do provide the tools. Android also comes with the tools. Time and again I have seen engineers neuter the systems as it is too hard to wrap their heads around the system. I see fixed keys all the time.
The additional problem is that Samsung is also the processor vendor.
This territorial fight is so useless given that the wealth of nations and people are tied to bits in ether. Earlier you conquered because you wanted land, slaves to till the the soils, and gold to fight more battles. Now, you don't need any of the 3.
Or am I being naive? That we humans are destined to kill each other ...
Given that there are all these anti-corruption laws that companies like ours have to comply with, I am surprised at the amount of corruption that the politicians engage in. They live in palaces, have private planes, etc.
I wonder where they are hiding their money ... probably somewhere around here as prime silicon valley property or other instruments.
Maybe the VPN interception will be a good thing? Maybe make the IP addresses public?
The last report said90% of engineering was in China. The other 10 % could be support engineers.
Privacy is not a concern in China.
So all those businesses talking to each other over zoom?
Guess what. Just the meta information of who is talking to whom at what frequency and time is good enough.