Posts by A random security guy 384 publicly visible posts • joined 20 Apr 2019
I never ran background checks on employees or future employees. But I did run checks on questionable people who were pretending to be executives in a company. The amount of material available online for free and much more from paid services is shocking. You can find CC payment issues, traffic violations, who lived with them at the same address, their internet presence, etc. You can track people's car license plates as people drive around and have their data slurped up by cameras everywhere. If you have access to Palantir, you can become even more invasive.
Now imagine my employer having access to that data.
Sanctions are not binary tools; they are there to slow down activities. They are also a political tool. The US sanctioning China means that China is a pariah nation. Being snactioned also slows down trade. The long term impact is that countries would rather deal with a non-sanctioned country than one which is.
Criminal negligence would be the better way to attack the problem: make CEOs liable for neglecting cybersecurity. If forensics reveals big gaps in cybersecurity implementation, the CEOs of the hacked company, the compliance company, and any vendor who lied about their service/product security would be made liable. Cyberinsurance companies wuld breathe a sigh of relief.
That way, passing SOC2 compliance would not be a rubber stamp.
Microsoft is claiming that there is no reason to protect its products because others need to do their job. It was the same argument used by people who used perimeter defense as sufficient to protect infrastructure. That is the worst possible defense argument; depending on others... The whole principle of zero trust is based on every component doing its best to guard against someone attacking it.
Yes, it is ethical. Most White Hat Hackers give a 30 day warning, sometimes more. The hackers mostly know about the vulnerabilities. There may be several reasons you don't see any exploits:
1. There are other exploits that are available
2. The hacking industry is working on creating an exploit.
3. They have already weaponized the exploit but are holding it back.
4. It is out there, but it hasn't hit you
5. You haven't noticed that you have been hacked
6. You are not worth it.
I used to write Office add-ins on Windows, which were among the most painful pieces of software I had to write. MS Office allows you to write software that can use Office APIs to create buttons,act on emails, etc. These are called Office add-ins/plugins. You can, for example, write a small program that reads an email from your boss, calls ChatGPT, creates a response, and sends it out. It seems that you can't do it on the MAC.
Oftentimes, I would get a pushback from a developer or a manager saying: I'll fix this buffer overflow or some other security bug only if you can show it can be exploited.
The basics of security revolve around building secure components. Writing exploits is a thankless job unless you are in the employ of some a nation state hacking organization or a hacker group. It can take hundreds of thousands of dollars to weaponize a vulnerability. Sometimes you can buy toolchains for known types of vulnerabilities.
Hacker groups can afford to do it because they can get the ROI by hacking and ransoming systems for millions of dollars. It is profitable for them.
Pointing out vulnerabilities is the right thing to do.
Microsoft not fixing their bugs is just business as usual.
Agreed. I am always curious to know why people think BRICS would amount to anything.
China absolutely wants BRICs to a a vehicle to create a currency dominated by the Yuan.
India doesn’t want to have anything to do with the Yuan.
India’s primary sources of income are from the West.
India is quite happy with the dollar. They would want the Rupee to be a bit more popular, though.
Well, there are a large number of men falling for scam texts with beautiful images.
Most calls originate out of NK and the poor girls are kept captive and beaten.
I found women to be more careful about privacy than men.
Maybe you used a bad female hire as an example and not a generalization. If so, my apologies.
Except for 2 companies I worked with, every other company has resisted even a static code analyzer to be run on their code.
A famous modem company specifically stated and made it clear that under no circumstances could we run binary code analysis.
At one company I walked out of a lucrative contract because the security team reported to the engineering director for application software and they refused to run analyzers of any kind. Not even nmap.
It was specifically called out in the contract that security companies were not allowed to do certain things; all vulnerabilities had to be approved by engineering.
Early warning: Adding to what you said, listening to patterns of ground noise, radio traffic, personnel movement, etc. can help you determine what is anomalous and then get an early warning even before the silo doors open.
The liquid fueled rockets need to be prepped and any hint of a first strike will give an extra minute or so for the Chinese govt leaders and military leaders to prepare.
All of it is available; you are just using stereotypes. I have visited Cisco in Bangalore, and its offices are the same as the ones here in Milpitas/Sunnyvale. There were no issues with power, sanitation, water, food, etc. There are many other companies operating out of India.
The main issues revolve around the bureaucracy, and for the life of me, I can't get a deal done in India if the government is involved in any manner. So India funding even 100% will not work because the bureaucracy will mess it up. Things will take years.
I still remember the Indian govt. trying to buy the M777 ... they finally bought it, I believe, 13 years later. So, even though I fully applaud the Indian govt. push for putting together an attractive deal to get TSMC in, that is also the problem.
I expect the infiltration to spread to more than the payroll system they initially attacked. There is something else that happens when the number of victims is very large: the hackers have a hard time extracting information of value from all of them. I remember working with a company last year which had been potentially breached but we found that the hackers had merely probed but not gone further because there were far juicier targets to exploit.
So you may be safe (r). Depends on your specific situation ...
This is the usual pushback I get from developers who don't want to implement security: prove this bad practice (process separation, address isolation, unsalted hash, buffer overrun, double frees, integer overflow, etc.) can be hacked easily and show me the hack. Security is built in layers with the principle of zero trust applied liberally. Each and every component must do its security properly.
The goal is not have obvious flaws which can be exploited.
AWS itself probably protects its own secrets in a completely separate CPU+memory (simplifying it a bit here) but many companies run their VMSs/ (EC2s/K8s pods, lambdas) with all kinds of secrets and PII.
One can imagine a nation-state just deploying 1000's of EC2s and K8s pods scraping data for years, mining the data, and then giving it to their state-sponsored hackers.
Not all companies use patents for blocking. And then there are patent trolls. Patent portfolios are revenue generators too. Having seen some of patents get licensed by my former employers, I have come to respect that as a business angle.
Patents are also an independent way for others to understand what you have done instead of relying on your resume. No method is foolproof, however.
Two of my neighbors have Ring cameras. They have videos of a guy who breaks into our mailboxes. The police can't do anything.
I have a few Simple questions:
1. Is the username/password combo the only authentication required?
2. What is the data retention policy when the video is shared with the police?
3. Is there a right to be able to get a copy of the data?
4. Are the police or private companies mining the data?
Having programmed modules for exchange and outlook, I’m still surprised that the thing actually works.
My IT admin in a previous company told me that a rule of thumb is 1 IT Engineer per Exchange server. I may be off, but I doubt by too much.
GSuite seems to work for most use cases.
Thanks for answering the question about the practical accuracy which was bothering me.
Machine guns take into account many items like recoil, change in balance due to the movement of cartridges, gas discharge, etc.
Question: could an automated pistol be used on a crowd of people? Sadly, I am less worried about militaries or regular criminals using it and more about mass shooters.
For all of us who have been in his position, you try to work with the system you have. And we probably have had CEOs who ignored even the basics. In this case, the CEO went one step further and fired the messenger. I doubt he had time to go to the SEC. They would not even let him give an honest report to the board and went around him. The report is pretty damning. And every claim in that report probably has many pieces of supporting evidence.
Try writing a whistleblower complaint with evidence to back it up without showing it, ensuring that you don't give out proprietary information, only make claims that are obvious.
This is solid 6 months of work.
I realized that this was an intense piece of work for many reasons:
1. Mudge needed to keep proprietary information out.
2. Mudge needed to have attorneys go through every one of his claims and ensure that they were backed up by evidence he had or could ask for
3. This kind of filtering and wording takes time
4. One single false claim will cause him to lose credibility
5. He has stuck to claims which are easy to prove
6. He has used the complaint to go after a CEO who was a fool (bright technically but not in security, privacy, people skills, law, etc.)
The best thing for Twitter is to fire the CEO. Immediately.
Yes,I do know that strcpy CAN be used safely if all the input parameters are validated, but why tempt fate? Any static code analyzer should have flagged it. I read the MSFT report, and it wasn't clear how strcpy crept in. It should have been caught eons ago. I have known of hackers introducing specific bugs like this.
From the Verge
https://www.theverge.com/2022/8/12/23303411/zoom-defcon-root-access-privilege-escalation-hack-patrick-wardle
Patrick Wardle states
The exploit works by targeting the installer for the Zoom application, which needs to run with special user permissions in order to install or remove the main Zoom application from a computer. Though the installer requires a user to enter their password on first adding the application to the system, Wardle found that an auto-update function then continually ran in the background with superuser privileges.
When Zoom issued an update, the updater function would install the new package after checking that it had been cryptographically signed by Zoom. But a bug in how the checking method was implemented meant that giving the updater any file with the same name as Zoom’s signing certificate would be enough to pass the test—so an attacker could substitute any kind of malware program and have it be run by the updater with elevated privilege.
The Register 
Biting the hand that feeds IT
Copyright. All rights reserved © 1998–2025
