I know it makes me sound like a horrible person, but there really are concerns about keys that are really easy for authoritarian governments to "request".
Especially when they're asked "which one do you want"? And the answer is haha "all of them" forever.
( Profound apologies to people who I told they could sorta trust zoom. )
Slashdot again: Zoom's Encryption Is 'Not Suited for Secrets' and Has Surprising Links To China, Researchers Discover
links to theintercept.com
ZOOM’S ENCRYPTION IS “NOT SUITED FOR SECRETS” AND HAS SURPRISING LINKS TO CHINA, RESEARCHERS DISCOVER
sometimes using keys issued by servers in China
Come on Zoom, what are you thinking? And don't blame the Corona Virus for this one. Your paying customers don't want this...
Perry
Friday, April 3, 2020
Developers! It's way past time! Install your products secure by default with random admin passwords!
It's PERFECTLY ALL RIGHT to make DBA's and SYSADMINS dig for the administrator password (within reason).
If they took the time to install the thing, through multiple missteps and retries, once your thing finally works you know they're just going to load it up and go.
Let them, but later, if they want to make any changes or see their data, make them find the password. They won't delete it.
DO you want this to happen? From Slashdot:
According to security researcher John Wethington, one of the people who saw this campaign unfolding and who aided ZDNet in this report, the first intrusions began around March 24. The attacks appear to be carried with the help of an automated script that scans the internet for ElasticSearch systems left unprotected, connects to the databases, attempts to wipe their content, and then creates a new empty index called nightlionsecurity.com. The attacking script doesn't appear to work in all instances, though, as the nightlionsecurity.com index is also present in databases where the content has been left intact.
Look at all the routers at Best Buy, there's a sticker on them with the admin password ! Brilliant!
If they took the time to install the thing, through multiple missteps and retries, once your thing finally works you know they're just going to load it up and go.
Let them, but later, if they want to make any changes or see their data, make them find the password. They won't delete it.
DO you want this to happen? From Slashdot:
A Hacker Has Wiped, Defaced More Than 15,000 Elasticsearch Servers (zdnet.com)
For the past two weeks, a hacker has been breaking into Elasticsearch servers that have been left open on the internet without a password and attempting to wipe their content, while also leaving the name of a cyber-security firm behind, trying to divert blame. From a report:According to security researcher John Wethington, one of the people who saw this campaign unfolding and who aided ZDNet in this report, the first intrusions began around March 24. The attacks appear to be carried with the help of an automated script that scans the internet for ElasticSearch systems left unprotected, connects to the databases, attempts to wipe their content, and then creates a new empty index called nightlionsecurity.com. The attacking script doesn't appear to work in all instances, though, as the nightlionsecurity.com index is also present in databases where the content has been left intact.
Look at all the routers at Best Buy, there's a sticker on them with the admin password ! Brilliant!
Perry
Wednesday, March 25, 2020
So is there any question we're in an active Cyberwar?
It's bad enough that we're in the middle of a global pandemic, but the Chinese are actively attacking our government and commercial organizations. The good thing is that they're being called out by FireEye and shedding some light on their antics.
More information about APT41 can be found on the MITRE ATT&CK site
https://attack.mitre.org/groups/G0096/
https://www.fireeye.com/blog/threat-research/2020/03/apt41-initiates-global-intrusion-campaign-using-multiple-exploits.htmlBeginning this year, FireEye observed Chinese actor APT41 carry out one of the broadest campaigns by a Chinese cyber espionage actor we have observed in recent years. Between January 20 and March 11, FireEye observed APT41 attempt to exploit vulnerabilities in Citrix NetScaler/ADC, Cisco routers, and Zoho ManageEngine Desktop Central at over 75 FireEye customers. Countries we’ve seen targeted include Australia, Canada, Denmark, Finland, France, India, Italy, Japan, Malaysia, Mexico, Philippines, Poland, Qatar, Saudi Arabia, Singapore, Sweden, Switzerland, UAE, UK and USA. The following industries were targeted: Banking/Finance, Construction, Defense Industrial Base, Government, Healthcare, High Technology, Higher Education, Legal, Manufacturing, Media, Non-profit, Oil & Gas, Petrochemical, Pharmaceutical, Real Estate, Telecommunications, Transportation, Travel, and Utility. It’s unclear if APT41 scanned the Internet and attempted exploitation en masse or selected a subset of specific organizations to target, but the victims appear to be more targeted in nature.
More information about APT41 can be found on the MITRE ATT&CK site
https://attack.mitre.org/groups/G0096/
Friday, January 17, 2020
Cool Dashcam has a security flaw
From Slashdot: Dashcam Flaw Allows Anyone To Track Drivers In Real-Time Across the US
An anonymous reader quotes a report from Motherboard:BlackVue is a dashcam company with its own social network. With a small, internet-connected dashcam installed inside their vehicle, BlackVue users can receive alerts when their camera detects an unusual event such as someone colliding with their parked car. Customers can also allow others to tune into their camera's feed, letting others "vicariously experience the excitement and pleasure of driving all over the world," a message displayed inside the app reads. Users are invited to upload footage of their BlackVue camera spotting people crashing into their cars or other mishaps with the #CaughtOnBlackVue hashtag. But what BlackVue's app doesn't make clear is that it is possible to pull and store users' GPS locations in real-time over days or even weeks. Motherboard was able to track the movements of some of BlackVue's customers in the United States.
Ordinarily, BlackVue lets anyone create an account and then view a map of cameras that are broadcasting their location and live feed. This broadcasting is not enabled by default, and users have to select the option to do so when setting up or configuring their own camera. Motherboard tuned into live feeds from users in Hong Kong, China, Russia, the U.K, Germany, and elsewhere. BlackVue spokesperson Jeremie Sinic told Motherboard in an email that the users on the map only represent a tiny fraction of BlackVue's overall customers. But the actual GPS data that drives the map is available and publicly accessible. By reverse engineering the iOS version of the BlackVue app, Motherboard was able to write scripts that pull the GPS location of BlackVue users over a week long period and store the coordinates and other information like the user's unique identifier. One script could collect the location data of every BlackVue user who had mapping enabled on the eastern half of the United States every two minutes. Motherboard collected data on dozens of customers.Following the report, BlackVue said their developers "have updated the security measures" to prevent this sort of tracking.
Motherboard confirmed that previously provided user data stopped working, and they said they have "deleted all of the data collected to preserve individuals' privacy."
An anonymous reader quotes a report from Motherboard:BlackVue is a dashcam company with its own social network. With a small, internet-connected dashcam installed inside their vehicle, BlackVue users can receive alerts when their camera detects an unusual event such as someone colliding with their parked car. Customers can also allow others to tune into their camera's feed, letting others "vicariously experience the excitement and pleasure of driving all over the world," a message displayed inside the app reads. Users are invited to upload footage of their BlackVue camera spotting people crashing into their cars or other mishaps with the #CaughtOnBlackVue hashtag. But what BlackVue's app doesn't make clear is that it is possible to pull and store users' GPS locations in real-time over days or even weeks. Motherboard was able to track the movements of some of BlackVue's customers in the United States.
Ordinarily, BlackVue lets anyone create an account and then view a map of cameras that are broadcasting their location and live feed. This broadcasting is not enabled by default, and users have to select the option to do so when setting up or configuring their own camera. Motherboard tuned into live feeds from users in Hong Kong, China, Russia, the U.K, Germany, and elsewhere. BlackVue spokesperson Jeremie Sinic told Motherboard in an email that the users on the map only represent a tiny fraction of BlackVue's overall customers. But the actual GPS data that drives the map is available and publicly accessible. By reverse engineering the iOS version of the BlackVue app, Motherboard was able to write scripts that pull the GPS location of BlackVue users over a week long period and store the coordinates and other information like the user's unique identifier. One script could collect the location data of every BlackVue user who had mapping enabled on the eastern half of the United States every two minutes. Motherboard collected data on dozens of customers.Following the report, BlackVue said their developers "have updated the security measures" to prevent this sort of tracking.
Motherboard confirmed that previously provided user data stopped working, and they said they have "deleted all of the data collected to preserve individuals' privacy."
Augmented Reality Contact Lenses are real!
WANT!
[ What does this have to do with info security? What DOESN'T it have to do with IS?! ]
From Slashdot Augmented Reality In a Contact Lens: It's the Real Deal
Tekla Perry writes:
Startup Mojo Vision announced a microdisplay mid-2019, with not a lot of talk about applications. Turns out, they had one very specific application in mind -- an AR contact lens. Last week the company let selected media have a look at working prototypes, powered wirelessly, though plans for the next version include a battery on board. The demos included edge detection and enhancement (intended for people with low vision) in a darkened room and text annotations. The lenses are entering clinical trials (company executives have been testing them for some time already).Steve Sinclair, senior vice president of product and marketing, says the first application will likely be for people with low vision -- providing real-time edge detection and dropping crisp lines around objects. Other applications include translating languages in real time, tagging faces, and providing emotional cues.
"People can't tell you are wearing it, so we want the interaction to be subtle, done using just your eyes," Sinclair said. He also noted the experience is different from wearing glasses. "When you close your eyes, you still see the content displayed," he says. Mojo Vision is calling the technology Invisible Computing.
[ What does this have to do with info security? What DOESN'T it have to do with IS?! ]
From Slashdot Augmented Reality In a Contact Lens: It's the Real Deal
Tekla Perry writes:
Startup Mojo Vision announced a microdisplay mid-2019, with not a lot of talk about applications. Turns out, they had one very specific application in mind -- an AR contact lens. Last week the company let selected media have a look at working prototypes, powered wirelessly, though plans for the next version include a battery on board. The demos included edge detection and enhancement (intended for people with low vision) in a darkened room and text annotations. The lenses are entering clinical trials (company executives have been testing them for some time already).Steve Sinclair, senior vice president of product and marketing, says the first application will likely be for people with low vision -- providing real-time edge detection and dropping crisp lines around objects. Other applications include translating languages in real time, tagging faces, and providing emotional cues.
"People can't tell you are wearing it, so we want the interaction to be subtle, done using just your eyes," Sinclair said. He also noted the experience is different from wearing glasses. "When you close your eyes, you still see the content displayed," he says. Mojo Vision is calling the technology Invisible Computing.
Saturday, July 13, 2019
So Google has humans listening to more conversations. How much and can we manage it?
And can we trust them?
Well, apparently not, from Slashdot: Google Contractors Are Secretly Listening To Your Assistant Recordings
SO what did I do about it? How-to-geek had instructions to turn off these recordings here,
Here's a a google search that shows even more information
https://www.google.com/search?q=google+home+recordings&rlz=1C1CHBF_enUS723US723&oq=google+home+recordings&aqs=chrome..69i57j69i64.8519j0j7&sourceid=chrome&ie=UTF-8
which I did and promptly stopped google voice commands from working
From there, I found another setting, in Google Activity Controls
Make sure "Web and App Activity" is ON, and go to "Manage Activity".
It might be set to save activity indefinitely, "
Keep until I delete manually", I set mine to "Keep for 3 months", which is the shortest amount of time.
I haven't done the same for my spouse's yet, or my Google search
Well, apparently not, from Slashdot: Google Contractors Are Secretly Listening To Your Assistant Recordings
A new report from Belgian broadcaster VRT News describes the process by which Google Home recordings end up being listened to by contractors -- and the scary part is that it apparently doesn't take much, if anything, to start a recording. While the recordings are not listened to live, audio clips are sent to subcontractors. The Next Web reports:
The Next Web reports:VRT, with the help of a whistleblower, was able to listen to some of these clips and subsequently heard enough to discern the addresses of several Dutch and Belgian people using Google Home -- in spite of the fact some hadn't even uttered the words "Hey Google," which are supposed to be the device's listening trigger. The person who leaked the recordings was working as a subcontractor to Google, transcribing the audio files for subsequent use in improving its speech recognition. They got in touch with VRT after reading about Amazon Alexa keeping recordings indefinitely.
SO what did I do about it? How-to-geek had instructions to turn off these recordings here,
Here's a a google search that shows even more information
https://www.google.com/search?q=google+home+recordings&rlz=1C1CHBF_enUS723US723&oq=google+home+recordings&aqs=chrome..69i57j69i64.8519j0j7&sourceid=chrome&ie=UTF-8
which I did and promptly stopped google voice commands from working
From there, I found another setting, in Google Activity Controls
Make sure "Web and App Activity" is ON, and go to "Manage Activity".
It might be set to save activity indefinitely, "
Keep until I delete manually", I set mine to "Keep for 3 months", which is the shortest amount of time.
I haven't done the same for my spouse's yet, or my Google search
Saturday, July 6, 2019
Face Recognition for air travel - not theoretical, Delta is testing in Minneapolis...
Slashdot: Delta Airlines Begins Using Facial Recognition Scanners To Replace Boarding Passes
Oh, burying the lede - the flyer doesn't need to get their picture taken - "They already have it."
Lileks: It's time for us to face the future, literally
When the same thing happened on JetBlue, I gave them the benefit of the doubt - thinking if it's international, the process needed it from the passport database for entry into the country - that's wrong I think
Gizmodo: What Your Airline Won't Tell You About Those Creepy Airport Face Scanners
Oh, burying the lede - the flyer doesn't need to get their picture taken - "They already have it."
Lileks: It's time for us to face the future, literally
When the same thing happened on JetBlue, I gave them the benefit of the doubt - thinking if it's international, the process needed it from the passport database for entry into the country - that's wrong I think
Gizmodo: What Your Airline Won't Tell You About Those Creepy Airport Face Scanners
Subscribe to:
Posts (Atom)
