Child tweets gibberish from US nuclear-agency account
bbc.com
bbc.com
Although you can't do anything to the systems that this agency deals with via the back end to this website, the scope of abuses that someone could engage in if they had these credentials is quite broad, ranging from "Agency XYZ endorses PQR" to "Agency XYZ will begin action against LMN".
Or, if you can't see the implications of that ability, consider that there's an entire cult of folks in the US that has some pretty questionable beliefs based on the mere assertion of "clearance" by an anon poster on a chan board... imagine how damaging it would be if those assertions could be "demonstrated" via an agency account?
I think these same people failed to learn the lessons of the 9/11 commission or have horse blinders on so they only apply those learnings to air travel or military contexts.
Think you aren’t worth anyone’s time to hack? Assume hacks are 100% automated — they aren’t targeting you, but if you are vulnerable they won’t do anything to avoid you.
Think you aren’t the biggest target? Assume it costs no more to hack the marginal device / server / Twitter account than it costs to send a single email. Assume the person running this hack is being paid a low wage in the poorest country - your coffee money is a decent day’s wages for them.
Think you have no assets to lose? Assume they can force you deep in debt to the extent that some greedy financial company will offer them a large loan in your name.
https://en.wikipedia.org/wiki/We_begin_bombing_in_five_minut...
Time to update that, then!
We lived on O'ahu when it happened and the topic still comes up occasionally. At the time, it was quite traumatic for myself, my wife, and our kids. I spoke to a large number of people who were still in a state of shock in the following week. At least one person died of a heart attack.
Errant tweets or text messages like this from positions of authority have the potential to have very real and major effects on people's lives. Don't downplay the power they hold.
BALLISTIC MISSILE THREAT INBOUND TO HAWAII. SEEK IMMEDIATE SHELTER. THIS IS NOT A DRILL.
I turned on the radio and FM stations were playing the Emergency Broadcast System's well known emergency tone followed by a computerized voice playing the same message as above on repeat.
When faced with this information, time is of absolute essence. The price of taking your time to doubt things and evaluating the veracity of the information means you're not acting to potentially prevent the immient death of yourself and your family.
In this scenario, you cannot expect people to do anything but take things at face value and seek immediate shelter.
People who think they're "good at evaluating information" and ignore emergency notifications can and do quite often end up dead.
The core rule for any alerting system is to trigger if and only if those-to-be-alerted must take some sort of action. In this case, I was tired, pardon the pun, of being blasted out of a deep slumber at 3am for an earthquake that was so weak I could not feel it.
The only action I needed to take was to try and fall asleep again, which isn't terribly easy after your phone has jacked itself to maximum volume with urgent news of impending doom.
After the fourth time in something like two weeks, that alarm was disabled. It was useless.
Kudos to the designer for the earthquake alarm sound, though. That bit does its job brilliantly -- it instantly grabs your attention without deafening you, and you know exactly what is going on.
This Twitter incident is a complete joke in comparison. While you should certainly be judicious if you're in any sort of significant communications role, I really don't care what's on USSTRATCOM's Twitter. I didn't even know they had a Twitter nor would I consider the information there more than a frequently updated newsletter. Give the employee a break, it's really not that big of a deal.
https://en.wikipedia.org/wiki/The_War_of_the_Worlds_(1938_ra...
> The response may have reflected newspaper publishers' fears that radio, to which they had lost some of the advertising revenue that was scarce enough during the Great Depression, would render them obsolete. In "The War of the Worlds", they saw an opportunity to cast aspersions on the newer medium: "The nation as a whole continues to face the danger of incomplete, misunderstood news over a medium which has yet to prove that it is competent to perform the news job," wrote Editor & Publisher, the newspaper industry's trade journal.[2][55]
> William Randolph Hearst's papers called on broadcasters to police themselves, lest the government step in, as Iowa Senator Clyde L. Herring proposed a bill that would have required all programming to be reviewed by the FCC prior to broadcast (he never actually introduced it).
And we all know Hearst would have no incentive to gin up something to make radio look bad and newspapers look better.
> Few contemporary accounts exist outside newspaper coverage of the mass panic and hysteria supposedly induced by the broadcast. Justin Levine, a producer at KFI in Los Angeles, wrote in a 2000 history of the FCC's response to hoax broadcasts that "the anecdotal nature of such reporting makes it difficult to objectively assess the true extent and intensity of the panic.[56] Bartholomew sees this as yet more evidence that the panic was predominantly a creation of the newspaper industry.[57]
"Canada: Totally okay, these things happen."
Leave US Strategic Command Launch Portal open for child to launch missiles against Ontario, Canada:
"United States: Totally okay, these things happen."
> Leave US Strategic Command Launch Portal open for child to launch missiles against Ontario, Canada:
"Canada: Totally okay, these things happen."
https://en.m.wikipedia.org/wiki/Quebec_sovereignty_movement
Quebec is the Texas of Canada, if I recall correctly.
There was a third, though unlikely option of the target switching to Alberta, but it turning out to be okay, because it just happened to coincide with a sudden invasion of hyper-intelligent rats, and the human population had already evac'd.
That being said, thank you. You genuinely brightened my day.
That's my understanding too. Or California with a more serious Calexit movement.
For most companies and organizations, this is absolutely understandable. WFH is challenging, and balancing childcare even more so.
In this case, though, it begs the question - why does US Strategic Command even have a Twitter account? Are they going to post fun and engaging tweets about the nuclear football? Twitter seems like something this agency should not be doing.
Link to a reasonably informative description of a research project on some sort of advanced ramjet being developed in partnership with Norway
Retweet of a paper detailing recent developments in China's plutonium production capability
Video interview with some Lt about life aboard a submarine and the general submarine career field
Photos of some sort of training exercise using very large bombs and a link with more info
Info on how air force bases operate with covid
Etc...
All seems pretty interesting to the types of folks who would follow the US Strategic Command twitter
As for why would e.g. US Strategic Command ever need to actually post something? I'm at a loss to be honest.
FWIW the @CAFinUS account is a good follow, with a mix of history, humor, etc. Pretty good for a government account.
I see you’ve never lived in a Canadian city that has lost the Stanley Cup. Or in the case of Montreal, won it.
Canada’s border agency account likes to tweet pics of them “expediting” vaccine clearances while border holdups are their fault in the first place.
Like, thanks for circumventing your slow process, but let’s not celebrate your on-tarmac releases as an unusual practice.
Meanwhile when they reduce their hours of operation (useful), they bury it on their website because people might (rightfully) complain too directly.
It might even be the same person who manages the United States account.
Back in the early 00's, there was a Linux kernel module or program to detect and eliminate feline keyboard input.
This software is the only winner so far of an Ig Noble prize in the category of Computer Science: https://www.improbable.com/ig-about/winners/#ig2000. See https://priceonomics.com/the-software-that-detects-when-a-ca... for a write-up.
Apparently this is still maintained, as it is described as compatible with Windows 2000, XP, Vista, 7, 8, and 10 (excepting "Metro/Modern" mode). Written by this charming coder: http://chrisniswander.com/.
[edited for grammar -- and should note that, of course Linux and ilk OS do offer a "cat" command]
This is a social media manager who’s working from home that we’re talking about here.
On the basis of these facts alone I can be relatively confident that the U.S. nuclear posture wasn’t seriously in jeopardy.
I don't blame the social media person, but I am pretty surprised that the US Strategic Command allows their Twitter account to be operated from an insecure location.
The things you can leave out at age 1 are different than age 2, or 5, or 10, or 15.
Also, significant American politics are not being run from twitter anymore.
Bear in mind we're talking about the same Twitter that only last year lost control of an administrator account resulting in a Bitcoin scam tweeted from one former U.S. President and one future one.
It would be embarrassing, but yeah that's it.
Edit: that was a great Chaos Monkey to reiterate security hygiene. Or was it a Mini Chaos Monkey? https://netflix.github.io/chaosmonkey/
Having attempted to encourage this as a habit for my users for about a year, and not a single one doing it, I've had to come up with other solutions that takes it out of their hands. (It's not business-critical for us, however we try to encourage good security habits all around).
So no, I don't think it is an automatic reaction for the majority of people. Although, this is government - so I would have expected a bit more rigor. Perhaps working in a home environment contributed to relaxing of security habits.
Side note: Windows + L was a bit easier to remember than Ctrl+Alt+Del -> Enter -> Enter for the users who made good faith efforts at making it a habit
We weighed our options and decided that it was a battle we would rather not waste our effort and risk staff animosity with. When a more serious security incident occurs, or when we decide to implement something else that may require staff effort, we believe that our staff will be more willing to work with us towards a solution.
Sometimes with security policy, a little give (proportional to risk analysis) can go a long way with non-technical staff. I'd rather work with staff to come up with processes that work for both the security staff and all other staff members than become so rigid in my security policy that I may inadvertently alienate the security staff - which has many risks itself.
In my old office, we had this team "tradition" that was supposed to encourage people to lock their desktops. If they left their office for whatever reason and left their desktop unlocked, anyone from the team jumps up to the machine. Then they send an email to the rest of the team on behalf of the person who left their desktop unlocked, saying that they are bringing cookies to share with the team tomorrow.
It worked out well for quite a few years, with people being more mindful about locking their machines. And their "punishment" for not doing so was just sharing cookies with the rest of the team the day after and hearing a couple of jokes about the situation. Overall, very positive experience, no one got upset about anything, because their machines themselves weren't screwed with, their work productivity wasn't lost due to it, and everyone shared a moment and baked goods.
Change their profile photo (github/slack/etc).
Flip their monitor orientation.
Swap to left-handed mouse buttons (or vice-versa).
Go on Amazon and add some "interesting" things to their wishlist/cart.
Go on Youtube and "like" a bunch of random videos.
When the …mark… sits down, inevitably with several… "witnesses" behind them, who then point out in "astonishment" the folder on their desktop, they try (in vain) to highlight it to delete it.
(Not appropriate for the workplace, of course.)
Also, scotch tape is not transparent to optical mice? and blocks the sensor. Had that one pulled on me once, took a while to figure it out.
I can tell you, that person never left that thing unlocked ever again.
alias ls=echo "Segmentation Fault" source ~/.bashrcIt took several months for him to catch on; for a while I had him convinced that his hardware must have an issue where the laptop being left idle for too long caused it to mess up somehow.
I can think of other broadcast communications that would get people fired.
Can't it be required by a group policy?
I guess this means setting the timer really low, so that it auto locks after a very short time?
The IT department at my former employer tried this out company-wide and it almost led to them getting attacked physically. When every simple distraction leads to you getting locked out of the desktop (phonecall, boss or coworker having a question) it builds frustration quickly. Pair this with frequently changing (company-mandated) complex passwords and permanent lockut after a few mistypes and you have a recipe for disaster: Even some of my technologically less-inclined co-workers researched how to bypass Windows security with hacking tools.
I used to work at a nuclear energy services consultancy. I heard a story about how an energy think-tank had particular rooms with power-saving motion occupancy sensors for the lights. The problem was sitting still at a computer would result in the lights suddenly going off. An engineer solved this problem with a drinking bird toy with a warm bowl of water right at the level of the sensor.
If you want users to adopt secure practices then you have to lower the amount of friction. Adding a fingerprint reader or some other kind of biometrick unlocking capability would probably help.
A better example: I think on macOS the system can be setup to automatically lock and unlock by wearing an Apple Watch.
The users aren't the ones that have to be trained, it's the flawed security practices that need to be fixed.
For those with a Mac and an Apple Watch you can make the watch automatically lock and unlock based on Bluetooth distance.
I deployed WHfB at our $LARGE_ENTERPRISE and opted against using BT RSSI as a trusted signal because it's just too unpredictable. Probably because the Windows space is much more varied, but an RSSI that'd work for one device at ~8' away would fail to lock another when two cube rows away. Meaning, we knew users would start to depend on it, but it wouldn't work as they thought.
Thus, still policies of locking machines, it's now just easier to unlock. (And arguably more secure because now less password typing means far fewer chances for keyloggers to get network-usable credentials.)
Which RDP client were you using? And did you disable the password provider (leaving just the WHfB factors)?
And you had full Windows Hello for Business? (This one: https://docs.microsoft.com/en-us/windows/security/identity-p...)
Or, were you using standard Hello? (The two are similarly named, but are quite different under the covers.)
Also - in the office if you leave your computer unlocked you may find that you have emailed the team and promised to bring everybody doughnuts tomorrow.
Hahah, nice! That's an awesome office. :D
Note that I have face ID disabled because I got really fed up of my computer unlocking itself just because I'd gone back to my desk to pick up something I'd forgotten when I locked it and walked away. This always seemed incredibly insecure to me, not to mention very annoying.
FWIW, this was a somewhat buggy install of Windows 10 (Settings->Devices->Add a Bluetooth device would crash reliably), so I don't particularly expect this to be widespread/reproducible.
I don't remember ever experiencing it with other machines but the reality is that since 2015 I've only actually used Windows 10 with three other computers:
1. A Dell desktop machine with no touchscreen or camera back in 2016,
2. My Macbook Pro, in 2016/17, where I used Windows 10 as a Parallels VM,
3. An Intel powered Surface laptop that I used at work from 2017 - 2019.
I don't remember any issues with the desktop machine. With the Mac I used the OSX screen lock so it was a complete non-issue (of course Windows would still lock itself but I wasn't careful about locking it manually).
The Surface was so wrought with glitches and problems that the lock screen not working properly would have been the absolute least of them. It was one of the worst and least reliable computers I've ever had to tolerate, bested in this regard only by my ZX Spectrum 48K+ back in 1986/87, and the Spectrum +2A that followed it in 1988/89. An awful, overpriced, underspecced paperweight of a computer. Avoid.
Can you provide anything else on this, rather than just casually claiming one of the most popular OSes has a massive security bug?
It happens infrequently enough that the first handful of times I thought I must have just forgotten to lock the machine. Eventually I realised that wasn't so and I wasn't just imagining it because, of course, by this time I'd become ultra-paranoid about locking the thing.
I'm running a ~2 year old Dell XPS equipped with a touchscreen. It's a decent machine for my needs but nothing special or exotic, and certainly I can't see any reason why this would be an issue.
I don't know what else to tell you other than I wish I was making it up.
What exactly do you mean by "swiping up"? Are you using Win10 on a tablet?
As I said in another comment, the first few times I thought I must simply have forgotten to lock the machine. But of course then I became paranoid about locking the machine and so when it continued to happen from time to time I realised something really wasn't quite right.
Like I say though, it's just not behaviour I can reproduce on demand - super annoying.
It's most likely some quirk of my machine configuration, or possibly a driver issue (though I tend to like to keep things up to date), but I have a super-unadventurous Dell XPS so it doesn't make a whole lot of sense.
Pull the smart card out, and the device locks. Most people do a good job of taking the card with them, from what I've seen. Although it can be a pain in the ass when you have to resize windows or enter the card pin ~3 times to get logged back in.
Though, I admit, if I'm working late and I'm the only one left in the building then I don't lock the computer.
I'd imagine many computer uses don't know how to lock their computers if they weren't taught by IT - many "obvious" things to a tech savvy person are unknown by your average office worker (you can't imagine how many people I've taught to use CTRL+F)
Also, the shortcut is Windows Key+L.
And then it calms down and all is well unless the cable decides not to connect at full speed, and I get to cycle it.
Win+L.
This may be because I've always hated the windows key, and would sometimes seek out keyboards that didn't have one.
So then one actual human has the credentials for the actual twitter account in question. That's possible??
https://www.scribd.com/document/500831873/FOIA-U-S-Strategic...
(And anyway, surely viewing a web page counts as an interoperable web standard already?)
While this doesn't address the number one issue (the kid on the keyboard) it does provide a certain amount of accountability and transparency into how a public sector agency pushes their communications out into the world / digital commons.
Gentlemen, you can't fight in here. This is the war room!
Animals vill BE BRED UND SCHLAUTERED!
Another 'analysis' of the key presses:
Right hand first: ;l;;
then left hand: g
right hand again: lm
then wrap up with left hand: xzssaw
"There are some games where the best move is to not play."
Best link I could find: https://newsinfo.inquirer.net/1347310/house-tweets-birthday-...
Because of this which provides a solution as "Q ACQUITTED":
;l;;gmlxzssaw
Most likely there is somebody hired to post to the twitter account from time to time, who has absolutely no oversight responsibilities or access to anything more substantial, they work from home and they forgot to lock their computer.
How is that a story for BBC? Nothing really more interesting happening?
"They have news conferences and can release memos. Why would you need a website!? What a waste of money!"
Considering you also mockingly call it "twatter", I'm guessing you might just be out of touch.
But then it's just a twitter account, sure from the US nuclear-agency, but so what. Social media accounts get hacked all the time so this is IMHO not really that serious...
...if the computer isn't also used for more "high-security" applications, in which case I'm worried because of non appropriate screen locking setups might imply non appropriate security in other parts of the setup, too.
Island website is being moved and updated.
Email me a@175g.com if You like.
- Henceforth, all tweets can only ever be sent from a remote-desktop server that has to be hosted in a security-clearance-5 site
- In order to access the remote-desktop, 2 government employees, who both have 10+ years of government experience, will need to jointly log into the server together. The 2 users will need to alternate keypresses and mouse-clicks, in order to prevent either one from abusing their power
- Both employees will need to be using a computer that comes equipped with a built-in webcam, that has been security cleared by the NSA. This webcam should be running NSA custom-built software that continuously monitors the faces of both employees, and locks the computer if it detects anything suspicious or anomalous
- To prevent the possibility of misuse or bias, all tweets will need to be pre-cleared by the CIA's department of information warfare
In other news, why does it cost the government so much money, and take so long, to get anything done!? Stay tuned for more.
Also, I took your comment to be satire, but it’s hard to tell that from truth these days.
Submitting the tweet requires turning two keys at the same time, the keys are reissued every 24 hours.
The password to unlock the computer is written with invisible ink in a microfilm contained inside a spy coin in a fake book which can only be found in a public library in Alaska corresponding to the volume #25 of the 1951 Encyclopedia Britannica, an encyclopedia that only had 24 volumes originally.
The password is punched into cards in reverse order. Then, these punched cards are used as an stencil that can be scanned with a fake Android barcode app that returns thingiverse url which can be used to 3d print a key that will unlock the chest where the actual password is contained.
The second key is obtained by calling the phone number found in the tag of a XXXL Harambe t-shirt from a specific vendor on Amazon.
The phone number will emit a fake busy tone for 5 minutes and then an operator will pick up and answer in the Klingon language.
Don't be ridiculous. Every organization has protocols in place. It might seem inherently wasteful, but they actually save money by preventing costly mistakes.
A better feature would be for laptop cameras to auto logout the user when they step away and let them log back in without authentication within 15 min. I think that better solves the unattended laptop problem than anything else. You can kind of get there with BLE keys but face authentication would work much better for presence detection (maybe do both BLE + face).