SCHiM

I am half convinced you can build a successful cyber security business putting a box in a network that does absolutely nothing. I think there's a requirement to at least show a blinking led and have a, not necessarily patched, cable plugged in. But that's about it.

My thinking is, that if you show a cool enough interface (not connected to the box), with lots of widgets and stats, and they don't detect a hack in the time span of 2 years, you can probably walk away with pretty penny! If they do get hacked, just pretend you technically _did_ see the alert, but a junior employee on your side failed to act on it. Sack them, and then re-hire them later. They are the 'fall' person whose job is basically getting fired. Give your customer a discount and try to stay on for 2 more years!

Had you run this on old IE versions, you'd have made a decent fuzzer! If this program ever tries to put a table inside a button it'd have found a couple of crashes for sure.

> That's usually a good thing.

For any individual company able to offload the blame, that's great. It's not so great if half the countries' doorbells, robot cleaners, various home streaming service setups, the baby camera, the fridge, the smart TV and your phone stop working... All at the same time.

In my opinion, the 'downtime' really should be measured in $NUM_SERVICES_STOPPED X $TIME, instead of just $TIME. And in this case I think any long time Amazon outage is orders of magnitudes worse than your regular old slow IT company outage.

I think this adds some momentum to the pendulum swinging back the other way. Maybe cloud teams can patch your services better than your in-house team can (See 2 critical issues in Azure the last 3 months, _caused_ by MS itself).

Maybe the cloud has a higher uptime than your on-premise infrastructure (see the AWS, Azure outages). Make sure to compare the actual outage time v.s. the stats doctored by various political pressures and weaselly worded SLAs (how do you mean you had an outage? Only 49% of your requests were failing!).

Although I can't claim a long tenure in the software development field. One of my favorite tricks/rediscovered performance enhancer can be found in a similarity between very old-school self-modifying code, and modern day profile guided JIT optimizer.

I think I read somewhere that, at some point, it was all the rage to have self-modifying code that could patch conditional branch instructions into unconditional ones (I think it was used on game consoles to save space). These days profile guided JIT compilers (or even AOT compiler) will de-virtualize calls to increase performance, which to me looks like a really similar technique.

Although I think bots should be free to access the same content as humans do, I have a suggestion for your fuzzer anti-bot-spray:

It won't work on the more sturdy samples, but maybe try a GZIP bomb on https streams: https://www.infosecmatter.com/metasploit-module-library/?mm=...

A long time ago, before my frontal lobe had completely developed, I used to develop multiplayer game cheats. I now recognize that behavior as abhorrent, but in those days I thought it was l33t.

In any case, no mater how good your protection is, how deep in the system you go, the cheaters can go deeper. Like anti-virus and DRM evasion will always win from detection. The cheaters have complete insight into any/all client side protection mechanisms, more importantly, the cheater owns the machine and the environment where your code runs. There is not a checksum that can not be faked, and no way to measure if any of your protections have been circumvented, because the code you use to measure can (and will) be patched.

I mean, obviously the best thing is:

1gram, 100gram, container size.

That way: you always know the exact amount you're actually buying, + it's easy to calculate if you consume less than the container, either by nx the amount of 1gram or nx100 gram of the product. Nothing else really makes sense, for any reason.

Same with the energy label of food. In the metric system:

Portion sizes of 65 gram in a 90 gram container. Then the label shows for 10 gram, portion size, and 100 grams. But not the actual weight of the container!

I mean, what 'portion' consists of 65/90th of a container? They know full well that the actual portion people consume $PRODUCT in is what is in the box.

Ohhh man/woman.

I'm a security person. I often work with my customers' central IT. I'm not going to have an opinion or judge you, but consider:

You're giving people nightmares. I've seen it go very wrong (front-page news wrong). And then the threads commenting on "how incompetent can they be, blabla". I've worked with the people stressed, sad and disappointed that they got pwned because of shadow IT. It's a ticking time bomb.

The cloud wont save you from shadow IT's insecurities. In two years, when you switch to another SAAS provider, or the domain changes, and the enterprise app is left in your azure subscription, and the baddies notice... Then you'll call me or someone like me, and I can earn my paycheck :)

I think this is a good thing. It might show potential victims that their opponents are not a bunch of smelly teenagers hopping online after midnight.

These are multi-million (billion?) businesses. There's strategic leadership, target acquisition pipelines, R&D, talent recruitment and coordination with other businesses in the space.

There's every indication that with a little bit of protection money, you can even run your business with no interference from the law, as long as you don't mess around in your own backyard.

You can see from the blog post, that this "company" has done a product-market-fit analysis. They've taken a look at their competitors' work, considered the pros/cons, and decided that they can do better. Since they are a b2b company (hehe) you can be reasonably sure this is not some PR aimed at consumers. I think it reads as a recruitment pitch to their lead generators (read: hackers whom infect other networks for them).

You can see the pitch, it almost reads as a vacancy post:

- We make a lot of money

- We're new to the scene but already have had success

- We only work with the best hackers

- We pay you lots of money to infect a network, if you got what it takes

A properly configured Defender ATP instance in a network is a beast to circumvent for attackers. It's a really nice piece of software as far as I'm concerned.

Defender on personal systems owned & maintained by a knowledgeable power user, maybe less useful.

Still, Defender ATP in the corporate environment is so much, much more than just an anti-virus scanner. There its primary functionality is EDR first, anti-virus distant second. And it works phenomenally.

It's the same old same old. Like you correctly identified it's a new place, it looks different. People don't think an attacker could approach them over IM, but they can.

But the problem goes beyond that. Many organizations have disabled sharing executable file formats in attachments over e-mail. GMail flat-out prevents you from sharing executables, and macro enabled word documents as attachments, even when put into a zip file.

But on Microsoft teams? I sent a zip file with 8 unsigned executables to a colleague a few days ago. No warnings, no messages, no nothing :)

I've been in security for ages, ransomware was there but has evolved since then.

Two other reasons can explain the increase in ransomware, that merely correlate with the rise of cryptocurrencies:

1) The innovation of encrypting files hadn't occurred to ransomware operators yet.

2) The value of computer systems, and data, itself increased. Massively increasing the likelihood of victims paying the ransom.

Before crypto currencies 'FBI scareware', which held your computer ransom by disabling your standard UI, simply asked you fork over the cash via Western Union.

This increases the friction for consumers, but if the colonial pipeline was ransomed in the same way, and the ransom only payable over WU, then they would have done that instead.

Because they run their operations from there, and don't mess around where they live. Part of their profits pays for protection. Extracting value, and crippling western companies aligns with the strategic goals of these countries. And ransomware is literally a 10B USD business.

Why should others decide if I can run useless hashing functions on my computer? Price the electricity accordingly, and make PoW impossible.

Cryptocurrency is no the enabler of ransomware. Ransomware was prevalent before cryptocurrencies. The real enablers of ransomware are the countries that shelter the R10 groups, raking in millions.

There's a reason some ransomware doesn't run when your system has a Russian language keyboard, and it's not because they know Russians never pay ransom...

I mean, a bullshit job is someone who spends their entire workday in meetings, answering e-mails and generating reports. None of which is useful if it isn't actually in support of _real_ work.

If you were to mediate conflicts all day between super talented, but very quarrelsome, experts: that's useful work. If you spend your entire day mediating conflicts between mediocre developers bikeshedding over logging frameworks, a topic that only came up because of nihysim: that's a bullshit job. Those developers are not useful, and neither are you.

I mean, just imagine, you go the the slave market and they tell you that the court ordered them to stop selling slaves on the basis that some laws say that you cannot do so!

Burning fossil fuels is bad. Shell is in the business of producing fossil fuels to burn. Shell needs to leave that business in the very long term. What's the problem here?

""" How can the adversary construct unencrypted Wi-Fi frames so they are accepted by a vulnerable device? First, certain Wi-Fi devices accept any unencrypted frame even when connected to a protected Wi-Fi network. """

This actually made me angry. How fucking long are we doing this already? This is so. basic. Why is this possible? This should incur liability, we know the IT environment is adversarial.

I understand one can make technical mistakes, or shoot oneself in the foot in low level languages that are difficult to handle correctly. But this is a conceptual mistake, involving crypto! How can you possibly have written this code for an issue like this to occur? What is the control flow that leads to this? I almost cannot imagine how someone could code this up by accident, this must be a backdoor. Just imagine:

  if decrypt(encrypted) == false
  {
    memcpy(plaintext, encrypted); // lets try to use the encrypted data anyway, you never know!
  }
  handle_packet(plaintext);

Not to be too offensive, but it _is_ lazy no? This stuff is important! I feel like it's (and has been for a while) going wrong. I know user education it mostly a pipe dream. But it's all I can think of.

The iPhone is probably relatively free compared to the streamlined hassle-free applications and devices of the future. And all the while polarization in all our societies grows, until my government too has no option but to lock it down and forge social cohesion through state-sponsored psy-ops and information-ops. We'll be well on our way to a 1984 dystopia then. ---

And please, it's not like there's not time for a normal life. See my comment about my family member below. Maybe if tech people would just refuse to fix the internet, more people would understand how it works.

I mean sure IOS is hassle free and all that, but on IOS you're also a computational serf, computing at the whims of your apple overlords.

I've thought one member of my family to setup their own wireless access point. And they can reliably solve most 'the internet does not work' problems on their own now. This member used to confuse the explorer.exe window with a picture of an explorer.exe window in internet explorer, with predictable results (at the time)...

I'd rather live in the latter world than the former, time will tell if more people agree with me.

The user most definitively has to know these things. Your argument is a race to the bottom I think.

We will end up with devices where the user has to know nothing, cannot do anything and is lazy and easily led.

Just as moving yourself around on a bike is healthier than planting your ass in your car, so is thinking for yourself and _once_ in your life taking the time to figure out what that whole location sharing thing actually means.

I don't understand how this isn't common knowledge: smart TVs are universally bad. This was figured out years ago. Just get a good screen + hdmi/dvi port and attach your laptop. No ads on your screensaver, no screen tracking that otherwise wouldn't happen, it's fast, it's 100% compatible with all platforms and media (if not legally, then through torrents).

If your laptop works, and your screen works, then this setup works. What's the downside?

I don't think I have the full definition.

But if you think about online games, it becomes abandonware if you can no longer log into the game servers?

Or if your product is dependent on DRM, then is becomes abandonware when the DRM servers shut down.

I think different classes of media will require different definitions of when they become abandonware, but I think we'll mostly know it when we see it.

The difference between the time it takes physical copies to wear out is much much longer than the time it takes $company to decide that it's time to force everyone to buy the next latest-and-greatest.

I've got NES cartridges from the 80s or 90s still working.

Do you think it'd be a good idea to force companies to open source abandonware? We could claw back space from copyright laws, and force companies to remove DRM schemes, open source DRM-ed copyright, servers and any/all assets required to run "the store" locally.

This is analogous to right to repair, DRM "breaking" your property should be banned.

No, the big difference is, that if it leaked from their lab _they_ are responsible. That's not a witch hunt. If I crash my car into your car today, it does not matter that you crashed your car into someone else two years ago.

Except it is. IS used facebook for a lot of their communication. Imagine a code like:

"Ten camels drink from the water at $some oasis".

Meaning:

"Attack $city at 10 AM tomorrow"

Or

"Meet at $place at 10 tomorrow".

This has been documented extensively. All was perfectly legible by whoever can read conversations on facebook, but the meaning is lost.

This stuff probably wasn't around when IP was designed, but in my own toy routing network protocols I use bloom filters and cuckcoo filters to remove duplicate packets.

Trivial amount of space and computation, easy fix for loop issues. Especially since I assume malicious actors can always connect to any point in my toy network.

I guess the amount of computation required is too much for backbone routers, but for my toy projects it works nice :)

Who cares about the optics of it? We now know it's bad, that type of whataboutism is the most destructive and dumb kind that exists.

Serously we should just pay for their solar panels, windfarms and reactors and be done with it.