248 karma · joined January 28, 2023
Could you expand on this? I haven't seen anything on your company website that suggests detection of this kind of stuff. Also, could you explain how this could be detected? Through another eBPF program?
>Hackers appear to have targeted a US location tracking firm Gravy Analytics. It collects information through smartphones, including peoples' precise movements, and then provides it to other companies or governments.
So... those companies sold their customers' data to Gravy Analytics? You know, Cambridge Analytica style? And these hackers just siphooned data from this tracking company?
>He also told Sky News the apps named in the leak weren't necessarily working with Gravy Analytics.
>Instead, he said, software development kits used in the apps appeared to be sending off users' location data.
So... those companies used SDKs from Gravy Analytics which secretly phoned home users' data to this tracking company?
Not sure what's worse, but if this is really the case, it highlights deep flaws in the way major companies evaluate their "software supply chain".
Also, from a more technical standpoint, single API calls following an established specification (assuming that's what those SDK actually do) should be favored over SDKs. If you send a POST containing certain data, there's no way the destination gets other data from you, unless your HTTP client is vulnerable and can somehow be attacked by the company who owns those APIs.
>Either that incident or the continuing hostilities in Ukraine (which are likely to last another year at least) will cause the economy to tank again, screwing up the markets to a fair degree.
I'm not an economist or a diplomat, but I would argue that a serious Taiwan incident may be worse than continuing hostilities in Ukraine from an economic standpoint.
First, because the surprise effect is probably relevant. We have been dealing with the situation in Ukraine for a while. We know trades with Russia are very limited, European countries know they can't get reliable gas supply from Ukraine, and so on. Yes, things may get worse, and Western countries might send more (or less) money and aid to Ukraine, but at least we have already covered our bases. When it comes to Taiwan, if something significant happens, it will probably affect the semiconductor business, which goes from CPUs and GPUs to photovoltaics, all things that are highly relevant to our economy.
Also, China itself is much richer than Russia, so a prolonged China-Taiwan conflict may last for a really long time.
I wonder if this mindset is also applied, for example, to the rest of the military. Does the Army regularly practice land navigation? I know they get at least one landnav class, but it is a perishable skill. If you don't practice, you'll soon forget about it.
I guess this could also be useful to civilians. Being able to do stuff without relying too much on electronics.
We do tip, but occasionally, only if we believe something about that meal was really great, and there's no set percentage.
Also, there are no tip jars. What happens is the server brings the check to you, and you can tip the server by giving money directly to them. Of course, this doesn't mean the owner cannot pocket the tips, but it does give a feeling that the tip is more likely to reach the servers only.
You reuse connections with a connection pool, but you accidentally reuse connections with different privileges and scopes. As a result, sometimes you get to read some data you shouldn't read and sometimes you don't.
Or, concurrency bugs.
You don't properly serialize transactions and sometimes two transactions overlap in time leading to conflicts.
We get the general trend, but we don't know if that peak is 10%, 20%, 100% or something else.
Assuming this is true, and tips are not actually taken by the owners, there are two interpretations of this:
1) customer pays more than what their lunch or dinner actually costs, to intentionally signal that there was something special about it (good service,...), or
2) customer pays more than what their lunch or dinner actually costs, because they know employees are underpaid and they want to compensate for that. It's essentially a form of charity.
While I have nothing against charity, charity that is "institutionalized" (big word, I know) by the employees (a tip jar) and very strongly encouraged does seem like a nice way for employers to justify a lower pay. And even if that is not the actual reason why tips exist, an employer who knows most of its customers tip can use this to pay less its employees.
Everything is possible, I know, but the amount of hacks related to S3 misconfigurations (https://github.com/nagwww/s3-leaks), including major companies, still makes me wonder.
If this assumption is true, it begs the question. Why do people act like public cloud storage is more secure than "private", on prem storage?
Do users expect safe defaults (as in, "default deny")?
Is it just a matter of attitude, where people think public cloud is more secure because it's not managed by (potentially short-staffed) corporate IT teams, even if it's not completely managed by the cloud provider?
Or is there something else?
With ChatGPT and similar platforms, trained on SE answers (and open Github repos,...), people will eventually skip Stack Exchange and directly go to ChatGPT.
First off, there are a lot of ways to bring someone to "the dark side". Maybe it's blackmail. Maybe it's ideology ("the greater good"). Maybe it's just pumping their ego. Or maybe it's money, but not that much, and extra money can be helpful. There is a long history of people spying against their country or hacking for a variety of reasons, even if they had a job and a steady paycheck. You can't just pay people and expect them to be 100% honest for the rest of their life.
Second, most (known) vulnerabilities are not backdoors. As any software developer knows, it's easy to make mistakes. This also goes for vulnerabilities. Even as a paid software developer, uou can definitely mess up a function (or method) and accidentally introduce an off-by-one vulnerability, or forget to properly validate inputs, or reuse a supposedly one-time cryptographic quantity.
Not at all. I'm talking about running more and more rigorous security tests because you have to catch vulnerabilities, 99% of which are probably introduced accidentally by an otherwise good, reliable developer.
This can be done in multiple ways. A downstream distribution which adds its own layers of security tests and doesn't blindly accept upstream commits. An informal standard on open source projects, kinda like all those Github projects with coverage tests shown on the main repo page. A more formal standard, forcing some critical companies to only adopt projects with a standardized set of security tests and with a sufficiently high score. All these approaches focus on the content, not on the authors, since you can have a totally good-willing developer introducing critical vulnerabilities (not the case here, apparently, but it happens all the time).
On top of that, however, you should also invest in training, awareness, and other "soft" issues that are actually crucial in order to actualy improve cybersecurity. Using the most battle-tested operating systems and kernels is not enough if someone actually puts sensitive data on an open S3 bucket, or if someone only patches their systems once a decade, or if someone uses admin/admin on an Internet-facing website.
The most practical way to establish some uniform governance over how people use those tools would involve a new OS distribution, kinda like Debian, Fedora, Slackware,... but managed by NIST or equivalent, which takes whatever they want from upstream and enrich it with other features.
But it doesn't stop here. What about browsers (think about how browsers protect us from XSS)? What about glibc, major interpreters and compilers? How do you deal with random Chrome or VS Code extensions? Not to mention "smart devices"...
Cybersecurity is not just about backdoors, it is also about patching software, avoiding data leaks or misconfigurations, proper password management, network security and much more.
Relying on trusted, TS cleared personnel for OS development doesn't prevent companies from using 5-years old distros or choosing predictable passwords or exposing critical servers to the Internet.
As the saying goes, security is not a product, it's a mindset.
If the ultimate goal is to avoid backdoors in critical infrastructures (think government systems, financial sector, transportation,...) you could force those organizations to use forks managed by an entity like CISA, NIST or whatever.
If the ultimate goal is to avoid backdoors in random systems (i.e. for "opportunistic attacks"), you have to keep in mind random people and non-critical companies can and will install unknown OSS projects as well as unknown proprietary stuff, known but unmaintained proprietary stuff (think Windows XP), self-maintained code, and so on. Enforcing TS clearances on OSS projects would not significantly mitigate that risk, IMHO.
Not to mention that, as we now know, allies spy and backdoor allies (or at least they try)... so an international alliance doesn't mean intelligence agencies won't try to backdoor systems owned by other countries, even if they are "allies".
It's pretty weird but, hey, "if it works don't touch it", I guess...
Of course, if you need advanced search features, APIs for indexing and searching (Kibana) or some fault tolerance don't reinvent the wheel.
So, I wouldn't use this in any production (i.e. non single-instance) setup, but it is a useful reminder of how modern hardware and software is powerful enough to do things that would intuitively seem resource-intensive.
I think most students wouldn't appreciate theoretical applications of some math problems. Saying "hey, you know what, a slight variation of this problem leads to a famous problem in non-commutative topology" or whatever only makes people even more confused.
Also, math is by far not the only thing you study that may have no "applications".
Does anyone in "the real world" care about Shakespeare, or Emily Dickinson? It's certainly not part of most jobs.
What about biology? Sure, knowing what a plant is and what animals are can be useful (for example, if you're a vegan), but do most jobs require knowing that "mitochondria is the powerhouse of the cell"? Nope.
Or, think history. Yes, knowing something about 20th century history can be useful (though not necessary), but do you really need to know about Mesopotamia for most practical jobs? Again, no.
School doesn't just teach stuff that everyone really needs in their everyday life. It also teaches
1) stuff that could be useful for some careers, and
2) stuff that becomes part of your background and subtly teaches other useful lessons.
If school were to be focused on the most common jobs (in the US: salespeople, cashiers, waiters, office clerks), you would see a syllabus made of:
- basic math, up to percentages and maybe powers. That's it
- a lot of Excel (for salespeople and office clerks)
- enough English to be able to write a few emails and confidently talk to customers. No literature, no 1,000 word essays.
- how to carry at least two, if not three plates at a time, as well as basic knowledge about hamburgers, meat and cocktails (for waiters)
Would this syllabus prove useful? Certainly. Would this system teach people something more than what they need to live their daily life and get a paycheck (no history, no geography, no literature, no trigonometry or biology or chemistry, and so on)? No, it probably wouldn't.
Chess players sit down and think very hard about how moving a rook now could affect the game five-six moves from now. No one actually cares about chess pieces outside of... well, chess players, and there's no real life constraint on moving only diagonally or only one square in any direction. Would you say chess has negative effects on one's life?