https://grh.am
A combination of cyber security, project ideas, and general ramblings.
851 karma · joined May 29, 2014
Email: graham@grh.am
A combination of cyber security, project ideas, and general ramblings.
LidLayer - https://lidlayer.com
Well, I'm back, and this time I've managed to turn this into an actual physical product! It all started with a simple blog post back in 2019, which gained enough traction on various websites that it seemed worthwhile pursuing. So, a Kickstarter[0] was, well, started – but it never gathered enough momentum to get it across the line (and looking back, rightly so), and so everything got put on hold.
Then the pandemic happened, and I’m kind of glad the idea hadn’t taken off. I did however continue to get a trickle of messages and DMs asking what happened to LidLayer, and if there were any plans for the future…
Fast-forward a year or two, and I get the opportunity to go to a conference for work – the beautiful Objective by the Sea (ObtS)[1], where I am surrounded by stickered MacBooks! The idea of LidLayer immediately pops back into my head, and I can’t help but take another look at it, to see if I can make it work (it must be good if I keep coming back to it, right?).
So, I managed to find a supplier who can accurately cut the LidLayers way more cost-effectively than I ever could, meaning I could finally bring this whole thing back to life. And, what that also means is that because the cost of producing these has gone down, I can pass that saving on to you! Win win win!
[0] https://www.kickstarter.com/projects/grham/lidlayer-protect-...
We ran something similar, firing ‘insiders’ across many of the top 100 sites and services, to spot breaches (either in the traditional sense of security incidents, or lapses in privacy for end users).
It got enough attention that it only seemed fair to give this a real chance, and for that, I decided to try out Kickstarter.
It got enough attention that it only seemed fair to give this a real chance, and for that, I decided to try out Kickstarter.
It is primarily for public and/or untrusted WiFi connections, or so that I can take packet captures of iOS applications easily without a jailbreak or connecting the phone via USB to a Mac.
The primary niggle I came across was transferring the keys between my host and the client, however after a bit of tweaking I found it far easier to just utilise the QR codes option. For those interested, I wrote about my experiences on my blog[0]
I was never really happy with the visual format of my site, which I think put me off writing at times - “if it were me, I’m not sure I’d read this in this format, it’s too visually taxing”. However with a quick style change to something much more basic, I’m feeling much more confident.
I think my final hurdle, which this article may help with, is my writing style. I get the impression that my ‘style’ changes fairly regularly, or depending on the topic or post I write for a different audience. This likely doesn’t matter too much for those visitors who come for a single post and move on, but anyone who would like to peruse around may get a slightly jarring experience.
It is unclear from any reporting as to how this technically happened, which is a shame but hopefully that will be made public in the coming days. Some other outlets[0] have an interesting statement:
> The breach also included details about where each passenger had traveled and any comments made by customer service representatives. The amount of data accessed varied among passengers.*
Based on those details, and the mention of 'no passwords were compromised', chances are this breach has come from an internal helpdesk type system, or possibly CRM. If however the statement around the passwords changes, that opens up a few other possibilities.
What this doesn't sound like, are the attacks we saw on British Airways[1] and Ticketmaster[2], where javascript was injected into the payment pages to vacuum up payment details from customers.
The statement around "The company has no evidence that any personal information has been misused" is always an interesting one, and is one of the many reasons I created my startup Breach Insider[3], so that data breaches like this could be detected much sooner (not 7 months later, as we have seen here), with minimal false positive alerts, and definitive evidence if any data has been misused. By using real email addresses that are unique to each company/business, you can be sure to find out if that data ever leaks & is abused for things like spam or phishing.
[0] https://www.theverge.com/2018/10/24/18019958/cathay-pacific-...
[1] https://www.britishairways.com/en-gb/information/incident/da...
[2] https://www.riskiq.com/blog/labs/magecart-ticketmaster-breac...
> The breach also included details about where each passenger had traveled and any comments made by customer service representatives. The amount of data accessed varied among passengers.
Based on those details, and the mention of 'no passwords were compromised', chances are this breach has come from an internal helpdesk type system, or possibly CRM. If however the statement around the passwords changes, that opens up a few other possibilities.
What this doesn't sound like, are the attacks we saw on British Airways[1] and Ticketmaster[2], where javascript was injected into the payment pages to vacuum up payment details from customers.
The statement around "The company has no evidence that any personal information has been misused" is always an interesting one, and is one of the many reasons I created my startup Breach Insider[3], so that data breaches like this could be detected much sooner (not 7 months later, as we have seen here), with minimal false positive alerts, and definitive evidence if any data has been misused. By using real email addresses that are unique to each company/business, you can be sure to find out if that data ever leaks & is abused for things like spam or phishing.
[0] https://www.theverge.com/2018/10/24/18019958/cathay-pacific-...
[1] https://www.britishairways.com/en-gb/information/incident/da...
[2] https://www.riskiq.com/blog/labs/magecart-ticketmaster-breac...
Here is an example of the sticker/skin and the finish. Excuse the slightly 'off' cut on the corner – I'm looking to produce a highly accurate template for each of the various models. https://imgur.com/FfQ3XQs
I want the skins to be identical to the original laptop material so that they are practically invisible. So for the MacBooks, a silver aluminium sticker (or space grey etc.)
I’ve done a proof of concept and it worked brilliantly (in the process of writing this up) and its allowed me to display my old ‘laptop’ as a keepsake, whilst being able to sell the laptop on in almost perfect condition.
I’m thinking of going down the crowdfunding route, as a way of proving there is a market, as well as helping to fund someone of the equipment needed.
Edit: Added they’d be a near identical match to the original laptop, rather than just a plain ‘sticker’
The obvious idea is to put them on your laptop, but that can make reselling it difficult, and you lose those stickers if you sell it with them still attached.
So... I’ve managed to find some sticky-backed vinyl that looks almost exactly like the aluminium used on the MacBooks and MacBook Pro’s. I’ve stencilled and cut out a couple of lids and when applied you can barely tell they’re on there. They look awesome.
I’ve had them on nice hot laptops for a couple of months (with cool stickers applied on top) and they peel off fairly easily, but most importantly, leave zero residue.
I’m planning on figuring out if there’s a market for these ‘skins’ and going from there. I’ve take pictures along the way so I’ll put a blog together about it shortly, and gauge interest.
* Data breach detection made easy, using pseudo-users with real information, unique to your business.
* Current stage: Bootstrapped and profitable. Working on (gradual) growth!
* Content marketing.. lots and lots of content marketing, to build our 'trust' within the community. There is nothing worse than a security startup that no-one has heard of.
[0] https://www.yubico.com/2018/02/wired-ars-technica-experts-ch...
Proxying requests to a third-party will mean browser security features like CORS will assume they are entirely safe due to them appearing to come from your domain, and not “gist.github.com” etc.
I ask because the curriculum looks great, but wondered if the mentoring might be a little more focused towards the more traditional startups looking to progress to VC funding, rather than those of us that are taking things a little slower on our own.
Good news! Mail access has been restored for users on some major networks. We apologize to those customers who still cannot reach their Inboxes - we're working to restore full access as fast as we can. No mail has been lost during this downtime. https://www.fastmailstatus.com
3:09 AM - 1 Aug 2018
We're experiencing a network outage. Stay tuned at https://www.fastmailstatus.com . We're in close communication with our provider trying to restore service.
1:34 AM - 1 Aug 2018