(cache) Friday Squid Blogging: Squid as Prey

Friday Squid Blogging: Squid as Prey

There's lots of video of squid as undersea predators. This is one of the few instances of squid as prey (from a deep submersible in the Pacific):

"We saw brittle stars capturing a squid from the water column while it was swimming. I didn't know that was possible. And then there was a tussle among the brittle stars to see who got to have the squid," says France.

As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

Read my blog posting guidelines here.

Tags: squid

Posted on June 2, 2017 at 4:05 PM • 47 Comments

Comments

Ben A. • June 2, 2017 4:10 PM

EternalBlue Exploit Spreading Gh0st RAT, Nitol

http://threatpost.com/eternalblue-exploit-spreading-gh0st-rat-nitol/126052/

WikiLeaks Dumps CIA Patient Zero Windows Implant

https://arstechnica.com/security/2017/06/wikileaks-says-cias-pandemic-implant-turns-servers-into-malware-carriers/

http://threatpost.com/wikileaks-dumps-cia-patient-zero-windows-implant/126036/

Crowdfunding Effort to Buy ShadowBrokers Exploits Shuts Down

http://threatpost.com/crowdfunding-effort-to-buy-shadowbrokers-exploits-shuts-down/126010/

Trump administration approves tougher visa vetting, including social media checks

http://www.reuters.com/article/us-usa-immigration-visa-idUSKBN18R3F8

Patches Available for Linux Sudo Vulnerability

https://threatpost.com/patches-available-for-linux-sudo-vulnerability/125985/

OneLogin suffers breach—customer data said to be exposed, decrypted

https://arstechnica.com/security/2017/06/onelogin-data-breach-compromised-decrypted/

https://www.theregister.co.uk/2017/06/01/onelogin_breached/

Security company finds unsecured bucket of US military images on AWS

https://www.theregister.co.uk/2017/06/01/us_national_geospatial_intelligence_agency_leak/

https://arstechnica.com/security/2017/05/defense-contractor-stored-intelligence-data-in-amazon-cloud-unprotected/

On the Mood Among My Former Colleagues at the FBI

https://www.lawfareblog.com/mood-among-my-former-colleagues-fbi

Maybe Skip SHA-3

https://www.imperialviolet.org/2017/05/31/skipsha3.html

Maybe we shouldn't skip SHA-3

https://www.cryptologie.net/article/400/maybe-dont-skip-sha-3/

Considering the Laptop Ban: Risks, Costs, Benefits, and Alternatives

http://www.heritage.org/sites/default/files/2017-06/IB4710_0.pdf

Google Domination • June 2, 2017 4:48 PM

Google in the Classroom
The NYT article told of an ‘innovative’ teacher selecting Google Classroom as it allows students to share documents. Impressive?
https://www.nytimes.com/2017/05/13/technology/google-education-chromebooks-schools.html?_r=0

16 Month Battle
Meanwhile Oregon state education attorneys 16 months to legally compel Google to respect students privacy.

EU Seven Year Battle
The EU European Competition Commissioner Margrethe Vestager, however, has shown no willingness to settle with Google who faces a record $9 billion fine for rigging search results.
http://www.independent.co.uk/news/business/news/google-eu-fine-search-9-billion-search-results-rigging-alphabet-shopping-service-a7768621.html

Government of Special Interests
In the USA, the Obama administration appointed hundreds of ex-Google employees to fill key technology positions. Alphabet CEO Eric Schmidt visited the White House over 200 times. The FCC then dropped its Google investigation.
Next the Department of Transportation gave American high-tech complete no holds barred control over driver-less cars with zero public debate on public highways.

Compulsory Auto Tracking
Intel’s CEO just stated these autos will be equipped with camera’s not for safety to scan license plates of adjacent private autos. His justification was to help find missing children. In reality your destinations meta-data will be added to your dossier for analysis and monetization.

IME is Not Enough
No doubt auto passenger facial recognition is next. Intel said Americans must get used to the increasing levels of invasive tracking (by corporate government agents). Will the captive passengers also be analyzed while watching advertising?
http://www.dailymail.co.uk/sciencetech/article-4564480/Self-driving-cars-double-security-cameras.html

Recon - View what Android Apps are Up-To
During his research, Choffnes’s team discovered various deceptive practices by Android apps. One such app, GrubHub was found to be unintentionally sending user passwords to Crashlytics, a Google-owned firm. (Google monitors most log-in pages Android or not).
ReCon has a web-based console, which allows users to block or revise the information. For example – users can block all the location data used by apps.
http://wccftech.com/can-now-track-apps-snooping-personal-data/

Seizing Internet Control through Chrome
‘Google also is working on scoring websites for their ad experiences, and would blacklist sites that fail, meaning the site would then be prevented from showing ads, a publishing source said.’
"If they blacklist you because of bad creative, Chrome will block ALL the ads on the site," said one publishing exec, not authorized to discuss the offering. "Google becomes the judge, jury and executioner. Next thing you know, you're making zero money."
Pot of Gold. The unstated benefit is Google will keep a log of EVERY web site Chrome users visit.‘Google did not respond to requests for a comment.’http://adage.com/article/digital/publishers-hope-google-s-ad-block-plan-hurts-bad-sites/308757/

Smart yes Very Smart
All this is overwhelming as Google moves into high-gear. There is zero American discussion, as if people are brain-dead. Educator recommendation:
“Every year, several million American students graduate from high school. And not only does Google make it easy for those who have SCHOOL Google accounts to upload their trove of school Gmail, Docs and other files to regular Google CONSUMER accounts — but schools encourage them to do so. This month, for instance, Chatfield Senior High School in Littleton, Colo., sent out a notice urging seniors to “make sure” they convert their school account “to a personal Gmail account.”

anony • June 2, 2017 6:11 PM

Black Hat Arsenal USA 2017

On June 1, 2017 @toolswatch announced the tools selected for Black Hat Arsenal USA 2017.

https://medium.com/hack-with-github/black-hat-arsenal-usa-2017-3fb5bd9b5cf2

anony • June 2, 2017 6:17 PM

RFID tags on the new Intel Skylake and Kobylake processors...

http://www.gamersnexus.net/news-pc/2936-intel-i9-7900x-delidding-cpu-package-thermal-paste

"There appears to be an RFID chip in the corner of the Intel i9-7900X that we looked at, which would lead us to believe that the chip is capable of storing user information. Der8auer’s theory is that this could be used to store user overclock data, e.g. maximum stable OC. Such a chip could also be used for RMA processes, theoretically."

also a german story on it out there...

ab praeceptis • June 2, 2017 11:45 PM

Ben A, all

I've read both pro- and anti SHA3 articles. Thanks for the links (from reddit and hn, I take).

I might say that I'm shocked because one of them simply hasn't understood security and the algorithms and the other one is even comparing apples with dogs. But I don't because I'm not (anymore) shocked.

I read imperial violet quite frequently for one simple reason: it's like a window into googles (and others like mozillas, etc) way of thinking.

What I'm not at all surprised about is Joes and Janes understanding. SHA3 came many years *after* SHA2 and SHA3 is officially supposed to be better than SHA3 - ergo Joe and Jane have their common (wo)mans answer. Which btw is OK in my opinion. Gazillions of end users need simple answers and guidelines.

What makes me really dislike the "discussion" between the two "experts" though isn't even their professional sloppiness (I try to avoid using the term "incompetence", in part because it's probably more about ignorance).
What I dislike is how they boil it down.

imperial violet, for instance, is not off with his desire for speed. And no, that's not simply because google and the likes care mostly about speed (as the other one indicates). Speed is important for many reasons, such as small MCUs (there are **way more** 430ies, even 8051s, a plethora of arm MCUs, etc out there that fast desktop or server cpus...) and - an important point - about acceptance and hence uptake. I hope I need not remind of the reason why even today many web user databases use md5 passphrase hashes...

If you run a web site or service with a significant amount of users, speed *is* of concern - and way more than many think. One reason for that is that one can't arbitrarily scale. Once you have your 16 or 48 or whatever xeon or power core busy you hit a quite hard wall; it's simply not good enough to add more servers as doing that opens another box of pandora.
Short: Doing something tens or hundreds of thousand times per second or otherwise massively, e.g. pumping out terabytes per hour, it makes a very major difference whether a core algorithm runs at 1 cycle/byte or at 15 cycles/byte.

But the decisive points are not limited to that and both miss that to a large degree. To name an example: state size of an algorithm isn't just performance relevant but also security relevant. On the other hand the possibility to extend an algorithm is (imo) next to irrelevant. Other quite important points were utterly ignored; keyability is an example.

In case anyone is interested: My personal preference is blake2. For Joe and Jane (who typically don't run massive scenarios) SHA3, the official thing, is a fine algorithm. For others who are more adventurous but still prefer to stay within a safe zone Skein, an algorithm which was co-designed by our host, Bruce Schneier, is a fine alternative, too.

Btw: Do we need 512 bit algos? No, we don't, except for very, very rare scenarios. In fact, even 256 are somewhat (but healthily) larger than 99.99% of all scenarios need. So let us stop that mundane and silly bigger-is-better hunt, which specifically in the crypto field is silly (because there it's much more about smarter is better).

Which brings me to my last point: Somehow we have become a society where only winners count. Just as if 2nd and 3rd places were without any value or merit. I consider that immature and unwise.
*All finalists* in a crypto competition have run through a merciless and hard parcour and "the winner" (like Keccak/SHA3) is usually not somehow superior but has been chosen based on a certain profile which happens to favour 1 algorithm over the other finalists which are *first class*, too, and usually in some respects even better (and slightly worse in others).

Thoth • June 3, 2017 12:13 AM

@Ministry of Truth

It is one thing to list a link farm with all kinds of tools but it is another thing to give quality and proper assuring security tools than just a bunch of links.

It is like trying to use everything in the book against an adversary but the adversary can traverse every single defense you put in it's way, thus, what is the whole point of just putting a bunch of links that do not provide the security people actually need.

For email encryption, GPG is not good enough. GPG with smart cards to store the encryption keys via the OpenPGP Applet will be another step up but it is till not good enough either but better than just software keys which the Intel/AMD/ARM crap can intercept your software keys.

I don't think TAILS can make the cut for a secure anonymous browsing system due to the fact that it uses Linux and not OpenBSD as the OS and as I have mentioned for a long time, even OpenBSD is not to be considered anywhere close to a secure operating environment. TOR itself is known to have issues with whoever having the bigger view of the network can see the transactions of encrypted following through and this is enough to guess who is communicating with who.

There are just too much to be desired and the link farm is as good as giving very little in terms of actual security enhancement but something more like a desperate attempt to beef up defenses when the enemies are already at the gates.

Wouldn't it be better if you could make a fully functioning plan (i.e. how the parts of the systems are deployed securely with little compromise) instead of dumping a link farm since beginners would be excited upon seeing a link farm and would try their hands on but when they face the reality where these systems if used improperly can be very cumbersome and not contribute to security (or even harm security).

Anura • June 3, 2017 12:13 AM

@ab praeceptis

Btw: Do we need 512 bit algos? No, we don't, except for very, very rare scenarios. In fact, even 256 are somewhat (but healthily) larger than 99.99% of all scenarios need. So let us stop that mundane and silly bigger-is-better hunt, which specifically in the crypto field is silly (because there it's much more about smarter is better).

In theory quantum collision attacks might be doable in O(n^1/3) time, so 384-bits might be a more prudent minimum. It should also be noted that you can often get higher throughput with a larger block size if you design your algorithm to take advantage of CPU optimizations like pipelining, so there may be other considerations besides just security.

ab praeceptis • June 3, 2017 12:29 AM

Anura

Correct. That's why I said that there is much more than speed (and tag size) to consider. In reference to your example: people usually see speed as given by some source; that, however, is usually cycles per byte in a given scenario which usually is a large one (say hashing a GB).

Reason (which is often not seen): There isn't just the running phase; there's also the setup phase - which can be quite considerable.

Now what if you run something that has many, many connections but just a couple of bytes for each? Then suddenly the setup phase gains a lot of weight and a 256 bit tag is simply waste (possibly up to the point that you need to change your whole design).

My advice: Don't look just at the nice throughput numbers. Also compute them for a small packet, very frequent algo setup scenarios and suddenly the performance picture looks quite different and the "speed deamons" become snails.

So, again: We need both a Joe and Jane and everybody algorithm (like SHA3) and alternatives that are chosen wisely and knowledgably by professionals.

P.S. One the two on which I recurred in my other post actually compared x cycles/byte hashing algo and 25519 which is PK!!! If at least he had compared it with sym crypto. Truely a new peak of idiocy.

Slime Mold with Mustard • June 3, 2017 6:19 AM

As I prepared to add my home's weekly junk mail to the burn bag, I noted six letters from law firms I had never heard of. Not the civil law outfits of my regular business. I read...

"In these difficult times, you want the best possible representation"

"it's not just yourself, but your family that stands accused"

..."My firm is comprised of attorneys with an abundance of knowledge in the area of felony criminal defense ..."

"My office has learned that you are facing felony criminal charges..."

"HIGHLY EXPERIENCED FELONY AND IMMIGRATION LAWYER"
(Damn, Trump has gone overboard. My mother's side of the family has been in the US more than 12k years)

I could not recall having been slapped in cuffs and tossed in the slammer. Or making bail. Then again, a lot of our best memories are a blur. (In the future, many people will be arrested via email, as a budgetary measure)

There is a fellow who lives three miles from me who shares a first and last name. He has a different middle name and his DOB is 674 days after mine. Our SSNs share only the first three digits. Due to Soundex style coding, our driver license numbers share the first four characters - and nothing else.

What really concerns me is that my street address is unique in my state. I don't mean when the street name is included. I mean "12345" (or whatever) is not repeated in my state and only a few times in the US.

I shall stop by the sheriff's office to ensure there are no pending charges, and let the real nightmare begin - trying to get this "digital scarlet letter" off my record. I did not go straight to Intellius etc, well aware that lookups breed yet more records.

I need not worry about employment, but would like my credit intact. I have those "correct the record links". https://info.publicintelligence.net/NJROIC-OptingOut.pdf

I at least hope I've been fingered for an armored car robbery, and not something lame like a DUI (drink - drive).

@ Clive Robinson

I've not given up on the SS Richard Montgomery. I've been swamped.

The 500 kt v 5 kt was reductio ad absurdum .

Ergo Sum • June 3, 2017 7:17 AM

@Ben A....

EternalBlue Exploit Spreading Gh0st RAT, Nitol

I loved the graphic in that article, maybe the door should've had an MS logo...

Wait... Wasn't the SMBv1 vulnerability patched by Microsoft; in some cases, about two month ego?

https://technet.microsoft.com/en-us/library/security/ms17-010.aspx

Quote from the above link:

The security update addresses the vulnerabilities by correcting how SMBv1 handles specially crafted requests.

Are there more "specially crafted requests" in SMBv1 that had not been patched?

I guess it's a good thing that SMBv1 had been disabled in both of my business and home networks a good while ego...

Andrew • June 3, 2017 7:23 AM

What key length should I use now if I want to keep a secret for 25 or 50 years?
What year's secrets can be decripted with current technology?
Just some thoughts.

Ergo Sum • June 3, 2017 8:30 AM

@Google Domination...

All this is overwhelming as Google moves into high-gear. There is zero American discussion, as if people are brain-dead.

I'd scream about antitrust laws, if we had a government that cared to enforce them. Instead, we have a government that creates regulations for legalizing monopolies, mafia style banking and health insurance, etc. You go ahead, scream "bloody murder" and talk to your representative suggesting alternatives. And the response is:

"The lobbyists would never allow that to pass"

In another word, our legislators care not for people. Yeah, you go ahead and discuss the company that does no Evil...

keiner • June 3, 2017 9:40 AM

@ Ergo Sum

The whole development is completely anti-democratic, as all of the control for these software/hardware monopolies is in the dark, the objectives of the companies are in the dark (if you don't want to joint the tinfoil hat faction) and nobody in politics is interested to give power back to the people.

Deeply disturbing.

LOL • June 3, 2017 9:51 AM

Google domination?

Heh, looks like the company that does not produce much more than adverts and that survives mainly by feeding from people's personal data need people to sell themselves. I take that Google is afraid they will be forgotten by the public otherwise...bad news for the sentiment through which they pump the value of their stock...

The many failed Google projects that never took over the world nor even changed it are quietly buried like a diseased child out of wedlock.

So when it comes to Google and it's "achievements", they are never spoken of in past tense. That would probably not contribute to a positive sentiment. Sort of like the Iraq War...the US government was always "winning" but never "won".

Compare to Amazon who is actually winning market share and producing things. How many failed projects does Amazon have?

How many Amazon employees and shareholders promoting Amazon on the internet?

patrick • June 3, 2017 10:51 AM

This is not great news for those poor folks who believe there is some value in trusting OneLogin with your passwords...

Hackers break into centralized password manager OneLogin
http://www.msn.com/en-us/news/technology/hackers-break-into-centralized-password-manager-onelogin/ar-BBBPSUG?OCID=ansmsnnews11

Seriously it would be better to keep your passwords in e.g. KeePass on a USB stick.

Baah Mooo • June 3, 2017 11:53 AM

Too much focus on each new scary Vault 7 exploit distracts people from the real dirt: the use cases. The juiciest cases naturally involve CIA covering up its universal-jurisdiction crimes. So remember Buffalo Bamboo if you hear it in connection with an unexpected foreign host. And remember der Starke, next time some poor US bastard's computer makes the news.

albert • June 3, 2017 1:03 PM

@LOL,
From the git go, Google has been very successful with their Monetization Plan, unlike, for example, Facebook. Amazon, OTOH, has a long-term goal: total domination of the mail-order market.

Google, FB, etc. are called 'tech' companies, but they are only data collectors. Their 'products' are information. Amazon is the modern equivalent of Sears.

Why is Apple so successful? Because they make stuff; cool things you can hold in your hand, with their own software. This was Microsofts big mistake; they didn't enter the hardware market when they had the chance. Apple did.

Of course I'm over-simplifying, but is my opinion that a countries with only financial and service sectors with be buried by those that actually make stuff.

We've got to expand our manufacturing sector.

. .. . .. --- ....

Google Monopoly Blossoms With Zero Regulator • June 3, 2017 2:02 PM

Great Products Don’t Need Advertising
Google has an insatiable need to push the privacy envelope as demanded by the paying advertisers.
Amazon has an insatiable need to sell world-class products many, of which are not available at local stores.
Costco also has many excellent products that also sell themselves. However they do send out monthly flyer's which of offer many genuine bargains. And then the nutritional samples!

Great Products Don’t Need Big-Data
I recently considered also making purchases through Walmart.com. However Walmart never made the software infrastructure investment. So they bought Jet then brought in virtually ALL the BIG guns of American Big-Data, who eavesdrop on every Walmart.com page.

Great Products Don’t Need Google Search
Google acknowledges that great products also don’t need Google Search. Which is why they play a major role at Wal-mart.com. They also partner to receive 70% of all purchase info in physical stores (unbeknown to customers).

Making an Informed Purchase
Rather than relying upon distorted advertising, people study Amazon and other sites reviews (knowing some are bogus).

Anti-Trust and Monopoly Issues
Google's Chrome accounts for almost 60% of the browser market, according to Net Market Share. Reminiscent of Microsoft Internet Explorer being fused into Windows.

Ad-Blockers Users Forced to Identify and Pay
Google plans to its own self-indulgent ad-blocker. Consumers must ID & pay extra to use other competing ad-blockers.

Google Toll Roads
Google anti-ad-block software will run on web-sites to detect if competing ad-blockers are in use.
If detected, the new Google ‘Funding Choice’ toll program will then pop-up forcing consumers to unmask themselves by paying to view content.
Of course those who have a all-knowing Google account will be identified and automatically charged.
Google gets a cut and can now track consumers who don’t even have a Google account. Just like a toll road or TSA screening? Your web surfing can then be sold to advertisers and the government (checked before you fly).
https://www.theverge.com/2017/6/1/15726778/chrome-ad-blocker-early-2018-announced-google

Google's Monopoly Is Blossoming in a Zero Regulator Environment. They must secretly worship Mr. Trump (in a world gone mad).

Ministry of Truth • June 3, 2017 3:49 PM

Here's a shorter version. Hopefully acceptable.

Firewalls, antiviruses, GPG/PGP[3], LiveJournal(warning! clicking this link classifies you as a Muslim extremist)[4], Tor[5], TAILS[6] and anything else that makes it harder for people to damage your computer or to steal your personal information is an offensive weapon, a cyber munition that causes mass destruction.

On the other hand, things such as network exploitation techniques[7], viruses[8], spyware[9], Denial of Service tools, sabotage of NIST security standards[10] (standards which must be secure to protect the secret service from being murdered[11]), preventing 0-day vulnerabilities from being fixed[12], and so on, factor into "defense". These defensive strategies do not put civilians at risk[13].

These things are for your protection[14]. It makes perfect sense for Anonymous to wear Guy Fawkes masks while DDoSing any dissidents/anyone else who is against Big Brother[15].

The government is above being hacked[16], so you should trust them with your mind body and soul. Failure to accept their mark will result in exclusion from all types of commerce[17], so accept it for your own good. Make sure to protect your children from peeping toms[18] and stalkers[19] by warning them not to use privacy software[20].

The US Government is doing everything it can to prevent Russian czars from having an easy to use, single point of attack (killswitch) that just takes one person to press it to instantly bring the entire US economy and all networked medical services to its knees[27].

The best way to catch terrorists and extremists is to look for groups that use fear to prevent discussing of opposing idealogies[28] instead of simply making a logical argument against their opponents' idealogies.

Also, it has recently been found that safety features in computers and cars can benefit terrorists, so all anti-viruses[34] and airbags (in Internet connected vehicles, which all new vehicles must be, "to protect the children") must have an easy, fast, sure way to be remotely disabled without alerting the occupants.

Ministry of Truth • June 3, 2017 4:08 PM

@Thoth
Good points.
I made a few assumptions in my post.

One, that there aren't too many newbies here, and that the ones that are here are probably security conscious enough to look up how to use Tor and whatnot safely.

Two, that the biggest obstacle to widespread liberty is a mindset that giving up liberty makes things more secure, so I tried to use satire to show what a bad argument it is to say "if you aren't a bad person you don't need privacy" or "unless you give up privacy you can't be safe".

Three, that even though Tor and TAILS can be broken, and Linux is not perfect, that these kinds of software need to become more popular, even if it is only newbies using them. That is because the zero-days against them probably won't be wasted on newbies, and the people who are selectively targeted should be able to work out more secure alternatives, such as GenodeOS, GNUNet, I2P, and so on. Apparently QubesOS is based on Linux like TAILS, but there is talk of making it support Dom0 besides Linux, and that many of the zero-days in Xen are mitigated in QubesOS. There is also SubgraphOS, and some really crazy super high EAL rated operating systems that are even less newbie friendly. It doesn't seem productive to write about them, since hardly anyone can use them, and the ones who can probably already know about them.

call girl • June 3, 2017 4:49 PM

@Google Monopoly Blossoms With Zero Regulator

Google Toll Roads
Google anti-ad-block software will run on web-sites to detect if competing ad-blockers are in use.
If detected, the new Google ‘Funding Choice’ toll program will then pop-up forcing consumers to unmask themselves by paying to view content.

The Seven Devils of the Internet

VIRUSES
WORMS
TROJANS
POP-UPS
SPYWARE
ADWARE
MALWARE

>>> And I heard a great voice out of the temple, saying to the seven angels: Go, and pour out the seven vials of the wrath of God upon the earth. <<<

Stem • June 3, 2017 7:25 PM

@Ben A.

Re: On the Mood Among My Former Colleagues at the FBI

"But here’s the thing: opinion on the subject within the Bureau is not, as far as I can glean anyway, diverse at all. I spoke about my concerns with a friend and former coworker, explaining that I was worried that if I were to write on the subject, the post would devolve into a weepy love letter to Director Comey. My friend’s response went a long way towards summing up what, I believe, is actually the overwhelmingly consistent reaction of FBI employees to the firing of the director: “But how could the post be anything except a weepy love letter?”"

"Lawfare"? o_0

Q: Was the sitting director of the FBI the bee's knees?
A: Hells ya!!!

...but of course their hearsay is conclusive, what other conclusion could one come to than that this is the most accurate portrayal of reality ever? I see no need to question this fact apparent in any way.

Having it All • June 3, 2017 9:42 PM

Subj: Todays Humor

My hot team is renegotiation the very unfair Free and Open Internet:
First we have to remove the anonymous data rules of net-neutrality
Then dump the anonymous data of those who wish to evade detection
Then build collection plates at every site to instill obedience

Continue building walls which magnify these attributes:
Omnipresence - the property of being present everywhere
Omnipotence - the quality of having unlimited power
Omniscience - the capacity to know everything that there is to know

Then I can unmask anyone else at anytime anywhere

Dummies: The World IS Getting Hotter. Its because (redacted to prevent unmasking)

In the mean-time enjoy the chaos!

n/a • June 4, 2017 12:44 AM

blog.torproject.org got changed big and now needs JAVASCRIPT to comment. NSA took it over??

ab praeceptis • June 4, 2017 2:05 AM

Ministry of Truth

"super high EAL" etc. - Forget it. windows has eal. eal means nothing but "someone (usually a large corp) coughed up the major money for a golden "secure" sticker. Same with fips and others.

Let me tell you why we are where we are - and why we will stay there for quite a while.
First the latter: We will stay there for quite a while for 2 reasons: a) we don't understand why we are there, and b) to get out of that ugly hole we'll need to walk a 1000 step staircase up.

Now to the why. 2.5 main reasons:

a) computing was, from the first day on, mainly driven by greed and irresponsible playing. Listen around, the holy currency still is either money or "fun". Go to any developer conference and you can drown in "it's fun!", "we do it for fun!" statements.
The IT field, particularly software dev. is basically another "go west, get rich!" with disney park thrown in on top.

b) foss. Many will hate me but I'm absolutely sure about that. That's not to say that foss is only and always bad, it isn't, but in summary foss broke down the last few walls of reason plus, to make it worse, it damaged the whole field.
foss broke down the last walls of reason because you can't ask for *anything*. From a payed developer you can demand to work properly (not that many would do that, but one *could* demand it), from a foss dev. you can't ask anything. From a software vendor you could demand at least minimal standards, quality, compensation, foss very clearly states "f*ck you!"; you use that foss software without its developers standing for anything, not even formally. A company must fear negative reactions, foss need not care, there simply are no consequences at all.

c) universities and the grant system are rotten. What little useful outcome research produces is almost always either hidden away and/or abandoned or used to spin off a company.

So, forget those "crazy super eal" OSs. Yes, there are a few, *very* few, but they are either abandoned or spun off at a rather early stage or they are private corp stuff from the beginning. And, that's important, they usually are *not* secure OSs but rather "not rididulously f*cked up crap". An example would be what came out of Oberon.

As for the 1000 steps stair back to sanity: We are at a very early stage and acceptance, let alone uptake, is sadly low. C is cool and fun, Ada or Eiffel aren't (so they think), fuzzing is cool and fun, properly spec'ing and verifying isn't (so they say).

And just btw: Think a moment about the kind of money one could earn by being able to sell some actually reasonably secure OS! (And about the efforts and investment that would need). Do you really think that would be given away for free? I certainly don't. As for foss, forget it; they are about cool and fun and blabla.

And btw, I'm quite sure that Bruce Schneiers "theater" image does hold here, too. Most people do *not* (really) care about security; what they do care about is *feeling* secure and comfortably so (read: spending 29$/year is O.K., activating ones brain and acting reasonably is not).

Ergo Sum • June 4, 2017 8:54 AM

@Ministry of Truth...

Three, that even though Tor and TAILS can be broken, and Linux is not perfect, that these kinds of software need to become more popular, even if it is only newbies using them. That is because the zero-days against them probably won't be wasted on newbies, and the people who are selectively targeted should be able to work out more secure alternatives, such as GenodeOS, GNUNet, I2P, and so on. Apparently QubesOS is based on Linux like TAILS, but there is talk of making it support Dom0 besides Linux, and that many of the zero-days in Xen are mitigated in QubesOS.

I found ironic that the QubeOS' introduction video shows Google Chrome browser for both the work and personal browsing and the narrating person also logs in to his Gmail account.

https://www.qubes-os.org/video-tours/

Admittedly, I have not installed QubeOS to see, if Chrome is the default browser, but it pretty much stopped me from trying it. Yes, I do know that I could remove/add browsers, once the installation has completed...

anony • June 4, 2017 2:30 PM

another NSA fail in data security...

http://www.popsci.com/china-new-submarine-engine-revolutionize-underwater-warfare

anony • June 4, 2017 2:40 PM

A key exchanged comp to comp comm sys.

https://github.com/warner/magic-wormhole

"Get things from one computer to another, safely.

This package provides a library and a command-line tool named wormhole, which makes it possible to get arbitrary-sized files and directories (or short pieces of text) from one computer to another. The two endpoints are identified by using identical "wormhole codes": in general, the sending machine generates and displays the code, which must then be typed into the receiving machine.

The codes are short and human-pronounceable, using a phonetically-distinct wordlist. The receiving side offers tab-completion on the codewords, so usually only a few characters must be typed. Wormhole codes are single-use and do not need to be memorized."

JG4 • June 4, 2017 3:23 PM

as always, I appreciate the civil discourse on important matters

http://www.wnd.com/2017/06/jeff-bezos-amazon-washington-post-and-the-cia/

call girl • June 4, 2017 3:43 PM

@JG4

as always, I appreciate the civil discourse on important matters
http://www.wnd.com/2017/06/jeff-bezos-amazon-washington-post-and-the-cia/

Sure thing. Except, ... we are not civil anymore.

Jeff Bezos' slaves are murdered by the cyber-mob bosses if they file for workers' compensation for repetitive stress injuries from heavy lifting in that awkward position on the loading chute or wherever they are stationed and not allowed to move.

Civil War II, World War III, whatever you want to call it.

Enough with the civility. These people are so vile that I never want to hear sirs, ma'ams, pleases, and thank yous out of their filthy mouths again.

Ministry of Truth • June 4, 2017 4:25 PM

@ab praeceptis

"mainly driven by greed and irresponsible playing. Listen around, the holy currency still is either money or "fun". Go to any developer conference and you can drown in "it's fun!", "we do it for fun!" statements.
The IT field, particularly software dev. is basically another "go west, get rich!" with disney park thrown in on top."
Mainly but not entirely. There is software with no purpose but to make computing safer. Software that offers no additional functionality, and whose developers give it away for free without adware or spyware in it.

"From a software vendor you could demand at least minimal standards, quality, compensation, foss very clearly states "f*ck you!"; you use that foss software without its developers standing for anything, not even formally. A company must fear negative reactions, foss need not care, there simply are no consequences at all."
Don't all shrinkwrap EULAs contain "f*ck you!", just with 10 times the pages of FOSS licenses, and additionally forbid you from modifying it or otherwise fixing the problems yourself? Or can you sue Microsoft every time there's a vulnerability in ActiveX or when Cortana sends all your WiFi passwords to everyone you friended on facebook?

"universities and the grant system are rotten. What little useful outcome research produces is almost always either hidden away and/or abandoned or used to spin off a company."
Almost always. Minix was made at a university by Tanenbaum, and it's proved useful in OS research, hasn't it? That's just one example, I don't think you really want a list of things that started at universities that have use in safer computing.

"As for the 1000 steps stair back to sanity: We are at a very early stage and acceptance, let alone uptake, is sadly low. C is cool and fun, Ada or Eiffel aren't (so they think)"
Can you write a dom0 in Ada or Eiffel?

"fuzzing is cool and fun, properly spec'ing and verifying isn't (so they say)"
Do you mean that FOSS projects never do extensive unit and integration tests?
Or that such tests are mutually exclusive with commercially available fuzzing products?

"And just btw: Think a moment about the kind of money one could earn by being able to sell some actually reasonably secure OS! (And about the efforts and investment that would need). Do you really think that would be given away for free? I certainly don't. As for foss, forget it; they are about cool and fun and blabla."
They wouldn't make any money. Every spy organization in every country would offer them more to backdoor it or to not release it than consumers would pay for it.
Releasing such an operating system could only be an act of philanthropy, not avarice.

"And btw, I'm quite sure that Bruce Schneiers "theater" image does hold here, too. Most people do *not* (really) care about security; what they do care about is *feeling* secure and comfortably so (read: spending 29$/year is O.K., activating ones brain and acting reasonably is not)."
Sad but true, which is why I think it's more important to publicize easy to understand arguments in favor of security than it is to wait until something perfectly secure exists before going public.

@Ergo Sum
"I found ironic that the QubeOS' introduction video shows Google Chrome browser for both the work and personal browsing and the narrating person also logs in to his Gmail account."
Thank God that people who do design and videos aren't people who package software or write code.
QubesOS dom0 has no browser, and the default installation image has an option for installing Whonix (which only has Tor Browser Bundle, based on Firefox).

Note that Chrome isn't FOSS, Chromium is. Chrome is more comparable to Internet Explorer and Microsoft Edge than it is to Mozilla Firefox. And it's far harder to audit Google Chrome than Chromium, due to the mystery meat BLOBs in it. Chromium is based on WebKit which is derived from KHTML, what's intrinsically bad about that?
There is no Google Chrome or Chromium included in any of the QubesOS installation images, but they can probably be installed in domU through yum or apt.

Nick P • June 4, 2017 5:26 PM

@ All

Microsoft Research and INRIA continue showing out on verifying crypto protocols. This report describes their new Low* language for implementing things such as crypto algorithms with proof of memory safety and side-channel resistance. That then gets translated into *readable* C for easy auditing. Then compiled with CompCert for verified production of assembly. Then, integrated into their ML-like language, F*, so the high-level stuff can be described and verified in a high-level way. They prove it out with an implementation of Bernstein et al's NaCl in Low*.

@ ab praeceptis

Being a separation logic fan, you might find VerCors interesting given they use a layered approach to verify concurrent, data structures. Another person doing verification, esp on distributed and concurrent stuff, said that's typically really hard where the tool is either a huge burden and/or can't prove a significant number of correct constructions. This tool improves on things in both directions. Will still be hard compared to non-formal methods since both correct concurrency and separation logic of anything not simple are hard. Still might be useful for specialists producing libraries of verified, concurrent structures for use by 3rd parties.

JG4 • June 4, 2017 6:12 PM

@call girl

Your point is well taken, although for the most part the discourse here at Mr. (Dr.?) Schneier's forum is quite civil. Your planet has been surprisingly violent for a long time and there is some hope that it is getting better, Mr. Bezos and his paymasters notwithstanding. See, for example,

https://www.scientificamerican.com/article/history-and-the-decline-of-human-violence/

Mr. Bezo's paymasters and business partners bankrolled a series of genocides in Asia that killed at least 4 millions. They have been quite diligent in the middle East as well. In the time since the Communist genocides (mostly) ended, the US has implemented a series of smaller ones. You may see the Philippines in the news from time to time. I thought it ironic that they are having a war on dealers and addicts, which is precisely what Mao did.

I am on the record as looking for a better country to support. I have identified a few, but they are surprisingly expensive.

Randy • June 4, 2017 7:16 PM

@call girl/JG4

"World Net Daily"..? You got to be kidding

That supposed connection between Jeff Bezos and CIA has been debunked here:

Does the owner of the Washington Post have a deal with the CIA worth 600 million dollars?

Perhaps it's time for you to push that nonsense somewhere else.

ab praeceptis • June 5, 2017 1:39 AM

@n/a

blog.torproject.org got changed big and now needs JAVASCRIPT to comment. NSA took it over??

IF that was true I wouldn't be surprised at all. I personally consider tor as tainted since quite some time.

@Ministry of Truth

Of course there are pleasant exceptions, e.g. Minix which I myself talked about occasionally and in a quite positive way. But before we can repair a situation we must properly assess it and fact is that the whole field is rotten grosso modo.

Ad "you can repair foss software yourself" - Oh really, is that really so? I don't think so; I think that that's nice sounding blabla like so much with foss. IF that were true then why don't we just repair, say OpenSSL or linux? Maybe because we can't? Maybe because C is ambivalent and hence unverifiable, because fuzzing and all those other funny techniques don't really cut it, and, very importantly to repair something one needed a proper specification of what "working properly" as opposed to being a clusterf*ck means? Usually even that doesn't exist. So all them funny test are run against what reference?

"unit, integration and whatnot tests" - Well intended but worthless blabbering. See above. And keep Dijkstra in mind: Testing can prove the presence of bugs but not their absence.

Just like the 1000 eyes blabbering. Sounds nice and oh so convincing but it consistently fails. For heartbleed, for instance, not even the promised 4 eyes (connected to working brains) were available.

Do I *like* microsoft? Certainly not; hate them since decades. But, you see, this is no sympathy competition. Fact is that evil microsoft has sunk millions upon millions into research and if tomorrows programmers write more reliable software then it will to a major degree be due to microsoft sinking millions into research and development of better tools.
If in a dire situation like ours I have to choose between evil Microsoft having seen the problem and actually delivering vs. "fun! fun! and freedom as in speech!" shouting sectarians with an utterly bad track record I'll choose Microsoft. Trust me, I'm the last guy on this planet who likes microsoft, let alone to laud them, but we'll never achieve safety and security if we can not even recognize reality and prefer to cling to some sectarian creed.

And btw. my education wasn't cheaper than that of other engineers. You see, there is a major difference between a, say electrical engineer helping on in his won free will with some, say, school or town project vs. accusing all electrical engineers as somehow evil, if they charge a fee for their services.
What do you think you get with that foss model? Let me tell you: More often than not you'll get losers and lousy amateurs because the good professionals want and need to and can earn a living with their profession.

And you know what? I still follow the 3 step model; in fact I always suggest it by myself to my clients: downpayment, payment on delivery plus a considerable part, say 20%, only 4 - 6 weeks after delivery, i.e. when my work has been tested and shown to perform as agreed.
Which leads me to my final point: microsoft (and a few other companies) actually pay professionals for cleaning up and repairing what they messed up. foss ... oh well...

ab praeceptis • June 5, 2017 2:40 AM

Nick P

Well, VerCors is pretty much about new front ends (java, C) for the (excellent) Viper infrastructure. I personally will stay with verifast but would not hesitate to recommend VerCors/Viper for java and C people, particularly less experienced ones.

As for the problems with concurrent and or distributed mode I have my own theory and many won't like it. I'm under the impression that that whole problem zoo is largely hype; useful hype, of course, as it feeds many academic projects. Why do I say that? The answer should be obvious when asking "What exactly is the problem?". A closer look will reveal that all those concurrency problems are but a special case of memory (and, one might argue, temporal) safety. I'm somewhat smirking because it comes down to the fact that the software people are way behind the hardware people. The decisive difference that is behind that problem class boils down to "Oh! It's not just me running on this system/cpu!". Another reason for me smirking is that in the end it comes down to some hardware fencing like, say CAS - which is well expressible in logic.
A variable is about access and value. Usually the safety problem is about access. With concurrency sometimes value dependence (i.e. a temporal problem) is added. That's not something hard to understand or to deal with - iff one has achieved enlightenment; the problem is mindset, not registers, memory, or warp holes *g

As for microsofts low* I just sigh. Yet again they've ignored the law of readability. Functional concepts with gratuitously thrown in C notation might look cool and impressive but will have many developers ending up in non-acceptance or, if they are brave and try it, bad usage, problems, and pain.
But still, they should be lauded for their work and engagement, if alone for clearly demonstrating that formal design and verification is a *must*.
(Side note: the functional approach remind me of McKenna's "give me one miracle and I'll explain the universe" in another form ("Give me monads and I'll do everything side effect free") haha).

And I very much liked the name Kremlin for the compiler (actually more of a transpiler with lots of magic thrown in). Smiling there; I have reasons for being a big ETH and Inria fan...

Now to the really funny bit: I laughed out loud seeing their examples. Why? Because I can have almost all of that - and much simpler and more elegant - with sparked Ada, haha.

Who? • June 5, 2017 3:56 AM

@ Ministry of Truth

I do not really trust EAL certification. Apple's OS X and Microsoft Windows 7 have EAL certification, OpenBSD doesn't. EAL certification is a way to move the worst disease of industry (if you pay us each time you release a new version of your product then it gets a sticker that shows it is appropriate for use in corporate environments) to security. It is not better than, we say, POSIX.

EAL establishes a first approach to security based on the willingness of developers to pay to get a certification. It is broken by design.

Who? • June 5, 2017 4:12 AM

@ Ministry of Truth, ab praeceptis

I see @ab praeceptis commented on EAL certification too. Glad too see we share the same opinion about the certification process... I must not be so wrong after all.

Dirk Praet • June 5, 2017 5:04 AM

@ ab praeceptis

If in a dire situation like ours I have to choose between evil Microsoft having seen the problem and actually delivering vs. "fun! fun! and freedom as in speech!" shouting sectarians with an utterly bad track record I'll choose Microsoft.

While I concur that Microsoft, Apple, Google et al from an engineering vantage are way ahead of the FOSS community in terms of professional development and software life cycle management methodologies, the element you seem to overlook is that their carefully crafted end products are spying platforms by design, thus defeating the entire purpose.

Same thing in music: folks like Celine Dion, Mariah Carey, Whitney Houston and Christina Aguilera are highly accomplished sopranos. Steve Vai and Joe Satriani are brilliant guitar players with an amazing technique. But their music s*cks like an Elektrolux, and I still go with John Lydon and the Ramones any time, even if the former couldn't sing and the latter couldn't play for sh*t.

My current home infrastructure is entirely security hardened Linux- and BSD (all family members), FDE on every machine, and with only one (1) physical and highly locked down Microsoft workstation remaining. All other M/S stuff lives in carefully isolated VM's none of which I require for my daily activities. This setup will not protect me from poorly written FOSS code and neither will it keep the NSA out.

But at least I am feeling reasonably comfortable that none of these devices are deliberately leaking information and that they are FAR less vulnerable to activity monitoring and compromise by script kiddies, cyber criminals, thieves, my ISP, corporate and nation state spies as compared to the potential havoc that can be wreaked by even one Windows machine with a smartphone on the side.

ab praeceptis • June 5, 2017 5:19 AM

Dirk Praet

What I said was clearly in the context of software development and in that area, that's fact, microsoft is spending lots of money and working really hard - and in a credible way.

Would I buy (or use, even for free) ms windows or office? Certainly not, no way.

But that's today. Maybe in a not too far away future ms introduces and sells a (at least much more than windows) safe, reliable and sound OS.
Would I use it? Probably not, i.a. for the reasons you mentioned. But then, I'm not Joe or Jane.

The factors you mentioned are a different issue; an earnest one and one where we should be prudent (read mistrusting) but another one. And one that, unlike safe development, can (and certainly should) be solved politically/legally.

JG4 • June 5, 2017 6:56 AM

http://www.nakedcapitalism.com/2017/06/links-6517.html
...[deep state business as usual]
Police State Watch
Hiding the Ugly Business of Torture Consortium News (Sid S)
https://consortiumnews.com/2017/06/02/hiding-the-ugly-business-of-torture/
...
Farewell Walt Mossberg, the scourge of Silicon Valley
https://www.theguardian.com/commentisfree/2017/jun/04/farewell-walt-mossberg-scourge-of-silicon-valley
John Naughton
His pioneering journalism held the industry to the same standards as other manufacturing sectors
...
If the networked printer suddenly stopped working, then you were faced with the kind of knowledge gap that existed between Leibniz and his horse. And so on.
...
“If we are really going to turn over our homes, our cars, our health and more to private tech companies, on a scale never imagined,” he wrote, “we need much, much stronger standards for security and privacy than now exist. Especially in the US, it’s time to stop dancing around the privacy and security issues and pass real, binding laws.

Thoth • June 5, 2017 9:11 AM

@FOSS vs. PAID et. al.

Both have their shortcomings and advantages. It should not boil down to whether FOSS is better than paid wares but more of the general outlook and mentalities and this have to be assessed by each project or product.

One example is safer OSes where most people typically place their trust that Linux to them are better choices than Windows because of the FOSS Linux label but the fact ia the mentality is important.

So far, Linux has been very bad in terms of safety and security mentality and as long as people are just contented with Linux sprinkled with some pixie dust to harden Linux, that wouldn't cut at all. For Linux to be truely security and safety centric, the mindset of Linus Torvalds of treating security and safety as typical second class has to change as he is the one with the power to change Linux and it's communities and even FOSS.

I doubt his attitudes would change any time soon and thus Linux et. al. would continue to not make the cut as a saferand more secure OS.

ab praeceptis • June 5, 2017 9:30 AM

Thoth

the mindset of Linus Torvalds of treating security and safety as typical second class has to change

Just a short remark: No.

I get your point but linux can not possibly be made secure. For one the linux bloat bubble consists of millions and millions of loc. Moreover, safety, reliability, and security have to be designed from the start. All attempts to somehow turn crap into something sound are bound to fail.

But my remarks were of a general nature, anyway. *Of course* there is also good or even high quality foss stuff (though typically not with gpl; little surprise there). OpenBSD is an obvious example (although compromised by its roots (posix)); those people do quite good work. That said, I've also seen really good and open sourced work come from companies.

Generally speaking, though, foss has rotten the whole field. One very regrettable symptom is the wide spread expectation that not only must software free (beer) but, in fact, foss software is better than commercial software - which, of course is utter bullsh*t.

Ergo Sum • June 5, 2017 9:42 AM

@ Ministry of Truth..

Thank God that people who do design and videos aren't people who package software or write code. QubesOS dom0 has no browser, and the default installation image has an option for installing Whonix (which only has Tor Browser Bundle, based on Firefox).

Thanks for your statements, off to try QubesOS...

JG4 • June 5, 2017 10:17 AM

Schneier on Security

Friday Squid Blogging: Squid as Prey

Comments

Leave a comment