Top 5 Security Books article

This article lists reviews of several important releases in recent security issue coverage. Two (the Peter Kim and Kevin Mitnick books) could be said to be continuations of a series and two of them are break-in procedural studies (the ones from Allsopp and SparkFlow), while the last one regarding the Maskirovka program might be of somewhat temporary interest. But all have significant drawing cards.

Kim and Mitnick are major figures in security technology. Kim's series needs a new volume every few years due to his concern with explaining current code flaw and tool developments, all of which can change rapidly. Mitnick offers a new perspective in that he's described his famous "social engineering" methods before but now describes defensive rather than offensive strategies.

The Allsopp and SparkFlow books are about entrance methods, open source information scouring, low-order as well as noisy probing and so forth. This is what you'd expect from a survey in the particular magazine that carried the article. PTMag concentrates on aggressive tactics.

The Maskirovka book, while perhaps too topical for some, looks to have larger relevance. The specific outbreak of this Russian Federation-generated item is merely the occasion for bringing up matters than promise to return in slightly altered form in the future. For example, the apparent "Cybercaliphate" that took credit for related activity was in reality our old friends at APT28. An event involving the takeover of video-capable billboards and the injecting of political material re: Ukraine and referencing old Eastern-bloc issues is covered. There's the expected mention of US election influence operations, but after the Cambridge Analytica (and other) data mining efforts, I'm guessing that such approaches are now used by basically everybody, and probably with free tools.

This is a good list. PJ says check it out (with apologies to Joe Bob Briggs, from whom I stole that closing line catchphrase).

More malware and data leaks - BUT...

This article at NordLocker is certainly more of the same, but suggests two things: first, that leaks continue unabated (those entrusted with our Personally Identifiable Information can't protect it) and second, that some obvious protective measures are brought into high relief.

The article states that most of the recently leaked data were either email addresses or login/password pairs.

That's a very interesting observation. Notice that in this case the information does not concern matters of irreperable compromise or near-irreperable damage (like leakage of tax/SSN, date of birth, vehicle operator license number, benefit or financial account numbers, etc.) but issues of email or passwords.

Issues of email (usually a free service) and passwords (usually regarding reconfigurable contexts) are completely within the control of the user. To change a password is trivial. To change (or shut down) an email address is more work, but also technically trivial. Replay attacks (using snatched ID credentials) don't work if passwords or addresses are different from when snatched.

Changing your email address and passwords could increase your security posture more than a brand new phone or computer.

Paradigm Shift?

Recently Facebook and Twitter have made decisions about continuing to ban the most recent ex-president of the US from posting on their systems. Certain political quarters have raised the possibility of breaking up social media concerns due to antitrust issues. There is a third consideration that is more far-reaching.

In the case of Facebook, to my knowledge its recent pronouncements about the usage of the ex-president's account constitute the third occurance of FB joining (or inserting itself into) its users' conversations, the first two being 2020 election procedure and Covid-19 treatment procedure. I'm not as familiar with Twitter. Using just FB as an indication, we're largely in uncharted territory - but not totally.

Over a decade ago, MySpace was the heavyweight social media platform. When it was purchased by a large advertising concern, many more sponsored content items appeared on user pages (crowding user content). This caused many users to begin searching for platform alternatives. Such a change could happen again and we should now be aware of that possibility.

[Additional note: I wasn't a heavy user of Google+ but that strikes me as what could have been a turnkey Facebook alternative had it been allowed to continue. Of course, hindsight is 20/20. Anyway, we're presented with two bad developments, in that big tech is accused of cancelling users and opponents of big tech could be accused of intending to restrict big tech's freedom of speech. My only advice would be to protect the first amendment above all in this range of issues and let the chips fall where they may. If both sides in this contest merely intend as a solution that the other side's opinions be throttled, then both sides are incorrect.]

Browser Isolation

So this guy (Rob Braxman) is on YouTube a lot with many video segments about computer technology issues. He seems knowledgeable but I haven't independently checked, tested or verified everything that he's said. There is one issue, though, that has piqued my curiousity. That's the one described in his video entitled

What Browser To Use? About Browser Isolation

Search YouTube for that title and you'll hit his video. I'm not linking to him since I'm not officially advocating his channel; he's probably legit but I don't work for him or anything. What he's saying in this instance is that it would be possible to enhance one's digital hygiene by running multiple browsers for multiple purposes.

The short version is that he says it would be good to use Brave for Facebook and related sites like Instagram, Chrome for Google and related sites like YouTube and then to use Firefox for everything else. The rationale is that since FB and Google are the only two entities that collect so much information on your habits that they can "follow" you around the web, they should get their own browsers. Further, he determines that Brave (a Chrome variant) has filters that are effective in controlling issues specific to Facebook tracking. He also determines that Chrome is good to use for Google activity since Google-controlled sites presume Chrome use, and if they're viewed on a separate browser it would be less likely that Google could associate your surfing with non-Google locations.

All this raises several questions. First, is this multi-browser idea more effective or practical than VMs, some container idea or separate physical devices? Probably but I'll try it for awhile and see how it goes. Second, is all this an excercise in futility if all the sites and organizations with data on everybody have such crappy security that it'll all be leaked eventually? Perhaps - that is, in the case of whatever you've put on some network (what you keep off the network is naturally not observable there).

I'll just proceed with my experiments with Braxman's approach and see if I can come up with an efficient way of juggling bookmarks by the hundreds or thousands, so as to get all the YouTube links to one browser, the blogging activity to another... ad infinitum (I hope not).

Another Data Breach - but a bit more interesting than usual...

One of my insurance companies informs me that Bonobos, a clothing subsidiary of WalMart, had a database breached on January 22nd. Around 7 million customers were affected and are being urged to change their passwords. Such items were exposed as:

email addresses
credit card information
phone numbers
details of orders
encrypted passwords

And here's the interesting aspect. Apparently the front line processing wasn't the target. Attackers downloaded a cloud backup of the company's database, not going for the "live" one.

You can flip through my previous posts to see how many times I've warned against this sort of thing. Why not go after backups? If the administrator of record even has the time to deal with security it'll regard the main processes and units, not ancillary matters like warm sites, cold sites, updates, secondary provider access, backups... Backups. Just a treasure chest sitting there and possibly not being well guarded.

There's the cloud location to be scrutinized as well; I used to talk to lots of customers at the old ISP that thought security was the responsibility of the cloud provider. They discovered otherwise. On top of needing to deal with such security details as would normally come up anywhere, cloud computing (to repeat myself) adds three more security issues to the mix:

Web Interface Integrity - is that form, code, etc. properly tested for buffer issues, syntax, version...?
Hypervisor Integrity - I saw at least one zero-day crack at this point
Provider Employee Exposure - can you trust the ISP staff you didn't hire?

But to simply go for a backup wherever it's located, online or otherwise, is an utterly fiendish strategy since it amounts to a flank attack, not approaching at a strong point. The backup may be stashed in some location on a primary node, a different node elsewhere, a cloud location, or even a tape (yes, that's still commonly in use). An attacker could either go for the live (online) location, the live local location, try to intercept the telemetry of the backup from point to point... or even risk physical theft of a tape cartridge. Any of these strategies could be profitable.