Third Week of StayCation: Different Uses For Multiple Boxes

One would be really dumb to try to do everything on one's phone: banking, insurance payments, stock trading, plotting illegal activities while assuming messaging is totally unmonitored... as if anybody ever actually did that. Oh, and doing one's taxes over a "smart"phone... that's a real winner.

But sitting at home on Covid-19 break, it occurred to me that there's enough PCs/Macs/Linux/whatever machines around here to be apportionable to many different needs. Imagine if one were to use dedicated boxes for specific risk levels or hardware needs. Let's list a few:

SECURE COMMUNICATIONS AND FINANCIAL ACCOUNTS - This would not argue for Windows XP. This would argue for a current, constantly-updated, antivirus-equipped (if applicable) latest-thing desktop or laptop. Don't load free gambling programs on this one.

CASUAL COMMUNICATIONS, SOCIAL MEDIA AND VIDEOCONFERENCING - This also argues for frequent patching and up-to-date hardware. But heavy malware scanning and general lack of trust would be important.

GAMING - High-performance hardware requirements and total lack of trust are the driving issues here.

CLONE/BACKUP OF OTHER UNIT - Mainly with the business/financial computer, if you have a crash you may need a quick replacement to step in.

OFFLINE ARCHIVING - Important files need to be stored in a safe place. This box doesn't need to be networked and you might even unplug this one when not used. And it's a good backup for a backup; the only place big enough to copy over an outboard HDD is another big drive.

FIREWALL/ROUTER/PROXY SERVER UNIT - If you have heavyweight networking requirements, a filtration point might be needed.

ODDBALL COMPATIBILITY UNIT - Particular jobs or situations could demand a particular operating system, application, application set or configuration(s). If the boss says to set it up a certain way, this is the box on which to do that.

So I've suggested that you need a minimum of SEVEN computers in your Undisclosed Location.

So? What's so strange about that? (everybody peers into my room, shakes head, walks away)

The Most Recent End Of The World

According to previous job descriptions, I have some experience in emergency operations of several kinds (I’ll keep details to myself since many of you know that stuff already and the internet already knows too much). Here’s my perspective on the current virus outbreak and how it can be somewhat managed:

1. Frequent hand-washing and refraining from touching the face are good moves. Using disposable gloves is also a good idea, as is social distancing whenever practical. Masks and buying lots of toilet paper are mistakes; the mask will not prevent a virus from getting through, but will help an infected person NOT infect someone that’s clear of the virus by containing the cough droplets. Also, intestinal problems are not present during most infections so the panic buying of toilet paper is misguided.

Edit: Information is not clear but it looks like masks could have some positive effect even if not 100% reliable, and on the toilet paper issue I've been told by a grocer that most of the cheap TP comes from China, where supply chain disruption has happened. So not all the TP went away from hoarding, and masks could be a good thing even in less effective contexts.

2. Many people appear to be buying more groceries than usual, perhaps since they’re not going to restaurants and bars so much. From what I’ve seen, the supply chain for produce and other foods is functioning well, but still needs overnight restocking. This is an opportunity for those of us that have earthquake kits (on the West coast), tornado kits (in the Great Plains) and hurricane kits (East coast and gulf coast) to restock and discard out-of-date canned goods, expired and leaking batteries and so forth. And in many areas take-out service or drive-through is still done at coffee houses and restaurants. And it may be a first that Texas restaurants are allowed to deliver alcoholic beverages with food orders, a measure not previously allowed in that US state.

3. Although much of the economy is being upset, many things still function. Power systems and telephone/internet transmission is good. Fuel oil, diesel and gasoline supplies are plentiful. Car repair places are still doing good business where I am (central US). The medicine I need is easy to get. Water/sewer service is unimpeded. And the weather has been mild. It could be worse.

4. The internet is rising to the occasion with not only new resource pages, but with the ones that already existed such as www.cdc.gov and www.ready.gov at least for the US.

5. Finally, remember that corona-family virii have been around for some time, and the infectious disease experts have been to this rodeo before (I think about ten times in the last 25 years or so for the US). If recent Chinese reports are accurate, the Hunan area is seeing a drop in need for bed space, treatment, therapeutic medicine and so forth, suggesting that the curve is already headed down at their locations. And early fast-spread statistics from Italy are something that I think could be explained by the close-in conversation habit that Italians consider normal. This effect would not apply to most other societies and I’ve seen at least one report that suggests that the Italians now are doing better than other European countries at social distancing practices.

I invent a new acronym...

... mainly for my own convenience: ITNA - Individually Targeted National Attack.

Here's a good Forbes Magazine article about the most recent developments in what we used to call 'wardriving'.

Driveby Vulnerability story

And here's one of the latest things on the Huawei issues.

Huawei story

At the risk of repeating myself, I'll speculate on the global possibilities of such hyper-local matters. One of the exposures of the Imperial Japanese Navy in attempting to knock out the American Pacific fleet in 1941 was the possibility that they'd be discovered as they slogged their way from Japan to Midway. They got discovered, thereby failing in their efforts. What if that trip had been unnecessary?

The whole "digital Pearl Harbor" scenario posits the internet as a remote access point to sensitive areas that an enemy would wish to use as attack vectors. Put that idea together with such things as personal data leaks and you get the possibility of attacking an enemy nation via bypassing national defense infrastructure. The Russians have already approached this by trying a cyberattack on Ukraine's municipal power grid some time ago. If citizens can be attacked directly, then there's little need for near-Napoleonic Era infantry advances. Observe this list of aspects of an individual's digital life:

Phone GPS tracking and phone company cloud data backups/saves

Smart home connections from digital assistants to smart light bulbs with insecure protocols

Financial information in data leaks

Medical information in data leaks

Email accounts, particularly free webmail

Government (national, state and local) information in data leaks

Information publicly viewable from government or Google

Resume information posted to job sites or on personal pages



First, set up a data collection project to track every citizen in the target country - let's say around 100 million people. Every citizen has a file. That file would become a dossier to use to feed an attack script specific to the person. The script could have sections for dox-ing personal contact info, for shutting down phone numbers and accounts with a phony email claiming a move to a competitor, for making unauthorized purchases that could trigger auto-shutdowns of credit, for making false police calls... get the idea?

Add those custom measures to the obvious things like attacks on police dispatch communications, remote traffic control systems, computer-controlled telephone exchanges, food distribution networks, internet-accessible remote starting in recently built cars and trucks... and all the other new exposures or vulnerabilities that have arisen over the last ten to fifteen years. And the Stuxnet worm has shown everyone that (with access to certain programs and languages) it's possible to destroy industrial devices with instructions inserted into the control points from outside.

So Country A could attack the 100 million citizens of Country B after first building the citizen files, then getting the attack scripts finished, then populating the attack script with info on the target citizen. After that, it's an access question (perhaps constructing backdoors over time) and then one simply selects a time to pull the trigger. No armies or navies needed. It's a software development project with a very large database. That sort of thing is done every day; it's just been weaponized by someone in this example.

How to protect oneself? If I were the government, I'd pull back on commercial off-the-shelf solutions and use more home-grown ideas, plus put more people onto network monitoring jobs. Individuals would benefit from my "Go to the PUB" advice: maintain Passwords, Updates and Backups. And don't load gobs of free apps onto your phone without knowing who they talk to.

Biting The Bullet: getting a Windows 10-native box due to Window 7 end-of-support

Short Report: buying and setting up the hardware was the usual three hour configuration process for a new box - but the discovery of a new OS was also usual in that one discovers yet again how Microsoft is always able to make some things marginally worse. And when it didn't really have to.

Longer Version: I got a fresh build of Win10 (not an upgrade from 7 or 8) from Office Depot's website's off lease resale page. My alternates were Tiger Direct, Micro Center and discountelectronics.com and they are probably equally trustworthy (although in my experience the last one listed has the fastest delivery time). Office Depot probably was the low price leader but took 10 days to deliver from a 3rd party refurbisher. Quality of the box was very good.

Sequence of events:

1. physical hookup and establishing of user account
2. Windows updates and related reboots
3. installation of other browser of preference
4. installation of duckduckgo and/or startpage.com search into browser of preference
5. installation of BrightFort Spyware Blaster (malware install preventer)
6. installation of Safer-Networking Spybot Anti-Beacon (blocks lots of Win10 chatty telemetry)
7. installation of other 3rd party things like openoffice.org, Audacity audio recorder, antivirus...
8. installation of iTunes VIA HAVING TO GOOGLE FOR Win10 INSTALLER rather than go through MS Store from Apple link
9. do 1st snapshot with BrightFort Spyware Blaster (a kind of short config backup)
10. do real backup (discovering that one outboard device had no Win10 driver available; used another that did)
11. test programs like mrt, disk utilities etc. to see if they work.
12. discover that "Photos", the replacement for Windows Photo Viewer, is clunkier and less stable
13. realize that "Backup" hid the control for "run now" in the More Options menu, which is stupid
14. realize that "Photos" sometimes wants connectivity to no useful purpose
15. move in remaining amount of needed data from other places if you require it

The more things change, the more they stay the same.

Kinda saw this coming...

... since Richmond had been warning us for oh, about 2 years.

I'll be complimenting one of my institutions (Chase) for NOT allowing this to happen. There are two or three ways to prevent this error message, all of which cost a bit of money. And the Info Tech people have to get it from some level of - you guessed it - MANAGEMENT and the managers at Chase, to my knowledge, understood the issue and I haven't seen this goofup at any of their ATMs. I don't actually know where this machine is, but it's at one of their competitors.

If I were Chase, I'd milk this for all it's worth, never letting the cheaper banks forget it. Hard to sweep this one under the rug.

Rank Speculations Prompting My Impending Win10 Switch

No, I'm not changing my advocacy position any. I still hate everything. But I'm now having to look at the Win10 upgrade situation due to Win7 going out of support in a few weeks (3 of my 11 currently operational boxes run some Windows or other). Is that really needed? Yes; most security problems statistically target the Win7 release. BUT going to 10 brings up a new set of problems.

(If you're interested I'm looking at buying at least one preloaded computer offlease (used) from either discountelectronics.com, tigerdirect.com, microcenter.com or officedepot.com).

Windows 10 is extremely chatty in that it monitors user activity for various reasons and excuses. Fortunately, there are lots of Win10 telemetry restriction programs, scripts and procedures available via a simple web search (I'll do a further post on some). But I speculate that it's more necessary than normal that you look into Win10 security due to the new chattiness, for the following reasons.

Unlike in the past, Windows 10 monitors user activity as well as security stance with various installed tools including a keystroke logger. This means that it sends data to Microsoft for later analysis.

But note that if this shuffling (telemetry) happens, then that means two other things. First, that it gets transmitted over probably-insecure, probably-unencrypted channels. That transmission provides the opportunity for someone to use the good-ol' MITM attack. If you don't know what that is, Goo... no, Yandex it.

And then there's a third problem I haven't seen discussed much. Microsoft would, after harvesting the info, store it somewhere. It's that storage location I wonder about. Years ago, Microsoft lost the source code to a break-in when somebody got into their network at Richmond, WA - but not directly. Rather than hit MS servers frontally, the sneaks got hold of an employee list and located a manager working from home. That's right. Security wasn't quite as good on the home laptop or desktop, so they hacked the manager. Getting in via his credentials, they swiped all of Win98SE, I think it was. Oh, I forget. Goo... no, Yandex it. And I dunno; maybe Win10 is 90% Win98SE.

This last holds the greatest number of possibilities for future bad guys in my view. Cook up a... let's call it a "Prospector Program" that searches for addresses of databases and storage locations (network, attached device, cloud, whatever). Then set up a humungous data repository for it to use as a depot. Give it an obscured and encrypted communications method. Then run the program 24x7x365 at a low-intensity level of pings, attempts, etc. You're not hitting the main web interfaces or firewalls aggressively. You're hitting a secondary area that's not being DDoS'd in spectacular fashion, for example. There's a greater possibility of overstressed admins having their backs turned.

Just a few thoughts.

Long Term Cyber Security Risk

Assume that you, on your end (company or individual) are doing everything right. You're not clicking on unknown links in emails, you're not opening any attachment from suspicious parties and you aren't going to any bad sites you shouldn't be. At least not on company time and if so, using a virtual machine that can be ditched if necessary AND with documented permission from immediate management.

But what about the party on the other end? What about companies with which your organization does business? What about organizations you don't control? Here's a nice list of issues:

Alexa/Google type assistants
Hospitals
Government organizations
businesses you shop with
Financial institutions
Phone, VPN and communications providers
Businesses purchased that haven't integrated their networks with the new owner securely yet
Email providers
Social Networks

Well? Are you sure all those parties are taking good care of your personal information? Even if an APT (advanced persistent threat) isn't interested in you, various scummy individuals and groups are looking for your info all the time, if only to resell it to another creep. I'll call this risk an "organization leak".

There's also the tendency of newer networking protocols to track your location more effectively. Things like your DOB or credit card number can be guessed by random generators. And cameras or phones pointed at you by somebody else (person or business) could save images or other recordings of you and not require your permission to do so. Put that together with facial recognition (or voice recognition if they have enough to go on) and that's another category of captured information you don't control. I'll call this risk "analysis exposure".

Given the environment of saved data above, with files and files being created everywhere regarding you while being identified with at least some of your personal information attached or associated, imagine that some time later, somebody gets interested in you. At that time, might they get hold of a super database harvesting script that spent, oh, 60 days prospecting around the 'net for anything it could find? And remember: this example presumes a third or fourth party completely unrelated to the organizations that collected or originated the data (a party that merely takes advantage of lack of organizational security, updates or oversight). I'll call this risk "data inventory exposure".

And do you use cloud storage? I'll call this risk "backup location exposure".

And in the near future, will it no longer be possible to buy a gizmo that's not wireless? Wired-only or no-connectivity options exist for various devices now but imagine if cost and convenience force out the availability of a power switch or card slot by which you could opt out of the info flow? I'll call this risk "transmission jailing".

So if in the long run there's no actual security anymore, consider that there MIGHT be if you try to keep a secret by not dealing with it over channels you can't prove are secure. I'll not recommend anything but then, I don't know what channels you use anyway. If you need to be secure about something, it might be best to go out-of-band... depending on what band is normal for you. Carrier pigeon? Marconi? Tin can telephone? Smoke signal? I have no inkling of what will work in your case. But then, the bad guy probably won't either.