Old Box Refurbishment and possibly comedy

Here's the latest stage in my Frankenstein-like assembly of a new system (not a phone but a traditional computer that does not connect to stuff through a telephone company). This box offered by a refurbisher was new enough to be expandable to a reasonable degree but old enough to have connectivity to some stuff I had laying around and thought it would be interesting/odd/funny to use.

This is a four to five year old Win10 box with a fast but not-recent 3.2ghz processor, however maxed out on RAM. The HDD option chosen was the cheapest conventional drive offered, since I had to take Windows and couldn't get the thing with no OS. If I didn't need another Windows box, why did I choose the worst 250-gigger of the seven available drives? Should I not get a big, fast one and wipe it?

I usually wipe them but elected to get it this way so as to have a backup Windows option, but the ability to use slot 2 to add another drive later - not as secondary storage but as another primary. The future second drive will have some Linux or other on it, perhaps be a platform for virtual images, and will be bigger and faster than the original one. Simply pop the cover, change the power and data connectors from drive to drive and PRESTO, the box becomes another computer. But wait. That's not all.

The thing has PS/2 connections I used to attach an IBM-style clickety keyboard that was old enough to vote several years ago. PLUS it's using an adapter to convert to PS/2 from the earlier AT connection that's about as big as those huge German DIN plugs seen on reel-to-reel stereo decks back in the day. The outboard HDD enclosure has a not so amazing 30g of storage in an ATA unit the origin of which I've forgotten. And the VGA monitor has at least 10 years on it. All peripherals were just laying around, and referring to the refurb box price as its only outlay, I'll call it The Amazing $89 Computer. Or maybe the Ratbag 3000. Or The Box With Two Brains, or The Incredible Two Headed Transplant. I did upgrade the memory so as to spend a little more on it. But in coming up with a backup Linux platform, I decided to offend as many of my tech buddies as possible.

Next step: maybe a 900g SSD and MX Linux or something.

Top 5 Security Books article

This article lists reviews of several important releases in recent security issue coverage. Two (the Peter Kim and Kevin Mitnick books) could be said to be continuations of a series and two of them are break-in procedural studies (the ones from Allsopp and SparkFlow), while the last one regarding the Maskirovka program might be of somewhat temporary interest. But all have significant drawing cards.

Kim and Mitnick are major figures in security technology. Kim's series needs a new volume every few years due to his concern with explaining current code flaw and tool developments, all of which can change rapidly. Mitnick offers a new perspective in that he's described his famous "social engineering" methods before but now describes defensive rather than offensive strategies.

The Allsopp and SparkFlow books are about entrance methods, open source information scouring, low-order as well as noisy probing and so forth. This is what you'd expect from a survey in the particular magazine that carried the article. PTMag concentrates on aggressive tactics.

The Maskirovka book, while perhaps too topical for some, looks to have larger relevance. The specific outbreak of this Russian Federation-generated item is merely the occasion for bringing up matters than promise to return in slightly altered form in the future. For example, the apparent "Cybercaliphate" that took credit for related activity was in reality our old friends at APT28. An event involving the takeover of video-capable billboards and the injecting of political material re: Ukraine and referencing old Eastern-bloc issues is covered. There's the expected mention of US election influence operations, but after the Cambridge Analytica (and other) data mining efforts, I'm guessing that such approaches are now used by basically everybody, and probably with free tools.

This is a good list. PJ says check it out (with apologies to Joe Bob Briggs, from whom I stole that closing line catchphrase).

More malware and data leaks - BUT...

This article at NordLocker is certainly more of the same, but suggests two things: first, that leaks continue unabated (those entrusted with our Personally Identifiable Information can't protect it) and second, that some obvious protective measures are brought into high relief.

The article states that most of the recently leaked data were either email addresses or login/password pairs.

That's a very interesting observation. Notice that in this case the information does not concern matters of irreperable compromise or near-irreperable damage (like leakage of tax/SSN, date of birth, vehicle operator license number, benefit or financial account numbers, etc.) but issues of email or passwords.

Issues of email (usually a free service) and passwords (usually regarding reconfigurable contexts) are completely within the control of the user. To change a password is trivial. To change (or shut down) an email address is more work, but also technically trivial. Replay attacks (using snatched ID credentials) don't work if passwords or addresses are different from when snatched.

Changing your email address and passwords could increase your security posture more than a brand new phone or computer.

Paradigm Shift?

Recently Facebook and Twitter have made decisions about continuing to ban the most recent ex-president of the US from posting on their systems. Certain political quarters have raised the possibility of breaking up social media concerns due to antitrust issues. There is a third consideration that is more far-reaching.

In the case of Facebook, to my knowledge its recent pronouncements about the usage of the ex-president's account constitute the third occurance of FB joining (or inserting itself into) its users' conversations, the first two being 2020 election procedure and Covid-19 treatment procedure. I'm not as familiar with Twitter. Using just FB as an indication, we're largely in uncharted territory - but not totally.

Over a decade ago, MySpace was the heavyweight social media platform. When it was purchased by a large advertising concern, many more sponsored content items appeared on user pages (crowding user content). This caused many users to begin searching for platform alternatives. Such a change could happen again and we should now be aware of that possibility.

[Additional note: I wasn't a heavy user of Google+ but that strikes me as what could have been a turnkey Facebook alternative had it been allowed to continue. Of course, hindsight is 20/20. Anyway, we're presented with two bad developments, in that big tech is accused of cancelling users and opponents of big tech could be accused of intending to restrict big tech's freedom of speech. My only advice would be to protect the first amendment above all in this range of issues and let the chips fall where they may. If both sides in this contest merely intend as a solution that the other side's opinions be throttled, then both sides are incorrect.]

Browser Isolation

So this guy (Rob Braxman) is on YouTube a lot with many video segments about computer technology issues. He seems knowledgeable but I haven't independently checked, tested or verified everything that he's said. There is one issue, though, that has piqued my curiousity. That's the one described in his video entitled

What Browser To Use? About Browser Isolation

Search YouTube for that title and you'll hit his video. I'm not linking to him since I'm not officially advocating his channel; he's probably legit but I don't work for him or anything. What he's saying in this instance is that it would be possible to enhance one's digital hygiene by running multiple browsers for multiple purposes.

The short version is that he says it would be good to use Brave for Facebook and related sites like Instagram, Chrome for Google and related sites like YouTube and then to use Firefox for everything else. The rationale is that since FB and Google are the only two entities that collect so much information on your habits that they can "follow" you around the web, they should get their own browsers. Further, he determines that Brave (a Chrome variant) has filters that are effective in controlling issues specific to Facebook tracking. He also determines that Chrome is good to use for Google activity since Google-controlled sites presume Chrome use, and if they're viewed on a separate browser it would be less likely that Google could associate your surfing with non-Google locations.

All this raises several questions. First, is this multi-browser idea more effective or practical than VMs, some container idea or separate physical devices? Probably but I'll try it for awhile and see how it goes. Second, is all this an excercise in futility if all the sites and organizations with data on everybody have such crappy security that it'll all be leaked eventually? Perhaps - that is, in the case of whatever you've put on some network (what you keep off the network is naturally not observable there).

I'll just proceed with my experiments with Braxman's approach and see if I can come up with an efficient way of juggling bookmarks by the hundreds or thousands, so as to get all the YouTube links to one browser, the blogging activity to another... ad infinitum (I hope not).

Another Data Breach - but a bit more interesting than usual...

One of my insurance companies informs me that Bonobos, a clothing subsidiary of WalMart, had a database breached on January 22nd. Around 7 million customers were affected and are being urged to change their passwords. Such items were exposed as:

email addresses
credit card information
phone numbers
details of orders
encrypted passwords

And here's the interesting aspect. Apparently the front line processing wasn't the target. Attackers downloaded a cloud backup of the company's database, not going for the "live" one.

You can flip through my previous posts to see how many times I've warned against this sort of thing. Why not go after backups? If the administrator of record even has the time to deal with security it'll regard the main processes and units, not ancillary matters like warm sites, cold sites, updates, secondary provider access, backups... Backups. Just a treasure chest sitting there and possibly not being well guarded.

There's the cloud location to be scrutinized as well; I used to talk to lots of customers at the old ISP that thought security was the responsibility of the cloud provider. They discovered otherwise. On top of needing to deal with such security details as would normally come up anywhere, cloud computing (to repeat myself) adds three more security issues to the mix:

Web Interface Integrity - is that form, code, etc. properly tested for buffer issues, syntax, version...?
Hypervisor Integrity - I saw at least one zero-day crack at this point
Provider Employee Exposure - can you trust the ISP staff you didn't hire?

But to simply go for a backup wherever it's located, online or otherwise, is an utterly fiendish strategy since it amounts to a flank attack, not approaching at a strong point. The backup may be stashed in some location on a primary node, a different node elsewhere, a cloud location, or even a tape (yes, that's still commonly in use). An attacker could either go for the live (online) location, the live local location, try to intercept the telemetry of the backup from point to point... or even risk physical theft of a tape cartridge. Any of these strategies could be profitable.

Sensitive Data Security

Prior to extensive research into this subject, I'll note here my seat-of-the-pants understanding of the issue of protecting proprietary information, results of research, confidential contingencies, legal obligations, etc. If there's a cache of important stuff you need to store in electronic form, how do you protect it? Such a question brings up not only new issues, but rather well-established ones.

AIRGAPPING - To have a node or nodes dedicated to storage is an obvious but often not actually used method. Probably a sub-concept of network segmentation in a proper hierarchy, a clumsy way to state it would be to tell an administrator not to put the backups on the same network as what's being backed up (AND to give that admin or admin group the authorization and money to set the system up and maintain it...). USB HDDs and thumb drives are there if you're really strapped for cash.

BACKUPS - Sort of off the subject, but security concerns extend to backups as well as "live" parts of your operation. The important stuff lives there as well. Not only should there be a program of backing up confidential things and testing the backups regularly, there should be a scheme in which the form of storage (encryption?) is considered, the storage location is considered (not only cloud, but an alternative to cloud if there's a provider issue) and the security of the communication route TO the backup storage locations is considered. This last would be a candidate for a latter-day form of vampire tapping. No need for tar commands later.

NETWORK SEGMENTATION - Any organization that has proprietary data could use particular subnets for not only that data but for financial people or groups, the managerial and scientific research groups and high-level admin people who might need a method of access for evaluation and countermeasures related to network attacks (to the extent effective).

SECONDARY PROVIDER - one's infrastructure or cloud provider might be a center of or source of the problem, so backup relationships would be good there, sort of as a 'warm site' as described in the sense of physical locations. And this would be good in case of the financial predicament I often bring up: I was once told of a large bank that failed to pay a monthly bill to a cloud provider and a few days after the first of the month, several virtual machines, switches, routers, lots of data, hourly transactions, logs and things just went POOF. While working all that out, one could hot-switch to the secondary provider perhaps.

So a combination of segmentation and backup sequestering seems to be the way to go about this. Communication channels are also a concern. All three items are a risk, since if I were a cyber soldier for a third world country and wanted to score some free research results from a first world nation, I'd look at them all. Are backups and communications in the clear? Is everything on the same network? Did management spend much on security? Did they spend much on network architecture originally or is this a (typically) patched-together situation? Do they even have IT??

I'll leave us with a checklist:

SEGMENTATION: separate node(s), directories, networks
ENCRYPTION: nothing in the clear
BACKUPS: data, configurations, locations, multiple copies
COMMUNICATIONS: multiple providers, devices, virtual devices, financial contingencies