I maintain an account at one of those background search sites in order to keep track of certain things, plus check out new situations that come up. I'd been having to maintain contact information on an old business partner for over 15 years now and nothing much had been changing. But lately a thing or two DID change - at least with respect to my ability to be aware of what went with whom.
I suspect that many adjustments have been made to the ability to mine the data important to me since I became associated with this person. Tools have gotten better, data sets/lakes/blobs have been purchased or combined... heck, even leaked. However it happened, all this would naturally suggest security problems but there's also a kind of service improvement. Where I had been confused about the relationships between data "items", some of those mysteries are now solved.
The person I followed after the business relationship ended (and follow to this day for compliance and legal reasons) had a fairly common name, altuhough there were identically named people that I could tell bore no resemblance to the person I knew. But there were other issues apparently unrelated that did appear to lead back to the same person, same address, same region, same zip code, same potential email addresses, same potential social media accounts, same approximate age and so on. But there wasn't enough data or similar potential data (or whatever a better database term would be) to nail down a connection.
That was then; this is now.
However my search site is doing it, I'm now able to see totally contradictory claims that lead back to the SAME EXACT INDIVIDUAL. If you'd looked up info on someone in the past, you might try it again for some surprises. Better ability to correlate matters like past businesses owned, previous potential relatives and neighbors, whatever legal info doesn't require a trip to the courthouse, sex offender registrations... All this material could even be historical - out there already - but previous search methods and tools couldn't establish good connections. But now that's much improved from, say, a decade ago. I'm now able to see that the person I used to trust makes Nixon look like Rebecca of Sunnybrook Farm.
There you are - actual positive and upbeat information from me for a change. Or at least more upbeat than usual.
Monday, February 21, 2022
Monday, January 17, 2022
Old Box Refurbishment and possibly comedy
Here's the latest stage in my Frankenstein-like assembly of a new system (not a phone but a traditional computer that does not connect to stuff through a telephone company). This box offered by a refurbisher was new enough to be expandable to a reasonable degree but old enough to have connectivity to some stuff I had laying around and thought it would be interesting/odd/funny to use.
This is a four to five year old Win10 box with a fast but not-recent 3.2ghz processor, however maxed out on RAM. The HDD option chosen was the cheapest conventional drive offered, since I had to take Windows and couldn't get the thing with no OS. If I didn't need another Windows box, why did I choose the worst 250-gigger of the seven available drives? Should I not get a big, fast one and wipe it?
I usually wipe them but elected to get it this way so as to have a backup Windows option, but the ability to use slot 2 to add another drive later - not as secondary storage but as another primary. The future second drive will have some Linux or other on it, perhaps be a platform for virtual images, and will be bigger and faster than the original one. Simply pop the cover, change the power and data connectors from drive to drive and PRESTO, the box becomes another computer. But wait. That's not all.
The thing has PS/2 connections I used to attach an IBM-style clickety keyboard that was old enough to vote several years ago. PLUS it's using an adapter to convert to PS/2 from the earlier AT connection that's about as big as those huge German DIN plugs seen on reel-to-reel stereo decks back in the day. The outboard HDD enclosure has a not so amazing 30g of storage in an ATA unit the origin of which I've forgotten. And the VGA monitor has at least 10 years on it. All peripherals were just laying around, and referring to the refurb box price as its only outlay, I'll call it The Amazing $89 Computer. Or maybe the Ratbag 3000. Or The Box With Two Brains, or The Incredible Two Headed Transplant. I did upgrade the memory so as to spend a little more on it. But in coming up with a backup Linux platform, I decided to offend as many of my tech buddies as possible.
Next step: maybe a 900g SSD and MX Linux or something.
Wednesday, December 22, 2021
Top 5 Security Books article
This article lists reviews of several important releases in recent security issue coverage. Two (the Peter Kim and Kevin Mitnick books) could be said to be continuations of a series and two of them are break-in procedural studies (the ones from Allsopp and SparkFlow), while the last one regarding the Maskirovka program might be of somewhat temporary interest. But all have significant drawing cards.
Kim and Mitnick are major figures in security technology. Kim's series needs a new volume every few years due to his concern with explaining current code flaw and tool developments, all of which can change rapidly. Mitnick offers a new perspective in that he's described his famous "social engineering" methods before but now describes defensive rather than offensive strategies.
The Allsopp and SparkFlow books are about entrance methods, open source information scouring, low-order as well as noisy probing and so forth. This is what you'd expect from a survey in the particular magazine that carried the article. PTMag concentrates on aggressive tactics.
The Maskirovka book, while perhaps too topical for some, looks to have larger relevance. The specific outbreak of this Russian Federation-generated item is merely the occasion for bringing up matters than promise to return in slightly altered form in the future. For example, the apparent "Cybercaliphate" that took credit for related activity was in reality our old friends at APT28. An event involving the takeover of video-capable billboards and the injecting of political material re: Ukraine and referencing old Eastern-bloc issues is covered. There's the expected mention of US election influence operations, but after the Cambridge Analytica (and other) data mining efforts, I'm guessing that such approaches are now used by basically everybody, and probably with free tools.
This is a good list. PJ says check it out (with apologies to Joe Bob Briggs, from whom I stole that closing line catchphrase).
Kim and Mitnick are major figures in security technology. Kim's series needs a new volume every few years due to his concern with explaining current code flaw and tool developments, all of which can change rapidly. Mitnick offers a new perspective in that he's described his famous "social engineering" methods before but now describes defensive rather than offensive strategies.
The Allsopp and SparkFlow books are about entrance methods, open source information scouring, low-order as well as noisy probing and so forth. This is what you'd expect from a survey in the particular magazine that carried the article. PTMag concentrates on aggressive tactics.
The Maskirovka book, while perhaps too topical for some, looks to have larger relevance. The specific outbreak of this Russian Federation-generated item is merely the occasion for bringing up matters than promise to return in slightly altered form in the future. For example, the apparent "Cybercaliphate" that took credit for related activity was in reality our old friends at APT28. An event involving the takeover of video-capable billboards and the injecting of political material re: Ukraine and referencing old Eastern-bloc issues is covered. There's the expected mention of US election influence operations, but after the Cambridge Analytica (and other) data mining efforts, I'm guessing that such approaches are now used by basically everybody, and probably with free tools.
This is a good list. PJ says check it out (with apologies to Joe Bob Briggs, from whom I stole that closing line catchphrase).
Sunday, June 13, 2021
More malware and data leaks - BUT...
This article at NordLocker is certainly more of the same, but suggests two things: first, that leaks continue unabated (those entrusted with our Personally Identifiable Information can't protect it) and second, that some obvious protective measures are brought into high relief.
The article states that most of the recently leaked data were either email addresses or login/password pairs.
That's a very interesting observation. Notice that in this case the information does not concern matters of irreperable compromise or near-irreperable damage (like leakage of tax/SSN, date of birth, vehicle operator license number, benefit or financial account numbers, etc.) but issues of email or passwords.
Issues of email (usually a free service) and passwords (usually regarding reconfigurable contexts) are completely within the control of the user. To change a password is trivial. To change (or shut down) an email address is more work, but also technically trivial. Replay attacks (using snatched ID credentials) don't work if passwords or addresses are different from when snatched.
Changing your email address and passwords could increase your security posture more than a brand new phone or computer.
The article states that most of the recently leaked data were either email addresses or login/password pairs.
That's a very interesting observation. Notice that in this case the information does not concern matters of irreperable compromise or near-irreperable damage (like leakage of tax/SSN, date of birth, vehicle operator license number, benefit or financial account numbers, etc.) but issues of email or passwords.
Issues of email (usually a free service) and passwords (usually regarding reconfigurable contexts) are completely within the control of the user. To change a password is trivial. To change (or shut down) an email address is more work, but also technically trivial. Replay attacks (using snatched ID credentials) don't work if passwords or addresses are different from when snatched.
Changing your email address and passwords could increase your security posture more than a brand new phone or computer.
Thursday, May 6, 2021
Paradigm Shift?
Recently Facebook and Twitter have made decisions about continuing to ban the most recent ex-president of the US from posting on their systems. Certain political quarters have raised the possibility of breaking up social media concerns due to antitrust issues. There is a third consideration that is more far-reaching.
In the case of Facebook, to my knowledge its recent pronouncements about the usage of the ex-president's account constitute the third occurance of FB joining (or inserting itself into) its users' conversations, the first two being 2020 election procedure and Covid-19 treatment procedure. I'm not as familiar with Twitter. Using just FB as an indication, we're largely in uncharted territory - but not totally.
Over a decade ago, MySpace was the heavyweight social media platform. When it was purchased by a large advertising concern, many more sponsored content items appeared on user pages (crowding user content). This caused many users to begin searching for platform alternatives. Such a change could happen again and we should now be aware of that possibility.
[Additional note: I wasn't a heavy user of Google+ but that strikes me as what could have been a turnkey Facebook alternative had it been allowed to continue. Of course, hindsight is 20/20. Anyway, we're presented with two bad developments, in that big tech is accused of cancelling users and opponents of big tech could be accused of intending to restrict big tech's freedom of speech. My only advice would be to protect the first amendment above all in this range of issues and let the chips fall where they may. If both sides in this contest merely intend as a solution that the other side's opinions be throttled, then both sides are incorrect.]
In the case of Facebook, to my knowledge its recent pronouncements about the usage of the ex-president's account constitute the third occurance of FB joining (or inserting itself into) its users' conversations, the first two being 2020 election procedure and Covid-19 treatment procedure. I'm not as familiar with Twitter. Using just FB as an indication, we're largely in uncharted territory - but not totally.
Over a decade ago, MySpace was the heavyweight social media platform. When it was purchased by a large advertising concern, many more sponsored content items appeared on user pages (crowding user content). This caused many users to begin searching for platform alternatives. Such a change could happen again and we should now be aware of that possibility.
[Additional note: I wasn't a heavy user of Google+ but that strikes me as what could have been a turnkey Facebook alternative had it been allowed to continue. Of course, hindsight is 20/20. Anyway, we're presented with two bad developments, in that big tech is accused of cancelling users and opponents of big tech could be accused of intending to restrict big tech's freedom of speech. My only advice would be to protect the first amendment above all in this range of issues and let the chips fall where they may. If both sides in this contest merely intend as a solution that the other side's opinions be throttled, then both sides are incorrect.]
Monday, February 1, 2021
Browser Isolation
So this guy (Rob Braxman) is on YouTube a lot with many video segments about computer technology issues. He seems knowledgeable but I haven't independently checked, tested or verified everything that he's said. There is one issue, though, that has piqued my curiousity. That's the one described in his video entitled
What Browser To Use? About Browser Isolation
Search YouTube for that title and you'll hit his video. I'm not linking to him since I'm not officially advocating his channel; he's probably legit but I don't work for him or anything. What he's saying in this instance is that it would be possible to enhance one's digital hygiene by running multiple browsers for multiple purposes.
The short version is that he says it would be good to use Brave for Facebook and related sites like Instagram, Chrome for Google and related sites like YouTube and then to use Firefox for everything else. The rationale is that since FB and Google are the only two entities that collect so much information on your habits that they can "follow" you around the web, they should get their own browsers. Further, he determines that Brave (a Chrome variant) has filters that are effective in controlling issues specific to Facebook tracking. He also determines that Chrome is good to use for Google activity since Google-controlled sites presume Chrome use, and if they're viewed on a separate browser it would be less likely that Google could associate your surfing with non-Google locations.
All this raises several questions. First, is this multi-browser idea more effective or practical than VMs, some container idea or separate physical devices? Probably but I'll try it for awhile and see how it goes. Second, is all this an excercise in futility if all the sites and organizations with data on everybody have such crappy security that it'll all be leaked eventually? Perhaps - that is, in the case of whatever you've put on some network (what you keep off the network is naturally not observable there).
I'll just proceed with my experiments with Braxman's approach and see if I can come up with an efficient way of juggling bookmarks by the hundreds or thousands, so as to get all the YouTube links to one browser, the blogging activity to another... ad infinitum (I hope not).
What Browser To Use? About Browser Isolation
Search YouTube for that title and you'll hit his video. I'm not linking to him since I'm not officially advocating his channel; he's probably legit but I don't work for him or anything. What he's saying in this instance is that it would be possible to enhance one's digital hygiene by running multiple browsers for multiple purposes.
The short version is that he says it would be good to use Brave for Facebook and related sites like Instagram, Chrome for Google and related sites like YouTube and then to use Firefox for everything else. The rationale is that since FB and Google are the only two entities that collect so much information on your habits that they can "follow" you around the web, they should get their own browsers. Further, he determines that Brave (a Chrome variant) has filters that are effective in controlling issues specific to Facebook tracking. He also determines that Chrome is good to use for Google activity since Google-controlled sites presume Chrome use, and if they're viewed on a separate browser it would be less likely that Google could associate your surfing with non-Google locations.
All this raises several questions. First, is this multi-browser idea more effective or practical than VMs, some container idea or separate physical devices? Probably but I'll try it for awhile and see how it goes. Second, is all this an excercise in futility if all the sites and organizations with data on everybody have such crappy security that it'll all be leaked eventually? Perhaps - that is, in the case of whatever you've put on some network (what you keep off the network is naturally not observable there).
I'll just proceed with my experiments with Braxman's approach and see if I can come up with an efficient way of juggling bookmarks by the hundreds or thousands, so as to get all the YouTube links to one browser, the blogging activity to another... ad infinitum (I hope not).
Friday, January 29, 2021
Another Data Breach - but a bit more interesting than usual...
One of my insurance companies informs me that Bonobos, a clothing subsidiary of WalMart, had a database breached on January 22nd. Around 7 million customers were affected and are being urged to change their passwords. Such items were exposed as:
email addresses
credit card information
phone numbers
details of orders
encrypted passwords
And here's the interesting aspect. Apparently the front line processing wasn't the target. Attackers downloaded a cloud backup of the company's database, not going for the "live" one.
You can flip through my previous posts to see how many times I've warned against this sort of thing. Why not go after backups? If the administrator of record even has the time to deal with security it'll regard the main processes and units, not ancillary matters like warm sites, cold sites, updates, secondary provider access, backups... Backups. Just a treasure chest sitting there and possibly not being well guarded.
There's the cloud location to be scrutinized as well; I used to talk to lots of customers at the old ISP that thought security was the responsibility of the cloud provider. They discovered otherwise. On top of needing to deal with such security details as would normally come up anywhere, cloud computing (to repeat myself) adds three more security issues to the mix:
Web Interface Integrity - is that form, code, etc. properly tested for buffer issues, syntax, version...?
Hypervisor Integrity - I saw at least one zero-day crack at this point
Provider Employee Exposure - can you trust the ISP staff you didn't hire?
But to simply go for a backup wherever it's located, online or otherwise, is an utterly fiendish strategy since it amounts to a flank attack, not approaching at a strong point. The backup may be stashed in some location on a primary node, a different node elsewhere, a cloud location, or even a tape (yes, that's still commonly in use). An attacker could either go for the live (online) location, the live local location, try to intercept the telemetry of the backup from point to point... or even risk physical theft of a tape cartridge. Any of these strategies could be profitable.
email addresses
credit card information
phone numbers
details of orders
encrypted passwords
And here's the interesting aspect. Apparently the front line processing wasn't the target. Attackers downloaded a cloud backup of the company's database, not going for the "live" one.
You can flip through my previous posts to see how many times I've warned against this sort of thing. Why not go after backups? If the administrator of record even has the time to deal with security it'll regard the main processes and units, not ancillary matters like warm sites, cold sites, updates, secondary provider access, backups... Backups. Just a treasure chest sitting there and possibly not being well guarded.
There's the cloud location to be scrutinized as well; I used to talk to lots of customers at the old ISP that thought security was the responsibility of the cloud provider. They discovered otherwise. On top of needing to deal with such security details as would normally come up anywhere, cloud computing (to repeat myself) adds three more security issues to the mix:
Web Interface Integrity - is that form, code, etc. properly tested for buffer issues, syntax, version...?
Hypervisor Integrity - I saw at least one zero-day crack at this point
Provider Employee Exposure - can you trust the ISP staff you didn't hire?
But to simply go for a backup wherever it's located, online or otherwise, is an utterly fiendish strategy since it amounts to a flank attack, not approaching at a strong point. The backup may be stashed in some location on a primary node, a different node elsewhere, a cloud location, or even a tape (yes, that's still commonly in use). An attacker could either go for the live (online) location, the live local location, try to intercept the telemetry of the backup from point to point... or even risk physical theft of a tape cartridge. Any of these strategies could be profitable.
Subscribe to:
Posts (Atom)