I must note at least one point about the recent prohibitions/restrictions upon certain software (at least in the US). Last Thursday the Biden Administration placed a ban upon sales of software from the Kaspersky company due to possible risks from the Russian government's access to telemetry or results from such software (like antivirus products). This recalls similar moves against Tik Tok, a social media platform with ties to China, indirect though they may be.
I'm not a lawyer but as I understand it, both situations mentioned above are questionable since the owner/operators of the programs/platforms have some connection to offshore entities (governments). This means that there exists a channel or channels possible to exfiltrate information from US users to potentially hostile or competitive interests which would not exist in many or most other products. That's the empirical point here - the channels exist.
There's also a legal point. If and when such channels are used to exfiltrate anything from domestic US users to any offshore location/entity, any number of violations of export restrictions could happen. And although the specifics of the exfiltering operation may not be mentioned by current legislation, the intent if not the letter of the law could easily be at risk here.
And there's an additional empirical point: if a channel exists via which domestic user information could be snatched, what's to prevent the curious third party (domestic or foreign) from discovering that channel? So here's the list of issues that impelled me to comment: first, we have potentially insecure communications situations present in certain software. Second, legal risks are created by the existence of said com situations. Third, the com situations create potential vulnerabilities that would be discoverable by any additional organization with the analytic capability to search for them.
I thought it was needed to overtly mention these points so as to contribute to the national-security-VS-free-speech debate (my own position being that free speech protections would not apply where national security concerns are objectively demonstrable).
Monday, June 24, 2024
Friday, May 17, 2024
Somebody GETS it!!!
[edit - This is an experiment in desperation. I normally wouldn't engage in comment involving political content since it's so often divisive and irrelevant but in this case there might be an argument for it. As I mention below, we've been in the digital age for quite some time and 9 out of 10 of us are still cavalier about data management. This article is a way to call attention to such issues that I'd hadn't tried yet...]
Hunter Biden (son of current US President) is facing various legal charges and some of the prosecution's information is based upon files found on various computers Hunter seems to have left lying around. There was one apparently abandoned at a repair shop, one left in a rental car during or after a business trip and at least one or two other laptops mentioned in the news over the past year or two. I have no specific information on or comment upon these cases but I'd like to note here that the predicament raises an interesting question - interesting to me, that is. Namely, how would one play Hunter's hand? What if you were in the same situation? Is the situation even defensible?
I'm not a lawyer, but Hunter Biden is - he's got a JD although I'm not sure if he's practiced. I don't know if he came up with his strategy himself or if he's getting very good advice but there's certainly a great angle for defense here: Biden has never denied posession of the laptops. Is that a problem? Not as such, because defense can repeatedly raise the possibility of someone planting files upon his machines for political or other nefarious purposes. As many of us constantly shout, these systems in the hands of the average user are as secure as Andy Griffith's jail, in which Otis the town drunk would let himself out at the end of his daily sentence. Yes, they MIGHT be operated securely, but it takes work - and there are those very interested in breaking into high value targets.
Not only are average systems not very secure, but the hardware (easily trackable to a user) has not been the object of denial. Biden's team is right not to claim lack of ownership because first, it's easier to indict files or configurations (possible to remotely manipulate) and second, it's hard to deny ownership. Think of all the ways your computer could be connected to you:
- SKU number or bar code of device associated with credit card purchase
- processor serial number (if any)
- device serial number
- MAC address of NIC
- motherboard serial number (if present)
- any serials of peripherals or internal options
- hard drive serial numbers
- memory serial, stock or control numbers
- ISP logs (if unaltered and reliably seen to be so)
- browser, OS and application logs (if unaltered and reliably seen to be so)
- and so on. The Biden stance of having no challenge to ownership dodges every above problem that could help the prosecution if defense claimed that the laptops were planted. And another thing that's brilliant about it is that it avoids the common frame of mind that 'nobody can see what I do on my phone'. Personal computers have been around for about a generation and I've had a cell phone for about 20 years now. This stuff is NOT NEW. But the average Joe Sixpack still has no concept of electronic security... and is even IN IGNORANCE dismissive of whomever brings it up. Either Hunter or somebody with him Actually Gets It.
P.S. - and to the idiots who thought I was about to make some political statement, here's one: I predict that whoever you like is gonna lose.
P.P.S. - Here's another way to illustrate the moral of the story: you could be next. Outside the highly public circumstances of Biden's family, the loss of a cell phone, a laptop or even a PC lost in a burglary presents essentially anyone to the dangers of the loss of control of one's data. If the "new owner" gets curious about anything important beyond wiping for resale then now YOU ARE HUNTER BIDEN.
Hunter Biden (son of current US President) is facing various legal charges and some of the prosecution's information is based upon files found on various computers Hunter seems to have left lying around. There was one apparently abandoned at a repair shop, one left in a rental car during or after a business trip and at least one or two other laptops mentioned in the news over the past year or two. I have no specific information on or comment upon these cases but I'd like to note here that the predicament raises an interesting question - interesting to me, that is. Namely, how would one play Hunter's hand? What if you were in the same situation? Is the situation even defensible?
I'm not a lawyer, but Hunter Biden is - he's got a JD although I'm not sure if he's practiced. I don't know if he came up with his strategy himself or if he's getting very good advice but there's certainly a great angle for defense here: Biden has never denied posession of the laptops. Is that a problem? Not as such, because defense can repeatedly raise the possibility of someone planting files upon his machines for political or other nefarious purposes. As many of us constantly shout, these systems in the hands of the average user are as secure as Andy Griffith's jail, in which Otis the town drunk would let himself out at the end of his daily sentence. Yes, they MIGHT be operated securely, but it takes work - and there are those very interested in breaking into high value targets.
Not only are average systems not very secure, but the hardware (easily trackable to a user) has not been the object of denial. Biden's team is right not to claim lack of ownership because first, it's easier to indict files or configurations (possible to remotely manipulate) and second, it's hard to deny ownership. Think of all the ways your computer could be connected to you:
- SKU number or bar code of device associated with credit card purchase
- processor serial number (if any)
- device serial number
- MAC address of NIC
- motherboard serial number (if present)
- any serials of peripherals or internal options
- hard drive serial numbers
- memory serial, stock or control numbers
- ISP logs (if unaltered and reliably seen to be so)
- browser, OS and application logs (if unaltered and reliably seen to be so)
- and so on. The Biden stance of having no challenge to ownership dodges every above problem that could help the prosecution if defense claimed that the laptops were planted. And another thing that's brilliant about it is that it avoids the common frame of mind that 'nobody can see what I do on my phone'. Personal computers have been around for about a generation and I've had a cell phone for about 20 years now. This stuff is NOT NEW. But the average Joe Sixpack still has no concept of electronic security... and is even IN IGNORANCE dismissive of whomever brings it up. Either Hunter or somebody with him Actually Gets It.
P.S. - and to the idiots who thought I was about to make some political statement, here's one: I predict that whoever you like is gonna lose.
P.P.S. - Here's another way to illustrate the moral of the story: you could be next. Outside the highly public circumstances of Biden's family, the loss of a cell phone, a laptop or even a PC lost in a burglary presents essentially anyone to the dangers of the loss of control of one's data. If the "new owner" gets curious about anything important beyond wiping for resale then now YOU ARE HUNTER BIDEN.
Sunday, May 5, 2024
Physical Security
Right now my geographical area is experiencing heavy rain and wind and we've lost electrical power (I'm typing on a laptop with a good battery; I could also do this on the smart phone). I'm reminded of the times that I gave security committee programs on various kinds of preparedness relevant to my organization. One such talk turned upon the speculation that 3/4 of the potential physical problems that could befall our location would result in one single sort of result: loss of electricity. Let's consider that possibility.
Rising flood waters, a lightning strike on a pole-mounted transformer, high winds knocking trees onto a power line, copper theft, traffic accidents taking out telephone poles, deliberate vandalism and other things could all result in power loss further down the road or somewhere on the grid. And even if your area wasn't affected, the fix for an affected area might route power away from you, causing a service interruption in order to help the stricken zone. Here's a list of issues and items that could be relevant to the attempt to counter the above potential problems.
Generator Issues: diesel, solar, wind, transformers to feed storage devices like batteries (ordinary rechargeable or deep cycle).
Battery Issues: flashlights, laptop batteries, uniterruptable power supplies, cell phone chargers, cell phone power packs, AC adaptors
Vehicle Issues: fuel storage, oil and tool storage, fuel topoff before inclement weather, tuneups, tire condition, spare tire condition, jumper cables or startup devices as required
Shock Protection Issues: spare fuses, surge protection/power conditioners, Faraday bags, isolation wrist wires, battery removal and storage to prevent corrosion at leads
First Aid Issues: ordinary kit contents (bandages, aintibiotic creams, tape, scissors), prescriptions, spare glasses or contact lenses, chewable aspirin, Immodium, antacid, sunglasses, sunscreen, insect repellent, area repellent (like Yard Gard), duct tape for splints, paper towels, muscular pain medication such as Voltarin or Aspercreme with lidocaine, baby wipes. Lysol spray disinfectant, trash or leaf bags.
Rising flood waters, a lightning strike on a pole-mounted transformer, high winds knocking trees onto a power line, copper theft, traffic accidents taking out telephone poles, deliberate vandalism and other things could all result in power loss further down the road or somewhere on the grid. And even if your area wasn't affected, the fix for an affected area might route power away from you, causing a service interruption in order to help the stricken zone. Here's a list of issues and items that could be relevant to the attempt to counter the above potential problems.
Generator Issues: diesel, solar, wind, transformers to feed storage devices like batteries (ordinary rechargeable or deep cycle).
Battery Issues: flashlights, laptop batteries, uniterruptable power supplies, cell phone chargers, cell phone power packs, AC adaptors
Vehicle Issues: fuel storage, oil and tool storage, fuel topoff before inclement weather, tuneups, tire condition, spare tire condition, jumper cables or startup devices as required
Shock Protection Issues: spare fuses, surge protection/power conditioners, Faraday bags, isolation wrist wires, battery removal and storage to prevent corrosion at leads
First Aid Issues: ordinary kit contents (bandages, aintibiotic creams, tape, scissors), prescriptions, spare glasses or contact lenses, chewable aspirin, Immodium, antacid, sunglasses, sunscreen, insect repellent, area repellent (like Yard Gard), duct tape for splints, paper towels, muscular pain medication such as Voltarin or Aspercreme with lidocaine, baby wipes. Lysol spray disinfectant, trash or leaf bags.
Sunday, March 3, 2024
Free Technical Certifications
Certifications aren't the be-all and end-all of the training landscape, but if it's free, the price is right. Maybe. Here's a roster of those free certs that appear valuable to me, depending on your area of interest.
CISCO SYTEMS, INC
The site skillsforall.com is one area where Cisco lists most of their no-charge classes, courses and certifications. Overall Cisco may have close to 500 online classes or courses, but this is a convenient page for programs that don't require a third party proctor (like CCNA, etc.).
JUNIPER
At juniper.net (then "training", then "free training"), one sees not free certs but free training modules for eventually taking the test for paid certs. However, if one finishes a free module with a score of seventy percent or greater, one is awarded a 75% discount on taking the actual test. At current price schedules that's only $50, so almost free. Perhaps charging just a bit holds down the crowds and prevents slow website performance, such as the next organization typically faces...
ORACLE
At academy.oracle.com one can establish not a "member" account (unless you're an institution) but a "student" or student hub account for free. Depending upon the product family there may be dozens or more free courses of instruction. Beware of attempts to get access to a test or even the site on nights or weekends. Early in the morning would be best, since "free" is so popular.
OPSWAT
This is a provider of cybersecurity protection products that claims as clients 5 of the 10 largest US banks and 98% of all commercial and research nuclear power plants in the US. They have three levels of certification. There are the free one or two certs, then a $50 level, then a $1000 level. The two lower levels are best practices exercises of general applicability. The high priced level is for their specific products which are within the MetaDefender suite.
GOOGLE
Classes or instruction videos on these many certs can be seen on YouTube but rather than search there, it might be more profitable to use a list at reliablesoft.net. Search on "Best Google Certification Courses in 2024 (Free and Paid)". Although there's an emphasis on digital marketing (obviously for this company), many courses are available for general use of Google products and for general cyber security relevance.
AMAZON WEB SERVICES
A search (from anywhere) on the article "Make the most of AWS Training and Certification free offerings" should lead you to an Amazon page with links for many hundreds of tests and courses. Within the Amazon site also try searching for "AWS Training and Certification". AI, cloud, security and data analytics are well represented.
AZURE
Other than trying the Microsoft site or YouTube or a low-cost provider like Udemy, one can get search hits on pages like Class Central, listing over 1000 courses for capabilities and tools of this AWS competitor. And don't forget related issues such as Windows Server courses if you're on that side of the business. Try pasting this link: https://www.classcentral.com/subject/microsoft-azure?free=true
CISCO SYTEMS, INC
The site skillsforall.com is one area where Cisco lists most of their no-charge classes, courses and certifications. Overall Cisco may have close to 500 online classes or courses, but this is a convenient page for programs that don't require a third party proctor (like CCNA, etc.).
JUNIPER
At juniper.net (then "training", then "free training"), one sees not free certs but free training modules for eventually taking the test for paid certs. However, if one finishes a free module with a score of seventy percent or greater, one is awarded a 75% discount on taking the actual test. At current price schedules that's only $50, so almost free. Perhaps charging just a bit holds down the crowds and prevents slow website performance, such as the next organization typically faces...
ORACLE
At academy.oracle.com one can establish not a "member" account (unless you're an institution) but a "student" or student hub account for free. Depending upon the product family there may be dozens or more free courses of instruction. Beware of attempts to get access to a test or even the site on nights or weekends. Early in the morning would be best, since "free" is so popular.
OPSWAT
This is a provider of cybersecurity protection products that claims as clients 5 of the 10 largest US banks and 98% of all commercial and research nuclear power plants in the US. They have three levels of certification. There are the free one or two certs, then a $50 level, then a $1000 level. The two lower levels are best practices exercises of general applicability. The high priced level is for their specific products which are within the MetaDefender suite.
Classes or instruction videos on these many certs can be seen on YouTube but rather than search there, it might be more profitable to use a list at reliablesoft.net. Search on "Best Google Certification Courses in 2024 (Free and Paid)". Although there's an emphasis on digital marketing (obviously for this company), many courses are available for general use of Google products and for general cyber security relevance.
AMAZON WEB SERVICES
A search (from anywhere) on the article "Make the most of AWS Training and Certification free offerings" should lead you to an Amazon page with links for many hundreds of tests and courses. Within the Amazon site also try searching for "AWS Training and Certification". AI, cloud, security and data analytics are well represented.
AZURE
Other than trying the Microsoft site or YouTube or a low-cost provider like Udemy, one can get search hits on pages like Class Central, listing over 1000 courses for capabilities and tools of this AWS competitor. And don't forget related issues such as Windows Server courses if you're on that side of the business. Try pasting this link: https://www.classcentral.com/subject/microsoft-azure?free=true
Monday, February 26, 2024
Still Good To Consider
I've been concerned with tech issues for some years now and with all the new developments, I'm again surprised at what hasn't changed and what problems are STILL with us after so long. I just pulled a Sun workstation out of the storage building to see if the clock battery cradle has rusted away, but over on the desk is this month's cell phone. Which I trust about as far as I can throw it. And in all the time between those two devices, I sometimes think that almost nothing has improved.
As a little test, I'll rip off my post of about August of 2022. I listed eleven things I'd listed before, and will no doubt list again. Do these sound familiar?
1. The network might not be secure.
Network maintenance and patching is a round-the-clock job and the safety level of your electronic environment may fluctuate between maintenance periods.
2. It might not be good to have only one copy of that file.
Any backup idea is better than no backup idea.
3. It might not be good to get sued.
Certain kinds of phone or computer use can create copyright problems, police issues, work misinterpretations or even more spam than other channels. Limiting use or having multiple phones or laptops for different purposes (personal VS work) could mitigate risk.
4. It will not be good to lose your laptop or phone.
Do you depend on apps to do things you haven't documented or set up in some other way? How would you get by with no phone, or during a period of switching devices?
5. Things break.
Beer spilled in keyboard? Phone dropped down porta-potty? SD card had a really acidic soft drink spilled on it? Device run over by car? Memory nonfunctional due to cracking? Backup or duplicate plans are in order.
6. Settings break.
Reinstalling a browser or app can cause "forgetting" of settings needed for the thing to work. Even writing settings down on paper is better than nothing.
7. Don't forget how good desktops and laptops can be at certain things.
The most insecure thing about a phone is that it gets to the 'net through a phone company that sells your information and may not make security a priority. The "older" ways may have more tools you know or tools that work better.
8. Earphones or headphones can be distracting and even dangerous.
You need to pay attention to traffic, possible muggers and even other pedestrians when on the sidewalk.
9. Touch or proximity radiation from cell phones can be an issue.
Guys: the regular pocket? Girls: phones in the cleavage? Repeated storage of a phone in skin contact or close might cause radar-like burns over long periods of time. Consider a holster or some sort of shielding.
10. It's not good to improperly dispose of cell phones or other data-carrying objects.
I've been finding old user files on replacement or refurbished drives for almost 20 years. They were supposedly wiped clean. Nope.
11. It might be good to turn things off sometimes.
The OFF switch! There it is. In an always-on, always-connected world, disconnection or power-down situations (where practical) can head off many problems, and possibly stretch battery life.
As a little test, I'll rip off my post of about August of 2022. I listed eleven things I'd listed before, and will no doubt list again. Do these sound familiar?
1. The network might not be secure.
Network maintenance and patching is a round-the-clock job and the safety level of your electronic environment may fluctuate between maintenance periods.
2. It might not be good to have only one copy of that file.
Any backup idea is better than no backup idea.
3. It might not be good to get sued.
Certain kinds of phone or computer use can create copyright problems, police issues, work misinterpretations or even more spam than other channels. Limiting use or having multiple phones or laptops for different purposes (personal VS work) could mitigate risk.
4. It will not be good to lose your laptop or phone.
Do you depend on apps to do things you haven't documented or set up in some other way? How would you get by with no phone, or during a period of switching devices?
5. Things break.
Beer spilled in keyboard? Phone dropped down porta-potty? SD card had a really acidic soft drink spilled on it? Device run over by car? Memory nonfunctional due to cracking? Backup or duplicate plans are in order.
6. Settings break.
Reinstalling a browser or app can cause "forgetting" of settings needed for the thing to work. Even writing settings down on paper is better than nothing.
7. Don't forget how good desktops and laptops can be at certain things.
The most insecure thing about a phone is that it gets to the 'net through a phone company that sells your information and may not make security a priority. The "older" ways may have more tools you know or tools that work better.
8. Earphones or headphones can be distracting and even dangerous.
You need to pay attention to traffic, possible muggers and even other pedestrians when on the sidewalk.
9. Touch or proximity radiation from cell phones can be an issue.
Guys: the regular pocket? Girls: phones in the cleavage? Repeated storage of a phone in skin contact or close might cause radar-like burns over long periods of time. Consider a holster or some sort of shielding.
10. It's not good to improperly dispose of cell phones or other data-carrying objects.
I've been finding old user files on replacement or refurbished drives for almost 20 years. They were supposedly wiped clean. Nope.
11. It might be good to turn things off sometimes.
The OFF switch! There it is. In an always-on, always-connected world, disconnection or power-down situations (where practical) can head off many problems, and possibly stretch battery life.
Sunday, October 15, 2023
Since Another War Started...
... I might as well make this a tech issue, as I'm wont to do on this page anyway. Not to callously ignore other aspects of the current Levant worries, but the situation brings up many questions you KNEW I'd have:
A) Since it's possible for country X to build dossiers of the soldiers/police/politicians/citizens of country Y in order to try to interfere with (at least) their gizmos in time of war, why don't we see more remote shutdown/wipe/corruption/redirection or whatever of opponent devices? I think we have indeed seen DDOS's but I was expecting more.
B) And if country X is so much smarter than country Y, why not take over the stupid COTS (Commercial Off The Shelf) crap they're using in order to redirect missiles, smart bombs and such back toward the shooter?
C) Is it possible to use an opponent's wireless telemetry emissions in order to locate and shoot at that enemy instantly (in real time)?
D) If not the above, why not get into enemy cell towers or services in order to track from that point? It may not be as good as the signal coming from General XYZ's tablet but it's better than nothing.
E) Might be good to track (or invest in) portable Faraday cage stuff, if there's a big increase in field confiscation of enemy cell phones and such. Or just use aluminum foil or snack bags.
F) And since there's been an apparently major intelligence failure somewhere, perhaps at least one or two groups have rediscovered dead drops, word-of-mouth and other such non-network-based methods of communication. I've always said there's still a place for HUMINT (human intelligence) but no one seems to be listening.
A) Since it's possible for country X to build dossiers of the soldiers/police/politicians/citizens of country Y in order to try to interfere with (at least) their gizmos in time of war, why don't we see more remote shutdown/wipe/corruption/redirection or whatever of opponent devices? I think we have indeed seen DDOS's but I was expecting more.
B) And if country X is so much smarter than country Y, why not take over the stupid COTS (Commercial Off The Shelf) crap they're using in order to redirect missiles, smart bombs and such back toward the shooter?
C) Is it possible to use an opponent's wireless telemetry emissions in order to locate and shoot at that enemy instantly (in real time)?
D) If not the above, why not get into enemy cell towers or services in order to track from that point? It may not be as good as the signal coming from General XYZ's tablet but it's better than nothing.
E) Might be good to track (or invest in) portable Faraday cage stuff, if there's a big increase in field confiscation of enemy cell phones and such. Or just use aluminum foil or snack bags.
F) And since there's been an apparently major intelligence failure somewhere, perhaps at least one or two groups have rediscovered dead drops, word-of-mouth and other such non-network-based methods of communication. I've always said there's still a place for HUMINT (human intelligence) but no one seems to be listening.
Tuesday, September 12, 2023
Win11 Experiences... and Possibilities
I bought a refurbished 3-year-old game computer with an option to upgrade its Win10 to Win11 Pro, so as to be able to claim familiarity with this latest release for professional reasons. Now running 11 Pro, I'm releived to have experienced little trouble in the way of being forced to establish a Microsoft account before OS activation could occur. I got to the point of being asked "Don't have a Microsoft account? Create one!". Making that choice experimentally, what happened when clicking "create one" was not the state of being dropped into an account establishment form, but an end of the current procedure. It sent me out of the installer completely and allowed normal activity. I then set up a local user with no problem, got updates, etc. Surprise.
I'm annoyed that the apparently arbitrary requirement of Win11 to run on processors only 3 or 4 years old or less requires many to buy new (or new-to-me refurb in my case) computers. There, however, is an opportunity here. With so many boxes abandoned by 11 that may have 2 or 3 Ghz processors and 8, 16 or 32 gigs of RAM expansion capability, what to do with them? This is the time for Linux-on-the-desktop advocates to get to work. Linux is free and the boxes will just be sitting around. Time to get creative, America - or World.
The kinks have been worked out of the Ubuntu's, mostly. There's MX Linux if you have the need for speed. And many gaming situations have embraced Linux for years.
The shortsightedness of the Win11 situation is the best case for DT Linux I've ever seen, and I remember UUCP over 300 baud modems. Which is still possible to do, I'll have you know, you young whippersnappers.
I'm annoyed that the apparently arbitrary requirement of Win11 to run on processors only 3 or 4 years old or less requires many to buy new (or new-to-me refurb in my case) computers. There, however, is an opportunity here. With so many boxes abandoned by 11 that may have 2 or 3 Ghz processors and 8, 16 or 32 gigs of RAM expansion capability, what to do with them? This is the time for Linux-on-the-desktop advocates to get to work. Linux is free and the boxes will just be sitting around. Time to get creative, America - or World.
The kinks have been worked out of the Ubuntu's, mostly. There's MX Linux if you have the need for speed. And many gaming situations have embraced Linux for years.
The shortsightedness of the Win11 situation is the best case for DT Linux I've ever seen, and I remember UUCP over 300 baud modems. Which is still possible to do, I'll have you know, you young whippersnappers.
Subscribe to:
Posts (Atom)