Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Warning: Do Not use my mirrors/services until I have reviewed the situation”

article.gmane.org

Post reply on HN
Print view View original

61–70 of 167 posts

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#61

Post by ChuckMcM »

drcomputer wrote: post #25
ChuckMcM wrote: post #10

Interesting. It is entirely possible it is survivor bias on my part but I get the suspicion that a global sort of 'cyberwar' that has been rumbling along for years is heating up rapidly. I've seen a 10x increase in various scripted attacks being attempted (patch early and often folks!) and a number of APT level compromises of systems either staging malware or deploying it (see the latest bulletin on the Afghan govern…

> It is entirely possible it is survivor bias on my part but I get the suspicion that a global sort of 'cyberwar' that has been rumbling along for years is heating up rapidly. It might have been a freudian slip or some kind of intuition, but when I was describing my life plans to my family, I said something along the lines of "I don't want to manage people, I want to stay on the front lines with the code." Except I d…

It is a difficult place to operate from. One of the things that depressed me about robotics for a long time was all the investment in robots that could kill other people.

The logical conclusion though, is you can either own that problem and spend your efforts on developing and making available countermeasures to code that can kill, or you can let go of the problem. In a similar way when you have kids you want the best for them, but at some point you have to let them be the individuals they will be, for good or ill.

Letting go of that which you don't have influence over is, for me, the hardest part of being an adult.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#62

Post by mmaunder »

throwaway2048 wrote: post #54
bashinator wrote: post #29

Earlier quoted context omitted.

If the USB device from the article is doing anything along the lines of BadUSB or EFI compromise, then re-imaging your server won't accomplish much. https://trmm.net/EFI

it is pretty likely the USB device is this http://www.cru-inc.com/products/wiebetech/mouse_jiggler/ to prevent the computer going to sleep while this is utilized http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/ These are pretty standard plays in seizing computers these days. One should note that the grsec linux patchset has functionality to not load drivers for any plugged usb devices, as well as log when…

Might be an interesting strategy to only allow one USB port to be used and if any other port is activated the machine self-wipes. Dell servers have an internal port along with the front and back externals.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#64

Post by SCHiM »

drcomputer wrote: post #55
SCHiM wrote: post #47

Earlier quoted context omitted.

I don't think that the scenario you're sketching here is far fetched at all. Code re-use and recycling inside technical companies is very common. If any code you wrote there turned out to be great/good at something you'd never know where it might end up. Perhaps in the processor of some killer robot in the future. I wonder where the code that is running inside the drones today comes from. Some one who never meant to…

I've had job offers for programming drones. I was involved with computer security for a while, and I still have a strong interest in every computational and mathematical aspect of it. I have friends that work on those things. I like those friends. I write code. I write math. We all think. We all share abstract models, different ways of thinking. It's not just code that gets turned into code. It's thought, and everyth…

I'd draw the line at actually making the code, or sharing real theory with someone else.

I don't think that it's fair to condemn oneself because his/her ideas could potentially end-up sparking an idea about killer drones in someone-elses mind. In the end we're all very much alike, and it doesn't take much to transfer a few missing links if you know and they don't.

In the end the same laws of nature rule in all our heads, and while it seems like each and every one of us are our own compartmentalized observers, it's not until you think a good long while about the principle of locality(and most of the other fundamental laws) that you understand that it's the other way around.

Thinking this way for me is peaceful. I can't believe in god or another entity but to follow this chain of thought always leads me to consider that I'm part of something greater and more important than one single life can ever hope to be. I guess these days I see humanity more as some sort of super organism . Just as I emerge from individual cells so does humanity emerge from all the humans inside of it. I just try to do my part inside the greater of humanity, and I leave it at that.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#65

Post by cesarb »

throwaway2048 wrote: post #54
bashinator wrote: post #29

Earlier quoted context omitted.

If the USB device from the article is doing anything along the lines of BadUSB or EFI compromise, then re-imaging your server won't accomplish much. https://trmm.net/EFI

it is pretty likely the USB device is this http://www.cru-inc.com/products/wiebetech/mouse_jiggler/ to prevent the computer going to sleep while this is utilized http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/ These are pretty standard plays in seizing computers these days. One should note that the grsec linux patchset has functionality to not load drivers for any plugged usb devices, as well as log when…

The computer in question is a server.

If the server were configured to sleep unless the mouse is jiggled, it would already be asleep. Thus, using a "mouse jiggler" or similar is pointless, and risks detection.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#66

Post by nsajko »

throwaway2048 wrote: post #54
bashinator wrote: post #29

Earlier quoted context omitted.

If the USB device from the article is doing anything along the lines of BadUSB or EFI compromise, then re-imaging your server won't accomplish much. https://trmm.net/EFI

it is pretty likely the USB device is this http://www.cru-inc.com/products/wiebetech/mouse_jiggler/ to prevent the computer going to sleep while this is utilized http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/ These are pretty standard plays in seizing computers these days. One should note that the grsec linux patchset has functionality to not load drivers for any plugged usb devices, as well as log when…

About the jiggler: would the hid driver even be loaded on a server?

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#67

Post by sauere »

mmaunder wrote: post #62
throwaway2048 wrote: post #54

Earlier quoted context omitted.

it is pretty likely the USB device is this http://www.cru-inc.com/products/wiebetech/mouse_jiggler/ to prevent the computer going to sleep while this is utilized http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/ These are pretty standard plays in seizing computers these days. One should note that the grsec linux patchset has functionality to not load drivers for any plugged usb devices, as well as log when…

Might be an interesting strategy to only allow one USB port to be used and if any other port is activated the machine self-wipes. Dell servers have an internal port along with the front and back externals.

Or use USB-ID white/blacklists.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#68

Post by tinco »

Havoc wrote: post #45
SchizoDuckie wrote: post #37

Earlier quoted context omitted.

WTF?! Since when do we backdoor hardware in The Netherlands without informing the owner?

I'm sure even the Netherlands has some kind of mechanism in place to allow this if a sufficiently powerful court order is in place.

Feel free to drop the 'even' in that sentence. Just say the magic words 'child pornography' and the judge will go and install that bug himself. Tor has a very bad reputation in The Netherlands, I think just saying it's a Tor node might be enough reason for a judge to sign off on an eaves-dropping warrant.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#69

Post by anigbrowl »

drcomputer wrote: post #55
SCHiM wrote: post #47

Earlier quoted context omitted.

I don't think that the scenario you're sketching here is far fetched at all. Code re-use and recycling inside technical companies is very common. If any code you wrote there turned out to be great/good at something you'd never know where it might end up. Perhaps in the processor of some killer robot in the future. I wonder where the code that is running inside the drones today comes from. Some one who never meant to…

I've had job offers for programming drones. I was involved with computer security for a while, and I still have a strong interest in every computational and mathematical aspect of it. I have friends that work on those things. I like those friends. I write code. I write math. We all think. We all share abstract models, different ways of thinking. It's not just code that gets turned into code. It's thought, and everyth…

Have I abstracted this problem too much, too far away from reality?

I'll say. You could throw it in and go work as a coal-miner, but then you'd have to worry about the coal you mined being used to smelt steel that goes on to be manufactured as bomb casings. And so on. Certainly you shouldn't work on anything that offends you conscience, but the mere fact that something can be repurposed for warfare doesn't create moral responsibility.

This isn't to say that worrying about war or your personal purpose is misplaced GH Hardy opined that ballistics was 'repulsive' both because of the moral purpose and the triviality of the mathematics involved, and there are more musings on the ethics of that sub-branch of math here: http://www.augustana.ualberta.ca/~hackw/mp480/exhibit/ballis...

But as long as you're knowingly working on some sort of combat system, it's folly to beat yourself up over the limitations of foreseeability and the vague possibility that something you craft might turn out to have military utility which you din't intend at the time you conceived it. Instead, look for ways to provide utility in other areas.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#70

Post by drcomputer »

ChuckMcM wrote: post #61
drcomputer wrote: post #25

Earlier quoted context omitted.

> It is entirely possible it is survivor bias on my part but I get the suspicion that a global sort of 'cyberwar' that has been rumbling along for years is heating up rapidly. It might have been a freudian slip or some kind of intuition, but when I was describing my life plans to my family, I said something along the lines of "I don't want to manage people, I want to stay on the front lines with the code." Except I d…

It is a difficult place to operate from. One of the things that depressed me about robotics for a long time was all the investment in robots that could kill other people. The logical conclusion though, is you can either own that problem and spend your efforts on developing and making available countermeasures to code that can kill, or you can let go of the problem. In a similar way when you have kids you want the bes…

> 8.1

> A novice asked the Master: "I perceive that one computer company is much larger than all others. It towers above its competition like a giant among dwarfs. Any one of its divisions could comprise an entire business. Why is this so?"

> The Master replied, "Why do you ask such foolish questions? That company is large because it is large. If it only made hardware, nobody would buy it. If it only made software, nobody would use it. If it only maintained systems, people would treat it like a servant. But because it combines all of these things, people think it one of the gods! By not seeking to strive, it conquers without effort."

http://www.mit.edu/~xela/tao.html

Post reply on HN