Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

“Warning: Do Not use my mirrors/services until I have reviewed the situation”

article.gmane.org

Post reply on HN
Print view View original

101–110 of 167 posts

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#101

Post by HCIdivision17 »

drcomputer wrote: post #44
ay1n wrote: post #31

Earlier quoted context omitted.

I've heard opinions along the lines of "thinking too much" countless of times, at first it was kind of depressing but later I've concluded that if you just like to think and analyze things in your mind (which is not so popular thing to do when you consider general population, sadly), people who voice such (negative, I'd say) comments didn't really think about this deeply. Over-analying can be a serious problem (consi…

Yea, the repetitive analysis usually stems from using the same model of which to analyze the data by. It's insufficient. That helps me turn it off, listen to other people, go about my life, learn new ways of thinking, connecting, interacting, helping, participating, and then I continue to re-evaluate myself, existence, and my place in it. I still can't shake the depression, though. Unless the entire world existed in…

If it helps, I find that analysis helps stave off depression. Having a focus for something to intellectually chew on helps me a lot. So while I've been accused of over-analysis, sometimes it's simply me printing what I had been mulling over while idling; if I ever stopped doing that, I'd drown in my own mind.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#102

Post by ossreality »

sauere wrote: post #67
mmaunder wrote: post #62

Earlier quoted context omitted.

Might be an interesting strategy to only allow one USB port to be used and if any other port is activated the machine self-wipes. Dell servers have an internal port along with the front and back externals.

Or use USB-ID white/blacklists.

so, the very thing that are fakeable and changeable via these hacks.

try agian

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#103

Post by draugadrotten »

Update on twitter: https://twitter.com/CthulhuSec "People have taken my mere suspicions way too seriously. I haven't even mentioned a specific agency and the theories are already flowing."

Update on tor-talk: https://lists.torproject.org/pipermail/tor-talk/2014-Decembe...

In the first original email, he writes "At this moment in time I am under no gagging orders or influence from external parties/agencies. If no update is provided within 48 hours you may draw your own conclusions."

Please may I call your attention that this canary paragraph is missing from the latest tor-talk update. Draw your own conclusions.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#104

Post by Shank »

throwaway2048 wrote: post #54
bashinator wrote: post #29

Earlier quoted context omitted.

If the USB device from the article is doing anything along the lines of BadUSB or EFI compromise, then re-imaging your server won't accomplish much. https://trmm.net/EFI

it is pretty likely the USB device is this http://www.cru-inc.com/products/wiebetech/mouse_jiggler/ to prevent the computer going to sleep while this is utilized http://www.cru-inc.com/products/wiebetech/hotplug_field_kit/ These are pretty standard plays in seizing computers these days. One should note that the grsec linux patchset has functionality to not load drivers for any plugged usb devices, as well as log when…

Pretty sure Jake Appelbaum stated at 30c3 that the Mouse Jiggler will cause the system to lock immediately if plugged into Systemd [0].

[0]: https://www.youtube.com/watch?v=vILAlhwUgIU

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#105

Post by adrianN »

yafujifide wrote: post #78
jerf wrote: post #34

Earlier quoted context omitted.

Oh, the whole cyberwar situation is far from "hopeless". The truth is nobody to speak of has taken it seriously yet. Security is still mostly an afterthought, if that , almost everywhere you look. Even in nominally security-focused contexts. And much of the activity in places that really are security focused are built around an environment in which software must be assumed to basically be constructed out of styrofoam…

I agree about C and C++, but is there a language that exists today that you think would be better for writing security-conscious code? Should a language be invented that is specifically for writing security-conscious code?

Ada is a language that is specifically for writing secure code.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#106

Post by dmix »

draugadrotten wrote: post #103

Update on twitter: https://twitter.com/CthulhuSec "People have taken my mere suspicions way too seriously. I haven't even mentioned a specific agency and the theories are already flowing." Update on tor-talk: https://lists.torproject.org/pipermail/tor-talk/2014-Decembe... In the first original email, he writes "At this moment in time I am under no gagging orders or influence from external parties/agencies. If no upda…

Which latest tor-talk update is missing the canary?

The one you linked to says:

> 7. Again, at this moment in time I am under no gagging orders or unreasonably withholding information under orders.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#107

Post by draugadrotten »

dmix wrote: post #106
draugadrotten wrote: post #103

Update on twitter: https://twitter.com/CthulhuSec "People have taken my mere suspicions way too seriously. I haven't even mentioned a specific agency and the theories are already flowing." Update on tor-talk: https://lists.torproject.org/pipermail/tor-talk/2014-Decembe... In the first original email, he writes "At this moment in time I am under no gagging orders or influence from external parties/agencies. If no upda…

Which latest tor-talk update is missing the canary? The one you linked to says: > 7. Again, at this moment in time I am under no gagging orders or unreasonably withholding information under orders.

The "under no influence" part is missing.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#108

Post by alexivanovs »

ChuckMcM wrote: post #10

Interesting. It is entirely possible it is survivor bias on my part but I get the suspicion that a global sort of 'cyberwar' that has been rumbling along for years is heating up rapidly. I've seen a 10x increase in various scripted attacks being attempted (patch early and often folks!) and a number of APT level compromises of systems either staging malware or deploying it (see the latest bulletin on the Afghan govern…

It has already happened, you just don't know about it, and neither do I. I've had experience in the scene for many years. Though I don't go there these days, I can almost guarantee that the big players have long had their databases downloaded and spread throughout multiple nations.

Your guess is as good as mine...

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#109

Post by junto »

Crito wrote: post #90
Havoc wrote: post #42

Earlier quoted context omitted.

Must admit I'm slightly amused that this is even being considered as a plausible theory. They're busy executing elderly with AK47s...thats very far away from physically cracking open servers in a western data center and inserting USB devices with targeted attack software.

It is not merely the uneducated who can subscribe to extremist ideologies. When the unskilled highschool grad gets off the plane and signs up, they are going to give him a rifle. When the engineer gets off the plane and announces himself as such, there is a chance that he will be put to better use.

Sadly, the fastest route to martyrdom is quite literally by biting a bullet, so no, AK-47's all round. Keyboards don't have quite the same sacrificial qualities.

Re: “Warning: Do Not use my mirrors/services until I have reviewed the situation”

#110

Post by retrogradeorbit »

SCHiM wrote: post #47
drcomputer wrote: post #25

Earlier quoted context omitted.

> It is entirely possible it is survivor bias on my part but I get the suspicion that a global sort of 'cyberwar' that has been rumbling along for years is heating up rapidly. It might have been a freudian slip or some kind of intuition, but when I was describing my life plans to my family, I said something along the lines of "I don't want to manage people, I want to stay on the front lines with the code." Except I d…

I don't think that the scenario you're sketching here is far fetched at all. Code re-use and recycling inside technical companies is very common. If any code you wrote there turned out to be great/good at something you'd never know where it might end up. Perhaps in the processor of some killer robot in the future. I wonder where the code that is running inside the drones today comes from. Some one who never meant to…

> I wonder where the code that is running inside the drones today comes from.

I interviewed a candidate for a job once who wrote code for military drones. He didn't think it was bad that they were used to kill innocent people. In fact, he thought it was awesome. There are a lot of coders who have a low moral bar and will code anything for money. These are the people who write this kind of software.

Post reply on HN