11–20 of 44 posts
Maybe public/private key pairs aren't as secure as we've been lead to believe.
This is interesting because it's one of those cases where insecurity can turn out to be a good thing - had those cybercriminals been more careful with their systems and made them more secure, this may have never been possible; but then again, the malware might not have been able to do this in the first place if the users' systems were more secure. How that could be accomplished is also worth considering - there is a…
> it's one of those cases where insecurity can turn out to be a good thing Well, it's usually a good thing when the bad guys make a mistake, isn't it? "Oh, I wanted to blow up this building, but I set my timer to the wrong time zone." Oops, now the police has an extra hour to evacuate the building and dismantle your bomb. What matters is: Good for whom? Obviously, insecure tools are not good for the person who relies…
The interesting case is: if I am the sole legitimate user of the device, should my device resist my attempts to run cat_pictures_infected_with_cryptolocker.jpg.exe?
Of course, the conspiracy theorist might say that it's a bit too convenient to suppose the hitherto extremely clever criminals helpfully and stupidly copied their private keys across to computers controlled by 'the feds'. A bit like those supposedly 'random' police stopping of vehicles which turn out to be full of drugs or explosives. Maybe public/private key pairs aren't as secure as we've been lead to believe.
Earlier quoted context omitted.
> it's one of those cases where insecurity can turn out to be a good thing Well, it's usually a good thing when the bad guys make a mistake, isn't it? "Oh, I wanted to blow up this building, but I set my timer to the wrong time zone." Oops, now the police has an extra hour to evacuate the building and dismantle your bomb. What matters is: Good for whom? Obviously, insecure tools are not good for the person who relies…
You're listing the clear, black-and-white cases. The interesting case is: if I am the sole legitimate user of the device, should my device resist my attempts to run cat_pictures_infected_with_cryptolocker.jpg.exe?
On the flip side, if your device resists your attempts to run cat_pictures_infected_with_cryptolocker.jpg.exe, it is clear that somebody else has some degree of control over the behavior of your device, and this somebody does not consider you to be the sole legitimate controller of your device.
Who is this somebody, and what right does he/she/they have to retain partial control of your property? That sounds like a more interesting question to me. Because unless you're like RMS and only use free software on open-source hardware, you're never the sole legitimate controller of any device these days.
Of course, the conspiracy theorist might say that it's a bit too convenient to suppose the hitherto extremely clever criminals helpfully and stupidly copied their private keys across to computers controlled by 'the feds'. A bit like those supposedly 'random' police stopping of vehicles which turn out to be full of drugs or explosives. Maybe public/private key pairs aren't as secure as we've been lead to believe.
I know they are doing this as a community service... because, I assume they feel it is their honor and duty to do so... but why the hell do these guys NOT have at least a donate link/button on their site!!!!! This is crazy. I know they are going to get awesome press which would have normally cost thousands but it never hurts to throw up a link and see how much your appreciated.
I don't think many people actually use them, especially if the traffic is mainly curious readers sent there by mainstream press.
Of course, the conspiracy theorist might say that it's a bit too convenient to suppose the hitherto extremely clever criminals helpfully and stupidly copied their private keys across to computers controlled by 'the feds'. A bit like those supposedly 'random' police stopping of vehicles which turn out to be full of drugs or explosives. Maybe public/private key pairs aren't as secure as we've been lead to believe.
Or maybe they got their hands on the keys some other way they're not willing to disclose.
Earlier quoted context omitted.
You're listing the clear, black-and-white cases. The interesting case is: if I am the sole legitimate user of the device, should my device resist my attempts to run cat_pictures_infected_with_cryptolocker.jpg.exe?
> if I am the sole legitimate user of the device... On the flip side, if your device resists your attempts to run cat_pictures_infected_with_cryptolocker.jpg.exe, it is clear that somebody else has some degree of control over the behavior of your device, and this somebody does not consider you to be the sole legitimate controller of your device. Who is this somebody, and what right does he/she/they have to retain par…