Brute Force: Now with less brutality

from here and here

My fingers are resting just a little bit easier knowing that there are now attacks against fingerprint authentication that involve a dictionary of digitized fingerprints. I'd just as soon the vulnerabilities involved not get fixed as that would force attackers back to using less civilized means. 

I suppose it might be more accurate to call it a dictionary attack rather than a brute force attack, but what do I know?

Judge not, lest ye be judged

from here and here

Who would have guessed that god-bothering fanatics would become a significant surveillance threat? I guess it's not enough for their sky-daddy to pass judgement on people, they want in on the action too.

It's not even the church, just a bunch of busybodies with deep pockets trying to force the church's hand.

Back when crypto meant cryptography

from here and here

I don't envy people trying to get their hands on the latest video cards with a global shortage going on. I've even seen seen graphics cards that were designed to be bad at cryptomining in an effort to deter the crypto-bros from snatching them all up

"PCs, not Macs"

from here

Many people really did believe quite earnestly that Macs weren't going to have the malware problems PCs did. One otherwise smart individual even went so far as to perform an ill-conceived game-theory analysis to support that idea. The problem was even when that analysis was performed there already was malware for the Mac, and not just proof of concept malware either. There was financially motivated Mac malware that had been ported over from the PC platform. Now, however, we seem to have a sophisticated piece of Mac malware that has no PC counterpart - it's exclusively for the Mac.

Macs may never see the same volume of malware, but they are just as vulnerable to malware as any other platform, and they've been a target for years.

Modern problems require modern solutions

from here and here (source article)

That study about people giving up their passwords for chocolate wasn't THAT long ago. Have people forgotten already? 

Too bad it didn't stay that way

from here

I know he's gone, and there's a school of thought that says you shouldn't speak ill of the dead, but I've had this idea percolating in my head for a while now and there aren't really going to be any further opportunities to get it out of there.

I won't directly mention the less wholesome association between McAfee and whales - that's a blue waffle that can easily be found with a search engine. Instead I'll just recall that in the distant past, a virus called McWhale contained a message claiming that John McAfee wrote a virus known as Whale.

Maybe they're compensating for something

from here

Eleven zero days is an awful lot of zero days.

And each one is worth an awful lot of money. 

Stuxnet only used 4-5 to compromise nuclear enrichment facilities and set back Iran's nuclear weapons program by years. This group better hope whatever they're doing with 11 is worth more than what they could have gotten by selling them, or they are going to be so pissed.

The hidden costs of innovation

from here

 It's been decades and people still haven't realized the error of allowing web content in the body of the email. Companies are still paying the price, including Apple playing a ton of money for vulnerabilities including at least some that would allow an email worm to spread and did allow researchers to compromise Apple's network.

With innovation there invariably comes new opportunities for exploitation, and while sometimes it may be difficult to see it coming, in this case it was entirely predictable.

The personal touch has personal consequences

from here

The story about the attempted compromise of a Tesla factory is surprising to me because of how much trust the criminals placed in their would-be accomplice. Certainly there are other ways to get this done, even if the old thumb drive in the parking lot trick doesn't work. Allowing himself to be not only seen but to engage on a personal, even friendly basis is what did this crook in. This is why anonymity is so valuable in criminal enterprises.

Money talks, privacy walks

from here

It's not technically wrong for companies to eagerly hand over your data to the government in return for money, but it certainly seems like it should be ethically/morally wrong.

Why not ditch the phone like they do in the movies?

from here

While they're are products that reputedly do block signals from going to or from your phone, a tin foil phone case isn't it. Heck, even the original tin foil hats are thought to serve more as antennas.

What gets me is where did the idea even come from? That's certainly not a technique known to popular media - in the movies and on TV they just throw the phone away.

When all you have is a gun, everything looks like a threat

from here

One of the underlying concepts of the Defund The Police movement is that men (and women) with guns are frequently the wrong tool for the job. This job would have been better handled by a cowboy than by a cop.

Junk Fax: The Next Generation

from here

If it doesn't ask for permission beforehand, why bother notifying afterwards? Never mind how creepy it is for a printer to just start printing on it's own when you're not even in the room.

It's conceivable that this is still a fairly new and unknown phenomenon, but don't count on it staying that way. Printers are now computers that also happen to apply ink to paper. Computers that perform automatic software updates using their WiFi connections. But importantly, computers that don't have real screens so they have to be creative about how they inevitably show you notifications.

If I'd known it was an IoT device, I would have kept looking for something else.

Malware experiences inflation too

from here

I don't know if I should feel sorry of the people who get caught by this malware or not. Seems like a bit of karmic balance being restored, to be honest.

But what if this inflation extends to other things? What's next? Are we going to get fake invoices for the sale of entire stores rather than just items from their inventory? Will a coalition of Nigerian princes start requesting our assistance? Fake HR documents for a country instead of a company?

Hopefully they can quarantine awful shows while they're at it

from here

Virus-scanning all the things is the price of "Smart" technology. All general purpose computers support viruses, and the people making smart devices are putting general purpose computers in them because it's cheaper to put a general purpose computer in a special purpose box than it is to create a special purpose computer. Samsung was just trying to accept the reality of the situation when they told people to scan their sets.

Advances in tin can telephones

from here

So it turns out that sometime in the past, Coca Cola got it in their heads to give out promotional surveillance cans. It seems some folks who like to maintain secrecy had some concerns about that.
[sarcasm]I can't imagine why.[/sarcasm]

Is that a banana in your pocket or are you just happy to shoot me

from here

Well, if someone's going to have the police called on them because they're carrying a banana, at least it happened in Canada where there's a pretty good chance of survival.

Operating System of the Living Dead

from here

Now, I'm not saying they shouldn't have released a patch for XP. If they think XP needs a patch then by all means patch away. All I'm saying is they should pick a position - either the OS is dead or it isn't. Don't pretend you don't support it if you're going to continue releasing patches for it.

Wile E. Coyote would be proud

from here

Sanitizing your inputs is important, even (especially) when you're making a self-driving car.

All trademark and no tradecraft

from here

Governmental spyware vendors keep getting breached (as does everyone else), but nothing quite compares to the spectacular self-own by Wolf Intelligence. A shame their customers victims were also exposed in the process.