Category: Security Theater

https://skyclerk.com/blog/if-you-run-a-small-business-park-in-the-back-of-the-parking-lot

“Have you ever walked into a bar and the bartender asks for and holds your credit card while opening a tab? This is a very negative and I submit it is often poor business practice. In this example, one of the earliest interactions with a customer is to signal a lack of trust. The bartender is suggesting the customer will leave without paying. It would be one thing if the bar was making the customer’s life easier so when they were done they could simply walk out effortlessly paying the bill but that is not the typical case. I understand some bars have issues with people “dining and dashing”, so a bar owner has to weigh the pros and cons – but few realize there are cons that should be deeply considered.“

Reality update: Normalization of Deviance – Flight Safety Foundation … :

“Noncompliance with standard operating procedures (SOPs) — especially tolerance of unstabilized approaches — is a serious impediment to further reduction of accident risk, according to United Airlines safety leaders.

During his April presentation to the World Aviation Training Conference and Tradeshow (WATS 2015) in Orlando, Florida, U.S., Chris Sharber, a first officer and flight simulator instructor–Boeing 777 fleet, at the United Airlines Training Center in Denver, described the issue as invisible and insidious.

United Airlines safety leaders echoed this theme in a keynote address and in presentations about analytical techniques and related insights from the company’s safety management system (SMS), including analysis of flight crews’ voluntary safety reports.

“We have somewhere between 11,000 and 12,000 pilots. Our new-hire department will bring another 1,000 pilots on board in the next 12 to 15 months,” Sharber said. “One of the challenges that you face with that many pilots, of course, is SOP compliance. How do you influence a group of 11,000 individuals to focus on SOP compliance, to maintain the tight standardization that’s required to maintain safe operations in a global airline?””

(…)

“Intentional Noncompliance Flight crews engage in intentional noncompliance — and sometimes self-justify this behavior — out of a variety of motivations. “Maybe it’s a bad SOP. Maybe there are competing priorities. Maybe it just doesn’t work. It’s not functional. … It’s not that important. It doesn’t really matter. I might [take a] shortcut just because I’m trying to save time,” he said. “[Or pilots rationalize], ‘I just don’t like it. I like the way we did it before. I’ve got a better way of doing things. I think this is a bad idea. I’m just not going to do it.” These occur with a perceived lack of consequences. The LOSA Collaborative’s latest data analysis suggests that acts of intentional noncompliance occur on between 40 to 60 percent of flights, or about half, on average.”

Reality update: Normalization of Deviance – Flight Safety Foundation … :

“

Reality update: Hausdurchsuchung bei Tarnkappe.info wegen angeblichem Drogenhandel … :

“Heute um ca. 14 Uhr haben insgesamt fünf Mitarbeiter der Bergisch Gladbacher Polizei eine Hausdurchsuchung bei Tarnkappe.info durchgeführt. Beschlagnahmt wurden alle vier technischen Geräte des Betreibers Lars Sobiraj. Der Durchsuchungsbeschluss vom AG Köln hat man damit begründet, dass in unserem Forum angeblich Drogen vermittelt wurden. Vom Verdächtigen wurden sogar die Fingerabdrücke genommen und Fotos erstellt. Ein anonymer Hinweisgeber hat sich an die Polizei in Bergisch Gladbach gewendet. Er will angeblich mittels Screenshots bewiesen haben, dass wir bei uns im Forum Drogen vermittelt haben. Somit hätte sich der Betreiber wegen des unerlaubten Handels mit BTM-pflichtigen Stoffen strafbar gemacht.”

[…]

“Kommentar von Lars Sobiraj:

Die Vorwürfe sind einfach hanebüchen. Ich bin verwundert, dass der zuständige Richter am AG Köln den Beschluss unterzeichnet, bzw. die Staatsanwältin überhaupt eine Durchsuchung angeordnet hat. Beim persönlichen Gespräch sagte mir der leitende Ermittler, er habe bei der Durchsicht des Forums von Tarnkappe.info überhaupt keine Anhaltspunkte für ein illegales Verhalten in irgendeiner Art finden können. Auch hätte ich bzw. meine Ehefrau bei der Durchsuchung nicht den Eindruck gemacht, dass wir hier etwas Illegales tun. Zudem sagte der KOK, er habe gesehen, dass ich alle Foren-Nutzer dazu aufgerufen habe, sich an die in Deutschland gültige Rechtslage zu halten.“

CVE-2019-12643: Critical Authentication Bypass Vulnerability in REST API Container for Cisco IOS XE – Blog | Tenable®

Cisco releases ten advisories, including one critical advisory impacting Cisco IOS XE devices with the REST API Container enabled.

Reality update: Fefes Blog … :

Selten so auf die Schenkel geklopft, einfach und klar – besser kann man es nicht erklärten, warum BC und BTC Hypes sind. Egal, sie werden weiter machen. 🙂 

Reality update: Warning! is rest-client 1.6.13 hijacked? · Issue #713 · rest-client/rest-client · GitHub … :
Wow. I guess I’d call that a #rubytuesday

“JanDintel commented Aug 20, 2019: 

In case people need to write a detailed security report at their company. This might help you.

Security threat consisted out of the following:

* It sent the URL of the infected host to the attacker.

* It sent the environment variables of the infected host to the attacker. Depending on your set-up this can include credentials of services that you use e.g. database, payment service provider.

* It allowed to eval Ruby code on the infected host. Attacker needed to send a signed (using the attacker’s own key) cookie with the Ruby code to run.

* It overloaded the #authenticate method on the Identity class. Every time the method gets called it will send the email/password to the attacker. However I’m unsure which libraries use the Identity class though, maybe someone else knows?”

(Thanks to Fefe, once again!)

Reality update: security-bulletins/2019-002.md at master · Netflix/security-bulletins · GitHub … :

“Workarounds and Fixes In most cases, an immediate workaround is to disable HTTP/2 support. However, this may cause performance degradation, and it might not be possible in all cases. To obtain software fixes, please contact your software vendor. More information can also be found in the CERT/CC vulnerability note.“

Reality update: Normalization of Deviance – Flight Safety Foundation … :

““The LOSA Collaborative and an Airbus study show that the industry’s average stabilized approach rate is about 96 to 97 percent. … If you are at the top of the industry in this regard, your unstabilized approach rate may be as low as about 1.5 percent, which is even more remarkable. … The studies show that somewhere between 1.5 and 3 percent of [crews flying] unstabilized approaches do the right thing and execute a go-around.”“

#sigh. Use fingerprints as passwords, they said, you have ten of them. And you leave them everywhere. And so many of the sheeps did, because they trusted.  

Major breach found in biometrics system used by banks, UK police and defence firms | Technology | The Guardian

The fingerprints of over 1 million people, as well as facial recognition information, unencrypted usernames and passwords, and personal information of employees, was discovered on a publicly accessible database for a company used by the likes of the UK Metropolitan police, defence contractors and banks.

Radioactive Glass Beads May Tell the Terrible Tale of How the Fukushima Meltdown Unfolded – Scientific American … :

“The beads are “the only direct evidence of the debris remaining inside the reactor. That’s the only clue,””

 “It was initially thought all the radioactive cesium released in the Fukushima plumes was in a water-soluble form, and would disperse more or less evenly throughout the environment. But when aerosol specialist Yasuhito Igarashi, then of the University of Tsukuba, and his colleagues examined an air filter from the Meteorological Research Institute in Tsukuba, 170 kilometers southwest of Fukushima, they noticed the filter contained radioactive hotspots. Using specialized imaging techniques they detected high concentrations of radioactive cesium as well as bits of iron and zinc, packed into particles just a couple of microns in diameter (about the size of the average Escherichia coli bacterium).”

“Although less radioactive cesium fell on Tokyo than closer to the plant, a bigger proportion of the total was packed into the microparticles, the team’s findings suggest. However, publication of the full study describing those findings, initially slated for 2017 in Scientific Reports, was postponed after researchers with the Tokyo Metropolitan Industrial Technology Research Institute (TIRI)—which had provided an air filter sample to one of the study’s authors—objected to the study over the sample’s use by the other co-authors. A 2017 investigation by several institutions in Japan found no evidence of wrongdoing by the co-authors—and “there’s never, in any of the discussion, been concern about our scientific results,” says Ewing, the Stanford nuclear materials expert who is also a study co-author.”

… Honi soit qui mal y pense …

“Researchers say a picture of the unusual beads is coming into focus against a backdrop of the Japanese public’s general nuclear wariness, and the government’s desire to put the Fukushima incident behind it—particularly with Tokyo poised to host the 2020 Olympics. “I think, unfortunately, the reaction to this discovery [of the beads] has been not very welcomed in Japan,” says Rod Ewing, a mineralogist and nuclear materials expert who co-directs the Center for International Security and Cooperation at Stanford University.”

Oh Really? Who would have thought that…? 

Reality update: Apple-Hacker Patrick Wardle: Ein Mac ist leicht zu hacken – SPIEGEL ONLINE … :

“Schon immer störte sich Wardle an “dieser Mentalität, dass Macs sicher sind, geradezu unhackbar”. Apple selbst habe das so dargestellt, und weil es lange Zeit nur wenig Mac-spezifische Malware gab, hätten es die Nutzer geglaubt. Manche tun es seiner Ansicht nach bis heute. Er will mit diesem Mythos aufräumen, denn die Zeiten haben sich geändert.“

 I couldn’t agree more. Fun fact:I can’t find any US or other English news on that? Am I blind? Feel free to tweet or mail them to me. Isn’t it bitter – he says Windows 10 (sic!) is safer than Apple iOS today. Wow. That’s blasphemy. 

Here’s Wardle’s website: Objective-See … : 

“Mac Malware Warning: this page contains malware & adware! By downloading malware from this site, you waive all rights to claim punitive, incidental and consequential damages resulting from mishandling or self-infection.“

Bonus Addon: 

Apple: US-Luftverkehrsbehörde verbietet MacBook Pro in Flugzeugen | ZEIT ONLINE

Aus Angst vor Bränden haben bereits vier weitere Fluggesellschaften Anfang der Woche die Mitnahme bestimmter Macbook-Pro-Modelle verboten. Medienberichten zufolge sollen Fluggesellschaften der TUI Group Airlines, Thomas Cook Airlines, Air Italy und Air Transa derzeit die Mitnahme der Laptops sowohl im Handgepäck als auch im aufgegebenen Gepäck untersagt haben.

Reality update – Tavis Ormandy auf Twitter:

“I’m publishing some research today, a major design flaw in Windows that’s existed for almost *two decades*. I wrote a blog post on the story of the discovery all the way through to exploitation. https://googleprojectzero.blogspot.com/2019/08/down-rabbit-hole.html …“

His Blog is here and very well worth a read, although it’s long and horrifying: Project Zero: Down the Rabbit-Hole… … : 

“The obvious attack is an unprivileged user injecting commands into an Administrator’s console session, or reading passwords as users log in. Even sandboxed AppContainer processes can perform the same attack. Another interesting attack is taking control of the UAC consent dialog, which runs as NT AUTHORITY\SYSTEM. An unprivileged standard user can cause consent.exe to spawn using the “runas” verb with ShellExecute(), then simply become SYSTEM.“

 Bitdefender SWAPGS Attack Mitigations Solution … :

“Bitdefender researchers have identified and demonstrated a new side-channel attack. The attack builds on previous research which led to the Spectre and Meltdown attacks. This newly disclosed attack bypasses all known mitigation mechanisms implemented in response to Spectre and Meltdown. Bitdefender Hypervisor Introspection renders Windows systems impervious to this new attack. The SWAPGS Attack affects newer Intel CPUs that use speculative execution.“

 How can I unlock my Kenwood car stereo? … :

“Finding the Kenwood Security Code

There are backdoor codes for each Kenwood car stereo, based upon the model and the serial numbers.

These backdoor codes are closely held secrets.

Outfits like Car Audio Accessories UK will sell you the code for your radio for £20.“

GitHub confirms it has blocked developers in Iran, Syria and Crimea – TechCrunch

https://techcrunch.com/2019/07/29/github-ban-sanctioned-countries/