Is VPOTUS Bluetooth-phobic or sensible? The answer's pretty clear
- Reference: 1639414865
- News link: https://www.theregister.co.uk/2021/12/13/in_brief_security/
- Source link:
"Should someone who travels with the nuclear football be spending time untangling her headphone wires? The American people deserve answers," the wags at Politico [1]noted .
Turns out being a political commentator doesn't make you smart on security. As John Scott-Railton, senior researcher at Citizen Lab (an org that knows a thing or six about security), [2]pointed out , you'd rather have a vice president who recognizes that security is paramount – and America's own NSA advises against the use of Bluetooth.
[3]
Using Bluetooth isn't a threat for most of us – although it has always been vulnerable and is [4]still used as an attack vector. But when you're the veep of a nuclear power there's a responsibility to minimize your threat profile.
[5]
[6]
In [7]an interview on Sunday, Harris called the storm in a teacup "ridiculous".
Russian malware-masker gets four years in prison
Online criminals managed to sneak hundreds of thousands of malware deliveries past commercial security using the help of Russian national Oleg Koshkin, 41, who was jailed by US authorities for his crimes.
Koshkin ran the crypt4u.com and fud.bz malware masking service and used it to infect unwitting participants and make them part of the Kelihos botnet. According to documents unsealed this week he was found guilty of one count of conspiracy to commit computer fraud and abuse and one count of computer fraud and abuse by a federal jury, and sentenced to 48 months in prison.
"For years, Koshkin and his co-conspirators worked to evade our most basic cyber defenses in order to spread malware on a truly global scale," [8]said special agent in charge David Sundberg of the FBI's New Haven Office.
[9]
"While our work to bring Koshin to justice comes to a close, the FBI will continue to tirelessly defend our country from the ever-evolving cyber threats posed by criminals, terrorists and hostile nation-states."
Internet sextortionist jailed for 32 years
British man Abdul Hasib Elahi, 26, has been sentenced to over 30 years in prison after extorting over nearly 2,000 people for sexual material and selling it online.
The Birmingham, England resident inveigled his way onto social media accounts posing as a sugar daddy or hacker and convinced victims to perform sexual acts on camera – sometimes involving other people. He then made over £25,000 selling "box sets" of the material, often using Telegram.
“Abdul Elahi is a depraved sadist who got sexual gratification through power and control over his victims whom he often goaded to the point of wanting to kill themselves. He has wrecked lives and families," [10]said Tony Cook, The UK's National Crime Agency's Head of CSA operations.
"NCA investigators were horrified by what Elahi had done and stunned by the industrial scale of his worldwide offending."
[11]
This hack has had [12]some experience in the area and the advice remains the same: don't play along, alert the police and service providers, and tough it out. The alternative is much worse.
Martian bugs are real!
The Perseverance rover currently trundling across the Martian regolith is looking for signs of life, but we found out this week that it also contains at least one bug.
[13]Irish Health Service ransomware attack happened after one staffer opened malware-ridden email
[14]Ransomwared payroll provider leaks data on 38,000 Australian government workers
[15]Oz Feds reveal distribution model behind backdoored 'An0m' chat app spread by crims
[16]Log4j RCE: Emergency patch issued to plug critical auth-free code execution hole in widely used logging utility
Thankfully it was not the biological kind – the mission was carefully sterilized before launch to avoid contamination – but of a software nature. As security watchers will have noted, the [17]critical Log4j flaw has had IT admins patching since its discovery, but – as the Apache Foundation gloated earlier in the year – it affects humankind's [18]first flying machine on another planet.
Did you know that Ingenuity, the Mars 2020 Helicopter mission, is powered by Apache Log4j? [19]https://t.co/gV0uyE1ylk [20]#Apache [21]#OpenSource [22]#innovation [23]#community [24]#logging [25]#services [26]pic.twitter.com/aFX9JdquP1 — Apache - The ASF (@TheASF) [27]June 4, 2021
Thankfully the risk of hacking is infinitesimal, and NASA's unlikely to need to do any remote patching – as freaking epic as that would be. ®
Get our [28]Tech Resources
[1] https://www.politico.com/newsletters/west-wing-playbook/2021/12/06/kamala-harris-is-bluetooth-phobic-495343
[2] https://twitter.com/jsrailton/status/1468034109134053382
[3] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=2&c=2YbfQoOUA72V-Uozqdy8D0wAAAIQ&t=ct%3Dns%26unitnum%3D2%26raptor%3Dcondor%26pos%3Dtop%26test%3D0
[4] https://www.theregister.com/2020/09/14/smart_padlock_really_isnt/
[5] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YbfQoOUA72V-Uozqdy8D0wAAAIQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[6] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YbfQoOUA72V-Uozqdy8D0wAAAIQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[7] https://www.sfchronicle.com/politics/article/One-year-in-Kamala-Harris-says-she-won-t-be-16692177.php
[8] https://www.justice.gov/opa/pr/russian-national-sentenced-providing-crypting-service-kelihos-botnet
[9] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=4&c=44YbfQoOUA72V-Uozqdy8D0wAAAIQ&t=ct%3Dns%26unitnum%3D4%26raptor%3Dfalcon%26pos%3Dmid%26test%3D0
[10] https://www.nationalcrimeagency.gov.uk/news/sadistic-blackmailer-and-paedophile-jailed-for-32-years-after-targeting-nearly-2-000-people-worldwide-to-commit-sickening-online-sexual-offences
[11] https://pubads.g.doubleclick.net/gampad/jump?co=1&iu=/6978/reg_security/front&sz=300x50%7C300x100%7C300x250%7C300x251%7C300x252%7C300x600%7C300x601&tile=3&c=33YbfQoOUA72V-Uozqdy8D0wAAAIQ&t=ct%3Dns%26unitnum%3D3%26raptor%3Deagle%26pos%3Dmid%26test%3D0
[12] https://www.theregister.com/2016/10/17/reg_hack_video_blackmail_attempt/
[13] https://www.theregister.com/2021/12/10/ireland_health_conti_ransomware_attack_report/
[14] https://www.theregister.com/2021/12/10/frontier_software_ransomware_incindent/
[15] https://www.theregister.com/2021/12/09/feds_reveal_distribution_model_behind/
[16] https://www.theregister.com/2021/12/10/log4j_remote_code_execution_vuln_patch_issued/
[17] https://www.theregister.com/2021/12/10/log4j_remote_code_execution_vuln_patch_issued/
[18] https://www.theregister.com/2021/05/08/nasa_ingenuity_sound/
[19] https://t.co/gV0uyE1ylk
[20] https://twitter.com/hashtag/Apache?src=hash&ref_src=twsrc%5Etfw
[21] https://twitter.com/hashtag/OpenSource?src=hash&ref_src=twsrc%5Etfw
[22] https://twitter.com/hashtag/innovation?src=hash&ref_src=twsrc%5Etfw
[23] https://twitter.com/hashtag/community?src=hash&ref_src=twsrc%5Etfw
[24] https://twitter.com/hashtag/logging?src=hash&ref_src=twsrc%5Etfw
[25] https://twitter.com/hashtag/services?src=hash&ref_src=twsrc%5Etfw
[26] https://t.co/aFX9JdquP1
[27] https://twitter.com/TheASF/status/1400875147163279374?ref_src=twsrc%5Etfw
[28] https://whitepapers.theregister.com/
Also, given the apparent sterility of the Martian environment, I would be way less concerned about importing biological bugs than contaminating it with Java. If there are Martians, I suspect they'll either hide from us or declare war as a result!
The chances of anything hacking from Mars
Are infinitesimal he said
The chances of anything hacking from Mars
Are infinitesimal
but still they pwo-own
Ulll- aaah
Ingenuity is powered by Apache Log4j
And there was me, thinking it was batteries.
"spending time untangling her headphone wires?"
Don't know if trying to understand why the nuclear response app is not pairing with the nuclear response satellite network is better....
Re: "spending time untangling her headphone wires?"
"now type the 4-digit pairing code into the keypad located on the satellite's ground test panel... Oh shit."
Re: "spending time untangling her headphone wires?"
In case you forget, it's 0000. Enter twice.
(see also Command and Control, by Eric Schlosser for this, and other near misses)
I find the idea of being able to compromise something in space fascinating. I assume that naturally there is encryption on the links to these various craft. I do wonder what is up there that people can control from Earth with the right resources. More so, has there been or is there any evidence that anyone ever has?
> An Associated Press article stated that the nickname "football" was derived from an attack plan codenamed "Dropkick".[3] The nickname has led to some confusion as to the nature—and even the shape—of the device, as the leather bag or "jacket" in which it is carried appears large enough to contain an actual football.
As a Brit, I just had to look this up on Wikipedia as it is obviously not an actual football. Outside of that context, the term "football" really does seem rather bizarre. Why don't they just describe it as a bag? Which is what it is.
"Football" is nothing more than an easy to remember codeword.
> "Football" is nothing more than an easy to remember codeword.
I see that but I don't think that anyone outside of the government bubble is going to understand the reference, particularly at the top of this article which, without context, is pretty incomprehensible.
Nuclear football
I think everyone who reads The Reg knows what the nuclear football is in the context of the vice president of the United States of America. It's been referenced on TV, and in movies, articles, and books.
It's like we don't have to explain what the FBI is. Everyone's seen the X Files.
C.
Re: Nuclear football
"Everyone's seen the X Files."
I watched about ten minutes of the first episode. Does that count?
Re: Nuclear football
Well I had a bit of a trawl around the office here (in BC, Canada mind, so still North America) and everyone except me seems to know the term. A completely new one on me and I thought I was pretty well read.
When I saw the picture of the bag I expected it to have a ball shaped bulge.
I'm pretty certain that almost everybody who reads ElReg knows that the Presidential Emergency Satchel (US version) is called "the football"[0] by those who actually deal with it day to day.
[0] Note that this has absolutely nothing to do with the ball sport, so arguments over whether this is US football, Soccer, Aussie football, or some other, are quite silly.
Bluetooth
Or, considering my "successes" in pairing earphones and other stuff to my phone, it could be she just wants something that works.
It sucks paying $600 for a helmet with a built-in Bluetooth communications unit that just won't pair to anything except an iPhone. It also kind of sucks having earphone wires flapping in the breeze, but at least they work.
I also have a shitty app to control settings on my motorcycle where pairing doesn't work in the current version. You have to install an older version, pair it, and update.
Re: Bluetooth
Personally, I rather enjoy NOT being at the beck and call of other people when I'm riding ... and I'd rather listen to the music of my bike than any tunage.
Re: Bluetooth
I work in an office where the other occupants are writing an app for motor cyclists , putting photos on maps and tracking and a heap of other shit , that apparently no motor cycle rider can do without,
and guess what! it'll only run on an apple, so most real M/C riders are safe.
I ride to escape why bring the jail with you?
Thankfully the risk of hacking is infinitesimal, and NASA's unlikely to need to do any remote patching – as freaking epic as that would be. ®"
I think you have just issued a challenge, hopefully nobody will take it up.