Groups | Search | Server Info | Keyboard shortcuts | Login | Register [http] [https] [nntp] [nntps]
Groups > sci.electronics.design > #518112 > unrolled thread
| Started by | TTman <kraken.sankey@gmail.com> |
|---|---|
| First post | 2018-10-02 11:18 +0100 |
| Last post | 2018-10-03 21:49 -0700 |
| Articles | 20 on this page of 181 — 25 participants |
Back to article view | Back to sci.electronics.design
worldwide internet threat map TTman <kraken.sankey@gmail.com> - 2018-10-02 11:18 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-02 07:07 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-02 08:45 -0700
Re: worldwide internet threat map Jeff Liebermann <jeffl@cruzio.com> - 2018-10-02 09:18 -0700
Re: worldwide internet threat map Cursitor Doom <curd@notformail.com> - 2018-10-02 17:22 +0000
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-02 10:28 -0700
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-02 15:19 -0400
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-02 14:59 -0400
Re: worldwide internet threat map Jon Elson <elson@pico-systems.com> - 2018-10-03 14:32 -0500
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-02 14:51 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-02 23:29 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-02 17:58 -0700
Re: worldwide internet threat map Lasse Langwadt Christensen <langwadt@fonz.dk> - 2018-10-02 18:08 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-02 19:09 -0700
Re: worldwide internet threat map Jeff Liebermann <jeffl@cruzio.com> - 2018-10-02 19:17 -0700
Re: worldwide internet threat map boB <boB@K7IQ.com> - 2018-10-02 21:17 -0700
Re: worldwide internet threat map boB <boB@K7IQ.com> - 2018-10-02 23:25 -0700
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-03 01:00 -0700
Re: worldwide internet threat map tabbypurr@gmail.com - 2018-10-03 03:21 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-03 05:37 -0700
Re: worldwide internet threat map Jeff Liebermann <jeffl@cruzio.com> - 2018-10-03 10:26 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-03 05:42 -0700
Re: worldwide internet threat map Jeff Liebermann <jeffl@cruzio.com> - 2018-10-03 10:40 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-04 01:07 +0100
Re: worldwide internet threat map Jon Elson <elson@pico-systems.com> - 2018-10-03 14:44 -0500
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-03 17:27 -0700
Re: worldwide internet threat map whit3rd <whit3rd@gmail.com> - 2018-10-04 10:50 -0700
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-04 11:38 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-04 12:11 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-04 01:03 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-03 17:14 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-04 10:47 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-04 08:40 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-04 08:48 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-04 22:32 +0100
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-04 15:07 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-05 00:44 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-05 08:47 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-05 17:14 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-05 12:04 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-05 20:22 +0100
Re: worldwide internet threat map whit3rd <whit3rd@gmail.com> - 2018-10-05 13:17 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-05 14:28 -0700
Re: worldwide internet threat map Jasen Betts <jasen@xnet.co.nz> - 2018-10-06 00:17 +0000
Re: worldwide internet threat map Cursitor Doom <curd@notformail.com> - 2018-10-05 16:53 +0000
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-05 12:08 -0700
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-03 00:52 -0400
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-02 18:30 -0400
Re: worldwide internet threat map Martin Brown <'''newspam'''@nezumi.demon.co.uk> - 2018-10-03 10:23 +0100
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-03 05:44 -0700
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-03 07:04 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-03 08:29 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-03 10:59 -0700
Re: worldwide internet threat map boB <boB@K7IQ.com> - 2018-10-03 14:06 -0700
Re: worldwide internet threat map Bert Hickman <bert-hickman@comcast.net> - 2018-10-03 17:20 -0500
Re: worldwide internet threat map boB <boB@K7IQ.com> - 2018-10-04 00:07 -0700
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-03 12:53 -0400
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-03 10:20 -0700
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-03 20:36 -0400
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-03 20:12 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-03 20:26 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-04 10:53 +0100
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-04 11:04 -0400
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-04 08:52 -0700
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-04 13:01 -0400
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-04 13:06 -0400
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-04 13:10 -0400
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-04 10:27 -0700
Re: worldwide internet threat map Martin Brown <'''newspam'''@nezumi.demon.co.uk> - 2018-10-04 20:27 +0100
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-04 20:55 -0400
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-04 18:03 -0700
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-04 21:04 -0400
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-05 08:55 -0700
Re: worldwide internet threat map <698839253X6D445TD@nospam.org> - 2018-10-05 16:12 +0000
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-05 14:00 -0700
Re: worldwide internet threat map <698839253X6D445TD@nospam.org> - 2018-10-06 06:03 +0000
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-06 09:22 -0700
Re: worldwide internet threat map <698839253X6D445TD@nospam.org> - 2018-10-06 18:48 +0000
Re: worldwide internet threat map Neon John <no@never.com> - 2018-10-06 21:17 -0400
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-07 08:22 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-07 08:54 -0700
Re: worldwide internet threat map Neon John <no@never.com> - 2018-10-07 11:56 -0400
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-05 17:18 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-05 14:04 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-05 23:41 +0100
Re: worldwide internet threat map Lasse Langwadt Christensen <langwadt@fonz.dk> - 2018-10-05 15:47 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-06 00:05 +0100
Re: worldwide internet threat map Lasse Langwadt Christensen <langwadt@fonz.dk> - 2018-10-05 16:12 -0700
Re: worldwide internet threat map Jasen Betts <jasen@xnet.co.nz> - 2018-10-06 00:24 +0000
Re: worldwide internet threat map Clifford Heath <no.spam@please.net> - 2018-10-06 12:57 +1000
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-06 08:19 +0100
Re: worldwide internet threat map Clifford Heath <no.spam@please.net> - 2018-10-06 22:21 +1000
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-06 09:31 -0700
Re: worldwide internet threat map Lasse Langwadt Christensen <langwadt@fonz.dk> - 2018-10-06 09:39 -0700
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-06 10:45 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-06 08:13 +0100
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-06 09:02 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-06 09:40 -0700
Re: worldwide internet threat map tabbypurr@gmail.com - 2018-10-06 11:26 -0700
Re: worldwide internet threat map tabbypurr@gmail.com - 2018-10-06 11:27 -0700
Re: worldwide internet threat map <698839253X6D445TD@nospam.org> - 2018-10-06 18:48 +0000
Re: worldwide internet threat map Martin Brown <'''newspam'''@nezumi.demon.co.uk> - 2018-10-09 11:26 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-09 07:07 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-09 07:19 -0700
Re: worldwide internet threat map Chris <xxx.syseng.yyy@gfsys.co.uk> - 2018-10-09 17:11 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-09 09:53 -0700
Re: worldwide internet threat map Martin Brown <'''newspam'''@nezumi.demon.co.uk> - 2018-10-09 20:27 +0100
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-09 17:32 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-10 18:03 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-10 18:25 -0700
Re: worldwide internet threat map Chris <c@b.a> - 2018-10-11 11:29 +1100
Re: worldwide internet threat map Lasse Langwadt Christensen <langwadt@fonz.dk> - 2018-10-05 14:47 -0700
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-06 10:47 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-04 18:45 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-04 19:35 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-05 08:04 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-05 09:08 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-05 18:16 +0100
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-05 19:24 -0700
Re: worldwide internet threat map Cursitor Doom <curd@notformail.com> - 2018-10-05 16:55 +0000
Re: worldwide internet threat map Neon John <no@never.com> - 2018-10-05 14:50 -0400
Re: worldwide internet threat map Martin Brown <'''newspam'''@nezumi.demon.co.uk> - 2018-10-09 10:42 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-09 07:10 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-09 17:27 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-04 18:30 -0700
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-04 21:00 -0400
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-04 21:03 -0400
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-04 10:10 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-04 22:38 +0100
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-04 15:08 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-05 00:47 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-05 09:19 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-05 18:48 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-05 14:08 -0700
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-05 09:15 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-05 18:55 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-05 14:12 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-05 14:37 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-06 00:01 +0100
Re: worldwide internet threat map whit3rd <whit3rd@gmail.com> - 2018-10-05 23:18 -0700
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-06 09:52 -0700
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-06 10:53 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-06 20:29 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-09 08:33 -0700
Re: worldwide internet threat map tabbypurr@gmail.com - 2018-10-06 11:18 -0700
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-06 11:20 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-05 19:35 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-06 05:24 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-06 06:53 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-04 18:12 -0700
Re: worldwide internet threat map whit3rd <whit3rd@gmail.com> - 2018-10-04 19:04 -0700
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-05 09:22 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-05 09:27 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-05 19:45 -0700
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-05 19:44 -0700
Re: worldwide internet threat map Martin Brown <'''newspam'''@nezumi.demon.co.uk> - 2018-10-04 17:00 +0100
Re: worldwide internet threat map bitrex <user@example.net> - 2018-10-03 20:42 -0400
Re: worldwide internet threat map bill.sloman@ieee.org - 2018-10-03 18:31 -0700
Re: worldwide internet threat map Martin Brown <'''newspam'''@nezumi.demon.co.uk> - 2018-10-04 09:23 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-04 09:06 -0700
Re: worldwide internet threat map Martin Brown <'''newspam'''@nezumi.demon.co.uk> - 2018-10-04 17:49 +0100
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-04 10:14 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-03 10:55 -0700
Re: worldwide internet threat map Tom Gardner <spamjunk@blueyonder.co.uk> - 2018-10-04 01:10 +0100
Re: worldwide internet threat map whit3rd <whit3rd@gmail.com> - 2018-10-03 13:13 -0700
Re: worldwide internet threat map John Larkin <jjlarkin@highland_snip_technology.com> - 2018-10-03 13:47 -0700
Re: worldwide internet threat map Martin Brown <'''newspam'''@nezumi.demon.co.uk> - 2018-10-04 09:26 +0100
Re: worldwide internet threat map Neon John <no@never.com> - 2018-10-04 10:22 -0400
Re: worldwide internet threat map makolber@yahoo.com - 2018-10-04 08:16 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-04 08:44 -0700
Re: worldwide internet threat map Martin Brown <'''newspam'''@nezumi.demon.co.uk> - 2018-10-04 17:15 +0100
Re: worldwide internet threat map John Larkin <jjlarkin@highlandtechnology.com> - 2018-10-04 09:14 -0700
Re: worldwide internet threat map Jeff Liebermann <jeffl@cruzio.com> - 2018-10-04 09:31 -0700
Re: worldwide internet threat map Jeff Liebermann <jeffl@cruzio.com> - 2018-10-04 07:51 -0700
Re: worldwide internet threat map Lasse Langwadt Christensen <langwadt@fonz.dk> - 2018-10-04 08:27 -0700
Re: worldwide internet threat map Jeff Liebermann <jeffl@cruzio.com> - 2018-10-04 09:57 -0700
Re: worldwide internet threat map Jon Elson <elson@pico-systems.com> - 2018-10-03 14:29 -0500
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-03 13:11 -0700
Re: worldwide internet threat map dplatt@coop.radagast.org (Dave Platt) - 2018-10-03 13:33 -0700
Re: worldwide internet threat map gnuarm.deletethisbit@gmail.com - 2018-10-03 16:02 -0700
Re: worldwide internet threat map Cows are Nice <nice@cows.moo> - 2018-10-03 21:49 -0700
Page 9 of 10 — ← Prev page 1 … 7 8 [9] 10 Next page →
| From | Martin Brown <'''newspam'''@nezumi.demon.co.uk> |
|---|---|
| Date | 2018-10-04 17:49 +0100 |
| Message-ID | <pp5ga5$1a6$1@gioia.aioe.org> |
| In reply to | #518334 |
On 04/10/2018 17:06, John Larkin wrote: > On Thu, 4 Oct 2018 09:23:25 +0100, Martin Brown > <'''newspam'''@nezumi.demon.co.uk> wrote: > >> On 03/10/2018 18:20, John Larkin wrote: >>> A CPU could be hardware firewalled so that it can't mess up anything >>> but the application it is currently running. Absolutely all access to >>> external resources could be managed. >> >> Dec did that fairly well. IBM did not. > > The main CPU of a VAX didn't do i/o; a PDP-8 managed the big iron and > did external i/o for the mainframe. The 8 ran simple, solid code. That > concept could be applied to a multiprocessor system to absolutely > firewall apps from i/o and shared resources. Not convinced about that. Our Starlink Vax 780 definitely had a 512x512 Sigma Args raster graphics device close coupled to the CPU. The publicity online today claims it was 24 bit colour but it was actually if my memory serves 8 bit deep with just 256 possible levels in the CLUT which was 24 bit RGB. http://www.chilton-computing.org.uk/acd/starlink/p003.htm Our IBM 370 (later 3081) also had a bespoke PDP11 based system of terminal concentrators that ran a way better custom multiuser system than IBM's offering at the time. It was very vulnerable to hacking as all IBMs were. The DEC kit by comparison was almost bulletproof. >> It isn't the Intel CPU at fault here. It has or at least had modes that >> could support segmented data and code where anything that steps out of >> line gets summarily terminated with extreme prejudice. >> >> Problem is that Windows with a flat memory model with every integer >> potentially as a pointer to God knows what object allowed chaos. > > x86 protections could be, but usually aren't, better applied. Buffer > and stack overflow exploits are still outrageous. But it still has > tons of dangerous bugs. The architecture is about 40 years old. Unfortunately that also means there are forty years of applications that all run on it warts and all. Apple uses Intel CPUs without problems... Most of the bugs you refer to are bad coding practices rather than faults with the CPU. There are compilers and tools that could prevent the vast majority of these stupid human errors but developers choose not to use them. It is lamentable but shortest time to market is deemed far more important than getting stuff right first time. > "Showstopper" is a good book, about the development of NT. Cutler did > it about as well as could be done on x86, a small and tight and fairly > secure kernel. After he did that, a gang of idiots at Microsoft went > in and broke it. I was involved in early OS/2. It could have been so much better had IBM not insisted on backwards compatibility with the 286 CPU. It was probably the mistake that allowed Win 3 to rapidly gain market share. Jumping through various insane hoops to make it run on a 286 cost an inordinate amount of software development time to no good end. -- Regards, Martin Brown
[toc] | [prev] | [next] | [standalone]
| From | gnuarm.deletethisbit@gmail.com |
|---|---|
| Date | 2018-10-04 10:14 -0700 |
| Message-ID | <2ce271a1-9451-483b-b76c-498cb3449213@googlegroups.com> |
| In reply to | #518334 |
On Thursday, October 4, 2018 at 12:06:42 PM UTC-4, John Larkin wrote: > On Thu, 4 Oct 2018 09:23:25 +0100, Martin Brown > <'''newspam'''@nezumi.demon.co.uk> wrote: > > >On 03/10/2018 18:20, John Larkin wrote: > >> On Wed, 3 Oct 2018 12:53:41 -0400, bitrex <user@example.net> wrote: > >> > >>> On 10/03/2018 10:04 AM, John Larkin wrote: > >>>> On Wed, 3 Oct 2018 10:23:15 +0100, Martin Brown > >>>> <'''newspam'''@nezumi.demon.co.uk> wrote: > >>>> > >>>>> On 02/10/2018 22:51, John Larkin wrote: > > > >>>>>> Of course, a decent OS just wouldn't allow nasties. > >>>>> > >>>>> Hardware engineers are inclined to view software as trivial. It isn't. > >>>> > >>>> Computers need hardware protection against malware. DEC did that way > >>>> better than Intel. We could do it even better now. > >>> > >>> There's essentially no way to even verify your software compiler isn't > >>> itself compromised and silently inserting malicious code into your > >>> binaries, or that all compilers aren't already silently compromised, > > > >Actually the ones that you compile yourself from the sourcecode are > >amenable to direct inspection checking (as is the resulting code). It > >only takes one level of bootstrapping to get a clean compile. > > > >>> even! Or that the CAD hardware design tools you use to design the > >>> hardware to provide the protection aren't compromised. Etc. > >>> > >>> <http://wiki.c2.com/?TheKenThompsonHack> > > > >It was the meme running through Blake's Seven and its AI character Orac. > > > >https://en.wikipedia.org/wiki/Characters_of_Blake%27s_7#Orac > > > >Basically all computers had a bit in them designed by Orac's creator > >which allowed it to tap into any and all other computers. > >> > >> I'm always amused that people who post to a electronic design group > >> are so emotionally invested in things being impossible and never > >> changing. They invent reasons to not design stuff. That's fine with > >> me... much less competition. > > > >No. We have a much better idea of what is possible and what will work so > >we spend much less time tilting at windmills a la Don Quixote. > >> > >> A CPU could be hardware firewalled so that it can't mess up anything > >> but the application it is currently running. Absolutely all access to > >> external resources could be managed. > > > >Dec did that fairly well. IBM did not. > > The main CPU of a VAX didn't do i/o; a PDP-8 managed the big iron and > did external i/o for the mainframe. The 8 ran simple, solid code. That > concept could be applied to a multiprocessor system to absolutely > firewall apps from i/o and shared resources. > > > >> > >> Intel can't even keep data from being executed, or keep stacks from > >> overflowing and poking hostile code into random places in executable > >> space. Or protect the system from Word macros. When in doubt, execute > >> it. > > > >The Intel CPU is (possibly was) quite capable of running a hard > >protected segmented operating system like OS/2 but IBM made such a hash > >of marketing it by conflating it with their lockin FUD PS/2 hardware > >that instead of revolutionising desktop computing it sank without trace. > > > >OS/2 still had some niche markets in air traffic control and banking > >until relatively recently. I suspect few systems remain live now. > >> > >> DEC didn't allow any of that. No CPU should allow that. > > > >It isn't the Intel CPU at fault here. It has or at least had modes that > >could support segmented data and code where anything that steps out of > >line gets summarily terminated with extreme prejudice. > > > >Problem is that Windows with a flat memory model with every integer > >potentially as a pointer to God knows what object allowed chaos. > > x86 protections could be, but usually aren't, better applied. Buffer > and stack overflow exploits are still outrageous. But it still has > tons of dangerous bugs. The architecture is about 40 years old. JL is a pretty ridiculous guy. He complains about how bad the x86 architecture because it is "old" but holds up an even older architecture as a good example. Rick C.
[toc] | [prev] | [next] | [standalone]
| From | gnuarm.deletethisbit@gmail.com |
|---|---|
| Date | 2018-10-03 10:55 -0700 |
| Message-ID | <3b1ccfdb-208c-4046-ae46-5a4c4f1fc909@googlegroups.com> |
| In reply to | #518201 |
On Wednesday, October 3, 2018 at 10:04:33 AM UTC-4, John Larkin wrote: > On Wed, 3 Oct 2018 10:23:15 +0100, Martin Brown > <'''newspam'''@nezumi.demon.co.uk> wrote: > > >On 02/10/2018 22:51, John Larkin wrote: > >> On Tue, 02 Oct 2018 09:18:47 -0700, Jeff Liebermann <jeffl@cruzio.com> > >> wrote: > >> > >>> On Tue, 02 Oct 2018 07:07:33 -0700, John Larkin > >>> <jjlarkin@highlandtechnology.com> wrote: > >>> > >>>> On Tue, 2 Oct 2018 11:18:56 +0100, TTman <kraken.sankey@gmail.com> > >>>> wrote: > >>>> > >>>>> For anyone that is interested:- > >>>>> https://threatmap.checkpoint.com/ThreatPortal/livemap.html > >>> > >>>> If threats can be tracked, why can't they be blocked? The internet > >>>> should not transport malware. > >>> > >>> Because most such attacks come from hijacked PC's. > >> > >> A bit of added compute power in the network could snoop packets and > >> apply some artificial intelligence to kill the bad stuff. Things like > >> that. > > > >Invoke the magic genie with the all seeing eye. Individual packets can > >be made to look quite harmless even when they have a dangerous payload. > >You are assuming the existence of a quick solution to the halting > >problem when you only have a part of the final program. > > You are assuming that nothing can ever be done to eliminate viruses > and spyware and ransomware. Starship Enterprise will be dead in space > because some 3-month old Klingon kid planted a worm in the computer. > > Nothing will ever change. > > Got it. > > > > > > >Coupled with the tendency of any kind of heuristic to have false > >positives and you quickly get to a situation where the cure is worse > >than the disease it is trying to prevent. > > > >Attempts to blacklist dodgy IP addresses do exist and sometimes work but > >more often than not they harm the next encumbent of a dynamic pool of IP > >addresses rather than the compromised machine which will just move on. > >> > >> Of course, a decent OS just wouldn't allow nasties. > > > >Hardware engineers are inclined to view software as trivial. It isn't. > > Computers need hardware protection against malware. DEC did that way > better than Intel. We could do it even better now. > > > > > >Viper was one attempt to make an absolutely secure processor from the > >ground up done by RSRE hardware engineers. It all ended in acrimony and > >tears. NASA came closest to a full formal proof (but look at the spec). > > > >https://ntrs.nasa.gov/archive/nasa/casi.ntrs.nasa.gov/19930011854.pdf > > > >(large file warning) > > > >There have been a few very secure CPU designed experimentally and they > >typically separate data from executable code in some fashion and guard > >the transition of one into the other very very carefully. > > Single-CPU solutions are difficult. We can afford lots of processors > these days. > > It helps to to accept that things might be possible before you invent > them. Then show us the way oh great Nebuchadnezzar! Construct your many CPU device with great hardware security!!! We await your ever wise design. Rick C.
[toc] | [prev] | [next] | [standalone]
| From | Tom Gardner <spamjunk@blueyonder.co.uk> |
|---|---|
| Date | 2018-10-04 01:10 +0100 |
| Message-ID | <ITctD.408133$0L2.56642@fx04.am4> |
| In reply to | #518180 |
On 03/10/18 10:23, Martin Brown wrote: > On 02/10/2018 22:51, John Larkin wrote: >> On Tue, 02 Oct 2018 09:18:47 -0700, Jeff Liebermann <jeffl@cruzio.com> >> wrote: >> >>> On Tue, 02 Oct 2018 07:07:33 -0700, John Larkin >>> <jjlarkin@highlandtechnology.com> wrote: >>> >>>> On Tue, 2 Oct 2018 11:18:56 +0100, TTman <kraken.sankey@gmail.com> >>>> wrote: >>>> >>>>> For anyone that is interested:- >>>>> https://threatmap.checkpoint.com/ThreatPortal/livemap.html >>> >>>> If threats can be tracked, why can't they be blocked? The internet >>>> should not transport malware. >>> >>> Because most such attacks come from hijacked PC's. >> >> A bit of added compute power in the network could snoop packets and >> apply some artificial intelligence to kill the bad stuff. Things like >> that. > > Invoke the magic genie with the all seeing eye. Individual packets can be made > to look quite harmless even when they have a dangerous payload. You are assuming > the existence of a quick solution to the halting problem when you only have a > part of the final program. > > Coupled with the tendency of any kind of heuristic to have false positives and > you quickly get to a situation where the cure is worse than the disease it is > trying to prevent. > > Attempts to blacklist dodgy IP addresses do exist and sometimes work but more > often than not they harm the next encumbent of a dynamic pool of IP addresses > rather than the compromised machine which will just move on. >> >> Of course, a decent OS just wouldn't allow nasties. > > Hardware engineers are inclined to view software as trivial. It isn't. > > Viper was one attempt to make an absolutely secure processor from the ground up > done by RSRE hardware engineers. It all ended in acrimony and tears. And don't forget the associated NewSpeak language in which it was impossible to express a faulty program. Was /anything/ ever released?
[toc] | [prev] | [next] | [standalone]
| From | whit3rd <whit3rd@gmail.com> |
|---|---|
| Date | 2018-10-03 13:13 -0700 |
| Message-ID | <832baaf7-f7fd-454d-be76-d64a89ef52a9@googlegroups.com> |
| In reply to | #518153 |
On Tuesday, October 2, 2018 at 2:51:36 PM UTC-7, John Larkin wrote: > A bit of added compute power in the network could snoop packets and > apply some artificial intelligence to kill the bad stuff. Things like > that. Yeah, big brother can censor. That, alas, doesn't work out well. > > Of course, a decent OS just wouldn't allow nasties. An operating system is intended to support software; determining nastiness is not a well-defined software task. Nasty software is just.. software. So, there's lots of user interaction required (minimum: find and personalize ALL YOUR DEVICE PASSWORDS). And, when some piece of free-from-the-internet warez is bigger than seems warranted, documented poorly, or has a source that cannot be identified with a known entity (with address, names, phone numbers, etc.), do NOT install and run.
[toc] | [prev] | [next] | [standalone]
| From | John Larkin <jjlarkin@highland_snip_technology.com> |
|---|---|
| Date | 2018-10-03 13:47 -0700 |
| Message-ID | <ei9arddtdadq28l2s05u2btfle8ojmj4ti@4ax.com> |
| In reply to | #518246 |
On Wed, 3 Oct 2018 13:13:40 -0700 (PDT), whit3rd <whit3rd@gmail.com> wrote: >On Tuesday, October 2, 2018 at 2:51:36 PM UTC-7, John Larkin wrote: > >> A bit of added compute power in the network could snoop packets and >> apply some artificial intelligence to kill the bad stuff. Things like >> that. > >Yeah, big brother can censor. That, alas, doesn't work out well. I could elect to pay my ISP to filter packets for me. There are also DNS servers that don't serve up the IP addresses of known hazards. That's a start. 9.9.9.9 > >> >> Of course, a decent OS just wouldn't allow nasties. > >An operating system is intended to support software; determining >nastiness is not a well-defined software task. Nasty software is >just.. software. It wouldn't be difficult to have serious protections built into the hardware and software of a computer system. We are just too stuck with ancient legacy designs to do that any time soon. It will happen. We just spent two hours with our IT consultant, talking a lot about security issues. His opinion is that in 20 years, hardly anybody will need IT consultants. Interesting guy. -- John Larkin Highland Technology, Inc picosecond timing precision measurement jlarkin att highlandtechnology dott com http://www.highlandtechnology.com
[toc] | [prev] | [next] | [standalone]
| From | Martin Brown <'''newspam'''@nezumi.demon.co.uk> |
|---|---|
| Date | 2018-10-04 09:26 +0100 |
| Message-ID | <pp4ir9$8f9$4@gioia.aioe.org> |
| In reply to | #518246 |
On 03/10/2018 21:13, whit3rd wrote: > On Tuesday, October 2, 2018 at 2:51:36 PM UTC-7, John Larkin wrote: > >> A bit of added compute power in the network could snoop packets and >> apply some artificial intelligence to kill the bad stuff. Things like >> that. > > Yeah, big brother can censor. That, alas, doesn't work out well. Some really bad stuff is blocked from the UK search engines. >> Of course, a decent OS just wouldn't allow nasties. > > An operating system is intended to support software; determining > nastiness is not a well-defined software task. Nasty software is > just.. software. You can guess at some heuristics which most malware has in common and try to guard against it, but the attacker always has the upper hand and they only have to get lucky once with a zero day exploit to do a lot of damage. That said many major corporations are running legacy software that is all too open to abuse (eg the UK NHS ransom attack last year). And the US military intelligence has a habit of being suckered by hackers into giving them military grade cyber tools like Eternal Blue. > > So, there's lots of user interaction required (minimum: find and > personalize ALL YOUR DEVICE PASSWORDS). And, when some > piece of free-from-the-internet warez is bigger than seems warranted, documented > poorly, or has a source that cannot be identified with a known > entity (with address, names, phone numbers, etc.), do NOT install and > run. The trouble with that approach is that major players release important upgrades to device drivers without signing the damn things so you then have to take a value judgement on whether or not you trust them. Home users get used to clicking through the warnings without even a second thought. The wetware behind the computer *is* part of the problem - and they can be so easily tricked into giving away passwords too. The ones that typically catch my friends and neighbours tend to offer to download sought after videos for free or of high ranking pop stars. Malwarebytes usually knocks them on the head, but not always. -- Regards, Martin Brown
[toc] | [prev] | [next] | [standalone]
| From | Neon John <no@never.com> |
|---|---|
| Date | 2018-10-04 10:22 -0400 |
| Message-ID | <pv4crdhsvjcostltim9v6a9lt77ivgd9im@4ax.com> |
| In reply to | #518153 |
On Tue, 02 Oct 2018 14:51:26 -0700, John Larkin <jjlarkin@highland_snip_technology.com> wrote: >Of course, a decent OS just wouldn't allow nasties. It's not really an OS issue. Last time I researched this issue, the Internet of things gadgets now constitute the bulk of the bots. Ring is one of the biggest offenders. Ring uses a cut-down version of Linux in each device but they cut all of Linux's security features. So if a bot bot can get past the router's firewall, it can own the Ring products. Second in line are out-of-date router/wifi units. Again, they use a cut-down Linux. Until recently, no attention was paid to security. I've replaced the firmware in my routers with DD-WRT, a FOSS firmware replacement that DOES do security. The problem is that few people pay any attention to their boxes and seldom update the firmware. So many-years-old, non-secure routers are exposed to the net. Network connected printers are in about the same situation. Everything in our house except for our cellphones are hardwired with ethernet cable. No IoT gadgets will ever enter our house. Both the security system and the camera system are hard-wired and do not use WiFi. I have WiFi on for our phones but the AP does not broadcast an SSID. The Hughsnet satellite transceiver/router has the firewall on. I use the MAC filtering feature. Now someone like Lieberman is going to state the obvious, that MAC addresses can be spoofed. A serious hacker who is targeting your particular network would be the only one willing to do the work necessary to the to the MAC spoofing aspect. MAC spoofing may be a problem in SanFran but certainly not up here in the mountains. Nevertheless, given the tourist traffic in the summer time, I've added another layer of security. I have a WiFi dongle hanging off the Linux box that serves as our NAT. Transmit is turned off in the dongle and it listens in promiscuous mode. I wrote a daemon that opens that port read-only and listens for the two MAC addresses. It detects differences from normal packets. If it detects something, it turns the Hughsnet's WiFi transmit function off. I have to stop and restart the daemon to reset the Hughsnet box. So for someone to gain access to my network, he would have to park on the road in front of my cabin, as I have the AP power turned way down. He would have to know that the AP exists. He would have to spoof the IP addresses (which are static on our phones) and MAC addresses. That is, after he manages to crack the WiFi encryption. He'd have to have the exact same model phone as we have, would have to be with the same carrier and would have to exactly duplicate every byte the phone generates in the headers. And he'd have to have a really good explanation for why he's sitting in front of my cabin because I'd quickly detect his presence and go check it out, shotgun in hand. (our loop is posted and I own the roadway in front of my property so I can legally check out a trespasser.) The daemon writes to a log file but in the ~5 years since I wrote the thing, it has never detected any anomalies. I have one more piece to my security plan. I keep my IP and all our personally sensitive stuff such as medical records and communications from our lawyer on an air-gapped USB drive. Before one of us plugs in the drive, he/she runs a BASH alias that turns off the AP transmitter. If I ever get motivated enough, I'll write another daemon to automatically detect the drive connection and shut off the AP transmitter. John John DeArmond http://www.neon-john.com http://www.tnduction.com Tellico Plains, Occupied TN See website for email address
[toc] | [prev] | [next] | [standalone]
| From | makolber@yahoo.com |
|---|---|
| Date | 2018-10-04 08:16 -0700 |
| Message-ID | <e63a7bd3-8efc-47e8-9b98-4439c2e6eb8b@googlegroups.com> |
| In reply to | #518322 |
I think most of the security vulnerabilities are due to making everything too automatic. It would have been difficult to hack an original IBM PC where .exes were "RUN", not "INSTALLED" into the OS. Each program had .ini files instead of the OS registry. Am I wrong?
[toc] | [prev] | [next] | [standalone]
| From | gnuarm.deletethisbit@gmail.com |
|---|---|
| Date | 2018-10-04 08:44 -0700 |
| Message-ID | <05f9d8f2-49dd-4c78-82fe-549d02df492d@googlegroups.com> |
| In reply to | #518325 |
On Thursday, October 4, 2018 at 11:16:41 AM UTC-4, mako...@yahoo.com wrote: > I think most of the security vulnerabilities are due to making everything too automatic. > > It would have been difficult to hack an original IBM PC where .exes were "RUN", not "INSTALLED" into the OS. > > Each program had .ini files instead of the OS registry. > > > Am I wrong? Yes A very common method of infection was to add a line to the autoexec.bat or I forget the name of the other file that was much less often viewed by the user... something.sys. Rick C.
[toc] | [prev] | [next] | [standalone]
| From | Martin Brown <'''newspam'''@nezumi.demon.co.uk> |
|---|---|
| Date | 2018-10-04 17:15 +0100 |
| Message-ID | <pp5eb2$1t2e$1@gioia.aioe.org> |
| In reply to | #518325 |
On 04/10/2018 16:16, makolber@yahoo.com wrote: > I think most of the security vulnerabilities are due to making everything too automatic. Most security vulnerabilities are due to trying to be too clever at optimising manually written code and not checking that input parameters are correct. Most buffer overrun attacks rely on declaring the object size to be less than it really is with the intention of inserting or modifying code which can then be executed. Naive unguarded copy until next nul is the typical C loop vulnerability that gets exploited. > > It would have been difficult to hack an original IBM PC where .exes were "RUN", not "INSTALLED" into the OS. > > Each program had .ini files instead of the OS registry. > > Am I wrong? Yes. The first ever malware - a worm/fork bomb called rabbit was essentially of the form: rabbit - start: run rabbit goto start It grew exponentially in core until it absorbed all available global system resources and predates PCs by a very long way 1974. I don't like the MS registry but it is because the damn thing is a maze of twisty little passages all alike and self corrupts with monotonous regularity. Hacking the broken registry with a flint axe is an all too common thing that you have to do as a software developer. End users just get told to reinstall Windows and start from scratch. (how convenient *NOT*) -- Regards, Martin Brown
[toc] | [prev] | [next] | [standalone]
| From | John Larkin <jjlarkin@highlandtechnology.com> |
|---|---|
| Date | 2018-10-04 09:14 -0700 |
| Message-ID | <upecrdpj9bu0t4q0kp33t0js8vr2d5svv8@4ax.com> |
| In reply to | #518322 |
On Thu, 04 Oct 2018 10:22:48 -0400, Neon John <no@never.com> wrote: >On Tue, 02 Oct 2018 14:51:26 -0700, John Larkin ><jjlarkin@highland_snip_technology.com> wrote: > > >>Of course, a decent OS just wouldn't allow nasties. > >It's not really an OS issue. Last time I researched this issue, the >Internet of things gadgets now constitute the bulk of the bots. Ring >is one of the biggest offenders. > >Ring uses a cut-down version of Linux in each device but they cut all >of Linux's security features. So if a bot bot can get past the >router's firewall, it can own the Ring products. > >Second in line are out-of-date router/wifi units. Again, they use a >cut-down Linux. Until recently, no attention was paid to security. >I've replaced the firmware in my routers with DD-WRT, a FOSS firmware >replacement that DOES do security. > >The problem is that few people pay any attention to their boxes and >seldom update the firmware. So many-years-old, non-secure routers are >exposed to the net. Network connected printers are in about the same >situation. > >Everything in our house except for our cellphones are hardwired with >ethernet cable. No IoT gadgets will ever enter our house. Both the >security system and the camera system are hard-wired and do not use >WiFi. > >I have WiFi on for our phones but the AP does not broadcast an SSID. >The Hughsnet satellite transceiver/router has the firewall on. I use >the MAC filtering feature. > >Now someone like Lieberman is going to state the obvious, that MAC >addresses can be spoofed. A serious hacker who is targeting your >particular network would be the only one willing to do the work >necessary to the to the MAC spoofing aspect. > >MAC spoofing may be a problem in SanFran but certainly not up here in >the mountains. Nevertheless, given the tourist traffic in the summer >time, I've added another layer of security. I have a WiFi dongle >hanging off the Linux box that serves as our NAT. Transmit is turned >off in the dongle and it listens in promiscuous mode. > >I wrote a daemon that opens that port read-only and listens for the >two MAC addresses. It detects differences from normal packets. If it >detects something, it turns the Hughsnet's WiFi transmit function off. >I have to stop and restart the daemon to reset the Hughsnet box. > >So for someone to gain access to my network, he would have to park on >the road in front of my cabin, as I have the AP power turned way down. >He would have to know that the AP exists. He would have to spoof the >IP addresses (which are static on our phones) and MAC addresses. That >is, after he manages to crack the WiFi encryption. He'd have to have >the exact same model phone as we have, would have to be with the same >carrier and would have to exactly duplicate every byte the phone >generates in the headers. > >And he'd have to have a really good explanation for why he's sitting >in front of my cabin because I'd quickly detect his presence and go >check it out, shotgun in hand. (our loop is posted and I own the >roadway in front of my property so I can legally check out a >trespasser.) > >The daemon writes to a log file but in the ~5 years since I wrote the >thing, it has never detected any anomalies. > >I have one more piece to my security plan. I keep my IP and all our >personally sensitive stuff such as medical records and communications >from our lawyer on an air-gapped USB drive. Before one of us plugs in >the drive, he/she runs a BASH alias that turns off the AP transmitter. >If I ever get motivated enough, I'll write another daemon to >automatically detect the drive connection and shut off the AP >transmitter. > >John > >John DeArmond >http://www.neon-john.com >http://www.tnduction.com >Tellico Plains, Occupied TN >See website for email address That's all great, but a huge hassle that few people could understand, much less manage. Granny, and her smart online refrigerator, aren't going to do that. IoT and 5G are just going to make the current situation worse. We will eventually need some systematic fixes, and they can't depend on every $8 ebay gadget being secure. -- John Larkin Highland Technology, Inc lunatic fringe electronics
[toc] | [prev] | [next] | [standalone]
| From | Jeff Liebermann <jeffl@cruzio.com> |
|---|---|
| Date | 2018-10-04 09:31 -0700 |
| Message-ID | <vdbcrdt8hd18ege8b3uarmft4rtduqqisi@4ax.com> |
| In reply to | #518322 |
On Thu, 04 Oct 2018 10:22:48 -0400, Neon John <no@never.com> wrote: I hate security discussions. They go on forever, never reach any useful conclusions, and burn too much time. However, I can't resist. >It's not really an OS issue. Last time I researched this issue, the >Internet of things gadgets now constitute the bulk of the bots. Ring >is one of the biggest offenders. Yeah, Ring (DoorBot, Amazon) is rather sloppy: "A Ring doorbell vulnerability lets people snoop even after a password change" <https://www.digitaltrends.com/home/ring-video-doorbell-security-exploit/> "This Smart Doorbell Was Accidentally Sending Data To China, Until People Started Freaking Out" <https://www.forbes.com/sites/aarontilley/2017/03/22/this-smart-doorbell-was-accidentally-sending-data-to-china-until-people-started-freaking-out/#3c262f125984> The real problem is that they store their Wi-Fi passwords as plain text. I can take the backup of the settings file, feed it to the "strings" program, and extract the Wi-Fi password. That's the type of mistake made by beginners. Incidentally, Ring isn't the only company that did that. I'm occasionally finding Wi-Fi wireless routers and devices making the same mistake. In terms of compromised devices, IoT based devices are probably at the top of the list. However, they lack the storage and performance of a desktop or laptop. So, they're limited to running probes and scans. If they find anything, they report back to the mother ship, which then installs the malware. I've been using Nmap to try and identify devices that are port scanning my various firewalls. Many of them turn out to be commodity devices by Linksys, Netgear, Dlink, and others. Nmap can sometimes tell if they're a router, camera, doorbell, media player, or such, but I haven't done anything useful with that. >Second in line are out-of-date router/wifi units. Again, they use a >cut-down Linux. Until recently, no attention was paid to security. >I've replaced the firmware in my routers with DD-WRT, a FOSS firmware >replacement that DOES do security. Recently? Way back in 1999 or so, I was ranting about "secure by default" in alt.internet.wireless demanding that an out of the box wireless router should be delivered with all the security features nailed down tight. Security should only be reduced if the owner intentionally needs or wants lower security. When I pounded on the various vendors shipping wireless routers with wireless security disabled and a stupid default login password, I was ignored. Things are a little better today among some vendors, but most have decided that convenience and easy setup are more important than security. >Everything in our house except for our cellphones are hardwired with >ethernet cable. No IoT gadgets will ever enter our house. Both the >security system and the camera system are hard-wired and do not use >WiFi. My home network topology is a mess and changes every few weeks. My office is worse. I won't offer either mess as something worthy of emulation. (Do like I say, not like I do). >I have WiFi on for our phones but the AP does not broadcast an SSID. >The Hughsnet satellite transceiver/router has the firewall on. I use >the MAC filtering feature. > >Now someone like Liebermann is going to state the obvious, that MAC >addresses can be spoofed. MAC addresses can easily be spoofed. It doesn't matter for attacks originating from the internet because MAC addresses do not go through a router. However, it's important for attacks originating on the LAN side of a router. If I want to impersonate a wireless user, it's useful (but not necessary) to "borrow" their MAC address so that the router is dealing with a known MAC address. >A serious hacker who is targeting your >particular network would be the only one willing to do the work >necessary to the to the MAC spoofing aspect. I guess that includes the neighbors kids. Over the years, almost all the kids, including the girls, have attacked my wireless network. Most are successful because they use a scripted attack that they found on the internet. Only a few have a clue what they're doing or how it works. Discovering a usable MAC address is easy. With the various forms of Wi-Fi encryption, only the data payload is encrypted. The headers and management packets are totally in the clear and easily readable. The source and destination MAC addresses are in the header and be read by Wireshark or any of the utilities found on the various penetration testing tools, as found on the Kali Linux DVD. >So for someone to gain access to my network, he would have to park on >the road in front of my cabin, as I have the AP power turned way down. >He would have to know that the AP exists. He would have to spoof the >IP addresses (which are static on our phones) and MAC addresses. That >is, after he manages to crack the WiFi encryption. He'd have to have >the exact same model phone as we have, would have to be with the same >carrier and would have to exactly duplicate every byte the phone >generates in the headers. Frontal attacks are always spectacular, but I preferred to bypass the defenses. I would just plug into your ethernet cable. If you don't have a convenient outdoor RJ45 jack, I used to crawl under the house, cut the CAT5 cable, insert an ethertap, switch, or hub, and plug my own wi-fi access point. If I want your wireless password, I would recover the saved passwords from the various client computers, not by sniffing: <http://www.nirsoft.net/utils/wireless_key.html> However, even that's usually too much trouble. Most people write the Wi-Fi password on a post it note and tape it to the router. ISP supplied routers/gateways from AT&T and Comcast have everything printed on a label. I don't try to write down all that. I use my smartphone camera. What's nice about PSK (pre-shared key) security is that everyone uses the same key, so stealing one key works for everyone on the same SSID. If you have a full time server setup, think about setting as RADIUS server and using WPA2-Enterprise, or just wait for WPA3 to arrive. >And he'd have to have a really good explanation for why he's sitting >in front of my cabin because I'd quickly detect his presence and go >check it out, shotgun in hand. (our loop is posted and I own the >roadway in front of my property so I can legally check out a >trespasser.) Yeah, that's a problem. If I have to do it at a distance, there's always the big 24dBi dish antenna and Ubiquiti M2 HP wireless bridge. Lots of gain and a really good RF section in the radio. If there are no trees or hills in the way, I can attack your wireless router from a few miles away. >The daemon writes to a log file but in the ~5 years since I wrote the >thing, it has never detected any anomalies. Anomalies, oddities, and attacks usually show up initially as changes in traffic patterns. DD-WRT will produce some nice traffic graphs (using SNMP with MRTG or RRDTool) or with the built in traffic logging. On small commercial installs, I sometimes have something that collects and serves the SNMP traffic data and have someone look for "odd changes" which usually means something has gone wrong. Graphs like these: <https://www.google.com/search?q=mrtg+traffic+graph&tbm=isch> >I have one more piece to my security plan. I keep my IP and all our >personally sensitive stuff such as medical records and communications >from our lawyer on an air-gapped USB drive. Before one of us plugs in >the drive, he/she runs a BASH alias that turns off the AP transmitter. >If I ever get motivated enough, I'll write another daemon to >automatically detect the drive connection and shut off the AP >transmitter. Good idea. Is the USB drive encrypted? I'm still using TrueCrypt even though it's been abandoned by its author (because I'm too lazy to change to Veracrypt). <https://en.wikipedia.org/wiki/TrueCrypt> <https://en.wikipedia.org/wiki/VeraCrypt> I still hate computer security discussions. -- Jeff Liebermann jeffl@cruzio.com 150 Felker St #D http://www.LearnByDestroying.com Santa Cruz CA 95060 http://802.11junk.com Skype: JeffLiebermann AE6KS 831-336-2558
[toc] | [prev] | [next] | [standalone]
| From | Jeff Liebermann <jeffl@cruzio.com> |
|---|---|
| Date | 2018-10-04 07:51 -0700 |
| Message-ID | <679crd1u988nhseje2uo0efjmo91701tji@4ax.com> |
| In reply to | #518153 |
On Tue, 02 Oct 2018 14:51:26 -0700, John Larkin <jjlarkin@highland_snip_technology.com> wrote: >Of course, a decent OS just wouldn't allow nasties. Apple doesn't allow nasty programs by requiring that applications came from the Apple Store. A program called Gatekeeper does a signature check and refuses to run any program it finds lacking. Sometimes the design is not quite right: "Malware Has a New Way to Hide on Your Mac" <https://www.wired.com/story/mac-malware-hide-code-signing/> Microsoft does something similar with programs that originate from the MS Store. Android can be set to only allow apps that came from the Play Store. One can also authenticate scripts and such: <https://comodosslstore.com/code-signing/microsoft-office-vba> If users run only signed programs and apps, we wouldn't have a problem, but there are plenty of good and worthwhile programs from "unknown sources" that do not have or need such signatures or don't want to pay OS vendors to distribute their products. This does not solve all malware problems and assumes that the operating system hasn't been compromised, but it's a step in the right direction. Eventually, the new and improved model of the internet will need to have literally everything authenticated, which then begs the question of whom are you going to trust? -- Jeff Liebermann jeffl@cruzio.com 150 Felker St #D http://www.LearnByDestroying.com Santa Cruz CA 95060 http://802.11junk.com Skype: JeffLiebermann AE6KS 831-336-2558
[toc] | [prev] | [next] | [standalone]
| From | Lasse Langwadt Christensen <langwadt@fonz.dk> |
|---|---|
| Date | 2018-10-04 08:27 -0700 |
| Message-ID | <bc9e3a94-9ed5-41ff-a59e-eb539aa97eee@googlegroups.com> |
| In reply to | #518323 |
torsdag den 4. oktober 2018 kl. 16.51.16 UTC+2 skrev Jeff Liebermann: > On Tue, 02 Oct 2018 14:51:26 -0700, John Larkin > <jjlarkin@highland_snip_technology.com> wrote: > > >Of course, a decent OS just wouldn't allow nasties. > > Apple doesn't allow nasty programs by requiring that applications came > from the Apple Store. A program called Gatekeeper does a signature > check and refuses to run any program it finds lacking. Sometimes the > design is not quite right: > "Malware Has a New Way to Hide on Your Mac" > <https://www.wired.com/story/mac-malware-hide-code-signing/> > Microsoft does something similar with programs that originate from the > MS Store. Android can be set to only allow apps that came from the > Play Store. One can also authenticate scripts and such: > <https://comodosslstore.com/code-signing/microsoft-office-vba> > If users run only signed programs and apps, we wouldn't have a > problem, but there are plenty of good and worthwhile programs from > "unknown sources" that do not have or need such signatures or don't > want to pay OS vendors to distribute their products. or the OS vendor refuses > This does not > solve all malware problems and assumes that the operating system > hasn't been compromised, but it's a step in the right direction. > Eventually, the new and improved model of the internet will need to > have literally everything authenticated, which then begs the question > of whom are you going to trust? and who are you going to give the power of deciding what you can and cannot run?
[toc] | [prev] | [next] | [standalone]
| From | Jeff Liebermann <jeffl@cruzio.com> |
|---|---|
| Date | 2018-10-04 09:57 -0700 |
| Message-ID | <6sgcrdha1iq85tj15daq12hic7usv3lk1o@4ax.com> |
| In reply to | #518326 |
On Thu, 4 Oct 2018 08:27:52 -0700 (PDT), Lasse Langwadt Christensen <langwadt@fonz.dk> wrote: >torsdag den 4. oktober 2018 kl. 16.51.16 UTC+2 skrev Jeff Liebermann: >> This does not >> solve all malware problems and assumes that the operating system >> hasn't been compromised, but it's a step in the right direction. >> Eventually, the new and improved model of the internet will need to >> have literally everything authenticated, which then begs the question >> of whom are you going to trust? >and who are you going to give the power of deciding what you can >and cannot run? Yes, that's a related problem. The way Windoze 10 is currently paving the road to hell, you don't really own the operating system or even the computer. Microsoft allows you to use their products and can at any time decide what can be run and what is "unsafe". Software as a service extends the concept to user programs. The average cable modem or gateway extends the concept to hardware. I had a fund afternoon trying to install my various hacker tools on Windoze 10. It complained about a few, but for some, it just erased the program and produced no error message. It's much the same on Android and IOS, where apps can sometimes disappear from the phone without warning or notice. However, none of that really answers the basic question "whom are you going to trust"? If you can't trust yourself to keep your computer up to date, free of malware, and authenticate all communications, it has to be someone else. Will it be the software authors, computer manufacturer, OS vendor, 3rd party anti-everything vendor, the certificate authority, government agency, the kid next door, or perhaps me? Plenty to choose from, but you will eventually be forced to choose at least one trusted entity or live with todays growing chaos. -- Jeff Liebermann jeffl@cruzio.com 150 Felker St #D http://www.LearnByDestroying.com Santa Cruz CA 95060 http://802.11junk.com Skype: JeffLiebermann AE6KS 831-336-2558
[toc] | [prev] | [next] | [standalone]
| From | Jon Elson <elson@pico-systems.com> |
|---|---|
| Date | 2018-10-03 14:29 -0500 |
| Message-ID | <deGdnZrwYYsPhSjGnZ2dnUU7-SOdnZ2d@giganews.com> |
| In reply to | #518131 |
On Tue, 02 Oct 2018 09:18:47 -0700, Jeff Liebermann wrote: > > Because most such attacks come from hijacked PC's. The PC's are > controlled by the evil bad guys from other hijacked PC's forming a > "botnet". They also tend to use VPN's to cover their tracks. It's easy > enough to find the source of the attacks, but not so easy finding the > originator of the malware or the operators of the botnet. If you go > chasing after the IP address displayed by such threat maps, you'll > probably find some home or small business user with an infected PC, > probably in another country. > Right, that's the problem. Now, one could argue that any spam/DDOS/ whatever-creating node should just be totally blocked by their ISP. Many of these nodes may be in regular use by their legitimate user, and they are totally unaware their machine is part of a botnet. Well, blocking their machine might get them to have the vulnerability fixed. So, there IS a good argument for that. But, there are MILLIONS of these single rogue nodes out there. If every PC had to keep a list of all the compromised nodes out there, it would bog their firewall to its knees. So, really, it is the responsibility of the ISP to deal with these rogue nodes, but they don't want to make their PAYING customers mad at them for something that they probably don't even understand. So, it is a conundrum, at least until the vast number of botnet machines brings the whole internet to its knees. We aren't all that far from that right now. Jon
[toc] | [prev] | [next] | [standalone]
| From | gnuarm.deletethisbit@gmail.com |
|---|---|
| Date | 2018-10-03 13:11 -0700 |
| Message-ID | <dfd25708-9a54-4d47-a80c-2e2858330418@googlegroups.com> |
| In reply to | #518238 |
On Wednesday, October 3, 2018 at 3:29:32 PM UTC-4, Jon Elson wrote: > On Tue, 02 Oct 2018 09:18:47 -0700, Jeff Liebermann wrote: > > > > > > Because most such attacks come from hijacked PC's. The PC's are > > controlled by the evil bad guys from other hijacked PC's forming a > > "botnet". They also tend to use VPN's to cover their tracks. It's easy > > enough to find the source of the attacks, but not so easy finding the > > originator of the malware or the operators of the botnet. If you go > > chasing after the IP address displayed by such threat maps, you'll > > probably find some home or small business user with an infected PC, > > probably in another country. > > > Right, that's the problem. Now, one could argue that any spam/DDOS/ > whatever-creating node should just be totally blocked by their ISP. > Many of these nodes may be in regular use by their legitimate user, and > they are totally unaware their machine is part of a botnet. Well, > blocking their machine might get them to have the vulnerability fixed. > So, there IS a good argument for that. But, there are MILLIONS of these > single rogue nodes out there. If every PC had to keep a list of all the > compromised nodes out there, it would bog their firewall to its knees. > So, really, it is the responsibility of the ISP to deal with these rogue > nodes, but they don't want to make their PAYING customers mad at them for > something that they probably don't even understand. > > So, it is a conundrum, at least until the vast number of botnet machines > brings the whole internet to its knees. We aren't all that far from that > right now. If the customers don't understand the issue, why would they know enough to blame their ISP??? It's no easier to block the messages at the ISP than it is on the home computer... but that's not even the problem. It's not that the home computer is being attacked, it's that the home computer is compromised. I am pretty sure if the ISP could effectively and easily stop malware attacks without creating horrendous problems for their customers, they would. I seem to recall my email being blocked a number of times because my provider was black listed because of one customer being compromised. That's a pretty sever solution to the spam problem, cutting off an entire ISP. That's the sort of problem you will have in spades if you try to block all malware at the ISP level. Heck, I have a program I use frequently that is NOT infected which sets off AVS software on a regular basis. We contact various AVS vendors periodically to get it whitelisted, but with the next release the program gets blotted again. Imagine that at the ISP level! Rick C.
[toc] | [prev] | [next] | [standalone]
| From | dplatt@coop.radagast.org (Dave Platt) |
|---|---|
| Date | 2018-10-03 13:33 -0700 |
| Message-ID | <gmlf8f-m7g.ln1@coop.radagast.org> |
| In reply to | #518245 |
In article <dfd25708-9a54-4d47-a80c-2e2858330418@googlegroups.com>, <gnuarm.deletethisbit@gmail.com> wrote: >I am pretty sure if the ISP could effectively and easily stop malware attacks without creating horrendous problems for their customers, they would. I seem to recall my >email being blocked a number of times because my provider was black listed because of one customer being compromised. That's a pretty sever solution to the spam problem, >cutting off an entire ISP. That's the sort of problem you will have in spades if you try to block all malware at the ISP level. Yes, that does happen. Spamblocking an ISP tends to happen mostly in situations where an ISP has one or more really "bad actor" customers, is notified of the problem, and fails to do anything about it. Spamhaus (as one example) has a well-defined escalation policy, slowly broadening their spam listing for an ISP's address space over time as the result of an ongoing problem (or an ISP's decision to be complicit in their customer's misbehavior). >Heck, I have a program I use frequently that is NOT infected which sets off AVS software on a regular basis. We contact various AVS vendors periodically to get it >whitelisted, but with the next release the program gets blotted again. Imagine that at the ISP level! Yes, it would be nasty. Distinguishing malware from goodware, or malware accesses from legitimate accesses, is a hard problem in the technical sense. I suspect it's equivalent to the Halting Problem, and thus there's no perfect solution to it... just heuristics, with both false-positive and false-negative results. Consumer ISPs these days often do perform some blocking that's intended to stop certain forms of illegitimate use. For example, many consumer-grade ISPs now block direct outbound connections to TCP port 25 (SMTP) from their customers... in order to send outbound email the customer must connect to the ISP's mail relay server, and use proper identity credentials. This gives the ISP the ability to detect excessive bulk emailing, and throttle or block it.
[toc] | [prev] | [next] | [standalone]
| From | gnuarm.deletethisbit@gmail.com |
|---|---|
| Date | 2018-10-03 16:02 -0700 |
| Message-ID | <15da45f0-f570-474e-9a44-c2739dbb4a33@googlegroups.com> |
| In reply to | #518251 |
On Wednesday, October 3, 2018 at 4:34:22 PM UTC-4, Dave Platt wrote: > In article <dfd25708-9a54-4d47-a80c-2e2858330418@googlegroups.com>, > <gnuarm.deletethisbit@gmail.com> wrote: > > >I am pretty sure if the ISP could effectively and easily stop malware attacks without creating horrendous problems for their customers, they would. I seem to recall my > >email being blocked a number of times because my provider was black listed because of one customer being compromised. That's a pretty sever solution to the spam problem, > >cutting off an entire ISP. That's the sort of problem you will have in spades if you try to block all malware at the ISP level. > > Yes, that does happen. Spamblocking an ISP tends to happen mostly in > situations where an ISP has one or more really "bad actor" customers, > is notified of the problem, and fails to do anything about it. > Spamhaus (as one example) has a well-defined escalation policy, slowly > broadening their spam listing for an ISP's address space over time as > the result of an ongoing problem (or an ISP's decision to be complicit > in their customer's misbehavior). That's now. I recall a time when one of the major email providers would block huge swaths of email sources. The problem is to be an effective deterrent against viruses, DOS and other attacks the actions would need to be pretty drastic which would disrupt the web as much as the trouble makers. > >Heck, I have a program I use frequently that is NOT infected which sets off AVS software on a regular basis. We contact various AVS vendors periodically to get it > >whitelisted, but with the next release the program gets blotted again. Imagine that at the ISP level! > > Yes, it would be nasty. Distinguishing malware from goodware, or > malware accesses from legitimate accesses, is a hard problem in the > technical sense. I suspect it's equivalent to the Halting Problem, > and thus there's no perfect solution to it... just heuristics, with > both false-positive and false-negative results. > > Consumer ISPs these days often do perform some blocking that's > intended to stop certain forms of illegitimate use. For example, many > consumer-grade ISPs now block direct outbound connections to TCP port > 25 (SMTP) from their customers... in order to send outbound email the > customer must connect to the ISP's mail relay server, and use proper > identity credentials. This gives the ISP the ability to detect > excessive bulk emailing, and throttle or block it. Yeah, some things work ok, but it's a tough job. Virtually any company is vulnerable, not just home computers. Does anyone really thing the ISPs can do much to protect companies like Yahoo, Target, etc? Rick C.
[toc] | [prev] | [next] | [standalone]
Page 9 of 10 — ← Prev page 1 … 7 8 [9] 10 Next page →
Back to top | Article view | sci.electronics.design
csiph-web