Just how badly does Windows 10 spy on you?

It's worse than you think.  So far, people have focused on the aggressive upgrade tricks that Microsoft has used to get users on Windows 10.  But the far more serious concern is the amount of data about you that Windows 10 sends to Microsoft:

Windows 10 sends an unprecedented amount of usage data back to Microsoft, particularly if users opt in to “personalize” the software using the OS assistant called Cortana. Here’s a non-exhaustive list of data sent back: location data, text input, voice input, touch input, webpages you visit, and telemetry data regarding your general usage of your computer, including which programs you run and for how long.

...

And while users can disable some of these settings, it is not a guarantee that your computer will stop talking to Microsoft’s servers. A significant issue is the telemetry data the company receives. While Microsoft insists that it aggregates and anonymizes this data, it hasn’t explained just how it does so. Microsoft also won’t say how long this data is retained, instead providing only general timeframes. Worse yet, unless you’re an enterprise user, no matter what, you have to share at least some of this telemetry data with Microsoft and there’s no way to opt-out of it.

Microsoft has tried to explain this lack of choice by saying that Windows Update won’t function properly on copies of the operating system with telemetry reporting turned to its lowest level. In other words, Microsoft is claiming that giving ordinary users more privacy by letting them turn telemetry reporting down to its lowest level would risk their security since they would no longer get security updates1. (Notably, this is not something many articles about Windows 10 have touched on.)

But this is a false choice that is entirely of Microsoft’s own creation. There’s no good reason why the types of data Microsoft collects at each telemetry level couldn’t be adjusted so that even at the lowest level of telemetry collection, users could still benefit from Windows Update and secure their machines from vulnerabilities, without having to send back things like app usage data or unique IDs like an IMEI number.

Yuck.  Microsoft seems to be combining the worst of Apple with the worst of Google, at least from a privacy and you-can-do-it-any-way-you-like-as-long-as-it's-my-way perspectives.

(via)

What does August in Germany look like?

This is shaping up as the first summer since 1989 where there is year-round snow on the Zugspitze (Germany's highest mountain). Sure, this is weather, not climate - but late or missing snows in winter would cause a breathless round of ZOMG Thermageddon!!!one! headlines, so turnaround is air play.

Even more so as this is (once again, yawn) being billed as the "hottest year ever".  No wonder the public no longer listens to "Climate Scientists" - I mean, who you going to believe?  The scientists or your lying eyes?

(via)

There IS only one Country Music song on the radio

Pistolero put out a fatwa on the new Country Music years ago, but I just figured you know how HE is.  Man, was he ever right.  Sir Mashalot puts five hit Country songs together at the same time, and they are all the same song.



3 guitarists, 1 solo.  Heh.

Pistolero, let me say it here: you were right and I was wrong.

As a palate cleanser, let me offer a song that is authentic.

Hack the Planet!

Free Kevin!

And regarding the T-shirt at the link, it's an old computer security joke:

Q: What's the difference between a hacker and a Security Professional?

A: The Security Professional has a mortgage.

The Presidential debates from the perspective of an Internet Security guru

No, not me (I don't have guru status).  But people who do are applying those analytical techniques to the upcoming debates:

The moderators, the ones running the debate, will do their best to ask Trump the toughest questions they think of. At this point, I think their first question will be about the Kahn family, and Trump's crappy treatment of their hero son. This is one of Trump's biggest weaknesses, but especially so among military-obsessed Republicans.

And Trump's response to this will be awesome. I don't know what it will be, but I do know that he's employing some of the world's top speech writers and debate specialists to work on the answer. He'll be practicing this question diligently working on a scripted answer, from many ways it can be asked, from now until the election. And then, when that question comes up, it'll look like he's just responding off-the-cuff, without any special thought, and it'll impress the heck out of all the viewers that don't already hate him.

The same will apply too all Trump's weak points. You think the debates are an opportunity for the press to lock him down, to make him reveal his weak points once and for all in front of a national audience, but the reverse is true. What the audience will instead see is somebody given tough, nearly impossible questions, and who nonetheless has a competent answer to everything. This will impress everyone with how "presidential" Trump has become.

The persuasion techniques in play are what in the security biz are called "social engineering".  The expectation is that Trump will be displaying advanced social engineering skillz.

Windows 10 update breaks most webcams

The Windows 10 "Anniversary update" breaks almost all webcams:

The Windows 10 Anniversary Update, aka version 1607, has been found to leave many webcams inoperable. The update prevents the use of webcams in applications such as Skype and Open Broadcaster Software (OBS), along with all manner of custom CCTV programs. Extremely popular hardware, such as Logitech's C920 and C930e cameras, in conjunction even with Microsoft's own Skype, will fail to properly broadcast video.

People first noticed the issue earlier this month. But it's only within the last couple of days that the exact cause became clear via a post by Brad Sams on thurott.com.

Microsoft has said that a fix is in development, but has not yet said when that fix will be distributed.

Me, I recommend Linux.

You can say anything on your last day

This is one of the Queen Of The World's favorite sayings.

Watching the Olympics is better when you're drunk

Especially if you're watching the Irish sports commentator announcing sailing (which he clearly doesn't know anything about).



Open a Guinness, kick back, and enjoy!  Just make sure you watch all the way to the end.

Hat tip: Chris Lynch.

The wrong concerto

Ever had a dream that you studied for the wrong test?    That's what happened with Maria Joao Pires. The expression on her face about 40 seconds into the piece is pretty funny, as she realizes that she needs to play a piece that she hadn't practiced.  Fortunately this was a rehearsal - I guess that's why you have rehearsals!



She finishes the piece anyway, playing from memory.  The Show must go on, indeed.

(via)

It seems that I am now "Colonel Borepatch"

As in Kentucky Colonel.  I now have something in common with Winston Churchill and Igor Stravinsky.  But please, let's keep things informal here.  Although I do like a snappy salute ...

And I probably have a halloween costume in my future ...

Sometimes News breaks so fast ...

... that there's no time to caption the picture.

Man, that's fast breaking news!

Curmudgeons of the World, unite!

First, kill all the philosophers

Heh:

A runaway trolley is about to kill philosophy professors who invent trolley problems. Will you divert it? pic.twitter.com/mlfi0mydlZ

— Peter Krantz (@peterkz_swe) August 14, 2016

But not Aretae, who's a good guy (even if he is a philosopher).  And not the Bad Ass Philosophers.

The definition of passive-aggressive

Quote of the Day - End of the Republic edition

The Roman Republic fell, not because of the ambition of Caesar or Augustus, but because it had already long ceased to be in any real sense a republic at all,” he said. “When the sturdy Roman plebian, who lived by his own labor, who voted without reward according to his own convictions, and who with his fellows joined in war the terrible Roman legion, had been changed into an idle creature who craved nothing in life save the gratification of a thirst for vapid excitement, who was fed by the state, and who directly or indirectly sold his vote to the highest bidder, then the end of the republic was at hand, and nothing could save it. The laws were the same as they had been, but the people behind the laws had changed, and so the laws counted for nothing

 - Theodore Roosevelt

NSA hack: probably real. NSA had a mole.

Most likely a government.  Russia tops the list, but China is a suspect, too.  Certainly the text reads like it was written by Chinese-as-a-first-language person (for whatever that's worth).  This is the most interesting bit:

This just isn't something that can be faked in this way. (Good proof would be for The Intercept to run the code names in the new leak against their database, and confirm that some of the previously unpublished ones are legitimate.) 

This is definitely not Snowden stuff. This isn't the sort of data he took, and the release mechanism is not one that any of the reporters with access to the material would use. This is someone else, probably an outsider...probably a government. 

... 

Okay, so let's think about the game theory here. Some group stole all of this data in 2013 and kept it secret for three years. Now they want the world to know it was stolen. Which governments might behave this way? The obvious list is short: China and Russia. Were I betting, I would bet Russia, and that it's a signal to the Obama Administration: "Before you even think of sanctioning us for the DNC hack, know where we've been and what we can do to you." 

They claim to be auctioning off the rest of the data to the highest bidder. I think that's PR nonsense. More likely, that second file is random nonsense, and this is all we're going to get. It's a lot, though. Yesterday was a very bad day for the NSA.

I haven't looked at the stuff and have no intent to do so.  However, people whose opinion I respect are.  I find the file timestamps to be very interesting, and in fact is evidence that Snowden was not working for the Russians (but rather was a whistleblower, as he claims).  It looks like the Russians had a mole in NSA while Snowden was there, and their mole had to scramble to gather up what data he had after Snowden went public and NSA security got dialed up to 11.

ObDisclaimer: I worked at NSA for a few years starting in the mid 1980s, doing (defensive, not offensive) computer security.

The Tomb of Scipio

Image from Archeology News Network

Scipio Africanus was one of Rome's greatest soldiers, beating the great Hannibal himself in a stand up, toe-to-toe slug fest at Zama, ending a half century of Superpower war in the ancient world.

Even more, he was an honorable man, gracious to his foes.  For many years he tried even to protect Hannibal from a blood thirsty Roman Senate eager for vengeance.  When his troops captured the fiancee of a Nubian war chief, he had her restored to him, her (and his) honor intact.

Naturally, he had a legion of enemies in Rome.  Disgusted with the degenerate and vicious politics of his day, he left Rome for good.  His family tomb is shown here, but his own is a bit of a mystery - it is said that he asked that his be inscribed with his own epitaph:

Ingrata patria, ne ossa quidem habebis. (Ungrateful fatherland, you will not even have my bones).

He was followed by a viper's nest, one that ultimately broke the Republic through increasingly divided and violent political division.  It got so bad that 150 years after his death, a grateful Rome welcomed Augustus as Imperator simply because it meant the end of the incessant blood letting.

An honorable - if flawed - man, followed by the contemptible.

Comrade Misfit looks on the corruption in which this Republic finds itself mired.  It feels like an "end of the Roman Republic" time.  Sophisticates can compete to show their, well, sophistication in comparing various recent Presidents to Scipio (flawed but honorable men), and the current crop of rogues to those who followed Scipio - each competing for most corrupt, venal, and destructive to the res publica.

"I hung around with hackers for a week ..."

"... and now I'm completely paranoid."

Good introduction to security from someone who pretty clearly hasn't thought much about it before.

Did the NSA get hacked?

Rick emails to point out something pretty interesting:

(NEWSER) – An apparent hacking group calling itself the "Shadow Brokers" claims to have hacked the NSA and is asking for about $570 million to share the data. Two sets of files were posted online Saturday—one open, the other encrypted—which the group claims are from the Equation Group, an advanced group of hackers believed to be working with US intelligence. The open files contain "a series of tools for penetrating network gear made by Cisco, Juniper, and other major firms," along with code words found in documents leaked by Edward Snowden, reports Foreign Policy. They are "most likely … part of the NSA toolset," an expert tells Ars Technica. But the encrypted files are "the best files," says the Shadow Brokers, which is asking for 1 million Bitcoin, currently worth about $570 million, to release them.

I have no idea whether this is legit or not, but know people who are in the "cyber weapon" business.  The encrypted file is interesting - typically the most damaging information would go there along with an automated "dead man's switch" that would release the encryption key.  If the Feds put the snatch on the perps, the information could be disclosed anyway.

Should NSA disclose Zero Day security bugs

Interesting analysis says "no":

The point is that no sane person can argue that it's worth it for the government to spend $1 million per iOS 0day in order to disclose/fix. If it were in the national interest, we'd already have federal bug bounties of that order, for all sorts of products. Long before the EFF argues that it's in the national interest that purchased bugs should be disclosed rather than exploited, the EFF needs to first show that it's in the national interest to have a federal bug bounty program at all.

Conversely, it's insane to argue it's not worth $1 million to hack into terrorist iPhones. Assuming the rumors are true, the NSA has been incredibly effective at disrupting terrorist networks, reducing the collateral damage of drone strikes and such. Seriously, I know lots of people in government, and they have stories. Even if you discount the value of taking out terrorists, 0days have been hugely effective at preventing "collateral damage" -- i.e. the deaths of innocents.

iOS "Day Zero" bugs (ones where there is no patch to protect the target) sell for around a million dollars.  Less for Windows, maybe the same for Android.  There could be a billion dollars a year in this sort of bug bounty program.  So it is doable - pricy, but probably not in the grand scheme of NSA's budget.

Or you can use them to attack high value targets.

The worry, of course, is whether you can trust NSA to attack legitimate targets and not everybody else.  The author shares those concerns:

The NSA/DoD/FBI buying and using 0days is here to stay. Nothing the EFF does or says will ever change that. Given this constant, the only question is how We The People get more visibility into what's going on, that our representative get more oversight, that the courts have clearer and more consistent rules. I'm the first to stand up and express my worry that the NSA might unleash a worm that takes down the Internet, or the FBI secretly hacks into my home devices. Policy makers need to address these issues, not the nonsense issues promoted by the EFF.

The EFF is, of course, the Electronic Frontier Foundation.  This is pretty interesting stuff, so if you're a security nerd you should RTWT.

Automotive software: unsafe at any speed

The problem isn't that there's software bugs.  The problem is an engineering culture that ensures that security problems are designed in and not fixed:

One of every five software vulnerabilities discovered in vehicles in the last three years are rated “critical” and are unlikely to be resolved through after the fact security fixes, according to an analysis by the firm IOActive.

“These are the high priority ‘hair on fire’ vulnerabilities that are easily discovered and exploited and can cause major impacts to the system or component,” the firm said in its report, which it released last week. The report was based on an analysis of more than 150 vehicle security flaws identified over three years by IOActive or publicly disclosed by way of third-party firms.

Where do all these "hair on fire" vulnerabilities come from?

The bulk of vulnerabilities that were identified stemmed from a failure by automakers and suppliers to follow security best practices including designing in security or applying secure development lifecycle (SDL) practices to software creation. “These are all great things that the software industry learned as it has progressed in the last 20 years. But (automakers) are not doing them.”

So the auto makers have basically ignored what the rest of the world has learned over the last two decades.  Got it.

The result is that vehicle cybersecurity vulnerabilities are not solvable using “bolt-on” solutions, IOActive concluded. That is because they are caused by flawed engineering assumptions or insecure development best practices. “The most effective cybersecurity work occurs during the planning, design and early implementation phases of products, with the difficulty and cost of remediation increasing in correlation with product age and complexity,” IOActive’s report notes.

Err, so the auto makers have basically ignored what the rest of the world has learned over the last two decades ...

Still, auto firms remain wary of information security firms and wedded to the notion that keeping the details of their systems secret will ensure security (aka “security through obscurity”).

“Their general attitude is that they don’t want to  engage researchers or share their ‘secret sauce,'” Thuen said. “The attitude is anti-security in general. It’s the Ostrich approach – we’re going to stick our head in the sand and say that we can’t hear you, or that everthing you’re saying isn’t important.”

What could possibly go wrong?  Oh yeah, problems not fixable once you release ...

Resistance to the attentions of security researchers is rooted in an engineering culture that looks on software vulnerabilities as shameful – far different from software-based engineering that generally accepts vulnerabilities as an inevitable byproduct of writing code. “It’s not shameful to have vulnerabilities. What is shameful is to have them and not move forward to fixing them,” he said.

So failure is inevitable.  I cannot say more strongly that I will not buy any "connected" car, ever.  And I will not ride in a self-driving car, ever.  There are too may ways that this breaks and the culture that builds them simply doesn't care.

Hackers say: vote early, vote often

Electronic voting machines hacked in public demo.  Candy, babies:

But for the hackers at Symantec Security Response, Election Day results could be manipulated by an affordable device you can find online.

"I can insert it, and then it resets the card, and now I'm able to vote again," said Brian Varner, a principle researcher at Symantec, demonstrating the device.

And you can hack them after voting is done, remotely.  Communications isn't encrypted, presumably because the people who designed the systems were n00bs.  And there's likely no way to tell that the system was hacked:

CBS News learned that only 60 percent of states routinely conduct audits post-election by checking paper trails. But not all states even have paper records, like in some parts of swing states Virginia and Pennsylvania, which experts say could be devastating.

Confidence is not high in the integrity of our political system.

U.S. Military Officer Corps is worse than useless

Fundamentally transformed:

Four U.S. military officials told me that the 300 or so U.S. special operators in Syria are under very strict rules of engagement. Because such rules are highly classified, these sources have requested anonymity.

But the rules in place, known as "last cover and concealment," are highly restrictive compared to special operations missions in the war on terror before 2014. Those rules of engagement allowed for U.S. special operators to fight alongside the local forces they trained. The rules of engagement for Syria, according to one military officer, amount to: "don't get shot."

The Queen Of The World saw red when she read this in the Sunday paper.  I can't blame her.  What use is an Officer Corps that isn't interested in winning wars, or protecting their most valuable assets?

Sir Arthur Sullivan - The Lost Chord

Everyone has heard of Gilbert and Sullivan and their comedic operettas.  However, Arthur Sullivan was a successful composer in his own right, and indeed it was his independent compositions that won him his knighthood from Queen Victoria.

In 1877, Sullivan's brother Fred was on his death bed.  Sullivan composed this music while sitting at Fred's bedside, using the poem "A Lost Chord" by Adelaide Anne Proctor.  It became wildly popular, perhaps his most famous work outside of his operettas.  Thomas Edison recorded this on his new fangled phonograph on this day in 1888, one of the first musical recordings ever made.  Jimmy Durante recorded a song "I'm The Guy Who Found The Lost Chord" which inspired The Moody Blues to write "In Search Of The Lost Chord".

Jolly good Pith Helmet, Old Boy

The big wheel race at Frederick's BestFest.



Wonder if RobertaX is here ...

Festival time

The Queen Of The World and I are off to nearby Frederick's BestFest.  Live music along the canal, a biergarten tent, street vendors.  It's not just festive, it's BestFestive.

The fly in the ointment?  The forecast is for 96°.  Oof.

Oh, well.  Just because it's hot doesn't mean it can't be fun.

Quote of the Day - Political Correctness edition

Yeah, I know I've already done one today.  Samizdata recalls George Carlin's epic description of this scourge:

Political correctness is fascism pretending to be manners

– George Carlin

Do you have data on your computer that you care about?

No?  You can stop reading.  Everyone else needs to go here.

History repeats itself because nobody listens the first time.

Quote of the Day - Both parties stink edition

Michael Bane echoes my "a pox on both your houses" attitude:

I despise the Democratic Party for pretending they are not the Socialist Workers Party of America, and I despise the Republicans for their gutlessness and their willingness to throw us all under the bus to protect their dacha by the lake.

Amen.

Another passes

Yesterday saw the sendoff of another of the generation who saved the world.  Via Patriot Guard Riders:

Lt. Col. James D. Hammond, Jr. USMC(ret), WWII/Korea, Canton, GA 11 Aug 16

The family of Lt. Col. James D. Hammond, Jr. has requested the Patriot Guard to honor their loved one and our hero.  It is our honor to do so.  We will stand a flag line at Georgia National Cemetery for his interment service.

Lt. Col. Hammond graduated from George Washington High School and attended Virginia Military Institute.  He served in the Marine Corps during WWII with the 2^nd Marines and was part of the Saipan, Tinian, and Okinawa campaigns.  Lt. Col. Hammond served at Chosin Reservoir with Dog Company, 2^nd Bn, 7^th Marines, 1^st Marine Division in Korea.  He retired from active duty in 1965 and from the Marine Corps reserves in 1983.

Lt. Col. Hammond earned two National Defense Service Medals, a United States Service Medal, a Korean Defense Medal with 3 bronze stars, and a Korean Presidential Unit Citation.

Saipan, Tinian, Okinawa, Chosin.  There's an honor roll for you.  Rest in peace, sir.  And may flights of Angels sing thee to thy rest.

Professional Video Gamers

While #1 Son and #2 Son were here, they told me about the DOTA 2 International game championship currently under way.  Teams of gamers face off, for a share of a $20 Million prize pool.  Last year's winning team scored a cool $6M, out of an $18M pool.

[blink] [blink]

They sell out stadiums.  This was last year, with a capacity crowd at Seattle's Key Arena.

[blink] [blink]

I really don't know what to say.  The World is a stranger place than we can imagine.

Handy guide to the Olympic events

"Smart" Thermostats hacked

More news from the Internet of (Insecure) Things:

Last week, Andrew Tierney and Ken Munro from Pen Test Partners demoed their proof-of-concept ransomware for smart thermostats, which relies on users being tricked into downloading malware that then roots the device and locks the user out while displaying a demand for one bitcoin. 

The researchers have not released sourcecode or the name of the manufacturer. They say that they gained vital intelligence by examining the manufacturer's regulatory filings with the FCC, and that they could design an attack that turned heating or cooling to arbitrary setpoints, ran both at once, or rapidly power-cycled them, possibly causing damage.

This seems to be not just bad coding and a grotesque inattention to security, but architectural decisions that seem to guarantee failure:

* First, the device has no interlocks to prevent unsafe or unwise settings -- nothing to limit the heating or cooling, or simultaneous air-conditioner/furnace operation, or repeated high-speed power-cycling -- which means that software defects, as well as malicious software, can do significant damage that might be prevented with more thoughtful systems design 

* Second, the business-model for smart thermostats overwhelmingly assumes that users are hostile parties, and protects against them with DRM of some kind. Some thermostats are designed to be sold to power companies who'll subsidize their installation in customers' homes so that the power authority can tweak power consumption to reduce load at peak times -- these sales are much easier to make if the vendor can assure the power company that there are no apps that allow users to override these tweaks, and no apps that enable this will be approved for the device (and the device will not run unapproved apps).

Interestingly, the vendor is not named, so it's not possible for consumers to make informed decisions on what product not to purchase:

This matters because a device with DRM poses significant legal risks to security researchers. Anti-circumvention laws like the section 1201 of the DMCA and European laws implementing Article 6 of the EUCD have been invoked to make civil and criminal threats against security researchers, on the theory that information about defects in a device will assist people who want to bypass the DRM, which is banned under these laws.

Government is what we choose to do together.  Like forcing you to only have insecure products to purchase.  Behold your Philosopher Kings.

Free retro games!

The Internet Archive now has a long list of games developed for the Commodore Amiga available for free play.  All you need is a Browser to get access to King's Quest II, Hunt for Red October, Pac Man, Galaga, and other 1980s nostalgia.

Knock yourselves out.

Bluetooth door locks - insecure and staying that way

Ah, the "Internet Of Things" - ubiquitous insecurity.  Not just coming to your house, but coming to your front door:

Many Bluetooth Low Energy smart locks can be hacked and opened by unauthorized users, but their manufacturers seem to want to do nothing about it, a security researcher said yesterday (Aug. 6) at the DEF CON hacker conference here. 

Researcher Anthony Rose, an electrical engineer, said that of 16 Bluetooth smart locks he and fellow researcher Ben Ramsey had tested, 12 locks opened when wirelessly attacked. The locks — including models made by Quicklock, iBlulock, Plantraco, Ceomate, Elecycle, Vians, Okidokey and Mesh Motion — had security vulnerabilities that ranged from ridiculously easy to moderately difficult to exploit. 

"We figured we'd find vulnerabilities in Bluetooth Low Energy locks, then contact the vendors. It turned out that the vendors actually don't care," Rose said. "We contacted 12 vendors. Only one responded, and they said, 'We know it's a problem, but we're not gonna fix it.'"

None of these will ever come to my front door, and I recommend the same to you.

Security: not an afterthought - it wasn't thought of at all.

It looks like the Russians didn't hack the DNC

I've been skeptical, and posted this a little while back:

There are other plausible actors who would be more embarrassing to the Democrats.  It's not beyond belief that a [DNC] IT Administrator was a closet Bernie Bro who caught a whiff of what was going on, and leaked the emails to Wikileaks.

And look at this:

Julian Assange seems to suggests on Dutch television program Nieuwsuur that [DNC staffer] Seth Rich was the source for the Wikileaks-exposed DNC emails and was murdered. 

... 

From the video:

Julian Assange: Whistleblowers go to significant efforts to get us material and often very significant risks. As a 27 year-old, works for the DNC, was shot in the back, murdered just a few weeks ago for unknown reasons as he was walking down the street in Washington. 

Reporter: That was just a robbery, I believe. Wasn’t it? 

Julian Assange: No. There’s no finding. So… I’m suggesting that our sources take risks.

No doubt the crack investigators at the FBI will be on this in a jiffy.  And no doubt the ruling ultimately will be that no prosecutor would file charges ...

What they promise vs. what they deliver

This is God's own truth.

Why does "Green" power kill so many people?

The Department of Veteran's Affairs repeatedly delayed veteran's health care, killing many.  The reason, we are told, is because they didn't have a big enough budget.  So what did they have budget for?

The Department of Veterans Affairs has spent more than $408 million to install solar panels on its medical facilities in recent years, despite many of the projects experiencing significant delays and some of the systems not becoming operational at all.

Hundreds of millions of dollars flowing not to health care for veterans, but to Solyndra and other "Green" companies feeding at the public trough.

Does the VA even know what their mission is?  I mean, it's in their Agency's name and everything.

Hat tip: Rick via email.

Hack the Vote!

This is my surprised face:

“People weren’t thinking about voting system security or all the additional challenges that come with electronic voting systems,” says the Brennan Center’s Lawrence Norden. “Moving to electronic voting systems solved a lot of problems, but created a lot of new ones.”

The list of those problems is what you’d expect from any computer or, more specifically, any computer that’s a decade or older. Most of these machines are running Windows XP, for which Microsoft hasn’t released a security patch since April 2014. Though there’s no evidence of direct voting machine interference to date, researchers have demonstrated that many of them are susceptible to malware or, equally if not more alarming, a well-timed denial of service attack. 

“When people think that people think about doing something major to impact our election results at the voting machine, they think they’d try to switch results,” says Norden, referring to potential software tampering. “But you can do a lot less than that and do a lot of damage… If you have machines not working, or working slowly, that could create lots of problems too, preventing people from voting at all.”

The extent of vulnerability isn’t just hypothetical; late last summer, Virginia decertified thousands of insecure WinVote machines. As one security researcher described it, “anyone within a half mile could have modified every vote, undetected” without “any technical expertise.” The vendor had gone out of business years prior.

Stalin would have had them all shot.

(via)

Monday

OK, that would be a time I would take a self-driving car

Tesla drives man to hospital, saves his life:

A Missouri man says his Tesla helped saved his life by driving him to the hospital during a life-threatening emergency. 

Joshua Neally is a lawyer and Tesla owner from Springfield, Missouri, who often uses the semi-autonomous driving system called Autopilot on his Tesla Model X. 

The system has come under fire after it was involved in a fatal Florida crash in May, but Neally told online magazine Slate that Autopilot drove him 20 miles down a freeway to a hospital, while Neally suffered a potentially fatal blood vessel blockage in his lung, known as a pulmonary embolism. The hospital was right off the freeway exit, and Neally was able to steer the car the last few meters and check himself into the emergency room, the report said.

I don't like the lack of security in self-driving cars, but I like the idea of death even less.

An out of this world birthday

At the Air and Space Museum with #1 Son and #2 Son.



Haven't been here for ages and had forgotten just how spectacular it is.

Nerds of a feather flock together

This is a Royal Command blog post, with mint julips made by the Queen Of The World, from Castle Borepatch's Gentlemen's Smoking Room.



She says that she'll tell me when it is allowed to smoke ...

Tractor pull

Howard County Fair.

Busy now

#1 Son and #2 Son are visiting Castle Borepatch, so I'm pretty much away from the 'net.  It sure is nice to see them again.  And co-blogger ASM826 will visit later, so it's a very social weekend.

I hope your weekend is as nice as mine.

True that

The United States Department of Being Behind The Times

Shot:

NIST is no longer recommending two-factor authentication systems that use SMS, because of their many insecurities.

(this is where when you log in, the server sends a text to your phone with a one time number to enter as part of the login process)

Chaser:

The SSA said all new and existing ‘my Social Security’ account holders will need to provide a cell phone number. The agency said it will use the mobile numbers to send users an 8-digit code via text message that needs to be entered along with a username and password to log in to the site.

I'm a fan of using SMS text messages to add security to the login routine.  The risk that NIST is pointing out is that as more phones move to Voice Over IP (VoIP), it is getting easier to spoof the SIP number.  They are probably right that this is an emerging threat, but for now I still recommend doing it (and in fact I do it all the time).

Heh

Chris Lynch sees something funny.

So is the F-35 actually ready for combat?

The Air Force says yes.  The rest of the world takes a "wait and see" approach to this gold plated fiasco.

Well OK then

Would you use that ATM machine?

Sweet Jesus, Mary, and Joseph.

Protip to all readers: don't use an ATM that looks like this.

Congratulations to my Son-In-Law

Promoted to Chief Petty Officer.

What happens when someone pwns your car when you're driving?

Nothing good:

Car hackers Charlie Miller and Chris Valasek have again hacked a 2014 Jeep Cherokee, this time by physically linking a laptop to commandeer its steering and kill the brakes. 

The duo have captured the hack to be presented at Black Hat Las Vegas this week in video proof-of-concept demonstrations. 

The compromise requires attackers to be physically present in order to compromise the car. 

However Miller confirmed this writer's suggestion that the attacks could be carried out using a concealed device which either contains automated and timed commands, or iwth remote attacks over a wireless link.

Watch the horror unfold:



We're in the early stages of people figuring out what the attack vectors are, but those will develop and grow more sophisticated over time.  That '67 GTO is looking safer and safer ...

I know people who used epoxy to fill USB connectors.  I'm thinking about doing this to the Wrangler's computer interface connector.

Security wasn't an afterthought.  It wasn't thought of at all.

Wait, what?

35 years ago, video killed the radio star

On August 1, 1981 MTV broadcast its first music video.  Now, the last VCR has been produced.



Back In The Day, buddy 2cents and I demanded our MTV ...



There was a brief golden age, before people realized that music videos had to make money.  Back when people would make videos like this:



... or this, which was maybe the apogee of music video production.  Directed by actual Hollywood director John Landis (directed The Blues Brothers, American Werewolf in London, others):



But mostly when I look back on this era, I remember Big Hair.  My flaming youth, right there ...



This was back when America was winning the Cold War, is all I can say.

Russian hackers and electronic voting machines

I've said that I'm skeptical as to whether the Russians actually hacked the DNC email server.  However, there's no question at all whether they could have.  As to Hillary's home brew server, everyone seems to be operating from the starting assumption that they read all her email.  This is much more likely than not.

There's also no question that the biggest story is whether the use of electronic voting machines would let the Russians (or someone else) rig an election:

Over the years, more and more states have moved to electronic voting machines and have flirted with Internet voting. These systems are insecure and vulnerable to attack.

[Your iPhone just got less secure. Blame the FBI.] 

But while computer security experts like me have sounded the alarm for many years, states have largely ignored the threat, and the machine manufacturers have thrown up enough obfuscating babble that election officials are largely mollified.

We no longer have time for that. We must ignore the machine manufacturers’ spurious claims of security, create tiger teams to test the machines’ and systems’ resistance to attack, drastically increase their cyber-defenses and take them offline if we can’t guarantee their security online.

The cynic in me thinks that the two political parties loved electronic voting machines because they saw the opportunity to do industrial scale voter fraud.  Certainly there was a rush to deploy these after the 2000 election.  Of course, security was not an after thought - 15 years later we're still dealing with what was well known at the time.

And now everyone is worried about the Russians rigging an election?  Good grief.

Bring back paper ballots.  You need physical access to tamper with them, so you can't do it from Minsk ...

This is not the future I was promised

I had to reboot the coffee machine in the office.

I support Gary Johnson and Donald Trump, it seems

Take the quiz.

Never heard of Castle, but it seems that I may be closer to him on policy choices.  I voted for Johnson last time around.

(via)

Blake Shelton (with Pistol Annies) - Boys 'Round Here

My wife almost killed me on the John Deere.  That could be a Country song.

We went up to Ohio to get her Dad's lawn tractor.  It was a little exciting using ramps to get it up into the pickup truck, and even more exciting backing it down.  But nothing was as exciting as when she was riding me around and gave it some gas.  It was a good thing that the lawn tractor was on a lawn ...

Every now and again we get our Redneck on.  As you'd expect, there's a song for that.  Blake Shelton said of the song "That song had me from the first, ‘cause I thought about all the guys I know back in Tishamingo. None of them listened to The Beatles. They listened to Hank, or these days you’ll hear Jason Aldean blaring out of somebody’s car coming from a mile away. It’s just how they are, and that song is just written exactly how I live."

Looks like that's how the Queen Of The World and I live, too.  At least this weekend.

The video includes the lovely Pistol Annies, who include the former Mrs. Blake Shelton, Miranda Lambert.



Boys 'Round Here (Songwriters: Rhett Akins, Dallas Davidson, Craig Wiseman):

Well the boys 'round here don't listen to The Beatles
Run ole Bocephus through a jukebox needle
At a honky-tonk, where their boots stomp
All night; what? (That's right)
Yea, and what they call work, digging in the dirt
Gotta get it in the ground 'fore the rain come down
To get paid, to get the girl
In your 4 wheel drive (A country boy can survive)

Yea the boys 'round here
Drinking that ice cold beer
Talkin' 'bout girls, talkin' 'bout trucks
Runnin' them red dirt roads out, kicking up dust
The boys 'round here
Sending up a prayer to the man upstairs
Backwoods legit, don't take no sh*t
Chew tobacco, chew tobacco, chew tobacco, spit

Aw heck
Red red red red red red redneck

Well the boys 'round here, they're keeping it country
Ain't a damn one know how to do the dougie
(You don't do the dougie?) No, not in Kentucky
But these girls 'round here yep, they still love me
Yea, the girls 'round here, they all deserve a whistle
Shakin' that sugar, sweet as Dixie crystal
They like that y'all and southern drawl
And just can't help it cause they just keep fallin'

For the boys 'round here
Drinking that ice cold beer
Talkin' 'bout girls, talkin' 'bout trucks
Runnin' them red dirt roads out, kicking up dust
The boys 'round here
Sending up a prayer to the man upstairs
Backwoods legit, don't take no sh*t
Chew tobacco, chew tobacco, chew tobacco, spit

Let me hear you say
(Ooh let's ride)
(Ooh let's ride)
Down to the river side

(Ooh let's ride…)
Hey now girl, hop inside
Me and you gonna take a little ride to the river
Let's ride (That's right)
Lay a blanket on the ground
Kissing and the crickets is the only sound
We out of town
Have you ever got down with a…
Red red red red red red redneck?
And do you wanna get down with a…
Red red red red red red redneck?
Girl you gotta get down

With the boys 'round here
Drinking that ice cold beer
Talkin' 'bout girls, talkin' 'bout trucks
Runnin' them red dirt roads out, kicking up dust
The boys 'round here
Sending up a prayer to the man upstairs
Backwoods legit, don't take no sh*t
Chew tobacco, chew tobacco, chew tobacco, spit

(Ooh let's ride)
Red red red red red red redneck
(Ooh let's ride)
I'm one of them boys 'round here
(Ooh let's ride)
Red red red red red red redneck
(Ooh let's ride)

(Ooh let's ride…)
Well all I'm thinkin' 'bout is you and me, how we'll be
So come on girl, hop inside
Me and you, we're gonna take a little ride
Lay a blanket on the ground
Kissing and the crickets is the only sound
We out of town
Girl you gotta get down with a…
Come on through the country side
Down to the river side

The "Russians hacked the DNC" story is wrong

At the very least, it is journalistic malpractice and we should consider it wrong until proven otherwise.  Robert Graham (an Internet Security bigwig) posts at length about this:

People keep citing this New York Times article by David Sanger that attributes the DNCleaks to Russia. As I've written before, this is propaganda, not journalism. It's against basic journalistic ethics to quote anonymous "federal officials" in a story like this. The Society of Professional Journalists repudiates this [1] [2]. The NYTime's own ombudsman has itself criticized David Sanger for this practice, and written guidelinesto specifically ban it.

Quoting anonymous federal officials is great, when they disagree with government, when revealing government malfeasance, when it's something that people will get fired over.

But the opposite is happening here. It's either Obama himself or some faction within the administration that wants us to believe Russia is involved. They want us to believe the propaganda, then hide behind anonymity so we can't question them. This evades obvious questions, like whether all their information comes from the same public sources that already point to Russia, or whether they have their own information from the CIA or NSA that points to Russia.

Everyone knows the Washington press works this way, and that David Sanger in particular is a journalistic whore.

There's more, and you should read the entire post.  In my opinion, this is exactly right.  I've been skeptical about this, but anonymous "tips" basically say "trust me".  I'm sorry, but the last decades have shown that we shouldn't trust the Press.