BSides Las Vegas 2016 & More!

BSides Las Vegas is next week, and I'm very pleased to note that a friend and colleague, Nik LaBelle, and I will be presenting Domains of Greys - a talk introducing DNS greylisting.

If you miss that talk, then come up to Skytalks at Defcon on Friday at 11, where ...

more ...

The Modern Bertillion

Biometric factors are not suitable for authentication.

This is a bit of a radical claim - after all, biometrics are traditionally considered to be one of the traditional three factors, being "a thing you know", "a thing you have", or "a thing you are" - but biometrics fail on several very important ...

more ...

Mitigation for Whitelisting Bypass using regsvr32 - "White Register"

A researcher has discovered undocumented functionality in regsvr32 that allows for arbitrary code execution even in otherwise locked-down environments.

Regsvr32, which provides core OS functionality for Windows, has an option available to load scripts from arbitrary network locations.

The researcher's description of exploitation is found here

Please note, the ...

more ...

The Trouble with Sibyls

Reputation systems are a very popular way for people to attempt to address certain very difficult realities of how the internet works. Given a network that puts in contact everyone from the most naive potential victims to the most canny predators, how do you keep safe the one population from ...

more ...

Internet of Asymmetric Warfare

One of the most significant problems facing the tech industry today is that of securing the so-called 'Internet of Things' - the vast mishmash of network-enabled gizmos and tchotchkes that seem to be the primary focus of development efforts today. When there are APIs available for toothbrushes, the likelihood of other ...

more ...

Cui Bono?

The recent announcement by Google of a service to mitigate DOS attacks looks like a very definite benefit for small companies that don't have the resources they need in order to handle that kind of attack themselves. However, this is by no means a charitable offer - Google reaps very ...

more ...

Algorithmic Excuses

Twitter is pushing a change to timelines, to have an 'algorithmic' timeline of 'relevant' content rather than a straightforward record of content as submitted by users. Twitter is also, due to pressure from the US Gov't, claiming to use anti-spam techniques to quash speech by 'terrorist' groups. These two ...

more ...

Malign Attention

One of the biggest hazards to people's livelihood in the current regime of informational propagation is that of being brought to the attention of "the mob" - given the weak-to-nonexistent security on people's PII, a dedicated adversary or set of adversaries can easily find everything that is needed to ...

more ...

Folksec

Information security is a difficult field. It's not only more than a little esoteric in how it works, but the conditions for 'valid' vs. 'owned' change often - much more often, at times, than most people's usual exposure to training for it.

This leads to some unfortunate consequences, where ...

more ...

Adama's Rule

Adama's Rule is a design principle for computer systems that, given the increasing prevalence of computers in traditionally non-computerized products, needs significant attention.

It can be stated thus:

Do not network anything that can kill you.

The name derives from the 'Battlestar Galactica' reboot, where the Cylons (malicious robotic ...

more ...