Sign in / up

* Posts by Chronos

1247 publicly visible posts • joined 21 Oct 2007

Page:

Dangle a DVR online and it'll be cracked in two minutes

Chronos
Reply Icon
Devil

Re: DVR?

I have some DVRs (one Tivo, two Humax) which record locally but as far as I can tell are not visible (at least to Shields Up) to the Internet.

Be very careful with that assumption. You're probably okay with your Tivo and Humax DVRs but most of these cheap CCTV DVR/NVR/IPCs, which is what we're discussing here as it was these which were targeted by Mirai, have a "cloud" feature built into the binary that processes the stream(s). Even if you disable the thing in the config, it'll still ping out to let the mothership know it's alive¹, which is why I said one of the mitigations was to block outgoing packets on MAC. Anything that can tunnel out through NAT/uPnP/firewall can tunnel back in again. ShieldsUp! won't detect stateful connections, only blatantly open ports.

¹Yes, I did verify this on the Hi3518E based cameras and a cheap, shonky Owsoo NVR, watching the resolver logs and sniffing the packets as they hit the brick wall of my router. Since most of this bilge is based on HiSilicon chippery, a safe course would be to err on the side of caution.

0 0
Chronos
Reply Icon
Thumb Up

Re: Clueless users

Thanks for that, Symon. I didn't even know that existed but it looks very useful.

4 0
Chronos

Clueless users

This is one time you really can't level that charge against the consumers. Many of the shonky PoS have hard-coded passwords in their root ROMfs and you simply can't change it without unsquashing the filesystem, messing with crypt, recreating the bin and buggering about with arcane flash commands in u-boot - and that assumes you can get a bootloader prompt in the first place, not to mention knowing the flash layout.

IP cameras based on the ever-so-popular Hi3518E chipset had this right up to the January 2016 firmware release. Worse, the default password was the same across multiple manufacturers. The only solution was to block forwarding at the gateway with MAC filtering or stick them on their own isolated segment.

If you want a decent IP camera, a Pi Zero W with the Picam NoIR, a switchable IR cut filter, a ring of IR LEDs and a decent wide angle lens works nicely. If you need a NVR, use a Pi III with ZoneMinder. All of this shonky rubbish needs to die in a fire.

15 0

Huge Apple news confirmed. Software deal with Accenture is official

Chronos
Coat

News everybody was waiting for.

Yep, I'll sleep tonight. </sarcasm>

2 0

Ad blocking basically doesn't exist on mobile

Chronos
Reply Icon

Re: Don't get your OS from an advertiser

Please stop shoving "Android" into a pigeon-hole. There's Android™ and then there's Android. Even if you don't feel like building it yourself, there is a plethora of options other than stock GoOgle-age. For my device, the Wileyfox Storm (I know, big mistake but I've beaten it into submission), there's Lineage nee CyanogenMod, Dirty Unicorns, AOSP Extended, VertexOS and many others. For a mainstream device such as the Moto <letter> handsets, there's more choice than you can shake a soggy stick at.

For Joe Public, yes, iOS offers advantages. For us lot on t' Reg, custom built Android beats seven shades of excrement out of Apple's walled garden.

2 1
Chronos
Reply Icon
Flame

Re: Stupid ad hurlers haven't learned - repeating history

Sites that have advertising need to have a basic understanding that if I go to their site for any reason it's probably not the best idea to obscure 95% of my view with a random "STAY INFORMED" or other junk pop-up when I land.

The other one that really pisses me off is the pop-over "Sign up to our mailing list!" Yes, just what I need, more irrelevant crap in my inbox. I'm interested in this content now and I'm reading it on my schedule. Thirty minutes down the line I'll be looking at/doing something else. I do not want every single mundane task or research session turning into a life-long obsession, thank you.

As for special deals on whatever they're selling, I probably already have one, which is why I'm there in the first place - and that really didn't turn out well or I'd not be looking for updates or a digital bat with which to beat it to death. Foscam, I'm looking at you. Thankfully, that was someone else's bad decision...

5 0
Chronos
WTF?

ORLY?

We have the technology, we just don't use it

I assume that's the royal "we" because, if not, you're on the wrong web site.

Lineage+AdAway+IceCat Mobile+µBlock Origin. I don't put up with them on my desktop, why should a device with less bandwidth be any different?

5 0

UK.gov wants quick Brexit deal with EU over private data protections

Chronos
Reply Icon
Joke

Re: "But with a fear of UKIPpers yelping at them from the sidelines they went off half-cocked."

Well all I can see was the fear UKIP induced in some in the Conservative leadership to the point they were sh**ting themselves they would lose MP's and/or power.

Am I the only one who thinks UKip should be the British Air BnB? UKip on the sofa, UKip in the hall and I'll kip in me bed. Breakfast is whatever isn't growing green hair in the 'fridge.

This whole process has FA to do with UK voters and everything to do with keeping the Conservative Party united. 1 nation. 1 people. 1 Leader. 1 vision (as Freddy Mercury might have sang).

Magic (kinda)...

If we don't destroy ourselves with our tribalism, in a century or so this will be looked back upon with much hilarity as the concept of "Nation" is explored in history lessons. It seems to me that the vast majority of the rhetoric from both camps is an awful lot of prick waving and not much substance. The reality, then, would appear to be that they're two sides to the same coin: A lot of people using power for personal gain arguing over how to divide up the spoils.

So, business as usual, then.

5 0

GTFO of there! Security researchers turn against HTTP public key pinning

Chronos
Boffin

Trust

It actually makes more sense to pin further up the chain. For example, if I pin to Thawte's intermediate, it's a clear, unequivocal message that I use Thawte (I don't, and other CAs are available) and a certificate issued by, say, Wosign (fat chance) is going to be malicious.

That way you can revoke, regenerate and reconfigure at whim as long as your trust chain remains unbroken.

7 0

Sysadmins told to update their software or risk killing the internet

Chronos
Reply Icon
Devil

Re: I am guessing...

...and nobody will notice the difference.

1 0
Chronos
Reply Icon

Re: BIND >9.7

Aye, but you don't want the new key in there yet if managed-keys is going to work its magic. Right now the new key is in the prepublication state, i.e. published but signed with the old KSK and not being used to sign the ZSK(s). You have until 11th September (a significant date I can only assume was chosen to make it extremely easy to remember) to get your managed-keys stanza into your config.

After this date, I suspect you'll have to manually intervene with the new key because the new ZSK won't have been published and signed, as far as your named is concerned, for the required 30 days but using managed-keys will future-proof the setup.

0 0
Chronos

BIND >9.7

Trivially simple. Ditch your old static trusted-key stanza for "." and add:

managed-keys {

"." initial-key 257 3 8

"AwEAAagAIKlVZrpC6Ia7gEzahOR+9W29euxhJhVVLOyQbSEW0O8gcCjF

FVQUTf6v58fLjwBd0YI0EzrAcQqBGCzh/RStIoO8g0NfnfL2MTJRkxoX

bfDaUeVPQuYEhg37NZWAJQ9VnMVDxP/VHL496M/QZxkjf5/Efucp2gaD

X6RS6CXpoY68LsvPVjR0ZSwzz1apAzvN9dlzEheX7ICJBBtuA6G3LQpz

W5hOA2hzCTMjJPJ8LbqF6dsV6DoBQzgul0sGIcGOYl7OyQdXfZ57relS

Qageu+ipAdTTJ25AsRTAoub8ONGcLmqrAmRLKBP1dfwhYB4N7knNnulq

QxA+Uk1ihz0=";

};

Do it now before the rollover window closes. You need 30 days of old ZSK signed new ZSK (read that carefully, the new ZSK is pre-published signed by the old one) for this to work.

I must confess I scrabbled around in my /etc/bind before finding I'd done it in 2013 :-)

3 0

Google's Android 8.0 Oreo has been served

Chronos
Thumb Up

Oreo

Right again. I really should do the lottery this week.

1 0

So, Nokia. What makes you think the world wants your phones?

Chronos
Boffin

The most important USP

Can you throw it at your annoying mate who is spouting some crap about immigrants and telling you there's such a thing as "Britishness" without a single hard fact to back up his assertions, pick it up, store it and then find it in a drawer seven years later, not only with enough charge to power up to prove it's worth charging but also fully functional?

If the answer to any of the above is "no" then it's not a bloody Nokia. And don't get me started on fixed batteries. I still have devices that use BL-5Cs long after the handsets that created the format have gone from the market.

23 3

Vaping ads flout EU rules, even if to promote healthier lifestyles

Chronos
Reply Icon

Re: Nicotine is not Tobacco

As I said, I don't mind people using Vaping as a substitute for smoking,

Well, thanks awfully for your permission. I'll sleep more soundly knowing I have Alan's tolerance.

1 0
Chronos
Reply Icon
Facepalm

Re: Nicotine is not Tobacco

Vaping is a drug delivery system.

Oh noes! Ban teaspoons before someone mixes their next fix on one!

Just like the language you used there, it all depends on what you load it with. Banning the legitimate use because someone may use it illegitimately simply kills all legitimate use. This is what we've been trying to get Ms Rudd and Ms May to understand about cryptography - you won't stop the scrotes using it, you'll just remove all of the positive benefits.

3 0
Chronos
Reply Icon
Holmes

Re: So presumably Niquitin and that ilk...

Even if you are not a vaper or a smoker, you should be furious - collectively we are all on the hook for the resulting costs.

It's not all bad news, of course. Keeping people smoking lowers the number who manage to reach the ever moving retirement age. Less people retiring, less of that lovely pension pot The City™ have invested in more consumer-rogering you have to claw back or find from the social security budget.

Actual smoking is still a net gain. From the top of my head, 2011-12 tobacco taxes gathered £12bn. Tobacco use cost the NHS £5bn - and most of that is not the cost of the compounds used in the interest of patients, more the compound interest on the money used to access the patents...

4 0

Marcus Hutchins free for now as infosec world rallies around suspected banking malware dev

Chronos
Reply Icon
Facepalm

Re: Blind support

He's a security researcher. How else is he supposed to make a living? Begging?

In answer, though, yes I did read it. I don't necessarily believe it or ascribe the same motivations to it that you obviously do but then I have this a{rse|ss]hole thing I do called "thinking for myself" which is probably the next big thing to have "The War on" added to it. What we'll probably never see is The War on Wars on Things, which is a shame as it falls so prettily from the tongue...

3 1

'Real' people want govts to spy on them, argues UK Home Secretary

Chronos
Reply Icon

Re: I wonder if the "Would you make Pi = 3" argument could work?

The problem there is you would only get this in reply:

"What sort of pie? I usually cut them into four, not three."

2 0

Linus Torvalds pens vintage 'f*cking' rant at kernel dev's 'utter BS'

Chronos

Google

I'm wondering how relevant is the fact that this comes from the Googleplex. Very is my guess. As far as I can tell, Linus sees the checker halting the machine with a BUG() where a WARN_ON and continue would be more appropriate. That trips my tinfoil hat into thinking Google prefer the machine to stop rather than allowing a potential root vector (Android, given that they've expressed a recent interest in taking back control of their OS) whereas Linus wants bug reports and meaningful information which require the machine to still be in a somewhat accessible state rather than limiting the user's access to her own bloody hardware.

In this instance, Linus is bang on the money.

28 2
Chronos
Reply Icon

Re: Big egos make bad code.

What's that in imperial arse-loads?

10 1

Intel loves the maker community so much it just axed its Arduino, Curie hardware. Ouch

Chronos
Reply Icon

Re: @Dwarf

@Dwarf

I did indeed miss your point and it now makes sense. For educational use, Atmel is the only choice.

3 0
Chronos
Reply Icon
Pint

@Dwarf

Well, there's also the ESP8266 in all its guises and the STM32, which runs at 72MHz, is far less fragile, runs on 3V3 and doesn't crap itself after a heavy debug session yet costs around £2 for the F103 "blue pill" modules.

The ESP has 802.11n built in and massive community support. Both can be integrated into the friendly Arduino IDE. Intel's stuff was barely relevant anywhere.

Don't get me wrong, the Atmel based boards are great for starting out, they're just rather light on RAM and flash - the STM32 has 20k and 64k (officially, but most blue pills have 128k flash) to the Mega328's 2k and 32k, so much so that you often find yourself running out of dynamic memory on the pro mini and nano, not to mention just two interrupts. Both the SoCs I mention have the ability to attach an interrupt to most of their GPIOs.

I'll still get a beer in, though.

4 0

Ten new tech terms I learnt this summer: Do you know them all?

Chronos
Reply Icon

Re: I am still waiting

I thank you, sir. It's definitely parody. I wouldn't inflict that kind of thing on people intentionally, especially not on a Friday.

6 0
Chronos
Reply Icon

Re: I am still waiting

Innovative. Will you be leveraging the existing competences of the digestive tract to usher in a new paradigm of goal-focused nutritionalisation, a value-added proposition to enhance the projected earnings potential for steak-holders?

38 0
Chronos
Thumb Up

T|N>K

How can you discuss policy with a minister whose only means of expression is to scream at you "Eeeeeeeeeeeee-oooooooo buh-doyngg buh-doyngg eeeeee-AAAAAAHHH!" before promptly hanging himself?

Absolute bloody genius. I'm assuming, since he does the gain adjustment bit, that he's a v.92 modem?

52 0

Media mogul Murdoch's 'Sky dataset' swallow poses 'grave threat'

Chronos
Facepalm

Please ignore the elephant...

The letter says that if that information [TV viewing, phone, Internet records] should "fall into the hands of an owner with an appetite for political leverage, the temptations and opportunities for misuse become very great indeed".

And they wonder why so much opposition to the government having "opportunities to misuse" very large datasets of public activity. Appetite for political leverage? By definition, that includes every person ever elected to government and every civil servant with a pulse.

8 0

Linus Torvalds may have damned systemd with faint praise

Chronos
Reply Icon
Thumb Up

Damning with faint praise: You're doing it right.

10 0

Microsoft drops Office 365 for biz. Now it's just Microsoft 365. Word

Chronos
Mushroom

Have you read the blurb on their blog?

Jesus tittyfucking¹ Christ, it's like someone was playing buzzword bingo and just spewed the winning card onto the web server. They do try their best to make mundane, soul-destroying, humdrum crap sound really exciting - usually by making up new words.

The bottom line is still "give us your cash and we'll give you a permanent headache" though.

¹ Sorry, I don't usually pepper my posts with the f-word if I can help it but I'm afraid, having tried to read that mush, I needed an expletive commensurate with the crimes against humanity committed on that blog.

9 2

BOFH: That's right. Turn it off. Turn it on

Chronos

Scarily realistic.

19 0

Feelin' safe and snug on Linux while the Windows world burns? Stop that

Chronos
Reply Icon

Re: Crickbait

Quite possibly, patrickstar. I don't, though. I usually blame the user, since it's ultimately the user's responsibility not to click unknown links, open unexpected attachments and generally act like a bellend. Granted, there are times when it's the admin's fault and there are times when it really is Microsoft's fault, given that most of the services are embedded into the OS. That said, it's still the admin's job to disable any that aren't needed.

Ultimately, whose fault it is matters less than having the right information to mitigate holes. Playing the blame game only gets in the way, which brings us back to my original point.

9 1
Chronos
Linux

Crickbait

Saying embedded systems and systems with "sysadmins" who don't patch is somehow a Linux problem is akin to saying that it's Ford's fault so many of their cars break down due to people using crap oil from supermarkets.

What this actually is is a money problem. "We've done the R&D, we have a product, flog it. Updates? WGAF? We've got their money."

One more reason I run LEDE. I'm not relying on anyone else for my security.

10 1

Bonkers call to boycott Raspberry Pi Foundation over 'gay agenda'

Chronos
Flame

As a member of the probable target demographic...

...white, middle-aged, heterosexual male, I have never read such a load of alt-right tosh as this petition in my life. However, given the dearth of supporters, it does give me some hope that humanity is becoming more accepting of diversity as a positive step towards truly being civilised.

10 0

Backdoor backlash: European Parliament wants better privacy

Chronos

As ye sow...

I wrote in April last year

For the avoidance of doubt, "free" is simply a have now, pay later with your privacy deal. It's worth remembering, when June rolls along, that we didn't even have a right to the expectation of privacy before the HRA 1998. Ms May&co wants to repeal that[1] but even that would be a pointless gesture until the shadow of the ECtHR is removed. Be careful with that vote, folks. You may have someone's eye in.

OTOH, I can't help wondering if Call-me-Dave's special exception on closer political integration renders that a moot point.

[1] George Carlin once said a right isn't a right if someone can take it away. It's just a temporary privilege.

I'm getting too bloody good at this prediction lark, unfortunately.

0 0

BOFH: Halon is not a rad new vape flavour

Chronos
Thumb Up

The BOfH hippocratic oath

Allow no harm. Defenestrate 'em before they do any more..

24 0

Look who's joined the anti-encryption posse: Germany, come on down

Chronos
Reply Icon

Re: Hahahahah

Snowy wrote: A backdoor in encryption is an open door making encryption less than worthless.

Spot on. It's a false sense of security and it'll be the oblivious masses who will be bitten on the arse by this when (not if) they lose control of that backdoor.

29 0

Human-free robo-cars on Washington streets after governor said the software is 'foolproof'

Chronos
FAIL

Only a fool

...declares anything foolproof. Nature will always evolve a "better" fool.

2 0

Infosec guru Schneier: Govts will intervene to regulate Internet of Sh!t

Chronos
Reply Icon
Alert

Re: Others problems first

I'd start with consumer routers, personally. Once your edge gateway is secure it can police everything else. Forget shiny boxes and wireless range, make the damned things fit for purpose first. Step one: make forwarding packets either way to ports 137-139 and 445 blackhole routes by default. Not reject or ICMP unreachable, blackhole. While it's wondering where its packet has gone, it's leaving someone else alone.

And can we please stop enabling uPNP out of the box? It makes setting up C&C links trivial for any slightly clueful villain.

9 0

UK PM Theresa May's response to terror attacks 'shortsighted'

Chronos
Reply Icon

Re: Trying to analyze the response is pointless

Voland's right hand wrote leveraged

Go and wash your mouth out or, before you realise what's happening, you'll be talking about paradigms and synergistic strategies.

Apart from that, you're not wrong.

0 0
Chronos
Reply Icon

I can see your point, tiggity, and I'll be the first to admit that the current resource usage on this planet is unsustainable but the figures don't add up. Either all the lights go out and we go back to the most popular car being An Ox or someone has to come up with a fully-arsed solution which will probably involve nuclear, wind power, hydroelectric, hydrogen and proper integrated management of those generating sources (nuke for baseload, hydro/wind for in-fill, surplus wind at off-peak times used to pump back up the hydro and electrolyse sea water into H2, which may then be used for transport and the resultant pure water harvested back at the filling station so every vehicle becomes a mobile desalination plant as a side effect) rather than just dumping it onto the grid. Yes, that will probably mean renationalisation of the power generating facilities, if for no other reason than to put them all on the same page in the hymn book.

There's also the urea fuel cell. Wind and piss are two things this country is never short of.

1 0
Chronos
Reply Icon

I would love to be able to support the Green Party, but I can't get past the constant quoting of fuzzy facts and the inability to understand the difference in generating capacity between rooftop solar panels and what this country actually needs. You can't make adults numerate, especially when they don't want to be.

This is my exact problem. I have a few panels and I know what they generate as I built the MPPT tracker that keeps an eye on them. Factoring in the cost and the resources used to make the things in the first place, they don't really make financial or ecological sense. It's the same story with electric cars. Mining the raw materials, shipping them to Japan, making Li_Ion cells and then shipping them to Tesla is not ecologically sound, even if the electricity that recharges them (500 times or so before they're stuffed and the whole wasteful cycle starts again) was renewable, which there's a fairly good chance it wasn't.

Just like Ms May's "reaction" to these latest exceptions that prove evolution, it's all "to be seen to be doing something." Nobody cares if it's actually effective, it's just a sop to the PR people.

Well, hopefully it's just a sop or we've got a real problem with both the major parties deliberately steering us into 1984 with knobs on.

4 0
Chronos
Reply Icon

You forgot the Green Party, if you can get past the short-sightedness of their energy and transport policies. What better way to address that than from within? Those have arisen due to too many idealists and not enough engineers.

I'm half tempted myself...

3 2

UK PM May's response to London terror attack: Time to 'regulate' internet companies

Chronos
Trollface

Typical

The icon says it all. Do they not realise they're being trolled into curtailing our freedoms and civil liberties? Either this is just another excuse to tighten the elite's stranglehold on power or they're all (as Labour did exactly the same thing - remember Whacky Jacqui and Andy Burnham?) thick as two short planks. Hanlon's razor suggests I should take the latter view.

It can be summarised thus: "A group of radicals want to oppress the people with their anti-freedom views so we'll get in and do it first."

11 0

ESA astronaut decelerates from 28,800kph to zero in first bumpy landing

Chronos
Headmaster

Ob nitpick

Zero? Only if the planet, the solar system and the galaxy stop moving from the origin point of the Universe. It's all relative. Or relatives on a Sunday, unfortunately.

1 0

Utah fights man's attempt to marry laptop

Chronos

Let him.

Then infect his laptop with a trojan that makes it file for a divorce. It owns half of his worldly possession at that point. Stupid needs to have real world consequences, I think.

2 0

'Major incident' at Capita data centre: Multiple services still knackered

Chronos

As Battery Sergeant Major Williams said...

Oh dear, how sad, never mind.

2 0

UK ministers to push anti-encryption laws after election

Chronos
Reply Icon
Thumb Up

@Graham Cobb

This. Well said, sir.

5 0

Go ahead, stage a hackathon. But pray it doesn't work too well

Chronos

So, in conclusion...

We should stifle innovation and stall the betterment of humanity for the "corporate good" and, if we can't, we should use the law to nuke ideas from orbit. I see. Now I begin to understand why large organisations tend to become such a morass of bureaucracy, paranoia and incompetence, why their output often ends up sucking massive donkey balls and what is horribly wrong with the patent system and employment contract practices (all your brain are belong to us).

There are literally no words that do the depth to which this philosophy sinks justice.

2 11

Bye bye MP3: You sucked the life out of music. But vinyl is just as warped

Chronos
Reply Icon
Trollface

Re: Rather than like buying a BMW

I know it's anode joke but there's a filament of truth in it...

7 0
Chronos
Reply Icon
Coat

Re: Rather than like buying a BMW

16 valves: All of them in the radio, eh?

6 0

Page: