Posts by Frumious Bandersnatch

Re: A wonderful name

Blimey. I've never seen so many downvotes for someone making a valid (and interesting) observation on English spelling/pronunciation. Is pedantry dead here on The Register?

You can have my upvote, partly because I just noticed your post after I made a similar comment. We're both in this together :-/

Re: Like Razors ...

http://www.theonion.com/blogpost/fuck-everything-were-doing-five-blades-11056

Re: Well one of the features of Windows used to be...

Eh, I think that you'll find that Display Postscript was developed by Adobe and NeXT. Before Quartz.

Still, I guess you might be right: Apple probably decided to patent it, despite prior art, because ... splines?

Re: Social Media? Sorry, don't use any.

They can have my FriendFace profile if they want.

Hmmm.. I suddenly have the urge to drink another can of Cuke.

Re: Palm Oil

"When will these vegan dreadlock toting flip flop wearing tree huggers think of the trees?"

Or the orangutans!

See my vest, see my vest, see my vest!

Re: memory price rises throughout 2017...similar pressures in the PC DRAM market.

That's because they desperately need cash to counteract their losses in Westinghouse, and they can sell their fab business as a "going concern".

Re: Casey Jones (1863–1900)

Dunno. All I know is, he'd better watch his speed.

Re: USB cufflinks.

A Linux user with a tie?

Don't knock it. It stops my pants from falling down.

Re: Linux kernel doesn't support Realtek RTL8812AU

I think you missed this bit of the article.

That still doesn't make sense to me. Either you're running Kali on a "modem" like those listed (in which case, you can use the wireless hardware), or you're communicating with these things as external devices (in which case, kernel support for the chipset is irrelevant; you talk to them over the standard 802.x network protocols).

Either way, this part of the article is very poorly worded.

Re: Well, we'll look for the house with no numbers.

Yeah, but a running process is <program that's on disk> + <data that's only ever in working memory>. Spawn a shell, install a program in its data space and your solution won't work.

Other posters above suggested that switching the machine off will deal with it. But what if it's a kind of APT ("advanced persistent threat") that can find other local machines where it can also run in memory, maybe even using different exploits or propagation methods? This can act as a backup in case the first machine is power-cycled, then re-infect it using the original exploit when it comes back up. Just like the ancient "Robin Hood and Friar Tuck" hack, except that there's no persistence if both machines are turned off at once.

Putting on my black hat for the moment, not persisting on disk can be a great way of avoiding detection. It's great for initial stages of an attack because you can use it to passively monitor a target network and use that info to plan for future attacks. Chances are this won't trigger any internal tripwires, and even if the probe is found, it won't reveal very much. From there, you can use a variety of different payloads, each working together stealthily using ideas of "quorum sensing" and "oblivious agents".

Quorum Sensing is an idea from bacteria, where individual bacteria take cues from the environment and begin to change their own secretions. The ultimate expression of QS in bacterial colonies is that they can regulate gene expression, so that they become more efficient at thriving in the environment. Apply that analogy to malware and you get to the idea of individual bits of malware using subliminal channels to announce their presence to each other and coordinate with each other to a degree. A simple example of a subliminal channel in a network might be to interact with a caching proxy (be it a web proxy or memcached database proxy or whatever) somewhere on the intranet. By looking at timing differences in responding to a request, each malware agent can basically pick up environmental cues to detect each other's presence. There are doubtless tons of other ways they can implement subliminal channels over innocuous-looking traffic.

Oblivious Agents are bits of code that have an encrypted payload. They take a set of input parameters (such as environmental cues, as gathered above, but it could also include things like the time or the host IP or whatever) and combine them to form a key. They use that key to do a trial decode on the encrypted payload, and if the decrypted message is valid (eg, by checking that it has a valid checksum), they execute it. They're called "oblivious" agents because they don't know (and don't reveal anything) about what exact set of triggers are needed to run a particular payload. And, of course, a defender can't easily decrypt the payload, either. Neither does it have to have just one payload, nor does all the logic have to be confined to being stored in a single malware agent: a payload could be just sending out a certain environmental trigger that ultimately serves to self-repair the swarm, delete itself, or start enacting some new strategic phase.

All of this is much more suited to a spear-phishing attack against a high-value target. It's still fascinating to think about how you could apply techniques like this against certain businesses, banks, military installations or whatever. If it can lay more or less dormant and inactive over a long enough time, there's no telling what it could do. It could, eg, find some long-term persistence technique (so that it can re-infect at a later time if it's discovered), or use a variety of environmental cues, eg, noticing lots of extra emails being sent or other seeing other signs of activity to guess that a North Korean missile site is about to conduct a nuclear test, or even just have some other internal resource (like git repo, active directory server, SCADA system or whatever) as the real target, and delete the bridgehead system once it's done its job.

Hmm. I think that having that black hat on for too long has affected my brain ...

Re: If all else fails...

why hasn't he tried tunnelling out of the embassy

Shh! We don't talk about those "diplomatic channels".

Re: Fake News is pretty old..

Apparently, he also said "Never pick a fight with people who buy ink by the barrel". I can't see how news organs are going to take kindly to Wikipedia scraping and aggregating all their articles and deleting all their revenue-generating ads.

wasn't using sarcasm at all... but irony

FTA:

Since sarcasm often involves humans stating something opposed to their beliefs or wants

Oops.

<sarcasm>Typical Yanks. Can't tell the difference between irony and sarcasm</sarcasm>

<sarcasm><irony>Finally, something to learn Americans to speak English good</irony></sarcasm>

Re: Is it safe?

She probably won't say, but Alaska.

Re: We desperately need a Trump icon.

I suggest something like a cross between a chef's hat and a nuclear mushroom emanating from a "cleftal horizon" (a couple of tasteful curves framing a Y for Yankee).

Re: Plase stop using the word algorithms

I totally agree, Ken. We should be talking about "automated processes" or the like.

It seems to me that the only thing that needs legislating here is in the realm of data protection (or FoI) requests. Let's say that someone is refused insurance cover. I think that it's quite possible and reasonable to make a data request asking the organisation to clarify the factors leading to the decision. I'm pretty sure, though not certain, that this sort of request is allowable and that it should receive a reply.

However, once you start using automated processes, there is a great risk that the organisation being asked for such information will, deliberately or not, seek to obfuscate what their processes are. You'll just get a response "computer says no". If you kick this up to the ombudsman or whatever, there's every likelihood that the organisation will argue two main points: first, they'll say that their algorithms are a trade secret, and second, they'll say that the cost of satisfying the request is excessive. I don't think that the first point needs much comment, but for the second, it's quite possible that they'll be able to make a good excuse: since software is so much more complicated than manual processes (which they'll no doubt have documented as part of their quality certification or whatever), the cost to audit it will be so much more. Since data requests can legally be refused on grounds of cost, this will end up with more data requests being refused, with little or no recourse.

So, as a result, I think that the only changes that need to come about are to ensure that the same transparency standards are applied to automated processes as manual ones. This needs to happen both in terms of privacy/FoI legislation and non-legislative areas, such as ISO quality standards (which I assume is immune to Brexit).

Re: Oh no...

Dumb ways to die (for a more upbeat version)

https://www.youtube.com/watch?v=IJNR2EpS0jw

Re: Reboot

... shouldn't be needed.

The kernel loads itself into memory at the start and then, apart from loadable modules, it doesn't need to re-load (page) itself from disk. The only thing that stops working after installing a new kernel is hibernate. That fails (in the sense of starting to hibernate, but not going through with it) because on the next reboot, a new kernel is in place and it wouldn't make sense to reload the memory image belonging to an old kernel.

Regular programs/services should also be restartable without needing a reboot. Even upgrading loadable kernel modules on the fly is fine because they are (like the kernel) just loaded once and the init system (or something like dbus) knows about dependencies and can restart affected parts of the system in the right order.

Re: er Bribery?

I believe that this practice goes by the nice, friendly name of "'hello' money".

Re: What does he expect?

Thanks, jake, for showing us all that this is a rather nuanced issue---by completely failing to notice it.

Re: forgotten archetypes

where's Mr. Incompetent?

You mean Peter/Mr. Peters?

That, or the court should rule that the DHS was engaging in vexatious litigation.

Surely the NSA knew since ...

The young man stepped into the hall of mirrors

Where he discovered a reflection of himself

Even the greatest stars discover themselves in the looking glass

Re: So about par with the (soon I hope) new Parrallella chip.

Hmmm. I didn't know that Adapteva were bringing out a new model. Last time I checked on their website (around a month and a half ago?) the whole effort looked pretty moribund. While reading this article I was tempted to start messing around with my 16-core board again.

Re: Not to Antigonish anyone....

Flappity, floppity, flip

The mouse on the mobius strip;

The strip revolved,

The mouse dissolved

In a chronodimensional skip.