• 1 Post
  • 1.03K Comments
Joined 2 years ago
cake
Cake day: June 23rd, 2023

help-circle




  • Everybody hates the government, but that take is not applicable.

    Reading the incident report -
    A privileged user got spearphished into downloading a compromised system administration tool. After the compromised tool was detected by industry standard (and modern) intrusion detection software and removed, the backdoor it installed, which was not fixed, was (eventually) used to install a keylogger. Shortly thereafter, another privileged user had a keylogger installed. Afterward, the harvested credentials were used to create further compromises in their network and to move laterally throughout it.

    The age of the equipment or software is not a factor when your admin accounts get compromised. The user that got compromised should have known better, but they literally failed one thing - double checking the veracity of the download website. They didn’t surrender credentials, or fall for any direct attack. It’s not really a government bad, private industry good sort of thing. Heck, if that had happened to a non-admin user, the attack wouldn’t have been possible.


  • The why is sort of at the limits of my knowledge. I can tell you a ‘close enough’ what, though.

    By default, Windows tries to install programs to the program files directory, but that requires admin, which triggers user account control. However, apps that do not require admin to install or run can still be installed to the users profile. Clicking cancel from a UAC prompt will just try to install the program locally instead of for all users.

    My assumption is that many system administrators believed UAC was enough, or that programs installing locally (as in, just for that user) and not requiring admin were not a big deal.



  • This is so pathetic and stupid.

    This isn’t aimed at Russia or China, whom the article calls out by name.
    This is a dick measuring contest with Iran and North Korea.

    I mean - he made the announcement in South Korea.

    Diplomatically, Trump (well, his administration) has stated to learn that befriending and allowing tinpot dictators to humiliate the U.S. is non-viable. So they’ve moved to cold-war era tactics of arms races and implied threats of nuclear holocaust.
    They, of course, are focusing on smaller nations that while powerful in their own right, aren’t actual threats to the U.S. global hegemony. Not that I support continued U.S. dominance on the world stage, but it’s a weird priority.
    Maybe by the end of the admin, they’ll be caught up to Clinton, who realized the best way to apply pressure was economically and via international partnerships — assuming the U.S. has an economy and international partnerships to leverage by then.



  • The social contract is that we do not tolerate intolerance. If someone is intolerant or they tolerate intolerance, they are violating the social contract.

    If she’s calling for tolerance of his views (she is), or is clear that she’s tolerant of his views (again, she is), then she’s breaking the social contract.

    As his wife, she would know his medical history, and would know if he underwent a personality shift. As a politician, she’s expected to represent all of her constituents and have sound judgement, especially in matters of conflicts of interest.
    There’s no more story to know or no mitigating factors. Throw the baby out with the bathwater on this one.




  • A few years ago I noticed an annoyance with a soundbar I had. After allowing it onto my WiFi network so we could stream music to it, it still broadcast the setup WiFi network.

    While dorking around one day, I ran a port scan on my network and the soundbar reported port 22 (ssh) was open. I was able to log in as root and no password.
    After a moment of “huh, that’s terrible security.” I connected to the (publicly open) setup network, ssh’d in, and copied the wpa_supplicant.conf file from the device to verify it had my WiFi info available to anyone with at least my mediocre skill level. I then factory reset the device, never to entrust it with any credentials again.






  • And it’s an act of constant, willful effort by yourself and your community.

    One neighbor is a rental, they are a large immigrant family and are barely getting along. Property owner lives out of country. Another neighbor thought it would be a fun idea to feed neighborhood stray cats. They wound up creating a very healthy breeding family of raccoons out the run-down garage of the rental. For years their offspring have wreaked havoc in our neighborhood. Every fall I’ve had to call a pest control company to trap the tiny raccoons that are small enough to climb downspouts (the big ones aren’t) and destroy the siding and soffits of my neighbors houses. The cat food guy moved away, I figured out how to occlude the raccoons from my downspouts with ample and unsightly flashing, and along with other neighbors, have built or repaired fencing in in our backyards (mostly because of pets and trespassing neighborhood kids, honestly).
    It seems like the raccoon misadventure has finally concluded. I’m now stuck with damaged soffits that squirrels have moved into (on account of a looming walnut tree that lives in a neighbors yard and is so large it overhangs my roof), and a repair estimate that was $5k a year ago, when I had the garage roof redone but wasn’t sure I’d gotten the raccoon problem licked, so I didn’t want to proceed with those repairs. Who knows what it’ll be now. … yay.