Category: Security

Categories
Reading Material Security Tampa Bay

My list of links from class discussions during UC Baseline’s InfoSec week

Photo: The Undercroft sign, featuring the Undercroft’s “mascot” — a stag standing upright in a suit, leaning jauntily against an umbrella, walking stick-style.During the Information Security week of the UC Baseline cybersecurity program, the instructors asked us a lot of questions whose answers we had to look up. As a way to maximize participation, we were encouraged to share lots of links of the class’ Slack channel, which also functioned as a backchannel, as well as a way to chat with the students who were taking the course online.

The links that we shared in class were valuable material that I thought would be worth keeping for later reference. I’ve been spending an hour here and there, gathering them up and even organizing them a little. The end result is the list below.

Since these are all publicly-available links and don’t link to any super-secret UC Baseline instructional material, I’m posting them here on Global Nerdy. Think of this list as a useful set of security-related links, something to read if you’re bored, or a peek into what gets discussed during the InfoSec week of the UC Baseline course!

The links

  • U.S. Department of Health & Human Services: Cyber Security Guidance Material
    A collection of “educational materials specifically designed to give HIPAA covered entities and business associates insight into how to respond to a cyber-related security incidents.”
  • DFIR — Digital Forensics and Incident Response
    “Digital forensics and incident response is an important part of business and law enforcement operations. It is a philosophy supported by today’s advanced technology to offer a comprehensive solution for IT security professionals who seek to provide fully secure coverage of a corporation’s internal systems.”
  • Understanding RPO and RTO
    “Recovery Point Objective (RPO) and Recovery Time Objective (RTO) are two of the most important parameters of a disaster recovery or data protection plan. These are objectives which can guide enterprises to choose an optimal data backup plan.”

  • The 3-2-1 backup rule
    “For a one-computer user, the VMware backup strategy can be as simple as copying all important files to another device – or, ideally, several devices – and keeping them in a safe place. However, for multiple computer systems, things can be (and usually are) much more complicated, especially when it comes to virtual environments containing thousands of virtual machines. To protect physical machines, you would need to perform Windows Server backup or Linux Server backup, which might be difficult without effective backup tools. In these cases, a comprehensive data protection plan should include the 3-2-1 backup rule.”

  • Evaluating Risks Using Quantitative Risk Analysis
    “Project managers should be prepared to perform different types of risk analysis. For many projects, the quicker qualitative risk assessment is all you need. But there are occasions when you will benefit from a quantitative risk analysis.Let’s take a look at this type of analysis: What is it? Why should we perform it? When should it be performed? And how do we quantify risks?”

  • Buffer/stack overflows
  • Here are six basic human tendencies that are exploited in social engineering attacks:
    1. Authority: An attacker may call you pretending to be an executive in order to exploit your tendency to comply with authority figures.
    2. Liking: An attacker may try to build rapport with you by finding common interests, and then ask you for a “favor”.
    3. Reciprocation: An attacker may try to do something for you, or convince you that he or she has, before asking you for something in return.
    4. Consistency: An attacker might first get your verbal commitment to abide by a fake security policy, knowing that once you agree to do so, you will likely follow through with his next request in order to keep your word.
    5. Social Validation: An attacker may try to convince you to participate in a fake survey by telling you that others in your department already have. He or she may have even gotten some of their names and use them to gain your trust.
    6. Scarcity: An attacker may tell you that the first 10 people to complete a survey will automatically win a prize and that since some of your co-workers have already taken the survey, you might as well too.
  • Social Studies – A Lesson in Social Engineering Basics
    As we have become more and more vigilant against clicking on malicious links in suspicious emails, some social engineers have gone back to the classic person-to-person approach. Their basic strategy is to prey on vulnerabilities in human nature.
Categories
Meetups Programming Security

Threat Angler’s “Intro to Docker” online seminar: Friday, Jan. 10, 12:00 p.m.


If you’ve heard of Docker but don’t quite know what it is or why it’s used, check out this upcoming online seminar that Tampa Bay cybersecurity company Threat Angler is putting on this Friday:

This event will provide you with an intro level understanding of containers and how to work with containers using the Docker platform. All skill levels are welcome, but the target audience is those who have no prior exposure to Docker. We look forward to the opportunity to share this knowledge with you!

The webinar happens on Friday, January 10, 12:00 to 1:00 p.m.. You’ll need Zoom to access it.

Categories
Security The Street Finds Its Own Uses For Things

Weaponizing social media with strobing images, Neuromancer, and what we can do

In another occurrence of terrible people weaponizing the internet, a number of assholes posted strobing images to Twitter with the intent of inducing seizures in people with the photosensitive variety of epilepsy. In order to ensure that their intended victims viewed the images, they @-mentioned the Epilepsy Foundation’s Twitter username and included epilepsy-related hashtags in their tweets. Worse still, they did this in November — National Epilepsy Awareness Month — when a larger than usual number of people would be following the Epilepsy Foundation’s Twitter account.

The Epilepsy foundation has since filed criminal complaints against the owners of 30 Twitter accounts with law enforcement, with the intention of ensuring that the perpetrators “are held fully accountable”.

This isn’t the first time that someone has tried this sort of attack against a person with epilepsy. In December of 2016, John Rayne Rivello, who didn’t agree with journalist Kurt Eichenwald’s negative takes on Donald Trump, tweeted a seizure-inducing animated GIF to Eichenwald from an account named @jew-goldstein. The GIF included the text “YOU DESERVE A SEIZURE FOR YOUR POSTS”.

Eichenwald viewed the tweet, as suffered a seizure, as was Rivello’s intent. As written up in The Outline:

According to a federal civil suit filed by Eichenwald against Rivello in Maryland, that seizure left him vulnerable to additional ones; he had another a week later. The second one forced him to increase the dosage of his anti-convulsive medication, despite profoundly debilitating side effects, and he spent Christmas of 2016 in a sedated haze.

Unsurprisingly, Rivello’s defense in the suit is based on the First Amendment, but as the Outline article says in a pull quote:

PUNCHING SOMEONE IN THE FACE COMMUNICATES A MESSAGE, BUT IT ISN’T ONE PROTECTED BY THE FIRST AMENDMENT.

The proceeding has been delayed until January 31, and Rivello is expected to plead guilty.

William Gibson wrote about this in Neuromancer

The idea of deliberately using strobing images on screens to induce epileptic seizures isn’t new. It most prominent use in science fiction that I’m aware of dates from 1984, in a heist executed on the Sense/Net broadcasting corporation by the protagonists and a gang called the Panther Moderns in William Gibson’s cyberpunk novel, Neuromancer:

The Panther Moderns allowed four minutes for their first move to take effect, then injected a second carefully prepared dose of misinformation. This time, they shot it directly into the Sense/Net building’s internal video system.

At 12:04:03, every screen in the building strobed for eighteen seconds in a frequency that produced seizures in a susceptible segment of Sense/Net employees. Then something only vaguely like a human face filled the screens, its features stretched across asymmetrical expanses of bone like some obscene Mercator projection. Blue lips parted wetly as the twisted, elongated jaw moved. Something, perhaps a hand, a thing like a reddish clump of gnarled roots, fumbled toward the camera, blurred, and vanished. Subliminally rapid images of contamination: graphics of the building’s water supply system, gloved hands manipulating laboratory glassware, something tumbling down into darkness, a pale splash… The audio track, its pitch adjusted to run at just less than twice the standard playback speed, was part of a month-old newscast detailing potential military uses of a substance known as HsG, a biochemical governing the human skeletal growth factor. Overdoses of HsG threw certain bone cells into overdrive, accelerating growth by factors as high as one thousand percent.

What can we do?

  • Read the Mozilla doc Web accessibility for seizures and physical reactions and follow its recommendations.
  • On your web pages and applications, consider removing auto-play from animated GIFs and videos.
  • Use tools to screen your video content for seizure-inducing flashing or strobing:
  • If you have the ability, write applications like Epilepsy Blocker, which detects potentially seizure-inducing images and videos. Otherwise, help susceptible people install it on their devices, and help spread the word about it!
  • And finally, if you see people using these kinds of attacks on social media, report and block them. If Gamergate taught us only one thing, it’s that the “ignore the bullies” tactic doesn’t work against online harassment campaigns.

Recommended reading

Categories
Current Events Security The Street Finds Its Own Uses For Things

The 2020 presidential campaigns aren’t ready to fight disinformation. It might be up to us.

In today’s New York Times, there’s a frightening article titled 2020 Campaigns Throw Their Hands Up on Disinformation, which Techmeme succinctly summarizes like so: Campaign staff and researchers say almost no political campaigns, including presidential ones, have teams for spotting and pushing back on disinformation.

Welcome to the downside of the old internet promise that anyone can be a publisher or a journalist: It’s that everyone also has to be an editor, a fact-checker, a media critic, and yes, an investor too.

Start with these basics:

Also worth reading: The Internet Broke the News Industry—and Can Fix It, Too, by Jimmy Wales and Orit Kopel:

The people-powered solution

In the end, what may end up making a big difference is the rise of contributors who care enough to give up some of their time to act as independent fact-checkers and watchdogs. That’s how the Urban Legends Reference Pages got its start, and it eventually became Snopes. Just as social media accounts can be used to spread disinformation, they can also be used to spread the truth. Algorithms have been weaponized against people, but they can also be harnessed to protect them.

Someone’s going to have to take on the challenges that the campaigns and social media networks can’t or won’t do, and as the drivers of the information age, that responsibility will fall to us. Are we up to it?