Slashdot Mirror


User: dirkmitt

dirkmitt's activity in the archive.

Stories
0
Comments
22
First seen
Last seen
Profile
(view on slashdot.org)

Comments · 22

  1. Re: Such an attack might be limited in scope. on NSA Metadata Collection Program Has Stopped Zero Attacks · · Score: 1

    It's an inherent weakness in RSA, to generate random prime numbers. In theory, if the attacker knew what method was being used, instead of trying to prime-factorize the modulus by brute force, he or she could just use the same random-prime generating scheme in their attack, that the defender used, and speed up the attack.

    Hence, true RSA encryption uses only a small subset of the existing, huge prime numbers.

    But then what I'd expect, is that this vulnerability does not extend to users or admins, who were not using the same random-number generating method. In this article: (Suggested Above), the security software was named "BSafe". How would it affect Linux-based Web admins, who never used the compromised generator(s), and who never used BSafe?

  2. Is it possible, that they helped patch Windows... on NSA Metadata Collection Program Has Stopped Zero Attacks · · Score: 1

    In such a way, that it's become harder for unauthorized programs to flash the BIOS at all? In that case, how many attacks they prevented is truly speculative. And the speculation, that they must have patched the BIOS themselves, secretly, would be unfounded.

  3. Re: I apologize for my Error. on NSA Says It Foiled Plot To Destroy US Economy Through Malware · · Score: 1

    I'm sorry that I argued against your idea so energetically - and ultimately falsely.

    I suppose that my information is grossly out-of-date. In response to your most recent posting, I looked up this subject on the Web, and found an article which confirms what you are saying:

    External Reference

    In particular, this article states that a BIOS update can be performed in some cases, by double-clicking on an .EXE File, which is by far different from what I had to do (only in 2011, for a contemporary computer) using a USB stick and an .ROM File.

    But then I must also admit, that the possible answers to the whole NSA question change completely as well. Since the BIOS can be flashed behind our backs, there is indeed little allowing the general public to know whether 'The BIOS Plot' as such was real, nor what the NSA could have done about it. At that point there is some slight plausibility, even for the idea of the NSA having used that - or having used some other back door - to get into our computers.

  4. Re: It's the BIOS, which administers a BIOS patch. on NSA Says It Foiled Plot To Destroy US Economy Through Malware · · Score: 1

    The logical conclusion is if this attack existed at all, it was more likely to be a vulnerability in the BIOS update workflow, perhaps someone managed to penetrate the signing keys of most of the major BIOS manufacturers which would have allowed them to push out apparent BIOS updates to a wide range of computers.

    What you're telling me, is that when I booted my BIOS into Admin mode, after I had given the command to Windows to reboot, when I told the BIOS to Update to a .ROM File, which it finds in the root directory of the USB stick I just inserted, the existing BIOS should have checked the signature of that (new) ROM Image, before accepting it. And so a failure to enforce a signature, would become a failure in the existing BIOS. Which has already been shipped in millions of computers.

    Well while this type of signature-checking does exist with Secure Boot, (a) it requires hardware-support at that, and (b) applies to operating systems, not BIOS ROM Images.

  5. Re: URL: #badBIOS on NSA Says It Foiled Plot To Destroy US Economy Through Malware · · Score: 3, Insightful

    You have suggested we look at the hash-tag #badBIOS , to see the system in action, that deploys PC firmware updates via Windows. This is one of the several articles written on the Web about this, all from the same guy, who goes by the name "Ruiu": Suggested Link What I find the most dubious about all this, is the ability "to transmit small amounts of network data with other infected machines even when their power cords and Ethernet cables were unplugged and their Wi-Fi and Bluetooth cards were removed." Also note, "(badBIOS) has the ability to use high-frequency transmissions passed between computer speakers and microphones to bridge airgaps." Can I be forgiven for not taking such claims seriously? To the best of my own knowledge, (1) Actual BIOS updates are infrequent, not a part of any routine workflow. (2) Even though virus-writers can use them to cripple computers - via a running O/S - SysAdmins can't use them unless they shut down the computer first, precisely because they do not work as described in this article. (3) Attempts are frequently made to bypass Protected Memory on the O/S, to result in viruses gaining access to all the hardware. But this cannot - presently - be used to produce a changed BIOS which works normally. (4) Instead of using floppy disks, we use USB sticks today. We put a file onto that USB drive, which has the filename extension .ROM . It stands for 'a ROM Image'. And because some advanced File Systems require than special drivers be loaded, even in this day and age we format those USB sticks with FAT32, just in case. (5) It's considered gauche, if there is even more than one .ROM File on the stick, even though technically, the BIOS itself, booted into admin mode, displays the .ROM Files in a list, for the user to choose from.

  6. Re: Please define "BIOS Update Workflow". on NSA Says It Foiled Plot To Destroy US Economy Through Malware · · Score: 1

    Since a legitimate BIOS Update, which leads to a working BIOS, takes place between a USB Stick, physically connected to a computer's Motherboard, whose O/S has been shut down, where exactly did the BIOS Update Workflow need to be fixed?

  7. Re: The NSA, after all, does foil some plots. on NSA Says It Foiled Plot To Destroy US Economy Through Malware · · Score: 1

    My observation for the moment would be, that if this thing was disguised as a software- or a firmware-update, it would not seem to have been targeting the most secure servers. Because unlike personal users, server admins don't usually fall for that kind of trick. And thankfully, most of the servers that actually 'run the economy', so to speak, are in the hands of people who can distinguish between a real update, and a fake one. I'm not sure whether those guys actually tend to update their BIOS often though. I'd think that if one of their Motherboards was giving them trouble, they'd just replace a whole server rack - with MBs that did perform well from day 1. /That kind/ of server-room doesn't receive many fake update-requests, of the sort that would fool non-experts, because each server isn't managed by a user as such. In that environment all the servers are managed by something like ~a Hypervisor~ , and most of them don't actually have monitors, to display confusing graphics... But then, how would this request have crippled the Economy? What's described might at best have crippled a whole bunch of PCs, which was the starting assumption of this whole article.

  8. Re: Questioning the logic again... on NSA Says It Foiled Plot To Destroy US Economy Through Malware · · Score: 1

    What your comment suggests, is that a targeted attack is possible against commercially-critical computers, and which exploits a vulnerability for code injection into the BIOS, with the aim of just disabling them. But you are also implying (as was the NSA), that the solution to this vulnerability was with the BIOS itself, _or_ with the Motherboard. And so it's a bit of a foregone conclusion, that the solution is to enhance BIOS-level encryption. AFAIK, Secure Boot etc., limit what types of O/S kernels can boot, based on encryption. I've never heard of Secure Boot blocking an attempted BIOS Flash, only of the Motherboard manufacturers making sure on their end, that functioning BIOS versions re-incorporate Secure Boot. Hence, if you were able to find an incompatible BIOS version that _would_ brick your machine, Secure Boot won't prevent you from inserting the USB stick and doing so. However, if the goal is to prevent arbitrary code execution, that has access to the whole hardware - which it's not supposed to in general - then the responsibility lies with the O/S. Whether the NSA got involved or not.

  9. Re: Arbitrary BIOS-injecting code executions... on NSA Says It Foiled Plot To Destroy US Economy Through Malware · · Score: 1

    AFAIK, result in a BIOS which no longer works. This will be different from a PC, which has been rescued by the NSA, in a way that's obvious to the user.

  10. Re:Flashing BIOS, required a USB-stick in 2011. on NSA Says It Foiled Plot To Destroy US Economy Through Malware · · Score: 1

    Well in addition to owning a dual-boot laptop that was manufactured in 2005, I own a Windows 7 -running PC, which urgently required a BIOS Flash. The reason was, the fact that this Windows-7 box was overclocked as shipped, which is now accomplished via a custom BIOS. Such a custom BIOS already likely has errors, other than the overclocking, causing obvious stability problems. Well in order to do this, I needed a USB Memory Stick, formatted with FAT32, even though this computer was built around 2011. The manufacturer was not able to do it with me, through a running O/S. How would a floppy disk be relevant? But, if all you want to do is brick the computer, then I'd say all you need is a successful attempt to flash the BIOS, while the O/S is running. It's done at that point. Besides which, my overclocked PC proved, that every MB requires its own, exact BIOS version. How did the NSA get all the BIOS versions straight, for presumably millions of computers?

  11. Re: Flashing the BIOS requires an O/S shutdown. on NSA Says It Foiled Plot To Destroy US Economy Through Malware · · Score: 1

    At least, if it's to produce a malware-running BIOS version. But wait a moment. What they wrote, is that the plot from China was only supposed to produce bricked computers. I've mainly heard of computers bricked because the user actually flashed his BIOS - and made some sort of mistake. So an attempt just to brick one could be targeted and might work, with Windows running. In any case, it would be hard for (China) to do this on my dual-boot laptop built in 2005, because I mainly run it in Linux mode, and Linux is so much more resilient to such things. And, I was able to install Linux on it, precisely because it *doesn't* have secure-boot.

  12. Re: Of course they couldn't have done that. on NSA Says It Foiled Plot To Destroy US Economy Through Malware · · Score: 1

    One needs to consider, whether claims that we hear and read are plausible. Just where did the NSA fix a BIOS vulnerability, on one of my computers, which was built in 2005? I never flashed the BIOS on this machine, and neither did they. But we do know that very conspicuously, Microsoft came out with Secure-Boot more recently, and "in cooperation with manufacturers". It's likely that this is what the NSA is referring to - behind some obfuscated ways of speaking...

  13. The real reason for secure-boot. on NSA Says It Foiled Plot To Destroy US Economy Through Malware · · Score: 1

    I suppose that this also means, is that all the Linux computers, installable on PCs without secure-boot, have by now been destroyed by China.

  14. Re:Nein. on Ask Slashdot: Is Samba4 a Viable Alternative To Active Directory? · · Score: 1

    There are alternatives, but they all work differently. Thus between 50 people, I don't see how useful pure file sharing remains. Instead, you might want to go with one of the popular Web Content Management Systems, or WCMS. "eGroupware" is just one, free example. But then don't expect to drag-and-drop files.

  15. Re: ...An imitation of a de-facto standard. on Ask Slashdot: Is Samba4 a Viable Alternative To Active Directory? · · Score: 1

    I think one needs to realize that MS became a de-facto standard, and that Samba is a Linux emulation of it. From what I see here, Samba4 also does Active Directory. But then it becomes a Linux re-implementation of A/D. Is it highly important to emulate pure file sharing at all? I once told myself that file sharing via a File Server may be a wrong approach to some problems, except when I'm copying and pasting some files here at home, between a mere 5 personal boxes. Even between my 5 home boxes, I've run in to Samba hiccups. It's true that Samba is even accepted by my Windows 7 Pro, 64-bit client, while running on a Linux server. But it's a wavelike phenomenon based on Windows popularity. /There should/ be better ways to go, for large enterprises. Mind you as sincere as I am, the main alternatives I can think of, are probably too Linux-centric for you. I.e. you could do an NFS mount, a Unison sync via SSH, some form of WCMS, some form of OpenVPN / SSH tunneling, etc..

  16. What gets taught, doesn't imply comprehension. on Are We Getting Smarter? Rising IQ Scores In the Twenty-First Century · · Score: 1

    People who start out to learn Computing will learn how to 'operate' a computer and its GUI. But there is a huge wealth of knowledge in Computer Science, which does not even pertain to the Graphical User Interface. Thus, certain tests even of 'computing comprehension' today could be flawed, because such tests sample the grasp of statements, while a person may not even know why a statement is valid or not so. 'Abstract thinking' would have been tested in 1912, by a subject explaining in essay form, or to the satisfaction of an examiner orally, of what "I think, therefore I am." means. The question could still be asked of people, why it's important to know this concept, even today. I wouldn't bank highly on 50% of the population giving the correct answer(s).

  17. I'd also want to consider the converse question. on Are We Getting Smarter? Rising IQ Scores In the Twenty-First Century · · Score: 1

    How highly would an average intellect by today's standards, have scored on the first actual IQ tests a century ago? I suspect not so well either.

  18. The sub-test resmbles GUI logic. on Are We Getting Smarter? Rising IQ Scores In the Twenty-First Century · · Score: 1

    I think that computers have a lot to do with it. The way GUIs work, tends to resemble a certain subset of most IQ tests, which measures pattern-matching, and even young people today are basically required to learn how to use smartphones, tablets, PCs etc.. (1) Actual IQ tests may soon need a revamped test for abstract reasoning, which won't resemble the puzzle of how to use an ATM or other menu systems as much. Or which wouldn't resemble icons too much. (2) It would not surprise me if population scores on certain subtests had actually deteriorated over time, because classical fields of knowledge are not being emphasized as much as they once were, such as Ancient History, even though they'd still be relevant. But basic education today has found class time to be so precious, that Modern History or Technology topics need to be taught. I don't see a lot of common people discussing Descarte's Cogito these days, even though some understanding should exist of what it means and where it comes from...

  19. Sound-Scaping is possible... on Ask Slashdot: Hacking Urban Noise? · · Score: 1

    Of course your best approach would be to attenuate the noise. Next, whether you can mask it with PINK noise, depends on how high a noise level you're left with. You can also mask it with more complex, soothing sounds. But the idea of parabolic sound reflectors sounds impractical to me. If the noise level is deafening, forget about trying to mask it. What I once read, many, many years ago, was an Ad for "Transducers" that could be glued to window panes, and which used their own mass for inertia, as a counter-balance to the sound waves they send through the glass. Transducers are not usually designed for the mass consumer, however commonplace they are in Science. This one Ad I once saw, bragged about how hard their glue actually was, so that good sound quality would be preserved. But the idea in the 1990s was, to position this transducer in a corner of the window where it won't obtrude visually, and to feed it with an externally-amplified pair of wires. Your window should play whichever Beethoven symphony your amp will feed it. AND, if that project because 'uninteresting or something', you simply disconnect the little transducer from its signal. You don't try to pry it off again.

  20. Re: The disadvantage of a phone: on Why the Tablet Market is Really the iPad Market · · Score: 1

    You need a provider, and in many cases this means signing a disadvantageous long-term contract. I'm sorry to have replied in two parts, but at first didn't notice the existence of phones as one of your possible arguments against tablets. Also, it may be difficult to weigh whether a technology is worthwhile, /without/ factoring the cost. I chose paying $500 down, over paying $50 /month, which is $600 /year, *plus* so many down, while in my daily life there's *secure* WiFi everywhere.

  21. Re:Tablet market saturated? on Why the Tablet Market is Really the iPad Market · · Score: 1

    I think it depends on whether people have a use for them, or whether those are just supposed to be toys. Mine is a replacement for a Palm, which means I need a computer I can carry around, and a laptop can be too clumsy. As long as users like me exist, there will be a market. I see all the fancier apps and features as mainly a bonus.

  22. Why tablet market is iPad market - *not* . on Why the Tablet Market is Really the iPad Market · · Score: 2, Insightful

    I'm one person who bought a tablet, knowing that it was going to be more expensive than an available iPad at the time. Why? Because I disagree with monopolies. And one reason fw I don't like monopolies, is my belief that competition must always be allowed to exist in some form.

    So while I admit that Apple did invent the tablet computer in its present form, I don't think that this makes them the owner of all tablets.

    I know that this entire comment is counter to what was originally posted, but that's how I see it, and one trend which I've looked upon with disdain, is how strongly Apple enthusiasts forget this idea, just like Microsoft enthusiasts had often forgotten it. The concept against either monopoly was the same, except that many Apple followers see _themselves_ as The Winners now... (*)

    And I'm very satisfied with my Android tablet, without wanting to become another advertisement for one particular brand.

    *) It also fits into my greater philosophy, that Capitalist Societies need to be lead and managed, and should not be left to run themselves. And one failure of recent self-proclaimed Capitalists has been, not to engage in enough anti-trust action.

    What this tends to do is prove their insincerity, not that they truly believe in Capitalism, as if to say "Too much wanting to make Capitalism work is a bad thing. Watching Capitalism defeat itself is a good thing."