Ironic thing, when I did that for a recent job, the interviewer said, "This is about you hiring with us, not the other way round." Needless to say, I found employment elsewhere.
I can see about using this for a general purpose desktop. Gaming performance is "meh"... but good enough. Two M.2 cards means decent SSD ability, or if the NUC supports it, RAID.
For something to toss in a cabinet and work as a VM server, similar. Disk performance for small VMs would be decent from the M.2 SSD, and with USB and Thunderbolt, one has many options to pick one's poison when it comes to additional storage, be it a USB HDD, a NAS, or if one wants to spend the dough, go for more TB3 external stuff. Plus, even if it did make noise due to a fan, the NUC could be stuffed somewhere ventilated, but out of the way.
Depends on what the product is. Enterprise level desktops, if I have time, I like running a Linux CD boot to zero out HDDs or blkdiscard -s SSDs, then PXE booting the desktop so it can load an image. This way, I'm sure no data is present that shouldn't be there.
Personal stuff, same thing. However, I use an imaging utility (Ghost, CloneZilla) to save the contents of the original HDD off, as there might be a driver on the original OS load that isn't available for downloading. Then, the SSD gets completely trimmed, and I install the OS from scratch. Even Macs, I zero out the storage, then boot El Capitan from a USB flash drive, so I know the machine is clean.
It is one of the few AV products that runs on Linux, Solaris, and AIX. Not that LPARs or LDOMs will be getting viruses anytime soon, but it is necessary for making the legal eagles happy and checking the "all machines, logical and physical, have AV running on them" box.
It is far easier to just toss McAfee on there than to try to explain or write exceptions to an auditor.
Two different points. If one has a clue, it isn't hard to ensure that a VM doesn't have access to the management network. However, if there is a weakness in the hypervisor, a rogue/compromised VM getting access to that isn't a good thing.
However, being able to use DRS so a VM physically runs on a box (perhaps to use a hardware security hole with the physical CPU like RAM row hammering) is one attack vector that can come into play. It is relatively minor, but it is present.
Virtualization is one of the biggest defensive tools we have against compromise. From being able to roll back or discard/spin up a VM if it is compromised to popping snapshots of disk and memory and scanning those for running malware, or just to keep bad stuff from trying to flash firmware to a real device like a bare metal hard disk, virtualization is a must.
My concern is that it isn't just the ESXi hypervisor that keeps the bad guys out. There are four main hypervisors out there that need to be looked at: ESXi, Hyper-V, Linux KVM, and Xen, with Xen giving way to KVM. There are also containers like LXC and Docker that are important as well. I can see KVM being more of an issue over time as OpenStack goes from "cool toy" to production quality.
The good thing is that hypervisors in general have a limited attack surface, run relatively few applications, and tend to have a better focus on security than general operating systems.
I can see a VM playing games with hitting the vCPU hard so DRS rules kick off and bounce the VM around to different physical ESXi boxes, and then using timing techniques, check to see which ESXi box it is sitting on, in order to move to a particular node in a vSphere cluster.
If a VM can get access to the management interface [1], that would be a game over. From there, it would be a matter of brute forcing users (although 6.0 will lock the account for 120 seconds after ten bad guesses) to get access to critical stuff.
[1]: Other than being explicitly configured to have access, via SR-IOV or a vSwitch.
My issue is that there are good ways to push updates, and there are bad ways. My experience is that companies will use the least expensive and most insecure ways possible in general, unless held to task by someone that matters (VISA and PCI-DSS, or the government.)
Want to do the upgrade proper? It just doesn't need to be signed, but signed by a computer that is air-gapped. The update process should be atomic (i.e. either the update completely succeeded, or it is rolled back.) There has to be no middle ground, no matter what. Even if the battery gets yanked during the updating process, the vehicle still must be able to load its ECM firmware and run.
I just fear a vehicle deciding to upgrade while on the road, then the next time the engine is shut off... it never turns back on, meaning a tow to the dealership and a multi-thousand ECM replacement because of some edge/corner case that never was looked into (such as a cellular handoff when downloading the flash, or a hard block error on a flash storage cell.)
I can see MS pushing W10 to non-genuine or copied of W7 that are in a 30 day activation (re-activated with slmgr/rearm) states. Just because one can't reset the rearm count in W10 by just booting to a WinPE prompt like you do in W7.
iOS, yes. OS X, you can turn off kernel signing and other features fairly easily.
As for other operating systems, one can copy the BootCamp drivers to a USB flash drive, boot up Linux or Windows, and install the OS without any need for OS X on the drive whatsoever. It may not be a true UEFI boot... but it will run with few issues.
No platform is perfect. However, OS X is a decent alternative, if one is tired of the MS stuff.
That is strange. I seem to have dodged that running W2012R2 on the desktop. The difference might be that I activated my copies via MAK rather than bounced them off a KMS server, and I would guess GWX checks the activation state (for example, if a VM is sitting in 30 day demo mode on W7, it won't ask to upgrade, while if it is activated by MAK or KMS, it will prompt.)
Makes me want to spin up a VM and see what happens if W10 gets installed over W2012R2 with full services running, just to see the trainwreck in action, if it doesn't error out at the last minute.
Encouraging startups is just good business. Eventually something will turn out that will revolutionize things, and this project might just move the world technical design mantle from the US to China, similar to how in the 1990s, so many startups popped up, most failed... but a lot still remained which gave useful products.
One of the biggest problems in the US is that there is a failure to understand that eating your seed corn is stupid. You have to plant crops in order to expect a meaningful harvest later on... and with China getting entrepreneurship off the ground, they will have new and cool stuff, eclipsing Silicon Valley.
It might just be useful, especially if oil/gas prices skyrocket making transportation of goods prohibitively expensive. Having stuff made locally/regionally can not just cut down on shipping, it can add to customization, although it is hard to beat economies of scale that we have now, but with advances in metal sintering, and machines that can sinter, then machine (additive/subtractive), it may be cheaper just to make specialty parts nearby.
I wouldn't scoff at China. During 2008, when the economy tanked, they put money into infrastructure and laying fiber... not "shovel ready" projects and crushing perfectly working cars. This has paid off in spades for them, and will do so for the long term.
The conventional antivirus has became all but useless to deal with the latest zero-day threats. At best, an AV program is useful for scanning a download for a potential Trojan... but even with that, one is better off just using VirusTotal if the executable is small, or use the MD5/SHA hash if the file is bigger.
I'd like to see an AV program actually do something useful:
1: Filter by IP address. This is especially useful with third party malvertising which is a large infection vector. 2: Set kill bits and disable site cookies, similar to SpywareBlaster's functionality. 3: Scan via executable signatures and look for unsigned stuff that isn't whitelisted by the user. 4: Boot from Windows PE so Bitlocker can be unlocked, scan the machine offline. 5: Have the ability to run on the hyperviser level, so VMs can be checked for RAM-resident stuff and suspended/rolled back. 6: Have the option to act as a "file firewall", (turned off by default, so a user doesn't get used to blindly clicking 'allow' as with the earlier ZoneAlarm type software) so software that isn't normally set to access a certain filetype (for example a game grabbing Word documents in the user's Documents directory) would prompt the user with the details of what is being done (reading, overwriting, etc.) This would act as pushback against ransomware. 7: Offer more than just AV functionality. Having the program also be able to function as a client so a user can have a backup server that "pulls" documents as further protection from ransomware would be nice. 8: Money is important, but perhaps do like some programs, allow manual updates, and charge for automatic updates/automated scanning, cutting the annoying dialogs to as low as possible. For minimizing impact on servers, signed binary diffs for the signature files can't hurt. Having enterprise versions with no expiration of signatures can't hurt. 9: Offer enterprise functionality, such as pulling signatures from a local server, audit logs, and other items to help organizations with compliance. This should be available in every version, not just "enterprise" versions. 10: Focus on being out of the way... software that is designed to be made part of a WIM install image where it is installed and forgotten about... until there is a meaningful alert.
It looks more and more like a Vagrant install of Windows that uses a PowerShell provisioning script to auto install Chrome, an ad blocker, might just be the way to go. This way, every time the machine is dropped and brought up, it has a new install ID and items present.
Ideally, the Web browser should feed websites bogus, random data about what is installed and what isn't.
I just want a web browser that doesn't register as unique when you visit eff.org's Panopticlick. The only way to deal with fingerprinting these days, is to have multiple VMs, and vagrant up your VM for web browsing, erasing it and bringing it back up every so often to minimize how often one fingerprint is used.
Some browser that randomizes the order of add-ons presented to the server, fonts, and perhaps turns on and off fake add-ons as well.
From what I read from the OP, he wants a wall clock that keeps in sync. The first thing that comes to mind would be the Android tablets as posted above, as they can be synced via the cell network or NTP.
This might just be a niche market. Take an Arduino with Wi-Fi capability, add an inexpensive LCD touchscreen, add some code to handle timezones, manual time setting, and so on, and call it done. Toss in a FONA cellular antenna/modem whose sole purpose in life is to get the time from the cell network for accuracy, and that is another avenue of getting things working if Wi-Fi connections are not doable.
Seems in cases like this where the Trojan is entirely in RAM, the best defense would be to have a RAM scanner on the hypervisor level that would scan VMs for things like this, and if found, suspend/snapshot the VM, and allow recovery via various methods (continue with the VM, shut the VM down and run a scan against the disk image, roll the VM back to a safe snapshot, etc.)
With ransomware also a threat, having AV on the hypervisor level can likely be the best defense, especially with VM snapshots coupled with snapshots of shared filesystems.
That is a good idea. The closest to this is.com, because the "land rush" has long since petered out. However, it would be nice to have a special TLD that has a distinct color when the web page is viewed (similar to EV SSL certs), and can be used in combination with EV. Some rules that sites must follow would be things like using SSL/TLS for all web traffic (other than the initial HTTP redirect to the secure site), staying updated to security levels, some concrete proof that the site is whom they claim to be given to the TLD owner (copies of the DBA), and so on. Ideally, it would mean sites are required to meet a security standard like PCI-DSS3.2, HIPAA, CJIS, FISMA, or some other known standard of security (where violating it will mean actual pain rather than a slap on the wrist.)
Of course, who is the gatekeeper for this domain? Ideally, it should be multiple domains so one country doesn't have the keys to the city for another. Perhaps some form of the TLD of the country with a character before it, like xde, xus, xco, so it is obvious it is a different domain, but the country of origin is standardized.
Daybreak (formerly SOE) had technology in EQ2 and EQ:Next where it would map your facial expressions onto your character's. Called SOEMote, it fell right into the bottom of the uncanny valley, but was an interesting thing to play with.
With power suspend technology, SSDs, CPU cores shutting parts off when not in use, and other power management abilities, it really doesn't make that big a difference. For example, Macs and most laptops will suspend after a period of time idle by default. Even on, a machine doesn't take much power, especially with modern SSDs where it has no moving parts that need to be powered other than a fan or two.
In the past, with CRT monitors and 5.25" HDDs that sucked up a large amount of power spinning the disks, it was a different story, but these days, there is a diminishing returns between powering everything off versus just letting the box suspend/idle.
Were it not for the need for A/C without a complete redesign of a house (and no, swamp coolers don't work in humid areas), most places in Texas could run off-grid with a rooftop panel array, coupled with a propane tank.
On a small scale, a few panels on the roof, a couple AGM batteries, a MPPT charge converter, and a PSW inverter can be used to add a dedicated circuit so low-draw devices can use that, and not suck off the mains power. Add a bit more wattage, you have a dedicated, clean power circuit that your computer can use, regardless of the status of mains power. Tile the roof with panels, you can use a PowerWall or other storage battery methods (there are YouTube vids on what the forklift batteries can power. Even if they hold a fraction of the charge as they did new, they still can run a lot of stuff.) Instead of buying a "smart" fridge, one can buy a fridge that switches between propane and electric, using a gallon of propane every 4-5 days. Alternatively, one can run a high efficiency fridge from solar as well.
Net metering is better than nothing, but it might be better to just run solar in an off-grid capacity, where mains power is only used to keep the storage batteries topped off. This may not give you a negative bill come low-use times, but the homeowner will still benefit from it greatly.
End to end encrypted... how? In theory, even if the messages are stored encrypted in the client, FB, et. al. could be forced to push a patch to add an ADK, not encrypt, or other means.
The ideal is to have the encryption layer separate from any messaging layer. This is why I like PGP/gpg. It encrypts/decrypts, and doesn't really give a care about what protocol is uses.
Slashdot Mirror
Ironic thing, when I did that for a recent job, the interviewer said, "This is about you hiring with us, not the other way round." Needless to say, I found employment elsewhere.
I can see about using this for a general purpose desktop. Gaming performance is "meh"... but good enough. Two M.2 cards means decent SSD ability, or if the NUC supports it, RAID.
For something to toss in a cabinet and work as a VM server, similar. Disk performance for small VMs would be decent from the M.2 SSD, and with USB and Thunderbolt, one has many options to pick one's poison when it comes to additional storage, be it a USB HDD, a NAS, or if one wants to spend the dough, go for more TB3 external stuff. Plus, even if it did make noise due to a fan, the NUC could be stuffed somewhere ventilated, but out of the way.
Depends on what the product is. Enterprise level desktops, if I have time, I like running a Linux CD boot to zero out HDDs or blkdiscard -s SSDs, then PXE booting the desktop so it can load an image. This way, I'm sure no data is present that shouldn't be there.
Personal stuff, same thing. However, I use an imaging utility (Ghost, CloneZilla) to save the contents of the original HDD off, as there might be a driver on the original OS load that isn't available for downloading. Then, the SSD gets completely trimmed, and I install the OS from scratch. Even Macs, I zero out the storage, then boot El Capitan from a USB flash drive, so I know the machine is clean.
It is one of the few AV products that runs on Linux, Solaris, and AIX. Not that LPARs or LDOMs will be getting viruses anytime soon, but it is necessary for making the legal eagles happy and checking the "all machines, logical and physical, have AV running on them" box.
It is far easier to just toss McAfee on there than to try to explain or write exceptions to an auditor.
Two different points. If one has a clue, it isn't hard to ensure that a VM doesn't have access to the management network. However, if there is a weakness in the hypervisor, a rogue/compromised VM getting access to that isn't a good thing.
However, being able to use DRS so a VM physically runs on a box (perhaps to use a hardware security hole with the physical CPU like RAM row hammering) is one attack vector that can come into play. It is relatively minor, but it is present.
Virtualization is one of the biggest defensive tools we have against compromise. From being able to roll back or discard/spin up a VM if it is compromised to popping snapshots of disk and memory and scanning those for running malware, or just to keep bad stuff from trying to flash firmware to a real device like a bare metal hard disk, virtualization is a must.
My concern is that it isn't just the ESXi hypervisor that keeps the bad guys out. There are four main hypervisors out there that need to be looked at: ESXi, Hyper-V, Linux KVM, and Xen, with Xen giving way to KVM. There are also containers like LXC and Docker that are important as well. I can see KVM being more of an issue over time as OpenStack goes from "cool toy" to production quality.
The good thing is that hypervisors in general have a limited attack surface, run relatively few applications, and tend to have a better focus on security than general operating systems.
I can see a VM playing games with hitting the vCPU hard so DRS rules kick off and bounce the VM around to different physical ESXi boxes, and then using timing techniques, check to see which ESXi box it is sitting on, in order to move to a particular node in a vSphere cluster.
If a VM can get access to the management interface [1], that would be a game over. From there, it would be a matter of brute forcing users (although 6.0 will lock the account for 120 seconds after ten bad guesses) to get access to critical stuff.
[1]: Other than being explicitly configured to have access, via SR-IOV or a vSwitch.
My issue is that there are good ways to push updates, and there are bad ways. My experience is that companies will use the least expensive and most insecure ways possible in general, unless held to task by someone that matters (VISA and PCI-DSS, or the government.)
Want to do the upgrade proper? It just doesn't need to be signed, but signed by a computer that is air-gapped. The update process should be atomic (i.e. either the update completely succeeded, or it is rolled back.) There has to be no middle ground, no matter what. Even if the battery gets yanked during the updating process, the vehicle still must be able to load its ECM firmware and run.
I just fear a vehicle deciding to upgrade while on the road, then the next time the engine is shut off... it never turns back on, meaning a tow to the dealership and a multi-thousand ECM replacement because of some edge/corner case that never was looked into (such as a cellular handoff when downloading the flash, or a hard block error on a flash storage cell.)
I can see MS pushing W10 to non-genuine or copied of W7 that are in a 30 day activation (re-activated with slmgr /rearm) states. Just because one can't reset the rearm count in W10 by just booting to a WinPE prompt like you do in W7.
iOS, yes. OS X, you can turn off kernel signing and other features fairly easily.
As for other operating systems, one can copy the BootCamp drivers to a USB flash drive, boot up Linux or Windows, and install the OS without any need for OS X on the drive whatsoever. It may not be a true UEFI boot... but it will run with few issues.
No platform is perfect. However, OS X is a decent alternative, if one is tired of the MS stuff.
That is strange. I seem to have dodged that running W2012R2 on the desktop. The difference might be that I activated my copies via MAK rather than bounced them off a KMS server, and I would guess GWX checks the activation state (for example, if a VM is sitting in 30 day demo mode on W7, it won't ask to upgrade, while if it is activated by MAK or KMS, it will prompt.)
Makes me want to spin up a VM and see what happens if W10 gets installed over W2012R2 with full services running, just to see the trainwreck in action, if it doesn't error out at the last minute.
Encouraging startups is just good business. Eventually something will turn out that will revolutionize things, and this project might just move the world technical design mantle from the US to China, similar to how in the 1990s, so many startups popped up, most failed... but a lot still remained which gave useful products.
One of the biggest problems in the US is that there is a failure to understand that eating your seed corn is stupid. You have to plant crops in order to expect a meaningful harvest later on... and with China getting entrepreneurship off the ground, they will have new and cool stuff, eclipsing Silicon Valley.
It might just be useful, especially if oil/gas prices skyrocket making transportation of goods prohibitively expensive. Having stuff made locally/regionally can not just cut down on shipping, it can add to customization, although it is hard to beat economies of scale that we have now, but with advances in metal sintering, and machines that can sinter, then machine (additive/subtractive), it may be cheaper just to make specialty parts nearby.
I wouldn't scoff at China. During 2008, when the economy tanked, they put money into infrastructure and laying fiber... not "shovel ready" projects and crushing perfectly working cars. This has paid off in spades for them, and will do so for the long term.
The conventional antivirus has became all but useless to deal with the latest zero-day threats. At best, an AV program is useful for scanning a download for a potential Trojan... but even with that, one is better off just using VirusTotal if the executable is small, or use the MD5/SHA hash if the file is bigger.
I'd like to see an AV program actually do something useful:
1: Filter by IP address. This is especially useful with third party malvertising which is a large infection vector.
2: Set kill bits and disable site cookies, similar to SpywareBlaster's functionality.
3: Scan via executable signatures and look for unsigned stuff that isn't whitelisted by the user.
4: Boot from Windows PE so Bitlocker can be unlocked, scan the machine offline.
5: Have the ability to run on the hyperviser level, so VMs can be checked for RAM-resident stuff and suspended/rolled back.
6: Have the option to act as a "file firewall", (turned off by default, so a user doesn't get used to blindly clicking 'allow' as with the earlier ZoneAlarm type software) so software that isn't normally set to access a certain filetype (for example a game grabbing Word documents in the user's Documents directory) would prompt the user with the details of what is being done (reading, overwriting, etc.) This would act as pushback against ransomware.
7: Offer more than just AV functionality. Having the program also be able to function as a client so a user can have a backup server that "pulls" documents as further protection from ransomware would be nice.
8: Money is important, but perhaps do like some programs, allow manual updates, and charge for automatic updates/automated scanning, cutting the annoying dialogs to as low as possible. For minimizing impact on servers, signed binary diffs for the signature files can't hurt. Having enterprise versions with no expiration of signatures can't hurt.
9: Offer enterprise functionality, such as pulling signatures from a local server, audit logs, and other items to help organizations with compliance. This should be available in every version, not just "enterprise" versions.
10: Focus on being out of the way... software that is designed to be made part of a WIM install image where it is installed and forgotten about... until there is a meaningful alert.
It looks more and more like a Vagrant install of Windows that uses a PowerShell provisioning script to auto install Chrome, an ad blocker, might just be the way to go. This way, every time the machine is dropped and brought up, it has a new install ID and items present.
Ideally, the Web browser should feed websites bogus, random data about what is installed and what isn't.
Much appreciated. Since I frequent this site on a daily basis, I might as well support it.
I just want a web browser that doesn't register as unique when you visit eff.org's Panopticlick. The only way to deal with fingerprinting these days, is to have multiple VMs, and vagrant up your VM for web browsing, erasing it and bringing it back up every so often to minimize how often one fingerprint is used.
Some browser that randomizes the order of add-ons presented to the server, fonts, and perhaps turns on and off fake add-ons as well.
I'd pay for this.
From what I read from the OP, he wants a wall clock that keeps in sync. The first thing that comes to mind would be the Android tablets as posted above, as they can be synced via the cell network or NTP.
This might just be a niche market. Take an Arduino with Wi-Fi capability, add an inexpensive LCD touchscreen, add some code to handle timezones, manual time setting, and so on, and call it done. Toss in a FONA cellular antenna/modem whose sole purpose in life is to get the time from the cell network for accuracy, and that is another avenue of getting things working if Wi-Fi connections are not doable.
Seems in cases like this where the Trojan is entirely in RAM, the best defense would be to have a RAM scanner on the hypervisor level that would scan VMs for things like this, and if found, suspend/snapshot the VM, and allow recovery via various methods (continue with the VM, shut the VM down and run a scan against the disk image, roll the VM back to a safe snapshot, etc.)
With ransomware also a threat, having AV on the hypervisor level can likely be the best defense, especially with VM snapshots coupled with snapshots of shared filesystems.
That is a good idea. The closest to this is .com, because the "land rush" has long since petered out. However, it would be nice to have a special TLD that has a distinct color when the web page is viewed (similar to EV SSL certs), and can be used in combination with EV. Some rules that sites must follow would be things like using SSL/TLS for all web traffic (other than the initial HTTP redirect to the secure site), staying updated to security levels, some concrete proof that the site is whom they claim to be given to the TLD owner (copies of the DBA), and so on. Ideally, it would mean sites are required to meet a security standard like PCI-DSS3.2, HIPAA, CJIS, FISMA, or some other known standard of security (where violating it will mean actual pain rather than a slap on the wrist.)
Of course, who is the gatekeeper for this domain? Ideally, it should be multiple domains so one country doesn't have the keys to the city for another. Perhaps some form of the TLD of the country with a character before it, like xde, xus, xco, so it is obvious it is a different domain, but the country of origin is standardized.
Daybreak (formerly SOE) had technology in EQ2 and EQ:Next where it would map your facial expressions onto your character's. Called SOEMote, it fell right into the bottom of the uncanny valley, but was an interesting thing to play with.
With power suspend technology, SSDs, CPU cores shutting parts off when not in use, and other power management abilities, it really doesn't make that big a difference. For example, Macs and most laptops will suspend after a period of time idle by default. Even on, a machine doesn't take much power, especially with modern SSDs where it has no moving parts that need to be powered other than a fan or two.
In the past, with CRT monitors and 5.25" HDDs that sucked up a large amount of power spinning the disks, it was a different story, but these days, there is a diminishing returns between powering everything off versus just letting the box suspend/idle.
Were it not for the need for A/C without a complete redesign of a house (and no, swamp coolers don't work in humid areas), most places in Texas could run off-grid with a rooftop panel array, coupled with a propane tank.
On a small scale, a few panels on the roof, a couple AGM batteries, a MPPT charge converter, and a PSW inverter can be used to add a dedicated circuit so low-draw devices can use that, and not suck off the mains power. Add a bit more wattage, you have a dedicated, clean power circuit that your computer can use, regardless of the status of mains power. Tile the roof with panels, you can use a PowerWall or other storage battery methods (there are YouTube vids on what the forklift batteries can power. Even if they hold a fraction of the charge as they did new, they still can run a lot of stuff.) Instead of buying a "smart" fridge, one can buy a fridge that switches between propane and electric, using a gallon of propane every 4-5 days. Alternatively, one can run a high efficiency fridge from solar as well.
Net metering is better than nothing, but it might be better to just run solar in an off-grid capacity, where mains power is only used to keep the storage batteries topped off. This may not give you a negative bill come low-use times, but the homeowner will still benefit from it greatly.
End to end encrypted... how? In theory, even if the messages are stored encrypted in the client, FB, et. al. could be forced to push a patch to add an ADK, not encrypt, or other means.
The ideal is to have the encryption layer separate from any messaging layer. This is why I like PGP/gpg. It encrypts/decrypts, and doesn't really give a care about what protocol is uses.
SMIT happens, I guess...