What's the deal with Deno? We talk with a major contributor to find out. Listen now.

Hot answers tagged

45

I used to be a Command Controller (CC) at the Laboratory for Atmospheric and Space Physics (LASP) (http://lasp.colorado.edu/). I was one of the people who would sit in front of the console during the times when spacecraft were visible to the ground stations. I would read/record telemetry to ensure spacecraft health and often send up new commands that would ...


41

As for how it may happen that reflashing the BIOS does not eradicate the malware, we can hazard a few guesses: The reflash operation is under control of... the BIOS, so the infected BIOS only pretends to do the reflash (or reinfects the new BIOS immediately afterwards). Another flashable firmware in the machine is also infected, and when either it or the ...


37

The Internet at large is designed to resist nuclear blasts. At least, it was a design goal of its immediate predecessor, ARPANET. There is no secret: to survive loss of components, you must have redundancy. In the context of nuclear blasts, this means that there must exist several paths for data between any two machines, and the paths should be as ...


17

Highly customized and patched hypervisors, sandboxes around said hypervisors to mitigate breakouts, and heavy monitoring. Of course, any given server only hosts so many VMs, so a breakout is fundamentally limited to a finite number of guests, if it's able to get past the protections outside the hypervisor. For example, QEMU can be compiled with a hardened ...


15

Apparently, NASA is taking communication security very seriously (and I would, too, if I had 2G$+ toys to manage !). I think they've done so for a long time, because in the early times of space exploration (in the 1960s) they feared malicious interference from their arch-enemies, the Soviets. (I do not have a reference handy, but my brain cells tell me that ...


12

As someone who runs personal honeypots and used to defend a massive global corporation, I can tell you that any attack leaves fingerprints. Styles of commands or command sequence, coding style of malware, as well as the paths used by attackers can all point in a direction of an attacker. For example, I was able to positively identify someone trapped in my ...


8

While I dont know how most critical infrastructure is defended against EMP threats I do know of many instances of critical infrastructure offer no protection to these kinds of threats. This does however not mean that there does not exist protection. Take for example Kelvedon Hatch nuclear bunker. Some of its features, and which should be considered in any ...


6

Remember the I in the CIA triad - Integrity. It is also a security failure if these sensitive Word documents and Excel spreadsheets from outside don't convert properly when you open them in your office suite. I fear you may have to accept that you need to run a proper copy of Office and put controls around that - for example, by opening them in a disposable ...


6

In addition to the other excellent answers here -- You asked about some of the threats that one must defend against. One possible risk is the possibility that the launch vehicle or spacecraft could be hijacked and retargeted to de-orbit and come back to Earth, hitting some designated location on Earth -- in effect, turning the spacecraft into a kinetic-...


6

It isn't. The threat model attempts to be resistant to external attack, but if all it takes is a malicious line in a build script on a package used on most systems (e.g. libc, x11, etc.) then all they need to do is compromise one build machine to gain near-universal control. Attempting to protect against this is hard, and the only way to do it is to build ...


6

The problem is less likely the security of the Ubuntu system as shipped by the distributor. It is very rare that there are critical issues which allow an remote attacker to hack the system. And while there are sometimes critical issues which allow privilege escalation by a local user they are rare too. But you can actually limit the impact further by only ...


5

There is no good way to determine clearly who made an attack, or even if an attack was performed by a nation-state, or as Bruce Schneier puts it "A couple of guys". That we live in the world where we aren't sure if any given cyberattack is the work of a foreign government or a couple of guys should be scary to us all. For physical attacks, if a tank ...


5

Electro-magnetic pulse is mostly mitigated by sending it to ground. Place routers/firewalls in a faraday cage (Imagine a room that has copper screen on all sides of it). Ground the Faraday cage (connect the copper mesh to multiple 6' copper rods that are pounded into the ground). Make it level with the ground (using the earth to block some of the EMP blast)....


5

Impersonating law enforcement agents is an old trick used by criminals to fool honest people. This is a mechanism used in numerous movies, e.g. this one. Though it has been revealed that the US government requested (and presumably obtained) some user password dumps from Internet companies, the exact details of the used protocols for that exchange are not ...


5

I drove a project that looked at this while I was at Microsoft. The answer is that the vast majority of breakins do not use 0 day. We used malware as a proxy for breakins, because data was more accessible and puts the use of 0days in perspective. The data here doesn't break out sophisticated attackers, but the arguments you put forth as to why no one ...


4

it seems as thought you have requirements to: view office documents from external sources a secure system that you wish to shield from an attack bourne by use of office tools It seems to me that separation is the answer. This comes in varying strengths: Air Gap: Is there a strong requirement for your secure system to also connect to external sources and ...


4

That said, bios and firmware attacks have been around for a while. The only change here is > the same one any class of attacks goes through: they have become commoditised. This doesn't change the approach of find, patch etc., but it does mean that a c>ompromised machine may require cleaning at firmware and hardware level, not just OS. Respectfully, I ...


4

"Advanced Persistent Threats" (APT) are primarily marketing language which still has a true core. Lets analyze first the particular words to get to the core: Threat: This means it is somehow dangerous for you, so that you will be scared and buy something in the hope it will protect you. Note that when you are scared critical thinking often is reduced so ...


4

Google states on their security blog that: These warnings are rare—fewer than 0.1% of users ever receive them—but they are critically important. The users that receive these warnings are often activists, journalists, and policy-makers taking bold stands around the world. And: We can't reveal the tip-off because these attackers will adapt, but this ...


3

As of late, there has been a best practice in the DevOps Community: If it's not automated, it's not secure. Automation provides benefits for security (e.g. limited, audited access via configuration management, e.g. Puppet, Chef, SaltStack), but also for availability and ease of support. As far as availability goes, it should be fast to roll back changes ...


3

Computer-based attack attribution works like the attribution of any other illegal activity: it requires a significant amount of investigation, gathering clues, corroborating information, attempting to eliminate false leads and recognize right ones, etc. On the attackers' side The attacker may cover his tracks using two main techniques: plausible ...


3

The U.S. government for many years has had a program called TEMPEST. Originally it was a set of specifications for devices and structures intended to minimize the chance of an outside evil-doer picking up emissions from devices processing sensitive data. Over the years it has extended to EMP protection. This is logical since those measures that keep ...


3

The answer to your question is listed in the Wikipedia article and dictionary definition. Yes, most people associate a Nation State with an ethnicity, but if it is used in a general sense it is just a large group of like minded individuals: Wikipedia: In a more general sense, a nation state is simply a large, politically sovereign country or ...


2

The article you linked to gives as much information as is publicly known. So I'll just quote from there: Investigators still do not know how hackers initially broke into The Times’s systems. They suspect the hackers used a so-called spear-phishing attack, in which they send e-mails to employees that contain malicious links or attachments. All it takes is ...


2

Think old-school. Vacuum tubes. Transistors and other semiconductors will likely be damaged by the induced voltages of the EMP, and few consumer or industrial grade chips are hardened against this kind of damage. Look at static electricity damage under a microscope some time and you'll see what happens when only a few hundred volts pass through a chip. ...


2

The biggest thing you can do is user training. The majority of targeted compromises are a result of stupid users. It doesn't matter how secure you can make the system when your PHB (pointy haired bastard) follows the link spoofed from their buddies e-mail address to some custom malware infested porn site and clicks ok to every dialog they see. If you can'...


2

Seems completely implausible! If we assume that the reports are accurate (and I'm uncertain if us observers are qualified to make the assumption that Dragos is being truthful, not mistaken, and not coerced?), then it only leads to three options: The storage media (HDD, SSD, USB drive) are not being completely wiped The BIOS is not being properly flashed ...


2

I'll try to address several questions raised here. It's not possible to prevent well-organized bad actors in the sense that we cannot create perfect computer security. Fundamentally the bugs will always come out before the fixes and we cannot invest an infinite amount of resources to protect all of our data. Therefore there will always be risk of some form ...


2

That's a big, big topic area to cover. If I had to try to start to answer that in my own professional situation (I don't work day-in-day out with clients who need to defend against advanced threats in mass), I would start by looking at resources like the NSA's Information Assurance mitigation guidance page, which contains a lot of good guidance about ...


2

Warning, lots of text. Very complicated issue. tl;dr is: we as a nation are not doing much and have not been doing much. The current mentality is "it's up to businesses to fix it before the GOVT has to get involved." Companies don't want to pay, and don't know what to do, and don't see a "market motivator" (yeah, literally hear that all the time. I'm not ...


Only top voted, non community-wiki answers of a minimum length are eligible