Cybersecurity

I would love if just once an admin of a fedi host under #DDoS attack would have the integrity to say:

“We are under attack. But we will not surrender to Cloudflare & let that privacy-abusing tech giant get a front-row view of all your traffic (including passwords & DMs) while centralizing our decentralized community. We apologize for the downtime while we work on solving this problem in a way that uncompromisingly respects your privacy and does not harm your own security more than the attack itself.”

This is inspired by the recent move of #LemmyWorld joining Cloudflare’s walled garden to thwart a DDoS atk.

So of course the natural order of this thread is to discuss various Cloudflare-free solutions. Such as:

1. Establish an onion site & redirect all Tor traffic toward the onion site. 1.1. Suggest that users try the onion site when the clearnet is down— and use it as an opportunity to give much needed growth to the Tor network.
2. Establish 3+ clearnet hosts evenly spaced geographically on VPSs. 2.1. Configure DNS to load-balance the clearnet traffic.
3. Set up tar-pitting to affect dodgy-appearing traffic. (yes I am doing some serious hand-waving here on this one… someone plz pin down the details of how to do this)
4. You already know the IPs your users use (per fedi protocols), so why not use that info to configure the firewall during attacks? (can this be done without extra logging, just using pre-existing metadata?)
5. Disable all avatar & graphics. Make the site text-only when a load threshold is exceeded. Graphic images are what accounts for all the heavy-lifting and they are the least important content (no offense @jerry@infosec.exchange!). (do fedi servers tend to support this or is hacking needed?)
6. Temporarily defederate from all nodes to focus just on local users being able to access local content. (not sure if this makes sense)
7. Take the web client offline and direct users to use a 3rd party app during attacks, assuming this significantly lightens the workload.
8. Find another non-Cloudflared fedi instance that has a smaller population than your own node but which has the resources for growth, open registration, similar philosophies, and suggest to your users that they migrate to it. Most fedi admins have figured out how to operate without Cloudflare, so promote them.

^ This numbering does /not/ imply a sequence of steps. It’s just to give references to use in replies. Not all these moves are necessarily taken together.

What other incident response actions do not depend on Cloudflare?

Source

idk if people on tumblr know about this but a cybersecurity software called crowdstrike just did what is probably the single biggest fuck up in any sector in the past 10 years. it's monumentally bad. literally the most horror-inducing nightmare scenario for a tech company.

some info, crowdstrike is essentially an antivirus software for enterprises. which means normal laypeople cant really get it, they're for businesses and organisations and important stuff.

so, on a friday evening (it of course wasnt friday everywhere but it was friday evening in oceania which is where it first started causing damage due to europe and na being asleep), crowdstrike pushed out an update to their windows users that caused a bug.

before i get into what the bug is, know that friday evening is the worst possible time to do this because people are going home. the weekend is starting. offices dont have people in them. this is just one of many perfectly placed failures in the rube goldburg machine of crowdstrike. there's a reason friday is called 'dont push to live friday' or more to the point 'dont fuck it up friday'

so, at 3pm at friday, an update comes rolling into crowdstrike users which is automatically implemented. this update immediately causes the computer to blue screen of death. very very bad. but it's not simply a 'you need to restart' crash, because the computer then gets stuck into a boot loop.

this is the worst possible thing because, in a boot loop state, a computer is never really able to get to a point where it can do anything. like download a fix. so there is nothing crowdstrike can do to remedy this death update anymore. it is now left to the end users.

it was pretty quickly identified what the problem was. you had to boot it in safe mode, and a very small file needed to be deleted. or you could just rename crowdstrike to something else so windows never attempts to use it.

it's a fairly easy fix in the grand scheme of things, but the issue is that it is effecting enterprises. which can have a looooot of computers. in many different locations. so an IT person would need to manually fix hundreds of computers, sometimes in whole other cities and perhaps even other countries if theyre big enough.

another fuck up crowdstrike did was they did not stagger the update, so they could catch any mistakes before they wrecked havoc. (and also how how HOW do you not catch this before deploying it. this isn't a code oopsie this is a complete failure of quality ensurance that probably permeates the whole company to not realise their update was an instant kill). they rolled it out to everyone of their clients in the world at the same time.

and this seems pretty hilarious on the surface. i was havin a good chuckle as eftpos went down in the store i was working at, chaos was definitely ensuring lmao. im in aus, and banking was literally down nationwide.

but then you start hearing about the entire country's planes being grounded because the airport's computers are bricked. and hospitals having no computers anymore. emergency call centres crashing. and you realised that, wow. crowdstrike just killed people probably. this is literally the worst thing possible for a company like this to do.

crowdstrike was kinda on the come up too, they were starting to become a big name in the tech world as a new face. but that has definitely vanished now. to fuck up at this many places, is almost extremely impressive. its hard to even think of a comparable fuckup.

a friday evening simultaneous rollout boot loop is a phrase that haunts IT people in their darkest hours. it's the monster that drags people down into the swamp. it's the big bag in the horror movie. it's the end of the road. and for crowdstrike, that reaper of souls just knocked on their doorstep.

cross-posted from: https://fed.dyne.org/post/315914

I'm experiencing an issue where, when I open a this PDF from OpenStreetMaps in Firefox (and only in Firefox), it spam creates empty .part file until i close Firefox.

Companies are increasingly migrating to Cyberark products. However I'm concerned about this company being an Israeli company and being closely tied to the Israeli government and army. I think using their products raises ethical concerns.

But there's a more important issue. That of using services where sensitive data is stored in data centers in Israël and the potential use of this information by the government or the army.

Am I being paranoid? Or are my concerns valid?

• In two hacker competitions run by Palisade Research, autonomous AI systems matched or outperformed human professionals in demanding security challenges.
• In the first contest, four out of seven AI teams scored 19 out of 20 points, ranking among the top five percent of all participants, while in the second competition, the leading AI team reached the top ten percent despite facing structural disadvantages.
• According to Palisade Research, these outcomes suggest that the abilities of AI agents in cybersecurity have been underestimated, largely due to shortcomings in earlier evaluation methods.

What do you guys think? I don't think there's a lot of depth to the arguments, myself. It reads more like an threadbare op-ed with a provocative title. But I'd like to hear you opinions on the impact of automated testing solutions on the role of pen-testers in the industry.

Background & Licensing

How comes GrapheneOS people find themselves in situations like these often?

Their software is all permissively licensed, allowing vendors to make it proprietary. Mainly though, they allow them to restrict user freedoms by not allowing to install another OS than GrapheneOS (which is the most secure OS anyways).

Cryptographic verification of the OS can be done with the Auditor, you dont need to reinstall to verify it is not malware.

Still, they contact stores that sell end of life or insecure phones, to stop doing this under their name.

PrivatePhoneShop sold devices as old as the Pixel 4a with GrapheneOS.

Is an EOL phone not secure?

I have a pixel 4a and GrapheneOS is awesome, I still get security updates at least as frequent as normally on LineageOS. But it is end of life, meaning Google and the hardware suppliers dont support it anymore. This means

• firmware issues of any kind will not be fixed (the vendor needs to sign the firmware, this is not possible for anyone else)
• the kernel, specificically patched for this device, will not be upgraded to the next LTS kernel, thus losing support in a while. This would be possible, but is immense efford without Google doing it upstream in AOSP.

"privatephoneshop"

Following the Mastodon post, you can see "privatephoneshop"s selection. They sell devices that are not cheap, but pretty cheap.

Ease of Installation by yourself

You can buy a used Pixel 7 for that price and flash GrapheneOS easily, using the webinstaller, even from another Android phone, with zero Terminal knowledge needed.

CalyxOS and LineageOS

PrivatePhoneShop sells devices with CalyxOS, which is a lot less secure in its architecture, and delivers slower security updates. It is less secure, because their webview is not as hardened, they dont use hardened_malloc, they preinstall random 3rd party apps etc.

LineageOS is not privacy hardened at all. It may now be degoogled, after GrapheneOS's effords to replace every connection to Google, even for Widevine DRM or A-GPS (SUPL) with at least their selfhosted proxy servers, stripping sensible data.

Only DivestOS can be assumed as reasonably secure, implementing sandboxed microG and other important architectural security measurements. GrapheneOS recommends DivestOS if your device is EOL or not supported.

So the store is selling phones with insecure software, that are also past or near the end of support by upstream.

Background on Android updates

There is no phone company that supplies as fast and complete security updates as Google. Google publishes recommender AOSP security patches, and a complete set. Pixel phones get all of them, while most other cheaply made devices struggle to even get the recommended ones.

GrapheneOS has updates about once a week, which is insanely good.

Btw, Fairphone plays in the same bad league as the cheap manifacturers, getting only the minimal amount of updates.

Hardware

Google Pixel phones are not just a choice because GrapheneOS devs love Google. They are the only phones that meet their security requirements

Since they expanded their security fixes, like implementing a way to disable the USB port (which involved a ton of lowlevel work and is more secure than what Android ever shipped), this list is a bit long.

But even the minimum requirements are not fulfilled. Samsung is close, but security features like verified and measured boot are arbitrarily blocked for external operating systems.

Debates & Harrassment

I only focus on this case now. GrapheneOS transparently asked them to stop selling EOL devices under their name.

Maybe they also asked to stop selling CalyxOS and LineageOS devices along with them, but "privatephoneshop" didnt give any evidence for that.

As a response, "privatephoneshop" posted this joke explanation

While GrapheneOS remains a top choice for security and privacy, we feel the toxic nature of its founder (and specifically his attacks on our business) no longer make GrapheneOS a viable choice.

For YOU, because you scam people. LOL

Early in November, GrapheneOS sent us a message on X (fka Twitter) stating they did not approve of our selling older phones such as the Pixel 4a with GrapheneOS, nor did they approve of our offering CalyxOS as a choice. Having previously seen how a typical conversation with GrapheneOS goes (more on that below), we blocked them.

Wow. Does this need any explanations?

But it gets better:

Why we sell older phones like the Pixel 4a

• Not everyone can afford a newer phone.

You sell outdated devices for up to 650$. People can buy used Pixel 7 phones on eBay for like 200$. You can do that too. Sell refurbished ones, better than insecure ones. Repairing pixels is easy (in contrast to repairing OnePlus phones, wtf OnePlus).

• Not everyone wants a phone made by google.

LOL. I think I explained why this is not some fanboy choice.

• Not everyone wants a 5G phone.

What? You can just disable 5G in the settings to my knowledge. Also, WIFI is always using something similar to 5G.

These are fake arguments, hiding behind esotheric misinformed people.

• Not everyone wants a large phone.

Very understandable, I miss my (honestly underpowered) Pixel 4a, also for the headphone jack. But this is a tradeoff, if you sell "privacy phones".

There is no privacy if you can get hacked.

• Everyone has a right to the level of privacy and security that they desire.

So, sell refurbished phones or upload instructions yourself on how to do it yourself.

Thoughts

I honestly think GrapheneOS should switch to a license that actually gives them some teeth. Bitching around back and forth on "social media" sounds like a pretty annoying thing to do apart from delivering the most secure OS on the phone market.

I am also very unhappy about Louis Rossman and Techlore for spreading bad opinions on them.

Yes, the devs can be harsh, yes they are sometimes a bit annoying. But look at their Github issues!, 500 open, over 2,5k closed!

They do free Software that helps anyone to be as private and secure as possible. They are a blessing for our world. Please donate to them, as they are doing an incredible job.

Btw, they are also against Nazis.

“We would like to clarify that it is more appropriate to refer to the presence of proprietary HCI commands—which allow operations such as reading and modifying memory in the ESP32 controller—as a “hidden feature” rather than a “backdoor.” concludes the report. “The use of these commands could facilitate supply chain attacks, the concealment of backdoors in the chipset, or the execution of more sophisticated attacks. Over the coming weeks, we will publish further technical details on this matter.”

3 months ago, I discovered a unique 0-click deanonymization attack that allows an attacker to grab the location of any target within a 250 mile radius. With a vulnerable app installed on a target's phone (or as a background application on their laptop), an attacker can send a malicious payload and deanonymize you within seconds--and you wouldn't even know.

I'm publishing this writeup and research as a warning, especially for journalists, activists, and hackers, about this type of undetectable attack. Hundreds of applications are vulnerable, including some of the most popular apps in the world: Signal, Discord, Twitter/X, and others. Here's how it works: