Posts by Frank Bitterlich

Some math...

Ok, the guy milked $122m with his scam. He will give back $50m. Subtract $300k fine. So he spent, or hid, $71.7m.

Facing (up to) 9 years of federal accommodation, that makes +/- $7.9m per year.

See, kids, crime doesn't pay!

Facbook "protecting" its employees?

"On one hand, Facebook can and should be able to protect its employees from any threat of harm."

No. It should not. Since when should Facebook take over law enforcement duties? So in order to "protect their employees", they do what even police wouldn't be allowed to do - they track and monitor people 24/7 without their knowledge...?

If someone is threatening Facebook employees, they should refer that case to the police instead of taking the law into their own hands and using illegal actions against these so-called "threats."

AfD data missing

Another theory on why the dump lacks data from any AfD politicians so far ist that the data might be somewhat old (and the AfD having made it into Bundestag this legislative period for the first time.)

Unfortunately the reporting on what exactly has been dumped is a bit thin so far in most German media.

So I'll leave it to the usual tinfoil hats to make up a suitable conspiracy theory on why they have been spared. Bob, you are reading this, right?

An email...

... that for some reason travelled backwards in time from May 2019 into my today's inbox:

"Dear happy Cixtrix user,

as you please have heard must please reset password now. Or not have access. Convenienly, plase click [a href="someplace.please-dont-block-my-account.wherever.tk]here[/a] to not have account removed and set new password. Must enter old password first. Please ignore if some get warning browser message, all is OK. Awaintingly, Cxitrix user best support team."

The other way around?

So, if you register as a data processor, submit to audits, do everything right, then you have to pay the ICO.

If you fail to do all that, you get slapped on the wrist, and a stern warning.

How about making those companies and individuals pay for the ICO which are the actual reason why an ICO is needed in the first place? 1£ per customer record lost, 50p for every spam email sent, oh and 10£ per illegal nuisance call. Wouldn't the whole problem just go away then?

Or, keep the current system, but with a money-back guarantee. Being affected by one violation of the DP rules (domestic, within the reach of the ICO) and you get your money back.

The way it is now is more like a protection racket than a just fee.

Minor flaw? Where?

"Which? found a minor privacy concern with this device..."

Where on earth did they find a "minor privacy concern"? All the flaws reported here were pretty much worst-case vulns (total stream takeover.) The only thing worse would be rooting the device. That is major, not minor.

So did they discover some more vulns, or did their spellchecker replace "major" with "minor"?

Test for yourself

Next time your get one of these "invoice" emails with a MS Word attachment and a misspelled subject line, upload the file to Virustotal. You'll be lucky if half of the engines detect the malware, even two weeks later.

That gives a good inidication how much these "award-winning", "widely tested" packages are worth.

Backup 101

"The worst hit, she said, will be students in [photography and] some technology subjects, who were more likely to be storing their work locally."

And this, dear students, concludes our course on "Why backing up your stuff is important." I hope you all leaned something. There will be NO pop quiz on this subject, as the pop quiz database has been encrypted by the ransomware, too.

Fun and vibrant team...

... of marketeers? Or rather "[...] a bunch of mindless jerks who'll be the first against the wall when the revolution comes."

Sounds much like the Sirius Cybernetics Corporation marketing dept. to me.

"Just leave the PJs at home, please!" – So I guess Casual Friday is cancelled, then?

Life imitating art once again...

... in the sidebar of this very forum page: An ad stating "The best, new crypto currency 2018 is called XYO."

Good research, but...

... some of the scenarios are somewhat constructed.

His tactic for such tokens was to surreptitiously turn on a smartphone’s front-facing camera to photograph the reflection of a QR code in a point of sale scanner’s protective cover. This attack also detects the configuration of the QR code and subtly changes its appearance to make it unreadable. The malware running the attack on the smartphone, however, manages to retain a perfect and usable QR code.

OK, so the targeted phone has already been compromised to such a level that the attack app has control over the screen. What's the point then to use the camera to try and catch the code? Why not just get it from a screengrab?

The technique can also be used to craft malicious QR codes that, when used for smartphone-to-smartphone payments, see the victim machine directed to download and run malware.

That's a vuln in the target smartphone's payment app. If it expects a payment token, and gets a "http:..." instead, it probably won't blindly say "oh, hey, why not, let's visit that site..."

All interesting techniques, and good that he did that research, but not very close to see that in the wild. Way more likely (and easier) to attack the payment service (for example with POS malware) directly.

That'll teach them...

Computer equipment and documents were seized for analysis at two Greater Manchester-based premises of the unnamed entities, the ICO said.

"... and we won't give it back until you have paid the fine. The whole £200 of it!!!"

Who on earth...

... would, when looking to protect their data, turn to Facebook by any means?

/shakes head in disbelief...

"You just don't *want* to solve that problem!"

The whole reiteration of "it's just not possible because you guys haven't invented it yet" reminds me of that Big Bang Theory episode, where Penny's idiot (ex-?)boyfriend proudly tells about the invention he just made – goggles that convert any movie into a 3D movie. How does it work? "I don't know, I'll let you figure that out."

Now there are two possibilities: Either all of those "the laws of Australia trump the laws of mathematics" statements are made honestly and those making them are really ignorant enough to believe in that; or that this is just a clever ploy to get Joe Public to sooner or later think "The tech companies just don't *want* to do it because they are evil."

Honestly, I don't know which one to believe. They both sound awfully plausible.