* Posts by Blacklight

147 posts • joined 6 May 2008


You got a smart speaker but you're worried about privacy. First off, why'd you buy one? Secondly, check out Project Alias


"but how do you deafen the smart speaker by making noises too quiet for human ears to hear?"

High frequencies dear boy. We can't hear them, but the little cyber ears can.


Um, I'm not that Gary, American man tells Ryanair after being sent other Gary's flight itinerary


I've had this, for a similar named person to me, and their flights.

And someone else crime report, with number (direct from the police)

And something from HM Government.

And home building plans, and insurance.

Normally I do get a "sorry" in most cases, but STA (re: the flights) took a LONG time to sort it, and I did consider cancelling the flight....

A year after Logitech screwed over Harmony users, it, um, screws over Harmony users: Device API killed off



Anyone who has enough nouse to play with APIs, can do the following...

Get a Raspberry Pi, an enclosure, and install OpenRemote on it.

Yes, there is a cloud UI to set things up, but once you've got the config on the Pi, you can cut it off from t'interweb and it will still control anything in your house/network that you can make it talk to (from HTTP/JSON to raw TCP/UDP).

Mine runs on a NAS rather than a Pi, but talks to Philips Hue (which runs when no cloud is available), Lightwave (same), and direct to other devices on the LAN. It is a bit of effort to get going, but it's so worth it when you hear of crap like this!

Rookie almost wipes customer's entire inventory – unbeknownst to sysadmin


Re: .cobol

My SMB box has a .recycle

Granted I have to enable it, but it's there - and on every family share "just in case" :)

Amazon warns you have 30 days before Music Storage files bloodbath


Sir has seen M-Disc, no?

That kind of appeals - although I've not had cause (or time) to test it!

If it's true, the drives will be the sods, ala Domesday...

Android P will hear no evil, see no evil, support evil notches

Black Helicopters


For sweet, sweet omniscient surveillance....

Intel gives Broadwells and Haswells their Meltdown medicine


I recently played with amending AMI type BIOS, as I wanted a new Intel BIOS for RST, and it worked. Hopefully if they drop the microcode in useful formats, people can try rolling their own (if they are suitably equipped).

At least my Gigabyte motherboard has Dual-BIOS, so I can't *totally* kill it...

Intel’s Meltdown fix freaked out some Broadwells, Haswells



Since putting the latest MS patches on my (Sandy Bridge based) PC, I've had two unexplained crashes - which is annoying when working remotely as while the Intel RST on my machine recovers correctly, it doesn't then reboot, so just sits waiting for someone to reset it. Maybe time invest a remote power switch....

Also quite annoying as my Sandy Bridge (i7 2700K) DOES support PCID, but not, apparently INVPCID...

So, on a Sandy Bridge i7 2700K (released Oct 2011 I believe) running Win 10 Pro, the results of "Get-SpeculationControlSettings" are:

Speculation control settings for CVE-2017-5715 [branch target injection]

Hardware support for branch target injection mitigation is present: False

Windows OS support for branch target injection mitigation is present: True

Windows OS support for branch target injection mitigation is enabled: False

Windows OS support for branch target injection mitigation is disabled by system policy: False

Windows OS support for branch target injection mitigation is disabled by absence of hardware support: True

Speculation control settings for CVE-2017-5754 [rogue data cache load]

Hardware requires kernel VA shadowing: True

Windows OS support for kernel VA shadow is present: True

Windows OS support for kernel VA shadow is enabled: True

Windows OS support for PCID performance optimization is enabled: False [not required for security]

Suggested actions

* Install BIOS/firmware update provided by your device OEM that enables hardware support for the branch target injection mitigation.

BTIHardwarePresent : False

BTIWindowsSupportPresent : True

BTIWindowsSupportEnabled : False

BTIDisabledBySystemPolicy : False

BTIDisabledByNoHardwareSupport : True

KVAShadowRequired : True

KVAShadowWindowsSupportPresent : True

KVAShadowWindowsSupportEnabled : True

KVAShadowPcidEnabled : False

1980s sci-fi movies: The thrill of being not quite terrified on mum's floral sofa


I think the pic used in the article is actually Automan, not Tron :)


Lovely lovely Sci-Fi.

Tripods, Chocky, Children of the Dog Star, "Benji, Zax & the Alien Prince", The Tomorrow People, all squarely aimed at kids, and in some cases quite dark (Chocky, I'm looking at you...). Knights of God was my first proper Dystopia, and the bastards never released it officially....

But then we got some proper trippy stuff. Manimal. Automan (not at *all* trying to be Tron). And the action sets (Airwolf, Knight Rider, Street Hawk). And big budget sci-fi, like "V", in all its latex goodness. It even had Freddy Kruger hiding in it.

What I want to see (properly restored) is "The Highwayman". That was proper, classic, dystopian cheese (with added Jane Badler, of V fame)....

Hells door-bells! Ring pieces paralyzed in horror during Halloween trick-or-treat rush


Le sigh...

"Let's all think of the clever, and not think of the function...."

Yes, it might put up a bit of cost, but how hard is it to also incorporate a remote sounder, like most wireless doorbells? Or even some local (encrypted) storage, so it can take/store pics of people who did come to the door?

If your internet backhaul is down, isn't the result going to be the same? At least Hue & Lightwave etc continue working with whatever settings they have been given, if the cloud goes down. My home automation system uses a cloud UI to configure, but once it's got it's config. it doesn't need the internet.

Failover modes people, failover modes....

Boffins blast beats to bury secret sonar in your 'smart' home


Re: yet another reason...

Depends on a variety of things :)

Your phone mobile is permanently wired, it can't be disconnected. As to wether it's "active" is down to software, listening to the input channel.

The various assistants (Siri etc) can be configured to either "listen all the time" (keyword activation) or after a button press (Siri). But do you trust that's what they're actually doing? :)

If you've got a Smartphone, and you can't take the battery out, you can't be 100% certain that it's not listening, That's the basic fact. Assuming you haven't run some third party apps with access to microphones, or granted access to those apps, then you should be "as safe as your assistant settings" are configured.

Virgin Media router security flap follows weak password expose



I may be wrong (probably am!) but is the other issue resolved?

i.e the one whereby when the router powers up, for 7 seconds or so, there is no encryption set on the WiFi? o_O

Thus, if you are quick enough, you can get onto the WLAN - and then (again, if quick enough) - either use the default web admin password to find a WLAN password (even if it's been changed), so you can then reconnect shortly after, or do a quick network probe? Granted that's a tight window of opportunity, but still!

[EDIT] Ah yes - a powershell to reboot a SuperHub - if you know the password. Assume it's default, and a bit of cross site jiggery-pokery with a form post/social engineering - and away you go, router reboots, WLAN available briefly...[/EDIT]

Personally, opt for "SACM" (standalone cable modem) mode and use my own WiFi. I'd still be using 802.1x EAP too if the firmware I use was updated to not break RADIUS :( (choice of stick with RADIUS but keep other vulns active, or upgrade and lose RADIUS)

If you don't have your own router, change the WiFi AND admin passwords - which should be standard OpSec anyway. It wouldn't be that hard for device manufacturers to trap all web traffic when the thing is in "default" mode and force passwords to change, before letting it go fully operational....


Re: Where are the instructions?


Also search a bit and you can see where to change the admin password....

Faking incontinence and other ways to scare off tech support scammers



I've just installed Lenny onto our PABX as a handy extension. Now I'll probably get no calls...

I also love that other default message (with the correct English pack) that says "All members of the household are currently assisting other telemarkers. Your call will be answered in the order it was received"...(and then dumps them on permanent hold music)

Leaked: The UK's secret blueprint with telcos for mass spying on internet, phones – and backdoors


Re: Encryption is not made "illegal"

Again, it's the over the top services that will be the "fun".

MPLS/BGP/TCP et al can be inspected, as it's a known protocol. If the packet's going up/down said wires turn out to contain encrypted stuff, that's WAY beyond the OpCo's wires, and the Telco's will simply go "meh" as it's not in their domain to control, unless they start doing DPI and being ordered to block anything they can't decode.

In which case we'll see digital steganography of another kind. Stuff will look like/be valid traffic, and just be nonsense, with anything relevant buried in some way that'll be harder to spot.


Re: So where is the problem here ?

"Are end users going to be forced to install ISP root certificates ( to allow HTTPS MITM attacks ) before they are allowed to use an ISP's services ? I can't see this. That would require touching every endpoint connected to the ISP, it would be a nightmare for the ISP's, and pinning complicates even this."

Erm, not quite. A nice nudge to Google & MS and hey-presto, your next s/w or OS update contains new certs.

Chrome already overrides machine level certs, as I found out when I was using a CA it opted to distrust (warnings ahoy, even though the root CA was trusted).

Unless you keep tabs on EVERY cert in your machine, with fingerprints, something could merrily install and opt to use one.

Pinning also only works if the apps respect it (or are allowed to)...

I'm sure someone will be along shortly to insert an obvious comment about not using Windows, or Google, or <other large well known app> - but for the masses, it's not going to be that hard to do...

Nielsen, eat your heart out: TiVo woos admen with prediction engine


You clearly missed the "experiments"

A while back, if you paused on VM TiVo, an ad popped up on the pause bar (for Tetley, IIRC) - so you may have something foisted on the screen even if you ignore it. It got slammed and went away (for a bit).

Also - do you not find it very suspicious that 99% of the channels on VM TiVo (other than terrestrial) seem to have magically sync'd their advert breaks? Get bored and channel hop? More ads...

Google mass logout riddle deepens: OAuth token fumble blamed



I saw all of my G devices logout, and this was timed when one of my 5X handsets had died, and I was in the process of recovering data and then RMA'ing it.

Mostly this was an inconvenience, and did initially raise an alarm as I was the account section checking if I'd gained another login elsewhere (I'd hope not, I use 2FA).

What worries me more is the OnHub resets! I don't have one, and personally this just adds to why I won't get one. "Key" infrastructure devices, ala routers should not be subject to the whim of an external 3rd party at all, error or otherwise. At worst I'd expect them to sever connections with the Cloud and request you log back in again, but NOT reset and take all the config with it....

The Register's guide to protecting your data when visiting the US


Re: @2460 Something

Use multi-factor.

SSH can be set to use pubkey, OTP and user/password (in any order), if not more. It can also be set to act differently depending on connecting IP. At home? Simple password. Not at home? All of the above.

Soz fanbois, Apple DIDN'T invent the smartphone after all


Sendo X did e-mail, and let you lug around your own music (on a card, or via USB no less!). We were even looking at cloud services. The X2 even had a nice VR game, but never got off the blocks, as Sendo went "phoom", cue Moto entering stage left. Moto had already tried to lure fanbois with the (ahem) MotoRokr back in 2005 - but that wasn't a smart phone. But who cared? Fun glowy LEDs! But then, out of Brum, came the (ring ring ring ring ring ring ring) Banaphone Z8.

The Z8 did do some very nice things, was nicely specced, had that fun form factor (although WTF marketing managed to do with that "horse" advert I have no idea) - although it was a potentially risk dalliance with UIQ over S60.

But then "Oh hai, iPhone" with it's large screen" and "touchscreen" and "bai bai" everything....but seriously, ignore the fact it happened to have "Apple" on it, the larger touch enabled screens are pretty much what won it...

Samsung SmartCam: Yes, those eyes really are following you around the room

Thumb Up

They have their places...

We've got a PTZ ethernet (or optionally, WiFi) camera with microphone (but no speakers), which we have dual purposed - in the night as a baby monitor (using a now aging Nexus 7 as the monitor) and in the daytime, it can be used to keep an eye on outdoors (via a window).

It's "LAN only", doesn't connect to t'internet - or allow connections from t'internet - if we're "off LAN" we access it via a VPN - but we're probably not the target market Samsung are addressing here...

Google may just have silently snuffed the tablet computer


Already said above, but the Pixel-C is a lovely bit of kit (although I can recommend NOT dropping it, as whilst the screen survived, trying to 'undent' the metal case is challenging!)

I've got a Nexus 7 (2013), which won't go beyond Android 6, and is a bit slow, but it's used for some games, and principally a baby monitor (IP Cam viewer) at night.

The Pixel-C is just a joy to use when you CBA with a phone. A bit heavy, but sometimes heft is good.

I was considering a Pixel Phone to replace the 5X, but £599 or £820? They're having a giraffe.

NASA starts countdown for Cassini probe's Saturn death dive


Ah, the braided rings: perhaps THIS time a probe will send back a decent photo of 'Message Bearer' ... ;-)

I for one welcome the Chtaptisk Fithp...

Delete Google Maps? Go ahead, says Google, we'll still track you


Nexus 5X here with Android 7.0 on.

Location for the Store is "off" and I didn't' turn it off, it's just "off". I didn't see any request to enable it either....

The only thing I did note was that I had Developer mode "uncovered" before the 6.0-7.0 upgrade, but it was disabled. Post upgrade, it was ENABLED and "Automatic system updates" were enabled...

Google swats Nexus 5X vulnerable fastboot memory dump flaw


A link to other materials here would be useful :)

The 5X has an encrypted file system, however other sources on this vuln show the password is left sitting "unguarded" in the extracted image, so someone with the image could unlock the device, or clone it.

Hopefully Google have either salted this passphrase now, rather than just stopping the panic enabling extraction.....

'I'm sorry, your lift has had a problem and had to shut down'


One of the offices I work at has three lifts. Above each one, on each floor, is a 4"x2" ish panel, showing the floor the lift is on, and a directional arrow.

Except one day the left most one was showing a teeny tiny Windows 2000 screen.....(not a BSOD, just the desktop...)

YouTube breaks Sony Bravias



I decided I'd never have a Smart TV, until the only way I could get a larger panel with 3D support was a Smart TV.

So I had a play, and while the interface isn't super whizzy, it works - although the unit has the most stupid design flaw - I can turn if OFF via Ethernet, once it's OFF, it doesn't respond to WoL, so you have to resort to a pinky interface, or good old IR. Well done there, that manufacturer.

But still, as it the box supports YouTube, Google Play Movies, Talk Talk TV/BlinkBox & NowTV. If any of those fail, those apps all support Chromecast, and I've got one of those too. £25 isn't a lot to shell out. Or, as mentioned, I could resurrect the Pi2 I have lying around...

'Nigerian scammer' busted after he infected himself with malware


Re: Amazingly

I've got one of these (and scanned it for posterity) if El Reg would like to run an expose on it...

It ticked all the boxes:

1) Shiny company name

2) Shiny company address (Geneva) - which, if Streetviewed, is a cinema and hairdressers....(presumably a unit above it)

3) Webmail email address

4) "Phone" number that points to a REGUS FAX number

5) Offer of lots of good investments

Windows 10 Anniversary Update is borking boxen everywhere


The upgrade has had some fun with my machine.

a) Restart after updating - well, no, it powered the machine off

b) ICMP (inbound) ping/response was disabled, after I'd explicitly enabled it

c) Jumbo Frame support magically got disabled

d) System Restore - also magically turned off - I created a Restore Point FIRST, and when I ran some diags/checks afterwards, System Restore on C: was disabled.

I'd advise you to check all your settings, just in case...

Windows 10 Anniversary Update: This design needs a dictator


It landed on my PC.

"Restart to install updates" - except it shutdown and powered off. Nice.

It also disabled incoming ICMP (which I'd explicitly turned ON before). Nice. That upset my elementary monitoring.

It turned off my Jumbo Frame support, which upset my file transfer speeds, and me.

I'm also using a local account, but it said it required access to my MS account "for something". It then showed up under Account again (since removed and logged out and it's not come back. Yet).

It enabled Windows Ink without asking. It got turned off.

Cortana is absent, as I'm using a local account. Good.

Facebook to kill native chat, bring opt-in crypto to Messenger


Re: Article short on details

^^ This. Use the mobile app, get requested to install Messenger. Use the mobile website, get diverted to install Messenger. Cancel, and you can use the mobile website. If you use a mobile with "desktop view" it kind of works (but Android & Facebooks auto scrolldown/refresh keeps confusing it).

Important messages still go via SMS, and some friends have already migrated to Signal.

'Windows 10 nagware: You can't click X. Make a date OR ELSE'


IANAL, but doesn't that constitute Misuse of Computers somewhere along the line?

Or do the terms of Win7 (et al) basically state you absolve your self of any/all choice? Or (worse) that the wording regarding "updates" is that they are offered without warranty, and WinX gets labeled as an "update" to get them around it?

Disclaimer : I have WinX (Home & Pro) on two machines, and don't hate it. Only gripe is the "Oh hai, buy Office 365 plz" self installing appvertisement...

A UK digital driving licence: What could possibly go wrong?



Well, combine it with ANPR/speed camera and facial recognition...

"You have....FIVE...points remaining on your licence...."

Official: Microsoft's 'Get Windows 10' nagware to vanish from PCs in July


Replace one with another...

It may well stop nagging you, but I've just fired up my W10 box, to have a notification that my version of Office (2007, paid for, working nicely still) is not the latest one, and would I like to upgrade? (50% off! Buy now! Every year!)

Erm, no thanks!

Half of people plug in USB drives they find in the parking lot



"George found it. George was curious.

Now George is an Unemployed Silly Bugger.

Don't be like George - hand it in, don't plug it in".

Nest bricks Revolv home automation hubs, because evolution


Re: Firmware

"I doubt that's as simple as people may want it to be. Even if the cloud-dependency is limited to the user interface (i.e. telling the home control unit how you want it to react to specific events, which it then continues to do autonomously) it needs to have that user interface added somehow, either on the control unit, or by adding that functionality to the control app on your phone/tablet/laptop."

It's not simple, but it's an option. There are other solutions to call commands - or they could expose REST type interfaces. OpenRemote (that I use) ties multiple IoT things together, and whilst OR does use a cloud designer, once it's synced to your controller device (in this case, my NAS), it no longer needs the cloud. If their servers die, I can't extend it easily, but I'm not entirely hamstrung. There are bound to be other similar things out there.


Is there a WiKi of IoT makers and wether they do/don't need cloud? There probably is, I'm just lazy and confident someone will be along with a LMGTFY link shortly :)

I have a blend of things, most of which have 'net connectivity in some form, but not all are cloud dependent. Philips Hue can be cloud linked, but doesn't need to be. LightwaveRF is the same (but by default is cloud linked). My biggest issue has been vendors (i.e. LightwaveRF) constantly developing the firmware and not publically releasing any API - so when you figure something out, it often breaks without warning - although their helpdesk has gotten much better at providing info post breakage!

I hadn't heard of Revolv, but would at least hope that they (or any other bought out team) would be able to provide a last firmware update that decouples the unit from the cloud and operate locally.

Google emits Android N developer preview early to smoke out bugs



"The Google Store Promotional Codes Terms apply. Offer (one redemption per person) only available in the United States while supplies last."

Well sheeeeeet.

Stray electronic-magnetic leaks used to harvest PC crypto keys



Soooo, if they (currently) require multiple runs to capture/identify the signals - presumably any machine running "other code" at the same time (as most machines do?) might well create obfuscation? Also, why not simply build in random calls during the decrypt, for optional "secure decryption" - every X operations, head -Y /dev/random into /dev/null (or /tmp/file), and use a decent RNG to generate X & Y. It'd slow the process down, but theoretically create enough chaff to hide things, and wouldn't be the same on any replay?

Microsoft encrypts explanation of borked Windows 10 encryption



"I'm sorry Dave, you want to add encryption to a self encrypting drive? I'm afraid we (and various agencies of choice) can't decrypt that (so we don't like it)".

Well, probably.

I was mortified to see the default is to save BitLocker keys "into the (MS) cloud" for you(r safety). Unless you have Win 10 Pro, in which case you are allegedly deemed capable of not losing your keys.

No boxy Volvo: Chilling in the S60 D3 Manual R-Design Lux Nav


Re: Lane keeping aid

"The adaptive cruise on the Volvo is easily the best of any car out there, far smoother than competing systems and able to follow the car in front at a range of distances from "miles away" to "Audi". "

Not on mine, although maybe that's as I have a '60 plate S60 D5 which was one of the early release "new look" ones.

The adaptive cruise is good, but the closest it lets you get is at least 2-3 car lengths, whereas the average Audi can get so close they may as well be in the back seat.

Also, mine is a bit naff at spotting people changing lanes into yours, between the car and the one it's following - you can watch them move over, until they are firmly in the lane with you and driving normally, THEN the car will go "ooh, a car" and promptly slow down/brake. If you have the distance set at 2-3 car lengths, that can be quite 'interesting'. I've learned how it behaves, but I suspect it REALLY annoys the car(s) behind....

Hacking Team spyware rootkit: Even a new HARD DRIVE wouldn't get rid of it



Does BitLocker assist here?

Assuming you've turned on the PCRs which check the BIOS and/or option ROMs haven't changed checksum, and you've got boot protection enabled (i.e. key/passphrase required) then the O/S should have a hissy fit on boot up, which should ring alarm bells?

Drill, baby, drill: HIDDEN glaciers ON MARS hold 150bn cubic metres of precious frozen WATER



"Start the reactor...."

Ten things you always wanted to know about IP Voice


It's fun....

I saw SIP in use originally in a commercial arena, and wanted to play - so setup Asterisk, with an SPA3102 linked to my DECT handsets. VoIP + PSTN failback, all worked nicely - until you realise the some PSTN carriers don't play nicely (Virgin + Clear on Disconnect? Not without lots of emails).

I've used 'free' systems like Voxalot, and commercials (like SipGate, VoIP.co.uk etc) and never had bad quality on any. The hardest bit is generally sorting out why Asterisk will play nicely with Trunk Provider 1, and not Trunk Provider 2....typically down to some esoteric setting.

But it's nice wangling cheaper/lower cost calls. If Google Voice hurried up and came to the UK properly I'd be plugging that in too....

FREAK show: Apple and Android SSL WIDE OPEN to snoopers


Nexus 5 / Android 5.0.1 / Chrome 40.0.2214.109 - oops

Mine comes up with a nice fat "Warning! Your client is vulnerable to CVE-2015-0204".

Google crashes supposedly secure Aviator browser


Re: Own goal by Google...

It is indeed. Run with SandboxIE and Ghostery/Adblock (as mentioned) it is quite the speedy thing....

Chromecast video on UK, Euro TVs hertz so badly it makes us judder – but Google 'won't fix'



To be fair, I hadn't seen any juddery images, although I do have a nice TV which does iron out a lot of crap (24Hz compatible TV, AMP and BD player have removed any jerky BD videos for example).

However, since Android Lollipop landed, my previously working (on 4.4.4) "Cast Screen" functionality has gone walkies. YouTube and other apps work, but I (and others, judging by the forums) can't cast screen anymore...

Way to go backwards!

Man brings knife to a gun fight and WINS


I demand....

Tom Selleck and a police unit in the style of "Runaway" immediately!

A moment of brilliance? UPnP for Internet of Stuff lightbulbs


If you're willing to dabble....

OpenRemote (www.openremote.org) - it's a free (for home use) server you can clap on a box at home (if you don't mind a JVM) with Android and iPhone clients, which lets you talk to anything that has an IP.

My *nix based installation serves custom screens and talks to Philips Hue, LightwaveRF, Globalcache iTach (IP2IR), and an IP enabled A/V receiver. Others have much more! Now both mine and my wife's phones (and our tablet) can act as unified remotes. My server also has a VPN so (if needs be) I can run things remotely/securely (OpenSSL/BASH vulns aside!)

Personally, having found Hue to be the easiest to work with, I'd love everything to speak JSON and use REST APIs - but as long as it has an API, I can wrap it in :)


Biting the hand that feeds IT © 1998–2019