Tor has written about this.

Hacker News thread.

** *** ***** ******* *********** ************* Simson Garfinkel on Spooky
Cryptographic Action at a Distance

[2024.10.30] Excellent read. One example:

    Consider the case of basic public key cryptography, in which a personΓÇÖs
    public and private key are created together in a single operation.
    These two keys are entangled, not with quantum physics, but with math.

    When I create a virtual machine server in the Amazon cloud, I am
    prompted for an RSA public key that will be used to control access to
    the machine. Typically, I create the public and private keypair on my
    laptop and upload the public key to Amazon, which bakes my public key
    into the serverΓÇÖs administrator account. My laptop and that remove
    server are thus entangled, in that the only way to log into the server
    is using the key on my laptop. And because that administrator account
    can do anything to that server -- read the sensitivity data, hack the
    web server to install malware on people who visit its web pages, or
    anything else I might care to do -- the private key on my laptop
    represents a security risk for that server.

    HereΓÇÖs why itΓÇÖs impossible to evaluate a server and know if it is
    secure: as long that private key exists on my laptop, that server has a
    vulnerability. But if I delete that private key, the vulnerability goes
    away. By deleting the data, I have removed a security risk from the
    server and its security has increased. This is true entanglement! And
    it is spooky: not a single bit has changed on the server, yet it is
    more secure.

Read it all.

** *** ***** ******* *********** ************* Tracking World Leaders Using
Strava

[2024.10.31] Way back in 2018, people noticed that you could find secret
military bases using data published by the Strava fitness app. Soldiers and
other military personal were using them to track their runs, and you could
look at the public data and find places where there should be no people
running.

Six years later, the problem remains. Le Monde has reported that the same
Strava data can be used to track the movements of world leaders. They donΓÇÖt
wear the tracking device, but many of their bodyguards do.

** *** ***** ******* *********** ************* Roger Grimes on Prioritizing
Cybersecurity Advice

[2024.10.31] This is a good point:

    Part of the problem is that we are constantly handed lists...list of
    required controls...list of things we are being asked to fix or
    improve...lists of new projects...lists of threats, and so on, that are
    not ranked for risks. For example, we are often given a cybersecurity
    guideline (e.g., PCI-DSS, HIPAA, SOX, NIST, etc.) with hundreds of
    recommendations. They are all great recommendations, which if followed,
    will reduce risk in your environment.

    What they do not tell you is which of the recommended things will have
    the most impact on best reducing risk in your environment. They do not
    tell you that one, two or three of these things...among the hundreds
    that have been given to you, will reduce more risk than all the others.

    [...]

    The solution?

    Here is one big one: Do not use or rely on un-risk-ranked lists.
    Require any list of controls, threats, defenses, solutions to be
    risk-ranked according to how much actual risk they will reduce in the
    current environment if implemented.

    [...]

    This specific CISA document has at least 21 main recommendations, many
    of which lead to two or more other more specific recommendations.
    Overall, it has several dozen recommendations, each of which
    individually will likely take weeks to months to fulfill in any
    environment if not already accomplished. Any person following this
    document is...rightly...going to be expected to evaluate and implement
    all those recommendations. And doing so will absolutely reduce risk.

    The catch is: There are two recommendations that WILL DO MORE THAN ALL
    THE REST ADDED TOGETHER TO REDUCE CYBERSECURITY RISK most efficiently:
    patching and using multifactor authentication (MFA). Patching is listed
    third. MFA is listed eighth. And there is nothing to indicate their
    ability to significantly reduce cybersecurity risk as compared to the
    other recommendations. Two of these things are not like the other, but
    how is anyone reading the document supposed to know that patching and
    using MFA really matter more than all the rest?

** *** ***** ******* *********** ************* Sophos Versus the Chinese
Hackers

[2024.11.04] Really interesting story of SophosΓÇÖs five-year war against
Chinese hackers.

** *** ***** ******* *********** ************* AIs Discovering
Vulnerabilities

[2024.11.05] IΓÇÖve been writing about the possibility of AIs automatically
discovering code vulnerabilities since at least 2018. This is an ongoing
area of research: AIs doing source code scanning, AIs finding zero-days in
the wild, and everything in between. The AIs arenΓÇÖt very good at it yet,
but theyΓÇÖre getting better.

HereΓÇÖs some anecdotal data from this summer:

    Since July 2024, ZeroPath is taking a novel approach combining deep
    program analysis with adversarial AI agents for validation. Our
    methodology has uncovered numerous critical vulnerabilities in
    production systems, including several that traditional Static
    Application Security Testing (SAST) tools were ill-equipped to find.
    This post provides a technical deep-dive into our research methodology
    and a living summary of the bugs found in popular open-source tools.

--- 
 * Origin: High Portable Tosser at my node (618:500/14.1)