A brief history of the Internet

Network Engineers created the Internet and packets flowedDevelopers wrote shitty applications borne from shitty business requirements Security Engineers created the firewall and gave it to Network engineersfewer packets flowed, and developers were angry with the Network engineers To bypass the firewall, developers moved all their traffic to 80, their apps were still shitty Security engineers created the IDS and gave it to the Network engineersfewer packets flowed, and developers were angrier still with the Network engineers
Read more...

Equifax Breach - Communicating impact and actions

This entire response has been comically bad to watch unfold. The type of data and scope of breach were bad enough but add in the bumbling response that reinforced a message of "these guys don't get it" across the industry and press...and it quickly became epic. But I'm inside the industry and have an understanding of how bad it is. What about those friends and family we have outside of industry, who might only find out about this through some apocalyptic local news story?
Read more...

To ignore or not?

Updated 11/16/2016, 11:15AM

Merrimack College's Assistant Professor of Communication and Media, Melissa "Mish" Zimdars created a list of False, Misleading, and Clickbait websites (Google Doc) as a resource for her students who are learning about the media landscape. This list has been making the rounds on social media and it intrigued me for its potential operational uses. For me, this meant loading the sites into a "blacklist" I maintain on a proxy server that all of my internet traffic goes through. The proxy would prevent any content hosted on the domain names from even being loaded. However, most people don't have access to this type of infrastructure, so I started looking at browser plugins like uBlock Origin, which allows for the total blocking of websites based on domains. Using Melissa's list as a source and uBlock's scripting, I can now easily block 80% of the bullshit I see on a daily basis flowing through social media. Success!

I love technology and the quick wins that can impact your life, but too often we don't step back to consider if the win is real or false. Is blocking these sites the best idea? When many people digest memes as fact or get their "news" from bullshit sites, is ignoring the source all together the right thing to do? "Oh, I can't read this. I blocked the domain for bullshittery," is not a convincing counter argument. Especially to someone who would believe a meme as fact or who dabbles in light conspiracy theory. If you don't know what is being said, how can you refute? I was ruminating on this when another article passed in front of my eyes, detailing a solution put together by a Princeton Hack-a-thon Team. Their solution is to simply overlay a button that says "UNVERIFIED" next to any story shared on the Facebook platform that does not meet a list of criteria they set. Perhaps there could be a natural integration of this list with the Princeton team's solution. This prevents wholesale blocking of sites and allows people to proceed with caution. 

Larger questions of information consumption and curation still remain. The Princeton team claims they rely on "AI" to understand if the site engages in bullshittery or not. How much can we trust that process? Mish's list was hand curated, but what qualifications does she have in judging bullshit? I suspect very good ones, but that question needs to be asked of her and every "news" source that crosses your path. What qualifications do I have to write this post? Do I have an authoritative voice for this subject? Not really, but I love asking questions.

The internet has provided the world such an amazing platform. The platform has been monetized by advertising, giving rise to the idea of click-bait. Inflammatory headlines, purposefully skewed facts, memes, and more are all designed to lure people to sites. As people click on those links, money is made by serving ad impressions. Driving traffic to sites is the #1 business case for the internet. So site owners are now incentivized to make headlines wilder and wilder. To play fast and loose with facts. To call their site satire somewhere buried in legalese while every other outward appearance is that of a legitimate site. Beyond that we also have outfits that are purpose built on peddling influence around the globe. A 2015 article detailed Russian Web Brigades, whose sole purpose was to flood the internet with pro-Russian propaganda. Their method was to create multiple sources that seemed to confirm information independently, providing journalists with enough source material to feel comfortable publishing on real platforms. This format was then turned toward US Communities, detailed in another 2015 article about the Russian Trolls. There is even circumstantial evidence that these same trolls were pimping for the trump campaign.

This puts everyone at a disadvantage for finding truth. Does increasing the signal to noise ratio make self-censorship acceptable? Is this action "censorship" when it ultimately results in the removal of half-truths, lies, and manipulation from your information sources? Is there an acceptable level of bullshittery that we can deal with? For example, I removed all satire sites from Mish's list because I can cognitively identify satire...others may not be able to. Do we lose humor to deal with edge case idiocy?

The scale of this issue is beyond memory capacity for humans and new sites could be added to Mish's list every day. Bullshit at internet scale is beyond human comprehension. The Princeton team's solution absolutely helps but how else can we increase the signal to noise ratio? Are blocking tools acceptable? I can barely remember where I've left my keys every day much less remember if some random website is real, fake, partially fake, clickbait, satire, or pure evil. Certainly context of the site and tuning our perception can help filter things out naturally but, again, the scale of the issue is already large and will continue to grow.


Read more...

Dancing madly on the lip of a volcano

John Oliver spent 18 minutes discussing the latest iteration of the crypto wars sparked by the recent Apple v. FBI case. In his summation, he provided a fantastic metaphor for cybersecurity, "dancing madly on the lip of a volcano". I think this metaphor is especially pointed as we see a greater increase in regulatory intervention by bodies with very limited views or education into security. There is no global consensus on cyber security and the house is on fire as of late.
Read more...

Verizon Supercookies

The Federal Communications Commission has settled its Verizon Wireless "supercookie" probe, resulting in better consumer controls and transparency between the provider and its customers. The FCC's investigation found that the company had inserted unique, undeletable identifiers into web traffic and used these to identify customers in order to deliver targeted ads from Verizon and other third parties. As a result of this settlement and the FCC investigation, Verizon Wireless is notifying consumers about its targeted advertising programs, will obtain customers' opt-in consent before sharing UIDH with third parties, and will obtain customers' opt-in or opt-out consent before sharing UIDH internally within the Verizon corporate family.
Read more...

PrivacyWonk moves to TLS (finally...)

After waiting for what seemed like an eternity, the site finally has a Let's Encrypt certificate! I took some time to setup TLS properly this evening (total project time: 2 hours), following fantastic guides from Mozilla and other sources (WeakDH.org, Qualys SSL Server Test, and Scott Helme's SecurityHeaders) ensure a secure and modern implementation. See reports below. Was this necessary for a site that simply serves up my idle thoughts on privacy and security?
Read more...

IP analysis shell function

Brian Warehime of nullsecure.org published a new threat intel piece, walking his readers through his analysis of incidents captures through his honeypot. The entire post, http://nullsecure.org/threat-intel-web-crew/, is fantastic and I encourage you to read it top to bottom. One snippet I found incredibly useful was a simple bash shell function that saves a great deal of time when performing IP based analysis. function ipgrab() { read line; echo $line | grep -E -o '[0-9]{1,3}\.
Read more...

Breach response for the jaded

I heard about the breach at [$COMPANY_NAME$] and the [$BREACH_QUANTITY$] [$DATA_TYPE$ one of "credit card", "patient record", "social security number", "user login", "hashed passwords", "national security secrets", "Hollywood star's 'selfies'"] compromised. Of course this is a serious matter and is the largest since [$YESTERDAY_DATE$] The people at [$COMPANY_NAME$] have not yet released details, which is appropriate given an incident response of this magnitude. I understand that they have the [$RESPONDER_NAME$ multiple of "
Read more...