Category Archives: Security

Google Lights $1M on Fire to Protest Separation of Test and Production

Advertising news sources are saying that it was an accident.

On Tuesday at about 7 p.m. ET, many publishers both in the U.S. and Australia saw many–if not all–of their ad slots filled with display ads featuring nothing but the color yellow. They were up for 45 minutes.

The costly mistake occurred during a Google training program when an employee accidentally purchased the 300×250 ad units, the sources said. Publishers who checked their logs saw the advertisements came from theiconic.au.com, an Australian retailer.

Estimates are upwards of $1m burned in just hours. Google made an official statement, confirming both payments and that the protest didn’t encounter any resistance.

We will honor payments to publishers for any ads purchased and are working hard to put safeguards in place to ensure this doesn’t happen again

“Top 10 Security Disasters in ML: How Laurel and Yanny Replaced Alice and Bob”: 2019 RSAC SF Presentation

I’ll be presenting again at the RSA Conference in SF, discussing how the information security industry shifted fundamentally after 2014 from ongoing confidentiality to growing integrity concerns.

SESSION ID: MASH-F02

TITLE: Top 10 Security Disasters in ML: How Laurel and Yanny Replaced Alice and Bob

SCHEDULED SESSION DAY AND TIME: Friday, Mar 08, 9:50 AM

ROOM: Moscone West 2007

LENGTH: 50 minutes

ABSTRACT: A seismic shift is upon us. Integrity flaws stand looming and untamed despite the security industry making great progress in availability and confidentiality awareness and control. Now a crisis of trust is developing as developers rush into “machine learning” with integrity a paramount risk. This talk will expose keys of past breaches of integrity to help attendees prepare to control ones just ahead.

QUICK ABSTRACT: If you thought confidentiality breaches were a crisis, are you ready to detect and prevent integrity failures at machine speed?

Apple Alert: SSD Data Loss in 13-inch Macbook Pro

In an awkwardly worded statement, the laptop manufacturer has alerted owners of its 13-inch Macbook Pro that SSD firmware flaws are causing serious data corruption and even complete failure.

Apple has determined that a limited number of 128GB and 256GB solid-state drives (SSD) used in 13-inch MacBook Pro (non Touch Bar) units have an issue that may result in data loss and failure of the drive. 13-inch MacBook Pro units with affected drives were sold between June 2017 and June 2018.

Apple or an Apple Authorized Service Provider (AASP) will service affected drives, free of charge. Apple recommends having your drive serviced as soon as possible.

A few things stand out here:

  1. The firmware update means an Apple “technician will run a utility”
  2. The repair process is to backup your data, update the SSD firmware in a destructive manner, and then restore all your data from backup. And this begs the question why someone can’t do the update themselves if it means restoring a backup to a fresh OS install. Apple ought not be worried about data loss or failure in the process as that’s a guaranteed outcome. Are they concerned the firmware update would brick the laptop, or that the utility would grant too much authority to the end user?
  3. Data already destroyed by the faulty SSD can not be recovered
  4. Anyone who already paid for this service can get a refund. Although at the same time, it only “covers affected MacBook Pro models for 3 years after the first retail sale of the unit”. The repair will not be free if your SSD has faults beyond 3 years…

2018 Ebola Crisis Worsens as US Regime Denies Aid

Here’s a pithy comment by Peter Salama, head of the new Health Emergencies Program at the World Health Organization, about factors leading to Ebola crisis unfolding this year in DRC:

These viruses manage to exploit social vulnerabilities and fault lines. That’s what we’re seeing in this Ebola outbreak starkly.

And even more to the point:

In the last two years since I have been here, 80 percent of our major outbreaks have been in conflict-affected areas. This is the issue of the future.

The issue of urban outbreaks of high-threat pathogens is really an issue of our generation. I don’t think we’ve fully grappled with that. Now with yellow fever, plague, with Ebola, we are starting to see these patterns. All bets are off [in terms of] thinking we know about the transmission of diseases because of what happened in rural outbreaks in the past. It’s completely different now.

Ok, so you have this data showing conflict-affected areas are where the major outbreaks occur, and that is “the issue of the future”. Consider this in terms of infected drones easily deployed over/under/around barriers into urban areas, and then rapid lateral transmission.

I’m not trying to think out of the box here. This is an ancient security worry, for those familiar with the history of siege weaponry.

Who (pun not intended) can guess the current US regime’s response to the outbreak of a high-threat pathogen in the place most expected? Perhaps the title of this post gave away the answer.

Vox reporter Julia Belluz asks Salama the following:

The US pulled its Centers of Disease Control and Prevention workers out of Beni, the outbreak epicenter. They decided it was too dangerous for America’s best Ebola experts to be there — and it sounds like they are not coming back anytime soon. […] But I understand Canada, the UK, even nonprofits with US personnel, are sending people, and you have hundreds of WHO officials deployed. Is the US government an outlier?

This makes the American leadership appear weak and feckless; and Salama replies very diplomatically:

The US government is the main country that has had constraints.

Insecurity of US Regime Impacts Trade

China has downgraded the rating of US ability to partner or deliver goods, and is distancing itself from the instability of a white nationalist White House.

…the economic relationship between the U.S. and China has been permanently altered.

[…]

The president’s abrupt return to brinkmanship…underscored U.S. unpredictability.

[…]

…imposition of tariffs on more than $250 billion in Chinese goods already has prompted China to [buy] soybeans from Brazil rather than Indiana or Iowa.

[…]

Xi has personally directed a campaign to promote “self-reliance,” with public tours of China’s modern industries in the south and its traditional Rust Belt region in the northeast.

“The turn away from reliance on the U.S. for agricultural and industrial inputs will accelerate,” Charles W. Freeman Jr., a former U.S. diplomat said in an email.

This really isn’t about China or America, though. Anyone familiar with the erratic performance and quick failure of a certain steakhouse, casino, airline…probably wouldn’t want to hitch their wagon to a horse unwilling to pull its own weight let alone help anyone else.

Top Australian Soldier Accused of War Crimes

You may have noticed a post the other day about a decorated SEAL charged with war crimes.

Some have decried this investigation as political maneuvering by those serving with the accused, while others have said they simply do not believe in challenging the accuracy of decorated war veteran records.

Meanwhile I noticed a similar story brewing in Australia about special forces with some interesting commentary on both political maneuvering and motives among those involved.

In a statement to Fairfax Media sent on Wednesday evening, an AFP spokesperson said: “The Australian Federal Police (AFP) received a referral to investigate allegations of war crimes committed by Australian soldiers during the Afghanistan conflict.”

[…]

Fairfax Media has confirmed through multiple military sources that both the AFP inquiry and the Brereton inquiry have gathered extensive information from decorated serving and former special forces veterans who served alongside Mr Roberts-Smith in Afghanistan. The Brereton inquiry has interviewed more than 200 witnesses on oath since 2016.

[…]

Dr Nelson, a former defence minister, has repeatedly attacked the media reporting and Inspector-General’s inquiry into Mr Roberts-Smith on the basis that it is taking too long and because, “We want to believe in our heroes”.

But Fairfax Media has confirmed from special forces insiders that over a dozen SAS soldiers are assisting the Brereton inquiry. Many believe that scrutiny of allegedly unlawful acts is needed to preserve the integrity of the regiment and are scathing of Dr Nelson’s advocacy, believing it amounts to an attack on soldiers willing to raise concerns about alleged battlefield combat.

Another high-profile supporter of the Brereton inquiry is former SAS officer and Afghanistan veteran Andrew Hastie, who is now a Coalition MP.

200 witnesses, a dozen soldiers assisting and a former officer/veteran who entered politics supporting the inquiry. It seems to me those most dedicated to the professionalism of their craft will welcome inquiry into their actions, as it validates what they already know or uncovers things they would want to hear.

And on that note, I have concerns with the response to an inquiry in this case

…Mr Roberts-Smith, he has vehemently denied any wrongdoing in Afghanistan, insisted he has a “spotless record” and insisted those making claims about him are disgruntled or jealous liars

Any auditor will tell you that angry claims of a “spotless record” can be a tell. Continuous improvement is what people aim for, not spotless records (indicates methods of intimidation and coverup). Also accusing messengers of jealousy can be a tell, which doubles-down on the risk that the accused believes spotless records are a function of destroying critics.

We definitely saw this behavior in the unraveling of Theranos, for example.

Q: The Theranos story has many remarkable aspects. What was the most striking thing you found during your reporting?

A: Two things. One, the egregiousness of the lies, the serial lies, of Elizabeth’s serial lies. Sunny’s, too.

The second thing is the unbelievable campaign of intimidation against me and my sources. I’ve been a journalist for more than 20 years and I’ve never encountered anything close to that. Still, I’m a big boy and the Wall Street Journal has been around for a long time. But Theranos went after my confidential sources. They threatened doctors in Arizona who had spoken to me on the record. It was beyond the pale.

And also with Lance “Live Wrong” Armstrong, as extensively documented

The original whistleblower who helped bring down Lance Armstrong has revealed how she was tormented and intimidated for more than a decade by the cyclist and his allies as they stopped at nothing in their bid to silence her.

Mr Roberts-Smith does himself a disservice by insisting he has a spotless record, and perhaps you can see why that’s not even an objective goal. Even if it doesn’t alarm you on its own, though, attacking critics makes the spotless record seem even less believable.

US Updates Antique Safety Standards to Allow Modern Train Technology

Interesting news from Streets Blog about the change in security standards that now allows foreign train technology to the US

Building trains to unusual U.S. safety standards for the small American passenger rail market made rolling stock purchases needlessly expensive. Opening the door to standardized European train specifications will significantly lower prices.

Rail operators are expected to save hundreds of millions of dollars a year as a result, enabling them to invest more in operating train service and upgrading rolling stock and infrastructure.

Florida Police Chief Sent to Jail For Conspiracy Against Black Men

The Biscayne Park police chief had tried to claim his department solved 100% of burglaries, when in fact the Justice Department reports he simply directed his staff to blame burglaries on black men and arrest them without evidence:

Former Chief Atesiano previously pleaded guilty to acting under color of law as chief of police when on three separate occasions he ordered former officers Guillermo Ravelo, Charlie Dayoub and Raul Fernandez to falsely arrest and charge individuals with unsolved burglaries. According to court filings, Chief Atesiano intentionally encouraged those officers to arrest individuals without a legal basis in order to have arrests effectuated for all reported burglaries. This created a fictitious 100% clearance rate for that category of crime.

[…]

“Putting an arrest statistic above the rights of an innocent man instead of working to protect all our citizens undermines the safety goals of every Miami-Dade police department,” said State Attorney Katherine Fernandez Rundle. “Miami-Dade’s residents deserve honesty and integrity, qualities that Raimundo Atesiano deliberately failed to deliver.”

Atesiano was sentenced to 36 months in jail.

Ronald Reagan’s “Special Unit” Soldier Sentenced to 5,160 Years in Jail for Mass Murder

Ronald Reagan’s arrival to office in 1981 was accompanied by a sentiment that the prior U.S. President’s policies should be rolled back, regardless of what they were.

One of the policies ended was the arms embargo on Guatemala, put in place by Jimmy Carter due to human rights abuses by that regime.

We know today that the CIA in late April 1981 was sending memos that rolled up to the White House describing the massacre of civilians within Mayan Indian territory. CIA memos documented how social support for guerrillas was high enough that soldiers said they were “forced” to fire indiscriminately into non-combatants.

Two months after news of the massacre Reagan un-blocked $3.2 million in military support to Guatemala’s army. The unblocking method used was crafty, as Reagan reclassified trucks and jeeps to transport Guatemalan soldiers to commit massacres. Military vehicles known to be used in the massacres no longer were under the human rights embargo.

One might be tempted here to ask “ok, but they’re just trucks and jeeps, so general use, right?” History helps a little, as it reminds us America has made this mistake before, facilitating genocide for profits:

GM’s president, Alfred P. Sloan, knew what was happening in Germany. Sloan and GM officials knew also that Hitler’s regime was expected to wage war from the outset. Headlines, radio broadcasts and newsreels made that fact apparent. America, it was feared, would once again be pulled in.

Nonetheless, GM and Germany began a strategic business relationship. Opel became an essential element of the German rearmament and modernization Hitler required to subjugate Europe. To accomplish that, Germany needed to rise above the horse-drawn divisions it deployed in World War I. It needed to motorize, to blitz — that is, to attack with lightning speed. Germany would later unleash a blitzkrieg, a lightning war. Opel built the 3-ton truck named Blitz to support the German military. The Blitz truck and its numerous specialized models became the mainstay of the Blitzkrieg.

In 1935, GM agreed to locate a new factory at Brandenburg, where it would be geographically less vulnerable to feared aerial bombardment by allied forces. In 1937, almost 17 percent of Opel’s Blitz trucks were sold directly to the Nazi military.

The Guatemalan government was emboldened by the new U.S. President’s support of their killing plans. Thus by early October 1981 the U.S. State Department was talking about Reagan’s ambassador General Vernon Walters meeting with Guatemalan leaders to discuss repression measures. Guatemalan General Fernando Romeo Lucas Garcia “made clear that his government will continue as before that the repression will continue.”

This wasn’t really any kind of secret. Word of violations were published by groups like the Inter-American Human Rights Commission who in October 1981 openly called out the Guatemalan government for “thousands of illegal executions.” The Reagan Administration engaged in whataboutism and deception to avoid addressing why they would sell military aid linked to mass human rights violations; falsely claiming Guatemalan human rights violations were a guerrilla strategy (as I’ve explained elsewhere).

Things escalated quickly after the U.S. government support shifted from embargo to support. The Guatemalan army issued instructions in 1982 that any resistance or incoming fire from a town or village meant everyone in the town is hostile and would be destroyed.

This might sound similar if you heard recently the current U.S. regime call to troops that they treat rocks and bottles as rifles.

In fact, Reagan’s support led to a fundamentalist Christian taking control of Guatemala in a March 1982 coup d’etat. General Efrain Ríos Montt seized power and announced a policy of “rifles and beans” — either eat beans quietly in obedience to dictatorship or be killed by rifles. In response Reagan described him as “a man of great personal integrity”.

…more than 600 Indian villages in the Guatemalan highlands were eradicated or occupied by the military. The slogan “rifles and beans” meant that pacified communities would get “beans,” while all others would be the target of army “rifles.”

In March 1983, Americas Watch condemned the Guatemalan army for human rights atrocities against the Indian population.

New York attorney Stephen L. Kass said there was proof that the Guatemalan government carried out “virtually indiscriminate murder of men, women and children of any farm regarded by the army as possibly supportive of guerrilla insurgents.”

Three months after the coup was applauded by Reagan, government death squads were unleashed on civilians. And Reagan then increased military aid in 1983 to $6 million despite evidence of civilian massacres increasing at the hands of American-trained soldiers riding in American vehicles, again reported in memos to the White House.

Such memos might sound strange to fans of Reagan, so consider the kind of writing found in his official documents

During the height of Montt’s genocidal counterinsurgency campaign, a CONFIDENTIAL cable from Secretary of State George Shultz praised his “impressive progress in human rights”.

(click that document link if you want to help disclose more strange truths from primary source materials)

In effect, the Reagan administration worked to reverse Carter’s human rights policy, centralizing power in U.S. presidency through deception and tricks in order to expedite military support to violent dictators killing democracy.

Within the U.S. government, there was no apparent struggle to reconcile the notion that the Guatemalan government “badly needed” arms with its horrific crimes. There was only a struggle to determine preconditions (which were never met) in order to gain minimal support from Congress so as to circumvent protections against abetting war criminals, which were put into place by the Carter administration.

Ríos Montt wasn’t an isolated case, either. Look into Regan’s support for genocide by Indonesian dictator Suharto, or why Chadian dictator Habre (another recipient of President Reagan’s “product shipments”) was sentenced to life for war crimes.

So there is our backdrop to news today from Guatemala, about prosecution of Reagan’s “special unit” for their attrocities:

A Guatemalan former soldier has been sentenced to more than 5,000 years in prison for his role in a massacre during the country’s civil war.

More than 200 people were killed in the village of Dos Erres in 1982, one of the most violent episodes in Guatemala’s brutal 36-year conflict.

Santos López was found responsible for 171 of the deaths.

He was a member of the Kaibiles, a US-trained counter-insurgency force fighting left-wing guerrillas.

López was sentenced to 30 years for each of the 171 killings committed in the village and to an additional 30 years for his role in the murder of a girl who had originally survived.

[…]

The massacre happened during the brief rule of military strongman Efraín Ríos Montt, who was accused of ordering the killing of more than 1,700 ethnic Mayans during a civil war.

He died in April aged 91 while on trial on charges of genocide.

Montt was the first military dictator in Latin America to be charged with genocide in his own country. Ronald Reagan was never charged for his role.

Some may be tempted to believe propaganda of the Reagan administration that fueling the mass murder of civilians somehow was meant to be about the U.S. fighting Communism. However, recent genocide trials have uncovered facts of Reagan’s “special units” that prove they engaged in genocidal practices, brutally murdering children by hand and terrorizing anyone within earshot of someone speaking about democracy.

The soldiers shot, strangled and bludgeoned the villagers to death with sledgehammers, and one admitted to throwing a baby into the village well.

In 1994, forensic anthropologists found the remains of 162 bodies in the well, including 67 children less than 12 years old.

The above should be serious food for thought when people now talk about news of migrants walking all the way from Guatemala to the U.S seeking aylum from violence. Imagine what they think when finding out they will be greeted with rifles instead.

It appears to this historian that the current U.S. regime has replaced the “beans and rifle” decision tree of Reagan’s Guatemalan death squads with…just rifles.

Ant Study Proves Social Network Pathogen-Trigger Response is Natural

The title is a mouthful, I know. If someone has a better suggestion I’m all ears. In the meantime, a new study reveals researchers have been busily infecting ants and tracking their response:

Social animals could potentially further reduce epidemic risk by altering their social networks in the presence of pathogens, yet there is currently no evidence for such pathogen-triggered responses. We tested this hypothesis experimentally in the ant Lasius niger using a combination of automated tracking, controlled pathogen exposure, transmission quantification, and temporally explicit simulations. Pathogen exposure induced behavioral changes in both exposed ants and their nestmates, which helped contain the disease by reinforcing key transmission-inhibitory properties of the colony’s contact network.

It’s an interesting point to bring up among managers in the U.S. who argue that workers should be commended for never, ever taking sick leave, or any leave for that matter.

The United States is one of the few industrialized countries without statutory national mandates for paid leave.

The Americans who deny sick leave not only create a national security risk, they also are taking an unnatural position. Fortunately lawmakers have been slowly working towards recognizing the security benefits of granting leave.

San Francisco first passed a law in 2007 granting one hour paid sick leave for every 30 hours worked. That concept has been adopted in five states, 26 cities, a county, and even Washington D.C…then New York City passed a paid sick leave law in 2013.

You never will guess what happened next:

It’s sick the way some health care providers are among the most egregious violators of the city’s paid sick leave law this year. Montefiore Medical Center was forced to pay $114,997…

Sad but true. The mounting fines were just evidence of how badly a law was needed to change some people’s opinions about sick leave.

In even more positive news, President Obama called in 2015 for seven paid sick leave days for all workers in America. His economic arguments were sound advice for improving security of the nation:

When 43 million private-sector workers are without any paid sick leave, too many workers are unable to take the time they need to recover from an illness. Many workers will go to work sick, putting their coworkers and customers at risk of illness. And even if workers have access to paid sick leave for themselves, they may not be able to use it to care for sick children. This forces many parents to choose between taking an unpaid day off work—losing much needed income and potentially threatening his or her job—and sending a child who should be home in bed to school.

Just as importantly, a body of research shows that offering paid sick days and paid family leave can benefit employers by reducing turnover and increasing productivity. Paid sick days would help reduce lost productivity due to the spread of illness in the workplace. And these policies can benefit our economy by fostering a more productive workforce.

Unfortunately his leadership wasn’t enough to overcome the unnatural desire of Congress to block sick leave. Some argued businesses are too weak to survive a law that helps them survive weakness. Yeah, Congress can be really dumb. That meant the issue, although gaining national leadership recognition, reverted back to local level where it repeatedly has proven itself a sound idea.

After evidence poured in (as many sanely predicted) that a sick leave law has no negative economic effects only positive ones, even New Jersey just adopted it statewide in 2018

New Jersey Governor Phil Murphy has signed into law the New Jersey Paid Sick Leave Act, which will provide eligible employees with paid leave for their own medical needs, those of a family member, or other covered reasons. The Act will take effect on October 29, 2018.

This is great news, and all the other states should follow suit if Congress is too weak to be able to get its thinking together at the federal level.

Tragic stories of pathogens in the news today only drive home the point of leave time improving everyone’s safety and productivity:

The number of sick people is increasing every day. Twenty-five people have been to the hospital for medical support. Staff serving the shelters have also been sick. The outbreak has been identified and confirmed by the Butte County public health laboratory to be the Norovirus which is highly contagious. Norovirus spreads through touching surfaces contaminated with the virus, close contact with someone who is infected, or eating contaminated food or drink.

[…] Please follow these recommended steps to prevent further spread: Stay home if there is any sign of illness…

America should do it because network pathogen-response is natural. I can only hope the next President proposes an Anti-pathogen National Trigger (ANT) Act to grant paid sick leave nation-wide. It would bring everyone together on a topic that naturally separates them.