Follow Slashdot stories on Twitter

 



Forgot your password?
typodupeerror

Comment Re:Agolf Shittler ruining America (Score 0) 113

I like the 34 time convicted felon angle a lot. Not because I'm particularly pro Trump or anti Trump. I just like that depending on which judge is doing the talking he's either a 34 time convicted felon or a man who had 34 convictions thrown out on appeal. So is he or isn't he? With the mix of judges in this country and their various loyalties the world may never know.

Comment Victim blaming, Opsec, and old email addresses (Score 1) 93

By itself this doesn't mean he was directly compromised. We need to be really careful about inferring things from presence on these stealer lists and breach tracking sites. This is the second time in the last couple weeks that I have seen a "stealer" list being used to discredit someone.

You can easily end up on these without having ever had a directly compromised device of your own. If you have an email password combination that was breached in any of the many public breaches listed out there (see https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fhaveibeenpwned.com%2F), all it takes is that credential to have ended up in the list being used by another nefarious actor to attempt attacks on new targets.

These are public lists, and if an attacker is using that list to attack another target, and the attacker's machines are also compromised (if you lie down with dogs, you get up with fleas).... that's it, you are now potentially in that list associated with other services than the originating service. It doesn't mean anything other than you had an account with a previously known password from a breach.

So yeah... it might infer this guy's opsec is terrible, It might indicate he was hacked, but it just as easily---and probably more likely--- might indicate nothing other than he was a victim of a 3rd party breach (like almost all of us who have been around a while will have been) and then someone else using that list was hacked... E.g. a password on a throw-away website/forum 20 years ago that was breached, forever plays forward in future attacks based on those lists. It appears as a new compromise, when it isn't.

From TFA..

"
As Lee notes, the presence of an individualâ(TM)s credentials in such logs isnâ(TM)t automatically an indication that the individual himself was compromised or used a weak password. In many cases, such data is exposed through database compromises that hit the service provider. The steady stream of published credentials for Schutt, however, is a clear indication that the credentials he has used over a decade or more have been publicly known at various points.
"

Comment "unstated ability to get access to systems" (Score 1) 48

Transcript of Internet Caucus Panel Discussion
Re: Administration's new encryption policy. Date: September 28, 1999.
Weldon statement.

Rep. Curt Weldon : Thank you. Let me see if I can liven things up here in the last couple of minutes of the luncheon. First of all, I apologize for being late. And I thank Bob and the members of the caucus for inviting me here.
...
But the point is that when John Hamre briefed me, and gave me the three key points of this change, there are a lot of unanswered questions. He assured me that in discussions that he had had with people like Bill Gates and Gerstner from IBM that there would be, kind of a, I don't know whether it's a, unstated ability to get access to systems if we needed it., Now, I want to know if that is part of the policy, or is that just something that we are being assured of, that needs to be spoke. Because, if there is some kind of a tacit understanding, I would like to know what it is.
Because that is going to be subjected to future administrations, if it is not written down in a clear policy way. I want to know more about this end use certificate. In fact, sitting on the Cox Committee as I did, I saw the fallacy of our end use certificate that we were supposedly getting for HPCs going into China, which didn't work. So, I would like to know what the policies are. So, I guess what I would say is, I am happy that there seems to be a coming together. In fact, when I first got involved with NSA and DOD and CIS, and why can't you sit down with industry, and work this out. In fact, I called Gerstner, and I said, can't you IBM people, and can't you software people get together and find the middle ground, instead of us having to do legislation.

.

Comment Re:That'll show Orange Man! (Score 1) 145

So we grow 80% of the worlds soybeans (give or take)? What happens when we stop selling them to China? Grow something else I guess? The same areas that grow soybeans are just fine for corn and other crops so to me this seems like the kind of thing that within a season or two means nothing to either side. American farmers can grow other crops. China can get soybeans from other places right?

Comment Re:act of war (Score 1) 130

You say that like it's not an option but increasingly it's becoming more likely. One of the only good things about the US dropping two atomic bombs on Japan was that it horrified the world (including the US) once it happened. Results were 80 years of nobody nuking anyone else. Ever larger and more deadly weapons kept the fear up but now they're becoming commonplace. More countries join the club every year and sooner or later someone is going to use one. China's making a great case for being the inevitable target.

Comment Re:Just pull out of the EU then... (Score 1) 184

I would genuinely like to see it happen. Mostly because I'd like to see how something like that shakes out. On a regular basis Apple, or Amazon, "Somebody" gets this treatment and I'm not saying that they do or don't have it coming. Not taking a position. We all see this response and yeah, it could happen I guess but what would be the fallout. I'd like to find out just once.

Slashdot Top Deals

How many hardware guys does it take to change a light bulb? "Well the diagnostics say it's fine buddy, so it's a software problem."

Working...