Catch up on stories from the past week (and beyond) at the Slashdot story archive

 



Forgot your password?
typodupeerror

Comment Victim blaming, Opsec, and old email addresses (Score 1) 93

By itself this doesn't mean he was directly compromised. We need to be really careful about inferring things from presence on these stealer lists and breach tracking sites. This is the second time in the last couple weeks that I have seen a "stealer" list being used to discredit someone.

You can easily end up on these without having ever had a directly compromised device of your own. If you have an email password combination that was breached in any of the many public breaches listed out there (see https://ancillary-proxy.atarimworker.io?url=https%3A%2F%2Fhaveibeenpwned.com%2F), all it takes is that credential to have ended up in the list being used by another nefarious actor to attempt attacks on new targets.

These are public lists, and if an attacker is using that list to attack another target, and the attacker's machines are also compromised (if you lie down with dogs, you get up with fleas).... that's it, you are now potentially in that list associated with other services than the originating service. It doesn't mean anything other than you had an account with a previously known password from a breach.

So yeah... it might infer this guy's opsec is terrible, It might indicate he was hacked, but it just as easily---and probably more likely--- might indicate nothing other than he was a victim of a 3rd party breach (like almost all of us who have been around a while will have been) and then someone else using that list was hacked... E.g. a password on a throw-away website/forum 20 years ago that was breached, forever plays forward in future attacks based on those lists. It appears as a new compromise, when it isn't.

From TFA..

"
As Lee notes, the presence of an individualâ(TM)s credentials in such logs isnâ(TM)t automatically an indication that the individual himself was compromised or used a weak password. In many cases, such data is exposed through database compromises that hit the service provider. The steady stream of published credentials for Schutt, however, is a clear indication that the credentials he has used over a decade or more have been publicly known at various points.
"

Comment Re:Don't fall for Chinese propaganda (Score 1) 576

And I think we're there.

You think we're there? What cringeworthy, random, flailing act on the part of this administration can you possibly point to to make that claim? Contact tracing depends upon one very important datum - knowing exactly where the disease is and is not at any given point in time. Given that the goal thus far has been to block access to testing in order to keep the confirmed case count down, how could you possibly assert that it's even possible to know this?

And even if you managed to get that far, all you'd do is meaningfully establish where the starting blocks are. To characterize anything Trump has done as an effort comparable to the Apollo or Mahatten(sic) projects is an exaggeration on par with Caligula claiming to have conquered England after some legionaries whacked some reeds with their swords.

Comment I switched from Android to iOS (Score 1) 122

... after having been an Android user for 10+ years, specifically for this kind of thing. Apple is far from perfect, but they're the only big player pretending to give a shit about user privacy. With an Android phone, by the time you get done with the preinstalled crapware from the phone manufacturer, network provider, and Google, your entire damn life is an open book to gods know who.

Submission + - NextCry Ransomware Targets NextCloud Linux Servers and Remains Undetected (linuxsecurity.com)

b-dayyy writes: A new and particularly troublesome ransomware variant has been identified in the wild. Dubbed NextCry, this nasty strain of ransomware encrypts data on NextCloud Linux servers and has managed to evade the detection of public scanning platforms and antivirus engines. To make matters worse, there is currently no free decryption tool available for victims.
Biotech

This Company Is Using Mushrooms To Reduce Plastic Waste (cnn.com) 29

The New York-based biotech startup Ecovative wants to replace plastic with mycelium, the below-ground root-like structure of a mushroom, writes CNN Business.

pgmrdlm shared their report: The company says it has developed a way to grow mycelium into specific shapes and sizes. The method, according to Ecovative, involves taking organic plant waste and inoculating it with mycelium. After the mycelium grows through and around the agricultural materials, it binds them together, providing a natural alternative to packaging materials made out styrofoam.

It's a process that takes about a week with minimal water and electricity consumed to make the parts. At the end of the mycelium substance's useful life, you can break it up and you can put it in your own garden. "So it's a nutrient, not a pollutant," said Ecovative's CEO and co-founder Eben Bayer .

The company also believes mycelium could play a major role in construction, as mycelium building materials are both insulative and structural and can be used in the same ways as conventional building material, Bayer said. In fact, packaging materials may be just the start. The startup has its eyes on another audacious goal: building organs. "My dream is to one day grow a lung and seed it with lung cells and use the mycelium to create the capillary network and use the human cells to create the actual lung," said Bayer.

The company's vision "has helped Ecovative attract millions from investors like 3M Company, the conglomerate behind Post-it notes and Scotch tape, and even a $9.1 million contract with the U.S. Department of Defense," reports CNN, adding that CEO Bayer believes the use of mycelium "really has boundless possibilities."

Ecovative is now even developing plant-based meats, including Mycelium bacon.

Comment Security theater (Score 2) 35

I'd say about 70% of security measures associated with *any* security policy, whether there has been a breach or not, are busywork at best and/or harmful at worst.

Consider, for example, password rotation. We now know frequent enforced password changes are a bad idea. Yet almost every security policy I've seen still imposes them. Why? Because IT security is still an emotional exercise, not an empirical one.

Slashdot Top Deals

"...a most excellent barbarian ... Genghis Kahn!" -- _Bill And Ted's Excellent Adventure_

Working...