Schneier on Security (RSS Feed)

https://www.schneier.com

Public Key

npub1pq90j4vh97m4qtpmrzl6gzfhwc6pvxsmuzcvrrhnl2xqpp7xjy4q2l0mzp

NIP-05 Address

https://www.schneier.com/feed/atom/@atomstr.data.haus

Profile Code

nprofile1qqsqszhe2ktjld6s9sa330aypymhvdqkrgd7pvxp3mel4rqqslrfz2sdfh9j9

Author Public Key

npub1pq90j4vh97m4qtpmrzl6gzfhwc6pvxsmuzcvrrhnl2xqpp7xjy4q2l0mzp

Show more details

Last Notes

2025-05-22 11:06:44

The Voter Experience
Technology and innovation have transformed every part of society, including our electoral experiences. Campaigns are spending and doing more than at any other time in history. Ever-growing war chests fuel billions of voter contacts every cycle. Campaigns now have better ways of scaling outreach methods and offer volunteers and donors more efficient ways to contribute time and money. Campaign staff have adapted to vast changes in media and social media landscapes, and use data analytics to forecast voter turnout and behavior.
Yet despite these unprecedented investments in mobilizing voters, overall trust in electoral health, democratic institutions, voter satisfaction, and electoral engagement has significantly declined. What might we be missing?...
https://www.schneier.com/blog/archives/2025/05/the-voter-experience.html

2024-11-06 12:02:18

IoT Devices in Password-Spraying Botnet
Microsoft is https://arstechnica.com/information-technology/2024/11/microsoft-warns-of-8000-strong-botnet-used-in-password-spraying-attacks/
Azure cloud users that a Chinese controlled botnet is engaging in “highly evasive” password spraying. Not sure about the “highly evasive” part; the techniques seem basically what you get in a distributed password-guessing attack:
“Any threat actor using the CovertNetwork-1658 infrastructure could conduct password spraying campaigns at a larger scale and greatly increase the likelihood of successful credential compromise and initial access to multiple organizations in a short amount of time,” Microsoft officials wrote. “This scale, combined with quick operational turnover of compromised credentials between CovertNetwork-1658 and Chinese threat actors, allows for the potential of account compromises across multiple sectors and geographic regions.”...
https://www.schneier.com/blog/archives/2024/11/iot-devices-in-password-spraying-botnet.html

2024-10-18 13:58:14

Justice Department Indicts Tech CEO for Falsifying Security Certifications
The Wall Street Journal is https://www.wsj.com/articles/tech-ceo-charged-with-fraud-over-security-reliability-claims-2e77e8a7
that the CEO of a still unnamed company has been indicted for creating a fake auditing company to falsify security certifications in order to win government business.
https://www.schneier.com/blog/archives/2024/10/justice-department-indicts-tech-ceo-for-falsifying-security-certifications.html

2024-10-16 11:03:23

Cheating at Conkers
The men’s world conkers champion is accused of https://www.theguardian.com/sport/2024/oct/14/cheating-alleged-after-mens-world-conker-champion-found-with-steel-chestnut
with a steel chestnut.
https://www.schneier.com/blog/archives/2024/10/cheating-at-conkers.html

2024-10-14 16:49:08

Upcoming Speaking Engagements
This is a current list of where and when I am scheduled to speak:
I’m speaking at https://events.linuxfoundation.org/soss-fusion/
in Atlanta, Georgia, USA. The event will be held on October 22 and 23, 2024, and my talk is at 9:15 AM ET on October 22, 2024.
The list is maintained on https://www.schneier.com/events/
.
https://www.schneier.com/blog/archives/2024/10/upcoming-speaking-engagements-41.html

2024-10-14 11:06:27

Perfectl Malware
Perfectl in an https://arstechnica.com/security/2024/10/persistent-stealthy-linux-malware-has-infected-thousands-since-2021/
of malware:
The malware has been circulating since at least 2021. It gets installed by exploiting more than 20,000 common misconfigurations, a capability that may make millions of machines connected to the Internet potential targets, researchers from Aqua Security said. It can also exploit CVE-2023-33246, a vulnerability with a severity rating of 10 out of 10 that was patched last year in Apache RocketMQ, a messaging and streaming platform that’s found on many Linux machines.
The researchers are calling the malware Perfctl, the name of a malicious component that surreptitiously mines cryptocurrency. The unknown developers of the malware gave the process a name that combines the perf Linux monitoring tool and ctl, an abbreviation commonly used with command line tools. A signature characteristic of Perfctl is its use of process and file names that are identical or similar to those commonly found in Linux environments. The naming convention is one of the many ways the malware attempts to escape notice of infected users...
https://www.schneier.com/blog/archives/2024/10/perfectl-malware.html

2024-10-11 21:04:10

Indian Fishermen Are Catching Less Squid
Fishermen in Tamil Nadu are reporting https://www.news18.com/india/in-rameswaram-fishermen-shares-how-depletion-of-squid-species-affect-their-business-9048665.html
of squid.
https://www.schneier.com/blog/archives/2024/06/new-blog-moderation-policy.html
https://www.schneier.com/blog/archives/2024/10/indian-fishermen-are-catching-less-squid.html

2024-10-11 19:00:27

More on My AI and Democracy Book
In July, I https://www.schneier.com/blog/archives/2024/07/upcoming-book-on-ai-and-democracy.html
and I are hard at work writing.
At this point, we would like feedback on titles. Here are four possibilities:
Rewiring Democracy: How AI Will Transform our Politics, Government, and Citizenship
The Thinking State: How AI Can Improve Democracy
Better Run: How AI Can Make our Politics, Government, Citizenship More Efficient, Effective and Fair
AI and the New Future of Democracy: Changes in Politics, Government, and Citizenship...
https://www.schneier.com/blog/archives/2024/10/more-on-my-ai-and-democracy-book.html

2024-10-11 11:08:28

IronNet Has Shut Down
After retiring in 2014 from an uncharacteristically long tenure running the NSA (and US CyberCommand), Keith Alexander founded a cybersecurity company called IronNet. At the time, he claimed that it was based on IP he developed on his own time while still in the military. That always troubled me. Whatever ideas he had, they were developed on public time using public resources: he shouldn’t have been able to leave military service with them in his back pocket.
In any case, it was never clear what those ideas were. IronNet never seemed to have any special technology going for it. Near as I could tell, its success was entirely based on Alexander’s name...
https://www.schneier.com/blog/archives/2024/10/ironnet-has-shut-down.html

2024-10-10 11:00:59

Deebot Robot Vacuums Are Using Photos and Audio to Train Their AI
An Australian news agency is https://www.abc.net.au/news/2024-10-05/robot-vacuum-deebot-ecovacs-photos-ai/104416632
that robot vacuum cleaners from the Chinese company Deebot are surreptitiously taking photos and recording audio, and sending that data back to the vendor to train their AIs.
Ecovacs’s privacy policy—https://gl-us-wap.ecovacs.com/content/agreementNewest/PRIVACY/DEFAULT/DEFAULT
—allows for blanket collection of user data for research purposes, including:
The 2D or 3D map of the user’s house generated by the device
Voice recordings from the device’s microphone
Photos or videos recorded by the device’s camera
It also states that voice recordings, videos and photos that are deleted via the app may continue to be held and used by Ecovacs...
https://www.schneier.com/blog/archives/2024/10/deebot-robot-vacuums-are-using-photos-and-audio-to-train-their-ai.html

2024-10-09 11:05:50

Auto-Identification Smart Glasses
Two students have created a demo of a smart-glasses app that performs automatic facial recognition and then information lookups. Kind of obvious, but the sort of creepy demo that gets attention.
News https://arstechnica.com/tech-policy/2024/10/harvard-students-make-auto-doxxing-smart-glasses-to-show-need-for-privacy-regs/
.
https://www.schneier.com/blog/archives/2024/10/auto-identification-smart-glasses.html

2024-10-08 11:00:52

China Possibly Hacking US “Lawful Access” Backdoor
The Wall Street Journal is https://www.wsj.com/tech/cybersecurity/u-s-wiretap-systems-targeted-in-china-linked-hack-327fc63b
that Chinese hackers (Salt Typhoon) penetrated the networks of US broadband providers, and might have accessed the backdoors that the federal government uses to execute court-authorized wiretap requests. Those backdoors have been mandated by law—CALEA—since 1994.
It’s a weird story. The first line of the article is: “A cyberattack tied to the Chinese government penetrated the networks of a swath of U.S. broadband providers.” This implies that the attack wasn’t against the broadband providers directly, but against one of the intermediary companies that sit between the government CALEA requests and the broadband providers...
https://www.schneier.com/blog/archives/2024/10/china-possibly-hacking-us-lawful-access-backdoor.html

2024-10-07 11:02:36

Largest Recorded DDoS Attack is 3.8 Tbps
CLoudflare just blocked the current record DDoS attack: https://blog.cloudflare.com/how-cloudflare-auto-mitigated-world-record-3-8-tbps-ddos-attack/
. (Lots of good information on the attack, and DDoS in general, at the link.)
News https://www.bleepingcomputer.com/news/security/cloudflare-blocks-largest-recorded-ddos-attack-peaking-at-38tbps/
.
https://www.schneier.com/blog/archives/2024/10/largest-recorded-ddos-attack-is-3-8-tbps.html

2024-10-04 21:07:53

Friday Squid Blogging: Map of All Colossal Squid Sightings
Interesting https://x.com/TerribleMaps/status/1834623825914532209
.
https://www.schneier.com/blog/archives/2024/06/new-blog-moderation-policy.html
https://www.schneier.com/blog/archives/2024/10/friday-squid-blogging-map-of-all-colossal-squid-sightings.html

2024-10-03 11:04:20

Weird Zimbra Vulnerability
Hackers can execute commands on a remote computer by sending https://arstechnica.com/security/2024/10/attackers-exploit-critical-vulnerability-recently-patched-in-zimbra-servers/
to a Zimbra mail server. It’s critical, but difficult to exploit.
In an email sent Wednesday afternoon, Proofpoint researcher Greg Lesnewich seemed to largely concur that the attacks weren’t likely to lead to mass infections that could install ransomware or espionage malware. The researcher provided the following details:
While the exploitation attempts we have observed were indiscriminate in targeting, we haven’t seen a large volume of exploitation attempts
Based on what we have researched and observed, exploitation of this vulnerability is very easy, but we do not have any information about how reliable the exploitation is
...
https://www.schneier.com/blog/archives/2024/10/weird-zimbra-vulnerability.html

2024-10-02 11:01:30

California AI Safety Bill Vetoed
Governor Newsom has https://arstechnica.com/ai/2024/09/california-governor-vetoes-controversial-ai-safety-bill/
the state’s AI safety bill.
I have mixed feelings about the https://arstechnica.com/information-technology/2024/07/from-sci-fi-to-state-law-californias-plan-to-prevent-ai-catastrophe/
.
(Related, the Council of Europe https://rm.coe.int/1680afae3c
. It’ll be legally binding when signed, and it’s a big deal.)
https://www.schneier.com/blog/archives/2024/10/california-ai-safety-bill-vetoed.html

2024-09-30 11:00:40

AI and the 2024 US Elections
For years now, AI has undermined the public’s ability to trust what it sees, hears, and reads. The https://www.theatlantic.com/technology/archive/2023/04/ai-generated-political-ads-election-candidate-voter-interaction-transparency/673893/
that was using AI to impersonate Americans on social media, and OpenAI disrupted an ...
https://www.schneier.com/blog/archives/2024/09/ai-and-the-2024-us-elections.html

2024-09-27 21:06:23

Squid Fishing in Japan
Fishermen are catching https://www.japantimes.co.jp/news/2024/09/12/japan/japan-saury-fishing/
as other fish are depleted.
https://www.schneier.com/blog/archives/2024/06/new-blog-moderation-policy.html
https://www.schneier.com/blog/archives/2024/09/squid-fishing-in-japan.html

2024-09-26 11:03:29

An Analysis of the EU’s Cyber Resilience Act
A https://www.lawfaremedia.org/article/the-cyber-resilience-act--an-accidental-european-alien-torts-statute
—long, complex—analysis of the EU’s new Cyber Resilience Act.
https://www.schneier.com/blog/archives/2024/09/an-analysis-of-the-eus-cyber-resilience-act.html

2024-09-21 01:59:17

Friday Squid Blogging: Squid Game Season Two Teaser
The https://www.hollywoodreporter.com/tv/tv-news/squid-game-season-2-trailer-lee-jung-jae-1236007425/
for Squid Game Season Two dropped.
https://www.schneier.com/blog/archives/2024/06/new-blog-moderation-policy.html
https://www.schneier.com/blog/archives/2024/09/friday-squid-blogging-squid-game-season-two-teaser.html

2024-09-20 15:32:37

Clever Social Engineering Attack Using Captchas
https://isc.sans.edu/diary/rss/31282
is really interesting.
It’s a phishing attack targeting GitHub users, tricking them to solve a fake Captcha that actually runs a script that is copied to the command line.
Clever.
https://www.schneier.com/blog/archives/2024/09/clever-social-engineering-attack-using-captchas.html

2024-09-19 15:40:17

FBI Shuts Down Chinese Botnet
The FBI has https://gizmodo.com/fbi-shuts-down-botnet-run-by-beijing-backed-hackers-that-hijacked-over-200000-devices-2000500627
a botnet run by Chinese hackers:
The botnet malware infected a number of different types of internet-connected devices around the world, including home routers, cameras, digital video recorders, and NAS drives. Those devices were used to help infiltrate sensitive networks related to universities, government agencies, telecommunications providers, and media organizations…. The botnet was launched in mid-2021, according to the FBI, and infected roughly 260,000 devices as of June 2024.
The operation to dismantle the botnet was coordinated by the FBI, the NSA, and the Cyber National Mission Force (CNMF), according to a press release dated ...
https://www.schneier.com/blog/archives/2024/09/fbi-shuts-down-chinese-botnet.html

2024-09-17 15:54:36

Remotely Exploding Pagers
https://www.cnn.com/world/live-news/lebanon-pagers-attack-hezbollah/index.html
.
It seems they all exploded simultaneously, which means they were triggered.
Were they each tampered with physically, or did someone figure out how to trigger a thermal runaway remotely? Supply chain attack? Malicious code update, or natural vulnerability?
I have no idea, but I expect we will all learn over the next few days.
EDITED TO ADD: I’m https://www.timesofisrael.com/liveblog-september-17-2024/
nine killed and 2,800 injured. That’s a lot of collateral damage. (I haven’t seen a good number as to the number of pagers yet.)
EDITED TO ADD: Reuters https://www.reuters.com/world/middle-east/dozens-hezbollah-members-wounded-lebanon-when-pagers-exploded-sources-witnesses-2024-09-17/
that detonated were the latest model brought in by Hezbollah in recent months, three security sources said.” That implies supply chain attack. And it seems to be a large detonation for an overloaded battery...
https://www.schneier.com/blog/archives/2024/09/remotely-exploding-pagers.html

2024-09-17 11:02:34

Python Developers Targeted with Malware During Fake Job Interviews
Interesting social engineering attack: luring potential job applicants with fake recruiting pitches, trying to https://www.reversinglabs.com/blog/fake-recruiter-coding-tests-target-devs-with-malicious-python-packages
These particular attacks from North Korean state-funded hacking team Lazarus Group are new, but the overall malware campaign against the Python development community has been running since at least August of 2023, when a number of popular open source Python tools were maliciously duplicated with added malware. Now, though, there are also attacks involving “coding tests” that only exist to get the end user to install hidden malware on their system (cleverly hidden with Base64 encoding) that allows remote execution once present. The capacity for exploitation at that point is pretty much unlimited, due to the flexibility of Python and how it interacts with the underlying OS...
https://www.schneier.com/blog/archives/2024/09/python-developers-targeted-with-malware-during-fake-job-interviews.html

2024-09-16 14:49:15

Legacy Ivanti Cloud Service Appliance Being Exploited
CISA wants everyone—and government agencies in particular—to https://therecord.media/cisa-urges-federal-agencies-remove-ivanti-product
an Ivanti Cloud Service Appliance (CSA) that is no longer being supported.
Welcome to the security nightmare that is the Internet of Things.
https://www.schneier.com/blog/archives/2024/09/legacy-ivanti-cloud-service-appliance-being-exploited.html