Dan Goodin

Reporter covering security at Ars Technica. DM me on Signal: +1650-440-4479.

Public Key

npub1yyl6ktycvjymch9hyzq5yqphj89kalfqmtswcjpjmp7s67ms6g9sdp6r3v

NIP-05 Address

dangoodin_at_infosec.exchange@mostr.pub

Profile Code

nprofile1qqszz0at9jvxfzdutjmjpq2zqqmerjmwl5sd4c8vfqedslgd0dcdyzcprpmhxue69uhhyetvv9ujumn0wdmksetjv5hxxmmdqy2hwumn8ghj7un9d3shjtnddaehgu3wwp6ky32ywdh

Publishing to

relay.noswhere.com

relay.mostr.pub

Author Public Key

npub1yyl6ktycvjymch9hyzq5yqphj89kalfqmtswcjpjmp7s67ms6g9sdp6r3v

Show more details

Last Notes

2024-08-08 20:35:00

Is there any generally accepted estimate for how soon until 1024-bit RSA is factorized? Even a ballpark range would suffice.

2024-08-01 03:49:57

Definitely worth a watch.
https://www.youtube.com/live/_VNi5Pe7zZM

2024-07-31 16:51:45

I'm looking for recent examples of Cloudflare not responding to verified complaints of abuse by customers using its service, particularly its pass-through service. Additionally, how does Cloudflare's abuse policy compare with those of competitors such as Fastly? Please text me on Signal at DanArs.82 or DM me here.

2024-07-25 18:26:49

- reply

Story is now live:
https://arstechnica.com/security/2024/07/secure-boot-is-completely-compromised-on-200-models-from-5-big-device-makers/

2024-07-25 18:18:48

- reply

@npub1pxy…htpa
Point taken. That said, I'm writing for a mainstream audience, not experts.

2024-07-25 17:06:00

- reply

@npub1pxy…htpa
Link?

2024-07-25 16:43:29

For anyone who cares about Secure Boot: it's completely borked on hundreds of device models from some of the industry's biggest manufacturers. Some of the affected devices shipped as recently as this year. More details to come in a little more than an hour from now.

2024-07-17 04:12:54

There are times when you can be certain the story subject is Black just by reading the headline.
https://www.cnn.com/2024/07/15/us/terrell-davis-united-airlines-flight-incident/index.html

2024-07-16 22:00:02

I badly botched my earlier attempt at this, so I'm going to try again. I will no longer donate to @signalapp and I will encourage others to stop funding it as well, until its employees stop using Twitter in official communications. The blue vanity tick marks these employee accounts sport demonstrate the very real value these accounts have in keeping this toxic, anti-privacy platform alive. I'm getting close to stopping subscriptions to news outlets that are also doing their part to give oxygen to a site that actively undermines a free press.

2024-07-16 17:25:13

Someone just pointed out that Twitter will give blue vanity ticks for free in the event the account is followed by at least 2,500 other blue tick accounts. So, I may have misspoke in saying Signal and Meredith pay directly. That said, if they're getting the tick for free, that means they're undoubtedly providing financial support in the form of content that motivates others to pay.

2024-07-11 00:27:43

I will not be attending Black Hat or Defcon this year. I think it's irresponsible for either conference to expect people to travel to ground zero for climate disaster.

2024-07-10 03:32:52

- reply

Facepalm
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/760/082/822/529/735/original/18ad3f6061c1b5a9.jpg

2024-06-27 22:52:46

- reply

The NCC Group alert reports a "significant compromise of
the TeamViewer remote access and support platform by an APT group." This is at odds with the "evidence" TeamViewer is saying indicates access is limited to its corporate environment.
https://media.infosec.exchange/infosec.exchange/media_attachments/files/112/691/034/550/470/686/original/93aae725c4ae9647.png

2024-06-27 17:37:56

TeamViewer is working with a team of security experts after company engineers detected an "irregularity" in the TeamViewer corporate network.
The corporate network is "completely independent" from the TeamViewer product environment.
'There is no evidence to suggest that the product environment or customer data is affected."
The company isn't providing any additional information at the moment.
https://www.teamviewer.com/en/resources/trust-center/statement/

2024-06-25 02:02:03

If you're annoyed with my hold-your-nose-and-vote-for-Biden threads, you will absolutely HATE life under a Trump presidency.

2024-06-24 16:15:00

- reply

Several replies to this thread bare a striking resemblance to Russian payops plays attempting to suppress the participation of potential Biden voters. Please keep that in mind when reading or engaging in these sorts of discussions.
Also, nation state psyops campaigns embracing the Fediverse. Yikes.

2024-06-22 01:45:34

To all the left of center people planning to sit out the election, or vote for someone other than Biden: can we at least agree that life under Trump will be infinitely worse than under Biden in so many important ways?

2024-06-11 16:31:23

Your reasons for staying on Twitter may be valid, but they don't change this ineluctable truth: you're breathing oxygen into a platform that's actively promoting antidemocratic, far-right disinformation.

2024-06-10 16:14:03

- reply

@npub1vcl…k6t3
Words fail me at the moment other than to say I'm so sorry for your profound loss and wish you and your family solace.

2024-06-10 16:11:03

So now Apple is being pressured into adding a bunch of half-baked AI features that no user actually wants. I just hope all this AI crap is opt in.

2024-06-08 03:17:01

The damage resulting from Orange Felon retaking the White House will be unprecedented and irreparable, with less privileged people disproportionately paying the price. It's beyond me how anyone considering themselves left of center isn't doing everything in their power (including voting for Biden) to head off this train wreck.
https://www.nytimes.com/interactive/2024/06/07/us/politics/trump-policy-list-2025.html?unlocked_article_code=1.yE0.HGUJ.n4G0j7au9_es&smid=url-share

2024-06-07 18:17:58

Researchers have discovered a critical RCE in PHP for Windows. CVE-2024-4577 allows unauthenticated people to bypass the protection for a previously fixed vulnerability (CVE-2012-1823) using specific character sequences. Arbitrary code can be executed on remote PHP servers through the argument injection attack.
https://devco.re/blog/2024/06/06/security-alert-cve-2024-4577-php-cgi-argument-injection-vulnerability-en/

2024-06-05 15:51:52

A reminder that if you're a member of a union or consider yourself pro labor you should avoid buying from Amazon whenever possible.
https://www.404media.co/amazons-ai-warehouses-isolate-workers-impact-union-organizing-new-report-finds/

2024-05-27 16:47:18

If you're mad at Biden for his policies toward Israel/Gaza, you will be absolutely apoplectic if Trump retakes the White House.
https://www.washingtonpost.com/politics/2024/05/27/trump-israel-gaza-policy-donors/

2024-05-23 17:39:13

I have now disconnected from all Slack channels except for the one used by my employer, which is a requirement for my job. I don't understand why more people aren't doing the same.

2024-05-07 05:06:35

People are still talking about how "Trump is worse" as if the 2024 election was just one more horse race that won't irrevocably change things for the worse for the next hundred years and beyond.

2024-04-22 17:43:54

Microsoft said today that Russian hackers have been exploiting the vulnerability tracked as CVE-2020-38028 since at least 2020. That would make it an 0day at the time Microsoft patched it in October 2022. And yet, Microsoft has never acknowledged that vulnerability as such. What's up with that?
https://www.microsoft.com/en-us/security/blog/2024/04/22/analyzing-forest-blizzards-custom-post-compromise-tool-for-exploiting-cve-2022-38028-to-obtain-credentials/
https://msrc.microsoft.com/update-guide/en-US/advisory/CVE-2022-38028

2024-03-21 07:54:27

There's a newly discovered side channel that leaks encryption keys from a widely used CPU architecture. Details will drop in about 6 hours.

2024-03-12 16:26:19

- reply

Thanks all. The syntax is:
"from: "

2024-03-12 16:23:02

I can't believe I'm asking this again, but I can never seem to find it on duckduckgo: how do I search a particular Mastodon user's posts for a specific search term?

2024-03-12 01:03:06

- reply

Seriously, folks. When someone running for the highest office in the land says they admire dictators and intend to act like one on the first day of their term, you best believe them and vote accordingly.

2024-03-12 00:51:50

How much longer can left-of-center folks keep insisting there's no difference between Biden and TFG?

2024-03-12 00:45:33

Last week, Boeing whistleblower John Barnett appeared at a deposition where he testified over in support of a lawsuit he filed against the airline maker. He was due to undergo further questioning on Saturday, but never appeared. That same day, he was found dead in his truck from a self-inflicted wound.
https://www.bbc.com/news/business-68534703

2024-02-12 18:35:07

A crowd in San Francisco surrounded a Waymo robotaxi on Saturday night, broke the windows and threw fireworks inside, setting the vehicle ablaze, the company said.
Waymo said that the autonomous vehicle was not transporting any passengers at the time of the incident and no injuries were reported.
Video posted to social media showed a crowd of several dozen people surrounding the car and scrawling graffiti on the sides. One man bashed the front passenger window and the windshield with a skateboard, shattering the glass.
Subsequently, someone threw a firework inside, setting the car on fire. Flames quickly engulfed the Jaguar, totally destroying the car.
It was not clear what prompted the crowd to set upon the robotaxi. The San Francisco Police Department said authorities are investigating the incident.
https://sfstandard.com/2024/02/10/waymo-robotaxi-goes-up-in-flames-in-chinatown-after-crowd-attacks-vehicle/

2024-01-19 19:35:05

- reply

HP CEO Enrique Lores said this about counterfeit ink cartridges this morningon CNBC:
They can "create security issues. We have seen that you can embed viruses in the cartridges, through the cartridges go to the printer, from the printer go to the network. So it can create [inaudible]"
I'm not aware of a single instance of this happening, either as a PoC attack by a researcher or a malicious one in the wild. Seems like the CEO is misspeaking. Any help here from people with experience in malware in embedded devices would be much appreciated.
Quote occurs at 3:28
https://youtu.be/QPRMyQSZGuY?si=EU905oCTcW860xJs&t=208

2024-01-19 18:44:30

Does anyone know of any attacks, either PoC or in the wild, that use malicious printer cartridges to infect printers? I saw this article from 2022
https://www.action-intell.com/2022/10/05/hp-bug-bounty-program-finds-reprogrammable-chips-open-printers-to-malware/
It says that HP's Bug Bounty program found such attacks are possible, but there are no details about who reported the bug that made such attacks possible. I remain skeptical about the accuracy.
Any help from experts in the form of pointers to attacks or analysis about whether printer cartridges are a viable infection vector would be much appreciated.

2023-10-23 21:04:00

1Password detects “suspicious activity” in its internal Okta account
1Password, a password manager used by millions of people and more than 100,000 businesses, said it detected suspicious activity on a company account provided by Okta, the identity and authentication service that disclosed a breach on Friday.
“On September 29, we detected suspicious activity on our Okta instance that we use to manage our employee-facing apps,” 1Password CTO Pedro Canahuati wrote in an email. “We immediately terminated the activity, investigated, and found no compromise of user data or other sensitive systems, either employee-facing or user-facing.”
Since then, Canahuati said, his company had been working with Okta to determine the means that the unknown attacker used to access the account. On Friday, investigators confirmed it resulted from a breach Okta reported hitting its customer support management system.
Okta said then that a threat actor gained unauthorized access to its customer support case management system and, from there, viewed files uploaded by some Okta customers. The files the threat actor obtained in the Okta compromise comprised HTTP archive, or HAR, files, which Okta support personnel use to replicate customer browser activity during troubleshooting sessions. Among the sensitive information they store are authentication cookies and session tokens, which malicious actors can use to impersonate valid users.
Security firm BeyondTrust said it discovered the intrusion after an attacker used valid authentication cookies in an attempt to access its Okta account. The attacker could perform “a few confined actions,” but ultimately, BeyondTrust access policy controls stopped the activity and blocked all access to the account. 1Password now becomes the second known Okta customer to be targeted in a follow-on attack.
Monday’s statement from 1Password provided no further details about the incident, and representatives didn’t respond to questions. A report dated October 18 and shared on an internal 1Password Notion workspace said the threat actor obtained a HAR file a company IT employee had created when recently engaging with Okta support. The file contained a record of all traffic between the 1Password employee’s browser and Okta servers, including session cookies.
https://arstechnica.com/security/2023/10/1password-detects-suspicious-activity-in-its-internal-okta-account/

2023-10-20 16:26:44

I didn’t join Mastodon until after we launched 404 Media. I joined, frankly, because lots of people told me that we should. Mastodon had been decried by many (me, previously), as a social media platform that is too complicated or weird to sign up for. I had also convinced myself that people on Mastodon would be mad at me if I made jokes, which has (mostly) not been the case.
I’ve now been using it for about two months and I am here to tell you that it is, in principle, what we should want the internet to be. If you have been remotely interested in Mastodon but had reservations about joining because you thought it would be difficult, confusing, or otherwise annoying, it is not.
https://www.404media.co/mastodon-is-the-good-one/

2023-09-20 02:24:43

- reply

@npub1lrv…tth9
Can you help me understand your rationale for small journalism staying on the dead bird site? Twitter isn't like electricity or water service that people can't live without. It seems like a copout to say you can't afford to leave the site be because of X, Y or Z. I suppose there probably are folks who might face true hardships if they leave, but even then, it seems like transitioning away could be a gradual process over no more than six months.
I just don't understand how all these Twitter users seem to think they are a victim of circumstance and have no choice.
What am I missing?

2023-09-20 02:14:39

- reply

@npub1lrv…tth9
I agree that the magnitude of the imperative is directly proportional to the number of followers and amount of influence you have. That said, I think it's incredibly short cited for any journalist to embrace the platform. I remain almost despondent so many people in this field ( and in cybersecurity, for that matter) choose a short term gain at the cost of the long-term good.

2023-09-20 02:08:21

- reply

@npub1lrv…tth9
I agree with everything you're saying except your use of the phrase "big journalism." It's equally in the interest litttle journalism too to stop giving comfort to a platform dedicated to spreading far-right extremism.

2023-09-19 18:58:33

While riding SF Muni yesterday, my wife saw a driverless Cruise vehicle do something similar, except it passed on the right side of the bus while two passengers in wheelchairs were trying to get on. It really sucks that Cruise et al. are using San Franciscans as guinea pigs in their risky experiments.
https://media.infosec.exchange/infosecmediaeu/media_attachments/files/111/093/337/146/650/542/original/93d2df48a7f12556.mp4

2023-08-16 18:25:30

- reply

A few months ago, an engineer in a data center in Norway encountered some perplexing errors that caused a Windows server to suddenly reset its system clock to 55 days in the future. The engineer relied on the server to maintain a routing table that tracked cell phone numbers in real time as they were being moved from one carrier to the other. A jump of eight weeks had dire consequences because it caused numbers that had yet to be transferred to be listed as having already been moved and numbers that had already been transferred to be reported as pending.
“With these updated routing tables, a lot of people were unable to make calls, as we didn't have a correct state!” the engineer, who asked to be identified only by his first name, Simen, wrote in an email. “We would route incoming and outgoing calls to the wrong operators! This meant, e.g., children could not reach their parents and vice versa.”
Simen had experienced a similar error last August when a machine running Windows Server 2019 reset its clock to January 2023 and then changed it back a short time later. Troubleshooting the cause of that mysterious reset was hampered because the engineers didn’t discover it until after event logs had been purged. The newer jump of 55 days, on a machine running Windows Server 2016, prompted him to once again search for a cause, and this time, he found it.
The culprit was a little-known feature in Windows known as Secure Time Seeding. Microsoft introduced the time-keeping feature in 2016 as a way to ensure that system clocks were accurate. Windows systems with clocks set to the wrong time can cause disastrous errors when they can’t properly parse time stamps in digital certificates or they execute jobs too early, too late, or out of the prescribed order. Secure Time Seeding, Microsoft said, was a hedge against failures in the battery-powered on-board devices designed to keep accurate time even when the machine is powered down.
https://arstechnica.com/security/2023/08/windows-feature-that-resets-system-clocks-based-on-random-data-is-wreaking-havoc/

2023-08-16 17:42:47

Windows Secure Time Seeding resets clocks months or years off the correct time.
https://arstechnica.com/security/2023/08/windows-feature-that-resets-system-clocks-based-on-random-data-is-wreaking-havoc/