AWS Saves Ukraine’s Data | WPF ‘is not Dead’ (yet) | Devs Quit for Cash - DevOps.com

The moral of the story: Everybody wants to be famous—but nobody wants to do the work

In this week’s #TheLongView:
1⃣ @AWSCloud #S3 is keeping #Ukraine’s data safe from #Russia,
2⃣ we ask if #WindowsPresentationFoundation is dead, and
3⃣ #developers tell us why they switch jobs.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/O7pQv8v80r #DevOps

— @Richi 🤓 Jennings (@RiCHi) December 21, 2022

DraftKings fantasy? How YOU can prevent credential stuffing attacks - ReversingLabs

I’ll choose a mask to look like you: There’s been a huge uptick in a type of low-effort hacking, where bad actors crack accounts of people who reuse passwords. They simply feed off of data from previous credential breaches.

3/ Prevented how? By checking user passwords against public databases of leaked #credentials.

In this week’s #SSBlogwatch we urge dev teams to do more.

For @ReversingLabs’ @SecuredSoftware: https://t.co/djeNopsos6 #DevOps

— @Richi 🤓 Jennings (@RiCHi) December 20, 2022

GitHub Secret Scanning is now Free (as in Beer) - Security Boulevard

Can You Keep a Secret? Microsoft’s GitHub source control service will help stop devs accidentally embedding secrets in public code repositories. A new free service will let you know if you’ve done something you shouldn’t have.

Naturally, there’s no such thing as a free lunch. #GitHub wants you to upgrade to the premium version of the service.

In today’s #SBBlogwatch, we look a gift horse in the mouth.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/31wURydLAK

— @Richi 🤓 Jennings (@RiCHi) December 19, 2022

Operation PowerOFF: DDoS Sites Denied Service (by US, UK, Europol) - Security Boulevard

FBI and Friends Pull the Plugs: Around 50 so-called booter DDoS sites have been nuked by international law enforcement. And seven of their alleged administrators have been charged.

And the @FBI says the operators knew full well what they’re used for.

In today’s #SBBlogwatch, we service their denials.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/gU4mJ4DOBh

— @Richi 🤓 Jennings (@RiCHi) December 16, 2022

EU Data Privacy: Try Again | SkyPilot: Choose Cheapest Cloud | WFH: Better Meetings - DevOps.com

The moral of the story: If you want the rainbow, you gotta put up with the rain

In this week’s #TheLongView:
1⃣ #EU-U.S. #DataPrivacyFramework reemerges,
2⃣ @UCBerkeley brings #cloud selection box, and
3⃣ proof that #RemoteWork is good work.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/cJTTDUhlku #DevOps #GDPR #SkyPilot #WFH

— @Richi 🤓 Jennings (@RiCHi) December 15, 2022

Ahoy! More insecure code washes ashore with AlphaCode - ReversingLabs

Below-average code: Alphabet’s DeepMind brings us AlphaCode — another AI code-generating parlor trick. And, just like its large language model cousins, it can spit out buggy code.

As the old saying goes: Garbage in, garbage out.

In this week’s #SSBlogwatch we take out the trash.

For @ReversingLabs’ @SecuredSoftware: https://t.co/hW5Mu82mqD

— @Richi 🤓 Jennings (@RiCHi) December 14, 2022

Rust: Officially Released in Linux 6.1 Kernel - Security Boulevard

Linus Counts to 6.1: At the weekend, Linus Torvalds hit the button, releasing Linux 6.1 to the world. Among other security features is support for writing parts of the kernel in Rust.

Linux’s initial focus is to write new device drivers in @RustLang.

In today’s #SBBlogwatch, we love to oxidize.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/OUZ17H6zUA

— @Richi 🤓 Jennings (@RiCHi) December 13, 2022

TikTok Ban: Texas is Fourth State to Join; Indiana Sues

Data Stealers Wheeled Away: Four U.S. states have now banned TikTok on government workers’ devices: Maryland, South Carolina, South Dakota and now Texas.

3/ They’re heeding the @FBI warning last week, no doubt.

In today’s #SBBlogwatch, we wonder what @TheRealRafferty would do.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/0MKYrxryHh

— @Richi 🤓 Jennings (@RiCHi) December 9, 2022

Dead Downtown: It’s YOUR Fault | Pentagon’s FOUR Cloud Vendors | Apple Adds MORE Price Flexibility - DevOps.com

The moral of the story: Turn your wounds into wisdom

In this week’s #TheLongView:
1⃣ #HomeWorking is ripping the heart out of cities,
2⃣ the @DeptofDefense’s bizarre #cloud strategy, and
3⃣ @Apple adds a $10,000 app price option.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/triFdgJAyu #DevOps #WFH #JWCC

— @Richi 🤓 Jennings (@RiCHi) December 8, 2022

ChatGPT: Parlor trick or Stack Overflow replacement? - ReversingLabs

Of all the friends I’ve had, you’re the first: Conversational AI language model ChatGPT can write code. But is it any good? Better than Copilot? Good enough to replace real people on Stack Overflow?

3/ Devs beware: Don’t be fooled by confident sounding AI.

In this week’s #SSBlogwatch we prefer #ELIZA.

For @ReversingLabs’ @SecuredSoftware: https://t.co/ILX9kIi2fh

— @Richi 🤓 Jennings (@RiCHi) December 7, 2022

APT41 Sent US Covid Cash to China — Wicked Panda - Security Boulevard

Keep Your Storied Pomp — Give Me Your Money: Chinese hackers stole tens of millions of dollars from PPP, the federal Paycheck Protection Program. So say Secret Service sources.

3/ $20 million here, $20 million there. In today’s #SBBlogwatch, pretty soon we’re talking serious money.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/DXj8qlsHOu

— @Richi 🤓 Jennings (@RiCHi) December 6, 2022

Russia Hit by New ‘CryWiper’ — Fake Ransomware - Security Boulevard

Vlad sobs: A new wiper malware is destroying data on Russian government PCs. Dubbed CryWiper, the dastardly Trojan is targeting only certain agencies.

3/ Who’s responsible? The @CIA? @Ukraine? Or an inside job?

In today’s #SBBlogwatch, we play the odds.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/WNXq1qiYR4

— @Richi 🤓 Jennings (@RiCHi) December 5, 2022

More Lies: Anker’s Eufy Pants on Fire — ‘No Cloud’ Cams Send to Cloud - Security Boulevard

Euf***ed Up: Eufy home security cameras and doorbells are insecure. They send your photos to the cloud with minimal protection and serve up video across the internet with useless encryption.

3/ It does appear to be a #Chinese plan to build a #FacialRecognition database of Americans.

In today’s #SBBlogwatch, we rip them off our front doors.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/sE8dITmur0

— @Richi 🤓 Jennings (@RiCHi) December 2, 2022

AWS re:Invent — Top 4 Things We Learned This Week - DevOps.com

The moral of the story: The unexamined life is not worth living

In this week’s #TheLongView, four things that caught my eye from @AWScloud’s #reInvent 2022:
1⃣ #SnapStart turbocharges Lambda,
2⃣ #Graviton3E @ARM HPC SoC,
3⃣ #AWS continues hiring, and
4⃣ AWS’s origin story.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/lj4R4KUCmH #DevOps

— @Richi 🤓 Jennings (@RiCHi) December 1, 2022

Meta’s GDPR fine: Why your DevOps needs red teaming - ReversingLabs

Finebook: Meta’s been fined $276 million for leaking people’s PII. But the leak wasn’t directly via a vulnerability, but rather due to data scraping. Helen Dixon (pictured), the head of Ireland’s GDPR regulator, ruled that Meta should have prevented the scrape.

3/ So monitor real-time usage for unusual patterns.

In this week’s #SSBlogwatch we suggest how — and what to do if you find them.

For @ReversingLabs’ @SecuredSoftware: https://t.co/c8uIxlt5ED

— @Richi 🤓 Jennings (@RiCHi) November 30, 2022

Naked TikTok Girls = Malware Mayhem #InvisibleFilter - Security Boulevard

TrickTok: TikTok’s ‘Invisible Body’ challenge was too tempting for malware scrotes to pass up. It was the perfect opportunity to thirst-trap people into downloading an info-stealing Trojan.

3/ Just download this totally innocent Windows app.

But, in today’s #SBBlogwatch, we wonder where the nekkid #videos really go.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/Wb1OfDhlmN

— @Richi 🤓 Jennings (@RiCHi) November 29, 2022

U.S. and UK Ban More Chinese Kit as Xi’s Grip Weakens - Security Boulevard

‘Oh, bother,’ said Pooh: Two key members of the Five Eyes intelligence alliance have made further moves to stop Chinese equipment imports. The fear is that Chinese companies can be “persuaded” by the Chinese Communist Party to help them spy on us.

3/ Yet more woes for #XiJinping (pictured), as his citizens rise up and protest his terrifying #ZeroCovid restrictions.

In today’s #SBBlogwatch, we ponder possible #protectionism.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/Zc5gtQQmnT

— @Richi 🤓 Jennings (@RiCHi) November 28, 2022

‘This is Appalling’ — Tax-Prep Sites Leak PII to Facebook - Security Boulevard

Taxing times for Meta: Some incredibly personal details are being sent to Facebook, without your consent. H&R Block, TaxAct, and TaxSlayer are accused of selling your data to Meta.

You are the product—except these services aren’t even free!

In today’s #SBBlogwatch, we’re as mad as hell and we’re not going to take it anymore.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/cwUlaeOdsy

— @Richi 🤓 Jennings (@RiCHi) November 23, 2022

Your support must scale: Don’t be like Meta, dev teams - ReversingLabs

Facebook farce: A rash of small businesses on Facebook found their accounts locked after being hacked. And it’s impossible to contact Meta to get the problem fixed.

🧵: A rash of small businesses on @Facebook found their accounts locked after being #hacked.

And it’s impossible to contact @Meta to get the problem fixed.https://t.co/69CCWN8cPU

— @Richi 🤓 Jennings (@RiCHi) November 23, 2022

iPhone Privacy ‘Lies’ Exposed Again: Apple Analytics not Anonymous - Security Boulevard

No better than Google—perhaps worse: Apple has been caught lying in a privacy policy. So say the now-notorious security researchers at Mysk.

3/ Everything you do is logged and permanently linked to your identity.

In today’s #SBBlogwatch, we ponder moving to Android.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/5G7pxf8aZr

— @Richi 🤓 Jennings (@RiCHi) November 22, 2022

DevOps, Drought and Climate | Meta❤️PTP - DevOps.com

The moral of the story: Life is not a problem to be solved, but a reality to be experienced

In this week’s #TheLongView:
1⃣ #DataCenters cause #ClimateChange, and
2⃣ @Meta is rolling out #PrecisionTimeProtocol.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/Ew8hiRnOIH #DevOps

— @Richi 🤓 Jennings (@RiCHi) November 21, 2022

Oops! Meta Security Guards Hacked Facebook Users - Security Boulevard

‘Oops’ not Even the Half of It: Facebook parent Meta has disciplined or fired at least 25 workers for allegedly hacking into user accounts. Some of the workers were contract security guards, we’re told.

All these questions and more will be asked in today’s #SBBlogwatch.

Please tell me it’s the weekend tomorrow.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/arliO84TlE

— @Richi 🤓 Jennings (@RiCHi) November 18, 2022

Data Centers IN SPAAACE | Discord GDPR Fine | AWS Fires Dead Wood - DevOps.com

The moral of the story: To write about life, first you must live it.

In this week’s #TheLongView:
1⃣ The #EU wants to put servers in orbit,
2⃣ a #GDPR penalty for @Discord, and
3⃣ @AWSCloud has the hatchet out.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/IvBX6yI6Pp #DevOps #ASCEND

— @Richi 🤓 Jennings (@RiCHi) November 17, 2022

Track this: Apple, Google hit with BIG privacy law claims - ReversingLabs

The state of disunion: Within the space of a few days, both Google and Apple have suffered huge legal challenges. The two tech titans were accused of various privacy violations.

3/ #Google lost a long standing privacy case, with more in the works. And now #Apple faces a big ol’ privacy #ClassAction.

In this week’s #SSBlogwatch we navigate the minefield.

For @ReversingLabs’ @SecuredSoftware: https://t.co/tv9KECQfSM

— @Richi 🤓 Jennings (@RiCHi) November 16, 2022

Google Pixel Can be Unlocked via SIM Swap (Other Android Phones, Too) - Security Boulevard

PUK Phun: A Hungarian researcher found a nasty Android security bug. If you insert a new SIM and type in the SIM’s personal unlocking key (PUK), the phone just dismisses the lock screen.

3/ #CVE202220465 is the vulnerability ID.

In today’s #SBBlogwatch, we search for the lost SIM eject tool.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/aA0X2Llwcp

— @Richi 🤓 Jennings (@RiCHi) November 15, 2022

NSA’s Plea: Stop Using C and C++ (Because You’re Idiots) - Security Boulevard

Don’t shoot the messenger: The C and C++ languages are unsafe. Instead, the U.S. National Security Agency would like devs to use memory-safe languages—because most security vulnerabilities are caused by bugs in memory usage.

3/ His prescription: Switch to languages such as @RustLang, like some of the #Linux kernel team are doing.

In today’s #SBBlogwatch, we’re only *slightly* sarcastic. At @TechstrongGroup’s @SecurityBlvd: https://t.co/VL493if9l1 #Rust #NSA

— @Richi 🤓 Jennings (@RiCHi) November 11, 2022

Rust Momentum Intensifies | Elon Says No WFH - DevOps.com

The moral of the story: The whole secret of a successful life is to find out what is one’s destiny to do—and then do it

In this week’s #TheLongView:
1⃣ People won’t shut up about @Rustlang, and
2⃣ @ElonMusk mandates @Twitter teams return to the office.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/K3Gwfz44iw #DevOps #rust #RustLang #WFH

— @Richi 🤓 Jennings (@RiCHi) November 10, 2022

Dropbox reveals hack: What DevOps can learn from it - ReversingLabs

OTP FAIL: FIDO2 FTW
Dropbox was hacked last month. The company has now revealed more details — and there are some big surprises.

3/ And it goes without saying that you shouldn’t store secrets in @GitHub.

In this week’s #SSBlogwatch we say it anyway.

For @ReversingLabs’ @SecuredSoftware: https://t.co/yWcAceApXS #DevOps

— @Richi 🤓 Jennings (@RiCHi) November 9, 2022

Hacker Stole $3B of Bitcoin — Because ‘Crypto’ is Garbage - Security Boulevard

In Fiat We Trust: James Zhong admitted to stealing 50,000 bitcoins from the former dark web market, Silk Road. The U.S. Department of Justice recently opened up and gleefully told the seizure story.

3/ To call him a “hacker” is frankly insulting to #hackers.

In today’s #SBBlogwatch, we roll our eyes.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/3qjVkTR07e

— @Richi 🤓 Jennings (@RiCHi) November 8, 2022

Red Cross Wants Shielding from Hacks via Digital Emblem - Security Boulevard

#ICRC thinks outside box: The International Committee of the Red Cross (ICRC) is proposing a digital version of its eponymous logo. The idea is that websites and other digital services that sport the “emblem” would gain protection from hacking under international law.

3/ Easy to mock, but it’s an interesting idea.

In today’s #SBBlogwatch, we give it space to ruminate.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/5WBwPEOPgP

— @Richi 🤓 Jennings (@RiCHi) November 4, 2022

OpenSSL Fiasco: What can DevOps Learn? | Elon Fires ‘50%’ of Twitter - DevOps.com

The moral of the story: If life were predictable, it would cease to be life—and be without flavor

In this week’s #TheLongView:
1⃣ The #OpenSSL project has egg on its face, and
2⃣ half of @Twitter’s staff are for the chop tomorrow.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/Ia7B1ToZ7a #DevOps

— @Richi 🤓 Jennings (@RiCHi) November 3, 2022

Reflection attacks: Don’t be part of the problem - ReversingLabs

We see you: Once again, Microsoft is under fire for shipping a service that can early be misused for DDoS attacks. CLDAP — basically LDAP over UDP — can be weaponized to generate huge spikes of bandwidth.

>

Learning from other devs’ mistakes is the only possible silver lining in this cloudy nightmare.

In this week’s #SSBlogwatch we take a long, hard look in the mirror.

For @ReversingLabs’ @SecuredSoftware: https://t.co/mgnJ0O39DI

— @Richi 🤓 Jennings (@RiCHi) November 2, 2022

FBI/CISA Failed: Biden’s Ransomware Summit Convenes, Impotently

Talking Shop at the Talking Shop: The International Counter Ransomware Summit is on in D.C., with representatives from 36 nations and blocs attending. Not including Russia, natch.

But will it amount to anything of substance?

In today’s #SBBlogwatch, we fear not.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/JQjGnok5eB

— @Richi 🤓 Jennings (@RiCHi) November 1, 2022

Chinese Tech: Banned in DC, but not in the States - Security Boulevard

‘Oh, Bother,’ Said Pooh: There’s a massive loophole in the federal ban on Chinese technology from sus firms such as Huawei and ZTE: It doesn’t stop states from buying it.

3/ It’s almost as if states had some sort of constitutional independence—who’d a thunk it?

In today’s #SBBlogwatch, we go hunting for heffalump.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/0QtEyKps5P

— @Richi 🤓 Jennings (@RiCHi) October 31, 2022

OpenSSL ‘CRITICAL’ Bug — Sky Falling — Patch Hits 11/1 - Security Boulevard

Worse Than Heartbleed?
OpenSSL has a new “critical” bug. But it’s a secret—until next month.

It’s a big, fat, hairy deal. OpenSSL is in just about everything.

In today’s #SBBlogwatch, we make sure our #SBOM​s are up to date.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/CdrJbcSpXq

— @Richi 🤓 Jennings (@RiCHi) October 28, 2022

Meta Income Down by Half | Will Apple Make it Worse? | Linux Secure Boot Fix - DevOps.com

The moral of the story: Your time is limited—so don’t waste it living someone else’s life

In this week’s #TheLongView:
1⃣ @Meta’s latest results are *very* bad,
2⃣ @Apple wants its cut of @Facebook ads, and
3⃣ Lennart “@pid_eins” Poettering proposes a new #SecureBoot for #Linux.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/9FGhbIS8yc #DevOps

— @Richi 🤓 Jennings (@RiCHi) October 27, 2022

Google pairs GUAC with SLSA to take a bite out of software supply chain insecurity - ReversingLabs

Dip into this tasty repo: Google is putting its weight behind a project to offer a comprehensive view of your software. Enter GUAC: Graph for Understanding Artifact Composition.

3/ It’s an #OpenSource project. In this week’s #SSBlogwatch we go to @GitHub and check it out.

For @ReversingLabs’ @SecuredSoftware: https://t.co/wg73kjbuK4

— @Richi 🤓 Jennings (@RiCHi) October 26, 2022

Chinese Huawei ‘Spies’ Charged — FBI is Mad as Hell - Security Boulevard

China pwned by U.S.
The Chinese government sent two spies to extract information about the U.S. case against Huawei. But they didn’t expect their contact to be a double agent.

Interesting timing, with the announcement right after #XiJinping changed the constitution to stay in power indefinitely.

In today’s #SBBlogwatch, we won’t share our hunny with heffalumps or woozles.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/WNiFqjIFL1

— @Richi 🤓 Jennings (@RiCHi) October 25, 2022

TikTok ‘Will’ Spy on US Citizens — Say Sources - Security Boulevard

For You Plague: TikTok parent ByteDance is planning to track the location of certain targeted individuals on U.S. soil. A specialist Chinese team is already assigned to the task, we’re told.

It’s not the first allegation that #TikTok is up to no good.

In today’s #SBBlogwatch, we doubt it’s the last.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/ZJOJ38IcMa

— @Richi 🤓 Jennings (@RiCHi) October 21, 2022

Fire at Data Center Causes Chaos | 20% Costlier Cloud - DevOps.com

The moral of the story: Life is what happens when you’re busy making other plans

In this week’s #TheLongView:
1⃣ A South Korean conflagration leads to a *ridiculously* long outage, and
2⃣ the price of #PublicCloud is skyrocketing.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/iqu9a3CuSI #DevOps #Kakao

— @Richi 🤓 Jennings (@RiCHi) October 20, 2022

Devs: Don’t rely on GitHub Copilot — legal risk gets real - ReversingLabs

Shut up and think of the deadline: GitHub’s Copilot ML code-completion engine is violating copyright wholesale. So say several high-profile open source advocates.

3/ The lesson for devs? Be extremely careful about the code fragments you import.

In this week’s #SSBlogwatch we go around.

For @ReversingLabs’ @SecuredSoftware: https://t.co/PsuMS6G98T

— @Richi 🤓 Jennings (@RiCHi) October 19, 2022

$3 BILLION in DeFi Hacks in 2022—So Far - Security Boulevard

In Fiat We Trust: Fake money fans are once again mourning the theft of worthless tokens. Finding security flaws in brittle DeFi “smart contracts” seems like shooting fish in a barrel.

3/ #AndNothingOfValueWasLost.

In today’s #SBBlogwatch, we point and laugh at naked emperors.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/sQhl9WTtev #crypto

— @Richi 🤓 Jennings (@RiCHi) October 17, 2022

Linux Fixes 5 Gaping Holes in Wi-Fi - Security Boulevard

Penguinistas’ Premier Panned: Linux’s Wi-Fi code has some nasty bugs, which can be exploited simply by being near an attacker. Remote code execution is a possibility—no need to actually connect to a malicious Wi-Fi network.

Some say it’s the fault of @Linus_Torvalds himself (pictured).

In today’s #SBBlogwatch, we decline to point the finger.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/GnJqX0C6Xm

— @Richi 🤓 Jennings (@RiCHi) October 14, 2022

Kill the Password: Google on Board | 4-Day Week Proves Worthy - DevOps.com

The moral of the story: I am not bound to please thee with my answer

In this week’s #TheLongView:
1⃣ #Passkeys is getting another big-tech supporter, and
2⃣ the @4DayWeek_Global train picks up speed.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/2mZSqgmWaJ #DevOps

— @Richi 🤓 Jennings (@RiCHi) October 13, 2022

DevOps lessons from Toyota FAIL: Crash test secrets - ReversingLabs

Do: Detect daft devs defying doctrine
Toyota stands accused of lax DevOps standards, as the company reveals it stored prod database credentials in a public GitHub repo. That’s bad enough, but it also took five years to detect and fix.

3/ It’s not the first time this has happened. In this week’s #SSBlogwatch we know it won’t be the last.

For @ReversingLabs’ @SecuredSoftware: https://t.co/StM8TAr1x3

— @Richi 🤓 Jennings (@RiCHi) October 12, 2022

LEAKED: Intel’s BIOS Source Code — All 6GB of It - Security Boulevard

Hackers’ Happy Hunting Ground: Source code for the Intel Alder Lake processor EUFI BIOS has gone walkies. 6 GB of build image is floating ’round the net like a genie freed from its bottle.

3/ #4chan is said to be involved. In today’s #SBBlogwatch, we try to sound surprised.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/0G08dvxa3x @insydesw @github @lenovo

— @Richi 🤓 Jennings (@RiCHi) October 11, 2022

Hacker Paige Thompson is FREE (‘Because Transgender Status and Mental Health Issues’) - Security Boulevard

‘Not What Justice Looks Like,’ whines DoJ: Capital One hacker Paige A. Thompson is still guilty, but her sentence is “time served and probation.” The judge went easy “because of her mental health and transgender status,” according to the sore losers at the Department of Justice.

3/ It’s fair to say #erratic was an #EthicalHacker. She could have gone about it better, but imprisoning a #whistleblower is never a good look—regardless of #GenderIdentity.

In today’s #SBBlogwatch, we are v. fair.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/60o69IgjV0

— @Richi 🤓 Jennings (@RiCHi) October 7, 2022

Linux 6.0 is Faster, Cooler | Debian Goes Proprietary | Google Africa Region - DevOps.com

The moral of the story: A fool thinks himself to be wise, but a wise man knows himself to be a fool

In this week’s #TheLongView:
1⃣ #Linux 6.0 promoted to Stable,
2⃣ @Debian 12 will include closed-source binaries, and
3⃣ @GoogleCloud opens its first #Africa region.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/F9Uc1UnAoc #DevOps

— @Richi 🤓 Jennings (@RiCHi) October 6, 2022

Memory-safe #RustLang shines with its day in the sun - ReversingLabs

Don’t miss out: The chatter around the Rust language is growing into a deafening roar. Not only is the Linux kernel train bearing down on the 6.1 station, but countless other devs are waking up to the memory-safe language.

But beware of edge cases. In this week’s #SSBlogwatch we brace for one of @Linus_Torvalds’ famous rants.

For @ReversingLabs’ @SecuredSoftware: https://t.co/4SSu3P3AVN #RustLang

— @Richi 🤓 Jennings (@RiCHi) October 5, 2022

FAIL: Los Angeles School District Loses 500GB of PII - Security Boulevard

Won’t Somebody Think of the Children?
The Los Angeles Unified School District (LAUSD) has lost control of a huge cache of sensitive data. The leak—courtesy of Russian gang Vice Society—includes staff bank account details and psych evals of children.

The self-styled “most accomplished superintendent in America’s history” definitely accomplished *something*.

In today’s #SBBlogwatch, we think it would have been better if he’d accomplished some improved #security.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/FVHhM4W6WS

— @Richi 🤓 Jennings (@RiCHi) October 4, 2022

Warning: N. Korean Job Scams Push Trojans via LinkedIn - Security Boulevard

슬기론 인민의 이 영광
Weird things are happening on LinkedIn. Scammers, believed to be working for North Korea, are creating fake profiles and targeting job applicants.

3/ Hey, hey, #DPRK, how many people will you scam today?

In today’s #SBBlogwatch, we piece together the puzzle.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/MpJMRwpATu

— @Richi 🤓 Jennings (@RiCHi) September 30, 2022

“The OG App” Devs’ Facebook Ban | WFH vs. NYC Real Estate | Calif. Pay Law is GO - DevOps.com

The moral of the story: Misery acquaints a man with strange bedfellows

In this week’s #TheLongView:
1⃣ A third party @Instagram app causes ructions,
2⃣ #RemoteWork causes office slump, and
3⃣ more on @California’s salary transparency law #SB1162.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/XARDmyBgos #DevOps @TheOGapp_

— @Richi 🤓 Jennings (@RiCHi) September 29, 2022

DevOps teams: BGP security is BAD. But you can fix it - ReversingLabs

“It’s always DNS” — unless it’s BGP: The security of the Border Gateway Protocol (BGP) is laughable. But we all rely on it every day. For everything.

3/3 Are you doing them?

Do you want to know how? In this week’s #SSBlogwatch we point you in the right directions.

For @ReversingLabs’ @SecuredSoftware: https://t.co/yXqna3Mimv #DevSecOps

— @Richi 🤓 Jennings (@RiCHi) September 28, 2022

Russia ‘Plans’ HUGE Cyberattack on Critical Infrastructure - Security Boulevard

Слава Україні — Героям Слава
The Ukrainian government has warned that Russia is planning a massive attack against critical infrastructure. And not just that of Ukraine, but also of its allies.

“Hello Ukraine,” the mural says.

In today’s #SBBlogwatch, we paint the town blue and yellow.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/DlbcNYUSpx

— @Richi 🤓 Jennings (@RiCHi) September 27, 2022

Alleged Russian RSOCKS Hacker: ‘Send Me to US’ - Security Boulevard

Къси Чорапи Селфи
The supposed owner of RSOCKS—a huge illegal botnet that provided anonymous proxy services to scrotes—wants to be extradited to the U.S. He claims to have information authorities here will want to hear.

3/3 A U.S. #prison is likely better than the alternatives.

In today’s #SBBlogwatch, ние сме твърде красиви.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/ggRRDz6qeB

— @Richi 🤓 Jennings (@RiCHi) September 26, 2022

Wipro Fires 2-Job Staff | Python Bug from 2007 | Lite Layoffs - DevOps.com

The Moral of the Story: I wish my horse had the speed of your tongue

In this week’s #TheLongView:
1⃣ @Wipro fires 300 for #moonlighting at competitors,
2⃣ #Python has a nasty 15-year-old bug, and
3⃣ companies are finding new ways to lay people off without calling it a “#layoff.”

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/JI3ow4hdGP #DevOps

— @Richi 🤓 Jennings (@RiCHi) September 22, 2022

Rust finds its mojo: Move forward to memory-safe code - ReversingLabs

The time is now
It’s confirmed: The Linux kernel will have Rust support soon. Also this week, Microsoft’s Azure CTO said the age of C++ is over—Rust is the future.

The momentum is surely unstoppable.

In this week’s #SSBlogwatch we see both sides.

For @ReversingLabs’ @SecuredSoftware: https://t.co/rm1ioDphkP

— @Richi 🤓 Jennings (@RiCHi) September 22, 2022

Hate Site Hacked — Kiwi Farms is ‘Very, Very Owned’ - Security Boulevard

Doxxers Doxxed — Swatters Swatted?
Kiwi Farms, the notorious web forum for harassing feminists, the neurodivergent and LGBTQ+ people, has itself suffered the ultimate harassment. Its services were secretly infected for weeks by an injected script that exfiltrated data about its users.

Next we expect leaks of user details.

In today’s #SBBlogwatch, we get slapped in the face with the #irony fish.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/DX9Y6I9lyP #DropKiwiFarms

— @Richi 🤓 Jennings (@RiCHi) September 20, 2022

Victims of Gym Phone Theft Lose $10,000 Each (Because SMS 2FA) - Security Boulevard

SMS 2FA: Go Away
A spate of thefts from gym lockers is reminding us that SMS based two-factor authentication (2FA) is utter, utter garbage. A fraudster is stealing phones and debit/ATM cards, using them to rack up big bills in London.

Let’s unpick the #fraud.

In today’s #SBBlogwatch, we get pumped.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/L48Kh04XPq

— @Richi 🤓 Jennings (@RiCHi) September 19, 2022

Uber Hacked: Its Security is ‘Awful’ and ‘Weak’ - Security Boulevard

People Prefer Proper Taxis: Fake taxi-cum-takeout service Uber was fully pwned this week. The company says it’s “responding to a cybersecurity incident,” whatever that means.

It’s bad—REALLY bad.

In today’s #SBBlogwatch, we dissect a train wreck.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/8P4f9SCEl2

— @Richi 🤓 Jennings (@RiCHi) September 16, 2022

Heat Cooks Twitter DC | AI Will Kill All Humans | Patreon Layoffs, CSAM Claim - DevOps.com

The Moral of the Story: Misery acquaints a man with strange bedfellows

In this week’s #TheLongView:
1⃣ @Twitter is in a “non-redundant state,” thanks to a hot summer,
2⃣ #AI is likely to eliminate us, and
3⃣ @Patreon fires 80 staff amid /nasty/ allegations (TW: #ChildSafety).

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/kupBE1jn4z #DevOps

— @Richi 🤓 Jennings (@RiCHi) September 15, 2022

Why Twitter security sucks: Half of staff has PII access - ReversingLabs

No locks on the doors:Peiter “Mudge” Zatko (pictured) was grilled by U.S. senators this week. Twitter’s former head of security has some damning things to say about the service’s DevOps security — or lack of it.

Is your shop any better? If a bad actor insider abused their power, would you be able to quickly identify it and lock down #access?

In this week’s #SSBlogwatch we get real.

For @ReversingLabs’ @SecuredSoftware: https://t.co/xkcw4JBGC5

— @Richi 🤓 Jennings (@RiCHi) September 15, 2022

Retbleed Security Fix Makes Linux go 70% Slower - Security Boulevard

Must Try Harder:The Linux kernel workaround for the ‘Retbleed’ vulnerability is causing a huge slowdown in tests. Performance runs of VMware guests show results up to 70% worse on slightly old hardware.

Good thing @Intel is working on a better fix.

In today’s #SBBlogwatch, we #speculate to accumulate.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/D2rnn3NLld

— @Richi 🤓 Jennings (@RiCHi) September 13, 2022

Patreon Fires its Security Team — and the Internet Freaks Out - Security Boulevard

Not OK, Jack:Patreon, the notorious membership monetization platform, laid off its entire security team yesterday. Just like that. Ouch.

3/ And there’s an unsubstantiated rumor that #Patreon has been #hacked again.

In today’s #SBBlogwatch, we hope it’s not as bad as 2015’s #blackmail-fest.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/caNFcqGawo

— @Richi 🤓 Jennings (@RiCHi) September 9, 2022

How’s Facebook Work? They Don’t Know! | Cali. Pay Law | NASA RISC-V Launch - DevOps.com

The Moral of the Story: Long live the King

In this week’s #TheLongView:
1⃣ @Facebook engineers admit they’ve no idea what @Meta stores (or where),
2⃣ @California requires job ads quote salaries, and
3⃣ @RISC_V will power future @NASA spacecraft.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/12gqnIKYCd #DevOps

— @Richi 🤓 Jennings (@RiCHi) September 8, 2022

U.S. schools developers on supply chain security - ReversingLabs

Feds’ big yawndoc: The U.S. government is schooling developers in a new document, Securing the Software Supply Chain. The NSA, CISA and the Office of the Director of National Intelligence (ODNI) have the lead.

Even so, dev teams should try to familiarize themselves with it (especially if you want to sell to governments).

In this week’s #SSBlogwatch we achieve full buzzword compliance.

For @ReversingLabs’ @SecuredSoftware: https://t.co/zcW5HZsKgY

— @Richi 🤓 Jennings (@RiCHi) September 8, 2022

TikTok Hack: 2B Records Leak — but ByteDance Denies - Security Boulevard

For You Plague: TikTok was hacked, with over two billion records stolen. Or so says notorious leak group BlueHornet (a/k/a AgainstTheWest, AggressiveCurl). But TikTok says not.

3/ What’s really going on?

In today’s #SBBlogwatch, we sort fiction from fact.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/Kh26Rk8RpT

— @Richi 🤓 Jennings (@RiCHi) September 6, 2022

Hackers Hail all Taxis in Moscow — HUGE Gridlock for 3 Hours - Security Boulevard

In Post-Soviet Russia, Taxi Order YOU:
Ukraine supporters hacked Russia’s biggest ride hailing app, Yandex Taxi. They sent every available cab to a single address, all at once.

3/ Yesterday was not a great day if you were trying to drive on the west side of central #Moscow.

In today’s #SBBlogwatch, we get out and walk.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/xjGL1vTFUf

— @Richi 🤓 Jennings (@RiCHi) September 2, 2022

Stable Diffusion Goes Public — and the Internet Freaks Out - DevOps.com

The Moral of the Story: What fools these mortals be

In this week’s #TheLongView: Unless you’ve been living under a rock, you’ll have seen something about @StabilityAI’s #StableDiffusion. It’s the new #OpenSource #MachineLearning model for creating images from text …

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/CR9WZAs3SG

— @Richi 🤓 Jennings (@RiCHi) August 31, 2022

LastPass hacked (again): What devs can learn - ReversingLabs

LastChance for its reputation?
The latest LastPass hack: Bad actors stole source code and other secrets from the huge password-manager firm’s dev environment. But not, it stresses, anyone’s passwords — as far as it can tell.

3/ What a mess. And it’s not the first time.

In this week’s #SSBlogwatch we put all our eggs in one basket.

For @ReversingLabs’ @SecuredSoftware: https://t.co/zTlkT5w8jT

— @Richi 🤓 Jennings (@RiCHi) August 31, 2022

0ktapus/‘Scatter Swine’ Hacking Gang Stole 10,000 Corp Logins via Twilio - Security Boulevard

Stop SMS 2FA Already: More on the Twilio débâcle from earlier this month: Researchers reveal the hackers swiped at least 9,931 user credentials from more than 130 organizations.

3/ And what’s with the silly names? #0ktapus? #ScatterSwine?

In today’s #SBBlogwatch, we dream of eight-legged pigs.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/w5GND6SbSx

— @Richi 🤓 Jennings (@RiCHi) August 30, 2022

Force Me Back to the Office? Apple ‘Hasn’t Learned Anything’ - DevOps.com

The Moral of the Story: The tempter or the tempted—who sins most?

In this week’s #TheLongView: New ways of working.

Whether it’s remote work, enforced #HybridWorking or a four-day working week, let’s triage the trends and futz with the future.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/OaeWQHU5mS #DevOps

— @Richi 🤓 Jennings (@RiCHi) August 25, 2022

Hyundai devs used sample code signing keys, making updates vulnerable - ReversingLabs

Hyundai: ‘Leading by example’
Developers of the entertainment unit in the Hyundai Ioniq didn’t seem to follow the sample code they were using. They reused an RSA code-signing key pair from an example, rather than generating their own.

3/: It’s only the entertainment unit, right?

But it’s a #Linux computer with full access to the car’s critical #CANbus.

In this week’s #SSBlogwatch we’re frightened by the implications.

For @ReversingLabs’ @SecuredSoftware: https://t.co/WQK6Z3lPW0

— @Richi 🤓 Jennings (@RiCHi) August 25, 2022

Oracle’s HUGE Ad Data Graph is ‘Illegal Panopticon’ — 5 BILLION People Big - Security Boulevard

Does Redwood City Have Limits?
Oracle “illegally” collects and links data about you, selling it to the highest bidder—all without your consent. Online and offline, your privacy is invaded daily—so says a California class action lawsuit.

3/ Stuff just got real, #AdTech industry.

In today’s #SBBlogwatch, we draw back the #SurveillanceCapitalism curtain.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/7DO00ddXzb

— @Richi 🤓 Jennings (@RiCHi) August 23, 2022

NSO Group Fires CEO — and 100 Staff — in Spyware ‘Streamlining’ - Security Boulevard

NSO CEO Go — NSO now ‘NO’?
NSO, notorious producer of the Pegasus nation-state spyware, is struggling. So it’s dumped its CEO, Shalev Hulio, and around 100 employees.

Is this the end for @NSOGroup?

In today’s #SBBlogwatch, we wave goodbye to the “S” in #NSO.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/t9RkgXIYSi

— @Richi 🤓 Jennings (@RiCHi) August 22, 2022

VPNs Don’t Work on iOS — and Apple Doesn’t Care - Security Boulevard

VPN: The P is for PR — bad PR
“VPNs on iOS are a scam.” That’s what an angry security researcher would have you believe. He’s fed up of reproducing and documenting a serious iOS bug that Apple just won’t fix.

What use is a VPN that randomly leaks data?

In today’s #SBBlogwatch, we pit @DefensiveComput vs. @Tim_Cook.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/BAjWNngfIO

— @Richi 🤓 Jennings (@RiCHi) August 19, 2022

Agile Sucks (Redux) | Plus: DevOps on Mars - DevOps.com

The moral of the story: Summer’s lease hath all too short a date

In this week’s #TheLongView:
1⃣ #Agile is bad, but “Wagile” is worse,
2⃣ This prod is even worse than yours.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/azrc6nOTCd #DevOps @NASA @NASAJPL @MarsCuriosity

— @Richi 🤓 Jennings (@RiCHi) August 18, 2022

Just for devs: Best of Black Hat and DEF CON - ReversingLabs

Hacker summer camp is back, baby: Lots happened in Vegas last week. Most of it should have stayed in Vegas. But some of it bears digging out from piles of mediocre nonsense.

I’ll peruse the news of the week … so you don’t have to.

In this week’s #SSBlogwatch we sort the heat from the chai.

For @ReversingLabs’ @SecuredSoftware: https://t.co/H6DUkWpZlU #AEPICLeak #Electron

— @Richi 🤓 Jennings (@RiCHi) August 18, 2022

Gmail Lets Candidates Spam You — FEC FAIL - Security Boulevard

Email is a Mass Noun: Politicians convinced the Federal Election Commission (FEC) that Google must give them a free pass through Gmail’s spam filters. They want la GOOG to ignore user preferences and deliver their “delightful” fundraising missives direct to your inbox.

Oh, what a tangled web we weave.

In today’s #SBBlogwatch, we order the lobster Thermidor au crevette with a Mornay sauce, served in a Provencale manner, with shallots and aubergines, etc., etc. …

At @TechstrongGroup’s @SecurityBlvd: https://t.co/DnKlTnyyo8 @ShaeFlorentine

— @Richi 🤓 Jennings (@RiCHi) August 15, 2022

Cisco Pwned by ‘Russian’ Gang — Data Leaked, Egg on Face - Security Boulevard

MFA FAIL: Cisco got hacked by a ransomware gang—a broker for the UNC2447 threat actor, linked to the Yanluowang crew (pictured). This was way back at the end of May, but Cisco’s only now talking about it.

What a mess.

In today’s #SBBlogwatch, we try to learn from Cisco’s mistakes.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/F3WgYaRi9c

— @Richi 🤓 Jennings (@RiCHi) August 12, 2022

We Must Kill ‘Dinosaur’ JavaScript | Microsoft Open Sources 3D Emoji - DevOps.com

The moral of the story: The Devil hath power to assume a pleasing shape

In this week’s #TheLongView:
1⃣ #JavaScript is a bloated barrier to progress, and
2⃣ @Microsoft’s #emoji are on @GitHub.

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/Bfcjp7bHbE #DevOps

— @Richi 🤓 Jennings (@RiCHi) August 11, 2022

DevOps: Fix your dangerous redirects! Amex shows how - ReversingLabs

And Snap shows how not: Recent ‘LogoKit’ spear phishing campaigns have misused open redirect URLs in web apps from Snapchat and American Express. When alerted, Amex quickly fixed the hole, but Snap’s is still open after more than a year.

Be better netizens, #DevOps teams.

In this week’s #SSBlogwatch we audit our URLs.

For @ReversingLabs’ @SecuredSoftware: https://t.co/MPBjV6uFjn

— @Richi 🤓 Jennings (@RiCHi) August 11, 2022

Twilio Fails Simple Test — Leaks Private Data via Phishing - Security Boulevard

“Sophisticated” Sophistry: Twilio (NYSE:TWLO) customer data has leaked—after a simple phishing attack on employees. The firm isn’t saying how many end-users are affected, but it could run into the millions.

… Twilio PR is spinning it as a “sophisticated” attack.

In today’s #SBBlogwatch, we just point and laugh.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/nRi20mV3u7

— @Richi 🤓 Jennings (@RiCHi) August 9, 2022

Slack App Leaked Hashed User Passwords for 5 YEARS - Security Boulevard

‘One Way’ Hash — Yeah, Right: Since 2017, if you’ve invited anyone to a Slack workspace, your password has leaked—albeit in the form of a salted hash. People are asking how this could have happened, and how it remained undetected for so long—more than five years.

Egg on someone’s face at @SlackHQ.

In today’s #SBBlogwatch, we double-check our password manager.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/caOOEwyWZ1

— @Richi 🤓 Jennings (@RiCHi) August 8, 2022

US Emergency Alert System Has ‘Huge Flaw’ — Broadcasters Must Patch NOW - Security Boulevard

EAS FAIL: FEMA IPAWS The Emergency Alert System (EAS) run by FEMA and the FCC is vulnerable to hacking. Imagine the vast potential for panic and chaos if a fake alert was widely broadcast.

This is NOT a test.

In today’s #SBBlogwatch, we fear a *real* emergency.

At @TechstrongGroup’s @SecurityBlvd: https://t.co/3mrQ1zDYz4

— @Richi 🤓 Jennings (@RiCHi) August 5, 2022

Recession! DevOps Hiring Freeze | Data Centers Suck (Power) | Intel to ‘be’ Wi-Fi 7 - DevOps.com

The moral of the story: There’s no point in questioning authority if you aren’t going to listen to the answers

In this week’s #TheLongView:
1⃣ Engineer #jobs are being cut, #hiring
2⃣ #cloud infrastructure is using too much #energy, and
3⃣ @Intel’s 802.11be silicon is alive. #WiFi7

At @TechstrongGroup’s @DevOpsDotCom: https://t.co/AOQdR9Z2b4 #DevOps #thanks @ShaeFlorentine

— @Richi 🤓 Jennings (@RiCHi) August 4, 2022

Post-quantum algo ‘SIKE’ dead: Did math geeks find key-encap back door? - ReversingLabs

NIST nixes PQC postulant: Here’s more on NIST’s search for post-quantum cryptography (PQC): This week, is it in trouble? Breathless headlines would have you believe it, because researchers found a way to easily break the SIKE key encapsulation algorithm.

… @CosicBe researchers Wouter Castryck and Thomas Decru are eligible for a chunky #BugBounty.

In this week’s #SSBlogwatch we’re glad to see the system is working, not broken.

For @ReversingLabs’ @SecuredSoftware: https://t.co/lp9Ar4HrHB

— @Richi 🤓 Jennings (@RiCHi) August 4, 2022