WD My Cloud NAS Devices Have Hard-Wired Backdoor
January 8th, 2018Via: Register:
If you have a Western Digital My Cloud network attached storage device, it’s time to learn how to update its OS because researcher James Bercegay has discovered a dozen models possess a hard-coded backdoor.
The backdoor, detailed here, lets anyone log in as user mydlinkBRionyg with the password abc12345cba.
WD mostly markets the My Cloud range as suited for file sharing and backup in domestic settings. But several of the models with the backdoor are four-disk machines suitable for use as shared storage in small business and also capable of being configured as iSCSI targets for use supporting virtual servers. Throw in the fact that some of the messed-up machines can reach 40TB capacity and there’s the very real prospect that sizeable databases are dangling online.
Intel’s 49-Qubit Chip Shoots for Quantum Supremacy
January 8th, 2018Disclosure: I am long Quantum Resistant Ledger (QRL). Nothing that appears on Cryptogon should be considered a recommendation to buy, sell or hold any financial instrument.
—
Via: IEEE:
Intel has passed a key milestone while running alongside Google and IBM in the marathon to build quantum computing systems. The tech giant has unveiled a superconducting quantum test chip with 49 qubits: enough qubits to possibly enable quantum computing that begins to exceed the practical limits of modern classical computers.
Intel’s announcement about the design and fabrication of its new 49-qubit superconducting quantum chip, code-named Tangle Lake, came during a keynote speech by Brian Krzanich, Intel’s CEO, during 2018 CES, an annual consumer electronics tradeshow in Las Vegas. It’s a milestone that Google and IBM researchers have also been targeting because it could usher in the moment of so-called “quantum supremacy,” when quantum computing can outperform classical computing.
The More I Read About Meltdown And Spectre…
January 7th, 2018The more I wonder: Are these bugs, or features?
Breaking Bitcoin With a Quantum Computer
January 6th, 2018Disclosure: I am long Quantum Resistant Ledger (QRL). Nothing that appears on Cryptogon should be considered a recommendation to buy, sell or hold any financial instrument.
—
For commentary on this, I’m going to share excerpts from an email that I wrote to friends of mine back in November:
Hi, ***
*** asked me to let her know if I spotted anything interesting in the cryptocoin space.
Cryptocoins could be doomed when quantum computers become a reality. Seeing this piece about it drove the point home:
https://www.technologyreview.com/s/609408/quantum-computers-pose-imminent-threat-to-bitcoin-security
I started looking to see if anyone was working on a quantum resistant cryptocoin.
There is one. It’s called The Quantum Resistant Ledger (QRL).
It has not fully launched yet, but trades in token form on a cryptocoin exchange called Bittrex. When it launches, the QRL tokens will be redeemed for the actual QRL cryptocoins.
QRL tokens can be bought with Bitcoin and sold for Bitcoin on Bittrex in real time. Despite the fact that this coin is virtually unknown, there is decent liquidity on Bittrex. However, pricing could become extremely volatile with news or a whale investor buying or selling.
I have been warning people on Cryptogon that I believe that NSA already has a general purpose quantum computing capability, which threatens Bitcoin and other cryptocoins.
In the QRL whitepaper, I found the following interesting:
Public quantum computer development has not passed beyond 2^5 qubits or the factorisation of small numbers (15 or 21). However, in August 2015 the NSA deprecated elliptic curve cryptography ostensibly based upon quantum computing concerns. It is unclear how advanced quantum computing may be presently or that any breakthroughs in this field will be publicised to allow cryptographic protocols in common usage in the internet to be made post-quantum secure. With somewhat anti-establishment origins, bitcoin could find itself the earliest target of an adversary with a quantum computer.
If a significant quantum computing advance were to occur publicly, node developers could implement quantum-resistant cryptographic signature schemes into bitcoin and encourage all users to move their balances from ECDSA-based addresses to new quantum-safe addresses. To mitigate the proportion of effected addresses it would be reasonable to disable public key recycling at the protocol level. Such a planned upgrade would also result in the possible movement of the 1 million coins belonging to Satoshi Nakamoto – with associated price volatility.
A less favourable scenario would be a silent non-linear quantum computing advance followed by a nuanced quantum computing attack on bitcoin addresses with exposed public keys. Such thefts could have a devastating effect upon the bitcoin exchange price due to new heavy sell pressure and a complete loss of confidence in the system as the scale of thefts become known. The role of bitcoin as a store of value (‘digital gold’) would be very badly damaged with extreme consequences for the world. In this context the authors believe it is reasonable to experiment with quantum-resistant cryptographic signatures in a cryptocurrency ledger and potentially create a backup value store in the event of a black swan.
—
“It is unclear how advanced quantum computing may be presently or that any breakthroughs in this field will be publicised to allow cryptographic protocols in common usage in the internet to be made post-quantum secure. ”
Well, it’s one thing for me to say it on my lunatic fringe conspiracy blog, but I’m clearly not the only one who suspects a covert quantum computing capability could emerge, or has emerged already. As of 2015, NSA stopped trusting the type of encryption that Bitcoin uses…
Hmm.
In that last paragraph in the excerpt above, they’re laying out a scenario in which intelligence agencies can quietly steal money out of cryptocoin wallets from the public addresses alone! haha Ye olde covert bail in!
…
If you guys want to acquire any QRL, please keep in mind, this is maximum risk. It might not work, it could go to zero, maybe other coins can manage to implement quantum resistant measures…. Who knows…
However, to summarize:
1) Quantum computers are coming, or are already operational by NSA and possibly other intelligence agencies.
2) Quantum computers threaten all Bitcoin-type cryptocoins.
3) QRL is the only cryptocoin purpose built to resist attacks from attackers with quantum computers.
4) People are holding tens of billions of dollars in Bitcoin and other cryptocoins. If a tiny fraction of those people become paranoid about the the quantum threat, it would be an understatement to say that QRL could become very interesting very fast.
—
Since I wrote that, other coins are mentioning adding quantum resistant capabilities, but I would take those claims with a grain of salt.
I had been planning to do more extensive research on QRL and their team and present that as a Cryptogon post, but events are moving faster than I anticipated, so this will have to do.
Via: Fortune:
Alex Beath, a Toronto-based physicist and pension fund analyst, is skeptical about Bitcoin but sees one useful purpose for the crypto-currency: It may detect when someone creates a working quantum computer.
“The second someone creates a viable quantum computer, the NP-complete math problems at the heart of Bitcoin mining tech become instantly solvable,” Beath notes. “In other words, one answer to the question ‘what’s the first thing you’d do with a quantum computer?’ is ‘mine all of the remaining Bitcoin instantly.’ Until that happens, nobody has a quantum computer.”
Beath’s off-the-cuff observation, which he made in response to a Fortune query about the security of bitcoin, is amusing. But it also underscores a serious problem: Namely, a new era of computing is fast-approaching and when it arrives, the system that gave rise to many crypto-currency fortunes will collapse.
This threat to Bitcoin and other software systems that use the same underlying encryption technique—a technique likely to crumble in the face of a quantum-based attack—is not new. Indeed, it was predicted decades ago, and Ethereum founder (and former journalist) Vitalik Buterin wrote about how to defend it in 2013.
The difference today, though, is that companies like Microsoft, Google and IBM are making rapid breakthroughs that could make quantum computing viable in less than 10 years.
Why Raspberry Pi Isn’t Vulnerable to Spectre or Meltdown
January 6th, 2018Via: Raspberry Pi:
Over the last couple of days, there has been a lot of discussion about a pair of security vulnerabilities nicknamed Spectre and Meltdown. These affect all modern Intel processors, and (in the case of Spectre) many AMD processors and ARM cores. Spectre allows an attacker to bypass software checks to read data from arbitrary locations in the current address space; Meltdown allows an attacker to read data from arbitrary locations in the operating system kernel’s address space (which should normally be inaccessible to user programs).
Both vulnerabilities exploit performance features (caching and speculative execution) common to many modern processors to leak data via a so-called side-channel attack. Happily, the Raspberry Pi isn’t susceptible to these vulnerabilities, because of the particular ARM cores that we use.
U.S. Government Searches of Travelers’ Phones and Computers Up Sharply
January 6th, 2018Via: cnet:
US Customs and Border Patrol searched more phones and laptops at the border in 2017 — 30,200 devices total.
The agency released those numbers Friday along with updated guidelines on how to conduct the searches, which have become a hot button issue under the administration of President Donald Trump. A lawsuit from the ACLU claims the searches violate constitutional rights to privacy, but the government says border searches are exempted from these protections for the sake of national security.
“In this digital age, border searches of electronic devices are essential to enforcing the law at the US border and to protecting the American people,” John Wagner, a deputy executive assistant commissioner at Customs and Border Patrol, said in a statement.
Travelers can be subjected to the searches whether or not they’re US citizens. Border Patrol agents have conducted the searches since before Trump’s election. The number of searches increased by about 59 percent from 2016 to 2017, the year Trump took office.
The searches can reveal everything on a traveler’s phone, tablet or computer, from vacation photos to potentially sensitive documents like business records or health information. In July, the US Department of Homeland Security said its authority to search electronic devices didn’t extend to information stored in the cloud that a device might be able to access. Customs and Border Patrol is run under the auspices of Homeland Security.
Security Flaws Put Virtually All Phones, Computers at Risk
January 3rd, 2018Update: Security Flaws Put Virtually All Phones, Computers at Risk
Update: All Macs, iPhones and iPads Affected
Via: The Verge:
Apple confirmed on Thursday that all Mac and iOS devices are affected by the Meltdown and Spectre CPU flaws that have roiled the computing industry for the past 24 hours, resulting in a race to patch operating systems and cloud computing infrastructure at the highest levels.
“‘All Mac systems and iOS devices are affected, but there are no known exploits impacting customers at this time,” the company writes in a blog post. “Since exploiting many of these issues requires a malicious app to be loaded on your Mac or iOS device, we recommend downloading software only from trusted sources such as the App Store.”
—
It’s not that bad, it’s worse.
Via: Reuters:
Security researchers on Wednesday disclosed a set of security flaws that they said could let hackers steal sensitive information from nearly every modern computing device containing chips from Intel Corp, Advanced Micro Devices Inc and ARM Holdings.
—
Via: Guardian:
A security flaw has been found in virtually all Intel processors that will require fixes within Windows, macOS and Linux, according to reports.
Developers are currently scrambling behind the scenes to fix the significant security hole within the Intel chips, with patches already available within some versions of Linux and some testing versions of Windows, although the fixes are expected to significantly slow down computers.
The specific details of the flaw, which appears to affect virtually all Intel processors made in the last decade and therefore millions of computers running virtually any operating system, have not been made public.
But details of the fixes being developed point to issues involving the accessing of secure parts of a computer’s memory by regular programs. It is feared that the security flaw within the Intel processors could be used to access passwords, login details and other protected information on the computer.
The fixes involve moving the memory used by the core of the computer’s operating system, known as the kernel, away from that used by normal programs. In that way, normal programs, including anything from javascript from a website to computer games, cannot be manipulated to exploit the hole and gain access to the protected kernel memory.
But implementing the fix is expected to significantly affect the performance of the computer, making some actions up to around 30% slower.
Congressional Investigators Find Irregularities in FBI’s Handling of Clinton Email Case
January 3rd, 2018Shocker.
Via: The Hill:
Republicans on key congressional committees say they have uncovered new irregularities and contradictions inside the FBI’s probe of Hillary Clinton’s email server.
For the first time, investigators say they have secured written evidence that the FBI believed there was evidence that some laws were broken when the former secretary of State and her top aides transmitted classified information through her insecure private email server, lawmakers and investigators told The Hill.
That evidence includes passages in FBI documents stating the “sheer volume” of classified information that flowed through Clinton’s insecure emails was proof of criminality as well as an admission of false statements by one key witness in the case, the investigators said.
The name of the witness is redacted from the FBI documents but lawmakers said he was an employee of a computer firm that helped maintain her personal server after she left office as America’s top diplomat and who belatedly admitted he had permanently erased an archive of her messages in 2015 after they had been subpoenaed by Congress.
The investigators also confirmed that the FBI began drafting a statement exonerating Clinton of any crimes while evidence responsive to subpoenas was still outstanding and before agents had interviewed more than a dozen key witnesses.
Those witnesses included Clinton and the computer firm employee who permanently erased her email archives just days after the emails were subpoenaed by Congress, the investigators said.
New York Times Bullshit Crosses Into Comedy Gold: A.I. and Big Data Could Power a New War on Poverty
January 2nd, 2018Here’s one for your Not-The-Onion file folder.
At the link, there’s a picture of a robot shaking hands with a human.
Here’s an idea for a New York Times OpEd: “How to Get a Suntan from a Nuclear Bomb Blast.”
For my story idea, they could show a nice mushroom cloud going up into the sky with a bunch of celebrities on a beach, basking in the… flash.
“If you’re far enough away from ground zero, just close your eyes, and a split second later, you’re done. Sure, nuclear explosions can be a pain, but there’s no reason to let them ruin your day. Turn that frown upside down and get ready to party!”
As for the OpEd below, which tries to smooth over what’s coming with a bunch of Magic 8 Ball codswallop, here’s a look at the implications of those driving jobs going away:
It should be clear at a glance just how dependent the American economy is on truck drivers. According to the American Trucker Association, there are 3.5 million professional truck drivers in the US, and an additional 5.2 million people employed within the truck-driving industry who don’t drive the trucks. That’s 8.7 million trucking-related jobs.
We can’t stop there though, because the incomes received by these 8.2 million people create the jobs of others. Those 3.5 million truck drivers driving all over the country stop regularly to eat, drink, rest, and sleep. Entire businesses have been built around serving their wants and needs. Think restaurants and motels as just two examples. So now we’re talking about millions more whose employment depends on the employment of truck drivers. But we still can’t even stop there.
Those working in these restaurants and motels along truck-driving routes are also consumers within their own local economies. Think about what a server spends her paycheck and tips on in her own community, and what a motel maid spends from her earnings into the same community. That spending creates other paychecks in turn. So now we’re not only talking about millions more who depend on those who depend on truck drivers, but we’re also talking about entire small town communities full of people who depend on all of the above in more rural areas. With any amount of reduced consumer spending, these local economies will shrink.
Looks like that AI is going to be busy fighting that, “New War on Poverty.”
Other Not-The-Onion wars to note:
The War on Drugs
The War on Cancer
The War on Terror
Via: New York Times:
When it comes to artificial intelligence and jobs, the prognostications are grim. The conventional wisdom is that A.I. might soon put millions of people out of work — that it stands poised to do to clerical and white collar workers over the next two decades what mechanization did to factory workers over the past two. And that is to say nothing of the truckers and taxi drivers who will find themselves unemployed or underemployed as self-driving cars take over our roads.
But it’s time we start thinking about A.I.’s potential benefits for society as well as its drawbacks. The big-data and A.I. revolutions could also help fight poverty and promote economic stability.
Iran Flashback: Seven Countries in Five Years
December 31st, 2017Via: New York Magazine:
Anti-government protests continued across multiple cities in Iran for a fourth day on Sunday, the most widespread unrest in the country since the pro-democracy Green Movement in 2009 — though nowhere near the same scale thus far. Two protesters were killed overnight Saturday, the first deaths attributed to the unrest. On Sunday, authorities reportedly blocked Instagram and the popular messaging app Telegram, which Iranians have been using to spread news about the protests. The country’s powerful Revolutionary Guard has threatened a violent crackdown if the demonstrations continue.
