Security quotes of the week
John Gilmore, an American entrepreneur and civil libertarian, once famously
quipped that “the Internet interprets censorship as damage and routes
around it.” This notion undoubtedly rings true for those who see national
governments as the principal threats to free speech.
— Brian
Krebs
However, events of the past week have convinced me that one of the fastest-growing censorship threats on the Internet today comes not from nation-states, but from super-empowered individuals who have been quietly building extremely potent cyber weapons with transnational reach.
More than 20 years after Gilmore first coined that turn of phrase, his most notable quotable has effectively been inverted — “Censorship can in fact route around the Internet.” The Internet can’t route around censorship when the censorship is all-pervasive and armed with, for all practical purposes, near-infinite reach and capacity. I call this rather unwelcome and hostile development the “The Democratization of Censorship.”
Instead, the attacks against KrebsOnSecurity harness so-called
Internet-of-things devices—think home routers, webcams, digital video
recorders, and other everyday appliances that have Internet capabilities
built into them. Manufacturers design these devices to be as inexpensive
and easy-to-use as possible. Consumers often have little technical
skill. As a result, the devices frequently come with bug-ridden firmware
that never gets updated and easy-to-guess login credentials that never get
changed. Their lax security and always-connected status makes the devices
easy to remotely commandeer by people who turn them into digital cannons
that spray the Internet with shrapnel.
— Dan Goodin
The RecentFiles object gives access to the history of recent
documents. Most users, unless they just installed Word, are going to have
opened more than two documents. However, on a testing virtual machine (VM),
the software is normally not "broken in". When the VM is initially created,
software is installed, maybe opened once or twice to make sure it works,
and then the state is saved and every time a test needs to be made, that
state is loaded again. These VM images may then be used in automated
analysis and testing tools which execute malware and see how they
behave. If malware can be smart enough to know when it's being tested in a
VM, it can avoid doing anything suspicious or malicious and thereby
increase the time it takes to be detected by such tools.
— Caleb Fenton