Congratulations!

[Valid Atom 1.0] This is a valid Atom 1.0 feed.

Recommendations

This feed is valid, but interoperability with the widest range of feed readers could be improved by implementing the following recommendations.

Source: http://erratasec.blogspot.com/feeds/posts/default

  1. <?xml version='1.0' encoding='UTF-8'?><?xml-stylesheet href="http://www.blogger.com/styles/atom.css" type="text/css"?><feed xmlns='http://www.w3.org/2005/Atom' xmlns:openSearch='http://a9.com/-/spec/opensearchrss/1.0/' xmlns:blogger='http://schemas.google.com/blogger/2008' xmlns:georss='http://www.georss.org/georss' xmlns:gd="http://schemas.google.com/g/2005" xmlns:thr='http://purl.org/syndication/thread/1.0'><id>tag:blogger.com,1999:blog-37798047</id><updated>2024-05-15T15:55:54.132-04:00</updated><category term="Apple"/><category term="humor"/><category term="NSA"/><category term="Microsoft"/><category term="CFAA"/><category term="masscan"/><category term="0day"/><category term="LookingGlass"/><category term="weev"/><category term="wifi"/><category term="HEV"/><category term="snowden"/><category term="C10M"/><category term="bitcoin"/><category term="password"/><category term="AxBan"/><category term="Ferret"/><category term="cyberwar"/><category term="#Anonymous"/><category term="Blackhat"/><category term="NetNeutrality"/><category term="SDLC"/><category term="TwiGUARD"/><category term="Twitter"/><category term="crack"/><category term="iPhone"/><category term="law"/><category term="net neutrality"/><category term="IDS"/><category term="SQL injection"/><category term="crypto"/><category term="malware"/><category term="Cisco"/><category term="EFF"/><category term="Metasploit"/><category term="OSX"/><category term="Occupy Wall Street"/><category term="ProtoDev"/><category term="Shmoocon2013"/><category term="TSA"/><category term="Vendor of the Week"/><category term="XKeyScore"/><category term="blog"/><category term="cliché"/><category term="deep inspection"/><category term="election"/><category term="random"/><category term="troll"/><category term="Alfa Bank"/><category term="Legacy negligence"/><category term="RSA"/><category term="Russia"/><category term="Tor"/><category term="Trump"/><category term="Trump Orgainzation"/><category term="anti-virus"/><category term="bugs"/><category term="cliche"/><category term="comodo"/><category term="comodogate"/><category term="fbi"/><category term="heartbleed"/><category term="netbook"/><category term="swartz"/><category term="virus"/><category term="wikileaks"/><category term="#glass"/><category term="Anonymous"/><category term="DRM"/><category term="Errata"/><category term="Facebook"/><category term="GPU"/><category term="Orwell"/><category term="Ruby"/><category term="Silicon Snake Oil"/><category term="Solaris"/><category term="TV"/><category term="activism"/><category term="code"/><category term="cracking"/><category term="dorks"/><category term="economics"/><category term="global warming"/><category term="google"/><category term="groupthink"/><category term="hacking"/><category term="identity theft"/><category term="journalism"/><category term="movies"/><category term="myth"/><category term="shellshock"/><category term="sidejacking"/><category term="survey"/><category term="#BSidesATL"/><category term="60minutes"/><category term="ASLR"/><category term="Books"/><category term="CCC"/><category term="CISSP"/><category term="DNS"/><category term="FCC"/><category term="George Ou"/><category term="Hacker Eye View"/><category term="Laws that are bad ideas"/><category term="Manning"/><category term="NAISG"/><category term="NAS"/><category term="PWN2OWN"/><category term="Snort"/><category term="Sony"/><category term="Toorcon"/><category term="United Nations"/><category term="Windows Mobile"/><category term="aaron"/><category term="certification"/><category term="cloud"/><category term="cyberterrorism"/><category term="data plane"/><category term="encryption"/><category term="ethics"/><category term="exploit"/><category term="firefox"/><category term="free speech"/><category term="funny"/><category term="hamster"/><category term="intellectual property"/><category term="kindle"/><category term="leak"/><category term="lulzsec"/><category term="mozilla"/><category term="musings"/><category term="nerd"/><category term="news"/><category term="oath"/><category term="openssl"/><category term="patents"/><category term="pentest"/><category term="raspberry pi"/><category term="research"/><category term="reverse engineering"/><category term="review"/><category term="rights"/><category term="risk analysis"/><category term="scada"/><category term="scalability"/><category term="sniffing"/><category term="software assurance"/><category term="sucks"/><category term="superfish"/><category term="technology"/><category term="tools"/><category term="twinkles"/><category term="vulnerability disclosure"/><category term="worm"/><category term="xmas"/><category term="#BSidesLV"/><category term="#BSidesSF"/><category term="#attorneyclient"/><category term="#breakingin"/><category term="#corporate"/><category term="#drones"/><category term="#legal"/><category term="#siliconvalley"/><category term="#spygate"/><category term="#startup"/><category term="3DES"/><category term="ARGs"/><category term="ATHF"/><category term="Adobe"/><category term="Andy Warhol"/><category term="BIOS"/><category term="Barbie"/><category term="Benzene"/><category term="Bitlocker"/><category term="BlackICE"/><category term="Blackberry"/><category term="Bratz"/><category term="Breaking in"/><category term="CIA"/><category term="CISA"/><category term="CPU"/><category term="CanSecWest"/><category term="Chinese hackers"/><category term="Christmas"/><category term="Comcast"/><category term="Communications Act of 1934"/><category term="DLL"/><category term="Equifax"/><category term="FOIA"/><category term="GNU"/><category term="GPS spoofing"/><category term="Guns"/><category term="Hacker"/><category term="Internet"/><category term="Ironport"/><category term="JavaScript"/><category term="Kindle Fire"/><category term="MAPP"/><category term="MMORPG"/><category term="MSCHAPv2"/><category term="Mac Pro"/><category term="MacAfee"/><category term="McAfee"/><category term="Mirai"/><category term="Myspace"/><category term="NAC"/><category term="NASCAR"/><category term="NDAA"/><category term="Neo"/><category term="NodeJS"/><category term="North Korea"/><category term="NotPetya"/><category term="OS/2"/><category term="Oakley"/><category term="Operation Global Blackout"/><category term="Oracle"/><category term="Oreilly"/><category term="PF_RING"/><category term="PayPal"/><category term="PoC"/><category term="Profile Spy"/><category term="Quicktime"/><category term="RAID"/><category term="ROI"/><category term="RSP"/><category term="Radio"/><category term="Ranum"/><category term="Reality Leigh Winner"/><category term="Rogue"/><category term="SANs"/><category term="SMS"/><category term="SOPA"/><category term="Safari"/><category term="SecTor"/><category term="Signature List"/><category term="Street View"/><category term="Summercon"/><category term="Symbian"/><category term="TCP/IP"/><category term="TV show"/><category term="Target"/><category term="Terminator"/><category term="The Intercept"/><category term="The Matrix"/><category term="The end of the cyber world"/><category term="USRP"/><category term="WabiSabiLabi"/><category term="WinNT"/><category term="Windows 7"/><category term="Yahoo"/><category term="active defense"/><category term="amazon"/><category term="amazon ec2"/><category term="analogies"/><category term="anonymous sources"/><category term="anti-vax"/><category term="atom"/><category term="attribation"/><category term="attribution"/><category term="aws"/><category term="backdoor"/><category term="backtrack"/><category term="bad bloggers"/><category term="badge"/><category term="bash"/><category term="beta"/><category term="bilski"/><category term="bizzaro world"/><category term="bluehat"/><category term="bluetooth"/><category term="botnet"/><category term="breach"/><category term="bully"/><category term="business"/><category term="cablegate"/><category term="captcha"/><category term="careers"/><category term="certificate"/><category term="chumby"/><category term="coffee"/><category term="collateral murder"/><category term="comedy"/><category term="conspiracy theories"/><category term="cookies"/><category term="crazy"/><category term="creationism"/><category term="cyberpunk"/><category term="cyberweapons"/><category term="darkreading"/><category term="database"/><category term="deep knowledge"/><category term="defcon"/><category term="denier"/><category term="detained"/><category term="dictionary"/><category term="disarmament"/><category term="dm1z"/><category term="down twinkles"/><category term="drama"/><category term="echelon"/><category term="email"/><category term="employment agreement"/><category term="entertainment"/><category term="evasion"/><category term="events with wifi"/><category term="evolution"/><category term="exploit sales"/><category term="fame"/><category term="fascism"/><category term="firewall"/><category term="freakonomics"/><category term="ftc"/><category term="fuzzing"/><category term="games"/><category term="going dark"/><category term="guru"/><category term="hack back"/><category term="hacker tool"/><category term="hacktivism"/><category term="hurricane"/><category term="iPad"/><category term="ida pro"/><category term="infrared"/><category term="intelligent design"/><category term="interesting"/><category term="internships"/><category term="intresting"/><category term="invention"/><category term="invisibility cloaks"/><category term="iptables"/><category term="iran"/><category term="jokes"/><category term="journalism guide"/><category term="kerb"/><category term="legal"/><category term="minigubs"/><category term="misconceptions"/><category term="mitm"/><category term="mobile"/><category term="multi-core"/><category term="nPetya"/><category term="nginx"/><category term="ninja"/><category term="nmap"/><category term="obama"/><category term="open-source"/><category term="party"/><category term="pcap_next"/><category term="pcap_set_immediate_mode"/><category term="performance"/><category term="phishing"/><category term="phones"/><category term="policy"/><category term="politics"/><category term="populism"/><category term="port scan"/><category term="process"/><category term="propaganda"/><category term="pundits"/><category term="ransomware"/><category term="red flags rule"/><category term="redacted document"/><category term="responsible disclosure"/><category term="risk"/><category term="robert khan"/><category term="rogaway"/><category term="rootkit"/><category term="roundup"/><category term="rvm"/><category term="sabu"/><category term="salt"/><category term="science"/><category term="sdl"/><category term="seattle"/><category term="sellout"/><category term="sexism"/><category term="shodan"/><category term="shout hacking"/><category term="shows"/><category term="simpsons"/><category term="sniffer"/><category term="social engineering"/><category term="software defined networks"/><category term="software patents"/><category term="spam"/><category term="spoofing"/><category term="sprint"/><category term="spygate"/><category term="ssh"/><category term="ssl"/><category term="startups"/><category term="steganography"/><category term="supreme court"/><category term="surveillance"/><category term="tape"/><category term="telnet"/><category term="testing"/><category term="tldr"/><category term="tradeoffs"/><category term="trope"/><category term="truther"/><category term="unmanned systems"/><category term="unsafe clib"/><category term="vapid populists"/><category term="vint cerf"/><category term="virtualization"/><category term="vista"/><category term="vuln"/><category term="vulnerability market"/><category term="war on hackers"/><category term="wassenaar"/><category term="wget"/><category term="white-hat"/><category term="wizards"/><category term="wrong"/><category term="x86"/><title type='text'>Errata Security</title><subtitle type='html'></subtitle><link rel='http://schemas.google.com/g/2005#feed' type='application/atom+xml' href='https://blog.erratasec.com/feeds/posts/default'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/'/><link rel='hub' href='http://pubsubhubbub.appspot.com/'/><link rel='next' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default?start-index=26&amp;max-results=25'/><author><name>David Maynor</name><uri>http://www.blogger.com/profile/09921229607193067441</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='16' height='16' src='https://img1.blogblog.com/img/b16-rounded.gif'/></author><generator version='7.00' uri='http://www.blogger.com'>Blogger</generator><openSearch:totalResults>1224</openSearch:totalResults><openSearch:startIndex>1</openSearch:startIndex><openSearch:itemsPerPage>25</openSearch:itemsPerPage><entry><id>tag:blogger.com,1999:blog-37798047.post-2857142063679853500</id><published>2024-02-14T17:30:00.002-05:00</published><updated>2024-02-14T17:30:42.635-05:00</updated><title type='text'>C can be memory safe, part 2</title><content type='html'>&lt;p&gt;&lt;a href=&quot;https://blog.erratasec.com/2023/02/c-can-be-memory-safe.html&quot;&gt;This post&lt;/a&gt; from last year was posted to &lt;a href=&quot;https://lobste.rs/s/gnjx2n/c_can_be_memory_safe&quot;&gt;a forum,&lt;/a&gt; so I thought I&#39;d write up some rebuttals to their comments.&lt;/p&gt;&lt;p&gt;The first comment is by David Chisnall, creator of CHERI C/C++, which proposes we can solve the problem with CPU instruction set extensions. It&#39;s a good idea, but after 14 years, CPUs haven&#39;t had their instruction-sets upgraded. Even mainstream RISC V processors haven&#39;t been created using those extensions.&lt;/p&gt;&lt;p&gt;Chisnall: &quot;&lt;i&gt;&lt;b&gt;If your safety requires you to insert explicit checks, it’s not safe&lt;/b&gt;&lt;/i&gt;&quot;. This is true from one perspective, false from another. My proposal includes compilers spitting out &lt;b&gt;warnings&lt;/b&gt;&amp;nbsp;whenever bounds information doesn&#39;t exist.&lt;/p&gt;&lt;p&gt;C is full of problems in theory that doesn&#39;t exist in practice because the compiler spits out warnings telling programmers to fix the problem. Warnings can also note cases where programmers probably made mistakes. We can&#39;t achieve perfect guarantees, because programmers can still make mistakes, but we can certainly achieve &quot;good enough&quot;.&lt;/p&gt;&lt;p&gt;Chisnall: &lt;i&gt;....&lt;b&gt;tread safety&lt;/b&gt;.....&lt;/i&gt; I&#39;m not sure I full understand the comment. I understand that CHERI can guarantee atomicity of bounds checking, which would require multiple (interruptible) instructions otherwise. The number of cases where this is a problem, and the C proposal would be no worse than other languages like Rust.&lt;/p&gt;&lt;p&gt;Chisnall: &lt;b&gt;&lt;i&gt;Temporal safety....&lt;/i&gt;&lt;/b&gt;&amp;nbsp;A lot of Rust &quot;ownership&quot; techniques can be applied to C with these annotations, namely, marking which variables OWN allocated memory and which simply BORROW it. I&#39;ve reviewed a lot of famous use-after-free and double-free bugs, and most can be trivially fixed by annotation.&lt;/p&gt;&lt;p&gt;Chisnall: &lt;i&gt;&lt;b&gt;If you are writing a blog never having actually tried to make large (million line or more) C codebases memory safe, you probably underestimate the difficulty by at least one order of magnitude.&lt;/b&gt;&amp;nbsp;&lt;/i&gt;I&#39;m both a programmer who has written a million lines of code in my lifetime as well as a hacker with decades of experience looking for such bugs. The goal isn&#39;t to pursue the ideal of 100% safe language, but of getting rid of 99% of safety errors. 1% less safe makes the goal an order of magnitude easier to reach.&lt;/p&gt;&lt;p&gt;snej:&amp;nbsp;&lt;b&gt;This post seems to epitomize the common engineer trait of seeing any problem you haven’t personally worked on as trivial. Sure bro, you’ll add a few patches to Clang and GCC and with those new attributes our C code will be safe. It’ll only take a few weeks and then no one will need Rust anymore.&lt;/b&gt;&amp;nbsp;But I&#39;ve spent decades working on this. The comment epitomizes the common trait of not realizing how much thought and expertise is behind the post. I few patches to clang and GCC will make make C &lt;i&gt;safer&lt;/i&gt;. The solution is far less safe than Rust. In fact, my proposal makes code more interoperable and translatable into Rust. Right now, translating C into Rust creates just a bunch of &#39;unsafe&#39; code that needs to be cleaned up. With such annotations, in a refactoring step using existing testing frameworks, results in code that can no be auto-translated safely in to Rust.&lt;/p&gt;&lt;p&gt;As for existing clang/gcc attributes, there are only a couple that match the macros I propose. They dod show how trivial it would be to actually go further.&lt;/p&gt;&lt;p&gt;danso:&amp;nbsp;&lt;b&gt;In addition to the criticisms I share with everyone else, I found this to be one of the most “talk is cheap, show me the code” posts I’ve ever read. &lt;/b&gt;The reason I wrote the post is because learning clang/gcc internals is a long process, and when asking for help, I needed something to point to &quot;this is what I&#39;m trying to achieve&quot;. I&#39;m not trying to communicate what other people should do, I&#39;m communicating what I&#39;m trying to do. I still don&#39;t know clang/gcc internals enough to even get started ... any pointers would be helpful.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/2857142063679853500/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=2857142063679853500' title='0 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/2857142063679853500'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/2857142063679853500'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2024/02/c-can-be-memory-safe-part-2.html' title='C can be memory safe, part 2'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><thr:total>0</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-2577999109857103644</id><published>2023-02-01T13:30:00.002-05:00</published><updated>2023-02-01T13:30:40.794-05:00</updated><title type='text'>C can be memory-safe</title><content type='html'>&lt;p&gt;The idea of &lt;i&gt;memory-safe languages&lt;/i&gt;&amp;nbsp;is in the news lately. C/C++ is famous for being the world&#39;s system language (that runs most things) but also infamous for being &lt;i&gt;unsafe&lt;/i&gt;. Many want to solve this by &lt;i&gt;hard-forking&lt;/i&gt;&amp;nbsp;the world&#39;s system code, either by changing C/C++ into something that&#39;s memory-safe, or rewriting everything in &lt;i&gt;Rust&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;Forking is a foolish idea. The core principle of computer-science is that we need to live with legacy, not abandon it.&lt;/p&gt;&lt;p&gt;And there&#39;s no need. Modern C compilers already have the ability to be memory-safe, we just need to make minor -- and compatible -- changes to turn it on. Instead of a hard-fork that abandons legacy system, this would be a soft-fork that enables memory-safety for new systems.&lt;/p&gt;&lt;p&gt;Consider the most recent memory-safety flaw in OpenSSL. They &lt;a href=&quot;https://git.openssl.org/gitweb/?p=openssl.git;a=commitdiff;h=c42165b5706e42f67ef8ef4c351a9a4c5d21639a&quot;&gt;fixed&lt;/a&gt; it by first adding a &lt;i&gt;memory-bounds&lt;/i&gt;, then putting every access to the memory behind a macro &lt;i&gt;PUSHC()&lt;/i&gt;&amp;nbsp;that checks the memory-bounds:&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1qmGnd5qPg0Q9OXfjx01TjnrTllr812DVCOixemH9yC_mp2G7QLcR0Bs6cOHrzQ7mQhjx4fGZ8xwKUblh1NwvQDQuHiVgjKc68aBLRpEV4ASK2UDRXRpUR1ioMumvRNcEkqZG-tJFCZaUJ_LIQbWkJTu5qK0cvDghcWOMOP9Jb_Va-1Z7bQ/s1280/Screen%20Shot%202023-02-01%20at%2012.59.51%20PM.png&quot; imageanchor=&quot;1&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;1090&quot; data-original-width=&quot;1280&quot; height=&quot;273&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1qmGnd5qPg0Q9OXfjx01TjnrTllr812DVCOixemH9yC_mp2G7QLcR0Bs6cOHrzQ7mQhjx4fGZ8xwKUblh1NwvQDQuHiVgjKc68aBLRpEV4ASK2UDRXRpUR1ioMumvRNcEkqZG-tJFCZaUJ_LIQbWkJTu5qK0cvDghcWOMOP9Jb_Va-1Z7bQ/s320/Screen%20Shot%202023-02-01%20at%2012.59.51%20PM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;A better (but currently hypothetical) fix would be something like the following:&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;span style=&quot;font-family: courier;&quot;&gt;size_t maxsize &lt;b&gt;CHK_SIZE(outptr)&lt;/b&gt; = out ? *outlen : 0;&lt;/span&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This would link the memory-bounds &lt;i&gt;maxsize&lt;/i&gt;&amp;nbsp;with the memory &lt;i&gt;outptr&lt;/i&gt;. The compiler can then be relied upon to do all the bounds checking to prevent buffer overflows, the rest of the code wouldn&#39;t need to be changed.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;div&gt;An even better (and hypothetical) fix would be to change the function declaration like the following:&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;span style=&quot;font-family: courier;&quot;&gt;int ossl_a2ulabel(const char *in, char *out, size_t *outlen&amp;nbsp;&lt;b&gt;CHK_INOUT_SIZE(out)&lt;/b&gt;);&lt;/span&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;/div&gt;&lt;div&gt;That&#39;s the intent anyway, that &lt;i&gt;*outlen&lt;/i&gt;&amp;nbsp;is the memory-bounds of &lt;i&gt;out&lt;/i&gt;&amp;nbsp;on input, and receives a shorter bounds on output.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This specific feature isn&#39;t in compilers. But &lt;i&gt;gcc&lt;/i&gt;&amp;nbsp;and &lt;i&gt;clang&lt;/i&gt;&amp;nbsp;already have other similar features. They&#39;ve only been halfway implemented. This feature would be relatively easy to add. I&#39;m currently studying the code to see how I can add it myself. I could just mostly copy what&#39;s done for the &lt;i&gt;alloc_size&lt;/i&gt;&amp;nbsp;attribute. But there&#39;s a considerable learning curve, I&#39;d rather just persuade an existing developer of &lt;i&gt;gcc&lt;/i&gt;&amp;nbsp;or &lt;i&gt;clang&lt;/i&gt;&amp;nbsp;to add the new attributes for me.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Once you give the programmer the ability to fix memory-safety problems like the solution above, you can then enable &lt;i&gt;warnings&lt;/i&gt;&amp;nbsp;for unsafe code. The compiler knew the above code was unsafe, but since there&#39;s no practical way to fix it, it&#39;s pointless nagging the programmer about it. With this new features comes warnings about failing to use it.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;In other words, it becomes compiler-guided &lt;i&gt;refactoring&lt;/i&gt;. Forking code is hard, refactoring is easy.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;As the above function shows, the OpenSSL code is already somewhat memory safe, just based upon the flawed principle of relying upon diligent programmers. We need the compiler to enforce it. With such features, the gap is relative small, mostly just changing function parameter lists and data structures to link a pointer with its memory-bounds. The refactoring effort would be small, rather than a major rewrite.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This would be a &lt;i&gt;soft-fork&lt;/i&gt;. The memory-bounds would work only when compiled with new compilers. The macro would be ignored on older systems.&amp;nbsp;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This &lt;i&gt;memory-safety&lt;/i&gt;&amp;nbsp;is a problem. The idea of abandoning C/C++ isn&#39;t a solution. We already have the beginnings of a solution in modern &lt;i&gt;gcc&lt;/i&gt;&amp;nbsp;and &lt;i&gt;clang&lt;/i&gt;&amp;nbsp;compilers. We just need to extend that solution.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/2577999109857103644/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=2577999109857103644' title='0 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/2577999109857103644'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/2577999109857103644'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2023/02/c-can-be-memory-safe.html' title='C can be memory-safe'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg1qmGnd5qPg0Q9OXfjx01TjnrTllr812DVCOixemH9yC_mp2G7QLcR0Bs6cOHrzQ7mQhjx4fGZ8xwKUblh1NwvQDQuHiVgjKc68aBLRpEV4ASK2UDRXRpUR1ioMumvRNcEkqZG-tJFCZaUJ_LIQbWkJTu5qK0cvDghcWOMOP9Jb_Va-1Z7bQ/s72-c/Screen%20Shot%202023-02-01%20at%2012.59.51%20PM.png" height="72" width="72"/><thr:total>0</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-5908535200586257651</id><published>2023-01-25T16:09:00.003-05:00</published><updated>2023-01-25T16:09:34.360-05:00</updated><title type='text'>I&#39;m still bitter about Slammer</title><content type='html'>&lt;p&gt;Today is the 20th anniversary of the Slammer worm. I&#39;m still angry over it, so I thought I&#39;d write up my anger. This post will be of interest to nobody, it&#39;s just me venting my bitterness and get off my lawn!!&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;Back in the day, I wrote &quot;BlackICE&quot;, an intrusion detection and prevention system that ran as both a &lt;b&gt;desktop&lt;/b&gt; version and a &lt;b&gt;network appliance&lt;/b&gt;. Most cybersec people from that time remember it as the desktop version, but the bulk of our sales came from the network appliance.&lt;/p&gt;&lt;p&gt;The network appliance competed against other IDSs at the time, such as Snort, an open-source product. For much the cybersec industry, IDS was Snort -- they had no knowledge of how intrusion-detection would work other than this product, because it was open-source.&lt;/p&gt;&lt;p&gt;My intrusion-detection technology was radically different. The thing that makes me angry is that I couldn&#39;t explain the differences to the community &lt;b&gt;because they weren&#39;t technical enough&lt;/b&gt;.&lt;/p&gt;&lt;p&gt;When Slammer hit, Snort and Snort-like products failed. Mine succeeded extremely well. Yet, I didn&#39;t get the credit for this.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;The &lt;b&gt;first&lt;/b&gt; difference is that I used a custom &lt;b&gt;poll-mode driver&lt;/b&gt;&amp;nbsp;instead of &lt;b&gt;interrupts&lt;/b&gt;. This the now the norm in the industry, such as with Linux &lt;a href=&quot;https://en.wikipedia.org/wiki/New_API&quot;&gt;NAPI&lt;/a&gt; drivers. The problem with interrupts is that a computer could handle less than 50,000 interrupts-per-second. If network traffic arrived faster than this, then the computer would hang, spending all it&#39;s time in the interrupt handler doing no other useful work. By turning off interrupts and instead polling for packets, this problem is prevented. The cost is that if the computer isn&#39;t heavily loaded by network traffic, then polling causes wasted CPU and electrical power. Linux NAPI drivers switch between them, interrupts when traffic is light and polling when traffic is heavy.&lt;/p&gt;&lt;p&gt;The consequence is that a typical machine of the time (dual Pentium IIIs) could handle 2-million packets-per-second running my software, far better than the 50,000 packets-per-second of the competitors.&lt;/p&gt;&lt;p&gt;When Slammer hit, it filled a 1-gbps Ethernet with 300,000 packets-per-second. As a consequence, pretty much all other IDS products fell over. Those that survived were attached to slower links -- 100-mbps was still common at the time.&lt;/p&gt;&lt;p&gt;An industry luminary even gave a presentation at BlackHat saying that my claimed performance (2-million packets-per-second) was impossible, because everyone knew that computers couldn&#39;t handle traffic that fast. I couldn&#39;t combat that, even by explaining with very small words &quot;but we disable interrupts&quot;.&lt;/p&gt;&lt;p&gt;Now this is the norm. All network drivers are written with polling in mind. Specialized drivers like PF_RING and DPDK do even better. Networks appliances are now written using these things. Now you&#39;d expect something like Snort to keep up and not get overloaded with interrupts. What makes me bitter is that back then, this was inexplicable magic.&lt;/p&gt;&lt;p&gt;I wrote an article in PoC||GTFO 0x15 that shows how my portscanner &lt;i&gt;masscan&lt;/i&gt;&amp;nbsp;uses this driver, if you want more info.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;The &lt;b&gt;second&lt;/b&gt;&amp;nbsp;difference with my product was how signatures were written. Everyone else used signatures that triggered on the &lt;b&gt;pattern-matching&lt;/b&gt;. Instead, my technology included &lt;b&gt;protocol-analysis&lt;/b&gt;, code that parsed more than 100 protocols.&lt;/p&gt;&lt;p&gt;The difference is that when there is an exploit of a buffer-overflow vulnerability, pattern-matching searched for patterns unique to the &lt;b&gt;exploit&lt;/b&gt;. In my case, we&#39;d measure the length of the buffer, triggering when it exceeded a certain length, finding any attempt to attack the &lt;b&gt;vulnerability&lt;/b&gt;.&lt;/p&gt;&lt;p&gt;The reason we could do this was through the use of &lt;b&gt;state-machine parsers&lt;/b&gt;. Such analysis was considered heavy-weight and slow, which is why others avoided it. State-machines are faster than pattern-matching, many times faster. Better &lt;i&gt;and&lt;/i&gt;&amp;nbsp;faster.&lt;/p&gt;&lt;p&gt;Such parsers are now more common. Modern web-servers (nginx, ISS, LightHTTPD, etc.) use them to parse HTTP requests. You can tell if a server does this by sending 1-gigabyte of spaces between &quot;GET&quot; and &quot;/&quot;. Apache gives up after 64k of input. State-machines keep going, because while in that state (&quot;between-method-and-uri&quot;), they&#39;ll accept any number of spaces -- the only limit is a timeout. Go read the &lt;i&gt;nginx&lt;/i&gt;&amp;nbsp;source-code to understand how this works.&lt;/p&gt;&lt;p&gt;I wrote a paper in PoC||GTFO 0x21 that shows the technique to implement the common &lt;i&gt;wc&lt;/i&gt;&amp;nbsp;(word-count) program. A simplified version of this &lt;a href=&quot;https://github.com/robertdavidgraham/wc2/blob/master/wc2o.c&quot;&gt;wc2o.c&lt;/a&gt;. Go read the code -- it&#39;s &lt;i&gt;crazy&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;The upshot is that when Slammer hit, most IDSs didn&#39;t have a signature for it. If they didn&#39;t just fall over, what they triggered on were things like &quot;UDP flood&quot;, not &quot;SQL buffer overflow&quot;. This lead many to believe what was happening was DDoS attack. My product correctly identified the vulnerability being exploited.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;The &lt;b&gt;third&lt;/b&gt;&amp;nbsp;difference with my product was the &lt;b&gt;event coalescer&lt;/b&gt;. Instead of a timestamp, my events had a start-time, end-time, and count of the number of times the event triggered.&lt;/p&gt;&lt;p&gt;Other event systems sometimes have this, with such events as &quot;last event repeated 39003 times&quot;, to prevent the system from clogging up with events.&lt;/p&gt;&lt;p&gt;My system was more complex. For one things, an attacker may deliberately intermix events, so it can&#39;t simply be 1 event that gets coalesced this way. For another thing, the attacker could sweep targets or spoof sources. Thus, coalescing needed to aggregate events over address &lt;b&gt;ranges&lt;/b&gt;&amp;nbsp;as well as &lt;b&gt;time&lt;/b&gt;.&lt;/p&gt;&lt;p&gt;Slammer easily filled a gigabit link with 300,000 packets-per-second. Every packet triggered the signature, thus creating 300,000 events-per-second. No system could handle that. To keep up with the load, events had to be reduced somehow.&lt;/p&gt;&lt;p&gt;My event coalescing logic worked. It reduced the load of events from 300,000 down to roughly 500 events-per-second. This was still a little bit higher load than the system could handle, forwarding to the remote management system. Customers reported that at their consoles, they saw the IDS slowly fall behind, spooling events at the sensor and struggling to ship them up to the management system.&lt;/p&gt;&lt;p&gt;The problem is so accurate that it&#39;s a big flaw in IDS still to this day. Snort often has signatures that throw away the excess data, but it&#39;s still easy to flood them with packets that overload their event logging.&lt;/p&gt;&lt;p&gt;What was exciting for me is that I&#39;d designed all this in theory, tested using artificial cases, unsure how it would stand up to the real world. Watching it stand up to the real world was exciting: big customers saw it successfully work in practice, with the only complaint that at the centralized console, it fell behind a little.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;The point is that I made three radical design choices, unprecedented at the time though more normal now, and they worked. And yet, the industry wasn&#39;t technical enough to recognize that it worked.&lt;/p&gt;&lt;p&gt;For example, a few months later I had a meeting at the Pentagon where a Gartner analyst gave a presentation claiming that only hardware-based IDS would work, because software-based IDS couldn&#39;t keep up. Well, these were my customer. I didn&#39;t refute Gartner so much as my customer did, with their techies standing up and pointing out that when Slammer hit, my &quot;software&quot; product did keep up. Gartner doesn&#39;t test products themselves. They rightly identified the problem with other software using interrupts, but couldn&#39;t conceive there was a third alternative, &quot;poll mode&quot; drivers.&lt;/p&gt;&lt;p&gt;I apologize to you, the reader, for subjecting you to this vain bitching, but I just want to get this off my chest.&lt;/p&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/5908535200586257651/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=5908535200586257651' title='0 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/5908535200586257651'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/5908535200586257651'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2023/01/im-still-bitter-about-slammer.html' title='I&#39;m still bitter about Slammer'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><thr:total>0</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-6123534176871645490</id><published>2022-10-23T16:05:00.008-04:00</published><updated>2022-10-27T14:23:12.831-04:00</updated><title type='text'>The RISC Deprogrammer</title><content type='html'>&lt;p&gt;I should write up a larger technical document on this, but in the meanwhile is this short (-ish) blogpost. &lt;b&gt;Everything you know about RISC is wrong&lt;/b&gt;. It&#39;s some weird nerd cult. Techies frequently mention RISC in conversation, with other techies nodding their head in agreement, but it&#39;s all &lt;i&gt;wrong&lt;/i&gt;. Somehow everyone has been mind controlled to believe in wrong concepts.&lt;/p&gt;&lt;p&gt;An example is &lt;a href=&quot;https://news.ycombinator.com/item?id=33295947&quot;&gt;this recent blogpost&lt;/a&gt; which starts out saying that &quot;RISC is a set of design principles&quot;. No, it wasn&#39;t. Let&#39;s start from this sort of viewpoint to discuss this odd cult.&lt;/p&gt;&lt;h4 style=&quot;text-align: left;&quot;&gt;What is RISC?&lt;/h4&gt;&lt;p&gt;Because of the march of Moore&#39;s Law, every year, more and more parts of a computer could be included onto a single chip. When chip densities reached the point where we could &lt;i&gt;almost&lt;/i&gt;&amp;nbsp;fit an entire computer on a chip, designers made tradeoffs, discarding unimportant stuff to make the fit happen. They made tradeoffs, deciding what needed to be included, what needed to change, and what needed to be discarded.&lt;/p&gt;&lt;p&gt;RISC is a set of creative tradeoffs, meaningful at the time (early 1980s), but which were meaningless by the late 1990s.&lt;/p&gt;&lt;p&gt;The interesting parts of CPU evolution are the three decades from &lt;b&gt;1964&lt;/b&gt;&amp;nbsp;with IBM&#39;s System/360 mainframe and &lt;b&gt;2007&lt;/b&gt;&amp;nbsp;with Apple&#39;s iPhone. The issue was a &lt;b&gt;32-bit&lt;/b&gt; core with &lt;b&gt;memory-protection&lt;/b&gt; allowing isolation among different programs with virtual memory. These were &lt;b&gt;real&lt;/b&gt;&amp;nbsp;computers, from the modern perspective: real computers have at least 32-bit and an MMU (memory management unit).&lt;/p&gt;&lt;p&gt;The year 1975 saw the release of Intel 8080 and MOS 6502, but these were 8-bit systems without memory protection. This was at the point of &lt;b&gt;Moore&#39;s Law&lt;/b&gt;&amp;nbsp;where we could get a useful CPU onto a single chip.&lt;/p&gt;&lt;p&gt;In the year 1977 we saw DEC release it&#39;s VAX minicomputer, having a 32-bit CPU w/ MMU. Real computing had moved from insanely expensive mainframes filling entire rooms to less expensive devices that merely filled a rack. But the VAX was way too big to fit onto a chip at this time.&lt;/p&gt;&lt;p&gt;The real interesting evolution of real computing happened in 1980 with Motorola&#39;s 68000 (aka. 68k) processor, essentially the first microprocessor that supported real computing.&lt;/p&gt;&lt;p&gt;But this comes with caveats. Making microprocessor required creative work to decide what wasn&#39;t included. In the case of the 68k, it had only a 16-bit ALU. This meant adding two 32-bit registers required passing them twice through the ALU, adding each half separately. Because of this, many call the 68k a 16-bit rather than 32-bit microprocessor.&lt;/p&gt;&lt;p&gt;More importantly, only the lower 24-bits of the registers were valid for memory addresses. Since it&#39;s memory addressing that makes a real computer &quot;real&quot;, this is the more important measure. But 24-bits allows for 16-megabytes of memory, which is all that anybody could afford to include in a computer anyway. It was more than enough to run a real operating system like Unix. In contrast, 16-bit processors could only address 64-kilobytes of memory, and weren&#39;t really practical for &lt;i&gt;real&lt;/i&gt; computing.&lt;/p&gt;&lt;p&gt;The 68k didn&#39;t come with a MMU, but it allowed an extra MMU chip. Thus, the early 1980s saw an explosion of &lt;i&gt;workstations&lt;/i&gt;&amp;nbsp;and &lt;i&gt;servers&lt;/i&gt;&amp;nbsp;consisting of a 68k and an MMU. The most famous was Sun Microsystems launched in 1982, with their own custom designed MMU chip.&lt;/p&gt;&lt;p&gt;Sun and its competitors transformed the industry running Unix. Many point to IBM&#39;s PC from 1982 as the transformative moment in computer history, but these were non-real 16-bit systems that struggled with more than 64k of memory. IBM PC computers wouldn&#39;t become &lt;i&gt;real&lt;/i&gt;&amp;nbsp;until 1993 with Microsoft&#39;s Windows NT, supporting full 32-bits, memory-protection, and pre-emptive multitasking.&lt;/p&gt;&lt;p&gt;But except for Windows itself, the rest of computing is dominated by the Unix heritage. The phone in your hand, whether Android or iPhone, is a Unix computer that inherits almost nothing from the IBM PC.&lt;/p&gt;&lt;p&gt;These 32-bit Unix systems from the early 1980s still lagged behind DEC&#39;s VAX in performance. The VAX was considered a mini-supercomputer. The Unix workstations were mere toys in comparison. Too many tradeoffs were made in order to fit everything onto a single chip, too many sacrifices made.&lt;/p&gt;&lt;p&gt;Some people asked &quot;&lt;b&gt;What if we make different tradeoffs?&lt;/b&gt;&quot;&lt;/p&gt;&lt;p&gt;Most people thought the VAX was the way of the future, and were all chasing that design. The 68k CPU was essentially a cut down VAX design. But history had anti-VAX designs that worked very differently, notably the CDC 6600 supercomputer from the 1960s and the IBM 801/ROMP processor from the 1970s.&lt;/p&gt;&lt;p&gt;It&#39;s not simply one tradeoff, but a bunch of inter-related tradeoffs. They snowball -- each choice you make changes the costs-vs-benefit analysis of other choices, changing them as well.&lt;/p&gt;&lt;p&gt;This is why people &lt;b&gt;can&#39;t agree upon a single definition of RISC&lt;/b&gt;. It&#39;s not one tradeoff made in isolation, but a long list of tradeoffs, each part of a larger scheme.&lt;/p&gt;&lt;p&gt;In 1987, Motorola shipped its 68030 version of the 68k processor, chasing the VAX ideal. By then, we had ARM, SPARC, and MIPS processors that significantly outperformed it. Given a budget of roughly 100,000 transistors allowed by Moore&#39;s Law of the time, the RISC tradeoffs were better than VAX-like tradeoffs.&lt;/p&gt;&lt;h4 style=&quot;text-align: left;&quot;&gt;So really, what is RISC?&lt;/h4&gt;&lt;p&gt;Let&#39;s define things in terms of 1986, comparing the [ARM, SPARC, MIPS] processors called &quot;RISC&quot; to the [68030, 80386] processors that weren&#39;t &quot;RISC&quot;. They all supported full 32-bit processing, memory-management, and preemptive multitasking operating systems like Unix.&lt;/p&gt;&lt;p&gt;The major ways RISC differed were:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;fixed-length instructions (32-bits or 4-bytes each)&lt;/li&gt;&lt;li&gt;simple instruction decoding&lt;/li&gt;&lt;li&gt;&lt;b&gt;horizontal vs. vertical microcode&lt;/b&gt;&lt;/li&gt;&lt;li&gt;deep pipelines of around 5 stages&lt;/li&gt;&lt;li&gt;load/store aka reg-reg&lt;/li&gt;&lt;li&gt;simple address modes&lt;/li&gt;&lt;li&gt;compilers optimized code&lt;/li&gt;&lt;li&gt;more registers&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;If you are looking for the &lt;i&gt;one&lt;/i&gt;&amp;nbsp;thing that defines RISC, it&#39;s the thing that nobody talks about: &lt;b&gt;horizontal microcode&lt;/b&gt;.&lt;/p&gt;&lt;p&gt;The VAX/68k/x86 architecture decoded &lt;i&gt;external&lt;/i&gt;&amp;nbsp;instructions into &lt;i&gt;internal&lt;/i&gt;&amp;nbsp;control ops that were pretty complicated, supporting such things as loops. Each &lt;i&gt;external&lt;/i&gt; instruction executed an &lt;i&gt;internal&lt;/i&gt;&amp;nbsp;&lt;b&gt;microprogram&lt;/b&gt;&amp;nbsp;with a variable number of such operations.&lt;/p&gt;&lt;p&gt;The classic RISC worked differently. Each &lt;i&gt;external&lt;/i&gt;&amp;nbsp;instruction decoded into exactly 4 &lt;i&gt;internal&lt;/i&gt;&amp;nbsp;ops. Moreover, each op had a fixed purpose:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ol style=&quot;text-align: left;&quot;&gt;&lt;li&gt;read from two registers into the ALU (arithmetic-logic unit)&lt;/li&gt;&lt;li&gt;execute a math operation in the ALU&lt;/li&gt;&lt;li&gt;access memory (well, the L1 cache)&lt;/li&gt;&lt;li&gt;write results back into one register&lt;/li&gt;&lt;/ol&gt;&lt;p style=&quot;text-align: left;&quot;&gt;(This explanation has been fudged and simplified, btw).&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;This internal detail was expressed externally in the instruction set, &lt;b&gt;simplifying decoding&lt;/b&gt;. The external instructions specified two registers to read, an ALU opcode, and one register to write. All of this was fit into a constant 32-bits. In contrast, the [68k/x86/VAX] model meant a complex decoding of instructions with a large ROM containing microprograms.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;Roughly half (50%) of the 68000&#39;s transistors contained this complex decoding logic and ROM. In contrast, for RISC processors, it was closer to 1%. All those transistors could be dedicated to other things. See how tradeoffs snowball? Saving so many transistors involved in instruction decoding meant being able to support other features elsewhere. It&#39;s not clear this is a benefit, however. This meant that RISC needed multiple instructions to do the same thing as a single [68k/x86/VAX] instruction.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;This meant instructions could be &lt;b&gt;deeply pipelined&lt;/b&gt;. Instructions could be overlapped. When reading registers for the &lt;i&gt;current&lt;/i&gt; instruction, we can simultaneously be fetching the &lt;i&gt;next&lt;/i&gt;, and performing the ALU calculation on the &lt;i&gt;previous&lt;/i&gt;&amp;nbsp;instruction. The classic RISC pipeline had 5 stages (the 4 mentioned above plus 1 for fetching the next instruction). Each clock cycle would execute part of 5 instructions simultaneous, each at a different stage in the pipeline.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;This was called &lt;i&gt;scalar&lt;/i&gt;&amp;nbsp;operation, In previous processor, it would take a variable number of clock cycles for an instruction to complete. In RISC, every instruction had 5 clock cycle &lt;b&gt;latency&lt;/b&gt; from beginning to end. And since execution was overlapped/pipelined, executing 5 instructions at a time, the &lt;b&gt;throughput&lt;/b&gt;&amp;nbsp;was one instruction per clock cycle.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;All CPUs are pipelined to some extent, but they need complex &lt;b&gt;interlocks&lt;/b&gt;&amp;nbsp;to prevent things from colliding with each other, such as two pipelined instructions trying to read registers at the same time. RISC removed most of those interlocks, by strictly regulation what an instruction could do in each stage of the pipeline. Removing these interlocks reduced transistor count and sped things up. This could be one possible definition of RISC that you never hear of: it got rid of all these interlocks found in other processors.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;Some pipeline conflicts were worse. Because pipelining, the results of an instruction won&#39;t be available until many clock cycles later. What if one instruction writes its results to register #5 (r5), and the very next instruction attempts to read from register #5 (r5)? It&#39;s too soon, it has to wait more clock cycles for the result.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;The answer: don&#39;t do that. Assembly language programmers need to know this complication, and are told to simply not write code that does this, because then the program won&#39;t work.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;This was anathema of the time. Throughout history to this point, each new CPU architecture also had a new operating-system written in assembly language, with many applications written in assembly language. Thus, a programmer-friendly assembly language was considered one of the biggest requirements for any new system. Requiring programmers to know such quirks lead to buggy code was simply unacceptable. &lt;i&gt;Everybody&lt;/i&gt; knew that programmer-hostile instruction-sets would never work in the market, even if they performed faster and cheaper.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;But technology is littered with what everybody knowing being wrong. In this case, by 1980 we had the&amp;nbsp; C programming language that was essentially a &quot;portable assembly language&quot; and the Unix operating system written in C. The only people who needed to know about a quirky assembly language were the compiler writers. They would take care of all such problems.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;That&#39;s why the history lesson above talks about Unix and &lt;i&gt;real&lt;/i&gt; computing. Without Unix and C, RISC wouldn&#39;t have happened. An operating-system written in a high-level language was a prerequisite for RISC. It&#39;s as import an innovation as Moore&#39;s Law allowing 100,000 transistors to fit on a chip.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;Because of the lack of complex decoding logic, the transistor budget was freed up to support such things as &lt;b&gt;more registers&lt;/b&gt;. The Intel x86 architecture famously had 8 registers, while the RISC competitors typically had as many as 32. The limitation was decode space. It takes 5 bits to specify one of 32 possibilities. Given that most every instructions specified two registers to read from and one register to write to, that&#39;s 15 bits, or half of the instruction space, leaving 17 bits for other purposes.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;The creators of the RISC, Hennessy and Patterson, wrote a textbook called a &quot;&lt;i&gt;Computer Architecture: A Quantitative Approach&lt;/i&gt;&quot;. It&#39;s horrible. It imagines a world where people need to be taught tradeoffs and transistor budgets. But there is no other approach than a quantitative one, it&#39;s like an economics textbook &quot;Economics: A Supply And Demand Approach&quot;. While the textbook has a weird obsession with quantitative theory, it misses non quantitative tradeoffs, like the fact that RISC couldn&#39;t happen without C and Unix.&amp;nbsp;&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;Among the snowballing tradeoffs is the &lt;b&gt;load/store&lt;/b&gt;&amp;nbsp;architecture, while at the same time, having fewer &lt;b&gt;addressing modes&lt;/b&gt;. It&#39;s here that we need to go back and discuss history -- what the heck is an &quot;&lt;i&gt;addressing mode&lt;/i&gt;&quot;????&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;In the beginning, computers had only a single general purpose register, called the &lt;b&gt;accumulator&lt;/b&gt;. All calculations, like adding two numbers together, involved reading the second value from &lt;b&gt;memory&lt;/b&gt; and combining with the first value already in the accumulator. All calculations, whether arithmetic (add, subtract) or logical (AND, OR, XOR) involved one value already in the register, and another value from memory.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;Addresses have to be &lt;b&gt;calculated&lt;/b&gt;. For example, when accessing elements in a table, we have to take the row number, multiply it by the size of the table, add an offset into the row for desired column, then add all that to the address at the start of the table. Then after calculating this address, we often want to increment the index to fetch the next row.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;If the &lt;i&gt;table&lt;/i&gt;&amp;nbsp;base address and &lt;i&gt;row&lt;/i&gt;&amp;nbsp;index are held in registers, we might get a complex instructions like the following. This calculates and address using two registers&lt;i&gt;&amp;nbsp;r10&lt;/i&gt;&amp;nbsp;and &lt;i&gt;r11&lt;/i&gt;, fetches that value from memory, then adds it into register &lt;i&gt;r9&lt;/i&gt;.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;&lt;i&gt;&amp;nbsp;ADD r9, [r10 + r11*8 + 4]&lt;/i&gt;&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;Such calculations embedded in the instruction-set were &lt;b&gt;necessary&lt;/b&gt;&amp;nbsp;for such early computers. While they had only a single &lt;i&gt;general purpose&lt;/i&gt;&amp;nbsp;register (the &lt;i&gt;accumulator&lt;/i&gt;), they still had multiple special purpose registers used this way for address calculations.&amp;nbsp;&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;For complex computers like the VAX, such &lt;i&gt;address modes&lt;/i&gt;&amp;nbsp;imbedded in instructions were no longer necessary, but still&amp;nbsp;&lt;b&gt;desirable&lt;/b&gt;. Half the work of the computer is in calculating memory addresses. It&#39;s very tedious for programmers to do it manually, easier when the instruction-set takes care of common memory access patterns (like accessing cells within a table).&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;This leads us to the &lt;b&gt;load/store&lt;/b&gt; issue.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;With many registers, we no longer need to read another value from memory (a &lt;i&gt;reg-mem&lt;/i&gt;&amp;nbsp;calculation). We can instead perform the calculation using two registers (&lt;i&gt;reg-reg&lt;/i&gt;). The VAX had such &lt;i&gt;reg-reg&lt;/i&gt;&amp;nbsp;instructions, but programmers still mostly used the &lt;i&gt;reg-mem&lt;/i&gt;&amp;nbsp;instructions with the complex address calculations.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;RISC changed this. Calculations were now exclusively &lt;i&gt;reg-reg,&lt;/i&gt;&amp;nbsp;where&amp;nbsp;math operations like &lt;i&gt;addition&lt;/i&gt;&amp;nbsp;could only operate on registers. To add something from memory, you needed first to &lt;i&gt;load&lt;/i&gt;&amp;nbsp;it from memory into a register, using a separate, explicit instruction. Likewise, writing back to memory required an explicit &lt;i&gt;store&lt;/i&gt;&amp;nbsp;operation.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;This architecture can be called either &lt;i&gt;&lt;b&gt;reg-reg&lt;/b&gt;&lt;/i&gt;&amp;nbsp;or &lt;i style=&quot;font-weight: bold;&quot;&gt;load/store&lt;/i&gt;, with the second name being more popular.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;With RISC, addressing modes were still desirable, but now they applied to only the two &lt;i&gt;load&lt;/i&gt; and &lt;i&gt;store&lt;/i&gt; instructions.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;The available addressing modes were constrained by the limited RISC pipeline and limited 32-bit fixed-length instructions. Since the pipeline allowed for the reading of two registers at the start, adding two registers together to form the address was allowed. The example shown above was too complex, though.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;What you are supposed to be reading from all of this is that &lt;b&gt;all of these tradeoffs are linked&lt;/b&gt;. Each decision that diverges from the ideal VAX-like architecture snowballed into other decisions that drifted further and further from this ideal, until what we had was something that looked nothing like a VAX.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;The upshot of these decisions was being able to reduce a 32-bit MMU CPU into roughly a single chip because it needed fewer transistors, while at the same time performing much faster. It required maybe twice as many instructions to perform the same tasks (mostly due to needing more complex address calculations due to lack of addressing modes), but performed them at maybe 5 times faster, for a significant speed up.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;At the time, the VAX was the standard benchmark target. When Sun shipped it&#39;s first SPARC RISC systems (the Sun-4), they benchmarked about twice as fast as the latest VAX systems, while being considerably cheaper.&lt;/p&gt;&lt;h4 style=&quot;clear: both; text-align: left;&quot;&gt;The end of RISC&lt;/h4&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;By the late 1980s, everybody knew that RISC was the future. Sure, Intel continued with its x86 and Motorola with it&#39;s 68000, but that&#39;s because the market wanted backwards compatibility with legacy instruction-sets. Both attempted to build their own RISC alternatives, but failed. When backwards compatibility wasn&#39;t required, everybody created RISC processors, because for 32-bit MMU real computing, they were&amp;nbsp; better. And everybody knew it.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;But of course, everybody was eventually wrong. Even as early as the 80486 in 1989, Intel was converting the innards of the processor into something that looked more RISC-like.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;The nail in the coffin came in 1995 with Intel&#39;s &lt;i&gt;Pentium Pro&lt;/i&gt;&amp;nbsp;processor that supported &lt;i&gt;out-of-order&lt;/i&gt;&amp;nbsp;(or &lt;i&gt;OoO&lt;/i&gt;) processing. Again, it wasn&#39;t really a new innovation. Out-of-order instructions first appeared on 1960s era supercomputers from CDC and IBM. This was the first time that transistor budgets allowed it to be practically used on single-chip microprocessors.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;Transistor budgets were so high that designers no longer had to make basic painful tradeoffs. The decisions necessary trying to cram everything into 100,000 transistors were longer meaningful when you had more than 1-million transistors to work with. Instruction-set decoding requiring 20k transistors is important with small budgets, but meaningless with large budgets.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;With OoO, the microarchitecture inside the chip looks roughly the same, regardless if it&#39;s an Intel x86, ARM, SPARC, or whatever.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;This was proven in benchmarks. When Intel released its out-of-order&amp;nbsp;&lt;i&gt;Pentium Pro&lt;/i&gt;&amp;nbsp;in 1995, it beat all the competing in-order RISC processors on the market.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;Everybody was wrong -- RISC wasn&#39;t the future, the future was OoO.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;One way of describing the &lt;i&gt;Pentium Pro&lt;/i&gt;&amp;nbsp;is that it &quot;&lt;i&gt;translates x86 into RISC-like micro-ops&lt;/i&gt;&quot;. What that really means is that instead of vertical microcode, it translated things into horizontal, pipelined micro-ops. Most of the typical math operations were split into two micro-ops, one a &lt;i&gt;load/store&lt;/i&gt; operation, and the other a &lt;i&gt;reg-reg&lt;/i&gt; operation. (Some x86 instructions need even more micro-ops: address calculation, then load/store, then ALU op).&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;Intel still has an &quot;x86 tax&quot; decoding complex instructions. But in terms of pipeline stages, that tax only applies to the first stage. Typical OoO processors have at least 10 more stages after that. Even RISC instruction-set processors like ARM must translate external instructions into internal micro-ops.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;The only significant difference left is the fact that Intel&#39;s instructions are &lt;b&gt;variable length&lt;/b&gt;. The &lt;b&gt;fixed length&lt;/b&gt;&amp;nbsp;instructions of RISC means that multiple can be fetched at once, and decoded all in parallel. This is impossible with Intel x86, they must at least partially be decoded serially, one before the next. You don&#39;t know where the next instruction starts until you&#39;ve figured out the length of the current instruction.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;Intel and AMD find crafty ways to get around this. For example, AMD has often put hints in its instruction cache (L1I) to so that decoders can know the length of instructions. Intel has played around with &quot;loop caches&quot; (so-called because they are most useful for loops) that track instructions after they&#39;ve been decoded, so they don&#39;t need to be decoded again.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;The upshot is that for most code, there&#39;s no inherent difference between x86 and RISC, they have essentially the same internal architecture for out-of-order (OoO) processors. No instruction-set has an inherent advantage over the other.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;And it&#39;s been that way since 1995.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;I mention this because bizarrely this cult has persisted for the last 30 years after OoO replaced RISC for high-end real computers. It ceased being a useful technical distinction, so what are techies still discussing it?&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;They persist in believing dumb things, for which no amount of deprogramming is possible. For example, they look at mobile (battery powered) devices and note that they use ARM chips to conserve power. They make the assumption that there must be some sort of inherent power-efficiency advantage.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;This isn&#39;t true. These chips consume less power by simply being slower. Fewer transistors mean less power consumption. This meant while desktops/servers used power-hungry OoO processors, mobile phones went back to the transistor budgets of yesteryear, meaning back to in-order RISC.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;But as Moore&#39;s Law turned, transistors got smaller, to the point where even mobile phones got OoO chips. They use clever tricks to keep that OoO chip powered down most of the time, often including an in-order chip that runs slower on less power for minor tasks.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;We&#39;ve reached the point where mobile and laptops now use the same chips, your MacBook uses (essentially) the same chip as your iPhone, which is the same chip as Apple desktops.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;Now Apple&#39;s M1 ARM (and hence RISC) processor is much better at power consumption than it&#39;s older Intel x86 chip, but &lt;b&gt;this isn&#39;t because it&#39;s RISC&lt;/b&gt;. Apple did a good job at analyzing what people do on mobile devices like laptops and phones and optimized for that. For example, they added a lot of great JavaScript features, cognizant of the ton of online and semi-offline apps that are written in JavaScript. In contrast, Intel attempts to optimize a chip simultaneously for laptops, desktops, and servers, leading poorly optimizations for laptops.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;Apple also does crazy things like putting a high end GPU (graphics processor) on the same chip. This has the effect of making their M1 ARM CPU crazy good for desktops for certain applications, those requiring the sorts of memory-bandwidth normally needed by GPUs.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;But overall, x86 chips from AMD and Intel are still faster on desktops and servers.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;In addition to the fixed-length instructions providing a tiny benefit, ARM has another key advantage, but it has nothing to do with RISC. When they upgraded their instruction-set to support 64-bit instead of just 32-bit, they went back and redesigned it from scratch. This allowed them to optimize the new instruction-set for the OoO pipeline, such as removing some dependencies that slow things down.&lt;/p&gt;&lt;p style=&quot;clear: both; text-align: left;&quot;&gt;This was something that Intel couldn&#39;t do. When it came time to support 64-bit, AMD simply extended the existing 32-bit instructions. A long sequence of code often looks identical between the 32-bit and 64-bit versions of the x86 instruction-sets, whereas they look completely different on ARM 32-bit vs. 64-bit.&lt;/p&gt;&lt;h3 style=&quot;clear: both; text-align: left;&quot;&gt;What about RISC-V and ARM-on-servers?&lt;/h3&gt;&lt;p style=&quot;text-align: left;&quot;&gt;We&#39;ve reached the point in tech where the &lt;b&gt;instruction-set doesn&#39;t matter&lt;/b&gt;. It&#39;s not simply that code is written in high-level language. It&#39;s mostly that &lt;b&gt;micro-architectural details have converged&lt;/b&gt;.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;Take &lt;b&gt;byte-order&lt;/b&gt;, for example. Back in the 1980s, most of the major CPUs in the world were &lt;b&gt;big-endian&lt;/b&gt;, while Intel bucked the trend being &lt;b&gt;little-endian&lt;/b&gt;. The reason is that some engineer made a simple optimization back when the&amp;nbsp;8008 processor was designed for terminals, and because of backwards compatibility, the poor decision continues to plague x86 today.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;Except when it annoys programmers debugging memory dumps, byte-order doesn&#39;t matter. Therefore, all the RISC processors allowed a simple bit to be set to switch processors from big-endian to little-endian mode.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;Over time, that has caused everyone to match Intel&#39;s little-endianess, driven primarily by Linux. The kernel itself supports either mode, but a lot of drivers depend upon byte-order, and user-mode programs developed on x86 sometimes have byte-order bugs. As it was ported to architectures like ARM or PowerPC, most of the time it was done in little-endian mode. (You can get PowerPC Linux in big-endian, but the preference is little-endian, &lt;a href=&quot;https://lwn.net/Articles/408845/&quot;&gt;because drivers&lt;/a&gt;).&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;The same effect happens even in things that aren&#39;t strictly CPU related, like memory and I/O. The tech stack has converged so that processors look more and more alike except for the instruction-set.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;The convergence of architecture is demonstrated most powerfully by Apple&#39;s M1 transition, where they stopped using Intel&#39;s processors in their computers in favor of their custom ARM processor they created for the iPhone.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;The MacBook Air M1 looks &lt;i&gt;identical&lt;/i&gt;&amp;nbsp;on the outside compared to the immediately preceding x86 MacBook. But more the the point, it performs almost identically &lt;i&gt;running x86 code&lt;/i&gt;&amp;nbsp;-- it runs x86 code at native x86 speeds but on an ARM CPU. The processors are so similar architecturally that instruction-sets could be converted on the fly -- it simply reads the x86 program, converts to ARM transparently on the fly, then runs the ARM version. Previous code translation attempts have incurred massive slowdowns to account for architectural differences, but the M1 cheated by removing any differences that weren&#39;t instruction-set related, allowing smooth translation of the instructions.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;&lt;b&gt;Technically&lt;/b&gt;, instruction-sets don&#39;t matter, but for &lt;b&gt;business&lt;/b&gt; reasons, they still do. Intel and AMD control x86, and prevent others from building compatible processors. ARM lets others build compatible processors (indeed, making no CPUs themselves), but charges them a license fee.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;Especially for processors on the low-end, people don&#39;t want to pay license fees.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;For that reason, RISC V has become popular. For low-end processors (in-order microcontrollers competing against ARM Cortex Ms) in the 100,000 transistor range, it matters that an instruction-set be RISC. The only free alternative is the aging MIPS. It has annoying quirks, like &quot;delay slots&quot;, which are fixed by RISC V. Since RISC V is an open standard, free of license fees, those designing their own low end processor have adopted it.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;For example, &lt;a href=&quot;https://riscv.org/wp-content/uploads/2016/07/Tue1100_Nvidia_RISCV_Story_V2.pdf&quot;&gt;nVidia&lt;/a&gt; uses RISC V extensively throughout its technology. GPUs contain tiny embedded CPUs to manage things internally. They have ARM licenses, but they don&#39;t want to pay the pennies it would cost for every unit that ARM charges. Likewise, Western Digital (a big hard-drive maker) designed a RISC V core for its drives.&amp;nbsp;&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;There are a lot of RISC V fans due to the RISC cult who insist it should go everywhere, but it&#39;s not going anywhere for high-end processors. At the high-end, you are going to pay licensing fees for &lt;i&gt;designs&lt;/i&gt; anyway. In other words, while big companies have the resources to design small in-order processors, they don&#39;t have the resources to design big OoO processors, and would therefore buy designs from others.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;Amazon&#39;s AWS Graviton is a good example (ARM-based servers). They aren&#39;t licensing the instruction-set from ARM so much as the complete OoO CPU design. They include the ARM cores on a chip of Amazon&#39;s design, having memory, I/O, security features tailored to AWS use cases. Neither the instruction-set architecture or micro-architecture particularly matter to Amazon compared to all the other features of their chips.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;Lots of big companies are getting into the custom CPU game, licensing ARM cores. Big tech companies tend to have their own programming language, their own operating systems, their own computer designs, and nowadays their own CPUs. This includes Microsoft, Google, Apple, Facebook, and so on. The advantage of ARM processors (or in the future, possibly RISC V processors) isn&#39;t their RISC nature, or their instruction-sets, but the fact they are big processor designs that others can included with their own chips. There is no inherent power efficiency or speed benefit -- only the business benefit.&lt;/p&gt;&lt;h3 style=&quot;clear: both; text-align: left;&quot;&gt;Conclusion&lt;/h3&gt;&lt;p style=&quot;text-align: left;&quot;&gt;This blogpost is in reaction to that blogpost I link above. That writer just recycles old RISC rhetoric of the past 30 years, like claiming it&#39;s a &quot;design philosophy&quot;. It, it was a set of tradeoffs meaningful to small in-order chips -- the best way of designing a chip with 100,000 transistors.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;The term &quot;RISC&quot; has been obsolete for 30 years, and yet this nonsense continues. One reason is the Penisy textbook that indoctrinates the latest college students. Another reason is the political angle, people hating whoever is dominant (in this case, Intel on the desktop). People &lt;i&gt;believe&lt;/i&gt;&amp;nbsp;in RISC, people &lt;i&gt;evangelize&lt;/i&gt;&amp;nbsp;RISC. But it&#39;s just a cult, it&#39;s all junk. Any conversation that mentions RISC can be improved by removing the word &quot;RISC&quot;.&lt;/p&gt;&lt;p style=&quot;text-align: left;&quot;&gt;OoO has replaced RISC as the dominant architecture for CPUs, and it did so in 1995, and ever since then, the terminology &quot;RISC&quot; is obsolete. The only thing you care about when looking at chips is whether it&#39;s an &lt;b&gt;in-order&lt;/b&gt; design or an &lt;b&gt;out-of-order&lt;/b&gt; design. Well, that&#39;s if you care about theory. If you care about practice, you care about whether it supports your legacy tooling and code. In the real world, whether you use x86 or ARM or MIPS or PowerPC is simply because of legacy market conditions. We still launch rockets to Mars using PowerPC processors because that&#39;s what the market for radiation-hardened CPUs has always used.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/6123534176871645490/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=6123534176871645490' title='0 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/6123534176871645490'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/6123534176871645490'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2022/10/the-risc-deprogrammer.html' title='The RISC Deprogrammer'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><thr:total>0</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-6145801374507785535</id><published>2022-07-03T19:02:00.003-04:00</published><updated>2023-12-05T15:53:27.153-05:00</updated><title type='text'>DS620slim tiny home server</title><content type='html'>&lt;div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnkD8CEmE4nfqwbYIso9-11DW14e7MBd4qen-74Nb8jaDVOUAm8U3pV52fRLsz33ggypH5gc1AqFDnn7OAofFflDonndyXnkkJ5XZhNPDIFqKhNPOaTGPCfYZkkqO04dpAhbRb/&quot; style=&quot;clear: right; float: right; margin-bottom: 1em; margin-left: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;400&quot; data-original-width=&quot;668&quot; height=&quot;192&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnkD8CEmE4nfqwbYIso9-11DW14e7MBd4qen-74Nb8jaDVOUAm8U3pV52fRLsz33ggypH5gc1AqFDnn7OAofFflDonndyXnkkJ5XZhNPDIFqKhNPOaTGPCfYZkkqO04dpAhbRb/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;In this blogpost, I describe the Synology &lt;a href=&quot;https://www.synology.com/en-us/products/DS620slim&quot;&gt;DS620slim&lt;/a&gt;. Mostly these are notes for myself, so when I need to replace something in the future, I can remember how I built the system. It&#39;s a &quot;NAS&quot; (network attached storage) server that has six hot-swappable bays for 2.5 inch laptop drives.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;That&#39;s right, &lt;b&gt;laptop 2.5 inch drives&lt;/b&gt;. It makes this a tiny server that you can hold in your hand.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The purpose of a NAS is &lt;b&gt;reliable&lt;/b&gt;&amp;nbsp;storage. All disk drives eventually fail. If you stick a USB external drive on your desktop for backups, it&#39;ll eventually crash, losing any data on it. A failure is unlikely tomorrow, but a spinning disk will almost certainly fail some time in the next 10 years. If you want to keep things, like photos, for the rest of your life, you need to do something different.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The solution is RAID, an array of&amp;nbsp;&lt;b&gt;redundant disks&lt;/b&gt;&amp;nbsp;such that when one fails (or even two), you don&#39;t lose any data. You simply buy a new disk to replace the failed one and keep going. With occasional replacements (as failures happen) it can last decades. My &lt;a href=&quot;https://blog.erratasec.com/2017/09/5-years-with-home-nasraid.html&quot;&gt;older NAS is 10 years old&lt;/a&gt; and I&#39;ve replaced all the disks, one slot replaced twice.&lt;/div&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This can be &lt;b&gt;expensive.&lt;/b&gt;&amp;nbsp;A NAS requires a separate box in addition to lots of drives. In my case, I&#39;m spending $1500 for a 18-terabytes of disk space that would cost only $400 as an external USB drive. But amortized for the expected 10+ year lifespan, I&#39;m paying $15/month for this home system.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This unit is not just disk drives but also a &lt;b&gt;server&lt;/b&gt;. Spending $500 just for a box to hold the drives is a bit expensive, but the advantage is that it&#39;s also a server that&#39;s powered on all the time. I can setup tasks to run on regular basis that would break if I tried to regularly run them on a laptop or desktop computer.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;There are lots of &lt;b&gt;do-it-yourself&lt;/b&gt; solutions (like the Radaxa Taco carrier board for a Raspberry Pi 4 CM running Linux), but I&#39;m choosing this solution because I want something that just works without any hassle, that&#39;s configured for exactly what I need. For example, eventually a disk will fail and I&#39;ll have to replace it, and I know now that this is something that will be effortless when it happens in the future, without having to relearn some arcane Linux commands that I&#39;ve forgotten years ago.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Despite this, I&#39;m a geek who obsesses about things, so I&#39;m still going to do possibly unnecessary things, like upgrading hardware: memory, network, and fan for an optimized system. Here are all the components of my system:&lt;/div&gt;&lt;div&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;$500 - &lt;a href=&quot;https://www.newegg.com/synology-ds620slim/p/N82E16822108621?Item=9SIA2F89SD8662&quot;&gt;DS620slim &lt;/a&gt;unit&lt;/li&gt;&lt;li&gt;$1000 - 6x Seagate Barracuda 5TB 2.5 inch laptop drive (&lt;a href=&quot;https://www.amazon.com/dp/B01M0AADIX&quot;&gt;ST5000LM000&lt;/a&gt;)&lt;/li&gt;&lt;li&gt;$100 - 2x Crucial 8GB DDR3 SODIMMs (&lt;a href=&quot;https://www.amazon.com/dp/B00JCRZ6XS&quot;&gt;CT2K102464BF186D&lt;/a&gt;) or 2x &lt;a href=&quot;https://www.amazon.com/dp/B0CJMWN8JG&quot;&gt;OWC&lt;/a&gt;&amp;nbsp;(update: in building a new system in 2023-December, the Crucial memory didn&#39;t work, but the OWC memory did).&lt;/li&gt;&lt;li&gt;$30 - 2.5gbps Ethernet USB (&lt;a href=&quot;https://amazon.com/dp/B07VNFLTLD&quot;&gt;CableCreation B07VNFLTLD&lt;/a&gt;)&lt;/li&gt;&lt;li&gt;$15 - &lt;a href=&quot;https://amazon.com/dp/B00NEMGCRQ&quot;&gt;Noctua NF-A8 ULN&lt;/a&gt; ultra silent fan&lt;/li&gt;&lt;li&gt;$360 - WD Elements 18TB USB drive (&lt;a href=&quot;https://www.amazon.com/dp/B08KTRBHP1&quot;&gt;WDBWLG0180HBK-NESN&lt;/a&gt;)&lt;/li&gt;&lt;/ul&gt;&lt;/div&gt;&lt;div&gt;You can save a bunch of money by going down to 4TB drives (and a 14TB backup USB drive), but I chose the larger 5TB drives.&lt;/div&gt;&lt;h2 style=&quot;text-align: left;&quot;&gt;Disk Drives&lt;/h2&gt;&lt;div&gt;The most important reason for choosing this product is the smaller &lt;b&gt;2.5-inch disk drives &lt;/b&gt;(sized for laptops). Otherwise, you should buy one of the larger (&lt;i&gt;much larger&lt;/i&gt;) system that&#39;ll holder standard sized drives.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The drives will be largest cost. A 5TB spinning disk costs ~$150, or an 8TB SSD flash costs ~$700. Buying 6 of them is your largest investment. You don&#39;t have to fill up the system, or buy the largest drives, but if you put in the time and effort, you might as well go all the way. On a cost-per-gigabyte, the larger drives seem to be best price.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;As you know, there are only three manufacturers remaining for spinning rust drives: Seagate, Western Digital (WD), and Toshiba. Also as you know, laptops have moved away from rotating disks, adopting SSDs instead. Thus, the 2.5 inch form factor for spinning disks is likely dead. For right now, they are a lot cheaper than SSDs, a fifth of the price. In the future, when a drive dies on the array, I&#39;ll likely have to replace it with an SSD, because a replacement spinning disk is no longer available. The SATA SSD itself is eventually going to disappear (to be replaced by NVMe SSDs), but they should still be around a decade from now when I need replacement drives. (I plan on the NAS lasting a decade before I have to upgrade and move the data).&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The &lt;b&gt;internal&lt;/b&gt; 5TB drives are a bit expensive. One strategy would be to instead buy &lt;b&gt;external &lt;/b&gt;USB drives and &quot;shuck&quot; them, removing the USB enclosure to get at the drives themselves. It&#39;s a common strategy when under certain market conditions, external drives are cheaper than internal drives. I tried buying a &lt;a href=&quot;https://www.amazon.com/dp/B07X41PWTY&quot;&gt;$100 5TB Western Digital external drive&lt;/a&gt;. It didn&#39;t work -- it wasn&#39;t a SATA drive in a USB enclosure, but was natively USB on the circuit board. I&#39;m using it as a Raspberry Pi 4 drive instead for storing blockchain info.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Inserting the drive into the 620slim is easy: just pop out the carrier, add the drive, and pop it back in. The carrier comes with little posts on one side that fit the screw holes, meaning you only need to screw in the other side with 2 screws -- or you can forgo the screws altogether.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The carriers have locks, to prevent people from accidentally pulling out a drive, but I don&#39;t use them. In 5 years when a drive fails and I need to replace it, I don&#39;t want to go hunting for these keys. The entire strategy I&#39;m using here is that when failure happens, I&#39;ll fix it right away rather than finding reasons to procrastinate. I&#39;ve had to replace 3 failed drives in my previous NAS, and this worked well.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;h2 style=&quot;text-align: left;&quot;&gt;Memory&lt;/h2&gt;&lt;div&gt;The DS620slim comes with 2-gigabytes of memory, in a single SO-DIMM slot. There&#39;s a second empty SO-DIMM slot. (SO-DIMMs are the smaller form factor for memory that&#39;s intended for notebook computers and tiny servers).&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Synology will &lt;b&gt;officially &lt;/b&gt;sell you a 4-gig SO-DIMM to put in the empty slot, bringing total memory to 6-gigs.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;Unofficially&lt;/b&gt;, you can get two of these, using the second to replace the existing 2-gigs, brining it to 8-gigs total.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Even &lt;b&gt;more unofficially&lt;/b&gt;, you can go to 16gigs. According to Intel&#39;s official spec sheet for the &lt;a href=&quot;https://ark.intel.com/content/www/us/en/ark/products/95597/intel-celeron-processor-j3355-2m-cache-up-to-2-50-ghz.html&quot;&gt;J3355 CPU&lt;/a&gt;, it only supports 8-gigs. Such numbers are usually conservative, reflecting the memory available at the time. When larger capacities appear later, they usually work. Such is the case here, where I put in 16-gigs total using &lt;a href=&quot;https://www.amazon.com/dp/B00JCRZ6XS&quot;&gt;Crucial SO-DIMMs&lt;/a&gt;&amp;nbsp;(two 8-gig DIMMs).&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;I recommend expanding memory here, if only an extra 2gig DIMM to fill that free space. It&#39;s a quick and easy replacement, just unscrew the bottom plate and insert the memory.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;h2 style=&quot;text-align: left;&quot;&gt;Ethernet&lt;/h2&gt;&lt;div&gt;The unit only comes with gigabit Ethernet. This can be a bottleneck, so we want to speed that up.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;It comes with two Ethernet ports, which support &lt;b&gt;aggregation&lt;/b&gt;, but I couldn&#39;t get a speed increase. It seems they&#39;ll speed things up if there are at least two devices talking to the NAS, but won&#39;t speed up when there&#39;s only one client. But then, if you have two clients, then things will slow down anyway, because accesses are no longer sequential.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The solution is to use a faster Ethernet adapter, like 2.5gig, 5gig, or 10gig. There&#39;s no PCIe slot in the device, but it does have USB 3. I can therefore use a 2.5gbps or 5gbps dongle.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;I benchmarked the three options, and found the following performance, in mbps (mega-bits per second). This was measured with large sequential transfers, small or random transfers are roughly the same speed, around 350mbps, for all three adapters.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjV74s7B8eQjQkXS7UFOIYLoPvZEMISsMW1tgFxbTlv6iEZAuOykrexo4GJbuiaQoQajqFqxLREDd6Yqv6mmAbgd6LfNqprLlue33iw8dK_lV8hxgdI-6x0ob6HwmdGgD3gYiik/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;127&quot; data-original-width=&quot;305&quot; height=&quot;133&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjV74s7B8eQjQkXS7UFOIYLoPvZEMISsMW1tgFxbTlv6iEZAuOykrexo4GJbuiaQoQajqFqxLREDd6Yqv6mmAbgd6LfNqprLlue33iw8dK_lV8hxgdI-6x0ob6HwmdGgD3gYiik/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;br /&gt;There&#39;s a big jump in performance using the 2.5gbps adapter, but only a marginal increase using the 5gbps adapter.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Synology doesn&#39;t support the adapters directly. To install them, I used the following steps with the following project:&lt;/div&gt;&lt;div&gt;&lt;ol style=&quot;text-align: left;&quot;&gt;&lt;li&gt;Enable SSH, using (Control Panel -&amp;gt; Terminal). If you are a geek, you&#39;ve already done this.&lt;/li&gt;&lt;li&gt;Go to&amp;nbsp;&lt;a href=&quot;https://github.com/bb-qq/r8152&quot;&gt;this GitHub project&lt;/a&gt;&amp;nbsp;and download the&amp;nbsp;the&amp;nbsp;&lt;span style=&quot;font-family: courier;&quot;&gt;&lt;a href=&quot;https://github.com/bb-qq/r8152/releases/download/2.15.0-5/r8152-apollolake-2.15.0-5.spk&quot;&gt;r8152-apollolake-2.15.0-5.spk&lt;/a&gt;&lt;/span&gt;&amp;nbsp;file (from the Releases section) to your local computer. Your DS620slim has an Apollo Lake CPU, so that&#39;s the package we are using.&lt;/li&gt;&lt;li&gt;Use the &quot;Package Center&quot; to do a &quot;Manual&quot; install, and upload this SPK file. If you get an error saying you don&#39;t have permissions, log out and back in. Otherwise, you&#39;ll first get a warning saying the driver isn&#39;t supported by Synology, and eventually you&#39;ll get the error &quot;Failed to install package&quot;. This is supposed to happen.&lt;/li&gt;&lt;li&gt;From the SSH command-line, run the command:&lt;/li&gt;&lt;li&gt;&lt;span style=&quot;font-family: courier;&quot;&gt;sudo install -m 4755 -o root -D /var/packages/r8152/target/r8152/spk_su /opt/sbin/spk_su&lt;/span&gt;&lt;/li&gt;&lt;li&gt;Now repeat the step using &quot;Packet Center&quot; to do a &quot;Manual&quot; install. If you didn&#39;t close the window that you had open, you can just click on the &quot;Done&quot; button a second time and it&#39;ll work.&lt;/li&gt;&lt;li&gt;Now reboot, and plug in the USB adapter.&lt;/li&gt;&lt;/ol&gt;&lt;/div&gt;&lt;div&gt;For 5-gbps, you can use go through the same process to install &lt;a href=&quot;https://github.com/bb-qq/aqc111&quot;&gt;Aquantia aqc111 drivers&lt;/a&gt;. I did this to get a &lt;a href=&quot;https://amazon.com/dp/B08977K9D2&quot;&gt;Sabrent NT-SS5G&lt;/a&gt; adapter to work.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;In practice, when transferring large files, you still aren&#39;t going to be able to exceed 2.5gbps much, so I just use the slower adapter. It&#39;s cheaper and uses a lot less electrical power (a 2.5gbps Ethernet adapter is noticeably cooler than a 5gbps, which is in turn noticeably cooler than 10gbps).&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;h2 style=&quot;text-align: left;&quot;&gt;Fan&lt;/h2&gt;&lt;div&gt;The unit comes with a small fan that by default will run in &quot;quiet&quot; mode, but under load, the noise becomes noticeable. A cheap $15 gets a fan that runs a lot quieter, like a &lt;a href=&quot;https://amazon.com/dp/B00NEMGCRQ&quot;&gt;Noctua&lt;/a&gt; fan famous for this. Replacing the fan doesn&#39;t require any tools, as it&#39;s held in by rubber thingies.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This allows me to run the fan at a higher speed, with less noise, which keeps everything even cooler. Since I plan on a 10 year lifespan with rotating disks, I figure lower temperatures will be better for longevity.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;h2 style=&quot;text-align: left;&quot;&gt;USB drive backups&lt;/h2&gt;&lt;div&gt;RAID6 gives pretty good safety, allowing two drives to fail with no data loss. The term &quot;RAID5&quot; means one redundant disk, the term &quot;RAID6&quot; means two redundant disks.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;But you should still do backups. The NAS itself can fail. Or, ransomware can delete all the files. There&#39;s lots of possible failures.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;One of the neat things with Synology is that it&#39;s easy to schedule regular backups to an external USB drive.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;In my case, I&#39;m using an 18 terabyte USB drive costing $400 for backups. I just schedule it and forget it, backups always happen, and ransomware on Windows machines can delete everything on the NAS but can&#39;t touch the backup.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;h2 style=&quot;text-align: left;&quot;&gt;UPS (Uninterruptable Power Supply)&lt;/h2&gt;&lt;div&gt;For a small NAS, I bought a &lt;a href=&quot;https://amazon.com/dp/B013JHYQNC&quot;&gt;small UPS&lt;/a&gt;. This is some weird APC unit that I got on close-out for $100. It&#39;s such a weird little product that I don&#39;t think it was very popular.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;It&#39;s a lithium ion UPS. The price for lithium batters, especially&amp;nbsp;LiFePO4, is approaching the point where they are price competitive with traditional lead acid batteries. This is especially true considering that they last longer in UPS applications than lead acid.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;h2 style=&quot;text-align: left;&quot;&gt;File system&lt;/h2&gt;&lt;div&gt;Now with hardware out of the way, let&#39;s talk software. Once you insert the drives, plug in the Ethernet, and turn on the power, you access the device with a web browser and configure from there.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;There are several choices for how you want to configure RAID and the filesystem.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;I chose &lt;a href=&quot;https://en.wikipedia.org/wiki/Btrfs&quot;&gt;BTRFS&lt;/a&gt; on top of RAID6.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;BTRFS is a new Linux filesystem that&#39;s increasingly becoming the default. It&#39;s major feature is that it includes checksums for files as part of their metadata (along with filenames and timestamps). This allows the filesystem to detect when a file has become corrupted, so that the file can be repaired. Bits will rot on hard disk, so files can become corrupted over time even if the files are never written to or read. Scrubbing prevents this from happening. With Synology, I simply configure it to scrub the entire filesystem every month.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This is not &quot;btrfs-raid&quot;, but &quot;btrfs-on-raid6&quot;. BTRFS has some experimental RAID built-in, but it&#39;s buggy and doesn&#39;t really work. Instead, I first create a RAID6 array combining multiple drives into a single virtual drive, then put BTRFS on top of that.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;These boxes are designed to allow multiple filesystems to be created, but I create simply the one. I do have multiple &quot;shares&quot;, though, such as for videos and music, but these are still just directories on the same filesystem.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;I also occasionally take &quot;snapshots&quot;. I&#39;m not sure how that works since I&#39;ve never restored a snapshot, but in principle it&#39;ll be quicker restoring from backups.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;h2 style=&quot;text-align: left;&quot;&gt;Summary&lt;/h2&gt;&lt;div&gt;If you are looking for between 16TB and 20TB, for more personal use than a large office, it&#39;s rather perfect. Yea, it&#39;ll be 4 times more expensive than just getting an external USB drive, but it&#39;s RAID and it&#39;s own server.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;It&#39;s so cute I got a second one and filled it with 2TB SSDs, for database accesses that spend a lot of time searching through large database of poorly indexed data (like password dumps).&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/6145801374507785535/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=6145801374507785535' title='0 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/6145801374507785535'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/6145801374507785535'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2022/07/ds620slim-tiny-home-server.html' title='DS620slim tiny home server'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgnkD8CEmE4nfqwbYIso9-11DW14e7MBd4qen-74Nb8jaDVOUAm8U3pV52fRLsz33ggypH5gc1AqFDnn7OAofFflDonndyXnkkJ5XZhNPDIFqKhNPOaTGPCfYZkkqO04dpAhbRb/s72-c" height="72" width="72"/><thr:total>0</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-5304991896640692146</id><published>2022-01-31T15:33:00.003-05:00</published><updated>2022-01-31T15:33:58.536-05:00</updated><title type='text'>No, a researcher didn&#39;t find Olympics app spying on you</title><content type='html'>&lt;p&gt;For the Beijing 2022 Winter Olympics, the Chinese government requires everyone to download an app onto their phone. It has many security/privacy concerns, as &lt;a href=&quot;https://citizenlab.ca/2022/01/cross-country-exposure-analysis-my2022-olympics-app/&quot;&gt;CitizenLab documents&lt;/a&gt;. However, another researcher goes further, claiming &lt;a href=&quot;https://twitter.com/jonathandata1/status/1486458526767661060&quot;&gt;his analysis&lt;/a&gt; proves the app is recording all audio all the time. His analysis is fraudulent. He shows a lot of technical content that looks plausible, but nowhere does he show anything that substantiates his claims.&lt;/p&gt;&lt;p&gt;&lt;span&gt;&lt;/span&gt;&lt;/p&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;Average techies may not be able to see this. It all looks technical. Therefore, I thought I&#39;d describe one example of the problems with this data -- something the average techie can recognize.&lt;p&gt;&lt;/p&gt;&lt;p&gt;His &quot;evidence&quot; consists screenshots from reverse-engineering tools, with red arrows pointing to the suspicious bits. An example of one of these screenshots is this on:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/a/AVvXsEht_qbSj6D-i35cKD8v5I-exLu35CuNci3C7XB9NtawR8fXjjojtWePt69v96CAwtax02bG8nnOp-_HsIsbMiOCntQvDPpdUfM_EIzE-5UF0c0nPaGB2lrp6fSZTJUoHCgq3xEqceTpGVnMBjFPlsXMGlSvGoT-qIE1XhuUL49jNjchwhpKug&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;545&quot; data-original-width=&quot;848&quot; height=&quot;206&quot; src=&quot;https://blogger.googleusercontent.com/img/a/AVvXsEht_qbSj6D-i35cKD8v5I-exLu35CuNci3C7XB9NtawR8fXjjojtWePt69v96CAwtax02bG8nnOp-_HsIsbMiOCntQvDPpdUfM_EIzE-5UF0c0nPaGB2lrp6fSZTJUoHCgq3xEqceTpGVnMBjFPlsXMGlSvGoT-qIE1XhuUL49jNjchwhpKug&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This screenshot is that of a reverse-engineering tool (Hopper, I think) that takes code and &quot;disassembles&quot; it. When you dump something into a reverse-engineering tool, it&#39;ll make a few assumptions about what it sees. These assumptions are &lt;b&gt;usually wrong&lt;/b&gt;. There&#39;s a process where the human user looks at the analyzed output, does a &quot;sniff-test&quot; on whether it looks reasonable, and works with the tool until it gets the assumptions correct.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;That&#39;s the red flag above: the researcher has dumped the results of a reverse-engineering tool without recognizing that something is wrong in the analysis.&lt;/div&gt;&lt;p&gt;It fails the sniff test. Different researchers will notice different things first. Famed google researcher Tavis Ormandy&amp;nbsp;&lt;a href=&quot;https://twitter.com/taviso/status/1487089870749069313&quot;&gt;points out&lt;/a&gt;&amp;nbsp;one flaw. In this post, I describe what jumps out first to me. That would be the &#39;imul&#39; (multiplication) instruction shown in the blowup below:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/a/AVvXsEil0gizOZOCfgPxDhWNvcVb4kLzGZ2uuK2vA3j5sSZwhlbbZcnv4nOyRE-JF_GmJ36giTl612W6LQDaFXejNeKgnDxf62sfSYCA647I3KWqK0IP7LwJY214i-z42UAhrs4SgZCOm2p3Ugbu8Zvu9OS0EE2Zu9ywjkWJuDLHS3XOt_BTPmYYyA&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;210&quot; data-original-width=&quot;1050&quot; height=&quot;64&quot; src=&quot;https://blogger.googleusercontent.com/img/a/AVvXsEil0gizOZOCfgPxDhWNvcVb4kLzGZ2uuK2vA3j5sSZwhlbbZcnv4nOyRE-JF_GmJ36giTl612W6LQDaFXejNeKgnDxf62sfSYCA647I3KWqK0IP7LwJY214i-z42UAhrs4SgZCOm2p3Ugbu8Zvu9OS0EE2Zu9ywjkWJuDLHS3XOt_BTPmYYyA&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;It&#39;s obviously ASCII. In other words, it&#39;s a series of bytes. The tool has tried to interpret these bytes as Intel x86 instructions (like &#39;and&#39;, &#39;insd&#39;, &#39;das&#39;, &#39;imul&#39;, etc.). But it&#39;s obviously not Intel x86, because those instructions make no sense.&lt;div&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;That &#39;imul&#39; instruction is multiplying something by the (hex) number 0x6b657479. That doesn&#39;t look like a number -- it looks like four lower-case ASCII letters. ASCII lower-case letters are in the range 0x61 through 0x7A, so it&#39;s not the single 4-byte number 0x6b657479 but the 4 individual bytes 6b 65 74 79, which map to the ASCII letters &#39;k&#39;, &#39;e&#39;, &#39;t&#39;, &#39;y&#39; (actually, because &quot;little-endian&quot;, reverse order, so &quot;ytek&quot;).&lt;/p&gt;&lt;p&gt;No, no. Techies aren&#39;t expected to be able to &lt;i&gt;read&lt;/i&gt;&amp;nbsp;hex this way. Instead, we are expected to &lt;i&gt;recognize&lt;/i&gt;&amp;nbsp;what&#39;s going on. I just used a &lt;a href=&quot;http://www.unit-conversion.info/texttools/hexadecimal/&quot;&gt;random website&lt;/a&gt; to interpret hex bytes as ASCII.&lt;/p&gt;&lt;p&gt;There are 26 lower case letters, roughly 10% of the 256 possible values for a byte. Thus, the chance that a random 4 byte number will consist of all lower-case letters is 1-in-10,000. Moreover, multiplication by strange constants happens even more rarely. You&#39;ll commonly see multiplications by small numbers like 48, or large well-formed numbers like 0x1000000. You pretty much never see multiplication by a number like 0x6b657479, baring something rare like an LCG.&lt;/p&gt;&lt;p&gt;QED: this isn&#39;t actually an Intel x86 imul instruction, it&#39;s ASCII text that the tool has tried to interpret as x86 instructions.&lt;/p&gt;&lt;p&gt;&lt;b&gt;Conclusion&lt;/b&gt;&lt;/p&gt;&lt;p&gt;At first glance, all those screenshots by the researcher look very technical, which many will assume supports his claims. But when we actually look at them, none of them support his claims. Instead, it&#39;s all just handwaving nonsense. It&#39;s clear the researchers doesn&#39;t understand them, either.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;/div&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/5304991896640692146/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=5304991896640692146' title='2 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/5304991896640692146'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/5304991896640692146'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2022/01/no-researcher-didnt-find-olympics-app.html' title='No, a researcher didn&#39;t find Olympics app spying on you'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/a/AVvXsEht_qbSj6D-i35cKD8v5I-exLu35CuNci3C7XB9NtawR8fXjjojtWePt69v96CAwtax02bG8nnOp-_HsIsbMiOCntQvDPpdUfM_EIzE-5UF0c0nPaGB2lrp6fSZTJUoHCgq3xEqceTpGVnMBjFPlsXMGlSvGoT-qIE1XhuUL49jNjchwhpKug=s72-c" height="72" width="72"/><thr:total>2</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-8483431279487229778</id><published>2021-12-07T20:35:00.004-05:00</published><updated>2021-12-07T20:39:22.939-05:00</updated><title type='text'>Journalists: stop selling NFTs that you don&#39;t understand</title><content type='html'>&lt;p&gt;The reason you don&#39;t really understand NFTs is because the journalists describing them to you don&#39;t understand them, either. We can see that when they attempt to sell an NFT as part of their stories (e.g. &lt;a href=&quot;https://www.coindesk.com/markets/2021/03/12/associated-press-nft-artwork-sells-for-180k-in-ether/&quot;&gt;AP&lt;/a&gt; and &lt;a href=&quot;https://www.nytimes.com/2021/03/26/technology/nft-sale.html&quot;&gt;NYTimes&lt;/a&gt;). They get important details wrong.&lt;/p&gt;&lt;p&gt;The latest is &lt;a href=&quot;https://reason.com/2021/12/01/own-a-piece-of-reason-history/&quot;&gt;Reason.com magazine selling an NFT&lt;/a&gt;. As libertarians, you&#39;d think at least they&#39;d get the technical details right. But they didn&#39;t. Instead of selling an NFT of the artwork, it&#39;s just an NFT of a URL. The URL points to OpenSea, which is known to remove artwork from its site (such as in response to DMCA takedown requests).&lt;/p&gt;&lt;p&gt;If you buy that Reason.com NFT, what you&#39;ll actually get is a token pointing to:&lt;/p&gt;&lt;p&gt;&lt;a href=&quot;https://api.opensea.io/api/v1/metadata/0x495f947276749Ce646f68AC8c248420045cb7b5e/0x1F907774A05F9CD08975EBF7BF56BB4FF0A4EAF0000000000000060000000001&quot;&gt;https://api.opensea.io/api/v1/metadata/0x495f947276749Ce646f68AC8c248420045cb7b5e/0x1F907774A05F9CD08975EBF7BF56BB4FF0A4EAF0000000000000060000000001&lt;/a&gt;&lt;/p&gt;&lt;p&gt;This is just the metadata, which in turn contains a link to the claimed artwork:&lt;/p&gt;&lt;p&gt;&lt;a href=&quot;https://lh3.googleusercontent.com/8Q2OGcPuODtCxbTmlf3epFGOqbfCbs4fXZ2RcIMnLpRdTaYHgqKArk7uETRdSZmpRAFsNE8KB4sFJx6czKE5cBKB1pa7ovc4wBUdqQ&quot;&gt;https://lh3.googleusercontent.com/8Q2OGcPuODtCxbTmlf3epFGOqbfCbs4fXZ2RcIMnLpRdTaYHgqKArk7uETRdSZmpRAFsNE8KB4sFJx6czKE5cBKB1pa7ovc4wBUdqQ&lt;/a&gt;&lt;/p&gt;&lt;p&gt;If either OpenSea or Google removes the linked content, then any connection between the NFT and the artwork disappears.&lt;/p&gt;&lt;p&gt;It doesn&#39;t have to be this way. The correct way to do NFT artwork is to point to a &quot;hash&quot; instead which uniquely identifies the work regardless of where it&#39;s located. That &lt;a href=&quot;https://blog.erratasec.com/2021/03/deconstructing-that-69million-nft.html&quot;&gt;$69 million Beeple piece&lt;/a&gt; was done this correct way. It&#39;s completely decentralized. If the entire Internet disappeared except for the Ethereum blockchain, that Beeple NFT would still work.&lt;/p&gt;&lt;p&gt;This is an analogy for the entire blockchain, cryptocurrency, and Dapp ecosystem: the hype you hear ignores technical details. They promise an entirely decentralized economy controlled by math and code, rather than any human entities. In practice, almost everything cheats, being tied to humans controlling things. In this case, the &quot;Reason.com NFT artwork&quot; is under control of OpenSea and not the &quot;owner&quot; of the token.&lt;/p&gt;&lt;p&gt;Journalists have a problem. NFTs selling for millions of dollars are newsworthy, and it&#39;s the journalists place to report news rather than making judgements, like whether or not it&#39;s a scam. But at the same time, journalists are trying to explain things they don&#39;t understand. Instead of standing outside the story, simply quoting sources, they insert themselves into the story, becoming advocates rather than reporters. They can no longer be trusted as an objective observers.&lt;/p&gt;&lt;p&gt;From a fraud perspective, it may not matter that the Reason.com NFT points to a URL instead of the promised artwork. The entire point of the blockchain is &lt;i&gt;caveat emptor in action&lt;/i&gt;. Rules are supposed to be governed by code rather than companies, government, or the courts. There is no undoing of a transaction even if courts were to order it, because it&#39;s math.&lt;/p&gt;&lt;p&gt;But from a journalistic point of view,&amp;nbsp; this is important. They failed at an honest description of what actually the NFT contains. They&#39;ve involved themselves in the story, creating a conflict of interest. It&#39;s now hard for them to point out NFT scams when they themselves have participated in something that, from a certain point of view, could be viewed as a scam.&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/a/AVvXsEisSQVAVEvUg5zjSZndwshn9yvxa23_CJq6gXtiMBy69qekJ8CA98P6x7cnuNRPxFoIu7SNMI2oA8twEHac417lvr3Act_L3Xl4B4MPcdCCDVmwYNPk60nY6xpf2ws8a1sE3ycrK04z6dz_zy2hgFeRYd3JTuEjeOBO1BAblp-xFInuAC2NbQ=s1926&quot; imageanchor=&quot;1&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;1050&quot; data-original-width=&quot;1926&quot; height=&quot;217&quot; src=&quot;https://blogger.googleusercontent.com/img/a/AVvXsEisSQVAVEvUg5zjSZndwshn9yvxa23_CJq6gXtiMBy69qekJ8CA98P6x7cnuNRPxFoIu7SNMI2oA8twEHac417lvr3Act_L3Xl4B4MPcdCCDVmwYNPk60nY6xpf2ws8a1sE3ycrK04z6dz_zy2hgFeRYd3JTuEjeOBO1BAblp-xFInuAC2NbQ=w400-h217&quot; width=&quot;400&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/8483431279487229778/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=8483431279487229778' title='0 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/8483431279487229778'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/8483431279487229778'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/12/journalists-stop-selling-nfts-that-you.html' title='Journalists: stop selling NFTs that you don&#39;t understand'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/a/AVvXsEisSQVAVEvUg5zjSZndwshn9yvxa23_CJq6gXtiMBy69qekJ8CA98P6x7cnuNRPxFoIu7SNMI2oA8twEHac417lvr3Act_L3Xl4B4MPcdCCDVmwYNPk60nY6xpf2ws8a1sE3ycrK04z6dz_zy2hgFeRYd3JTuEjeOBO1BAblp-xFInuAC2NbQ=s72-w400-h217-c" height="72" width="72"/><thr:total>0</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-5882299128802596099</id><published>2021-11-07T20:09:00.001-05:00</published><updated>2021-11-07T20:09:32.980-05:00</updated><title type='text'>Example: forensicating the Mesa County system image</title><content type='html'>&lt;p&gt;Tina Peters, the election clerk in Mesa County (Colorado) &lt;a href=&quot;https://www.washingtonpost.com/investigations/an-elections-supervisor-embraced-conspiracy-theories-officials-say-she-has-become-an-insider-threat/2021/09/26/ee60812e-1a17-11ec-a99a-5fea2b2da34b_story.html&quot;&gt;went rogue&lt;/a&gt; and dumped disk images of an election computer on the Internet. They are available on the Internet via BitTorrent [&lt;a href=&quot;magnet:?xt=urn:btih:dc654b50ec08a8ad5d8f6275f9cd4fcae29686c1&amp;amp;dn=Mesa1&quot;&gt;Mesa1&lt;/a&gt;][&lt;a href=&quot;magnet:?xt=urn:btih:ef534e78bbe71b3908ccf074d6d40077a3a63074&amp;amp;dn=Mesa2&quot;&gt;Mesa2&lt;/a&gt;], The Colorado Secretary of State is now suing her over the incident.&lt;/p&gt;&lt;p&gt;The lawsuit describes the facts of the case, how she entered the building with an accomplice on Sunday, May 23, 2021. I thought I&#39;d do some forensics on the image to get more details.&lt;/p&gt;&lt;p&gt;Specifically, I see from the Mesa1 image that she logged on at 4:24pm and was done acquiring the image by 4:30pm, in and (presumably) out in under 7 minutes.&lt;/p&gt;&lt;p&gt;In this blogpost, I go into more detail about how to get that information.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;The image&lt;/b&gt;&lt;/p&gt;&lt;p&gt;To download the Mesa1 image, you need a program that can access BitTorrent, such as the Brave web browser or a BitTorrent client like qBittorrent. Either click on the &quot;magnet&quot; link or copy/paste into the program you&#39;ll use to download. It takes a minute to gather all the &quot;metadata&quot; associated with the link, but it&#39;ll soon start the download:&lt;/p&gt;&lt;p&gt;What you get is file named EMSSERVER.E01. This is a container file that contains both the raw disk image as well as some forensics metadata, like the date it was collected, the forensics investigator, and so on. This container is in the well-known &quot;EnCase Expert Witness&quot; format. EnCase is a commercial product, but its container format is a quasi-standard in the industry.&lt;/p&gt;&lt;p&gt;Some freeware utilities you can use to open this container and view the disk include &quot;FTK Imager&quot;, &quot;Autopsy&quot;, and on the Linux command line, &quot;ewf-tools&quot;.&lt;/p&gt;&lt;p&gt;However you access the E01 file, what you most want to look at is the Windows operating-system logs. These are located in the directory C:\Windows\system32\winevtx. The standard Windows &quot;Event Viewer&quot; application can load these log files to help you view them.&lt;/p&gt;&lt;p&gt;When inserting a USB drive to create the disk image, these event files will be updated and written to that disk before the image was taken. Thus, we can see in the event files all the events that happen right before the disk image happens.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;div&gt;&lt;p&gt;&lt;b&gt;Disk image acquisition&lt;/b&gt;&lt;/p&gt;&lt;p&gt;Here&#39;s what the event logs on the Mesa1 image tells us about the acquisition of the disk image itself.&lt;/p&gt;&lt;p&gt;The person taking the disk image logged in at 4:24:16pm, directly to the console (not remotely), on their second attempt after first typing an incorrect password. The account used was &quot;emsadmin&quot;. Their NTLM password hash is&amp;nbsp;9e4ec70af42436e5f0abf0a99e908b7a. This is a &quot;role-based&quot; account rather than an individual&#39;s account, but I think Tina Peters is the person responsible for the &quot;emsadmin&quot; roll.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVJlvZ3B1XIbm9111Azfh0IYzsO6TfHb3JQVkcf2gt_gPj6G-9Kv7v4lfdNMwlfwAlsXkkEXk0RYKSkiIqqsdsoDTSHYDodsedSDqffGxtgeNno2X1dgnbm8lo4OyY5KsOrxdS/&quot; style=&quot;clear: right; float: right; margin-bottom: 1em; margin-left: 1em;&quot;&gt;&lt;img data-original-height=&quot;1434&quot; data-original-width=&quot;1500&quot; height=&quot;191&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVJlvZ3B1XIbm9111Azfh0IYzsO6TfHb3JQVkcf2gt_gPj6G-9Kv7v4lfdNMwlfwAlsXkkEXk0RYKSkiIqqsdsoDTSHYDodsedSDqffGxtgeNno2X1dgnbm8lo4OyY5KsOrxdS/w200-h191/image.png&quot; width=&quot;200&quot; /&gt;&lt;/a&gt;&lt;/div&gt;Then, at 4:26:10pm, they connected via USB a Western Digital&amp;nbsp; &quot;easystore™&quot; portable drive that holds 5-terabytes. This was mounted as the F: drive.&lt;p&gt;&lt;/p&gt;&lt;p&gt;The program &quot;Access Data FTK Imager 4.2.0.13&quot; was run from the USB drive (F:\FTK Imager\FTK Imager.exe) in order to image the system. The image was taken around 4:30pm, local Mountain Time (10:30pm GMT).&lt;/p&gt;&lt;p&gt;It&#39;s impossible to say from this image what happened after it was taken. Presumably, they immediately hit &quot;eject&quot; on the drive, logged off, and disconnected the hard drive. Thus from beginning to end, it took about 7 minutes to take the image once they sat down at the computer.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;/div&gt;&lt;div&gt;&lt;p&gt;&lt;b&gt;Dominion Voting Systems&lt;/b&gt;&lt;/p&gt;&lt;p&gt;The disk image is that of a an &quot;EMS Server&quot; part of the Dominion Voting Suite. This is a server on an air-gapped network (not connected to any other network) within the count offices.&lt;/p&gt;&lt;p&gt;Most manuals for Colorado are &lt;a href=&quot;https://www.sos.state.co.us/pubs/elections/VotingSystems/DVS-DemocracySuite511/documentation/docIndex.html&quot;&gt;online&lt;/a&gt;, though some bits and pieces are missing, and can be found in documents posted to &lt;a href=&quot;https://www.sos.ca.gov/elections/ovsta/frequently-requested-information/dominion-voting&quot;&gt;other state&#39;s websites&lt;/a&gt;&amp;nbsp;(though each state does things a little different, so such cross referencing can&#39;t be completely trusted).&lt;/p&gt;&lt;p&gt;The locked room with an air-gapped network&amp;nbsp; you see in the Mesa County office appears to look like the following, an &quot;EMS Standard&quot; configuration (EMS stands for Election Management System).&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgalVSOCVg48IG-YRkAitL7VXceV_fsZF6YE0UrICZ97HzcUceIONmufZz_7R72jjBYe7w0slDtJe2YUDVfYlQz3XrHM-2PeyoRJy296CWIFQE1R752E5srZyjeFP55iO_GWy4n/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;1214&quot; data-original-width=&quot;2048&quot; height=&quot;190&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgalVSOCVg48IG-YRkAitL7VXceV_fsZF6YE0UrICZ97HzcUceIONmufZz_7R72jjBYe7w0slDtJe2YUDVfYlQz3XrHM-2PeyoRJy296CWIFQE1R752E5srZyjeFP55iO_GWy4n/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;This small network is &quot;air gapped&quot;, meaning there is no connection from this network to any other network in the building, nor out to the Internet. By looking at the logs from the Mesa1 image, we can see what this network looks like:&lt;div&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;The EMS Server is named &quot;EMSERVER&quot; with IP address 192.168.100.10 and MAC address 44-A8-42-30-01-5D. The hard drive matches Dominion&#39;s specs: a 1-terabyte boot drive (C:) and a 2-terabyte data drive (D:) that is shared with the rest of the network as \\EMSERVER\NAS. This also acts as the network&#39;s DHCP and DNS server.&lt;/li&gt;&lt;li&gt;At least one network printer, model Dell E310dw.&lt;/li&gt;&lt;li&gt;Two EMS Workstations (EMSCLIENT01 and EMSCLIENT02). This is where users spend most of their time, before an election to create the ballots, and after all the ballots have been counted to construct the final tally.&lt;/li&gt;&lt;li&gt;Four&amp;nbsp;&lt;a href=&quot;https://www.sos.state.co.us/pubs/elections/VotingSystems/DVS-DemocracySuite511/documentation/2-03-ICC-FunctionalityDescription-5-11-CO.pdf&quot;&gt;ImageCast Central&lt;/a&gt;&amp;nbsp;(ICC) (ICC01 - ICC04) scanners, for automatically scanning and tabulating ballots.&lt;/li&gt;&lt;li&gt;Two &lt;a href=&quot;https://www.sos.state.co.us/pubs/elections/VotingSystems/DVS-DemocracySuite511/documentation/2-08-ADJ-SystemOperationProcedures-5-11-CO.pdf&quot;&gt;Adjudication Workstations&lt;/a&gt; (ADJCLIENT01 and ADJCLIENT03). These are used when the scanners reject ballots, such as when somebody does a write-in candidate, or marks two candidates. Humans need to get involved to make the final judgement on what the ballot actually says.&lt;/li&gt;&lt;/ul&gt;&lt;/div&gt;&lt;div&gt;&lt;p&gt;Note this isn&#39;t the machines you&#39;d expect to see in a precinct when you vote (which would be &quot;ballot marking devices&quot; predominantly). These are the machines in the back office that count the votes and store the official results.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Conclusion&lt;/b&gt;&lt;/p&gt;&lt;p&gt;What we see here is that &quot;system logs&quot; can tell us a lot of interesting things about the system. There&#39;s good reason to retain them in the future.&lt;/p&gt;&lt;p&gt;On the other hand, they generally can&#39;t answer the most important question: whether the system was hacked and votes flipped.&lt;/p&gt;&lt;p&gt;Mike Lindell claims to have &quot;Absolute Proof&quot; that Chinese hackers flipped votes throughout the country, including Maricopa County. If so, this would&#39;ve been the system that the Chinese hackers would&#39;ve hacked. Yet, in the system image, there is no evidence of this. By this, I mean the Mesa1 image, the one from before the system logs were deleted (obviously, there would be nothing in the Mesa2 image).&lt;/p&gt;&lt;p&gt;This lack of hacking evidence in the logs isn&#39;t proof that it didn&#39;t happen, though. The fact is, the logs aren&#39;t comprehensive enough to record most hacks, and the hackers could&#39;ve deleted the logs anyway. That&#39;s why system logs aren&#39;t considered &quot;election records&quot; and that laws don&#39;t mandate keeping them: they could have some utility, as I&#39;ve shown above, but they really wouldn&#39;t show the things that we most want to know.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;/div&gt;&lt;div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/5882299128802596099/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=5882299128802596099' title='1 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/5882299128802596099'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/5882299128802596099'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/11/example-forensicating-mesa-county.html' title='Example: forensicating the Mesa County system image'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiVJlvZ3B1XIbm9111Azfh0IYzsO6TfHb3JQVkcf2gt_gPj6G-9Kv7v4lfdNMwlfwAlsXkkEXk0RYKSkiIqqsdsoDTSHYDodsedSDqffGxtgeNno2X1dgnbm8lo4OyY5KsOrxdS/s72-w200-h191-c/image.png" height="72" width="72"/><thr:total>1</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-7031097278681708508</id><published>2021-10-31T01:39:00.011-04:00</published><updated>2021-10-31T02:15:17.301-04:00</updated><title type='text'>Debunking: that Jones Alfa-Trump report</title><content type='html'>&lt;p&gt;The Alfa-Trump conspiracy-theory has gotten a new life. Among the new things is a report done by Democrat operative Daniel Jones [&lt;a href=&quot;https://krebsonsecurity.com/wp-content/uploads/2021/09/JonesvAlfa.pdf&quot;&gt;*&lt;/a&gt;]. In this blogpost, I debunk that report.&lt;/p&gt;&lt;p&gt;If you&#39;ll recall, the conspiracy-theory comes from anomalous DNS traffic captured by cybersecurity researchers. In the summer of 2016, while Trump was denying involvement with Russian banks, the Alfa Bank in Russia was doing lookups on the name &quot;mail1.trump-email.com&quot;. During this time,&amp;nbsp; additional lookups were also coming from two&amp;nbsp;other organizations with suspicious ties to Trump, Spectrum Health and Heartland Payments.&lt;/p&gt;&lt;p&gt;This is certainly suspicious, but people have taken it further. They have crafted a conspiracy-theory to explain the anomaly, namely that these organizations were secretly connecting to a Trump server.&lt;/p&gt;&lt;p&gt;We know this explanation to be false. There is no Trump server, no real server at all, and no connections. Instead, the name was created and controlled by Cendyn. The server the name points to for transmitting bulk email and isn&#39;t really configured to accept connections. It&#39;s built for outgoing spam, not incoming connections. The Trump Org had no control over the name or the server. As Cendyn explains, the contract with the Trump Org ended in March 2016, after which they re-used the IP address for other marketing programs, but since they hadn&#39;t changed the DNS settings, this caused lookups of the DNS name.&lt;/p&gt;&lt;p&gt;This still doesn&#39;t answer why Alfa, Spectrum, Heartland, and nobody else were doing the lookups. That&#39;s still a question. But the answer isn&#39;t secret connections to a Trump server. The evidence is pretty solid on that point.&lt;/p&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Daniel Jones and Democracy Integrity Project&lt;/b&gt;&lt;/p&gt;&lt;p&gt;The report is from&amp;nbsp;&lt;a href=&quot;https://en.wikipedia.org/wiki/Daniel_J._Jones&quot;&gt;Daniel Jones&lt;/a&gt;&amp;nbsp;and his Democracy Integrity Project.&lt;/p&gt;&lt;p&gt;It&#39;s at this point that things get squirrely. All sorts of right-wing sites claim he&#39;s a front for George Soros, funds Fusion GPS, and involved in the &lt;a href=&quot;https://en.wikipedia.org/wiki/Steele_dossier&quot;&gt;Steele Dossier&lt;/a&gt;. That&#39;s right-wing conspiracy theory nonsense.&lt;/p&gt;&lt;p&gt;But at the same time, he&#39;s clearly not an independent and objective analyst. He was hired to further the interests of Democrats.&lt;/p&gt;&lt;p&gt;If the data and analysis held up, then partisan ties wouldn&#39;t matter. But they don&#39;t hold up. Jones is clearly trying to be deceptive.&lt;/p&gt;&lt;p&gt;The deception starts by repeatedly referring to the &quot;Trump server&quot;. There is no Trump server. There is a Listrak server operated on behalf of Cendyn. Whether the Trump Org had any control over the name or the server is a key &lt;i&gt;question&lt;/i&gt;&amp;nbsp;the report should be trying to prove, not a &lt;i&gt;premise&lt;/i&gt;. The report clearly understands this fact, so it can&#39;t be considered a mere &lt;i&gt;mistake&lt;/i&gt;, but a deliberate &lt;i&gt;deception&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;People make assumptions that a domain name like &quot;&lt;i&gt;trump-email.com&lt;/i&gt;&quot; would be controlled by the Trump organization. It&#39;s wasn&#39;t. When Trump Hotels hired Cendyn to do marketing for them, Cendyn did what they normally do in such cases, register a domain with their client&#39;s name for the sending of bulk emails. They did the same thing with &lt;i&gt;hyatt-email.com&lt;/i&gt;, &lt;i&gt;denihan-email.com&lt;/i&gt;, &lt;i&gt;mjh-email.com&lt;/i&gt;, and so on. What clear is that the Trump organization had no control, no direct ties to this domain until after the conspiracy-theory hit the press.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Finding #1 - Alfa Bank, Spectrum Health, and Heartland account for nearly all of the DNS lookups for mail1.trump-email.com in the May-September timeframe.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;Yup, that&#39;s weird and unexplained.&lt;/p&gt;&lt;p&gt;But it concludes from this that there were connections, saying the following:&lt;/p&gt;&lt;blockquote&gt;In the DNS environment, if &quot;computer X&quot; does a DNS look-up of &quot;Computer Y,&quot; it means that &quot;Computer X&quot; is trying to connect to &quot;Computer Y&quot;.&lt;/blockquote&gt;&lt;p&gt;This is false. That&#39;s certainly the assumption we usually make, that it&#39;s probably true in most cases. But it&#39;s not something we insist upon if there&#39;s reason to doubt it. And since there&#39;s reason to doubt it here, we would need more evidence to make that conclusion.&lt;/p&gt;&lt;p&gt;For example, before the contract was canceled in March 2016, there were DNS lookups for the &quot;mail1.trump-email.com&quot; name from all over the place. That&#39;s because the Listrak server was pumping out bulk emails (&quot;spam&quot;) promoting Trump Hotels. Servers receiving the emails would often check the identity of the server through DNS lookups, but without any attempt to connect. This fact is footnoted in the Jones report even as it claims otherwise in the main text.&lt;/p&gt;&lt;p&gt;Obviously, that&#39;s no longer the case after March 2016, when the contract was canceled. But if Cendyn repurposes the server for something else, such lookups can still happen without connections. The DNS records hadn&#39;t changed. So if the server sends out new things from that IP address, unrelated to Trump Org, it&#39;d still cause DNS lookups for the &quot;trump-email.com&quot; domain to happen. It wouldn&#39;t mean anybody was trying to connect to the server.&lt;/p&gt;&lt;p&gt;This is indeed what Cendyn claims, that they repurposed the resources for their hotel meetings app (whereby hotels can schedule conferences and things on their premises).&lt;/p&gt;&lt;p&gt;It&#39;s still suspicious that only those three organizations were involved, but at the same time, it&#39;s clearly false to assume this is evidence of &lt;i&gt;connections&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Finding #2 - Comparison with &lt;i&gt;denihan-email.com&lt;/i&gt;.&lt;/b&gt;&lt;/p&gt;&lt;p&gt;The Jones report compared the DNS logs of &lt;i&gt;trump-email.com&lt;/i&gt;&amp;nbsp;with the domain of another of Cendyn&#39;s client, Denihan. Cendyn registered the domain&amp;nbsp;&lt;i&gt;denihan-email.com&lt;/i&gt;. This is another hotel company.&lt;/p&gt;&lt;p&gt;This comparison was obviously bogus. The contract with Cendyn ended in March 2016, after which Cendyn claims it repurposed the server. Jones uses the timeframe August 2016 through September 2016 to compare traffic for those two domains. Of course they&#39;d be different. A valid comparison would be a t timeframe before March 2016, when both were clients of Cendyn.&lt;/p&gt;&lt;p&gt;Since Jones documents the fact the contract between Cendyn and Trump Org was ended, they are knowingly comparing an apple to an orange. Thus, it&#39;s not a mistake but a deception.&lt;/p&gt;&lt;p&gt;This also points to the fundamental problem with the data-set. We don&#39;t really have a full picture of what happened, such as data going back to 2015. We have a carefully curated subset of the data designed to show just what they want us to see.&lt;/p&gt;&lt;p&gt;Everything points to &lt;i&gt;trump-email.com&lt;/i&gt;&amp;nbsp;domain and Listrak servers being just normal Cendyn stuff used for Cendyn&#39;s purposes. As far as we can tell, that domain worked the same as other Cendyn clients, such as &lt;i&gt;denihan-email.com&lt;/i&gt;, &lt;i&gt;hyatt-email.com&lt;/i&gt;, &lt;i&gt;mjh-email.com&lt;/i&gt;, and so on. These domains are controlled by Cendyn, not their client&#39;s. Cendyn in turn points those names at Listrak servers for sending bulk email.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Finding #3 - Missing SPF record&lt;/b&gt;&lt;/p&gt;&lt;p&gt;The Jone&#39;s report points to missing SPF records, showing that the server is not configured correctly for sending mass emails. It includes this exhibit.&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdx0FhIhsjpQqX3J5LJCgXurzCQQBNQPQiTSy5tawoEvH35xzIbpQwI8zfJpH74LN62Fa7naMh0d8pIZxNkvcfhYWgAG6tzu6t47IIDpV-wkoKco4iAqrISPzZns-mH_XIlj5l/s1808/Screen+Shot+2021-10-30+at+3.09.24+PM.png&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;354&quot; data-original-width=&quot;1808&quot; height=&quot;63&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdx0FhIhsjpQqX3J5LJCgXurzCQQBNQPQiTSy5tawoEvH35xzIbpQwI8zfJpH74LN62Fa7naMh0d8pIZxNkvcfhYWgAG6tzu6t47IIDpV-wkoKco4iAqrISPzZns-mH_XIlj5l/s320/Screen+Shot+2021-10-30+at+3.09.24+PM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;But a review shows that this is the same configuration as for other Cendyn/Listrak bulk email servers. For example, compared to &lt;i&gt;mjh-email.com&lt;/i&gt;, we find it&#39;s configured the same:&lt;div&gt;&lt;br /&gt;&lt;div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjB2rQiz9TrUi6iJij3jD3KlKoY5DN7p_m-1iD6JAOyEwal0v6VI4333nrj57AWRY2Zp_gxdWojUKG29v5S-FXvKOz2vzEQ0LGS-RA9vNVaj1-hg7-ibTBz-8iF65y6hBtZKZzR/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;286&quot; data-original-width=&quot;804&quot; height=&quot;114&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjB2rQiz9TrUi6iJij3jD3KlKoY5DN7p_m-1iD6JAOyEwal0v6VI4333nrj57AWRY2Zp_gxdWojUKG29v5S-FXvKOz2vzEQ0LGS-RA9vNVaj1-hg7-ibTBz-8iF65y6hBtZKZzR/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The SPF and DMARC standards were not as widely used in 2016, so misconfigurations were common. Moreover, the domains also lacked a DMARC record. Without DMARC, despite SPF being bad, many receivers won&#39;t reject the emails.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Listrak/Cendyn still fail to have proper DMARC records for their clients, which means that some of their bulk email is getting rejected. They should probably fix that. This doesn&#39;t mean Listrak/Cendyn aren&#39;t in the bulk email business, only that they could be better at it.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Thus, we&#39;ve shown that &lt;i&gt;trump-email.com&lt;/i&gt;&amp;nbsp;had the perfectly normal Cendyn SPF records. Far from proving this isn&#39;t a bulk email server, the consistency with Cendyn&#39;s normal configuration proves unequivocally that it is.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;Finding #4 - Accepts emails only from specific senders&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The Jones report shows that the server in question (66.216.133.29) accepts incoming email, but rejects email from the public, accepting email only from specific senders. They assume the specific senders would be those from Alfa Bank, Spectrum, and Heartland.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Again, they don&#39;t compare properly to other Cendyn/Listrak systems. If they had, they&#39;d have found that they all are configured the same way. There&#39;s an entire subnet of servers you can test this way:&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZiXSsbGmf6nbLhDbcBvf77laNj5VTwp1zP8TCd7UeJUIZOkMgAHDBPcSe3Fw3Ddy0Gv3LnxYf31ujQbL7XpmqjXg1NrQGVqhkrFXsYPZysFZ2Acogq-YvWRWoNCtnBcpaLmBb/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;483&quot; data-original-width=&quot;780&quot; height=&quot;198&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiZiXSsbGmf6nbLhDbcBvf77laNj5VTwp1zP8TCd7UeJUIZOkMgAHDBPcSe3Fw3Ddy0Gv3LnxYf31ujQbL7XpmqjXg1NrQGVqhkrFXsYPZysFZ2Acogq-YvWRWoNCtnBcpaLmBb/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;All these servers show the same messages, allowing incoming email &lt;i&gt;connections &lt;/i&gt;but not incoming email &lt;i&gt;messages&lt;/i&gt;.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This is a vestigial configuration common to bulk email senders. Spammers only send email. One way to test if somebody is spammer is to connect back. This configuration makes it appear they&#39;ll accept email even if they won&#39;t, passing the test.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;In no way is this evidence of secret communications. It&#39;s not evidence of their claim that somehow Alfa Bank, Spectrum Health, and Heartland would be on the list of allowed senders. We would need additional evidence to make that claim, not an assumption.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;Finding #5 - Evidence of human interaction and coordination&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The report claims a direct link between Alfa and Trump with the following:&lt;/div&gt;&lt;div&gt;&lt;/div&gt;&lt;blockquote&gt;&lt;div&gt;On September 23, 2016, two days after &lt;i&gt;The New York Times&lt;/i&gt;&amp;nbsp;approached Alfa Bank, the Trump Organization deleted the email server &quot;mail1.trump-email.com&quot; ... it would have been a deliberate human action taken by a someone working on behalf of the Trump Organization and not by &lt;i&gt;Alfa Bank&lt;/i&gt;. An analyst, quoted in the &lt;i&gt;Slate&lt;/i&gt;&amp;nbsp;article by Franklin Foer, observed that &lt;i&gt;&quot;the knee was struck in Moscow, and the leg kicked in New York.&quot;&lt;/i&gt;&lt;/div&gt;&lt;div&gt;&lt;/div&gt;&lt;/blockquote&gt;&lt;div&gt;This &#39;finding&#39; is an excellent demonstration of how to identify conspiracy-theories: anomalies that cannot otherwise be explained become proof of the conspiracy. After all, the conspiracy-theory can explain everything.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;When I debunked the Alfa-Trump thing back in 2017, reporters grilled me on this specific point. They demanded I come up with an explanation for this coincidence. I told them I had none, but just because I didn&#39;t have one, it didn&#39;t mean it was proof of the conspiracy theory. There could be lots of explanations, just because we don&#39;t know them doesn&#39;t mean they don&#39;t exist. Just because the conspiracy-theory explains it doesn&#39;t mean this is evidence for the conspiracy.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;But now we do have another explanation: the FBI called Cendyn on the morning of September 23 and asked them about the domain. As the agent reported back:&lt;/div&gt;&lt;blockquote&gt;&lt;div&gt;“Followed up this morning with Central Dynamics [Cendyn] who confirmed that the mail1.trump-email.com domain is an old domain that was set up in approximately 2009 when they were doing business with the Trump Organization that was never used.&quot; -- &lt;a href=&quot;http://zububrothers.com/2021/10/31/durham-probe-inches-closer-to-hillary-as-alfa-bank-hoax-plot-thickens/&quot;&gt;*&lt;/a&gt;&lt;/div&gt;&lt;div&gt;&lt;/div&gt;&lt;/blockquote&gt;&lt;div&gt;Thus, it&#39;s not NYT contacting Alfa Bank that caused the deletion, it&#39;s the FBI calling Cendyn. Thus, there&#39;s no evidence Alfa Bank or Trump Org were even involved. The evidence is quite clear that only Cendyn was involved.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;After Cendyn deletes the domain &quot;mail1.trump-email.com&quot;, lookups of that name started to fail. The Jones report notes that Alfa Bank then switched to &quot;trump1.contact-client.com&quot;. It weaves this in to the conspiracy thusly:&lt;/div&gt;&lt;blockquote&gt;&lt;div&gt;The fact that Alfa Bank was the first entity (IP address) to conduct a DNS look-up for &quot;trump1.contact-client.com&quot; in the data-set could indicate that someone at Alfa Bank was in some manner made aware of the new Trump Organization server name.&lt;/div&gt;&lt;div&gt;&lt;/div&gt;&lt;/blockquote&gt;&lt;div&gt;The name &quot;contact-client.com&quot; is part of Cendyn&#39;s infrastructure. For their &quot;&lt;i&gt;mail1.&lt;b&gt;customer&lt;/b&gt;-email.com&lt;/i&gt;&quot; domains, there&#39;s a matching &quot;&lt;i&gt;&lt;b&gt;customer&lt;/b&gt;1.contact-client.com&lt;/i&gt;&quot; domain. We can see test that live right now:&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjklwYzoFzV_wlIKVML3xu4bjhAZqBS1V2F417ph1iG636fq3s_ncOX2yjYioANv0tICTWGojHi2jZMvCtngccB8904knZbw7UabbqhVFueeACy5-scnT5AkGaDYceca1e3sDCB/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;277&quot; data-original-width=&quot;775&quot; height=&quot;114&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjklwYzoFzV_wlIKVML3xu4bjhAZqBS1V2F417ph1iG636fq3s_ncOX2yjYioANv0tICTWGojHi2jZMvCtngccB8904knZbw7UabbqhVFueeACy5-scnT5AkGaDYceca1e3sDCB/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;This is totally consistent with Cendyn&#39;s re-use of the infrastructure for a new purpose, as it would treat both domain names the same. Rather than evidence suggesting human interaction, it&#39;s evidence suggesting the opposite, that there was no human interaction.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;6. The Mandiant report doesn&#39;t refuted these findings&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;After this thing hit the news, Alfa Bank hired Mandiant to come to their offices and investigate. Their report was inconclusive. They didn&#39;t find anything.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Note the difference in language. Things Mandiant can&#39;t explain demonstrates Mandiant&#39;s incompetence, while things Jones can&#39;t explain prove the conspiracy-theory. If Mandiant&#39;s report should be treated as inclusive and proof of nothing, then so too should the Jones report. The Jones report has even less evidence than the Mandiant report.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;7. The public statements by Trump et al. are contradictory and incomplete&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/div&gt;&lt;div&gt;Duh.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The Trump Org, Alfa, and Spectrum Health have no idea what happened. Their statements are consistent with knowing they don&#39;t have secret communications, but not knowing where this DNS data came from. They are unable to refute the allegations, but at the same time, are concerned for their reputations, and behave accordingly. Which, of course, means the guess at what&#39;s going on with more confidence than is warranted.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;If there were secret communications among them, you&#39;d expect they&#39;d do a better job at coordinating their stories.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;Conclusion&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/div&gt;&lt;div&gt;In this blogpost, I&#39;ve refuted all the findings of the Jones report. There is still the question where this DNS anomaly came from, but the allegation that this proves a secret connect between Alfa Bank and a Trump server is clearly false.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Moreover, I&#39;ve shown that the Jones report is not merely wrong, but deliberately deceptive. They repeatedly reference a &quot;Trump Organization Server&quot; even though it&#39;s quite clear from the text they know that no such server exists.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;For example, when Cendyn removed the &quot;mail1.trump-email.com&quot; DNS record, it was described as the &quot;Trump Organization deleted the email server&quot;. It&#39;s clear they know that Cendyn simply removed the &lt;i&gt;mail1.trump-email.com&lt;/i&gt; record, and that the Listrak server wasn&#39;t touched. Yet, they deliberate phrase things this way in order to deceive.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;What we have is Alfa Bank doing DNS queries. What we don&#39;t have is any connection to the Trump Org. Since Jones couldn&#39;t create the &lt;i&gt;conclusion&lt;/i&gt; based on evidence that Trump Org was involve, he instead made it the &lt;i&gt;premise&lt;/i&gt;.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This in turn makes it easy to disprove the entire Jones report: since there&#39;s not only no evidence of Trump Org involvement, and quite a lot of evidence Trump Org had no control over the domain or servers, it disprove the entire theory that there was secret connections with Alfa Bank.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;/div&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/7031097278681708508/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=7031097278681708508' title='2 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/7031097278681708508'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/7031097278681708508'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/10/debunking-that-jones-alfa-trump-report.html' title='Debunking: that Jones Alfa-Trump report'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjdx0FhIhsjpQqX3J5LJCgXurzCQQBNQPQiTSy5tawoEvH35xzIbpQwI8zfJpH74LN62Fa7naMh0d8pIZxNkvcfhYWgAG6tzu6t47IIDpV-wkoKco4iAqrISPzZns-mH_XIlj5l/s72-c/Screen+Shot+2021-10-30+at+3.09.24+PM.png" height="72" width="72"/><thr:total>2</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-5951653034642667450</id><published>2021-10-24T19:46:00.005-04:00</published><updated>2021-10-24T19:46:46.119-04:00</updated><title type='text'>Review: Dune (2021)</title><content type='html'>&lt;p&gt;One of the most important classic sci-fi stories is the book &quot;&lt;i&gt;Dune&lt;/i&gt;&quot; from Frank Herbert. It was recently made into a movie. I thought I&#39;d write a quick review.&lt;/p&gt;&lt;p&gt;The summary is this: just read the book. It&#39;s a classic for a good reason, and you&#39;ll be missing a lot by not reading it.&lt;/p&gt;&lt;p&gt;But the movie &lt;i&gt;Dune&lt;/i&gt; (2021) movie is very good. The most important thing to know is &lt;b&gt;see it in IMAX&lt;/b&gt;. IMAX is this huge screen technology that partly wraps around the viewer, and accompanied by huge speakers that overwhelm you with sound. If you watch it in some other format, what was visually stunning becomes merely very pretty.&lt;/p&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;p&gt;This is Villeneuve&#39;s trademark, which you can see in his other works, like his sequel to Bladerunner. The purpose is to marvel at the visuals in every scene. The story telling is just enough to hold the visuals together. I mean, he also seems to do a good job with the story telling, but it&#39;s just not the reason to go see the movie. (I can&#39;t tell -- I&#39;ve read the book, so see the story differently than those of you who haven&#39;t).&lt;/p&gt;&lt;p&gt;Beyond the story and visuals, many of the actor&#39;s performances were phenomenal. Javier Bardem&#39;s &quot;Stilgar&quot; character steals his scenes.&amp;nbsp;Stellan Skarsgård exudes evil. The two character actors playing the mentats were each perfect. I found the lead character (Timothée Chalamet) a bit annoying, but simply because he is at this point in the story.&lt;/p&gt;&lt;p&gt;Villeneuve&#39;s splits the book into two parts. This movie is only the first part. This presents a problem, because up until this point, the main character is just responding to events, not the hero who yet drives the events. It doesn&#39;t fit into the traditional Hollywood accounting model. I really want to see the second film even if the first part, released in the post-pandemic turmoil of the movie industry, doesn&#39;t perform well at the box office.&lt;/p&gt;&lt;p&gt;In short, if you haven&#39;t read the books, I&#39;m not sure how well you&#39;ll follow the storytelling. But the visuals (seen at IMAX scale) and the characters are so great that I&#39;m pretty sure most people will enjoy the movie. And go see it on IMAX in order to get the second movie made!!&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/5951653034642667450/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=5951653034642667450' title='0 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/5951653034642667450'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/5951653034642667450'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/10/review-dune.html' title='Review: Dune (2021)'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><thr:total>0</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-4064086299244535941</id><published>2021-10-13T23:33:00.002-04:00</published><updated>2021-10-13T23:33:07.845-04:00</updated><title type='text'>Fact check: that &quot;forensics&quot; of the Mesa image is crazy</title><content type='html'>&lt;p&gt;Tina Peters, the elections clerk from Mesa County (Colorado) went rogue, creating a &quot;disk-image&quot; of the election server, and posting that image to the public Internet. Conspiracy theorists have been analyzing the disk-image trying to find anomalies supporting their conspiracy-theories. A recent example is &lt;a href=&quot;https://www.scribd.com/document/531800293/Mesa-County-Database-and-System-Analysis&quot;&gt;this &quot;forensics&quot; report&lt;/a&gt;. In this blogpost, I debunk that report.&lt;/p&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;p&gt;I suppose calling somebody a &quot;conspiracy theorist&quot; is insulting, but there&#39;s three objective ways we can identify them as such.&lt;/p&gt;&lt;p&gt;The first is when they use the logic &quot;&lt;b&gt;everything we can&#39;t explain is proof of the conspiracy&lt;/b&gt;&quot;. In other words, since there&#39;s no other rational explanation, the only remaining explanation is the conspiracy-theory. But there can be other possible explanations -- just ones unknown to the person because they aren&#39;t smart enough to understand them. We see that here: the person writing this report doesn&#39;t understand some basic concepts, like &quot;airgapped&quot; networks.&lt;/p&gt;&lt;p&gt;This leads to the second way to recognize a conspiracy-theory, when it &lt;b&gt;demands this one thing&lt;/b&gt;&amp;nbsp;that&#39;ll clear things up. Here, it&#39;s demanding that a manual audit/recount of Mesa County be performed. But it won&#39;t satisfy them. The Maricopa audit in neighboring Colorado, whose recount found no fraud, didn&#39;t clear anything up -- it just found more anomalies demanding more explanation. It&#39;s like Obama&#39;s birth certificate. The reason he ignored demands to show it was that first, there was no serious question (even if born in Kenya, he&#39;d still be a natural born citizen -- just like how Cruz was born in Canada and McCain in Panama), and second, showing the birth certificate wouldn&#39;t change anything at all, as they&#39;d just claim it was fake. There is no possibility of showing a birth certificate that can be proven isn&#39;t fake.&lt;/p&gt;&lt;p&gt;The third way to objectively identify a conspiracy theory is when they &lt;b&gt;repeat objectively crazy things. &lt;/b&gt;In this case, they keep demanding that the 2020 election be &quot;decertified&quot;. That&#39;s not a thing. There is no regulation or law where that can happen. The most you can hope for is to use this information to prosecute the fraudster, prosecute the elections clerk who didn&#39;t follow procedure, or convince legislators to change the rules for the next election. But there&#39;s just no way to change the results of the last election even if wide spread fraud is now proven.&lt;/p&gt;&lt;p&gt;The document makes 6 individual claims. Let&#39;s debunk them one-by-one.&lt;/p&gt;&lt;p&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;#1 Data Integrity Violation&lt;/b&gt;&lt;/p&gt;&lt;p&gt;The report tracks some logs on how some votes were counted. It concludes:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;If the reasons behind these findings cannot be adequately explained, then the county&#39;s election results are indeterminate and must be decertified.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;This neatly demonstrates two conditions I cited above. The analyst can&#39;t explain the anomaly not because something bad happened, but because they don&#39;t understand how Dominion&#39;s voting software works. This demand for an explanation is a common attribute of conspiracy theories -- the ignorant keep finding things they don&#39;t understand and demand somebody else explain them.&lt;/p&gt;&lt;p&gt;Secondly, there&#39;s the claim that the election results must be &quot;decertified&quot;. It&#39;s something that Trump and his supporters believe is a thing, that somehow the courts will overturn the past election and reinstate Trump. This isn&#39;t a rational claim. It&#39;s not how the courts or the law works or the Constitution works.&lt;/p&gt;&lt;p&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;#2 Intentional purging of Log Files&lt;/b&gt;&lt;/p&gt;&lt;p&gt;This is the issue that convinced Tina Peters to go rogue, that the normal Dominion software update gets rid of all the old system-log files. She leaked two disk-images, before and after the update, to show the disappearance of system-logs. She believes this violates the law demanding the &quot;election records&quot; be preserved. She claims because of this, the election can&#39;t be audited.&lt;/p&gt;&lt;p&gt;Again, we are in crazy territory where they claim things that aren&#39;t true. System-logs aren&#39;t considered election records by any law or regulation. Moreover, they can&#39;t be used to &quot;audit&quot; an election.&lt;/p&gt;&lt;p&gt;Currently, no state/county anywhere treats system-logs as election records (since they can&#39;t be used for &quot;audits&quot;). Maybe this should be different. Maybe you can create a lawsuit where a judge rules that in future elections they must be treated as election records. Maybe you can convince legislatures to pass laws saying system-logs must be preserved. It&#39;s not crazy to say this should be different in the future, it&#39;s just crazy to say that past system-logs were covered under the rules.&lt;/p&gt;&lt;p&gt;And if you did change the rules, the way to preserve them wouldn&#39;t be to let them sit on the C: boot-drive until they eventually rot and disappear (which will eventually happen no matter what). Instead, the process to preserve them would be to copy them elsewhere. The way Dominion works is that all election records that need to be preserved are copied over to the D: data drive.&lt;/p&gt;&lt;p&gt;Which means, by the way, that this entire forensics report is bogus. The Mesa disk image was only of the C: boot-drive, not of the D: data drive. Thus, it&#39;s unable to say which records/logs were preserved or not. Everyone knows that system-logs probably weren&#39;t, because they aren&#39;t auditable election records, so you can still make the claim &quot;system-logs weren&#39;t preserved&quot;. It&#39;s just that you couldn&#39;t make that claim based on a forensics of the C: boot-drive. Again, we are in crazy statements territory that identify something as a conspiracy-theory, weird claims about how reality works.&lt;/p&gt;&lt;p&gt;System-logs cannot be used to audit the vote. That&#39;s confusing the word &quot;audit&quot; with &quot;forensics&quot;. The word &quot;audit&quot; implies you are looking for a definitive result, like whether the vote count was correct, or whether all procedures were followed. Forensics of system-logs can&#39;t tell you that. Instead, they can only lead to indeterminate results.&lt;/p&gt;&lt;p&gt;That&#39;s what you see here. This &quot;forensics&quot; report cannot make any definitive statement based upon the logs. It can find plenty of anomalies, meaning things the forensics investigator can&#39;t understand. But none of that is positive proof of anything. If a hacker had flipped votes on this system, it&#39;s unlikely we would have seen evidence in the log.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;#3 Evidence of network connection&lt;/b&gt;&lt;/p&gt;&lt;p&gt;The report claims the computer was connected to a network. Of course this is true -- it&#39;s not a problem. The network was the one shown in the diagram below:&lt;/p&gt;&lt;p&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgalVSOCVg48IG-YRkAitL7VXceV_fsZF6YE0UrICZ97HzcUceIONmufZz_7R72jjBYe7w0slDtJe2YUDVfYlQz3XrHM-2PeyoRJy296CWIFQE1R752E5srZyjeFP55iO_GWy4n/&quot; style=&quot;margin-left: 1em; margin-right: 1em; text-align: center;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;1214&quot; data-original-width=&quot;2048&quot; height=&quot;190&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgalVSOCVg48IG-YRkAitL7VXceV_fsZF6YE0UrICZ97HzcUceIONmufZz_7R72jjBYe7w0slDtJe2YUDVfYlQz3XrHM-2PeyoRJy296CWIFQE1R752E5srZyjeFP55iO_GWy4n/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&lt;p&gt;Specifically, this Mesa image was of the machine labeled &quot;EMS Server&quot; in the above diagram. From my forensics of the network logs, I can see that there are other computers on this network:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ol style=&quot;text-align: left;&quot;&gt;&lt;li&gt;Four ICC workstations (named ICC01 through ICC04)&lt;/li&gt;&lt;li&gt;Two Adjudication Workstations (named ADJCLIENT01 and ADJCLINET03, I don&#39;t know what happened to number 2).&lt;/li&gt;&lt;li&gt;Two EMS Workstations (named EMSCLIENT01 and EMSCLIENT02).&lt;/li&gt;&lt;li&gt;A printer, model Dell E310dw.&lt;/li&gt;&lt;/ol&gt;&lt;div&gt;The word &quot;airgapped&quot; doesn&#39;t mean the EMS Server is airgapped from any network, but that this entire little network is airgapped from anything else. The security of this network is physical security, the fact that nobody can enter the room who isn&#39;t authorized.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;I did my own forensics on the Mesa image and could find none of the normal signs that the server accessed the Internet, and pretty good evidence that most of the time, it was unconnected (it gets mad when it can&#39;t find the Internet and produces logs stating this). This doesn&#39;t mean I proved conclusively no Internet connection was ever made. It&#39;s possible that somebody will find some new thing in that image that shows an Internet connection. It&#39;s just that currently, there&#39;s no reason to believe the &quot;airgap&quot; guarantee of security was violated.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The claimed evidence about the &quot;Microsoft Report Server&quot; is wrong.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;#4 Lack of Software Updates&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This is just stupid. The cybersecurity community does have this weird fetish demanding that every software update be applied immediately, but there&#39;s good reasons why they aren&#39;t, and ways of mitigating the security risk when they can&#39;t be applied.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Software updates sometimes break things. In sensitive environments where computers must be absolutely predictable, they aren&#39;t applied. This includes live financial systems, medical equipment, and industrial control systems.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This also includes elections. It&#39;s simply not acceptable canceling or delaying an election because a software update broke the computer.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This is why Dominion does what they call a &quot;Trusted Build&quot; process that wipes out the boot-drive (deleting system-logs). To update software, they build an entire new boot image with all the software in a tested, known state. They then apply that boot disk image to all the county machines, which replaces everything on the C: boot-drive with a new version of Windows and all the software. This leaves the D: data drive untouched, where the records are preserved.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;If you didn&#39;t do things this way, then sometimes elections will fail.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This is also why having an &quot;airgapped&quot; network is important. The voting machines aren&#39;t going to have software updates regularly applied, so they need to be protected. Firewalls would also be another mitigation strategy.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;#5 Existence of SQL Server Management Studio.&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This is just a normal part of having an SQL server installed.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Yes, in theory it would make it easy for somebody to change records in the database. But at the same time, such a thing is pretty easy even without SSMS installed. One way is command-line scripts.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;#6 Referential Integrity&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This &quot;referential integrity&quot; is a reliability concern, not an anti-hacking measure. It just means hackers would need only an extra step if they wanted to delete or change records.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;Conclusion&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/div&gt;&lt;div&gt;Evidence is something that the expert understands. It&#39;s something they can show, explain, and defend against challengers.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This report contained none of that. It contained instead anomalies the writer couldn&#39;t explain.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Note that this doesn&#39;t mean they weren&#39;t an expert. Obviously, they needed enough expertise to get as far as they did. It&#39;s just a consequence of conspiracy-theories. When searching for proof of your conspiracy-theory when there is none, it means going off into the weeds past your are of expertise.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Give that forensics image to any expert, and they&#39;ll find anomalies they can&#39;t explain. That includes me, I&#39;ve posted some of them to Twitter and had other experts explain them to me. The difference is that I attributed the lack of an explanation to my own ignorance, not a conspiracy.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;At some point, we have to call out conspiracy-theories for what they are. This isn&#39;t defending the integrity of elections. If it were, it&#39;d be proposing solutions for future elections. Instead, it&#39;s an attack on the integrity of elections, fighting the peaceful transfer of power by unfounded conspiracy-theory claims.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;And we can say this objectively. As I stated above, there&#39;s three objective tests. These are:&lt;/div&gt;&lt;div&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;Anomalies that can&#39;t be explained are claimed to be evidence -- when in fact they come from simple ignorance.&lt;/li&gt;&lt;li&gt;Demands that something needs explaining, when it really doesn&#39;t, and which won&#39;t satisfy them anyway.&lt;/li&gt;&lt;li&gt;Statements of a world view (like that the election can be &quot;decertified&quot; or that system-logs are &quot;election records&quot;) that nobody agrees with.&lt;/li&gt;&lt;/ul&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;p&gt;&lt;/p&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/4064086299244535941/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=4064086299244535941' title='1 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/4064086299244535941'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/4064086299244535941'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/10/fact-check-that-forensics-of-mesa-image.html' title='Fact check: that &quot;forensics&quot; of the Mesa image is crazy'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgalVSOCVg48IG-YRkAitL7VXceV_fsZF6YE0UrICZ97HzcUceIONmufZz_7R72jjBYe7w0slDtJe2YUDVfYlQz3XrHM-2PeyoRJy296CWIFQE1R752E5srZyjeFP55iO_GWy4n/s72-c" height="72" width="72"/><thr:total>1</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-6542937840234381358</id><published>2021-10-10T20:35:00.002-04:00</published><updated>2021-10-10T20:35:49.145-04:00</updated><title type='text'>100 terabyte home NAS</title><content type='html'>&lt;p&gt;So, as a nerd, let&#39;s say you need 100 terabytes of home storage. What do you do?&lt;/p&gt;&lt;p&gt;My solution would be a commercial NAS RAID, like from &lt;a href=&quot;http://amazon.com/dp/B095NW9576&quot;&gt;Synology&lt;/a&gt;, &lt;a href=&quot;https://www.amazon.com/dp/B08P42JR89&quot;&gt;QNAP&lt;/a&gt;, or &lt;a href=&quot;https://www.amazon.com/dp/B07Y2BJWLT&quot;&gt;Asustor&lt;/a&gt;. I&#39;m a nerd, and I have setup my own Linux systems with RAID, but I&#39;d rather get a commercial product. When a disk fails, and a disk will always eventually fail, then I want something that will loudly beep at me and make it easy to replace the drive and repair the RAID.&lt;/p&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;p&gt;Some choices you have are:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;vendor (Synology, QNAP, and Asustor are the vendors I know and trust the most)&lt;/li&gt;&lt;li&gt;number of bays (you want 8 to 12)&lt;/li&gt;&lt;li&gt;redundancy (you want at least 2 if not 3 disks)&lt;/li&gt;&lt;li&gt;filesystem (btrfs or ZFS) [not btrfs-raid builtin, but btrfs on top of RAID]&lt;/li&gt;&lt;li&gt;drives (NAS optimized between $20/tb and $30/tb)&lt;/li&gt;&lt;li&gt;networking (at least 2-gbps bonded, but box probably can&#39;t use all of 10gbps)&lt;/li&gt;&lt;li&gt;backup (big external USB drives)&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;The products I link above all have at least 8 drive bays. When you google &quot;NAS&quot;, you&#39;ll get a list of smaller products. You don&#39;t want them. You want somewhere between 8 and 12 drives.&lt;/p&gt;&lt;p&gt;The reason is that you want &lt;b&gt;two-drive redundancy&lt;/b&gt;&amp;nbsp;like RAID6 or RAIDZ2, meaning two additional drives. Everyone tells you one-disk redundancy (like RAID5) is enough, they are wrong. It&#39;s just legacy thinking, because it was sufficient in the past when drives were small. Disks are so big nowadays that you really need two-drive redundancy. If you have a 4-bay unit, then half the drives are used for redundancy. If you have a 12-bay unit, then only 2 out of the 12 drives are being used for redundancy.&lt;/p&gt;&lt;p&gt;The next decision is the filesystem. There&#39;s only two choices, &lt;i&gt;btrfs&lt;/i&gt;&amp;nbsp;and &lt;i&gt;ZFS&lt;/i&gt;. The reason is that they both &lt;b&gt;healing&lt;/b&gt;&amp;nbsp;and &lt;b&gt;snapshots&lt;/b&gt;. Note btrfs means btrfs-on-RAID6, not btrfs-RAID, which is broken. In other words, btrfs contains its own RAID feature that you don&#39;t want to use.&lt;/p&gt;&lt;p&gt;Over long periods of time, errors creep into the file system. You want to scrub the data occasionally. This means reading the entire filesystem, checksuming the files, and repairing them if there&#39;s a problem. That requires a filesystem that checksums each block of data.&lt;/p&gt;&lt;p&gt;Another thing you want snapshots to guard against things like ransomware. This means you mark the files you want to keep, and even if a workstation attempts to change or delete the file, it&#39;ll still be held on the disk.&lt;/p&gt;&lt;p&gt;QNAP uses ZFS while others like Synology and Asustor use btrfs. I really don&#39;t know which is better.&lt;/p&gt;&lt;p&gt;It&#39;s cheaper to buy the NAS diskless then add your own disk drives. If you can&#39;t do this, then you&#39;ll be helpless when a drive fails and needs to be replaced.&lt;/p&gt;&lt;p&gt;Drives cost between $20/tb and $30/tb right now. This &lt;a href=&quot;https://www.anandtech.com/show/12075/best-consumer-hdds&quot;&gt;recent article&lt;/a&gt; has a good buying guide. You probably want to get a NAS optimized hard drive. You probably want to double-check that it&#39;s CMR instead of SMR -- SMR is &quot;shingled&quot; vs. &quot;conventional&quot; magnetic recording. SMR is bad. There&#39;s only three hard drive makers (Seagate, Western Digital, and Toshiba), so there&#39;s not a big selection.&lt;/p&gt;&lt;p&gt;Working with such large data sets over 1-gbps is painful. These units allow 802.3ad link aggregation as well as faster Ethernet. Some have 10gbe built-in, others allow a &lt;a href=&quot;https://www.amazon.com/dp/B07G9N9KJT&quot;&gt;PCIe adapter&lt;/a&gt; to be plugged in.&lt;/p&gt;&lt;p&gt;However, due to the overhead of spinning disks, you are unlikely to get 10gbps speeds. I mention this because 10gbps copper Ethernet sucks, so is not necessarily a buying criteria. You may prefer multigig/NBASE-T that only does 5gbps with relaxed cabling requirements and lower power consumption.&lt;/p&gt;&lt;p&gt;This means that your NAS decision is going to be made with your home networking decision. I use a couple of these &lt;a href=&quot;https://amazon.com/dp/B075Q6NPM2&quot;&gt;multigig switches&lt;/a&gt; as something that doesn&#39;t cost too much for home networking.&lt;/p&gt;&lt;p&gt;Even though RAID is pretty darn reliable, you still need a backup solution. The way I do this is wither &lt;a href=&quot;https://www.amazon.com/dp/B08KTRBHP1&quot;&gt;external USB hard drives&lt;/a&gt;. I schedule the NAS to backup to those drives automatically. As a home user, tapes aren&#39;t an effective solution, so you are stuck with USB drives.&lt;/p&gt;&lt;p&gt;In the end, this means that your total storage costs, with the NAS server, the drives, and the backup drives, is going to cost you 3x the price of the raw storage. Spinning drives fail often. If you plan on keeping your data around for the next decade, there&#39;s no way to do this without 3x the cost for storage.&lt;/p&gt;&lt;p&gt;I choose Synology because I have the most familiarity with the software, and its software gets the best reviews. But QNAP and Asustor also have great reputations.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Note that I&#39;ve made the assumption here that you&#39;ll want &quot;desktop NAS&quot; solutions. There are also rackmount solutions available.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/6542937840234381358/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=6542937840234381358' title='2 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/6542937840234381358'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/6542937840234381358'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/10/100-terabyte-home-nas.html' title='100 terabyte home NAS'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><thr:total>2</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-895858219046543988</id><published>2021-09-24T03:12:00.013-04:00</published><updated>2021-09-24T14:06:44.604-04:00</updated><title type='text'>Check: that Republican audit of Maricopa</title><content type='html'>&lt;p&gt;Author: Robert Graham (@erratarob)&lt;/p&gt;&lt;p&gt;Later today (Friday, September 24, 2021), Republican auditors release their final report on what they found with elections in Maricopa county. Draft copies of the report have already circulated online. In this blogpost, I write up my comments on the cybersecurity portions of their draft.&lt;/p&gt;&lt;p&gt;&lt;a href=&quot;https://arizonaagenda.substack.com/p/we-got-the-senate-audit-report&quot;&gt;https://arizonaagenda.substack.com/p/we-got-the-senate-audit-report&lt;/a&gt;&lt;/p&gt;&lt;p&gt;The three main problems are:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;They misapply cybersecurity principles that are meaningful for normal networks, but which don’t really apply to the &quot;air gapped&quot; networks we see here.&lt;/li&gt;&lt;li&gt;They make some errors about technology, especially networking.&lt;/li&gt;&lt;li&gt;They are overstretching themselves to find dirt, claiming the things they don&#39;t understand are evidence of something bad.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;In the parts below, I pick apart individual pieces from that document to demonstrate these criticisms. I focus on section 7, the cybersecurity section, and ignore the other parts of the document, where others are more qualified than I to opine.&lt;/p&gt;&lt;p&gt;In short, when corrected, section 7 is nearly empty of any content.&lt;/p&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;p&gt;&lt;b&gt;7.5.2.1.1 Software and Patch Management, part 1&lt;/b&gt;&lt;/p&gt;&lt;p&gt;They claim Dominion is defective at one of the best-known cyber-security issues: applying patches.&lt;/p&gt;&lt;p&gt;It’s not true. The systems are “air gapped”, disconnected from the typical sort of threat that exploits unpatched systems. The primary security of the system is physical. Frequent patching isn&#39;t expected.&lt;/p&gt;&lt;p&gt;This is a standard in other industries with hard reliability constraints, like industrial or medical. Patches in those systems can destabilize computers and kill people, so these industries are risk averse and resist applying them. They prefer to mitigate the threat in other ways, such as with firewalls and air gaps.&lt;/p&gt;&lt;p&gt;Yes, this approach is controversial. There are some in the cybersecurity community who use lack of patches as a bludgeon with which to bully any who don’t apply every patch immediately. But this is because patching is more a political issue than a technical one. In the real, non-political world we live in, most things don’t get immediately patched all the time.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;7.5.2.1.1 Software and Patch Management, part 2&lt;/b&gt;&lt;/p&gt;&lt;p&gt;The auditors claim new software executables were applied to the system, despite the rules against new software being applied. This isn’t necessarily true.&lt;/p&gt;&lt;p&gt;There are many reasons why Windows may create new software executables even when no new software is added. One reason is “Features on Demand” or FOD. You’ll see new executables appear in &lt;i&gt;C:\Windows\WinSxS&lt;/i&gt; for these. Another reason is their .NET language, which causes binary x86 executables to be created from bytecode. You’ll see this in the &lt;i&gt;C:\Windows\assembly&lt;/i&gt; directory.&lt;/p&gt;&lt;p&gt;The auditors simply counted the number of new executables, with no indication which category they fell into. Maybe they are right, maybe new software was installed or old software updated. It’s just that their mere counting of executable files doesn’t show understanding of these differences.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;7.5.2.1.2 Log Management&lt;/b&gt;&lt;/p&gt;&lt;p&gt;The auditors claim that a central log management system should be used.&lt;/p&gt;&lt;p&gt;This obviously wouldn’t apply to “air gapped” systems, because it would need a connection to an external network.&lt;/p&gt;&lt;p&gt;Dominion already designates their EMSERVER as the central log repository for their little air gapped network. Important files from C: are copied to D:, a RAID10 drive. This is a perfectly adequate solution, adding yet another computer to their little network would be overkill, and add as many security problems as it solved.&lt;/p&gt;&lt;p&gt;One could argue more Windows logs need to be preserved, but that would simply mean archiving the from the C: drive onto the D: drive, not that you need to connect to the Internet to centrally log files.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;7.5.2.1.3 Credential Management&lt;/b&gt;&lt;/p&gt;&lt;p&gt;Like the other sections, this claim is out of place given the airgapped nature of the network.&lt;/p&gt;&lt;p&gt;Dominion simply uses “role based security” instead of normal user accounts. It’s a well known technique, and considered very appropriate for this sort of environment.&lt;/p&gt;&lt;p&gt;The auditors claim account passwords must “be changed every 90 days”. This is a well-know fallacy in cybersecurity. It took years to get NIST to remove it from their recommendations. If CISA still has it in their recommendations for election systems, then CISA is wrong.&lt;/p&gt;&lt;p&gt;Ideally, accounts wouldn’t be created until they were needed. In practice, system administrators aren’t available (again, it’s an airgapped system, so no remote administration). Dominions alternative is to create the accounts ahead of time, suc has “adjuser09”, waiting for the 9th person you hire that might use that account.&lt;/p&gt;&lt;p&gt;They are all given the same default password to start, like “Arizona2019!!!”. Some customers choose to change the default password, but obviously Maricopa did not. This is weak – but not a big deal, since the primary security is from controlling physical access.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;7.5.2.1.4 Lack of Baseline for Host and Network Activity&lt;/b&gt;&lt;/p&gt;&lt;p&gt;They claim sort of baselining should be done. This is absurd. Baselines are always problematic, but would be especially so in this case.&lt;/p&gt;&lt;p&gt;The theory of baselines is that a networks traffic is somewhat predictable on a day-to-day basis. This obviously doesn’t apply to elections systems, which are highly variable day-to-day, especially on election day.&lt;/p&gt;&lt;p&gt;Baselining is the sort of thing you do with a dedicated threat hunting team. It’s incredibly inappropriate for a small installation like this.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;7.5.3.1.1 Network Related Data&lt;/b&gt;&lt;/p&gt;&lt;p&gt;The auditors asked for an unreasonable access to network data, in the worst way possible, triggering the refusal to hand it over. They didn’t ask for reasonable data. They blame Maricopa Count for the conflict, but it’s really themselves who are to blame.&lt;/p&gt;&lt;p&gt;A reasonable request would take the MAC addresses from the election machines and ask for any matching records the Maricopa might have in their Splunk, DHCP, or ARP logs. Matches shouldn’t be found, but if they were, the auditors should then ask for flow data for the associated IP addresses.&lt;/p&gt;&lt;p&gt;They are correct in identifying this as a very important issue. Dominion security depends upon an airgap. If auditors find a netowrk connection, it’s bad. It’s not catastrophic, and sometimes machines are disconnected from one network and attached to a network during other times than the election. But this would very much be a useful part of a report – if only they had made a reasonable request that didn’t demand Maricopa spend their entire yearly budget to comply.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;7.5.3.1.? Other Devices Connected to the Election Network&lt;/b&gt;&lt;/p&gt;&lt;p&gt;The auditors complain they weren’t given access to the router identified by 192.168.100.1.&lt;/p&gt;&lt;p&gt;It probably doesn’t exist.&lt;/p&gt;&lt;p&gt;Routers aren’t needed by devices that are on the same local Ethernet. They wouldn’t exist on a single-segment air gapped network. But typical operating-system configuration demands one be configured anyway, so it’s common to put in a dummy router address even if it’s unused.&lt;/p&gt;&lt;p&gt;If you see messages like this one in the logs, it means the router wasn’t there:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLvMyKpknq6gxajDiGa0oGRwG9tnL2OUnYo-a96PEu3zwdfu7rFjBnCLet9wokriLWZmup0qNyWBu5YZqhBzTr3KsaPM0FXeG_I9uUvdhZUwA1HH_RzEJrYinvqhCyIw8BDrO_/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;237&quot; data-original-width=&quot;577&quot; height=&quot;131&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLvMyKpknq6gxajDiGa0oGRwG9tnL2OUnYo-a96PEu3zwdfu7rFjBnCLet9wokriLWZmup0qNyWBu5YZqhBzTr3KsaPM0FXeG_I9uUvdhZUwA1HH_RzEJrYinvqhCyIw8BDrO_/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;The auditors are right in identifying this as an important issue. If there were such a router, then this would cast doubt whether the network was “airgapped”.&lt;p&gt;&lt;/p&gt;&lt;p&gt;Note that if such a router did exist, it would almost certainly be a NAT. This would still offer some firewall protection, just not as strong as an air gap.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;7.5.4 Anonymous Logins&lt;/b&gt;&lt;/p&gt;&lt;p&gt;They see something in the security logs they don’t understand, and blame Maricopa’s lack of network data (&quot;the routers&quot;) for their inability to explain it.&lt;/p&gt;&lt;p&gt;This is an extraordinarily inappropriate claim, based not on expert understanding of what they see in the logs, but complete ignorance. There’s no reason to believe that getting access to Maricopa Count network logs would explain what’s going on here.&lt;/p&gt;&lt;p&gt;This demonstrates they are on a phishing expedition, and that everything they see that they can’t explain is used as evidence of a conspiracy, either of Maricopa to withhold data, or of election fraud.&lt;/p&gt;&lt;p&gt;The Dominion suite of applications and services is oddly constructed and will produce anomalies. Comparing against a general Windows server not running Dominion’s suite is meaningless.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;7.5.5 Dual Boot System Discovered&lt;/b&gt;&lt;/p&gt;&lt;p&gt;The auditors claim something about “dual-homed hosts” or “jump-boxes”. That’s not how these terms are normally used. These terms normally refer to a box with access to two separate networks, not a box with two separate operating systems.&lt;/p&gt;&lt;p&gt;This requires no nefarious explanation. This is commonly seen in corporate networks, either because somebody simply added a new drive to re-install the operating-system, or repurposed an old drive from another system as a data drive, and simply forgot to wipe it. The BIOS points to one they intend to boot from and ignore the fact that the other can also boot.&lt;/p&gt;&lt;p&gt;There are endless non-nefarious explanations for what is seen here that doesn’t require a nefarious one. It’s not even clear its a failure of their build process, which focuses on what’s on the boot drive and not what’s on other drives in the system.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;7.5.6 EMS Operating System Logs Not Preserved&lt;/b&gt;&lt;/p&gt;&lt;p&gt;It is true the EMS operating-system logs are not preserved (well, generally not preserved). By this I refer to the generic Windows logs, the same logs that your own Windows desktop keeps.&lt;/p&gt;&lt;p&gt;The auditors falsely claim that this violates the law. This is false. The “electron records” laws don’t cover the operating-system. The laws instead are intended to preserve the records of the election software running on top of the operating-system, not those of the operating-system itself.&lt;/p&gt;&lt;p&gt;This issue has long been known. You don’t need an auditor’s report to tell you that these logs aren’t generally preserved – everyone has known this for a long time, including those who certified Dominion.&lt;/p&gt;&lt;p&gt;The subtext of this claim is the continued argument by Republicans that the fact they can’t find evidence for 2020 election fraud is because key data is missing. That’s the argument of Tina Peters, the former clerk of a county in the neighboring state of Colorado, who claims their elections cannot be audited because they don’t have the Windows operating-system logs.&lt;/p&gt;&lt;p&gt;It’s not true. System logs are as likely to cause confusion, as they do above with the “anonymous logins” issue. They are unlikely to provide proof of votes being flipped in a hack. If there was massive fraud, as detected by recounts of paper ballots, I’d certainly want such system logs to search for how it happened. But I wouldn’t use such logs in order to audit the vote.&lt;/p&gt;&lt;p&gt;Note that the description of “deleting” log entries by overfilling the logs is wrong. If it were important to preserve such logs, then they would be copied right after the election. They wouldn’t be left to rot on the boot drive for months afterwards.&lt;/p&gt;&lt;p&gt;As a forensics guy, I would certainly support the idea that Dominion should both enable more logs and preserve them after each election. They don’t require excessive storage and can be saved automatically in the last phase of an election. But their lack really isn’t all that important, they are mostly just full of junk.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Conclusion&lt;/b&gt;&lt;/p&gt;&lt;p&gt;We live in a pluralistic democracy, meaning there are many centers of power, each competing with each other. It&#39;s inherently valid for one side to question and challenge the other side. But this can go too far, to the point where you are challenging the stability of our republic.&lt;/p&gt;&lt;p&gt;The Republican party is split. Some are upholding that principle of pluralism, wanting to make sure future elections are secure and fair. Others are attacking that principle, challenging the peaceful transfer of power in the last election with baseless accusations of fraud.&lt;/p&gt;&lt;p&gt;This split is seen in Arizona, where Republicans have demanded an audit by highly partisan auditors. An early draft of their report straddles that split, containing some reasonable attempt to create recommendations for future elections, while simultaneous providing fodder for the other side to believe the last election was stolen.&lt;/p&gt;&lt;p&gt;A common problem with auditors is that when they can’t find the clear evidence they were looking for, the fill their reports with things they don’t understand. I think I see that here. The auditors make technical errors in ways that question their competence, but that’s likely not true. Instead, they kept searching past where they were strong into areas where they were weak, looking for as much dirt as possible. Thus, in this report, we see where they are technically weak.&lt;/p&gt;&lt;p&gt;Trumpists, meaning those attacking the peaceful transfer of power with baseless accusations of fraud, will certainly use this report to champion their cause, despite the headline portion that confirms the vote count. But for the rest of us, we should welcome this report. Elections do need to be fixed, and while it’s unlikely we’ll fix them in the ways suggested in this report, it will add visibility into the process which we can use to debate improvements.&lt;/p&gt;&lt;div&gt;This blogpost is only a first draft. While the technical bits in section 7 look fairly straightforward to me, I&#39;m guessing that people who don&#39;t understand them will come up with weird conspiracy-theories about them. Thus, I&#39;m guessing I&#39;ll have to write another blogpost in a week debunking some of the crazier ideas.&lt;/div&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/895858219046543988/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=895858219046543988' title='12 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/895858219046543988'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/895858219046543988'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/09/check-that-republican-audit-of-maricopa.html' title='Check: that Republican audit of Maricopa'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiLvMyKpknq6gxajDiGa0oGRwG9tnL2OUnYo-a96PEu3zwdfu7rFjBnCLet9wokriLWZmup0qNyWBu5YZqhBzTr3KsaPM0FXeG_I9uUvdhZUwA1HH_RzEJrYinvqhCyIw8BDrO_/s72-c" height="72" width="72"/><thr:total>12</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-436861897425412865</id><published>2021-09-21T18:01:00.004-04:00</published><updated>2021-09-26T11:56:50.068-04:00</updated><title type='text'>That Alfa-Trump Sussman indictment</title><content type='html'>&lt;p&gt;Five years ago, online magazine Slate broke a &lt;a href=&quot;http://www.slate.com/articles/news_and_politics/cover_story/2016/10/was_a_server_registered_to_the_trump_organization_communicating_with_russia.html&quot;&gt;story&lt;/a&gt; about how DNS packets showed secret communications between Alfa Bank in Russia and the Trump Organization, proving a link that Trump denied. I was the only prominent tech expert that debunked this as just a conspiracy-theory[&lt;a href=&quot;https://blog.erratasec.com/2016/11/debunking-trumps-secret-server.html&quot;&gt;*&lt;/a&gt;][&lt;a href=&quot;https://blog.erratasec.com/2016/11/in-which-i-have-to-debunk-second-time.html&quot;&gt;*&lt;/a&gt;][&lt;a href=&quot;https://blog.erratasec.com/2017/03/fbi-what-to-look-for-in-trumpalfabank.html&quot;&gt;*&lt;/a&gt;].&lt;/p&gt;&lt;p&gt;Last week, I was vindicated by the&amp;nbsp;&lt;a href=&quot;https://s3.documentcloud.org/documents/21063441/sussmann.pdf&quot;&gt;indictment&lt;/a&gt;&amp;nbsp;of a lawyer involved, a Michael Sussman. It tells a story of where this data came from, and some problems with it.&lt;/p&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;p&gt;But we should first avoid reading too much into this indictment. It cherry picks data supporting its argument while excluding anything that disagrees with it. We see chat messages expressing doubt in the DNS data. If chat messages existed expressing confidence in the data, we wouldn&#39;t see them in the indictment.&lt;/p&gt;&lt;p&gt;In addition, the indictment tries to make strong ties to the Hillary campaign and the Steele Dossier, but ultimately, it&#39;s weak. It looks to me like an outsider trying to ingratiated themselves with the Hillary campaign rather than there being part of a grand Clinton-lead conspiracy against Trump.&lt;/p&gt;&lt;p&gt;With these caveats, we do see some important things about where the data came from.&lt;/p&gt;&lt;p&gt;We see how Tech-Executive-1 used his position at cyber-security companies to search private data (namely, private DNS logs) to search for anything that might link Trump to somebody nefarious, including Russian banks. In other words, a link between Trump and Alfa bank wasn&#39;t something they accidentally found, it was one of the many thousands of links they looked for.&lt;/p&gt;&lt;p&gt;Such a technique has been long known as a problem in science. If you cast the net wide enough, you are sure to find things that would otherwise be statistically unlikely. In other words, if you do hundreds of tests of hydroxychloroquine or invermectin on Covid-19, you are sure to find results that are so statistically unlikely that they wouldn&#39;t happen more than 1% of the time.&lt;/p&gt;&lt;p&gt;If you search world-wide DNS logs, you are certain to find weird anomalies that you can&#39;t explain. Unexplained computer anomalies happen all the time, as every user of computers can tell you.&lt;/p&gt;&lt;p&gt;We&#39;ve seen from the start that the data was highly manipulated. It&#39;s likely that the data is real, that the DNS requests actually happened, but at the same time, it&#39;s been stripped of everything that might cast doubt on the data. In this indictment we see why: before the data was found the purpose was to smear Trump. The finders of the data don&#39;t want people to come to the best explanation, they want only explainations that hurt Trump.&lt;/p&gt;&lt;p&gt;Trump had no control over the domain in question, trump-email.com. Instead, it was created by a hotel marketing firm they hired, Cendyne. It&#39;s Cendyne who put Trump&#39;s name in the domain. A broader collection of DNS information including Cendyne&#39;s other clients would show whether this was normal or not.&lt;/p&gt;&lt;p&gt;In other words, a possible explanation of the data, hints of a Trump-Alfa connection, has always been the dishonesty of those who collected the data. The above indictment confirms they were at this level of dishonesty. It doesn&#39;t mean the DNS requests didn&#39;t happen, but that their anomalous nature can be created by deletion of explanatory data.&lt;/p&gt;&lt;p&gt;Lastly, we see in this indictment the problem with &quot;experts&quot;.&lt;/p&gt;&lt;p&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkL_j3i3ThTFlnuLbPWw0O3aeAIxqG5F2zPmGTPQaT8fzxA-3Db6V86LjsxtBtEAUky9knXSQmGGSaZsvDNQQZQHlZbls8DLx-lmisAGKBZ07SDJ0h2Ocd5NApfO05KXmpfNcr/s1186/Screen+Shot+2021-09-16+at+9.03.23+PM.png&quot; style=&quot;margin-left: 1em; margin-right: 1em; text-align: center;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;220&quot; data-original-width=&quot;1186&quot; height=&quot;59&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkL_j3i3ThTFlnuLbPWw0O3aeAIxqG5F2zPmGTPQaT8fzxA-3Db6V86LjsxtBtEAUky9knXSQmGGSaZsvDNQQZQHlZbls8DLx-lmisAGKBZ07SDJ0h2Ocd5NApfO05KXmpfNcr/s320/Screen+Shot+2021-09-16+at+9.03.23+PM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&lt;p&gt;Sadly, this didn&#39;t happen. Even experts are biased. The original Slate story quoted Paul Vixie, who hates Trump, who was willing to believe it rather than question it. It&#39;s not necessarily Vixie&#39;s fault: the Slate reporter gave the experts they quoted a brief taste of the data, then pretended their response was a full in-depth analysis, rather than a quick hot-take. It&#39;s not clear that Vixie really still stands behind the conclusions in the story.&lt;/p&gt;&lt;p&gt;But of the rest of the &quot;experts&quot; in the field, few really care. Most hate Trump, and therefore, wouldn&#39;t challenge anything that hurts Trump. Experts who like Trump also wouldn&#39;t put the work into it, because nobody would listen to them. Most people choose sides -- they don&#39;t care about the evidence.&lt;/p&gt;&lt;p&gt;This indictment vindicates my analysis in those blogposts linked above. My analysis shows convincingly that Trump had no real connection to the domain. I can&#39;t explain the anomaly, why Alfa Bank is so interested in a domain containing the word &quot;trump&quot;, but I can show that conspirational communications is the least likely explanation.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/436861897425412865/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=436861897425412865' title='0 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/436861897425412865'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/436861897425412865'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/09/that-alfa-trump-sussman-indictment.html' title='That Alfa-Trump Sussman indictment'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhkL_j3i3ThTFlnuLbPWw0O3aeAIxqG5F2zPmGTPQaT8fzxA-3Db6V86LjsxtBtEAUky9knXSQmGGSaZsvDNQQZQHlZbls8DLx-lmisAGKBZ07SDJ0h2Ocd5NApfO05KXmpfNcr/s72-c/Screen+Shot+2021-09-16+at+9.03.23+PM.png" height="72" width="72"/><thr:total>0</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-2180228297562107817</id><published>2021-09-14T23:07:00.009-04:00</published><updated>2021-09-15T14:19:24.002-04:00</updated><title type='text'>How not to get caught in law-enforcement geofence requests</title><content type='html'>&lt;p&gt;I thought I&#39;d write up a response to this question from well-known 4th Amendment and CFAA lawyer Orin Kerr:&lt;/p&gt;
  2. &lt;blockquote class=&quot;twitter-tweet&quot;&gt;&lt;p dir=&quot;ltr&quot; lang=&quot;en&quot;&gt;Question for tech people related to &quot;geofence&quot; warrants served on Google: How easy is it for a cell phone user, either of an Android or an iPhone, to stop Google from generating the detailed location info needed to be responsive to a geofence warrant? What do you need to do?&lt;/p&gt;— Orin Kerr (@OrinKerr) &lt;a href=&quot;https://twitter.com/OrinKerr/status/1437929337357963265?ref_src=twsrc%5Etfw&quot;&gt;September 15, 2021&lt;/a&gt;&lt;/blockquote&gt; &lt;script async=&quot;&quot; charset=&quot;utf-8&quot; src=&quot;https://platform.twitter.com/widgets.js&quot;&gt;&lt;/script&gt;
  3. &lt;blockquote class=&quot;twitter-tweet&quot; data-conversation=&quot;none&quot;&gt;&lt;p dir=&quot;ltr&quot; lang=&quot;en&quot;&gt;(FWIW, I&#39;m seeking info from people who actually know the answer based on their expertise, not from those who are just guessing, or are who are now googling around to figure out what the answer may be,)&lt;/p&gt;— Orin Kerr (@OrinKerr) &lt;a href=&quot;https://twitter.com/OrinKerr/status/1437930368523407366?ref_src=twsrc%5Etfw&quot;&gt;September 15, 2021&lt;/a&gt;&lt;/blockquote&gt; &lt;script async=&quot;&quot; charset=&quot;utf-8&quot; src=&quot;https://platform.twitter.com/widgets.js&quot;&gt;&lt;/script&gt;
  4. &lt;p&gt;First, let me address the second part of his tweet, whether I&#39;m technically qualified to answer this. I&#39;m not sure, I have only 80% confidence that I am. Hence, I&#39;m writing this answer as blogpost hoping people will correct me if I&#39;m wrong.&lt;/p&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;p&gt;&lt;b&gt;There is a simple answer&lt;/b&gt;&amp;nbsp;and it&#39;s this: just disable &quot;Location&quot; tracking in the settings on the phone. Both iPhone and Android have a one-click button to tap that disables everything.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPTvHwU1eiv8vwSiHqZvnyTrMEujwBkCEY5Vq90DyTG78bYYD3wveTrWD27V3Y9Tw_qDTItz9mk53nTLxea10UG1i0k0b6RSct7A-GyJRXE8YiLsPoQstC9OOgQWJzTyScm9ay/&quot; style=&quot;clear: right; float: right; margin-bottom: 1em; margin-left: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;2436&quot; data-original-width=&quot;1125&quot; height=&quot;240&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPTvHwU1eiv8vwSiHqZvnyTrMEujwBkCEY5Vq90DyTG78bYYD3wveTrWD27V3Y9Tw_qDTItz9mk53nTLxea10UG1i0k0b6RSct7A-GyJRXE8YiLsPoQstC9OOgQWJzTyScm9ay/&quot; width=&quot;111&quot; /&gt;&lt;/a&gt;&lt;/div&gt;The trick is knowing which thing to disable. On the iPhone it&#39;s called &quot;Location Services&quot;. On the Android, it&#39;s simply called &quot;Location&quot;.&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;If you do start googling around for answers, you&#39;ll find &lt;a href=&quot;https://apnews.com/article/north-america-science-technology-business-ap-top-news-828aefab64d4411bac257a07c1af0ecb&quot;&gt;articles&lt;/a&gt; upset that Google is still tracking them. That&#39;s because they disabled &quot;Location History&quot; and not &quot;Location&quot;. This left &quot;Location Services&quot; and &quot;Web and App Activity&quot; still tracking them. Disabling &quot;Location&quot; on the phone disables all these things [&lt;a href=&quot;https://support.google.com/accounts/answer/3467281&quot;&gt;*&lt;/a&gt;].&lt;p&gt;&lt;/p&gt;&lt;p&gt;It&#39;s that simple: one click and done, and Google won&#39;t be able to report your location in a geofence request.&lt;/p&gt;&lt;p&gt;I&#39;m pretty confident in this answer, despite what your googling around will tell you about Google&#39;s pernicious ways. But I&#39;m only 80% confident in my answer. Technology is complex and constantly changing.&lt;/p&gt;&lt;p&gt;Note that the answer is very different for mobile phone companies, like AT&amp;amp;T or T-Mobile. They have their own ways of knowing about your phone&#39;s location independent of whatever Google or Apple do on the phone itself. Because of modern 4G/LTE, cell towers must estimate both your direction and distance from the tower. I&#39;ve confirmed that they can know your location to within 50 feet. There are limitations to this, it depends upon whether you are simply in range of the tower or have an active phone call in progress. Thus, I think law enforcement prefers asking Google.&lt;/p&gt;&lt;p&gt;Another example is how my car uses Google Maps all the time, and doesn&#39;t have privacy settings. I don&#39;t know what it reports to Google. So when I rob a bank, my phone won&#39;t betray me, but my car will.&lt;/p&gt;&lt;p&gt;Note that &quot;disabling GPS&quot; isn&#39;t sufficient. I include the screenshot above because of how it mentions the phone relies upon WiFi, BlueTooth, and cell tower info to also confirm your location. Tricking GPS will do little to stop your phone from knowing your location.&lt;/p&gt;&lt;p&gt;I only know about this from the phone side of things and not actual legal cases. I&#39;d love to see the sort of geofence results the FBI gets. There might be some subtle thing that I missed about how Android works with mobile companies, such as this &lt;a href=&quot;https://qz.com/1131515/google-collects-android-users-locations-even-when-location-services-are-disabled/&quot;&gt;old story&lt;/a&gt; where Android phones reported cell tower information to Google (since removed). Or worse, there might be something completely obvious I should&#39;ve known about that everyone seems to know, but for some reason I simply forgot.&lt;/p&gt;&lt;p&gt;Both Apple and Google are upfront about what private information they do and don&#39;t track and how to disable it. Thus, while I think they may do something on accident hidden from view, I don&#39;t think there&#39;s anything going on that isn&#39;t documented. And what&#39;s documented this concern is that simply turning off the &quot;Location&quot; button.&lt;/p&gt;&lt;p&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/p&gt;&lt;hr /&gt;&lt;p&gt;&lt;b&gt;Update:&lt;/b&gt;&amp;nbsp;Many comments note that Google does log the IP address of requests, and that IP addresses can sometimes be geolocated.&lt;/p&gt;&lt;p&gt;Well, yes and no. It&#39;s not something companies log in that way. Thus, when given a geofence request for everything within a certain physical location, logs containing only IP addresses wouldn&#39;t be something covered by the request. The log would need a record of the physical location to be covered. Moreover, geolocation by IP address is incredibly inaccurate, often telling you only what city or neighborhood where the IP address is located. Even if Google logged a record of the best-guess about location, I&#39;m still not sure whether it would be an appropriate response to a geofence request.&lt;/p&gt;&lt;p&gt;In any event, this wouldn&#39;t apply to mobile IP addresses. In America, consumer mobile phones don&#39;t have public IP addresses by share the same pool of private addresses. Thus, the IP address from a mobile phone is meaningless for location purposes.&lt;/p&gt;&lt;p&gt;Now you can create a hypothetical situation like the following:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;a Capitol Hill protestor logs onto a nearby WiFi (meaning: it&#39;s not the mobile IP address in question, but the IP address of the WiFi hotspot)&lt;/li&gt;&lt;li&gt;the geolocation record of that WiFi hotspot is actually accurate&lt;/li&gt;&lt;li&gt;requests to Google resolves that geolocation when it logs the IP address&lt;/li&gt;&lt;li&gt;they give such IP/location logs in response to geofence request&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;Then, yes, my argument is defeated, a hypothetical geofence request might then get you.&lt;/p&gt;&lt;p&gt;Which I actually like. It&#39;s a good demonstration of why I doubt myself at the top of the post. I don&#39;t think this scenario is likely, and hence don&#39;t consider it a reasonable rebuttal, but &quot;unlikely&quot; doesn&#39;t mean &quot;impossible&quot;. I&#39;m still pretty confident that a one-click disabling &quot;Location&quot; is all you need to defeat geofence warrants given to Google.&lt;/p&gt;&lt;p&gt;Note that the discussion of this blogpost is just about the &quot;geofence request to Google&quot;. This &quot;Capital Hill WiFi&quot; hypothetical is unlikely to help with requests by location, but of course would for requests by IP address. Law enforcement could certainly ask Google for a list of users that came in via the Capital Hill WiFi IP address.&lt;/p&gt;&lt;/div&gt;&lt;blockquote class=&quot;twitter-tweet&quot; data-conversation=&quot;none&quot;&gt;&lt;p dir=&quot;ltr&quot; lang=&quot;en&quot;&gt;Except I bet they started with cell carriers and are being thorough. &lt;br /&gt;&lt;br /&gt;Contact Google via public wifi in the Capitol and BOOM.&lt;/p&gt;— Bob (Moderna #3) Kerns (@BobKerns) &lt;a href=&quot;https://twitter.com/BobKerns/status/1438145330374086663?ref_src=twsrc%5Etfw&quot;&gt;September 15, 2021&lt;/a&gt;&lt;/blockquote&gt; &lt;script async=&quot;&quot; charset=&quot;utf-8&quot; src=&quot;https://platform.twitter.com/widgets.js&quot;&gt;&lt;/script&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/2180228297562107817/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=2180228297562107817' title='1 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/2180228297562107817'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/2180228297562107817'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/09/how-not-to-get-caught-in-law.html' title='How not to get caught in law-enforcement geofence requests'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjPTvHwU1eiv8vwSiHqZvnyTrMEujwBkCEY5Vq90DyTG78bYYD3wveTrWD27V3Y9Tw_qDTItz9mk53nTLxea10UG1i0k0b6RSct7A-GyJRXE8YiLsPoQstC9OOgQWJzTyScm9ay/s72-c" height="72" width="72"/><thr:total>1</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-3133624835814497538</id><published>2021-07-26T20:52:00.002-04:00</published><updated>2021-07-26T20:52:15.510-04:00</updated><title type='text'>Of course you can&#39;t trust scientists on politics</title><content type='html'>Many people make the same claim as this tweet. It&#39;s obviously wrong. Yes,, the right-wing has a problem with science, but this isn&#39;t it.&lt;blockquote class=&quot;twitter-tweet&quot;&gt;&lt;p dir=&quot;ltr&quot; lang=&quot;en&quot;&gt;If you think you don&#39;t trust scientists, you&#39;re mistaken. You trust scientists in a million different ways every time you step on a plane, or for that matter turn on your tap or open a can of beans. The fact that you&#39;re unaware of this doesn&#39;t mean it&#39;s not so.&lt;/p&gt;— Paul Graham (@paulg) &lt;a href=&quot;https://twitter.com/paulg/status/1419765657080578052?ref_src=twsrc%5Etfw&quot;&gt;July 26, 2021&lt;/a&gt;&lt;/blockquote&gt;&lt;p&gt;First of all, people trust airplanes because of their long track record of safety, not because of any claims made by scientists. Secondly, people distrust &quot;scientists&quot; when politics is involved because of course scientists are human and can get corrupted by their political (or religious) beliefs.&lt;/p&gt;&lt;p&gt;And thirdly, the concept of &quot;trusting scientific authority&quot; is wrong, since the bedrock principle of science is distrusting authority. What defines sciences is how often prevailing scientific beliefs are challenged.&lt;/p&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;p&gt;Carl Sagan has many quotes along these lines that eloquently expresses this:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;A central lesson of science is that to understand complex issues (or even simple ones), we must try to free our minds of dogma and to guarantee the freedom to publish, to contradict, and to experiment. Arguments from authority are unacceptable.&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;If you are &quot;arguing from authority&quot;, like Paul Graham is doing above, then you are fundamentally misunderstanding both the principles of science and its history.&lt;/p&gt;&lt;p&gt;We know where this controversy comes from: politics. The above tweet isn&#39;t complaining about the $400 billion U.S. market for alternative medicines, a largely non-political example. It&#39;s complaining about political issues like vaccines, global warming, and evolution.&lt;/p&gt;&lt;p&gt;The reason those on the right-wing resist these things isn&#39;t because they are inherently anti-science, it&#39;s because the left-wing is. They left has corrupted and politicized these topics. The &quot;Green New Deal&quot; contains very little that is &quot;Green&quot; and much that is &quot;New Deal&quot;, for example. The left goes from the fact &quot;carbon dioxide absorbs infrared&quot; to justify &quot;we need to promote labor unions&quot;.&lt;/p&gt;&lt;p&gt;Take Marjorie Taylor Green&#39;s (MTG) claim that she doesn&#39;t believe in the Delta variant because she doesn&#39;t believe in evolution. Her argument is laughably stupid, of course, but it starts with the way the left has politicized the term &quot;evolution&quot;.&lt;/p&gt;&lt;p&gt;The &quot;Delta&quot; variant didn&#39;t arise from &quot;evolution&quot;, it arose because of &quot;mutation&quot; and &quot;natural selection&quot;. We know the &quot;mutation&quot; bit is true, because we can sequence the complete DNA and detect that changes happen. We know that &quot;selection&quot; happens, because we see some variants overtake others in how fast they spread.&lt;/p&gt;&lt;p&gt;Yes, &quot;evolution&quot; is synonymous with mutation plus selection, but it&#39;s also a politically loaded term that means a lot of additional things. The public doesn&#39;t understand mutation and natural-selection, because these concepts are not really taught in school. Schools don&#39;t teach students to &lt;i&gt;understand&lt;/i&gt; these things, they teach students to &lt;i&gt;believe&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;The focus of science eduction in school is indoctrinating students into believing in &quot;evolution&quot; rather than teaching the mechanisms of &quot;mutation&quot; and &quot;natural-selection&quot;. We see the conflict in things like describing the evolution of the eyeball, which Creationists &quot;reasonably&quot; believe is too complex to have evolved this way. I put &quot;reasonable&quot; in quotes here because it&#39;s just the &quot;Gods in the gaps&quot; argument, which credits God for everything that science can&#39;t explain, which isn&#39;t very smart. But at the same time, science textbooks go too far, refusing to admit their gaps in knowledge here. The fossil records shows a lot of complexity arising over time through steady change -- it just doesn&#39;t show anything about eyeballs.&lt;/p&gt;&lt;p&gt;In other words, it&#39;s possible for a kid to graduate high-school with a full understanding of science, including mutation, selection, and the fossil record, while believing God created the eyeball. This is anathema to educators, who would rather students &quot;believe in evolution&quot; than understand it.&lt;/p&gt;&lt;p&gt;Thus, &quot;believing&quot; in the &quot;evolution&quot; of the Delta variant becomes this horrible political debate because the left-wing has corrupted science. You have politicians like MTG virtue signaling their opposition to evolution in what should be a non-political, neutral science discussion.&lt;/p&gt;&lt;p&gt;The political debate over vaccines isn&#39;t the vaccines themselves, but forcing people to become vaccinated.&lt;/p&gt;&lt;p&gt;The evidence is clear that the covid vaccines are in your own (and your kids&#39;) best interest. If we left it there, few would be challenging the science. There is no inherent right-wing opposition to vaccines. Indeed, Trump championed the covid vaccines, trying to take credit for their development.&amp;nbsp;&lt;/p&gt;&lt;p&gt;But the left-wing chose a different argument, that covid vaccines are in the best interest of society, and therefore, that government must coerce/force people to become vaccinated. It&#39;s at this point that political opposition appears on the right-wing. It&#39;s the same whether you are describing the debate in the United States, Europe, or Asia.&lt;/p&gt;&lt;p&gt;We know the juvenile method which people defend their political positions. Once people decide to oppose &quot;forcible vaccination&quot;, they then build a position that vaccines aren&#39;t &quot;good&quot; anyway.&lt;/p&gt;&lt;p&gt;Thus, you&#39;ll get these nonsense arguments from people who have get their opinions from dodgy blogs/podcasts, like &quot;these don&#39;t even meet the definition of a vaccine&quot;. The started from the political goal first, and then looked for things that might support it, no matter how intellectually vacuous. It&#39;s frustrating trying to argue against the garbage arguments they&#39;ll toss up.&lt;/p&gt;&lt;p&gt;But at the same time, the left is no better. The tweet above is equally a vacuous meme, that they repeat because it sounds good, not because they&#39;ve put much thought into it. It&#39;s simply an argument that strokes the prejudices of those who repeat it, rather than being a robust argument that can change the minds of opponents. It&#39;s obviously false: people trust planes because of their track record, not because of scientists claim. They trust scientists and doctors on non-political things, but rightly distrust their pronouncements on politically-tainted issues. And lastly, the above argument is completely anti-scientific -- science is all about questioning and doubting.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt; &lt;script async=&quot;&quot; charset=&quot;utf-8&quot; src=&quot;https://platform.twitter.com/widgets.js&quot;&gt;&lt;/script&gt;
  5. </content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/3133624835814497538/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=3133624835814497538' title='2 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/3133624835814497538'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/3133624835814497538'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/07/of-course-you-cant-trust-scientists-on.html' title='Of course you can&#39;t trust scientists on politics'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><thr:total>2</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-2166895125765554100</id><published>2021-07-21T18:11:00.002-04:00</published><updated>2021-07-21T18:11:58.104-04:00</updated><title type='text'>Risk analysis for DEF CON 2021</title><content type='html'>&lt;p&gt;It&#39;s the second year of the pandemic and the DEF CON hacker conference wasn&#39;t canceled. However, the Delta variant is spreading. I thought I&#39;d do a little bit of risk analysis. TL;DR: I&#39;m not canceling my ticket, but changing my plans what I do in Vegas during the convention.&lt;/p&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;p&gt;First, a note about risk analysis. For many people, &quot;risk&quot; means something to avoid. They work in a binary world, labeling things as either &quot;risky&quot; (to be avoided) or &quot;not risky&quot;. But real risk analysis is about shades of gray, trying to quantify things.&lt;/p&gt;&lt;p&gt;The Delta variant is a mutation out of India that, at the moment, is particularly affecting the UK. Cases are nearly up to their pre-vaccination peaks in that country.&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDH09X1x2xo7EbB6_yQt_84duZ46Zbm2PuE-ci341SI2UEHmlylUxr-7AgXs4F2rUOOqyK6fy2NOBJdosMm9lgXsNZAkJYBXoHZoP03bHdBh46rqDYsl3mPrP7mOsO63GTACu1/s1486/Screen+Shot+2021-07-21+at+5.37.03+PM.png&quot; imageanchor=&quot;1&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;938&quot; data-original-width=&quot;1486&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDH09X1x2xo7EbB6_yQt_84duZ46Zbm2PuE-ci341SI2UEHmlylUxr-7AgXs4F2rUOOqyK6fy2NOBJdosMm9lgXsNZAkJYBXoHZoP03bHdBh46rqDYsl3mPrP7mOsO63GTACu1/s320/Screen+Shot+2021-07-21+at+5.37.03+PM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;br /&gt;&lt;/div&gt;&lt;p&gt;Note that the UK has already vaccinated nearly 70% of their population -- more than the United States. In both the UK and US there are few preventive measures in place (no lockdowns, no masks) other than vaccines.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;&amp;nbsp;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzQ8NTa24G0QgUEQK2DzeAVQrKTDGmKB-XCRvxGTs_3NsOchZumKWqhqg9dXoZ3qLD3taBpaYKadn2KauDpTQ71NyYR23prsyJA-9NHcCEPVggoT_XBVDgwFFyY_Q3Lw3M7Are/s1442/Screen+Shot+2021-07-21+at+11.15.38+AM.png&quot; imageanchor=&quot;1&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;1004&quot; data-original-width=&quot;1442&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgzQ8NTa24G0QgUEQK2DzeAVQrKTDGmKB-XCRvxGTs_3NsOchZumKWqhqg9dXoZ3qLD3taBpaYKadn2KauDpTQ71NyYR23prsyJA-9NHcCEPVggoT_XBVDgwFFyY_Q3Lw3M7Are/s320/Screen+Shot+2021-07-21+at+11.15.38+AM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;&lt;p&gt;Thus, the UK graph is somewhat predictive of what will happen in the United States. If we time things from when the latest wave hit the same levels as peak of the first wave, then it looks like the USA is only about 1.5 months behind the UK.&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjUzz106H_G2hTQIhLs5EhUE7igrxJRJEWkBwPjF5_Wz-y9LMZMv-uBuF9bRP20mVDNSPbafQCN5hCUQUjOaTOqc0GvYW5eQiaw9IMXep8cjT8Mm2Xz9jidsipXP6JNiI_eZJcv/s1502/Screen+Shot+2021-07-21+at+5.32.45+PM.png&quot; imageanchor=&quot;1&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;920&quot; data-original-width=&quot;1502&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjUzz106H_G2hTQIhLs5EhUE7igrxJRJEWkBwPjF5_Wz-y9LMZMv-uBuF9bRP20mVDNSPbafQCN5hCUQUjOaTOqc0GvYW5eQiaw9IMXep8cjT8Mm2Xz9jidsipXP6JNiI_eZJcv/s320/Screen+Shot+2021-07-21+at+5.32.45+PM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;&lt;p&gt;It&#39;s another interesting lesson about risk analysis. Most people experience these things as sudden changes. One moment, everything seems fine, and cases are decreasing. The next moment, we are experiencing a major new wave of infections. It&#39;s especially jarring when the thing we are tracking is exponential. But we can compare the curves and see that things are totally predictable. In about another 1.5 months, the US will experience a wave that looks similar to the UK wave.&lt;/p&gt;&lt;p&gt;Sometimes the problem is that the change is inconceivable. We saw that recently with 1-in-100 year floods in Germany. Weather forecasters predicted 1-in-100 level of floods days in advance, but they still surprised many people.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfML6nU3sgd6QL1s_fpiZBmribYuHimgBLtbHomCCbDwnDBBonG_rjWIM4XjpMXf52VlmaCFLspclLHjzNeJ-SV9v99CMt-x7EEcj-cEEjLOyzPE2YOuilBaLS0FP79eMtLQzt/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;336&quot; data-original-width=&quot;640&quot; height=&quot;168&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhfML6nU3sgd6QL1s_fpiZBmribYuHimgBLtbHomCCbDwnDBBonG_rjWIM4XjpMXf52VlmaCFLspclLHjzNeJ-SV9v99CMt-x7EEcj-cEEjLOyzPE2YOuilBaLS0FP79eMtLQzt/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;Nevada is ahead of the curve in the US, probably because Vegas is such a hub of unvaccinated people going on vacation. Because of exponential growth, there&#39;s a good chance that in 2 weeks, that peek will be triple where it is now. It may not look like &quot;time to cancel your ticket&quot; now, but it probably will in 2 weeks when the event takes place. In other words, the closer we get to the event, the more people will look at this graph and cancel their tickets.&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFeNMFRCnumJoTmDmZ1UhJzMaJtggq8F3exZMGc1gcH-q48LpQO_Cn_SycAjgvgX-Vr4j5P7EsNswfCsS06RJaT-BC0bXsJydbip5qECOihDItWc-a50-Mx5Bipi6eB6heqJ1k/s1486/Screen+Shot+2021-07-21+at+5.45.19+PM.png&quot; imageanchor=&quot;1&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;920&quot; data-original-width=&quot;1486&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgFeNMFRCnumJoTmDmZ1UhJzMaJtggq8F3exZMGc1gcH-q48LpQO_Cn_SycAjgvgX-Vr4j5P7EsNswfCsS06RJaT-BC0bXsJydbip5qECOihDItWc-a50-Mx5Bipi6eB6heqJ1k/s320/Screen+Shot+2021-07-21+at+5.45.19+PM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;The risk is really high for the unvaccinated, but much less for the vaccinated. We see that in the death rates in the UK, which are still low, even accounting for the 2 week lag that you see between spikes in infections and spikes in deaths. This is partly due to the fact that while the new variant infects the vaccinated, it doesn&#39;t cause much harm. Also, I suspect it&#39;s due to how much better we are at treating infections if they do require a hospital visit.&lt;div&gt;&lt;br /&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzusjRQXrpwuRRDJUOPqXZTq5VPw2zcQYBVg0GQo-HuqYwLXZRw5ngin99lcily22Jy9t_S2rjaLv53nob-p6O3BUc4RQRrNraZ4M9FjijoPy-Hiuqkfnkaze9et1a8zjsmF0F/s1468/Screen+Shot+2021-07-21+at+5.49.35+PM.png&quot; imageanchor=&quot;1&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;926&quot; data-original-width=&quot;1468&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhzusjRQXrpwuRRDJUOPqXZTq5VPw2zcQYBVg0GQo-HuqYwLXZRw5ngin99lcily22Jy9t_S2rjaLv53nob-p6O3BUc4RQRrNraZ4M9FjijoPy-Hiuqkfnkaze9et1a8zjsmF0F/s320/Screen+Shot+2021-07-21+at+5.49.35+PM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;But still, death isn&#39;t the major concern. It appears the major concern is long term-lung (and other organ) damage caused by even mild cases. Thus, one should fear infection even if one believes they have no chance of dying.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;So here&#39;s my personal risk analysis: I&#39;m not canceling my ticket. Instead, I&#39;m changing my plans of what I do. For the most part, this means that wherever there&#39;s a crowd, go someplace else.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;It also means I&#39;m going to take this opportunity to do things I&#39;ve never had the opportunity to do before: go outside of Vegas. I plan on renting a car to go down to the Grand Canyon, Hoover Dam, and do hikes around the area (like along Lake Meade, up in the canyons, and so on). This means spending most of my time away from people.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;During the pandemic, outdoor activities (without masks, socially distanced) is one of the safest things you can do, especially considering the exercise and vitamin D that you&#39;ll be getting.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Also, airplanes aren&#39;t much of a worry. They have great filtration and as far as anybody can tell, haven&#39;t resulted in superspreader events this entire pandemic.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The real point of this blogpost is the idea of &quot;predictions&quot;. This post predicts that US infection rates will be spiking in 1.5 months in a curve that looks similar to the UK, and that in 2 weeks during DEFCON, Nevada&#39;s infection rates will be around 3 times higher. The biggest lesson about risk analysis is that it&#39;s usually done in hind-sight, what people should&#39;ve known, once the outcome is known. It&#39;s much harder doing it the other way around, estimating what might happen in the future.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;/div&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/2166895125765554100/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=2166895125765554100' title='2 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/2166895125765554100'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/2166895125765554100'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/07/risk-analysis-for-def-con-2021.html' title='Risk analysis for DEF CON 2021'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiDH09X1x2xo7EbB6_yQt_84duZ46Zbm2PuE-ci341SI2UEHmlylUxr-7AgXs4F2rUOOqyK6fy2NOBJdosMm9lgXsNZAkJYBXoHZoP03bHdBh46rqDYsl3mPrP7mOsO63GTACu1/s72-c/Screen+Shot+2021-07-21+at+5.37.03+PM.png" height="72" width="72"/><thr:total>2</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-6733311247470341311</id><published>2021-07-14T20:49:00.000-04:00</published><updated>2021-07-14T20:49:05.921-04:00</updated><title type='text'>Ransomware: Quis custodiet ipsos custodes</title><content type='html'>&lt;p&gt;Many claim that &quot;ransomware&quot; is due to cybersecurity failures. It&#39;s not really true. We are adequately protecting users and computers. The failure is in the inability of cybersecurity guardians to protect themselves. Ransomware doesn&#39;t make the news when it only accesses the files normal users have access to. The big ransomware news events happened because ransomware elevated itself to that of an &quot;administrator&quot; over the network, giving it access to all files, including online backups.&lt;/p&gt;&lt;p&gt;Generic improvements in cybersecurity will help only a little, because they don&#39;t specifically address this problem. Likewise, blaming ransomware on how it breached perimeter defenses (phishing, patches, password reuse) will only produce marginal improvements. Ransomware solutions need to instead focus on looking at the typical &lt;a href=&quot;https://docs.microsoft.com/en-us/security/compass/human-operated-ransomware&quot;&gt;human-operated ransomware&lt;/a&gt; killchain, identify how they typically achieve &quot;administrator&quot; credentials, and fix those problems. In particular, large organizations need to redesign how they handle Windows &quot;domains&quot; and &quot;segment&quot; networks.&lt;/p&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;p&gt;I read a lot of lazy op-eds on ransomware. Most of them claim that the problem is due to some sort of moral weakness (laziness, stupidity, greed, slovenliness, lust). They suggest things like &quot;taking cybersecurity more seriously&quot; or &quot;do better at basic cyber hygiene&quot;. These are &quot;unfalsifiable&quot; -- things that nobody would disagree with, meaning they are things the speaker doesn&#39;t really have to defend. They don&#39;t rest upon technical authority but moral authority: anybody, regardless of technical qualifications, can have an opinion on ransomware as long as they phrase it in such terms.&lt;/p&gt;&lt;p&gt;Another flaw of these &quot;unfalsifiable&quot; solutions is that they are not measurable. There&#39;s no standard definition for &quot;best practices&quot; or &quot;basic cyber hygiene&quot;, so there no way to tell if you aren&#39;t already doing such things, or the gap you need to overcome to reach this standard. Worse, some people point to the &quot;NIST Cybersecurity Framework&quot; as the &quot;basics&quot; -- but that&#39;s a framework for &lt;i&gt;all&lt;/i&gt;&amp;nbsp;cybersecurity practices. In other words, anything short of doing &lt;i&gt;everything&amp;nbsp;possible&lt;/i&gt; is considered a failure to follow the basics.&lt;/p&gt;&lt;p&gt;In this post, I try to focus on specifics, while at the same time, making sure things are broadly applicable. It&#39;s detailed enough that people will disagree with my solutions.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;The thesis of this blogpost is that &lt;b&gt;we are failing to protect &quot;administrative&quot; accounts&lt;/b&gt;. The big ransomware attacks happen because the hackers got administrative control over the network, usually the Windows &lt;i&gt;domain admin&lt;/i&gt;. It&#39;s with administrative control that they are able to cause such devastation, able to reach all the files in the network, while also being able to delete backups.&lt;/p&gt;&lt;p&gt;The &lt;b&gt;Kaseya&lt;/b&gt; attacks highlight this particularly well. The company produces a product that is in turn used by &quot;Managed Security Providers&quot; (MSPs) to administer the security of small and medium sized businesses. Hackers found and exploited a vulnerability in the product, which gave them administrative control of over 1000 small and medium sized businesses around the world.&lt;/p&gt;&lt;p&gt;The underlying problems start with the way their software gives indiscriminate administrative access over computers. Then, this software was written using standard software techniques, meaning, with the standard vulnerabilities that most software has (such as &quot;SQL injection&quot;). It wasn&#39;t written in a paranoid, careful way that you&#39;d hope for software that poses this much danger.&lt;/p&gt;&lt;p&gt;A good analogy is airplanes. A common joke refers to the &quot;black box&quot; flight-recorders that survive airplane crashes, that maybe we should make the entire airplane out of that material. The reason we can&#39;t do this is that airplanes would be too heavy to fly. The same is true of software: airplane software is written with extreme paranoia knowing that bugs can lead to airplanes falling out of the sky. You wouldn&#39;t want to write all software to that standard, because it&#39;d be too costly.&lt;/p&gt;&lt;p&gt;This analogy tells us we can&#39;t write all software to the highest possible standard. However, we should write a&lt;i&gt;dministrative software&lt;/i&gt; (like Kaseya) to this sort of standard. Anything less invites something like the massive attack we saw in the last couple weeks.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;Another illustrative example is the &quot;&lt;b&gt;PrinterNightmare&lt;/b&gt;&quot; bug. The federal government issued a directive telling everyone under it&#39;s authority (executive branch, military) to &lt;a href=&quot;https://us-cert.cisa.gov/ncas/current-activity/2021/07/13/cisa-issues-emergency-directive-microsoft-windows-print-spooler&quot;&gt;disable the Printer Spooler on &quot;domain controllers&quot;&lt;/a&gt;. The issue here is that this service should never have been enabled on &quot;domain controllers&quot; in the first place.&lt;/p&gt;&lt;p&gt;Windows security works by putting all the security eggs into a single basket known as &quot;Active Directory&quot;, which is managed by several &quot;Domain Controller&quot; (AD DC) servers. Hacking a key DC gives the ransomware hacker full control over the network. Thus, we should be paranoid about protecting DCs. They should not be running any service other than those needed to fulfill their mission. The more additional services they provide, like &quot;printing&quot;, the larger the attack surface, the more likely they can get hacked, allowing hackers full control over the network.&amp;nbsp;&lt;/p&gt;&lt;p&gt;Yet, I rarely see Domain Controllers with this level of paranoid security. Instead, when an organization has a server, they load it up with lots of services, including those for managing domains. Microsoft&#39;s advice&amp;nbsp;&lt;a href=&quot;https://docs.microsoft.com/en-us/windows-server/identity/ad-ds/plan/security-best-practices/reducing-the-active-directory-attack-surface&quot;&gt;securing domain controllers&lt;/a&gt;&amp;nbsp;&quot;recommends&quot; a more paranoid attitude, but only as one of the many other things it &quot;recommends&quot;.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;When you look at detailed analysis of ransomware killchains, you&#39;ll find the most frequently used technique is &quot;&lt;b&gt;domain admin account hijacking&lt;/b&gt;&quot;. Once a hacker controls a desktop computer, they wait for an administrator to login, then steal the administrators credentials. There are various ways this happens, the most famous being &quot;pass-the-hash&quot; (which itself is outdated, but good analogy for still-current techniques). Hijacking even &lt;i&gt;restricted&lt;/i&gt; administrator accounts can lead to elevation to &lt;i&gt;unrestricted&lt;/i&gt; administrator privileges over the entire network.&lt;/p&gt;&lt;p&gt;If you had to fix only one thing in your network, it would be this specific problem.&lt;/p&gt;&lt;p&gt;Unfortunately, I only know how to &lt;i&gt;attack&lt;/i&gt;&amp;nbsp;this problem as a pentester, I don&#39;t know how to &lt;i&gt;defend&lt;/i&gt;&amp;nbsp;against it. I feel that separating &lt;i&gt;desktop admins&lt;/i&gt;&amp;nbsp;and &lt;i&gt;server/domain admins&lt;/i&gt;&amp;nbsp;into separate, non-overlapping groups is the answer, but I don&#39;t know how to achieve this in practice. I don&#39;t have enough experience as a defender to know how to make reasonable tradeoffs.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;In addition to attacking &lt;i&gt;servers&lt;/i&gt; and &lt;i&gt;accounts&lt;/i&gt;, ransomware attackers also target &lt;b&gt;networks&lt;/b&gt;. Organizations focus on &quot;perimeter security&quot;, where the major security controls are between the public Internet and the internal organization. They also need an internal perimeter, between the organization&#39;s network and the core servers.&lt;/p&gt;&lt;p&gt;There are lots of tools for doing this: VLANs, port-isolation, network segmentation, read-only Domain Controllers, and the like.&lt;/p&gt;&lt;p&gt;As an attacker, I see the lack of these techniques. I don&#39;t know why defenders doin&#39;t use them more. There might be good reasons. I suspect the biggest problem is inertia: networks were designed back when these solutions were hard, and change would break things.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;In summary, I see the major problem exploited by ransomware is that we don&#39;t protect &quot;administrators&quot; enough. We don&#39;t do enough to protect administrative software, servers, accounts, or network segments. When we look at ransomware, the big cases that get splashed across the news, its not because they compromised a single desktop, but because they got administrative control over the entire network and thus were able to encrypt everything.&lt;/p&gt;&lt;p&gt;Sadly, as a person experience in attack (red-team) and exploiting these problems, I can see the problem. However, I have little experience as a defender (blue-team), and while solutions look easy in theory, I&#39;m not sure what can be done in practice to mitigate these threats.&lt;/p&gt;&lt;p&gt;I do know that general hand-waving, exhorting people to &quot;take security seriously&quot; and perform &quot;cyber hygiene&quot; is the least helpful answer to the problem.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/6733311247470341311/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=6733311247470341311' title='8 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/6733311247470341311'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/6733311247470341311'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/07/ransomware-quis-custodiet-ipsos-custodes.html' title='Ransomware: Quis custodiet ipsos custodes'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><thr:total>8</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-7766669610303791684</id><published>2021-07-05T17:15:00.003-04:00</published><updated>2021-07-05T17:15:28.711-04:00</updated><title type='text'>Some quick notes on SDR</title><content type='html'>&lt;p&gt;I&#39;m trying to create perfect screen captures of SDR to explain the world of radio around us. In this blogpost, I&#39;m going to discuss some of the imperfect captures I&#39;m getting, specifically, some notes about WiFi and Bluetooth.&lt;/p&gt;&lt;p&gt;An SDR is a &quot;software defined radio&quot; which digitally samples radio waves and uses number crunching to decode the signal into data. Among the simplest thing an SDR can do is look at a chunk of spectrum and see signal strength. This is shown below, where I&#39;m monitoring part of the famous 2.4 GHz pectrum used by WiFi/Bluetooth/microwave-ovens:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhbz69YcYg9p4Y4jySkNi7XJLJmpClhCptaRArmCrGHjZ7KNl7dXQA665V-sAfdhqBVda84ZujOFyTRIRgY-9DfzXsqcCmGQKR7zCJW2oY05tiJqexulPrBpEuMUGW553fhtTxV/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;1075&quot; data-original-width=&quot;2048&quot; height=&quot;168&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhbz69YcYg9p4Y4jySkNi7XJLJmpClhCptaRArmCrGHjZ7KNl7dXQA665V-sAfdhqBVda84ZujOFyTRIRgY-9DfzXsqcCmGQKR7zCJW2oY05tiJqexulPrBpEuMUGW553fhtTxV/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;p&gt;&lt;/p&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;p&gt;&lt;br /&gt;There are two panes. The top shows the current signal strength as graph. The bottom pane is the &quot;waterfall&quot; graph showing signal strength over time, display strength as colors: black means almost no signal, blue means some, and yellow means a strong signal.&lt;/p&gt;&lt;p&gt;The signal strength graph is a bowl shape, because we are actually sampling at a specific frequency of 2.42 GHz, and the further away from this &quot;center&quot;, the less accurate the analysis. Thus, the algorithms think there is more signal the further away from the center we are.&lt;/p&gt;&lt;p&gt;What we do see here is two peaks, at 2.402 GHz toward the left and 2.426 GHz toward the right (which I&#39;ve marked with the red line). These are the &quot;Bluetooth beacon&quot; channels. I was able to capture the screen at the moment some packets were sent, showing signal at this point. Below in the waterfall chart, we see packets constantly being sent at these frequencies.&lt;/p&gt;&lt;p&gt;We are surrounded by devices giving off packets here: our phones, our watches, &quot;tags&quot; attached to devices, televisions, remote controls, speakers, computers, and so on. This is a picture from my home, showing only my devices and perhaps my neighbors. In a crowded area, these two bands are saturated with traffic.&lt;/p&gt;&lt;p&gt;The 2.4 GHz region also includes WiFi. So I connected to a WiFi access-point to watch the signal.&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgE6KQ_rW30FZbUrvko0fNyi3aXUbm9GkqqdqFDOV-bG_9lPhgnDcW_DFANJTaB0I7xvTsQO2jgUU9k7Wb7w-vTy0q5wOf7QkXfj0WK0CWF4HyBZQjg1p-kYtaXcYstZ9KY5vik/s2048/Screen+Shot+2021-07-05+at+4.21.31+PM.png&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;1104&quot; data-original-width=&quot;2048&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgE6KQ_rW30FZbUrvko0fNyi3aXUbm9GkqqdqFDOV-bG_9lPhgnDcW_DFANJTaB0I7xvTsQO2jgUU9k7Wb7w-vTy0q5wOf7QkXfj0WK0CWF4HyBZQjg1p-kYtaXcYstZ9KY5vik/s320/Screen+Shot+2021-07-05+at+4.21.31+PM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;WiFi uses more bandwidth than Bluetooth. The term &quot;bandwidth&quot; is used today to mean &quot;faster speeds&quot;, but it comes from the world of radio where it quite literally means the width of the band. The width of the Bluetooth transmissions seen above is 2 MHz, the width of the WiFi band shown here is 20 MHz.&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;It took about 50 screenshots before getting these two. I had to hit the &quot;capture&quot; button right at the moment things were being transmitted. And easier way is a setting that graphs the current signal strength compared to the maximum recently seen as a separate line. That&#39;s shown below: the instant it was taken, there was no signal, but it shows the maximum of recent signals as a separate line:&lt;/div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5DC9BdZpaj-0kBYECXyEw15Qih5Bnpv7busuVTn2xM49qoay_oBoXcSNTFkqceEhaM2aXrI_sduLJUbRDmkOWQ6vQuQ2u_2v_2XKTSyFj_UEKUAPAjgLoj9q604I6C-Yai2JH/s2048/Screen+Shot+2021-07-05+at+4.27.54+PM.png&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;1104&quot; data-original-width=&quot;2048&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj5DC9BdZpaj-0kBYECXyEw15Qih5Bnpv7busuVTn2xM49qoay_oBoXcSNTFkqceEhaM2aXrI_sduLJUbRDmkOWQ6vQuQ2u_2v_2XKTSyFj_UEKUAPAjgLoj9q604I6C-Yai2JH/s320/Screen+Shot+2021-07-05+at+4.27.54+PM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;&lt;div&gt;You can see there is WiFi traffic on multiple channels. My traffic is on channel #1 at 2.412 GHz. My neighbor has traffic on channel #6 at 2.437 GHz. Another neighbor has traffic on channel #8 at 2.447 GHz. WiFi splits the spectrum assigned to it into 11 overlapping channels set 5 MHz apart.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Now the reason I wanted to take these pictures was to highlight the difference between old WiFi (802.11b) and new WiFi (802.11n). The newer standard uses the spectrum more efficiently. Notice in the picture above how signal strength for a WiFi channel is strongest in the center but gets weaker toward the edges. That means it&#39;s not fully using all the band.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Newer WiFi uses a different scheme to encode data into radio waves, using all the band given to it. We can see the difference in shape below, when I change from 802.11b to 802.11n:&lt;/div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmihXNzBA-O8EBy2lqAinkbe6S5bx3gaAiCRVgeLDUK6H6Jcs_nJnMF7zmb2yw2_11lCBS-J_ImEbuCUDZUwxjO1XCSR-fFi6F6RRbrRy_p0lwayAhoBzi87HvfAnO8BuQdbLF/s2048/Screen+Shot+2021-07-05+at+4.35.38+PM.png&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;1104&quot; data-original-width=&quot;2048&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgmihXNzBA-O8EBy2lqAinkbe6S5bx3gaAiCRVgeLDUK6H6Jcs_nJnMF7zmb2yw2_11lCBS-J_ImEbuCUDZUwxjO1XCSR-fFi6F6RRbrRy_p0lwayAhoBzi87HvfAnO8BuQdbLF/s320/Screen+Shot+2021-07-05+at+4.35.38+PM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;&lt;div&gt;Instead of a curve it&#39;s more of a square block. It fills its entire 20 MHz bandwidth instead of only using the center.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;What we see here is the limits of math and physics, known as the &lt;i&gt;Shannon Limit&lt;/i&gt;, that governs the maximum possible speed for something like WiFi (or mobile phone radios like LTE). It&#39;s simply the size of that box: its width times its height. The width is measured in frequency, 20 MHz wide. It&#39;s height is signal strength measure above the noise floor (which should be straight line across the bottom of our graph, but as I mentioned before, is shown in this SDR by a curved line increasingly inaccurate near the edges).&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;As we move toward faster and faster speeds, we cannot exceed this theoretical limit.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;One solution is directional antennas, such as the yagi antennas you see on top of houses or satellite dishes. A directional antenna or dish means getting a stronger signal with less noise -- thus, increasing the &quot;height&quot; of the box.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The same effect can be achieved with something called &quot;phased arrays&quot;, using multiple antennas that transmit/receive at (very) slightly different times, such that waves they produce reinforce each other in one direction but cancel each other out in other directions. This is how SpaceX &quot;Starlink&quot; space-based Internet works. The low Earth orbit satellites whizzing by overhead travel too fast to keep an antenna pointed at them, so their antenna is a phases array instead. The antennas are fixed, but the timing is slightly altered to aim the beam toward the satellite.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;What&#39;s even more interesting is MIMO: receiving different signals on different antennas. With fancy circuits and math, doubling the number of antennas doubles the effective bandwidth.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The latest mobile phones and WiFi use MIMO and phases arrays to increase bandwidth.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;But mostly, higher frequencies give more bandwidth. That&#39;s why WiFi at 5 GHz is better -- bands are a minimum of 40 MHz (instead of 20 MHz as in 2.4 GHz WiFi), are more commonly 80 MHz, and can go up to 160 MHz.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Anyway, these are more imperfect picture I&#39;m creating to explain WiFi and Bluetooth. At some point in the time, I&#39;ll be generating more perfect ones.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/7766669610303791684/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=7766669610303791684' title='1 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/7766669610303791684'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/7766669610303791684'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/07/some-quick-notes-on-sdr.html' title='Some quick notes on SDR'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhbz69YcYg9p4Y4jySkNi7XJLJmpClhCptaRArmCrGHjZ7KNl7dXQA665V-sAfdhqBVda84ZujOFyTRIRgY-9DfzXsqcCmGQKR7zCJW2oY05tiJqexulPrBpEuMUGW553fhtTxV/s72-c" height="72" width="72"/><thr:total>1</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-8007125639266971739</id><published>2021-06-20T20:34:00.004-04:00</published><updated>2021-06-20T20:34:42.293-04:00</updated><title type='text'>When we&#39;ll get a 128-bit CPU</title><content type='html'>&lt;p&gt;On Hacker News, this article claiming &quot;&lt;a href=&quot;https://news.ycombinator.com/item?id=27572663&quot;&gt;You won&#39;t live to see a 128-bit CPU&lt;/a&gt;&quot; is trending&quot;. Sadly, it was non-technical, so didn&#39;t really contain anything useful. I thought I&#39;d write up some technical notes.&lt;/p&gt;&lt;p&gt;The issue isn&#39;t the CPU, but memory. It&#39;s not about the size of computations, but when CPUs will need more than 64-bits to address all the memory future computers will have. It&#39;s a simple question of math and Moore&#39;s Law.&lt;/p&gt;&lt;span&gt;&lt;a name=&#39;more&#39;&gt;&lt;/a&gt;&lt;/span&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;Today, Intel&#39;s server CPUs support 48-bit addresses, which is enough to address 256-terabytes of memory -- in theory. In practice, Amazon&#39;s AWS cloud servers are offered up to 24-terabytes, or 45-bit addresses, in the year 2020.&lt;/p&gt;&lt;p&gt;Doing the math, it means we have 19-bits or 38-years left before we exceed the 64-bit registers in modern processors. This means that by the year 2058, we&#39;ll exceed the current address size and need to move 128-bits. Most people reading this blogpost will be alive to see that, though probably retired.&lt;/p&gt;&lt;p&gt;There are lots of reasons to suspect that this event will come both sooner and later.&lt;/p&gt;&lt;p&gt;It could come sooner if&amp;nbsp;&lt;i&gt;storage&lt;/i&gt; merges with &lt;i&gt;memory&lt;/i&gt;. We are moving away from rotating platters of rust toward solid-state storage like flash. There are post-flash technologies like Intel&#39;s Optane that promise storage that can be accessed at speeds close to that of memory. We already have machines needing petabytes (at least 50-bits worth) of storage.&lt;/p&gt;&lt;p&gt;Addresses often contain more just the memory address, but also some sort of description about the memory. For many applications, 56-bits is the maximum, as they use the remaining 8-bits for tags.&lt;/p&gt;&lt;p&gt;Combining those two points, we may be only 12 years away from people starting to argue for 128-bit registers in the CPU.&lt;/p&gt;&lt;p&gt;Or, it could come later because few applications need more than 64-bits, other than databases and file-systems.&lt;/p&gt;&lt;p&gt;Previous transitions were delayed for this reason, as the x86 history shows. The first Intel CPUs were 16-bits addressing 20-bits of memory, and the Pentium Pro was 32-bits addressing 36-bits worth of memory.&lt;/p&gt;&lt;p&gt;The few applications that needed the extra memory could deal with the pain of needing to use multiple numbers for addressing. Databases used Intel&#39;s address extensions, almost nobody else did. It took 20 years, from the initial release of MIPS R4000 in 1990 to Intel&#39;s average desktop processor shipped in 2010 for mainstream apps needing larger addresses.&lt;/p&gt;&lt;p&gt;For the transition beyond 64-bits, it&#39;ll likely take even longer, and might never happen. Working with large datasets needing more than 64-bit addresses will be such a specialized discipline that it&#39;ll happen behind libraries or operating-systems anyway.&lt;/p&gt;&lt;p&gt;So let&#39;s look at the internal cost of larger registers, if we expand registers to hold larger addresses.&lt;/p&gt;&lt;p&gt;We already have 512-bit CPUs -- with registers that large. My laptop uses one. It supports AVX-512, a form of &quot;SIMD&quot; that packs multiple small numbers in one big register, so that he can perform identical computations on many numbers at once, in parallel, rather than sequentially. Indeed, even very low-end processors have been 128-bit for a long time -- for &quot;SIMD&quot;.&lt;/p&gt;&lt;p&gt;In other words, we can have a large register file with wide registers, and handle the bandwidth of shipping those registers around the CPU performing computations on them. Today&#39;s processors already handle this for certain types of computations.&lt;/p&gt;&lt;p&gt;But just because we can do many 64-bit computations at once (&quot;SIMD&quot;) still doesn&#39;t mean we can do a 128-bit computation (&quot;scalar&quot;). Simple problems like &quot;carry&quot; get difficult as numbers get larger. Just because SIMD can do multiple small computations doesn&#39;t tell us what one large computation will cost. This was why it took an extra decade for Intel to make the transition -- they added 64-bit MMX registers for SIMD a decade before they added 64-bit for normal computations.&lt;/p&gt;&lt;p&gt;The above discussion is about speed, but it&#39;s also a concern for power consumption. Mobile devices were a decade later (than desktops) adopting 64-bits, exceeding the 32-bit barrier just now. It&#39;s likely they be decades late getting to 128-bits. Even if you live to see supercomputers transition to 128-bits, you probably won&#39;t live to see your mobile device transition.&lt;/p&gt;&lt;p&gt;Now let&#39;s look at the market. What the last 40 years has taught us is that old technology doesn&#39;t really day, it&#39;s that it stops growing -- with all the growth happening in some new direction. 40 years ago, IBM dominated computing with their mainframes. Their mainframe business is as large as ever, it&#39;s just that all the growth in the industry has been in other directions than the mainframe. The same thing happened to Microsoft&#39;s business, Windows still dominates the desktop, but all the growth in the last 15 years has bypassed the desktop, moving to mobile devices and the cloud.&lt;/p&gt;&lt;p&gt;40 years from now, it won&#39;t be an issue of mainstream processors jumping from 64-bits to 128-bits, like the previous transitions. I&#39;m pretty sure we&#39;ll have ossified into some 64-bit standard like ARM. Instead, I think 128-bit systems will come with a bunch of other radical changes. It&#39;ll happen on the side of computers, much like how GPUs evolved separately from mainstream CPUs can became increasingly integrated into them.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/8007125639266971739/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=8007125639266971739' title='0 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/8007125639266971739'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/8007125639266971739'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/06/when-well-get-128-bit-cpu.html' title='When we&#39;ll get a 128-bit CPU'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><thr:total>0</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-4008232982979402236</id><published>2021-04-29T04:09:00.005-04:00</published><updated>2021-04-29T15:19:19.634-04:00</updated><title type='text'>Anatomy of how you get pwned</title><content type='html'>&lt;p&gt;Today, somebody had a problem: they kept seeing a popup on their screen, and obvious scam trying to sell them McAfee anti-virus. Where was this coming from?&lt;/p&gt;&lt;p&gt;In this blogpost, I follow this rabbit hole on down. It starts with &quot;search engine optimization&quot; links and leads to an entire industry of tricks, scams, exploiting popups, trying to infect your machine with viruses, and stealing emails or credit card numbers.&lt;/p&gt;&lt;p&gt;Evidence of the attack first appeared with occasional popups like the following. The popup isn&#39;t part of any webpage.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisxnmkKzQg_ZP5a1OcYT984GOcOouARM8UbJhGy-dDhHuwLQcQWDqW1j_I1jc4tQm2nPT9oyM5NE7j_Ml0ycobZRBR_YCx1qyoRgUK4eDh9LVfCeoebYehjMpV-jg9ZeVNVBO2/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;180&quot; data-original-width=&quot;542&quot; height=&quot;106&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisxnmkKzQg_ZP5a1OcYT984GOcOouARM8UbJhGy-dDhHuwLQcQWDqW1j_I1jc4tQm2nPT9oyM5NE7j_Ml0ycobZRBR_YCx1qyoRgUK4eDh9LVfCeoebYehjMpV-jg9ZeVNVBO2/w320-h106/image.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;&lt;br /&gt;&lt;/div&gt;&lt;p&gt;This is obviously a trick. But from where? How did it &quot;get on the machine&quot;?&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;There&#39;s lots of possible answers. But the most obvious answer (to most people), that your machine is infected with a virus, is likely wrong. Viruses are generally silent, doing evil things in the background. When you see something like this, you aren&#39;t infected ... yet.&lt;/p&gt;&lt;p&gt;Instead, things popping with warnings is almost entirely due to evil websites. But that&#39;s confusing, since this popup doesn&#39;t appear within a web page. It&#39;s off to one side of the screen, nowhere near the web browser.&lt;/p&gt;&lt;p&gt;Moreover, we spent some time diagnosing this. We restarted the webbrowser in &quot;troubleshooting mode&quot; with all extensions disabled and went to a clean website like Twitter. The popup still kept happening.&lt;/p&gt;&lt;p&gt;As it turns out, he had another windows with Firefox running under a different profile. So while he cleaned out everything in this one profile, he wasn&#39;t aware the other one was still running&lt;/p&gt;&lt;p&gt;This happens a lot in investigations. We first rule out the obvious things, and then struggle to find the less obvious explanation -- when it was the obvious thing all along.&lt;/p&gt;&lt;p&gt;In this case, the reason the popup wasn&#39;t attached to a browser window is because it&#39;s a new type of popup notification that&#39;s suppose to act more like an app and less like a web page. It has a hidden web page underneath called a &quot;service worker&quot;, so the popups keep happening when you think the webpage is closed.&lt;/p&gt;&lt;p&gt;Once we figured the mistake of the other Firefox profile, we quickly tracked this down and saw that indeed, it was in the Notification list with Permissions set to Allow. Simply changing this solved the problem.&lt;/p&gt;&lt;p&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhi4eKTcKRJZSLoRkO9L7epnAI9AsyMr09L4WTbU7ycP-iBSCEJXQc64mqT5wSvHnFv6PxjohEYZeMLdEAjECdUgojJ2kXEuJAdeEDE8GcQZcdmO8s1T0b545nDHPvMtEP4VEYE/&quot; style=&quot;margin-left: 1em; margin-right: 1em; text-align: center;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;687&quot; data-original-width=&quot;964&quot; height=&quot;228&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhi4eKTcKRJZSLoRkO9L7epnAI9AsyMr09L4WTbU7ycP-iBSCEJXQc64mqT5wSvHnFv6PxjohEYZeMLdEAjECdUgojJ2kXEuJAdeEDE8GcQZcdmO8s1T0b545nDHPvMtEP4VEYE/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/p&gt;&lt;p&gt;Note that the above picture of the popup has a little wheel in the lower right. We are taught not to click on dangerous thing, so the user in this case was avoiding it. However, had the user clicked on it, it would&#39;ve led him straight here to the solution. I can&#39;t recommend you click on such a thing and trust it, because that means in the future, malicious tricks will contain such safe looking icons that aren&#39;t so safe.&lt;/p&gt;&lt;p&gt;Anyway, the next question is: which website did this come from?&lt;/p&gt;&lt;p&gt;The answer is Google.&lt;/p&gt;&lt;p&gt;In the news today was the story of the Michigan guys who tried to kidnap the governor. The user googled &quot;&lt;a href=&quot;http://google.com/search?q=attempted+kidnap+sentencing+guidelines&quot;&gt;attempted kidnap sentencing guidelines&lt;/a&gt;&quot;. This search produced a page with the following top result:&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqpeVDz7ICSRdWEY_f7OGsUjJlLCPzr6AhulgLL5mLF2amH8YyCa_3q9Wfh4YhZxzRJFzso8ThnbyvZ2BFf6y_lAIQP3WZ1YHaHRuwttkr3gJ8b5Zr42uwaRHzy24RsiSGmGG5/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;676&quot; data-original-width=&quot;1159&quot; height=&quot;187&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiqpeVDz7ICSRdWEY_f7OGsUjJlLCPzr6AhulgLL5mLF2amH8YyCa_3q9Wfh4YhZxzRJFzso8ThnbyvZ2BFf6y_lAIQP3WZ1YHaHRuwttkr3gJ8b5Zr42uwaRHzy24RsiSGmGG5/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;Google labels this a &quot;featured snippet&quot;. This isn&#39;t an advertisement, not a &quot;promoted&quot; result. But it&#39;s a link that Google&#39;s algorithms thinks is somehow more worthy than the rest.&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This happened because hackers tricked Google&#39;s algorithms. It&#39;s been a constant cat and mouse game for 20 years, in an industry known as &quot;search engine optimization&quot; or SEO. People are always trying to trick google into placing their content highest, both legitimate companies and the quasi-illegitimate that we see here. In this case, they seem to have succeeded.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The way this trick works is that the hackers posted a PDF instead of a webpage containing the desired text. Since PDF documents are much less useful for SEO purposes, google apparently trusts them more.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;But the hackers have found a way to make PDFs more useful. They designed it to appear like a webpage with the standard CAPTCHA. You click anywhere on the page such as saying &quot;I&#39;m not robot&quot;, and it takes you to the real webstie.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiz5vu9F8IQL-JvotRDMNu9VY-_ifCbSKiN3POaelyRDPQotGgcLusA-b76dHxwH1Srfpodx3tjar_IFlJ_5NxgL1ycL1qWkHgAbyAt5j3q69zV8dLz_-Jjnzd6W_0IAO6s-wq4/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;676&quot; data-original-width=&quot;1159&quot; height=&quot;187&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEiz5vu9F8IQL-JvotRDMNu9VY-_ifCbSKiN3POaelyRDPQotGgcLusA-b76dHxwH1Srfpodx3tjar_IFlJ_5NxgL1ycL1qWkHgAbyAt5j3q69zV8dLz_-Jjnzd6W_0IAO6s-wq4/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;&lt;br /&gt;&lt;p&gt;But where is the text I was promised in the Google&#39;s search result? It&#39;s there, behind the image. PDF files have layers. You can put images on top that hides the text underneath. Humans only see the top layer, but google&#39;s indexing spiders see all the layers, and will index the hidden text. You can verify this by downloading the PDF and using tools to examine the raw text:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_eVXmvcZXVUHKdFODaouId1jDAA-pwYF3z2sZGclcAP7LjunXi4XhJFvofHVd8VrZZQ8BMpbK44wBZdHTn83NkM7-yg_aK1yKScMEMV6-gFrX0SB_T34hw_H2YQTfRswZIR2Z/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;663&quot; data-original-width=&quot;1000&quot; height=&quot;212&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEh_eVXmvcZXVUHKdFODaouId1jDAA-pwYF3z2sZGclcAP7LjunXi4XhJFvofHVd8VrZZQ8BMpbK44wBZdHTn83NkM7-yg_aK1yKScMEMV6-gFrX0SB_T34hw_H2YQTfRswZIR2Z/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;If you click on the &quot;I am not robot&quot; in the fake PDF, it takes you to a page like the following:&lt;p&gt;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjI3IV4FtFSRg60ZdApWxmDI0cKHucvWHFPIOWglR3fZQgJTGSj-I7LlpxymJYEu_sHBeqFbe5puUQrzhGljJunHraTTmN10hQYQwVhI6nZMP-Ju8C-oAAd0JqcfnFounVBqQtQ/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;471&quot; data-original-width=&quot;913&quot; height=&quot;165&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjI3IV4FtFSRg60ZdApWxmDI0cKHucvWHFPIOWglR3fZQgJTGSj-I7LlpxymJYEu_sHBeqFbe5puUQrzhGljJunHraTTmN10hQYQwVhI6nZMP-Ju8C-oAAd0JqcfnFounVBqQtQ/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;Here&#39;s where the &quot;hack&quot; happened. The user misclicked on &quot;Allow&quot; instead of &quot;Block&quot; -- accidentally. Once they did that, popups started happening, even when this window appeared to go away.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The lesson here is that &quot;misclicks happen&quot;. Even the most knowledgeable users, the smartest of cybersecurity experts, will eventually misclick themselves.&lt;/div&gt;&lt;div&gt;&lt;p&gt;As described above, once we identified this problem, we were able to safely turn off the popups by going to Firefox&#39;s &quot;Notification Permissions&quot;.&lt;/p&gt;&lt;p&gt;Note that the screenshots above are a mixture of Firefox images from the original user, and pictures of Chrome where I tried to replicate the attack in one of my browsers. I didn&#39;t succeed -- I still haven&#39;t been able to get any popups appearing on my computer.&lt;/p&gt;&lt;p&gt;So I tried a bunch of different browsers: Firefox, Chrome, and Brave on both Windows and macOS.&lt;/p&gt;&lt;p&gt;Each browser produced a different result, a sort of A/B testing based on the User-Agent (the string sent to webservers that identifies which browser you are using). Sometime following the hostile link from that PDF attempted to install a popup script in our original example, but sometimes it tried something else.&lt;/p&gt;&lt;p&gt;For example, on my Firefox, it tried to download a ZIP file containing a virus:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJBzQboxRN_RetSrC6hIyikOgJ_LGp0qAPQQraBbWxNyYgl9T1hdElC4Uu5mQj-zttKzhg1ckE9B6JEjus6z9dRBeONE4itnmmnSa2gT_HVzZC5S1PriXyKB3_L72U5zyq_4hq/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;637&quot; data-original-width=&quot;996&quot; height=&quot;205&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJBzQboxRN_RetSrC6hIyikOgJ_LGp0qAPQQraBbWxNyYgl9T1hdElC4Uu5mQj-zttKzhg1ckE9B6JEjus6z9dRBeONE4itnmmnSa2gT_HVzZC5S1PriXyKB3_L72U5zyq_4hq/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;When I attempt to download, Firefox tells me it&#39;s a virus -- probably because Firefox knows the site where it came from is evil.&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;However, Microsoft&#39;s free anti-virus didn&#39;t catch it. One reason is that it comes as an &lt;i&gt;encrypted zip&lt;/i&gt;&amp;nbsp;file. In order to open the file, you have to first read the unencrypted text file to get the password -- something humans can do but anti-virus products aren&#39;t able to do (or at least, not well).&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlutzKo_IEJgAHfeiBPyYnUsnORmgupnRI9-dbZ3eF6IYbi2YPYt4U23khK9ZsszWoNAyAPGQlYn4rys-AxG-bWzqcGusF8sPDjhjBF5v_j2Ijd_ISTzMtXrYNYtJ1LZKDOFX5/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;431&quot; data-original-width=&quot;1016&quot; height=&quot;136&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjlutzKo_IEJgAHfeiBPyYnUsnORmgupnRI9-dbZ3eF6IYbi2YPYt4U23khK9ZsszWoNAyAPGQlYn4rys-AxG-bWzqcGusF8sPDjhjBF5v_j2Ijd_ISTzMtXrYNYtJ1LZKDOFX5/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;So I opened the password file to get the password (&quot;257048169&quot;) and extracted the virus. This is mostly safe -- as long as I don&#39;t &lt;i&gt;run&lt;/i&gt; it. Viruses are harmless sitting on your machine as long as they aren&#39;t running. I say &quot;mostly&quot; because even for experts, &quot;misclicks happen&quot;, and if I&#39;m not careful, I may infect my machine.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Anyway, I want to see what the virus actually is. The easiest way to do that is &lt;a href=&quot;https://www.virustotal.com/gui/file/aefeb01a28379d3ac99576317a86ba58e6960dccb53792b7010bd1f471914169/detection&quot;&gt;upload it to VirusTotal&lt;/a&gt;, a website that runs all the known anti-virus programs on a submission to see what triggers what. It tells me that somebody else uploaded the same sample 2 hours ago, and that a bunch of anti-virus vendors detect it, with the following names:&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5GmTQ6BORO7Sy6paMtwqZ3-5ROhz0wLBWwlKJrD9oNp5hvUx2kgyrkztTdD8IQesaW7wPQA-UDTs13kwEf9KzN9Rn2UloPPCO5NUpCir8A-m91BaC2r4DRcVTW9cmWbqHVupv/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;911&quot; data-original-width=&quot;1273&quot; height=&quot;229&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEg5GmTQ6BORO7Sy6paMtwqZ3-5ROhz0wLBWwlKJrD9oNp5hvUx2kgyrkztTdD8IQesaW7wPQA-UDTs13kwEf9KzN9Rn2UloPPCO5NUpCir8A-m91BaC2r4DRcVTW9cmWbqHVupv/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;/div&gt;&lt;div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: left;&quot;&gt;&lt;br /&gt;&lt;/div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: left;&quot;&gt;With VirusTotal, you can investigate why anti-virus products think it may be a virus.&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: left;&quot;&gt;&lt;br /&gt;&lt;/div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: left;&quot;&gt;For example, anti-virus companies will run viruses to see what they do. They run them in &quot;emulated&quot; machines that are a lot slower, but safer. If viruses find themselves running in an emulated environment, then they stop doing all the bad behaviors the anti-virus programs might detection. So they repeated check the timestamp to see how fast they are running -- if too slow, they assume emulation.&lt;/div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: left;&quot;&gt;&lt;br /&gt;&lt;/div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: left;&quot;&gt;But this itself is a bad behavior. This timestamp detection is one of the behaviors the anti-virus programs triggered on as suspicious.&lt;/div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: left;&quot;&gt;&lt;br /&gt;&lt;/div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: left;&quot;&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFztQKvV5zKZo9p2n6oiZYFFLwF9MaAzNBbt51lA8B6eOOrzWHsSWBs_3JifWXgELRRuOIgK0IFg67EZ30cnZOtnKoOoIQ4ZQ2MErLZCEmo-y3eOSGUzXUzYfnW3rUCh_uMeUV/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;911&quot; data-original-width=&quot;1273&quot; height=&quot;229&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhFztQKvV5zKZo9p2n6oiZYFFLwF9MaAzNBbt51lA8B6eOOrzWHsSWBs_3JifWXgELRRuOIgK0IFg67EZ30cnZOtnKoOoIQ4ZQ2MErLZCEmo-y3eOSGUzXUzYfnW3rUCh_uMeUV/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;You can go investigate on VirusTotal &lt;a href=&quot;https://www.virustotal.com/gui/file/aefeb01a28379d3ac99576317a86ba58e6960dccb53792b7010bd1f471914169/behavior&quot;&gt;other things it found with this virus&lt;/a&gt;.&lt;/div&gt;&lt;br /&gt;Viruses and disconnected popups wasn&#39;t the only trick. In yet another attempt with web browsers, the hostile site attempt to open lots and lots of windows full of advertising. This is a direct way they earn money -- hacking the advertising companies rather than hacking you.&lt;br /&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;In yet another attempt with another browser, this time from my MacBook air, it asked for an email address:&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8tD27X0mKTfxOLQqHpVoVwtx1ZrIyVKacFQnyvNNWExUEQG0I1b76GPY2bHH1CKw4BFQtPmacSxS4uXU7ny2Vcozz0AVRq7XnQtH5QYsHX2MDZjx_rO1-cPpG1bNx3-8oQ8TK/s1788/Screen+Shot+2021-04-29+at+2.54.28+AM.png&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;1280&quot; data-original-width=&quot;1788&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8tD27X0mKTfxOLQqHpVoVwtx1ZrIyVKacFQnyvNNWExUEQG0I1b76GPY2bHH1CKw4BFQtPmacSxS4uXU7ny2Vcozz0AVRq7XnQtH5QYsHX2MDZjx_rO1-cPpG1bNx3-8oQ8TK/s320/Screen+Shot+2021-04-29+at+2.54.28+AM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;I happily obliged, giving it a fake address.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;At this point, the hackers are going to try to use the same email and password to log into Gmail, into a few banks, and so on. It&#39;s one of the top hacks these days (if not the most important hack) -- since most people reuse the same password for everything, even though it&#39;s not asking your for your Gmail or bank password, most of the time people will simply reuse them anyway. (This is why you need to keep important passwords separate from unimportant ones -- and write down your passwords or use a password manager).&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Anyway, I now get the next webpage. This is a straight up attempt to steal my credit card -- maybe.&amp;nbsp;&lt;/div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8O5FH15nM8N5jfq-gCPyx_sqGJ7oVCGLx3zKFk1hAtfO9CJtjTpbjBbWCeNbVWE0NdUYhQvQ74iB0sBwANlph9Ih5QBPAZ1xkghdGcNYsaIgM3tvISFCwd3O-Kxq408nfa7o8/s1746/Screen+Shot+2021-04-29+at+3.03.46+AM.png&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;1746&quot; data-original-width=&quot;1630&quot; height=&quot;320&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEj8O5FH15nM8N5jfq-gCPyx_sqGJ7oVCGLx3zKFk1hAtfO9CJtjTpbjBbWCeNbVWE0NdUYhQvQ74iB0sBwANlph9Ih5QBPAZ1xkghdGcNYsaIgM3tvISFCwd3O-Kxq408nfa7o8/s320/Screen+Shot+2021-04-29+at+3.03.46+AM.png&quot; /&gt;&lt;/a&gt;&lt;/div&gt;This is a website called &quot;AppCine.net&quot; that promises streaming movies, for free signup, but requires a credit card.&lt;br /&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;This may be a quasi-legitimate website. I saw &quot;quasi&quot; because their goal isn&#39;t outright credit card fraud, but a &quot;dark pattern&quot; whereby they make it easy to sign up for the first month free with a credit card, and then make it nearly impossible to stop the service, where they continue to bill you month after month. As long as the charges are small each month, most people won&#39;t bother going through all the effort canceling the service. And since it&#39;s not actually fraud, people won&#39;t call their credit card company and reverse the charges, since they actually did sign up for the service and haven&#39;t canceled it.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;It&#39;s a &lt;a href=&quot;https://www.nytimes.com/2021/04/03/us/politics/trump-donations.html&quot;&gt;slimy thing the Trump campaign did&lt;/a&gt; in the last election. Their website asked for one time donations but tricked people into unwittingly making it a regular donation. This caused a lot of &quot;chargebacks&quot; as people complained to their credit card company.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;In truth, everyone does the same pattern: makes it easy to sign up, and sign up for more than you realize, and then makes it hard to cancel. I thought I&#39;d canceled an AT&amp;amp;T phone but found out they&#39;d kept billing me for 3 years, despite the phone no longer existing and using their network.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;They probably have a rewards program. In other words, they aren&#39;t out there doing SEO hacking of google. Instead, they pay others to do it for them, and then give a percentage profit, either for incoming links, but probably &quot;conversion&quot;, money whenever somebody actually enters their credit card number and signs up.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Those people are in tern a different middleman. It probably goes like this:&lt;/div&gt;&lt;div&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;somebody skilled at SEO optimization, who sends links to a broker&lt;/li&gt;&lt;li&gt;a broker who then forwards those links to other middlemen&lt;/li&gt;&lt;li&gt;middlemen who then deliver those links to sites like AppCine.net that actually ask for an email address or credit card&lt;/li&gt;&lt;/ul&gt;&lt;/div&gt;&lt;div&gt;There&#39;s probably even more layers -- like any fine tuned industry, there are lots of specialists who focus on doing their job well.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Okay, I&#39;ll play along, and I enter a credit card number to see what happens (I have bunch of used debit cards to play this game). This leads to an error message saying the website is down and they can&#39;t deliver videos for me, but then pops up another box asking for my email, from yet another movie website:&lt;/div&gt;&lt;div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjb_o8vcqVwlnmiTv2p7X5gw_CnABiTSBMc214I4HeldbZIrIoRPTYWJ8M8_3Ew554UKnZXxDhZDDPPK3qaDkYDqBG2hfczsrnH-Du02SbKljgJ1GEtmSfqAZYZSsMn_fnWJ-Es/s1638/Screen+Shot+2021-04-29+at+3.13.50+AM.png&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;1166&quot; data-original-width=&quot;1638&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjb_o8vcqVwlnmiTv2p7X5gw_CnABiTSBMc214I4HeldbZIrIoRPTYWJ8M8_3Ew554UKnZXxDhZDDPPK3qaDkYDqBG2hfczsrnH-Du02SbKljgJ1GEtmSfqAZYZSsMn_fnWJ-Es/s320/Screen+Shot+2021-04-29+at+3.13.50+AM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;&lt;/div&gt;This leads to yet another site:&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdz-UjGbgg9KoeL6ZJK3u8clgFv-98kBrpaVFNjf02ED3PT5aTBRcRjCOMNoBG9J_8dpwbSBPhno4hW1cTDLMkj8XFe_OtYEbn46E77Uq4arAoKaCOM_C0zSJcqxzRuO0aptAp/s1638/Screen+Shot+2021-04-29+at+3.16.36+AM.png&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;1480&quot; data-original-width=&quot;1638&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhdz-UjGbgg9KoeL6ZJK3u8clgFv-98kBrpaVFNjf02ED3PT5aTBRcRjCOMNoBG9J_8dpwbSBPhno4hW1cTDLMkj8XFe_OtYEbn46E77Uq4arAoKaCOM_C0zSJcqxzRuO0aptAp/s320/Screen+Shot+2021-04-29+at+3.16.36+AM.png&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;It&#39;s an endless series. Once a site &quot;converts&quot; you, it then simply sells the link back to another middleman, who then forwards you on to the next. I could probably sit there all day with fake email addresses and credit cards and still not come to the end of it all.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;Summary&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/div&gt;&lt;div&gt;So here&#39;s what we found.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;First, there was a &quot;search engine optimization&quot; hacker who specializes in getting their content at the top of search results for random terms.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Second, they pass hits off to a broker who distributes the hits to various hackers who pay them. These hackers will try to exploit you with:&lt;/div&gt;&lt;div&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;popups pretending to be anti-virus warnings that show up outside the browser&lt;/li&gt;&lt;li&gt;actual virus downloads in encrypted zips that try to evade anti-virus, but not well&lt;/li&gt;&lt;li&gt;endless new windows selling you advertising&lt;/li&gt;&lt;li&gt;steal your email address and password, hoping that you&#39;ve simply reused one from legitimate websites, like Gmail or your bank&lt;/li&gt;&lt;li&gt;signups for free movie websites that try to get your credit card and charge you legally&lt;/li&gt;&lt;/ul&gt;&lt;/div&gt;&lt;div&gt;Even experts get confused. I had trouble helping this user track down exactly where the popup was coming from. Also, any expert can misclick and make the wrong thing happen -- this user had been clicking the right thing &quot;Block&quot; for years and accidentally hit &quot;Allow&quot; this one time.&lt;/div&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/4008232982979402236/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=4008232982979402236' title='0 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/4008232982979402236'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/4008232982979402236'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/04/anatomy-of-how-you-get-pwned.html' title='Anatomy of how you get pwned'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEisxnmkKzQg_ZP5a1OcYT984GOcOouARM8UbJhGy-dDhHuwLQcQWDqW1j_I1jc4tQm2nPT9oyM5NE7j_Ml0ycobZRBR_YCx1qyoRgUK4eDh9LVfCeoebYehjMpV-jg9ZeVNVBO2/s72-w320-h106-c/image.png" height="72" width="72"/><thr:total>0</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-7497953035384868701</id><published>2021-04-21T17:27:00.001-04:00</published><updated>2021-04-21T17:27:21.203-04:00</updated><title type='text'>Ethics: University of Minnesota&#39;s hostile patches</title><content type='html'>&lt;p&gt;The University of Minnesota (UMN) got into trouble this week for doing a study where they have submitted deliberately vulnerable patches into open-source projects, in order to test whether hostile actors can do this to hack things. After a UMN researcher submitted a crappy patch to the Linux Kernel, kernel maintainers decided to rip out all recent UMN patches.&lt;/p&gt;&lt;p&gt;Both things can be true:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;Their study was an important contribution to the field of cybersecurity.&lt;/li&gt;&lt;li&gt;Their study was unethical.&lt;/li&gt;&lt;/ul&gt;&lt;div&gt;It&#39;s like Nazi medical research on victims in concentration camps, or U.S. military research on unwitting soldiers. The research can simultaneously be wildly unethical but at the same time produce useful knowledge.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;I&#39;d agree that &lt;a href=&quot;https://github.com/QiushiWu/QiushiWu.github.io/blob/main/papers/OpenSourceInsecurity.pdf&quot;&gt;their paper&lt;/a&gt;&amp;nbsp;is useful. I would not be able to immediately recognize their patches as adding a vulnerability -- and I&#39;m an expert at such things.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;In addition, the sorts of bugs it exploits shows a way forward in the evolution of programming languages. It&#39;s not clear that a &quot;safe&quot; language like Rust would be the answer. Linux kernel programming requires tracking resources in ways that Rust would consider inherently &quot;unsafe&quot;. Instead, the C language needs to evolve with better safety features and better static analysis. Specifically, we need to be able to annotate the parameters and return statements from functions. For example, if a pointer can&#39;t be NULL, then it needs to be documented as a non-nullable pointer. (Imagine if pointers could be &lt;i&gt;signed&lt;/i&gt;&amp;nbsp;and &lt;i&gt;unsigned&lt;/i&gt;, meaning, can sometimes be NULL or never be NULL).&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;So I&#39;m glad this paper exists. As a researcher, I&#39;ll likely cite it in the future. As a programmer, I&#39;ll be more vigilant in the future. In my own open-source projects, I should probably review some previous pull requests that I&#39;ve accepted, since many of them have been the same crappy quality of simply adding a (probably) unnecessary NULL-pointer check.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The next question is whether this is ethical. Well, the paper claims to have sign-off from their university&#39;s IRB -- their &lt;a href=&quot;https://en.wikipedia.org/wiki/Institutional_review_board&quot;&gt;Institutional Review Board&lt;/a&gt; that reviews the ethics of experiments. Universities created IRBs to deal with the fact that many medical experiments were done on either unwilling or unwitting subjects, such as the Tuskegee Syphilis Study. All medical research must have IRB sign-off these days.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;However, I think IRB sign-off for computer security research is stupid. Things like masscanning of the entire Internet are undecidable with traditional ethics. I regularly scan every device on the IPv4 Internet, including your own home router. If you paid attention to the packets your firewall drops, some of them would be from me. Some consider this a gross violation of basic ethics and get very upset that I&#39;m scanning their computer. Others consider this to be the expected consequence of the end-to-end nature of the public Internet, that there&#39;s an inherent social contract that you must be prepared to receive any packet from anywhere. Kerckhoff&#39;s Principle from the 1800s suggests that core ethic of cybersecurity is exposure to such things rather than trying to cover them up.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The point isn&#39;t to argue whether masscanning is ethical. The point is to argue that it&#39;s undecided, and that your IRB isn&#39;t going to be able to answer the question better than anybody else.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;But here&#39;s the thing about masscanning: I&#39;m honest and transparent about it. My very first scan of the entire Internet came with a tweet &quot;BTW, this is me scanning the entire Internet&quot;.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;A lot of ethical questions in other fields comes down to honesty. If you have to lie about it or cover it up, then there&#39;s a good chance it&#39;s unethical.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;For example, the west suffers a lot of cyberattacks from Russia and China. Therefore, as a lone wolf actor capable of hacking them back, is it ethical to do so? The easy answer is that when discovered, would you say &quot;yes, I did that, and I&#39;m proud of it&quot;, or would you lie about it? I admit this is a difficult question, because it&#39;s posed in terms of whether you&#39;d want to evade the disapproval from other people, when the reality is that you might not want to get &lt;a href=&quot;https://en.wikipedia.org/wiki/Poisoning_of_Alexei_Navalny&quot;&gt;novichoked&lt;/a&gt; by Putin.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The above research is based on a lie. Lying has consequences.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The natural consequence here is that now that UMN did that study, none of the patches they submit can be trusted. It&#39;s not just this one&amp;nbsp;&lt;a href=&quot;https://lore.kernel.org/linux-nfs/20210407001658.2208535-1-pakki001@umn.edu/&quot;&gt;submitted patch&lt;/a&gt;. The kernel maintainers are taking&amp;nbsp;&lt;a href=&quot;https://lore.kernel.org/lkml/20210421130105.1226686-1-gregkh@linuxfoundation.org/&quot;&gt;scorched earth response&lt;/a&gt;, reverting all recent patches from the university and banning future patches from them. It may be a little hysterical, but at the same time, this is a new situation that no existing policy covers.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;I partly disagree with the kernel maintainer&#39;s &lt;a href=&quot;https://lore.kernel.org/linux-nfs/YH%2FfM%2FTsbmcZzwnX@kroah.com/&quot;&gt;conclusion&lt;/a&gt; that the patches &quot;obviously were _NOT_ created by a static analysis tool&quot;. This is exactly the sort of noise static analyzers have produced in the past. I reviewed the &lt;a href=&quot;https://elixir.bootlin.com/linux/latest/source/net/sunrpc/auth_gss/auth_gss.c#L385&quot;&gt;source file&lt;/a&gt; for how a static analyzer might come to this conclusion, and found it&#39;s exactly the sort of thing it might produce.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;But at the same time, it&#39;s obviously noise and bad output. If the researcher were developing a static analyzer tool, they should understand that this is crap noise and bad output from the static analyzer. They should not be submitting low-quality patches like this one. The main concern that researchers need to focus on for static analysis isn&#39;t increasing detection of vulns, but decreasing noise.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;In other words, the debate here is whether the researcher is incompetent or dishonest. Given that UMN has practiced dishonesty in the past, it&#39;s legitimate to believe they are doing so again. Indeed, &quot;static analysis&quot; research might also include research in automated ways to find subversive bugs. One might create a static analyzer to search code for ways to insert a NULL pointer check to add a vuln.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;Now incompetence is actually a fine thing. That&#39;s the point of research, is to learn things. Starting fresh without all the preconceptions of old work is also useful. That researcher has problems today, but a year or two from now they&#39;ll be an ultra-competent expert in their field. That&#39;s how one achieves competence -- making mistakes, lots of them.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;But either way, the Linux kernel maintainer response of &quot;we are not part of your research project&quot; is a valid. These patches are crap, regardless of which research project they are pursuing (static analyzer or malicious patch submissions).&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;Conclusion&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/div&gt;&lt;div&gt;I think the UMN research into bad-faith patches is useful to the community. I reject the idea that their IRB, which is focused on biomedical ethics rather than cybersecurity ethics, would be useful here. Indeed, it&#39;s done the reverse: IRB approval has tainted the entire university with the problem rather than limiting the fallout to just the researchers that could&#39;ve been disavowed.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;The natural consequence of being dishonest is that people can&#39;t trust you. In cybersecurity, trust is hard to win and easy to lose -- and UMN lost it. The researchers should have understand that &quot;dishonesty&quot; was going to be a problem.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;I&#39;m not sure there is a way to ethically be dishonest, so I&#39;m not sure how such useful research can be done without the researchers or sponsors being tainted by it. I just know that &quot;dishonesty&quot; is an easily recognizable issue in cybersecurity that needs to be avoided. If anybody knows how to be ethically dishonest, I&#39;d like to hear it.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;Update:&lt;/b&gt;&amp;nbsp;This person proposes a way this research could be conducted to ethically be dishonest:&lt;/div&gt;
  6. &lt;blockquote class=&quot;twitter-tweet&quot;&gt;&lt;p dir=&quot;ltr&quot; lang=&quot;en&quot;&gt;By asking the top boss if it&#39;s okay if you lie to their team, a la an authorized penetration test.&lt;br /&gt;&lt;br /&gt;In this case that might still not be ethical, because while the top guy can answer for the /project/ he can&#39;t answer for the other /people/, who are volunteers and not employees.&lt;/p&gt;— Random of Eddie (@random_eddie) &lt;a href=&quot;https://twitter.com/random_eddie/status/1384979654256308225?ref_src=twsrc%5Etfw&quot;&gt;April 21, 2021&lt;/a&gt;&lt;/blockquote&gt; &lt;script async=&quot;&quot; charset=&quot;utf-8&quot; src=&quot;https://platform.twitter.com/widgets.js&quot;&gt;&lt;/script&gt;
  7. </content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/7497953035384868701/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=7497953035384868701' title='1 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/7497953035384868701'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/7497953035384868701'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/04/ethics-university-of-minnesotas-hostile.html' title='Ethics: University of Minnesota&#39;s hostile patches'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><thr:total>1</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-1949610645936705403</id><published>2021-03-26T14:43:00.003-04:00</published><updated>2021-03-26T14:51:59.223-04:00</updated><title type='text'>A quick FAQ about NFTs</title><content type='html'>&lt;p&gt;I thought I&#39;d write up 4 technical questions about NFTs. They may not be the ones you ask, but they are the ones you should be asking. The questions:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;What does the token look like?&lt;/li&gt;&lt;li&gt;How does it contain the artwork? (or, where is the artwork contained?)&lt;/li&gt;&lt;li&gt;How are tokens traded? (How do they get paid? How do they get from one account to another?)&lt;/li&gt;&lt;li&gt;What does the link from token to artwork mean? Does it give copyrights?&lt;/li&gt;&lt;/ul&gt;&lt;div&gt;I&#39;m going to use 4 sample tokens that have been sold for outrageous prices as examples.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;#1 What does the token look like?&lt;/b&gt;&lt;/p&gt;&lt;p&gt;An NFT token has a unique number, analogous to:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;your social security number (SSN#)&lt;/li&gt;&lt;li&gt;your credit card number&lt;/li&gt;&lt;li&gt;the VIN# on your car&lt;/li&gt;&lt;li&gt;the serial number on a dollar bill&lt;/li&gt;&lt;li&gt;etc.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;This unique number is composed of two things:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;the contract number, identifying the contract that manages the token&lt;/li&gt;&lt;li&gt;the unique token identifier within that contract&lt;/li&gt;&lt;/ul&gt;&lt;div&gt;Here are some example tokens, listing the contract number (the long string) and token ID (short number), as well as a link to a story on how much it sold for recently.&lt;/div&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;&lt;a href=&quot;https://etherscan.io/address/0x2a46f2ffd99e19a89476e2f62270e0a35bbf0756#code&quot;&gt;&lt;i&gt;&lt;span style=&quot;font-family: courier; font-size: x-small;&quot;&gt;0x2a46f2ffd99e19a89476e2f62270e0a35bbf0756&lt;/span&gt;&lt;/i&gt;&lt;/a&gt; - #40913 (&lt;a href=&quot;https://www.theverge.com/2021/3/11/22325054/beeple-christies-nft-sale-cost-everydays-69-million&quot;&gt;Beeple $69m&lt;/a&gt;)&lt;/li&gt;&lt;li&gt;&lt;a href=&quot;https://etherscan.io/address/0xb47e3cd837ddf8e4c57f05d70ab865de6e193bbb#code&quot;&gt;&lt;i&gt;&lt;span style=&quot;font-family: courier; font-size: x-small;&quot;&gt;0xb47e3cd837dDF8e4c57F05d70Ab865de6e193BBB&lt;/span&gt;&lt;/i&gt;&lt;/a&gt;&amp;nbsp; #7804 (&lt;a href=&quot;https://www.forbes.com/sites/alexkonrad/2021/03/18/figma-ceo-dylan-field-talks-cryptopunks-nft-beeple-metaverse/?sh=38a2c7105a1d&quot;&gt;$7.6m CryptoPunks&lt;/a&gt;)&lt;/li&gt;&lt;li&gt;&lt;a href=&quot;https://etherscan.io/address/0x9fc4e38da3a5f7d4950e396732ae10c3f0a54886#code&quot;&gt;&lt;i&gt;&lt;span style=&quot;font-family: courier; font-size: x-small;&quot;&gt;0x9fc4e38da3a5f7d4950e396732ae10c3f0a54886&lt;/span&gt;&lt;/i&gt;&amp;nbsp;&lt;/a&gt;- #1 (&lt;a href=&quot;https://www.nasdaq.com/articles/associated-press-nft-artwork-sells-for-%24180k-in-ether-2021-03-12&quot;&gt;AP $180k&lt;/a&gt;)&lt;/li&gt;&lt;li&gt;&lt;i&gt;&lt;span style=&quot;font-family: courier; font-size: x-small;&quot;&gt;&lt;a href=&quot;https://etherscan.io/address/0x06012c8cf97bead5deae237070f9587f8e7a266d#code&quot;&gt;0x06012c8cf97BEaD5deAe237070F9587f8E7A266d&lt;/a&gt;&lt;/span&gt;&lt;/i&gt; - #896775 (&lt;a href=&quot;https://thenextweb.com/hardfork/2018/09/05/most-expensive-cryptokitty/&quot;&gt;$170k CryptoKitty&lt;/a&gt;)&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;With these two numbers, you can go find the token on the blockchain, and read the code to determine what the token contains, how it&#39;s traded, its current owner, and so on.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;#2 How do NFTs contain artwork? or, where is artwork contained?&lt;/b&gt;&lt;/p&gt;&lt;p&gt;Tokens can&#39;t*** contain artwork -- art is too big to fit on the blockchain. That Beeple piece is 300-megabytes in size. Therefore, tokens point to artwork that is located somewhere else than the blockchain.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;*** (footnote) This isn&#39;t actually true. It&#39;s just that it&#39;s very expensive to put artwork on the blockchain. That Beeple artwork would cost about $5million to put onto the blockchain. Yes, this less than a tenth the purchase price of $69million, but when you account for &lt;i&gt;all&lt;/i&gt;&amp;nbsp;the artwork for which people have created NFTs, the total exceeds the prices for all NFTs.&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;So if artwork isn&#39;t on the blockchain, where is it located? and how do the NFTs link to it?&lt;/p&gt;&lt;p&gt;Our four examples of NFT mentioned above show four different answers to this question. Some are smart, others are stupid -- and by &quot;stupid&quot; I mean &quot;tantamount to fraud&quot;.&lt;/p&gt;&lt;p&gt;The correct way to link a token with a piece of digital art is through a &lt;i&gt;&lt;b&gt;hash&lt;/b&gt;&lt;/i&gt;, which can be used with the decentralized &lt;i&gt;&lt;b&gt;darknet&lt;/b&gt;&lt;/i&gt;.&lt;/p&gt;&lt;p&gt;A&amp;nbsp;&lt;i&gt;hash&lt;/i&gt;&amp;nbsp;is a unique cryptographic &quot;key&quot; (sic) generated from the file contents. No two files with different contents (or different lengths) will generate the same&amp;nbsp;&lt;i&gt;hash&lt;/i&gt;. A hacker can&#39;t create a different file that generates the same hash. Therefore, the&amp;nbsp;&lt;i&gt;hash&lt;/i&gt;&amp;nbsp;becomes the&amp;nbsp;&lt;i&gt;identity&lt;/i&gt;&amp;nbsp;of the file -- if you have a hash and a file, you can independently verify the two match.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirQrGRMWEXu3WuX5v7PMyS5syelGleF_oIi327qGS-dFA8kT13K5E8plLZRNOwZoRkXqO0-2Fn9mWayIa_fZaTxhPDzYSiZnnUhrKPHi1BT44BsbiRd2RaDDU7fe18CJujD3oH/&quot; style=&quot;clear: right; float: right; margin-bottom: 1em; margin-left: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;813&quot; data-original-width=&quot;1220&quot; height=&quot;134&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirQrGRMWEXu3WuX5v7PMyS5syelGleF_oIi327qGS-dFA8kT13K5E8plLZRNOwZoRkXqO0-2Fn9mWayIa_fZaTxhPDzYSiZnnUhrKPHi1BT44BsbiRd2RaDDU7fe18CJujD3oH/w200-h134/image.png&quot; width=&quot;200&quot; /&gt;&lt;/a&gt;&lt;/div&gt;The hash (and therefore unique identity) of the &lt;b&gt;Beeple file&lt;/b&gt; is the following string:&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;With the hash, it doesn&#39;t matter where the file is located right now in cyberspace. It only matters that at some point in the future, when the owner of the NFT wants to sell it, they can produce the file which provably matches the hash.&lt;/p&gt;&lt;p&gt;To repeat: because of the magic of cryptographic &lt;i&gt;hashes&lt;/i&gt;, the artwork in question doesn&#39;t have to be located anywhere in particular.&lt;/p&gt;&lt;p&gt;However, people do like having a live copy of the file available in a well known location. One way of doing this is with the &lt;i&gt;darknet&lt;/i&gt;, which is essentially a decentralized version of the web. In much the same way the blockchain provides &lt;i&gt;decentralized&lt;/i&gt;&amp;nbsp;transactions, darknet services provide &lt;i&gt;decentralized&lt;/i&gt;&amp;nbsp;file sharing. The most famous of such services is BitTorrent. The most popular for use with NFTs is known as IPFS (&lt;a href=&quot;https://en.wikipedia.org/wiki/InterPlanetary_File_System&quot;&gt;InterPlanetary File System&lt;/a&gt;). A hash contained within an NFT token often links to the IPFS system.&lt;/p&gt;&lt;p&gt;In the $69million Beeple NFT, this link is:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;ipfs://ipfs/QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Sharp eyed readers will notice the hash of the artwork (above) doesn&#39;t match the hash in this IPFS link.&lt;/p&gt;&lt;p&gt;That&#39;s because the NFT token points to a &lt;a href=&quot;https://ipfsgateway.makersplace.com/ipfs/QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz&quot;&gt;metadata file&lt;/a&gt; that contains the real hash, along with other information about the artwork. The QmPAg.... hash points to metadata that contains the QmXkx... hash.&lt;/p&gt;&lt;p&gt;But a chain of hashes in this manner is still just as secure as a single hash -- indeed, that&#39;s what the &quot;blockchain&quot; is -- a hash chain. In the future, when the owner sells this NFT, they&#39;ll need to provide both files, the metadata and the artwork, to conclusively transfer ownership.&lt;/p&gt;&lt;p&gt;Thus, in answer to the question of where the artwork is located (in the NFT? on the web?), the answer is often that the NFT token contains a hash pointing to the darknet.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjOLbRezsx3DBvOmdjCtiUj7wSGdhbd1f_mK8L7payXtY6tUef0fTTrx3e7bfHKTce7GLwZI_p-nSXgmlt0DLS7Q69iAiywQcTKrTOh_2vha0yH0Mh92z8U8DeB62Lw_4mKCTc/&quot; style=&quot;clear: right; float: right; margin-bottom: 1em; margin-left: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;432&quot; data-original-width=&quot;768&quot; height=&quot;113&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgjOLbRezsx3DBvOmdjCtiUj7wSGdhbd1f_mK8L7payXtY6tUef0fTTrx3e7bfHKTce7GLwZI_p-nSXgmlt0DLS7Q69iAiywQcTKrTOh_2vha0yH0Mh92z8U8DeB62Lw_4mKCTc/w200-h113/image.png&quot; width=&quot;200&quot; /&gt;&lt;/a&gt;&lt;/div&gt;Let&#39;s look at another token on our list, the &lt;b&gt;$180k AP artwork&lt;/b&gt;. The NFT links to the following URL:&lt;p&gt;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;a href=&quot;https://ap-nft.everipedia.org/api/presidential-2020/1&quot;&gt;https://ap-nft.everipedia.org/api/presidential-2020/1&lt;/a&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;Like the above example with Beeple, this too points to a metadata file, with a link to the eventual artwork (&lt;a href=&quot;https://gateway.pinata.cloud/ipfs/QmU81jiJ41qne5DFoDwsmgpq6AG3ziHdJbSnMkXBYQVU8v&quot;&gt;here&lt;/a&gt;). However, this chain is broken in the middle with that URL -- it isn&#39;t decentralized, and there&#39;s no guarantee in the future that it&#39;ll exist. The company &quot;Everipedia&quot; could go out of business tomorrow, or simply decide to stop sharing the file to the web, or decide to provide a different file at that location. In these cases, the thing the NFT points to disappears.&lt;/p&gt;&lt;p&gt;In other words, 50 years from now, after WW III and we&#39;ve all moved to the off-world colonies, the owner of Beeple&#39;s NFT will still be able to sell it, providing the two additional files. The owner of this AP NFT probably won&#39;t -- the link will probably have disappeared from the web -- they won&#39;t be able to prove that the NFT they control points to the indicated artwork.&lt;/p&gt;&lt;p&gt;I would call this tantamount to fraud -- almost. The information is all there for the buyer to check, so they know the problems with this NFT. They obviously didn&#39;t care -- maybe they plan on being able to offload the NFT onto another buyer before the URL disappears.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH9TC-wQ9_jnuSynyagaDbHo_9vecqNHkcOK5dkR33GJ8Qua6oiLaagaKgmcgcD3a9iQHrMF6ALBNxnOGpfJtPG10ONEnEdCxcYZD4aGsc_YgiGub-cu7jTf6RZWBP4PbPbQrt/&quot; style=&quot;clear: right; float: right; margin-bottom: 1em; margin-left: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;476&quot; data-original-width=&quot;483&quot; height=&quot;197&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEhH9TC-wQ9_jnuSynyagaDbHo_9vecqNHkcOK5dkR33GJ8Qua6oiLaagaKgmcgcD3a9iQHrMF6ALBNxnOGpfJtPG10ONEnEdCxcYZD4aGsc_YgiGub-cu7jTf6RZWBP4PbPbQrt/w200-h197/image.png&quot; width=&quot;200&quot; /&gt;&lt;/a&gt;&lt;/div&gt;Now let&#39;s look at the &lt;b&gt;CryptoPunks #7804&lt;/b&gt;&amp;nbsp;NFT. The contract points to the same &lt;i&gt;hash&lt;/i&gt; of an image file that contains all 10,000 possible token images. That hash is the following. Click on it to see the file it maps to:&lt;p&gt;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;a href=&quot;https://github.com/larvalabs/cryptopunks/raw/master/punks.png&quot;&gt;ac39af4793119ee46bbff351d8cb6b5f23da60222126add4268e261199a2921b&lt;/a&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;The token ID in question is #7804. If you look in that file for the 7804th face, you&#39;ll see which one the token matches.&lt;/p&gt;&lt;p&gt;Unfortunately, the original contract doesn&#39;t actually explain how we arrive at the 7804th sub-image. Do we go left to right? Top down? or some other method? Currently, there exists a website that does the translation using one algorithm, but in the future, there&#39;s no hard proof which token maps to which face inside that massive image.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi10k2-8LFjo8M8lmLeUaarcILLFkDqc1-FwCCdjOStrfQesv3evpgMuwq4OD5eZx0NCzV9sQNQIN-hkJwKGlo-omVOCMr0aueCfHRSa86e8Cb2NQkuLTsMydVrqOxSI8tEQNUE/&quot; style=&quot;clear: right; float: right; margin-bottom: 1em; margin-left: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;447&quot; data-original-width=&quot;572&quot; height=&quot;156&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEi10k2-8LFjo8M8lmLeUaarcILLFkDqc1-FwCCdjOStrfQesv3evpgMuwq4OD5eZx0NCzV9sQNQIN-hkJwKGlo-omVOCMr0aueCfHRSa86e8Cb2NQkuLTsMydVrqOxSI8tEQNUE/w200-h156/image.png&quot; width=&quot;200&quot; /&gt;&lt;/a&gt;&lt;/div&gt;Now let&#39;s look at the &lt;b&gt;CryptoKitty #896775&lt;/b&gt;&amp;nbsp;. In this case, there&#39;s no hashes involved, and no image. Instead, each kitty is expressed as a pattern of &quot;genes&quot;, with contracts that specify how to two kittens can breed together to create a new kitty&#39;s genes. The above token contains the gene sequence:&lt;p&gt;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;235340506405654824796728975308592110924822688777991068596785613937685997&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;There are other contracts on the blockchain that can interact with this.&amp;nbsp;&lt;/p&gt;&lt;p&gt;The CryptoKitty images we see are generated by an algorithm that reads the gene sequence. Thus, there is no image file, no hash of a file. The algorithm that does this is located off-chain, so again we have the problem that in the future, the owner of the token may not be able to prove ownership of the correct image.&lt;/p&gt;&lt;p&gt;So what we see in these examples is one case where there&#39;s a robust hash chain linking the NFT with the corresponding image file, and three examples where the link is problematic -- ranging from slightly broken to almost fraudulent.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;#3 How are tokens traded?&lt;/b&gt;&lt;/p&gt;&lt;p&gt;There are two ways you can sell your NFTs:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;off the blockchain&lt;/li&gt;&lt;li&gt;on the blockchain&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;The Beeple artwork was sold through Christie&#39;s -- meaning off blockchain. Christies conducted the bidding and collected the payment, took its cut, and gave the rest to the artist. The artist then transferred the NFT. We can see this on the blockchain where Beeple transferred the NFT for $0, but we can&#39;t see the flow of money &lt;b&gt;off blockchain&lt;/b&gt;.&lt;/p&gt;&lt;p&gt;This is the exception. The rule is that NFTs are supposed to be traded &lt;b&gt;on blockchain&lt;/b&gt;.&lt;/p&gt;&lt;p&gt;NFT contracts don&#39;t have auction or selling capabilities themselves. Instead, they follow a standard (known as ERC721) that allows them to be managed by other contracts. A person controlling a token selects some other auction/selling contract that matches the terms they want, and gives control to that contract.&lt;/p&gt;&lt;p&gt;Because contracts are code, both sides are know what the terms are, and can be confident they won&#39;t be defrauded by the other side.&lt;/p&gt;&lt;p&gt;For example, a contract&#39;s terms might be to provide for bids over 5 days, transfer the NFT from the owner to the buyer, and transfer coins from the buyer to the previous owner.&lt;/p&gt;&lt;p&gt;This is really why NFTs are so popular: not ownership of artwork, but &lt;i&gt;on blockchain&lt;/i&gt; buying and selling of tokens. It&#39;s the ability to conduct such commerce where the rules are dictated by code rather than by humans, where such transfers happen in a decentralized manner rather than through a central authority that can commit fraud.&lt;/p&gt;&lt;p&gt;So the upshot is that if you own an NFT, you can use the &lt;b&gt;Transfer()&lt;/b&gt;&amp;nbsp;function to transfer it to some other owner, or you can authorize some other contract to do the selling for you, which will eventually call this Transfer() function when the deal is done. Such a contract will likely also transfer coins in the other direction, paying you for your token.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;#4 What does this all mean?&lt;/b&gt;&lt;/p&gt;&lt;p&gt;If you break into the Louvre Museum and steal the Mona Lisa, you will &lt;b&gt;control&lt;/b&gt;&amp;nbsp;the artwork. But you won&#39;t &lt;b&gt;own&lt;/b&gt;&amp;nbsp;it. The word &quot;ownership&quot; is defined to mean your legal rights over the object. If the legal authorities catch up with you, they&#39;ll stick you in jail and transfer control of the artwork back to the rightful legal owner.&lt;/p&gt;&lt;p&gt;We keep talking about &quot;ownership&quot; of NFTs, but this is fiction. Instead, all that you get when you acquire an NFT is &quot;control&quot; -- control of just the token even, and not of the underlying artwork. Much of what happens in blockchain/cryptocurrencies isn&#39;t covered by the law. Therefore, you can&#39;t really &quot;own&quot; tokens. But you certainly control them (with the private key in your wallet that matches the public key of your account/address on the blockchain).&lt;/p&gt;&lt;p&gt;This is why NFTs are problematic, people are paying attention to the fiction (&quot;ownership&quot;) and not the technical details (&quot;control&quot;). We see that in the AP artwork above which simply links to a URL instead of a hash, missing a crucial step. They weren&#39;t paying attention to the details.&lt;/p&gt;&lt;p&gt;There are other missing steps. For example, I can create my own NFTs representing all these artworks and sell them (maybe covered in a future blogpost). It&#39;s a fiction that one of these is valid and my copy NFTs are invalid.&lt;/p&gt;&lt;p&gt;On the other hand, this criticism can go too far. Some people claim the entire blockchain/cryptocurrency market is complete fiction. This isn&#39;t true -- there&#39;s lots of obvious value in transactions that are carried out by code rather than by humans.&lt;/p&gt;&lt;p&gt;For example, an oil company might sell tokens for oil futures, allowing people to trade such futures on the blockchain. Ultimately, though, the value of such tokens comes down to faith in the original issuer that they&#39;ll deliver on the promise -- that the controller of the token will eventually get something in the real world. There are lots of companies being successful with this sort of thing, such as the BAT token used in the &quot;Brave&quot; web browser that provides websites with micropayment revenue instead of advertising revenue.&lt;/p&gt;&lt;p&gt;Thus, the difference here is that cryptocurrencies are part fiction, part real -- tied to real world things. But NFTs representing artwork are pretty much completely fiction. They confer no control over the artwork in the real world. Whatever tie a token has to the artwork is purely in your imagination.&lt;/p&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/1949610645936705403/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=1949610645936705403' title='1 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/1949610645936705403'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/1949610645936705403'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/03/a-quick-faq-about-nfts.html' title='A quick FAQ about NFTs'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEirQrGRMWEXu3WuX5v7PMyS5syelGleF_oIi327qGS-dFA8kT13K5E8plLZRNOwZoRkXqO0-2Fn9mWayIa_fZaTxhPDzYSiZnnUhrKPHi1BT44BsbiRd2RaDDU7fe18CJujD3oH/s72-w200-h134-c/image.png" height="72" width="72"/><thr:total>1</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-4049457482069625866</id><published>2021-03-20T23:12:00.005-04:00</published><updated>2021-03-20T23:52:47.549-04:00</updated><title type='text'>Deconstructing that $69million NFT</title><content type='html'>&lt;p&gt;&quot;NFTs&quot; have hit the mainstream news with the sale of an NFT based digital artwork for $69 million. I thought I&#39;d write up an explainer. Specifically, I deconstruct that huge purchase and show what actually was exchanged, down to the raw code. (The answer: almost nothing).&lt;/p&gt;&lt;p&gt;The reason for this post is that every other description of NFTs describe what they &lt;i&gt;pretend&lt;/i&gt;&amp;nbsp;to be. In this blogpost, I drill down on what they &lt;i&gt;actually&lt;/i&gt;&amp;nbsp;are.&lt;/p&gt;&lt;p&gt;Note that this example is about &quot;NFT artwork&quot;, the thing that&#39;s been in the news. There are other uses of NFTs, which work very differently than what&#39;s shown here.&lt;/p&gt;&lt;p&gt;&lt;b&gt;tl;dr&lt;/b&gt;&lt;/p&gt;&lt;p&gt;I have long bit of text explaining things. Here is the short form that allows you to drill down to the individual pieces.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ul&gt;&lt;li&gt;&lt;a href=&quot;https://www.beeple-crap.com/&quot;&gt;Beeple&lt;/a&gt; created a piece of art in a &lt;a href=&quot;https://ipfsgateway.makersplace.com/ipfs/QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA&quot;&gt;file&lt;/a&gt;&lt;/li&gt;&lt;li&gt;He created a &lt;a href=&quot;https://google.com/search?q=QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA&quot;&gt;hash&lt;/a&gt; that uniquely, and unhackably, identified that file&lt;br /&gt;&lt;/li&gt;&lt;li&gt;He created a &lt;a href=&quot;https://dweb.link/ipfs/QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz&quot;&gt;metadata file&lt;/a&gt; that included the hash to the artwork&lt;/li&gt;&lt;li&gt;He created a &lt;a href=&quot;https://google.com/search?q=QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz&quot;&gt;hash&lt;/a&gt; to the metadata file&lt;/li&gt;&lt;li&gt;He uploaded both files (metadata and artwork) to the &lt;a href=&quot;https://en.wikipedia.org/wiki/InterPlanetary_File_System&quot;&gt;IPFS&lt;/a&gt; darknet decentralized file sharing service&lt;/li&gt;&lt;li&gt;He created, or&amp;nbsp;&lt;a href=&quot;https://etherscan.io/tx/0x84760768c527794ede901f97973385bfc1bf2e297f7ed16f523f75412ae772b3#eventlog&quot;&gt;minted a token&lt;/a&gt; governed by the &lt;a href=&quot;https://etherscan.io/address/0x2a46f2ffd99e19a89476e2f62270e0a35bbf0756#code&quot;&gt;MakersTokenV2 smart contract&lt;/a&gt; on the Ethereum blockchain&lt;/li&gt;&lt;li&gt;Christies created an &lt;a href=&quot;https://onlineonly.christies.com/s/first-open-beeple/beeple-b-1981-1/112924&quot;&gt;auction&lt;/a&gt; for this token&lt;/li&gt;&lt;li&gt;The auction was concluded with a payment of $69 million worth of Ether cryptocurrency. However, nobody has been able to find this payment on the Ethereum blockchain, the money was probably transferred through some private means.&lt;/li&gt;&lt;li&gt;Beeple &lt;a href=&quot;https://etherscan.io/tx/0xa342e9de61c34900883218fe52bc9931daa1a10b6f48c506f2253c279b15e5bf#eventlog&quot;&gt;transferred&lt;/a&gt; the token to the winner, who &lt;a href=&quot;https://etherscan.io/tx/0x01d0967faaaf95f3e19164803a1cf1a2f96644ebfababb2b810d41a72f502d49#eventlog&quot;&gt;transferred&lt;/a&gt; it again to this final &lt;a href=&quot;https://etherscan.io/address/0x8bb37fb0f0462bb3fc8995cf17721f8e4a399629#tokentxnsErc721&quot;&gt;Metakovan&lt;/a&gt; account&lt;/li&gt;&lt;/ul&gt;&lt;div&gt;Each of the link above allows you to drill down to exactly what&#39;s happening on the blockchain. The rest of this post discusses things in long form.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;p&gt;&lt;b&gt;Why do I care?&lt;/b&gt;&lt;/p&gt;&lt;p&gt;Well, you don&#39;t. It makes you feel stupid that you haven&#39;t heard about it, when everyone is suddenly talking about it as if it&#39;s been a thing for a long time. But the reality, &lt;i&gt;they&lt;/i&gt;&amp;nbsp;didn&#39;t know what it was a month ago, either. Here is the Google Trends graph to prove this point -- interest has only exploded in the last couple months:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiz76iRC5UAkv0R-Asg4LcveX0SgAJs1nPc6XR9PQSYCBg6ZkvO4Q8dv5tvKAEox6j3UFQg_zfjAi2P0xhOaORqVVaf07KUBGSpJpntxBzDnw5ACuxm5iuw-ORUYd44J7iWZaF/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;479&quot; data-original-width=&quot;1223&quot; height=&quot;125&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiz76iRC5UAkv0R-Asg4LcveX0SgAJs1nPc6XR9PQSYCBg6ZkvO4Q8dv5tvKAEox6j3UFQg_zfjAi2P0xhOaORqVVaf07KUBGSpJpntxBzDnw5ACuxm5iuw-ORUYd44J7iWZaF/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;p&gt;&lt;/p&gt;&lt;div&gt;The same applies to me. I&#39;ve been aware of them (since the CryptoKitties craze from a couple years ago) but haven&#39;t invested time reading source code until now. Much of this blogpost is written as notes as I discover for myself exactly what was purchased for $69 million, reading the actual transactions.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div style=&quot;font-weight: bold;&quot;&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/div&gt;&lt;b&gt;So what is it?&lt;/b&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;My definition: &quot;Something new that can be traded on a blockchain that isn&#39;t a fungible cryptocurrency&quot;.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;In this post, I&#39;m going to explain in technical details. Before this, you might want to pause and see what everyone else is saying about it. You can look &lt;a href=&quot;https://en.wikipedia.org/wiki/Non-fungible_token&quot;&gt;on Wikipedia&lt;/a&gt; to answer that question, or look at the following definition &lt;a href=&quot;https://www.cnn.com/2021/03/17/business/what-is-nft-meaning-fe-series/index.html&quot;&gt;from CNN&lt;/a&gt; (the first result when I google it):&lt;/div&gt;&lt;div&gt;&lt;span style=&quot;font-size: x-small;&quot;&gt;&lt;blockquote&gt;Non-fungible tokens, or NFTs, are pieces of digital content linked to the blockchain, the digital database underpinning cryptocurrencies such as bitcoin and ethereum. Unlike NFTs, those assets are fungible, meaning they can be replaced or exchanged with another identical one of the same value, much like a dollar bill.&lt;/blockquote&gt;&lt;/span&gt;&lt;/div&gt;&lt;div&gt;You can also get a list of common NFT systems &lt;a href=&quot;https://etherscan.io/tokens-nft&quot;&gt;here&lt;/a&gt;. While this list of NFT systems contains a lot of things related to artwork (as described in this blogpost), a lot aren&#39;t. For example, CryptoKitties is an online game, not artwork (though it too allows ties to pictures of the kitties).&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;What is fungible?&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;p&gt;Let&#39;s define the word &lt;b&gt;fungible&lt;/b&gt; first. The word refers to goods you purchase that can be replaced by an identical good, like a pound of sugar, an ounce of gold, a barrel of West Texas Intermediate crude oil. When you buy one, you don&#39;t care which one you get.&lt;/p&gt;&lt;p&gt;In contrast, an automobile is a &lt;b&gt;non-fungible&lt;/b&gt; good -- if you order a Tesla Model 3, you won&#39;t be satisfied with just any car that comes out of the factory, but one that matches the color and trim that you ordered. Art work is a well known non-fungible asset -- there&#39;s only one Mona Lisa painting in the world, for example.&lt;/p&gt;&lt;p&gt;Dollar bills and coins are fungible &lt;b&gt;tokens&lt;/b&gt; -- they represent the value printed on the currency. You can pay your bar bill with any dollars.&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Cryptocurrencies&lt;/b&gt; like Bitcoin, ZCash, and Ethereum are also &quot;fungible tokens&quot;. That&#39;s where they get their value, from their fungibility.&lt;/p&gt;&lt;p&gt;NFTs, or &lt;b&gt;non-fungible tokens&lt;/b&gt;, is the idea of trading something unique (non-fungible, not the same as anything else) on the blockchain. You can trade them, but each is unique, like a painting, a trading card, a rare coin, and so on.&lt;/p&gt;&lt;p&gt;This is a &lt;b&gt;token&lt;/b&gt;&amp;nbsp; -- it represents a thing. You aren&#39;t trading an artwork itself on the blockchain, but a token that represents the artwork. I mention this because most descriptions about NFTs are that you are buying artwork -- you aren&#39;t. Instead, you are buying a token that points to the artwork.&lt;/p&gt;&lt;p&gt;The best real world example is a &lt;b&gt;receipt&lt;/b&gt; for purchase. Let&#39;s say you go to the Louvre and buy the Mona Lisa painting, and they give you a receipt attesting to the authenticity of the transaction. The receipt is not the artwork itself, but something that represents the artwork. It&#39;s proof you legitimately purchased it -- that you didn&#39;t steal it. If you ever resell the painting, you&#39;ll probably need something like this proving the provenance of the piece.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Show me an example!&lt;/b&gt;&lt;/p&gt;&lt;p&gt;So let&#39;s look an at an example NFT, the technical details, to see how it works. We might as well use this massive $69 million purchase as our example. Some news reports describing the purchase are here: [&lt;a href=&quot;https://www.washingtonpost.com/technology/2021/03/17/nft-beeple-metakovan-christies/&quot;&gt;1&lt;/a&gt;] [&lt;a href=&quot;https://www.theverge.com/2021/3/11/22325054/beeple-christies-nft-sale-cost-everydays-69-million&quot;&gt;2&lt;/a&gt;] [&lt;a href=&quot;https://www.nytimes.com/2021/03/11/arts/design/nft-auction-christies-beeple.html&quot;&gt;3&lt;/a&gt;].&lt;/p&gt;&lt;p&gt;None of these stories say what actually happened. They say the &quot;artwork was purchased&quot;, but what does that actually mean? We are going to deconstruct that here. (The answer is: the artwork wasn&#39;t actually purchased).&lt;/p&gt;&lt;p&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;What was the artwork?&lt;/b&gt;&lt;/p&gt;&lt;p&gt;It&#39;s a piece created by an artist named &quot;&lt;a href=&quot;https://www.beeple-crap.com/everydays&quot;&gt;Beeple&lt;/a&gt;&quot; (Mike Winkelmann), called &quot;&lt;b&gt;Everydays: The First 5000 Days&lt;/b&gt;&quot;. It&#39;s a 500-megapixel image, which is about 300-megabytes in size. A thumbnail of this work is shown below.&lt;/p&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://ipfsgateway.makersplace.com/ipfs/QmZ15eQX8FPjfrtdX3QYbrhZxJpbLpvDpsgb2p3VEH8Bqq&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img border=&quot;0&quot; data-original-height=&quot;800&quot; data-original-width=&quot;800&quot; height=&quot;194&quot; src=&quot;https://ipfsgateway.makersplace.com/ipfs/QmZ15eQX8FPjfrtdX3QYbrhZxJpbLpvDpsgb2p3VEH8Bqq&quot; width=&quot;194&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;So the obvious question is &lt;b&gt;where is this artwork?&lt;/b&gt;&amp;nbsp;Is it somewhere on the blockchain? Well, no, the file is 300-megabytes in size, much too large to put on the blockchain. Instead, the file exists somewhere out in cyberspace (described below).&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;What exists on the blockchain is a unique fingerprint linking to the file, known as a &lt;b&gt;hash&lt;/b&gt;.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;What is a hash?&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;p&gt;It&#39;s at this point we need to discuss &lt;b&gt;cryptography&lt;/b&gt;: it&#39;s not just about encryption, but also random numbers, public keys, and hashing.&lt;/p&gt;&lt;p&gt;A &quot;hash&quot; passes all the bytes of a file through an algorithm to generate a short &lt;b&gt;signature&lt;/b&gt;&amp;nbsp;or &lt;b&gt;fingerprint&lt;/b&gt;&amp;nbsp;unique to that file. No two files with different contents can have the same hash. The most popular algorithm is &lt;b&gt;SHA-256&lt;/b&gt;, which produces a 256-bit hash.&lt;/p&gt;&lt;p&gt;We call it a &lt;b&gt;cryptographic hash&lt;/b&gt;&amp;nbsp;to differentiate it from weaker algorithms. With a strong algorithm, it&#39;s &lt;i&gt;essentially&lt;/i&gt;&amp;nbsp;impossible for a hacker to create a different file that has the same hash -- even if the hacker tried really hard.&lt;/p&gt;&lt;p&gt;Thus, the hash is the &lt;b&gt;identity&lt;/b&gt;&amp;nbsp;of the file. The identity of the artwork in question is not the title of the piece mentioned above, other pieces of art can also be given that title. Instead, the identity of the artwork is its hash. Other pieces of artwork cannot have the same hash.&lt;/p&gt;&lt;p&gt;For this artwork, that 300-megabyte file is hashed, producing a 256-bit value. Written in hex, this value is:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;6314b55cc6ff34f67a18e1ccc977234b803f7a5497b94f1f994ac9d1b896a017&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;Hexadecimal results in long strings. There are shorter ways of representing hashes. One is a format called &lt;b&gt;MultiHash&lt;/b&gt;. It&#39;s value is shown below. This refers to the same 256-bits, and thus the two forms equivalent, they are simply displayed in different ways.&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;This is the identity of the artwork. If you want to download the entire 300-megabyte file, simply copy and paste that into google, and it&#39;ll lead you to someplace in cyberspace where you can download it. Once you download it, you can verify the hash, such as with the command-line tool OpenSSL:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;&lt;span style=&quot;font-family: courier; font-size: x-small;&quot;&gt;$ openssl dgst -sha256 everdays5000.jfif&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;span style=&quot;font-family: courier; font-size: x-small;&quot;&gt;SHA256(everdays5000.jfif)= 6314b55cc6ff34f67a18e1ccc977234b803f7a5497b94f1f994ac9d1b896a017&lt;/span&gt;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The above is exactly what I&#39;ve done -- I downloaded the file from cyberspace, named it &quot;everydays5000.jfif&quot;, and then calculated the hash to see if it matches. As you can tell by looking at my result with the above hash, they do match, so I know I have an exact copy of the artwork.&lt;/p&gt;&lt;p&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;Where to download the image from cyberspace?&lt;/b&gt;&lt;/p&gt;&lt;p&gt;Above, I downloaded the file in order to demonstrate calculating the hash. It doesn&#39;t live on the blockchain, so where does it live?&lt;/p&gt;&lt;p&gt;There&#39;s two answers. The first answer is potentially&amp;nbsp;&lt;b&gt;anywhere in cyberspace. &lt;/b&gt;Thousands of people have downloaded the file onto the personal computers, so obviously it exists on their machines -- you just can&#39;t get at it. If you ever do come across it somewhere, you can always verify it&#39;s the exact copy by looking at the hash.&lt;/p&gt;&lt;p&gt;The second answer is &lt;b&gt;somewhere on the darknet&lt;/b&gt;. The term &quot;darknet&quot; refers to various systems on the Internet other than the web. Remember, the &quot;web&quot; is not the &quot;Internet&quot;, but simply one of many services on the Internet.&lt;/p&gt;&lt;p&gt;The most popular darknet services are &lt;b&gt;decentralized file sharing&lt;/b&gt;&amp;nbsp;systems like BitTorrent and &lt;a href=&quot;https://en.wikipedia.org/wiki/InterPlanetary_File_System&quot;&gt;IPFS&lt;/a&gt;. In much the same way that blockchains are decentralized transaction services, these two system are decentralized file services. When something is too big to live on the blockchain, it often lives on the darknet, usually via IPFS.&lt;/p&gt;&lt;p&gt;The way these services identify files is through their hashes. If you know their hash, you can stick it into one of these services and find it. Thus, if you want to find this file on IPFS, download some IPFS aware software, and plug in the hash.&lt;/p&gt;&lt;p&gt;There&#39;s an alternative privacy-focused browser called &quot;Brave&quot; that includes darknet features (TOR, BitTorrent, and IPFS). To download this file using Brave, simply use the following URL:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;ipfs://QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;But an easier way is to use one of the many &lt;b&gt;IPFS gateways&lt;/b&gt;. These are web servers that will copy a file off the darknet and make it available to you. Here is a URL using one of those gateways:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;a href=&quot;https://ipfsgateway.makersplace.com/ipfs/QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA&quot;&gt;https://ipfsgateway.makersplace.com/ipfs/QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA&lt;/a&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;If you click on this link within your browser, you&#39;ll download the 300-megabyte file from the IPFS darknet. It&#39;ll take a while, the service is slow. Once you get it, you can verify the hashes match. But since the URL is based on the hash, of course they should match, unless there was some error in transmission.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;So this hash is on the blockchain?&lt;/b&gt;&lt;/p&gt;&lt;p&gt;Well, it could&#39;ve been, but it wasn&#39;t. Instead, the hash that&#39;s on the blockchain points to a file containing metadata -- and it&#39;s the metadata that points to the hash.&lt;/p&gt;&lt;p&gt;In other words, it&#39;s a chain of hashes. The hash on the blockchain (as we&#39;ll see below) is this one here (I&#39;ve made it a link so you can click on it to see the raw data):&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;a href=&quot;https://dweb.link/ipfs/QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz&quot;&gt;QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz&lt;/a&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;When you click on this, you see a bunch of JSON data. Below, I&#39;ve stripped away the uninteresting stuff to show the meaningful bits;&lt;/p&gt;&lt;blockquote&gt;&lt;b&gt;title&lt;/b&gt;:&quot;&lt;i&gt;EVERYDAYS: THE FIRST 5000 DAYS&lt;/i&gt;&quot;&amp;nbsp;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;b&gt;description&lt;/b&gt;:&quot;&lt;i&gt;I made a picture from start to finish every single day from May 1st, 2007 - January 7th, 2021.&amp;nbsp; This is every motherfucking one of those pictures.&lt;/i&gt;&quot;&amp;nbsp;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;b&gt;digital_media_signature&lt;/b&gt;:&quot;&lt;i&gt;6314b55cc6ff34f67a18e1ccc977234b803f7a5497b94f1f994ac9d1b896a017&lt;/i&gt;&quot;&amp;nbsp;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;b&gt;raw_media_file&lt;/b&gt;:&quot;&lt;i&gt;&lt;a href=&quot;https://ipfsgateway.makersplace.com/ipfs/QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA&quot;&gt;https://ipfsgateway.makersplace.com/ipfs/QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA&lt;/a&gt;&lt;/i&gt;&quot;&lt;/blockquote&gt;&lt;p&gt;Now remember that due to the magic of cryptographic hashes, this chain can&#39;t be broken. One hash leads to the next, such that changing any single bit breaks the chain. Indeed, that&#39;s what a &quot;blockchain&quot; is -- a hash chain. Changing any bit of information anywhere on the Bitcoin blockchain is immediately detectable, because it throws off the hash calculations.&lt;/p&gt;&lt;p&gt;So we have a chain:&amp;nbsp;&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;hash -&amp;gt; metadata -&amp;gt; hash -&amp;gt; artwork&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;So if you own the root, you own the entire chain.&lt;/p&gt;&lt;p&gt;Note that this chain seems unbreakable here, in this $69 million NFT token. However, in a lot of other tokens, it&#39;s not. I mean, the hash chain itself doesn&#39;t promise much (it simply points at the artwork, giving no control over it), but other NFTs promise even less.&lt;/p&gt;&lt;p&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;So what, exactly, is the NFT that was bought and sold?&lt;/b&gt;&lt;/p&gt;&lt;p&gt;Here&#39;s what&amp;nbsp;&lt;a href=&quot;https://en.wikipedia.org/wiki/Christie%27s&quot;&gt;Christie&#39;s&lt;/a&gt;&amp;nbsp;sold. Here&#39;s how &lt;a href=&quot;https://onlineonly.christies.com/s/first-open-beeple/beeple-b-1981-1/112924&quot;&gt;Christies describes it&lt;/a&gt;:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Beeple (b. 1981)&lt;br /&gt;EVERYDAYS: THE FIRST 5000 DAYS&lt;br /&gt;&lt;b&gt;token ID&lt;/b&gt;: 40913&lt;br /&gt;wallet address: 0xc6b0562605D35eE710138402B878ffe6F2E23807&lt;br /&gt;&lt;b&gt;smart contract address&lt;/b&gt;: 0x2a46f2ffd99e19a89476e2f62270e0a35bbf0756&lt;br /&gt;non-fungible token (jpg)&lt;br /&gt;21,069 x 21,069 pixels (319,168,313 bytes)&lt;br /&gt;Minted on 16 February 2021. This work is unique.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The seller is the artist&amp;nbsp;&lt;a href=&quot;https://www.beeple-crap.com/&quot;&gt;Beeple&lt;/a&gt;. The artist created the &lt;b&gt;token &lt;/b&gt;(shown below) and assigned their &lt;b&gt;wallet address&lt;/b&gt;&amp;nbsp;as the owner. This is their wallet address:&lt;/p&gt;&lt;blockquote&gt;&lt;a href=&quot;https://etherscan.io/address/0xc6b0562605d35ee710138402b878ffe6f2e23807&quot;&gt;0xc6b0562605D35eE710138402B878ffe6F2E23807&lt;/a&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;When Beeple created the token, he did so using a &lt;b&gt;smart contract&lt;/b&gt;&amp;nbsp;that governs the rules for the token. Such smart contracts is what makes Ethereum different from Bitcoin, allowing things to be created and managed on the blockchain other than simple currency transfers. Contracts have addresses on the blockchain, too, but no person controls them -- they are rules for decentralized transfer of things, with nobody (other than the code) in control.&lt;/p&gt;&lt;p&gt;There are many smart contracts that can manage NFTs. The one Beeple chose is known as &lt;b&gt;MakersTokenV2&lt;/b&gt;. This contract has the following address:&lt;/p&gt;&lt;blockquote&gt;&lt;a href=&quot;https://etherscan.io/address/0x2a46f2ffd99e19a89476e2f62270e0a35bbf0756#code&quot;&gt;0x2a46f2ffd99e19a89476e2f62270e0a35bbf0756&lt;/a&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;Note that if you browse this link, you&#39;ll eventually get to the&amp;nbsp;&lt;a href=&quot;https://etherscan.io/address/0x2a46f2ffd99e19a89476e2f62270e0a35bbf0756#code&quot; style=&quot;font-weight: bold;&quot;&gt;code&lt;/a&gt;&amp;nbsp;so that you can read the smart contract and see how it works. It&#39;s a derivation of something known as&amp;nbsp;&lt;a href=&quot;https://github.com/ethereum/EIPs/blob/master/EIPS/eip-721.md&quot;&gt;ERC721&lt;/a&gt;&amp;nbsp;that defines the properties of a certain class of non-fungible tokens.&lt;/p&gt;&lt;p&gt;Finally, we get to the actual token being sold here. It is:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;#40913&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;In other words, it&#39;s the 40913rd token created and managed by the MakersTokenV2 contract. The full description of what Christies is selling is this token number governed by the named contract on the Ethereum blockchain:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;Ethereum -&amp;gt; 0x2a46f2ffd99e19a89476e2f62270e0a35bbf0756 -&amp;gt; 40913&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;We have to search the blockchain in order to find the transaction that created this token. The transaction is identified by the hash:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;&lt;a href=&quot;https://etherscan.io/tx/0x84760768c527794ede901f97973385bfc1bf2e297f7ed16f523f75412ae772b3#eventlog&quot;&gt;0x84760768c527794ede901f97973385bfc1bf2e297f7ed16f523f75412ae772b3&lt;/a&gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;The smart contract is code, so in the above transaction, Beeple calls functions within the contract to create a new token, assign digital media to it (the hash), and assign himself owner of the newly created token.&lt;/p&gt;&lt;p&gt;After doing this, the token #40913 now contains the following information:&lt;/p&gt;&lt;div&gt;&lt;blockquote&gt;&lt;b&gt;creator &lt;/b&gt;: 0xc6b0562605d35ee710138402b878ffe6f2e23807&lt;br /&gt;&lt;div&gt;&lt;b&gt;metadataPath &lt;/b&gt;: QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz&lt;br /&gt;&lt;div&gt;&lt;b&gt;tokenURI &lt;/b&gt;: ipfs://ipfs/QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz&lt;/div&gt;&lt;/div&gt;&lt;/blockquote&gt;&lt;div&gt;&lt;span style=&quot;font-size: x-small;&quot;&gt;&lt;/span&gt;&lt;/div&gt;&lt;/div&gt;&lt;p&gt;This is the thing that Christie&#39;s auction house sold. As you can see in their description above, it all points to this token on the blockcahin.&lt;/p&gt;&lt;p&gt;Now after the auction, the next step is to transfer the token to the new owner. Again, the contract is code, so this is calling the &quot;Transfer()&quot; function in that code. Beeple is the only person who can do this transfer, because only he knows the private key that controls his wallet. This transfer is done in the transaction below:&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;&lt;a href=&quot;https://etherscan.io/tx/0xa342e9de61c34900883218fe52bc9931daa1a10b6f48c506f2253c279b15e5bf#eventlog&quot;&gt;0xa342e9de61c34900883218fe52bc9931daa1a10b6f48c506f2253c279b15e5bf&amp;nbsp;&lt;/a&gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;token : 40913&lt;br /&gt;from : 0xc6b0562605d35ee710138402b878ffe6f2e23807&lt;br /&gt;to : 0x58bf1fbeac9596fc20d87d346423d7d108c5361a&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;That&#39;s not the current owner. Instead, it was soon transferred again in the following transaction:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;&lt;a href=&quot;https://etherscan.io/tx/0x01d0967faaaf95f3e19164803a1cf1a2f96644ebfababb2b810d41a72f502d49#eventlog&quot;&gt;0x01d0967faaaf95f3e19164803a1cf1a2f96644ebfababb2b810d41a72f502d49&lt;/a&gt;&amp;nbsp;&lt;/p&gt;&lt;/blockquote&gt;&lt;blockquote&gt;&lt;p&gt;token : 40913&lt;br /&gt;from : 0x58bf1fbeac9596fc20d87d346423d7d108c5361a&lt;br /&gt;to :&amp;nbsp;0x8bb37fb0f0462bb3fc8995cf17721f8e4a399629&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;That final address is known to belong to a person named &quot;Metakovan&quot;, who the press has identified as the buyer of the piece. I don&#39;t know what that intermediary address between Beeple and Metakovan was, but it&#39;s common in the cryptocurrency world to have many accounts that people transfer things between, so I bet it also belongs to Metakovan.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;How are things transferred?&lt;/b&gt;&lt;/p&gt;&lt;p&gt;Like everything on the blockchain, control is transfered via public/private keys. Your &lt;b&gt;wallet address&lt;/b&gt;&amp;nbsp;is a hash of your &lt;b&gt;public key&lt;/b&gt;, which everyone knows. Anybody can transfer something to your public address without you being involved.&lt;/p&gt;&lt;p&gt;But every public key has a matching &lt;b&gt;private key&lt;/b&gt;. Both are generated together, because they are mathematically related. Only somebody who knows the private key that matches the wallet address can transfer something out of the wallet to another person.&lt;/p&gt;&lt;p&gt;Thus Beeple&#39;s account as the following public address. But we don&#39;t know his private key, which he has stored on a computer file somewhere.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;a href=&quot;https://etherscan.io/address/0xc6b0562605d35ee710138402b878ffe6f2e23807&quot;&gt;0xc6b0562605D35eE710138402B878ffe6F2E23807&lt;/a&gt;&lt;/blockquote&gt;&lt;p&gt;&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;b&gt;To summarize what was bought and sold&lt;/b&gt;&lt;/p&gt;&lt;p&gt;So that&#39;s it. To summarize:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;&lt;a href=&quot;https://www.beeple-crap.com/&quot;&gt;Beeple&lt;/a&gt;&amp;nbsp;created a piece of art in a&amp;nbsp;&lt;a href=&quot;https://ipfsgateway.makersplace.com/ipfs/QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA&quot;&gt;file&lt;/a&gt;&lt;/li&gt;&lt;li&gt;He created a&amp;nbsp;&lt;a href=&quot;https://google.com/search?q=QmXkxpwAHCtDXbbZHUwqtFucG1RMS6T87vi1CdvadfL7qA&quot;&gt;hash&lt;/a&gt;&amp;nbsp;that uniquely, and unhackably, identified that file&lt;/li&gt;&lt;li&gt;He created a&amp;nbsp;&lt;a href=&quot;https://dweb.link/ipfs/QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz&quot;&gt;metadata file&lt;/a&gt;&amp;nbsp;that included the hash to the artwork&lt;/li&gt;&lt;li&gt;He created a&amp;nbsp;&lt;a href=&quot;https://google.com/search?q=QmPAg1mjxcEQPPtqsLoEcauVedaeMH81WXDPvPx3VC5zUz&quot;&gt;hash&lt;/a&gt;&amp;nbsp;to the metadata file&lt;/li&gt;&lt;li&gt;He uploaded both files (metadata and artwork) to the&amp;nbsp;&lt;a href=&quot;https://en.wikipedia.org/wiki/InterPlanetary_File_System&quot;&gt;IPFS&lt;/a&gt;&amp;nbsp;darknet decentralized file sharing service&lt;/li&gt;&lt;li&gt;He created, or&amp;nbsp;&lt;a href=&quot;https://etherscan.io/tx/0x84760768c527794ede901f97973385bfc1bf2e297f7ed16f523f75412ae772b3#eventlog&quot;&gt;minted a token&lt;/a&gt;&amp;nbsp;governed by the&amp;nbsp;&lt;a href=&quot;https://etherscan.io/address/0x2a46f2ffd99e19a89476e2f62270e0a35bbf0756#code&quot;&gt;MakersTokenV2 smart contract&lt;/a&gt;&amp;nbsp;on the Ethereum blockchain&lt;/li&gt;&lt;li&gt;Christies created an&amp;nbsp;&lt;a href=&quot;https://onlineonly.christies.com/s/first-open-beeple/beeple-b-1981-1/112924&quot;&gt;auction&lt;/a&gt;&amp;nbsp;for this token&lt;/li&gt;&lt;li&gt;The auction was concluded with a payment of $69 million worth of Ether cryptocurrency. However, nobody has been able to find this payment on the Ethereum blockchain, the money was probably transferred through some private means.&lt;/li&gt;&lt;li&gt;Beeple&amp;nbsp;&lt;a href=&quot;https://etherscan.io/tx/0xa342e9de61c34900883218fe52bc9931daa1a10b6f48c506f2253c279b15e5bf#eventlog&quot;&gt;transferred&lt;/a&gt;&amp;nbsp;the token to the winner, who&amp;nbsp;&lt;a href=&quot;https://etherscan.io/tx/0x01d0967faaaf95f3e19164803a1cf1a2f96644ebfababb2b810d41a72f502d49#eventlog&quot;&gt;transferred&lt;/a&gt;&amp;nbsp;it again to this final&amp;nbsp;&lt;a href=&quot;https://etherscan.io/address/0x8bb37fb0f0462bb3fc8995cf17721f8e4a399629#tokentxnsErc721&quot;&gt;Metakovan&lt;/a&gt;&amp;nbsp;account&lt;/li&gt;&lt;/ul&gt;&lt;div&gt;And that&#39;s it.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;Okay, I understand. But I have a question. WHAT IS AN NFT????&lt;/b&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;&lt;br /&gt;&lt;/b&gt;&lt;/div&gt;&lt;div&gt;So if you&#39;ve been paying attention, and understood everything I&#39;ve said, then you should still be completely confused. What exactly was purchased that was worth $69 million?&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;If we are asking what Metakovan purchased for his $69 million, it comes down to this: the ability to transfer MakersTokenV2 #40913 to somebody else.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;That&#39;s it. That&#39;s everything he purchased. He didn&#39;t purchase the artwork, he didn&#39;t purchase the copyrights, he didn&#39;t purchase anything more than the ability to transfer that token. Even saying he owns the token is a misnomer, since the token lives on the blockchain. Instead, since only Metakovan knows the private key that controls his wallet, all that he possesses is the ability to transfer the token to the control of another private key.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;It&#39;s not even as unique as people claim. Beeple can mint another token for the same artwork. Anybody else can mint a token for Beeple&#39;s artwork. Insignificant changes can be made to that artwork, and tokens can be minted for that, too. There&#39;s nothing hard and fast controlled by the code -- the relationship is in people&#39;s minds.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;If you are coming here asking why somebody thinks this is worth $69 million, I have no answer for you.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;b&gt;The conclusion&lt;/b&gt;&lt;/div&gt;&lt;p&gt;&lt;/p&gt;&lt;div&gt;I think there are two things that are clear here:&lt;/div&gt;&lt;div&gt;&lt;ul style=&quot;text-align: left;&quot;&gt;&lt;li&gt;This token is not going to be meaningful to most of us: who cares if the token points to a hash that eventually points to a file freely available on the Internet?&lt;/li&gt;&lt;li&gt;This token is meaningful to those in the &quot;crypto&quot; (meaning &quot;cryptocurrency&quot;) community, but it&#39;s in their minds, rather than something hard and fast controlled by code or cryptography.&lt;/li&gt;&lt;/ul&gt;&lt;div&gt;In other words, the work didn&#39;t sell for $69 million of real money.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;For one thing, it&#39;s not the work that was traded, or rights or control over that work. It&#39;s simply a token that pointed to the work.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;For another thing, it was sold for 42329.453 ETH, not $dollars. Early adopters with lots of cryptocurrency are likely to believe the idea that the token is meaningful, whereas outsiders with $dollars don&#39;t.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;An NFT is ultimately like those plaques you see next to paintings in a museum telling people about the donor or philanthropist involved -- only this plaque is somewhere where pretty much nobody will see it.&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;div class=&quot;separator&quot; style=&quot;clear: both; text-align: center;&quot;&gt;&lt;a href=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgH1qv72M_Z2zpwrh4ovslSolaewHZ6cYY_k8HBGo65epxsKryBwXJRDXSQm-jJIgpW3xe6eabeGWy-yJHP-V-Bu-CqdR7W2C4-Y1fECRl_G9vDkJfsGNw8_2K91YbvNT00scfC/&quot; style=&quot;margin-left: 1em; margin-right: 1em;&quot;&gt;&lt;img alt=&quot;&quot; data-original-height=&quot;1404&quot; data-original-width=&quot;1920&quot; height=&quot;234&quot; src=&quot;https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgH1qv72M_Z2zpwrh4ovslSolaewHZ6cYY_k8HBGo65epxsKryBwXJRDXSQm-jJIgpW3xe6eabeGWy-yJHP-V-Bu-CqdR7W2C4-Y1fECRl_G9vDkJfsGNw8_2K91YbvNT00scfC/&quot; width=&quot;320&quot; /&gt;&lt;/a&gt;&lt;/div&gt;&lt;br /&gt;&lt;br /&gt;&lt;/div&gt;&lt;div&gt;&lt;br /&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;&lt;/div&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/4049457482069625866/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=4049457482069625866' title='8 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/4049457482069625866'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/4049457482069625866'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/03/deconstructing-that-69million-nft.html' title='Deconstructing that $69million NFT'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><media:thumbnail xmlns:media="http://search.yahoo.com/mrss/" url="https://blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEgiz76iRC5UAkv0R-Asg4LcveX0SgAJs1nPc6XR9PQSYCBg6ZkvO4Q8dv5tvKAEox6j3UFQg_zfjAi2P0xhOaORqVVaf07KUBGSpJpntxBzDnw5ACuxm5iuw-ORUYd44J7iWZaF/s72-c" height="72" width="72"/><thr:total>8</thr:total></entry><entry><id>tag:blogger.com,1999:blog-37798047.post-5423611307430503564</id><published>2021-02-28T19:06:00.006-05:00</published><updated>2021-02-28T20:05:19.523-05:00</updated><title type='text'>We are living in 1984 (ETERNALBLUE)</title><content type='html'>&lt;p&gt;In the book &lt;i&gt;1984&lt;/i&gt;, the protagonist questions his sanity, because his memory differs from what appears to be everybody else&#39;s memory.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;The Party said that Oceania had never been in alliance with Eurasia. He, Winston Smith, knew that Oceania had been in alliance with Eurasia as short a time as four years ago. But where did that knowledge exist? Only in his own consciousness, which in any case must soon be annihilated. And if all others accepted the lie which the Party imposed—&lt;b&gt;if all records told the same tale—then the lie passed into history and became truth&lt;/b&gt;. ‘Who controls the past,’ ran the Party slogan, ‘controls the future: who controls the present controls the past.’ And yet the past, though of its nature alterable, never had been altered. Whatever was true now was true from everlasting to everlasting. It was quite simple. All that was needed was an unending series of victories over your own memory. ‘Reality control’, they called it: in Newspeak, ‘doublethink’.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;I know that EternalBlue didn&#39;t cause the &lt;a href=&quot;https://en.wikipedia.org/wiki/2019_Baltimore_ransomware_attack&quot;&gt;Baltimore ransomware attack&lt;/a&gt;. When the attack happened, the entire cybersecurity community agreed that EternalBlue wasn&#39;t responsible.&lt;/p&gt;&lt;p&gt;But &lt;a href=&quot;https://www.nytimes.com/2019/05/25/us/nsa-hacking-tool-baltimore.html&quot;&gt;this New York Times article&lt;/a&gt; said otherwise, blaming the Baltimore attack on EternalBlue. And there are hundreds of other news articles [&lt;a href=&quot;https://www.theverge.com/2019/5/25/18639859/baltimore-city-computer-systems-cyberattack-nsa-eternalblue-wannacry-notpetya-cybersecurity&quot;&gt;eg&lt;/a&gt;] that agree, citing the New York Times. There are no news articles that dispute this.&lt;/p&gt;&lt;p&gt;In a&amp;nbsp;&lt;a href=&quot;https://blog.erratasec.com/2021/02/review-perlroths-book-on-cyberarms.html&quot;&gt;recent book&lt;/a&gt;, the author of that article admits it&#39;s not true, that EternalBlue didn&#39;t cause the ransomware to spread. But they defend themselves as it being essentially true, that EternalBlue is responsible for a lot of bad things, even if technically, not in this case. Such errors are justified, on the grounds they are generalizations and simplifications needed for the mass audience.&lt;/p&gt;&lt;p&gt;So we are left with the situation Orwell describes: all records tell the same tale -- when the lie passes into history, it becomes the truth.&lt;/p&gt;&lt;p&gt;Orwell continues:&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;blockquote&gt;&lt;p&gt;He wondered, as he had many times wondered before, whether he himself was a lunatic. Perhaps a lunatic was simply a minority of one. At one time it had been a sign of madness to believe that the earth goes round the sun; today, to believe that the past is inalterable. He might be ALONE in holding that belief, and if alone, then a lunatic. But the thought of being a lunatic did not greatly trouble him: the horror was that he might also be wrong.&lt;/p&gt;&lt;p&gt;&lt;/p&gt;&lt;/blockquote&gt;&lt;p&gt;I&#39;m definitely a lunatic, alone in my beliefs. I sure hope I&#39;m not wrong.&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;&lt;p&gt;&lt;br /&gt;&lt;/p&gt;
  8.  
  9. &lt;hr/&gt;
  10. &lt;b&gt;Update:&lt;/b&gt; Other lunatics document their struggles with Minitrue:
  11. &lt;blockquote class=&quot;twitter-tweet&quot; data-conversation=&quot;none&quot; data-dnt=&quot;true&quot;&gt;&lt;p lang=&quot;en&quot; dir=&quot;ltr&quot;&gt;When I was investigating the TJX breach, there were NYT articles citing unnamed sources that were made up &amp;amp; then outlets would publish citing the NYT. The TJX lawyers would require us to disprove the articles. Each time we would. It was maddening fighting lies for 8 months.&lt;/p&gt;&amp;mdash; Nicholas J. Percoco (@c7five) &lt;a href=&quot;https://twitter.com/c7five/status/1366189900454895625?ref_src=twsrc%5Etfw&quot;&gt;March 1, 2021&lt;/a&gt;&lt;/blockquote&gt; &lt;script async src=&quot;https://platform.twitter.com/widgets.js&quot; charset=&quot;utf-8&quot;&gt;&lt;/script&gt;</content><link rel='replies' type='application/atom+xml' href='https://blog.erratasec.com/feeds/5423611307430503564/comments/default' title='Post Comments'/><link rel='replies' type='text/html' href='https://www.blogger.com/comment.g?blogID=37798047&amp;postID=5423611307430503564' title='2 Comments'/><link rel='edit' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/5423611307430503564'/><link rel='self' type='application/atom+xml' href='https://www.blogger.com/feeds/37798047/posts/default/5423611307430503564'/><link rel='alternate' type='text/html' href='https://blog.erratasec.com/2021/02/we-are-living-in-1984-eternalblue.html' title='We are living in 1984 (ETERNALBLUE)'/><author><name>Robert Graham</name><uri>http://www.blogger.com/profile/09879238874208877740</uri><email>noreply@blogger.com</email><gd:image rel='http://schemas.google.com/g/2005#thumbnail' width='26' height='32' src='//blogger.googleusercontent.com/img/b/R29vZ2xl/AVvXsEjJp1K5oBkDsBDOh7UOk0xPIdd0d8DKmV7PEAPZ7x-ckmfG6iWTVCt5LvUpd2iwW3UUYeaqd2UoYnupOSz1VDFUok6gUW_48x_rCU1Sth9Sk4-vEidqnqC2M3DXw16T4o0/s220/robertgraham.jpg'/></author><thr:total>2</thr:total></entry></feed>

If you would like to create a banner that links to this page (i.e. this validation result), do the following:

  1. Download the "valid Atom 1.0" banner.

  2. Upload the image to your own server. (This step is important. Please do not link directly to the image on this server.)

  3. Add this HTML to your page (change the image src attribute if necessary):

If you would like to create a text link instead, here is the URL you can use:

http://www.feedvalidator.org/check.cgi?url=http%3A//erratasec.blogspot.com/feeds/posts/default

Home · About · News · Docs · Terms

 
Copyright © 2002-9 Sam Ruby, Mark Pilgrim, Joseph Walton, and Phil Ringnalda