Unsupervised Learning No. 247
I spend 5-20 hours a week consuming books, articles, and podcasts that explore the intersection of security, technology, and society. Then every Monday morning I send out the best of what I found. STANDARD EDITION | EP. 247 | September 21, 2020
MY ESSAYS
No, Moving Your SSH Port Isn't Security by Obscurity More
I've Been Too Sloppy in the Past More
SECURITY NEWS
A TikTok deal has evidently been approved in the US, with the contract going to Oracle and Walmart right before the app was set to be banned. The contract supposedly includes the standing up of a new company called TikTok Global, which both companies will have a combined 20% share of. The deal includes both US hosting and access to TikTok's source code, but given how fast this happened, and how close to the deadline, I expect a lot to change in the next few days. More
A (likely-Maze-based) ransomware attack on a hospital in Germany has lead to the death of woman. She tried to get immediate help at a hospital that was currently disabled due to ransomware, and she had to go to another hospital about an hour away. She never made it. More
An anti-China activist leaked a Chinese database full of personal data from tens of thousands of VIPs from around the world. The total list was around 2.4 million people, which included politicians, royalty, etc. The database was created by a Chinese company called Zhenhua Data, and seems to be exactly what I wrote about here, where I postulated that China is probably building a massive Leverage CRM for the future. Basically, gather as much information as you can, about everyone, including kids, so that you can use that data as leverage years or decades in the future. More
Six people selling products on Amazon have been indicted for bribing Amazon employees to help them gain an unfair advantage. This included bribing them to do things like reinstate their banned accounts, or banning rival accounts. They were able to earn one-hundred million dollars using these techniques. More
Congress has passed a bipartisan IoT Security Bill that will require (if it becomes law) that all devices acquired by Federal agencies comply with a new set of NIST security standards for IoT. More
Credit card fraud has risen 104% in the last quarter according to the FTC. More
Vulnerabilities:
There's a wicked vulnerability in Microsoft Netlogon (445 TCP or a Random RPC port) that gives an attacker instant Domain Admin. Patch immediately. More
There's a vulnerability in Bluetooth affecting billions of devices. More
The ZDI September Security Update Review More
Ransomware:
Ransomware lead to the death of a woman in Germany because she needed immediate help and had to go to a further hospital and never made it. More
APT:
The US has imposed sanctions on an Iran-based APT39, which is known for targeting dissidents, journalists as well as global enterprises. More
TECHNOLOGY NEWS
Anime avatars are getting big on Twitch and YouTube. It's where you're basically looking at a video stream of a cartoon character, but it's being controlled by a real person, in real-time. The technology is just now getting really good, but I think this is going to open the doors for millions more streamers who didn't want to stream live because of their voice or their appearance. They will be able to emote as themselves, or as a character, and have people see them as they wish they were. More
Amazon is hiring another 100,000 employees in the US and Canada. More
It looks like Zoom might be coming after Slack with new messaging features. More
Facebook is introducing a new feature where you can watch videos together, called Watch Together. More
Elon Musk has almost completed his tunnel under Las Vegas that will transport self-driving cars. More
Starting on October 1st, all new repos on Github will be called "main" instead of "master". More
The X-1 credit card gives you a limit based on your income, not your credit. More
Companies:
Snowflake just had the largest software IPO in history, at $3.4 billion dollars. More
Affirm just raised a $500 million dollar series G to help their 'buy now pay later' business. More
Tonal has raised another $110 million to continue doing connected home fitness. More
Observe.ai has raised $54 million to analyze call center conversations. More
RapidAI has raised $25 million to analyze medical scans using AI. More
SOCIETY NEWS
Another doctor and a fairly large study has found that Vitamin D can significantly help against Coronavirus. As I've said before here, I think the science is still early on COVID, but it looks like getting your D-levels to the high-normal range is probably a really good idea. Again, normal ranges. Don't go crazy with it. The problem seems to be a deficiency in D, not a need for super-high levels. More
Spiking gun sales are overwhelming our background check infrastructure. More
Israel is doing another lockdown because their cases are spiking. More
The study of Ancient DNA (it's a whole field now) has revealed that Vikings weren't all Scandanavians with blonde hair. There was significant mixing with groups from Asia and Southern Europe. More
Scientists figured out how to create a disassociation, Ketamine-like effect using brain waves instead of drugs. More
IDEAS, TRENDS, & ANALYSIS
Ransomware is the New PCI, and both seem more effective than anything else we've tried at getting people to take security seriously. More
UPDATES
My friend John Japuntich just released his new novel, ATROPOS, on Amazon, and it's currently sitting at #44 in new hard Sci-fi!. I'm going to read it first, and if it's great I might recommend it for our book club. More
I've been doing a bunch of work on the site lately, basically making it look more like a modern website and less like a blog. Whatever that means.
DISCOVERY
The Ultimate Guide to FFUF, by my friend Codingo. More
Generative Bad Handwriting More
A brilliant and hilarious walkthrough of someone finding Tony Abbott's passport number using a discarded airplane ticket. More
How to send files using nothing but SSH, Tee, and Base64 More
How the Air Quality Index Works More
I am loving these one-liner bug-bounty tips on Twitter. More
Mental Models More
Marc Andreessen on Productivity, Scheduling, Reading Habits, Work, and More More
Hash.ai — Build multi-agent simulations in minutes. More
Darkshot — A multi-threaded screenshot scraper. More
Onefuzz — A self-hosted Fuzzing-as-a-Service Platform More
RECOMMENDATIONS
You should watch—and get your loved ones to watch—The Social Dilemma. It's a documentary about how social media is attacking our mental health and our democracy. Extremely well done. More
APHORISMS
"Simplicity is the extreme degree of sophistication."
~ Leonardo da Vinci