Unsupervised Learning No. 233

MEMBER EDITION | EP. 233 | June 15, 2020

THIS WEEK’S TOPICS: SMBleed, Republicans. vs. China, Hawkey Surveillance, COVID in August 2019, IBM Facial PR, Palantir NHS, Blockchain Misinformation, Technology News, Human News, Ideas Trends & Analysis, Discovery, Recommendations, and the Weekly Aphorism…

SECURITY NEWS

There's an extremely nasty SMB vulnerability that was just patched in MIcrosoft's patch Tuesday, which basically works like psexec for attackers. Please get your 445 off the internet if you can. And high-fives to all those pentesters in the mines. It's funny, we've been saying for a decade that pentesting would be near impossible before too long. But the vulns keep coming. More 

A group of Republicans (the Republican Study Committee) is taking action to highlight and restrict China's various influence operations within the US. More

A private company with Hawkeye cameras strapped to Cesnas was hired by the Baltimore Police Department to fly over and monitor the city. The ACLU is suing. This also ties into another story where a guy used a simple SDR to log aircraft beacons and callsigns, and found an FBI surveillance plane near LA. Between the cameras everywhere, the planes flying overhead, we really are becoming a surveillance state. I truly believe it's possible to do this well, and for the right reasons—i.e., transparently, and with the full endorsement of the people—but I also believe that's the opposite of how we're doing it. More More

Analysis of hospital traffic using satellite imagery and Baidu search engine activity indicate that Wuhan was already facing a significant outbreak in late summer, early fall of 2019. More

IBM said they're getting out of the facial recognition business for ethical reasons, but I and a lot of others see this like Blackberry getting out of the AI business. There were many such announcements and they all smelled strongly of PR in my opinion. Amazon paused selling Rekognition to police departments for a year. And there's a bill in Congress to limit the use of facial recognition. More

Britain gave Palantir sensitive access to NHS data as part of their £1 deal. More

It's possible to identify individuals by looking at their heartbeat data, and that's flared up the common security debate around biometrics. I talked about how the theft threat was overblown back in 2017. A number of steps in many biometric authentication workflows make the systems resistant to these steal-once / use forever attacks. First, it's hashes that are usually stored, not high-res images of the source data. Second, devices that take the readings can be improved as attacks improve. Third, in the future, it'll likely be a massive combination of readings that will be used simultaneously to identify someone, not single factors. And finally, auth systems can evolve based on what we know has been stolen and copied. If everyone's biometrics were perfectly stolen and replicated, we would simply stop using them. There are definitely valid concerns with biometrics (as with any auth system), and we should be thoughtful as this inevitable switch is made, but it's not the Pandora's Box that people think it is. More

The New York Times had their R&D team build a prototype blockchain system for combatting misinformation. The system allows people to see the history of something being shared. More

Twitter is testing out a feature that will prompt you if you try to retweet something without reading it. More

China is spending $1.4 trillion dollars over the next 5 years to develop 5G, AI, and datacenters. This includes plans to build 600,000 new 5G towers by the end of 2020. More

A number of city blocks in Seattle are now "Autonomous" meaning that Seattle itself is not claiming authority there. Protesters there have designated the area as owned by the people. More

Twitter has removed over 170,000 accounts associated with Chinese state-linked media campaigns around COVID-19, the Hong Kong protests, and George Floyd. More

Spies can now eavesdrop by watching the vibrations of a lightbulb in a room. Before you ask—yes, it's research from Israel. More

Putin just said in an interview that the US is in "deep internal crisis" due to the US's inability to accept Trump as a legitimate president. Nicely played. I honestly can't wait to read in 10 to 20 years what was really happening in the current moment with regard to Russia and the US. It's going to be the best spy story ever written. More

Vulnerabilities:

• There's an extremely critical SMB vulnerability that basically works like psexec for the attacker. More

• Microsoft's Patch Tuesday has 129 CVEs. More

• IBM Websphere has two critical issues. More

• There's a new vulnerability in UPnP. Remember to disable it on your IoT stuff if at all possible. More

• 23 issues in SAP, with two being critical. More

• Adobe has updates to Flash, Experience Manager, and Framemaker. More

Breaches:

• Nintendo says another 140,000 accounts may have been accessed in its recently announced breach. More

• Babylon Health leaked their video health consultations. More

Companies:

• Palantir is set to IPO soon. More

TECHNOLOGY NEWS

Facebook has an AI-based system called TransCoder that can convert code back and forth between C++, Python, and Java. More

Quite a bit of the US's AI supremacy relies on Chinese talent, and many are worried that trade tensions will remove that advantage. More

United has added touchless check-in kiosks around the country. More

Grammarly has added custom business style guides. More

Companies:

• Grow Credit builds peoples' credit scores by paying for online subscriptions. More

• Snowflake as filed for their IPO. More

HUMAN NEWS

California has banned private prisons and immigration detention centers. More

Dogs have been trained to detect people who have COVID-19 at a 95% success rate. More

Around one-third of heterosexual American males aged 18-24 reported having no sex in the last year. Researchers said women are preferring men of higher socioeconomic status, and that more women now have college degrees, which are two factors affecting the chances of having heterosexual encounters for men. More

24-hour Fitness is permanently closing around a quarter of its gyms, including 10 in the SF Bay Area. More

Russia had a major oil spill in the Arctic. More

Brazil deforested 10,000 square kilometers of rainforest in 2019, which is a 34% increase over 2018. I don't have many authoritarian tendencies, but getting the international community to intervene and protect the Amazon is one of them. More

IDEAS, TRENDS, & ANALYSIS

It might be a really good time for companies to move towards Zero Trust architectures. More

Gene Spafford was interviewed about digital voting security and came to the same conclusion I did after attending ENIGMA one year. In short, all the experts agree it's a bad idea. More

Layoffs are coming, and employers need to do them right. More

UPDATES

I'm in the middle of working on two big presentations right now, so I've been writing a bit less. But that'll be done in two weeks and I'll just have one presentation in August to prepare for.

I've finished the book on Complex PTSD, Nonviolent Communication, and now I'm reading Getting to Yes.

DISCOVERY

A project that lets you explore ISS images of Earth for a given location. More

Create diagrams with code, using Graphviz. More

Cloud Pentesting Cheatsheets More

The word "huh?" seems to exist in every language. More

Using SharpChisel to ExFil data from a network. More

How to talk about your experience and perspective using stories during interviews. More

All slides from NahamSec this weekend, including my buddy Jason's session on his Bug Hunter's Methodology v4! More

How to use a serious camera as your webcam. More

A Machine Learning Field Guide More

A broad interview with Marc Andreessen about time management, reading, and other topics. More

A deep-dive into fountain pen ink properties. More

Canary Tools — Plant triggers all over your network and applications, and get notifications if anyone trips them. More

Gordon — A tool to check multiple reputation lists based on IP or domain. More

Baby Shark — A C2 server that uses Google translate as a proxy. More

URLCrazy — A tool to testing typo-squatting attacks against your domains. More

RECOMMENDATIONS

Nonviolent Communication is an extraordinary book for conflict resolution. I do think it could have had a better name though. I spent all these years thinking it was about hostage negotiation or something, but no—it's really quite universal. More

APHORISMS

“Life consists of what one thinks of all day.”

~ Ralph Waldo Emerson