Cybertastrophe and Cybergeddon: Recent Comments

Comment on White House will ban laptops, Blackberries, wi-fi hotspots at inauguration

OmegaWolf747 — Tue, 28 Apr 2009 21:23:25 GMT

There's no way a jammer could remotely stop a laptop from booting up.

Comment on Report will admit Taliban hackers launched U.S. Patriot missile

seth alton — Mon, 06 Apr 2009 21:46:51 GMT

Leave it up to higher command to fuck something like this up. If they were going to use a commercial line, why didn't they use a T1 encryption device? WTF are these people thinking?

Comment on Joint Chiefs mull a $5M reward for "agent.btz" virus author

Seth Alton — Mon, 06 Apr 2009 21:26:50 GMT

Let me think, ATO is based off of a classified network, which means some dumb ass AF guy put his USB stick into a classified computer. #1 rule in IT administration, TRAIN YOUR USERS! 2. Get rid of the most security flawed OS and train administrators like me that SHOULD BE DOING THIS JOB ANYWAY!!! Send me to classes to use a Unix/Linux based OS, or come up with one specifically used for the military. AND DON'T GIVE ME THAT CRAP THAT YOU'D HAVE TO TEACH THE ENTIRE ARMED FORCES ON HOW TO USE MAC OS. WHY DO YOU THINK THAT THEY PUT IT IN ELEMENTARY SCHOOLS FOR CRYING OUT LOUD. AND THE LAST TWO MAC OS UPGRADES DON'T LOOK ALL THAT DIFFERENT LIKE VISTA DID FROM XP PRO. REMEMBER... IT WAS THE AF J-TAC WHO WAS THE ONLY GUY RUNNING AROUND IN A BRIGHT RED BERRET IN TRANSFORMERS. Leave the sophistication and the cryptographic talk to the Navy. They're good at it. Rangers lead the way

Comment on Report will admit Taliban hackers launched U.S. Patriot missile

Alissa V. Knight — Fri, 30 Jan 2009 01:59:52 GMT

John,

Yep. Thank you. Question, can you send me the Investigative Boards Report (whatever is public)? Ive checked both the News Release and also the Reports site for the Army and I can't find it.

Thanks for all your help.

Alissa

Comment on Report will admit Taliban hackers launched U.S. Patriot missile

Alissa V. Knight — Fri, 30 Jan 2009 01:09:58 GMT

John,

Can you email me? My email address is alissa.knight [at] cewar.org

Thanks!
Alissa Knight

Comment on Report will admit Taliban hackers launched U.S. Patriot missile

Arq — Fri, 30 Jan 2009 00:58:31 GMT

The SIGINT details are X1, but, the rest of the document should only be collateral. I think it would be easy to sanitize. The executive summary wasn't even FOUO, that is why I didn't feel bad writing about it. Semper Gumby!

-John

--I'm editing this comment to add something. The summary is in Part I of the investigative board's report. Part I is always public. Part II of the report is the one that is mostly collateral. But I would think you already knew that!

Comment on Report will admit Taliban hackers launched U.S. Patriot missile

Alissa V. Knight — Fri, 30 Jan 2009 00:21:44 GMT

John,

Fantastic article. You continue to remain our source for open-source intel like this. Question, I can't find this Army report anywhere and am siting it. Was it never released or is it classified?

Thanks,
Alissa V. Knight
C2I Counter Intelligence
Special Operations

Comment on Joint Chiefs mull a $5M reward for "agent.btz" virus author

Mike Druckenmiller — Sun, 18 Jan 2009 12:59:22 GMT

Two Things.

1. Can someone please provide me with a Link or a search Phrase to locate additional information of the differences in vulnerabilities between a USB Flash drive and an External USB Hard Drive?

2. Has anyone found out how to completely disable to "Sync" Fuction in Windows Media that allows it to remain aware of Media Changes and attempt to Sync even when AutoPlay has been succesfully disabled for all drives?

Discussion:
I know that Windows mounts an External USB Hard drive as a "permanent" drive and mounts "most" USB Flash drives as "removable".

I suspect that some AV software doesn't handle them the same resulting in increased vulenrabilities for USB "removable" toys?

I also suspect that the Windows "awareness" and application handshaking that allows Windows Media to attempt to Sync a drive is also at the core of the vulerabilities for such media?

So far I have not found anyway to make *all* Media Change Events "manual".

Could just remove Windows Media...

But, that wouldn't eliminate the flaw in the OS that makes it work!

Thanks,

Mike Sr.

Comment on White House will ban laptops, Blackberries, wi-fi hotspots at inauguration

Mike — Sun, 18 Jan 2009 12:29:02 GMT

Seems a little harsh not to allow laptops to even boot up...

I can see taking down or jamming all 2.4 Ghz comm links...

But, preventing a laptop from even booting, especially with WiFi turned off, seems a bit SciFi.

We are too dependent upon "open" (non-secured) networks. This must change.

The American Public has no concept of what can be done to and with an unsecured system.

Even my fellow tech aware ET's have such a cavalier attitude that I shudder...

Operating without at least WPA, a Personal Firewall and up to date AV is simply ludicrous.

But, it is this "unaware techno-mania" that is making US as a Nation so vulnerable.

I am sorry to see extreme measures having to be taken at President Elect Obama's Inauguration.

I didn't vote for him. But, losing His personal connectivity, I can definately identify with.

I hope you guys have several full EW suites up and running both the active and passives.

Best Wishes... Yours is NOT a job I'd volunteer for.

Mike Sr.

Comment on Joint Chiefs mull a $5M reward for "agent.btz" virus author

Michael Druckenmiller — Wed, 17 Dec 2008 00:14:12 GMT

I had a thought that this might be the case...

The word is Complicity...

Unless you're a "spook". Then it's called intelligence gathering.

Again, except for the very big hole that Media Player grants all removable media, especially on the USB Bus...

Still, turning off AutoPlay/Autorun for all drives might have, should have, stopped a "standard" Autorun/Autoplay "bug".

The fact the niether Symantec or McAfee have come to their senses and included both Rootkit Detection and USB Firewalling in their AV apps is insane!

I know that even an old app like Sygate Personal Firewall had to be very carefully tweaked to get Active Sync to work at home with my PDA.

So, I know the technology and knowledge exists...

So... We are left with Heartbreak, Grief and Death...

BTW, if I wanted to do this intentionally just getting rid of USB access wouldn't be enough.

Sneaker Net lives and the troops will always find a way to get their apps and Data to and from a system...

I have too many off Network Lab Systems to not have some form of Sneaker Net.

But, I have always been very proactive with my non-network systems because I can, so I do.

The education and involvement of the end user remains the "nail" the allows the shoe to be thrown and the battle lost....

Mike Sr.