Post New

https://satcom.sysnet.ucsd.edu/docs/dontlookup_ccs...

Word to the wise:

We pointed a commercial-off-the-shelf satellite dish at the sky and carried out the most comprehensive public study to date of geostationary satellite communication. A shockingly large amount of sensitive traffic is being broadcast unencrypted, including critical infrastructure, internal corporate and government communications, private citizens’ voice calls and SMS, and consumer Internet traffic from in-flight wifi and mobile networks. This data can be passively observed by anyone with a few hundred dollars of consumer-grade hardware. There are thousands of geostationary satellite transponders globally, and data from a single transponder may be visible from an area as large as 40% of the surface of the earth.

Jeff

Bringing this on topic, it seems there’s a good chance we could aim some listening equipment toward the sky and figure out Berkshire’s non-public thoughts on an investment when they’re on their way back to Omaha, and calling from their plane.

https://www.smbc-comics.com/comic/right
It's getting harder and harder to diagnose paranoia.

Jim

Cute cartoon :-)

What keeps me awake at night is that, while I use two part authentication, secure passwords and a high level of awareness of threats by email, etc. is the possibility that my network or that of a financial institution I deal with, will be compromised during a system update:

https://my.f5.com/manage/s/article/K000154696

F5, a Seattle-based maker of networking software, disclosed the breach on Wednesday. F5 said a “sophisticated” threat group working for an undisclosed nation-state government had surreptitiously and persistently dwelled in its network over a “long-term.” Security researchers who have responded to similar intrusions in the past took the language to mean the hackers were inside the F5 network for years.

During that time, F5 said, the hackers took control of the network segment the company uses to create and distribute updates for BIG IP, a line of server appliances that F5 says is used by 48 of the world’s top 50 corporations. Wednesday’s disclosure went on to say the threat group downloaded proprietary BIG-IP source code information about vulnerabilities that had been privately discovered but not yet patched. The hackers also obtained configuration settings that some customers used inside their networks.

Control of the build system and access to the source code, customer configurations, and documentation of unpatched vulnerabilities has the potential to give the hackers unprecedented knowledge of weaknesses and the ability to exploit them in supply-chain attacks on thousands of networks, many of which are sensitive. The theft of customer configurations and other data further raises the risk that sensitive credentials can be abused, F5 and outside security experts said.

Until financial liability for consequential damage is the responsibility of the vendor, they will only spend the minimum they can get away with on security.

Jeff

A shockingly large amount of sensitive traffic is being broadcast unencrypted, including critical infrastructure, internal corporate and government communications, private citizens’ voice calls and SMS, and consumer Internet traffic from in-flight wifi and mobile networks.

As they say, the "S" in "IOT" stands for security.

There's no doubt this applies to Berkshire because of it's NG pipeline and electrical transmission infrastructure, and has for a while.

SMS is always unencrypted to my understanding, satellite or not. You may have a phone that made you migrated to RCS or use iMessage, and that's one of the reasons why there's been a push to retire the protocol; particularly given how much of multi-factor authentication is access codes sent over text messages. As long as the in-flight wifi wasn't MITM'ed (ie, intercepted between the browser and the tls termination point) a passenger would be okay.

Until financial liability for consequential damage is the responsibility of the vendor

I'm willing to take it to another board related to information security, but I very mildly disagree with you. I think businesses should be insured for liability, and - like safe deposit boxes in banks - be liable only in the case of negligence. I've usually heard threat actors like this described as advanced persistent threat groups (APTs) so if I use that acronym, that's what I mean.

This does sound like a nation state APT and I would not be worried about your bank. They generally are not interested in robbing anyone, but are conducting espionage or establishing influence. Much better to get financial or medical records and find who is pliable with bribes, dating site records to see who might have something to hide, or strategic industrial companies for planning or design files. There are criminal APT groups that are capable of this, but I suspect they'd have used it already, or were in the business of selling the exploits to the nation state APTs.

Most worthwhile systems are regularly patched and defended in depth, so the gap between the discovering of a vulnerability, the discovery of the exploit of the vulnerability, and before public disclosure and remediation are most interesting. This access seems like it would have been extraordinarily valuable for the gap between the 2nd and 3rd events. There are a lot of Big IP devices and being aware of vulnerabilities in the time between F5 being notified and F5 developing and delivering patches would be valuable to many intelligence agencies.

Most of our greatest assets are mostly being not so interesting, at a nation-state level.

Post New

Berkshire Hathaway FAQ

---

Contact Shrewd'm
Contact the developer of these message boards.