If you installed an update in the last 5 years you’re good.
The sad part is that there are apparently quite a few devices online for which this isn’t the case. That said, I do wonder how many of these “over 10,000 devices” are honeypots? This seems like something folks at the SANS ISC or GreyNoise would have added to their default setups.
This strategy really depends on their ability to bribe President Trump for a pardon.
While this patch might stop some existing attacks, it’s not really a fix. First off, the type of people who might install a third party Windows patch are probably the exact same people who would be cautious about clicking on an LNK file embedded in a ZIP file. Second, even if this patch somehow became widespread, attackers would just shift their attacks into the 260 character limit. Sure, it would now be visible in the properties, people aren’t looking at the properties of LNK files.
The problem is this “vulnerability” is essentially “as designed”. LNK files exist to allow both pointers to other files and a quick way to run complex commands. It’s like calling powershell.exe a vulnerability, because it can be used to get up to all sorts of malicious stuff. Both are powerful tools on Windows, but those tools can be abused.
While that is possible, I’d seriously doubt it happening. Wagner’s run at Moscow seemed like the best opportunity for that to happen, but it just stalled out. I’m still surprised Prighozin, stopped his push short of Moscow. I was not surprised afterwards when an airplane he was on suffered “technical difficulties”. But, between the failure of Wagner to remove Putin and them now being rolled into the Russian military, I think Putin has done a lot to consolidate his control over the armed forces, exactly to prevent that outcome.
Ya, it could happen, I don’t believe it’s likely.
While I like the sentiment, unless the EU is interested in a WWII style total war and invasion of Russia, Putin is never going to be held to account for the invasion of Ukraine.
The Russian government (Read: Putin and his cronies) are not going to agree to hand Putin over to The Hague. Even if the current war ends on favorable terms for Ukraine, that is never going to look anything like the German or Japanese surrenders. At best, this war ends with Russian military exhaustion and withdrawal. More like the end of Soviet involvement in Afghanistan. There will be no push to Moscow, no mass bombing of Russian factories or cities. Just Russian soldiers packing up and going home, leaving death and devastation behind for the survivors of their invasion to deal with.
Any negotiated peace is going to look pretty similar. It will stop the death sooner at the cost of giving Russia something it’s willing to accept. That’s the way negotiations work. If you want to force the other side to accept your terms, without any compromise, that’s what war is for. Since it seems neither the EU nor the US are willing to engage in a direct confrontation with Russia, then the only choice to end this war early is compromise. And Putin facing accountability is almost certainly not going to be on the table.
First off, why does a beer company have personal data on customers? It seems like the best protection for this data would be, don’t have it in the first place. You sell beer, you don’t need to hoover up personal data on people to make and sell beer.
“That reflects a wider truth that companies are investing more than ever in digital defences, yet adversaries continue to outpace them, exploiting weak links in supply chains or breaking in through trusted partners,” he (Shankar Haridas, head of UK and Ireland at ManageEngine) added.
Ya, they are spending money, but failing at basic cyber hygiene (read: documentation, patching and network segmentation). But hey, I Mr. ManageEngine here will be happy to sell us another product which just papers over the failures to get the basics done. And it will almost certainly have “Agentic AI” to do…something.
The compromise seems to have started with network equipment at one site, impacting the OT environment and potentially expanding into IT systems
I’d bet a lot of money the Asahi security team had been screaming about the OT environment being a big, juicy target for a long time. But, applying security controls in the OT environment is hard and scary and might cause a blip in production. So nope, all those shit-boxes running Windows XP must never be touched. Also, NDR is expensive and hard, so stop asking about it. But yes, those same shit-boxes really do need to be fully internet connected and logged on 24x7 as a local admin, with the same password everywhere, because identity management is hard.
We seriously need to start dragging CTOs, CIOs and CEOs out into the street, tarring and feathering them when this shit happens. Also, the companies making the OT systems need to have their entire management put through a chipper shredder the first time one of them suggests that their systems just shouldn’t be patched. If your shit is so fragile that an OS patch might break something, chipper shredder goes BRRRR…
Sorry, OT systems are a bit of a pain point.
Ya, AI as a tool has it’s place. I’m currently working on documentation to meet some security compliance frameworks (I work in cybersecurity). Said documentation is going to be made to look pretty and get a check in the box from the auditors. It will then be stored in a SharePoint library to be promptly lost and ignored until the next time we need to hand it over to the auditors. It’s paperwork for the sake of paperwork. And I’m going to have AI spit out most of it and just pepper in the important details and iron out the AI hallucinations. Even with the work of fixing the AI’s work, it will still take less time than making up all the bullshit on my own. This is what AI is good for. If I actually care about the results, and certainly if I care about accuracy, AI won’t be leaned on all that much.
The technology actually it pretty amazing, when you stop and think about it. But, it also often a solution in search of a problem.
There are a number of sites which provide either labs or virtual machines which are intentionally vulnerable. Some provide other resources to help learn.
I’d also suggest getting a good foundation in programming and building systems.
deleted by creator
AWS seems to be cratering as well: https://downdetector.com/status/aws-amazon-web-services/
And Google, why not?
Was going to say the same. I work in cybersecurity and while I have avoided the management track like the plague, I do recognize that it’s a fairly reasonable progression for someone in any tech field. Even if you don’t end up pursuing management, knowing how to speak to management will make your job in cybersecurity easier. Project management is also a worthwhile skill to pick up and that often comes from business school.
It’s not just speed, CGNAT is a near complete “fuck you” to self-hosting. You can work around it with a VPN endpoint “in the cloud”, but that still means you are reliant on someone else’s computer.
If the goal is stability, I would have likely started with an immutable OS. This creates certain assurances for the base OS to be in a known good state.
With that base, I’d tend towards:
Flatpak > Container > AppImage
My reasoning for this being:
This leaves the question of apt packages or doing installs via make. And the answer is: don’t do that. If there is not a flatpak, appimage, or pre-made container, make your own container. Docker files are really simple. Sure, they can get super complex and do some amazing stuff. You don’t need that for a single software package. Make simple, reasonable choices and keep all the craziness of that software package walled off from everything else.
It’s going to depend on what types of data you are looking to protect, how you have your wifi configured, what type of sites you are accessing and whom you are willing to trust.
To start with, if you are accessing unencypted websites (HTTP) at least part of the communications will be in the clear and open to inspection. You can mitigate this somewhat with a VPN. However, this means that you need to implicitly trust the VPN provider with a lot of data. Your communications to the VPN provider would be encrypted, though anyone observing your connection (e.g. your ISP) would be able to see that you are communicating with that VPN provider. And any communications from the VPN provider to/from the unencrypted website would also be in the clear and could be read by someone sniffing the VPN exit node’s traffic (e.g. the ISP used by the VPN exit node) Lastly, the VPN provider would have a very clear view of the traffic and be able to associate it with you.
For encrypted websites (HTTPS), the data portion of the communications will usually be well encrypted and safe from spying (more on this in a sec). However, it may be possible for someone (e.g. your ISP) to snoop on what domains you are visiting. There are two common ways to do this. The first is via DNS requests. Any time you visit a website, your browser will need to translate the domain name to an IP address. This is what DNS does and it is not encrypted by default. Also, unless you have taken steps to avoid it, it likely your ISP is providing DNS for you. This means that they can just log all your requests, giving them a good view of the domains you are visiting. You can use something like DNS Over Https (DOH), which does encrypt DNS requests and goes to specific servers; but, this usually requires extra setup and will work regardless of using your local WiFi or a 5g/4g network. The second way to track HTTPS connections is via a process called Server Name Identification (SNI). In short, when you first connect to a web server your browser needs to tell that server which domain it wants to connect to, so that the server can send back the correct TLS certificate. This is all unencrypted and anyone inbetween (e.g. your ISP) can simply read that SNI request to know what domains you are connecting to. There are mitigations for this, specifically Encrypted Server Name Identification (ESNI), but that requires the web server to implement it, and it’s not widely used. This is also where a VPN can be useful, as the SNI request is encrypted between your system and the VPN exit node. Though again, it puts a lot of trust in the VPN provider and the VPN provider’s ISP could still see the SNI request as it leaves the VPN network. Though, associating it with you specifically might be hard.
As for the encrypted data of an HTTPS connection, it is generally safe. So, someone might know you are visiting lemmy.ml, but they wouldn’t be able to see what communities you are reading or what you are posting. That is, unless either your device or the server are compromised. This is why mobile device malware is a common attack vector for the State level threat actors. If they have malware on your device, then all the encryption in the world ain’t helping you. There are also some attacks around forcing your browser to use weaker encryption or even the attacker compromising the server’s certificate. Though these are likely in the realm of targeted attacks and unlikely to be used on a mass scale.
So ya, not exactly an ELI5 answer, as there isn’t a simple answer. To try and simplify, if you are visiting encrypted websites (HTTPS) and you don’t mind your mobile carrier knowing what domains you are visiting, and your device isn’t compromised, then mobile data is fine. If you would prefer your home ISP being the one tracking you, then use your home wifi. If you don’t like either of them tracking you, then you’ll need to pick a VPN provider you feel comfortable with knowing what sites you are visiting and use their software on your device. And if your device is compromised, well you’re fucked anyway and it doesn’t matter what network you are using.
Ultimately, it’s going to be down to your risk profile. What do you have on your machine which would wouldn’t want to lose or have released publicly? For many folks, we have things like pictures and personal documents which we would be rather upset about if they ended up ransomed. And sadly, ransomware exists for Linux. Lockbit, for example is known to have a Linux variant. And this is something which does not require root access to do damage. Most of the stuff you care about as a user exists in user space and is therefore susceptible to malware running in a user context.
The upshot is that due care can prevent a lot of malware. Don’t download pirated software, don’t run random scripts/binaries you find on the internet, watch for scam sites trying to convince you to paste random bash commands into the console (Clickfix is after Linux now). But, people make mistakes and it’s entirely possible you’ll make one and get nailed. If you feel the need to pull stuff down from the internet regularly, you might want to have something running as a last line of defense.
That said, ClamAV is probably sufficient. It has a real-time scanning daemon and you can run regular, scheduled scans. For most home users, that’s enough. It won’t catch anything truly novel, but most people don’t get hit by the truly novel stuff. It’s more likely you’ll be browsing for porn/pirated movies and either get served a Clickfix/Fake AV page or you’ll get tricked into running a binary you thought was a movie. Most of these will be known attacks and should be caught by A/V. Of course, nothing is perfect. So, have good backups as well.
I know that, during my own move from Windows to Linux, I found that the USB drive tended to lag under heavy read/write operations. I did not experienced that with Linux directly loaded on a SATA SSD. I also had some issues dealing with my storage drive (NVMe SSD) still using an NTFS file system. Once I went full Linux and ext4, it’s been nothing but smooth sailing.
As @MagicShel@lemmy.zip pointed out, performance will depend heavily on the generation of USB device and port. I was using a USB 3.1 device and a USB 3.1 port (no idea on the generation). So, speeds were ok-ish. By comparison, SATA 2 can have a transfer rate of 2 GB/s. And while the SSD itself may not have saturated that bandwidth, it almost certainly blew the transfer rate of my USB device out of the water. When I later upgraded to an NVMe drive, things just got better.
Overall, load times from the USB drive is the one place I wouldn’t trust testing Linux on USB. It’s going to be slower and have lag compared to an SSD. Read/Write performance should be comparable to Windows. Though, taking the precaution of either dual booting or backing up your Windows install can certainly make sense to test things out.
And we’re just supposed to trust the word of partisan hack. Ya, no.
I do get that there is a lot of intransigence in Federal IT. I was an IT and IS contractor for a couple sites within the US FedGov and there were places where “that’s the way we’ve always done it” was the trump card for any proposed change. And this led to some abysmal security practices which should have resulted in a lot of management getting shown the door (and mostly not just IT/IS management, culture gets set from the top). And I’ve worked at others where we had a large staff of folks whose entire job was ensuring compliance with all required cybersecurity controls and documentation. While I’ll be one of the first to state that compliance is not security, I also have yet to see a site which got security mostly right which didn’t also have compliance on lock. If you are doing things the right way, compliance is actually pretty easy to achieve, since good documentation is the foundation of security. If you go into a site and they can’t even spell CMDB, expect a shitshow.
So ya, if the DHS team went to FEMA’s IT team and started asking for network diagrams, data flow diagrams, system and network baseline checklists and system documentation; and the FEMA IT team’s response was, “sorry, we don’t have that”. Then yes, I would get cleaning house. Though, I’d have started by figuring out if the problem is the IT team just not getting it done; or, if the IT team was prevented from getting it done. My experience has been that IT teams are willing to patch and correct configurations; but, this means downtime and risk to applications. So, upper management will side with the application owners who want five nines uptime on a “best effort” budget, which ends up blocking patching and configuration changes. Also, if the IT team is spending 40 hours a week putting out fires and dealing with the blow-back from accumulated technical debt, that’s an upper management problem.
The problem, of course, is that the DHS is led by a two-bit partisan hack. And this administration is known for straight up lying to clear the board for it’s own partisan interests. I have zero faith that they did any sort of good faith analysis of the FEMA IT department. Especially since this is the same administration which gave us Russian compromised DOGE servers.
force binary choices that don’t align with household rules or with children’s maturity levels.
This has been my main experience with “parental controls”. As soon as they are turned on, I lose any ability to manage the experiences available to my children. So, in areas where I see them as mature enough to handle something, the only way I can allow them access to that experience is to completely bypass the controls. In many ecosystems, if I judge that one of my children could handle a game and the online risks associated with it, I can’t simply allow that game. Instead, I need to maintain a full adult account for them to use. You also run into a lot of situations where the reason a game is banned from children is unclear or done in an obvious “better safe than sorry” knee-jerk reaction. Ultimately, parental controls end up being far more frustrating than empowering. I’d rather just have something that just says, “this game/movie/etc your kid is asking for is restricted based on reasons X, Y and Z. Do you want to allow it?” Log my response and go with it. Like damned near any choice in software settings, quit trying to out-think me on what I want, give me a choice and respect that choice.
The US Government hasn’t given a shit about harmful monopolistic practices in a long time. They only pretend to care from time to time to force large companies to start donating to politicians.
You could try using Autopsy to look for files on the drive. Autopsy is a forensic analysis toolkit, which is normally used to extract evidence from disk images or the like. But, you can add local drives as data sources and that should let you browse the slack space of the filesystem for lost files. This video (not mine, just a good enough reference) should help you get started. It’s certainly not as simple as the photorec method, but it tends to be more comprehensive.