which is why, to me, the principle is so important
right now Apple can hold the moral high ground and say "we don't even give this to the US gov"
if that goes, they're into fighting it in each country with each agency
and here's some more moral hazard for you , say we have a saudi citizen in the UK, with a phone registered in Germany, which of those three countries can file a demand
@RоryMcCune I agree. I was really looking to see if there is a way around it - I mean, in this case it is a single phone being targeted, which is much better than collecting everything (and the dog) just in case. I guess not though, because it will eventually be pushed towards that.
also largely this is all american companies, if this ever actually happened all the fbi would achieve is murdering the entire US technology secter overnight
it's alright whining "oh we needs your data" but if they do, suddenly it won't be american companies holding the data, it will be their international replacements and then they're back to square one, because they can't play the jurisdiction card to get the data from said international replacement
@diagprov sure you do, but what do apple do? say I'm in france but with a UK registered phone, why can't the UK gov. go to Vodafone (in the UK) who go to apple (in the UK) to demand access
@RоryMcCune The question really needs to be the other way around - where did the crime happen? I'm assuming the phone has been surrendered on arrest, rather than the government is randomly pushing out malicious OTA updates. In which case, if you committed a crime in France, with a UK phone, then it would be Apple in France.
@diagprov to me though that's part of the slippery slope, once the precedent is established for phone's in possession of law enforcement, there's no reason why it shouldn't be OTA updates
law makers would be very unlikely to make that distinction as they don't understand the concepts in question
@RоryMcCune I agree entirely. There's a lot of problems, especially when we start getting away from "proven criminal" to "suspected criminal". If France decide you might be up to no good and schedule an OTA update for you but you go home before it arrives, then, they've scheduled an OTA update for a UK citizen in the UK...
@diagprov yeah it's a complete nightmare jurisdictionally. It's something the Internet has essentially been dodging for a while now and sooner or later I have a feeling reality is going to set iin
@AviD wouldn't surprise me TBH, I've heard people argue that ASLR/DEP shouldn't be needed as they don't add much and it's "inevitable" that they can be bypassed
@diagprov well if you've got Internet IPs you own you could host the client Internet facing and then if you can get authority for the domain on a DNS server you control it ... should .. work, but yeah internet control panel style likely wouldn't
for most of my domains I can set the DNS servers to be whatever I want
so I could set it to one of my external facing IPs
@RоryMcCune yep, because you have authority to edit the records delegated to you - you can set the nameserver to whatever you want. I run my own forward dns no problem.
What I'm saying is I cannot edit the dns records for my IP address ranges.
dig +nssearch ccc.bbb.aaa.in-addr.arpa shows you which server is responding to rdns queries for aaa.bbb.ccc.xxx.
Sorry, I'm talking jibberish a little. For each IP I use I can set the PTR record to be some hostname by talking to the datacentre and asking them to do it.
But I don't do it by editing bind / unbound / whatever config, as I do for forward dns on my domains.
@Matthew - You may not understand how SMBs in Asia have a funky way of operating. So, please leave the moral high ground & help with what's being asked. Please guide on tracing so that we can enforce policies that will prevent in future. Its not about assigning blame, its about preventing repeating similar ACTIVITY/ things in future. Also, to know what faux paus was conducted - it could be someone stupidly installed a browser toolbar/ extension. Why we want this is KEY for us.. If you can help guide us please do let us know. — Alex S23 mins ago
Sometimes, I don't know why I bother with comments on questions rather than just VTC
Mazar Bot a new Android malware that spreads via SMS, its capabilities: It can read incoming SMS and send itself, make calls to directory contacts, contaminate Chrome, access to the Network, read the phone status or query the network to know the status and completely erase the contents of storage...
@deed02392 So PHP's MT rand has been broken for god knows how long; someone notices the mistake and fixes it; guy reverts the fix since it breaks all code that depends on MT rand's output being deterministic.
that's like saying "you look really busy lining up that shot" while I'm spraying bullets from an uzi
I'm somewhat embarrassed by the fact that @Ohnana and @MarkBuffalo have both got way more rep than me in no time at all so for ~3-4 minutes I was motivated to do something about it but then I realized I have more rep than @Simon in less time and he can live with himself so it can't be all that bad
@bluefeet Where is that link to request swag to pass out at events for Secse?
@bluefeet I'd like to attend a security conference, and pass out swag or something. I heard this is a thing, and want to find out how to socialize by bribes
The text message to infect your device with the Mazar bot looks like this:
You have received a multimedia message from +[country code] [sender number] Follow the link http: //www.mmsforyou [.] Net / mms.apk to view the message.
Don't run the link and you don't get infected.
You can also e...
We have a CI server which is installed as the builduser and all tasks are executed as that respective user at the OS level. We have many teams sharing the build server which means the build user and its resources are shared.
Each team also manages different environments and this requires ssh con...
@MarkBuffalo You can use the contact us form. Explain what you need, when you need it by, etc and we'll see if we can do something. I'm not sure if we have any Sec swag in stock though
what is the difference between cipher (i.e. aes128-ctr, aes192-ctr, aes256-ctr, aes256-cbc,aes192-cbc, aes128-cbc,blowfish-cbc,3des-cbc server aes128ctr,aes192-ctr,aes256-ctr)
Thanks in advance.
MTSC
@Matthew yeah. I know telling people to nuke from orbit sounds like overkill, but, if you have backups and a disaster recovery plan it shouldn't be too hard
@Simon Yes, but that's kind of a different problem. That's "spotting infection when it occurs", and people are terrible at that in my experience (having been dealing with a system that was infected at some point betwen 2011 and 2014, and they spotted last month...)
@RoraΖ Yeah, makes sense. Depends why they've built in the way they have - might be to keep the number of accounts on production systems down (seen that before), which seems sensible until you work through all the effects of this
@Simon Ok but, how do you clean install your company database server with seven years' worth of data on it? You need that data back, as close to now as possible.
@Simon You need at least to extract the data from a backup at a time when it was known good. Perhaps not the whole server, maybe for that you have a deployment procedure to install a new one, but rarely can you throw away all your old data.
@kalina If the legal framework for providing software had been defined along the same lines as the legal obligations when building and selling cars, then there would be a lot fewer bugs in software -- and a lot less software, too.
@ThomasPornin but considering that a bug in the autodrive system of a car is equally as capable of killing somebody as the driver sitting in the passenger seat not paying attention, maybe they should.