Stephen Savitzky

What Were You Thinking, Patreon?

2022-09-10T00:00:00-07:00

So, a couple of days ago (September 8th, to be exact) Patreon laid off their entire five-person security team. WTF? The linked article goes on to say,

The firm, which is still doing business in Russia, simply calls it “a strategic shift” (which seems to be corporate mumbo-jumbo for “cheaper outsourcing”). But infosec experts call it a “nightmare” caused by an “untrustworthy” company that’s “just put a massive target on its back.”

You can see links to more articles below in the resources.

The minimum reasonable response to this would be to change your password. Done that. It's not unreasonable to delete your account. I'm still supporting a few sites, so I'll leave my account in place until I see what's going to happen. And laying in a supply of popcorn.

Resources

@ Patreon confirms it 'parted ways' with its 'entire' cyber security team | IT PRO
Patreon confirms security team layoffs | TechCrunch
Patreon Fires its Security Team — and the Internet Freaks Out
Patreon Just Let Its Entire Security Team Go [Updated]
Should You Delete Your Patreon Account After They Laid Off Their Entire Security Team? - Dhole Moments -> excellent discussion of risks and alternatives -> changed password. Probably ought to delete account too, but I'm using it.

Update Zoom on Mac ASAP

2022-08-16T00:00:00-07:00

According to this article posted yesterday on Ars Technica, there is a major security hole in Zoom for the Mac. Zoom issued a security bulletin on Saturday. The article suggests that you should download the update directly from Zoom or click on your menu bar options to “Check for updates” rather than waiting for the auto-update, although if you’ve already updated since Saturday you’re probably ok.

The article goes into more detail; tl;dr is that Zoom’s installer is owned by and runs as root, and has a major bug that allows unsigned updates to be installed.

Resources

Trojan Source

2021-11-02T00:00:00-07:00

This post in Krebs on Security describes an unusual and potentially very dangerous attack technique that can be used to sneak evil code past code reviews and into the supply chain. Briefly, it allows evildoers to write code that looks very different to a human and a compiler. It should probably come as no surprise that it involves Unicode, the same coding standard that lets you make blog posts that include inline emoji, or mix text in English and Arabic.

In particular, it's the latter ability that the vulnerability targets, specifically Unicode's "Bidi" algorithm for presenting a mix of left-to-right and right-to-left text. (Read the Bidi article for details and examples -- I'm not going to try plopping random text in languages I don't know into the middle of a blog post.)

Now go read the "Trojan Source Attacks" website, and the associated paper [PDF] and GitHub repo. Observe, in particular, the Warning about bidirectional Unicode text that GitHub now attaches to files like this one in C++. Observe also that GitHub does not flag files that, for example, mix homoglyphs like "H" (the usual ASCII version) and "Н" (the similar-looking Cyrillic letter that sounds like "N"; how similar it looks depends on what font your browser is using). If you're unlucky, you might have clicked on a URL containing one or more of these, that took you someplace unexpected and almost certainly malicious.

The Trojan Source attack works by making use of the control characters U+202B RIGHT-TO-LEFT EMBEDDING (RLE) and U+202A LEFT-TO-RIGHT EMBEDDING (LRE), which change the base direction explicitly.

And remember: ШYSINAШYG - What You See Is Not Always What You've Got!

Resources

Trojan Source Attacks

here [PDF]

 @article{boucher_trojansource_2021,
	title = {Trojan {Source}: {Invisible} {Vulnerabilities}},
	url = {https://trojansource.codes/trojan-source.pdf},
	journal = {Preprint.},
	author = {Nicholas Boucher and Ross Anderson},
	year = {2021}
 }

‘Trojan Source’ Bug Threatens the Security of All Code – Krebs on Security
nickboucher/trojan-source: Trojan Source: Invisible Vulnerabilities
Warning about bidirectional Unicode text | GitHub Changelog
Unicode Bidirectional Algorithm basics
but... research!rsc: On “Trojan Source” Attacks

What happened to facebook yesterday?

2021-10-06T00:00:00-07:00

If you're sensible enough not to use Facebook, WhatsApp, or Instagram, or to have set up "log in with Facebook" on any site you use regularly, you might not have noticed that they all disappeared from the internet for about six hours yesterday. Or if you noticed, you might not have cared. But you might have read some of the news about it, and wondered what the heck BGP and DNS are, and what they had to do with it all.

And if not, I'm going to tell you anyway.

You're more likely to have heard of DNS: that's the Internet's phone book. Your web browser, and every other program that connects to anything over the Internet, uses the Domain Name System to look up a "domain name" like, say, "www.facebook.com", and find the numerical IP address that it refers to. DNS works by splitting the name into parts, and looking them up in a series of "name servers". First it looks in a "root server" to find the address of the Top-Level Domain (TLD) server that holds the lookup table for the last part of the name, e.g., "com". From the TLD server it gets the address of the "authoritative name server" that holds the lookup table for the next part of the name, e.g., facebook, and looks there for any subdomains (e.g. "www").

(When you buy a "domain name", what you're actually buying is a line in the TLD servers that points to the DNS server for your domain. You also have to get somebody to "host" that server; that's usually also the company that hosts your website, but it doesn't have to be.)

All this takes a while, so the network stack on your computer passes the whole process off to a "caching name server" which remembers every domain name it looks up, for a time which is called the name's "time to live" (TTL). Your ISP has a caching name server they would like you to use, but I'd recommend telling your router (if you have full control over it) to use Cloudflare's or Google's nameserver, at the IP address 1.1.1.1 or 8.8.8.8 respectively. Your router will also keep track of the names of the computers attached to your local network.

Finally, we get to the Border Gateway Protocol (BGP). If DNS is the phone book where you look up street addresses, BGP is the road map that tells your packets how to get there from your house, and in particular what route to take.

The Internet is a network of networks, and it's split up into "autonomous systems (AS), each of which is a large pool of routers belonging to a single organization. Each AS exchanges messages with its neighbors, using BGP to determine the "best" route between the itself and every other AS in the Internet. (The best route isn't always the shortest; the protocol can also take things like the cost of messages into account.) BGP isn't entirely automatic -- there's some manual configuration involved.

What happened yesterday was that somebody at Facebook accidentally gave a command that resulted in all the routes leading to Facebook's data centers being withdrawn. In less than a minute Facebook's DNS servers noticed that their network was "unhealthy", and took themselves offline. At that point Facebook had basically shot themselves in the foot with a cannon.

Normally, engineers can fix server configuration problems like this by connecting to the servers over the internet. But Facebook's servers weren't connected to the internet anymore. To make matters worse, the computers that control access to Facebook's buildings -- offices as well as data centers -- weren't able to connect to the database that told them whose badges were valid.

Meanwhile, computers that wanted to look up Facebook or any of its other domains (like WhatsApp and Instagram), kept getting DNS failures. There isn't a good way for an app or a computer to determine whether a DNS lookup failure is temporary or permanent, so they keep re-trying, sometimes (as Cloudflare's blog post puts it) "aggressively". Users don't usually take an error for an answer either, so they keep reloading pages, restarting their browsers, and so on. "Sometimes also aggressively." Traffic to Facebook's DNS servers increased to 30 times normal, and traffic to alternatives like Signal, Twitter, Telegram, and Tiktok nearly doubled.

Altogether a nice demonstration of Facebook's monopoly power, and great fun to read about if you weren't relying on it.

Resources

Public Service Announcement: Recent leaks and other news

2021-10-06T00:00:00-07:00

1. The entirety of Twitch has reportedly been leaked: source code, user payouts, hashed passwords. Change your password RIGHT NOW.

2. Company That Routes Billions of Text Messages Quietly Says It Was Hacked; Criminals were inside Syniverse for 5 years before anyone noticed - Malwarebytes; Syniverse responds to data breach. Good reason to switch to Signal, if you haven't already. Won't help with ordinary SMS text messages, though. Don't send secrets via SMS.

... and in other news,

3. Facebook whistleblower Frances Haugen details company's misleading efforts on 60 Min. Facebook, over and over again, has shown it chooses profit over safety. It is subsidizing, it is paying for its profits with our safety. But you knew that already, right?

4. This morning I got an email from my mobile provider, AT&T, offering me a pair of free security apps collectively called AT&T ActiveArmor (details). I'd quote the email, but it was nothing but a pretty image. I went to the Google and Apple app stores and read the reviews. Apparently, it's just like all the other AT&T bloatware I've deleted over the years: flaky, a memory and bandwith hog, and not worth the price you pay for it. And when I can say that about something free, well...

5. ...and speaking of free, Windows 11 drops Oct. 5: Mark your calendars - TechRepublic. That would be today. Also, Windows 11 upgrade: Five questions to ask first | ZDNet. Fortunately it won't run on any of my machines, so I don't have to care.

P.S. In case you're trying to understand yesterday's Facebook et. al. outage, that's what I'll be writing about next.

Finding ELIZA

2021-06-05T00:00:00-07:00

Note: Despite being posted on a Saturday and a title that includes the name of a a character from a well-known musical, this is not a Songs for Saturday post. It doesn’t have anything to do with fish, either.

Remarkably, Joseph Weizenbaum’s original source code for ELIZA has been rediscovered, after having been missing and believed lost for over half a century, and was made public on May 23rd of this year. ELIZA is probably the oldest and almost certainly the best-known implementation of what is now known as a chatbot.

If you decide to look at the code, start by reading the web page it’s embedded in before you dive into the listing. The “Notes on reading the code” section, which comes after the listing, will prevent a lot of confusion. The listing itself is a scan of a 132-column listing, and definitely benefits from being viewed full-screen on a large monitor.

The first thing you see in the listing is the script – the set of rules that tells the ELIZA program how to respond to input. The program itself starts on page 6. You might be misled by the rules, which are in the form of parenthesized lists, into thinking that the program would be written in LISP. It’s not; it’s written in MAD, an Algol-like language, with Weisenbaum’s SLIP (Symmetric List Processing) primitives embedded in it.

SLIP uses circular, bidirectionally-linked lists. Each list has a header with pointers to the first and last list element; the header of an empty list points to itself. I’ve lost track of how many times I’ve implemented doubly-linked lists, in everything from assembly language to Java.

ELIZA is the name of the program, but “Eliza” usually refers to the combination of an Eliza-like program with the Doctor script. The most common script is a (rather poor) simulation of a Rogerian psychotherapist called “Doctor”. According to the note at the bottom of the Original Eliza page, actual Rogerian therapists have pronounced it a perfect example of how not to do Rogerian therapy. Nevertheless, many people are said to have been helped by ELIZA, and it’s possible to have a surprisingly intimate conversation with her as long as you suspend your disbelief and respect her limits.

If you have Emacs installed on your computer, you can access a version of Doctor with M-X doctor. Otherwise, browse to Eliza, Computer Therapist if you don’t mind having a potentially intimate conversation with something hosted on a public website. (Or simply download the page – it’s written in Javascript.)

Resources

ELIZAGEN – The Genealogy of ELIZA “This site is dedicated to tracing the legacy ofJoseph Weizenbaum’s ELIZA (aka. Doctor) program.”
ELIZAGEN - The Original ELIZA - the source code.
anthay/ELIZA: A Simulation in C++ of Joseph Weizenbaum’s 1966 ELIZA by Anthony Hay. The README includes both a copy of the transcript published in Wizenbaum’s CACM article in 1966, and a detailed description of the script syntax and how it works.
MAD (Michigan Algorithm Decoder) manual by Elliott Organick (1961).
GNU gSlip [PDF Manual(738K)] for C++.
doctor.el\play\lisp - emacs.git - Emacs source repository - the Doctor program as implemented in Emacs LISP.
Eliza, Computer Therapist in Javascript

RIP Fry’s Electronics – the end of an era

2021-02-24T00:00:00-08:00

Today I was shocked to read that Fry's Electronics has gone out of business, as of midnight last night (February 24th). Their web page has the announcement:

After nearly 36 years in business as the one-stop-shop and online resource for high-tech professionals across nine states and 31 stores, Fry’s Electronics, Inc. (“Fry’s” or “Company”), has made the difficult decision to shut down its operations and close its business permanently as a result of changes in the retail industry and the challenges posed by the Covid-19 pandemic. The Company will implement the shut down through an orderly wind down process that it believes will be in the best interests of the Company, its creditors, and other stakeholders.

It's a sad, sad day. Their first ad, a full page in the San Jose Mercury-News, was like nothing seen before (or since), listing computer chips and potato chips on the same page. (Its relationship to Fry's Food and Drug, which had recently been sold by the founders' father, was obvious.) As time went by the groceries largely disappeared, but soft drinks and munchies remained, and some of the larger stores included a cafeé.

I (snail) mailed a copy of that first ad to my father, and that first Sunnyvale store was one of the tourist attractions we visited on his next visit to the West Coast. I have no idea how much money I spent there over the years.

After I moved to Washington in 2012 my visits to Fry's became much less frequent, and more of my electronics started coming from Amazon. It's been years since I saw the inside of a Fry's store.

I'll miss it.

Dependency Confusion

2021-02-16T00:00:00-08:00

I've always been a little uncomfortable about build systems and languages that start the build by going out to a package repository and pulling down the most recent (minor or patch) version of every one of the package's dependencies. Followed by all of their dependencies. The best-known of these are probably Python's pip package manager, Javascript's npm (node package manager), and Ruby's gems. They're quite impressive to watch, as they fetch package after package from their repository and include it in the program or web page being built. What could possibly go wrong?

Plenty, as it turns out.

The best-known technique for taking advantage of a package manager is typosquatting -- picking a name for a malware package that's a plausible misspelling of a real one, and waiting for someone to make a typo. (It's an adaptation of the same technique from DNS - picking a domain name close to that of some popular site in hopes of siphoning off some of the legitimate site's traffic. These days it's common for companies to typosquat their own domains before somebody else does -- facbook.com redirects to FB, for example.)

A few days ago, Alex Birsan published "Dependency Confusion: How I Hacked Into Apple, Microsoft and Dozens of Other Companies", describing a new attack that relies on the way package managers like npm resolve dependencies, by looking for and fetching the most recent compatible version (i.e. with the same major version) of every package, and the fact that they can be made to look in more than one repository.

Fetching the most recent minor version of a package is usually perfectly safe; packages have owners, and only the owner can upload a new version to the repository. (There have been a few cases where somebody has gotten tired of maintaining a popular package, and transferred ownership to someone who turned out to be, shall we say, less than reliable.)

The problem comes if, like most large companies and many small ones, you have a private repository that some of your packages come from. The package manager looks in both places, public and private, for the most recent version. If an attacker somehow gets the name and version number of a private package that doesn't exist in the public repository, they can upload a bogus package with the same name and a later version.

It turns out that the names and versions of private packages can be leaked in a wide variety of ways. The simplest turns out to be looking in your target's web apps -- apparently it's not uncommon to find a copy of a `package.json` left in the app's JavaScript by the build process. Birsan goes into detail on this and other sources of information.

Microsoft has published 3 Ways to Mitigate Risk When Using Private Package Feeds, so that's a good place to look if you have this problem and want to fix it. (Hint: you really want to fix it.) Tl;dr: by far the simplest fix is to have one private repo that includes both your private packages, and all of the public packages your software depends on. Point your package manager at that. Updating the repo to get the most recent public versions is left as an exercise for the reader; if I was doing it I'd just make a set of dummy package that depend on them.

Happy hacking!

Resources

Curmudgeon Thinks Out Loud

2020-09-05T00:00:00-07:00

...about disk partitioning. Content warning: rather specialized geekness. If that's not something you're into, you might want to skip this.

If you've been reading my posts for a while, especially if you've been reading them on Dreamwidth, you may have noticed a tendency to over-think things. And if you read this Curmudgeon post, you can probably guess what I'm over-thinking about. Or at least one of the things -- my previous post, about keyboards, was the other.

Last Sunday the SSD in Sable, my main laptop, became corrupted, and after waffling for a while about what to replace it with I ordered a new one -- a bigger one, of course. The old one was/is 500GB; the new one is twice that. That raises two obvious questions: how to partition the new drive, and what to do with the old one. I'm planning to tackle that second question after it has actually become the old drive.

Most of my current overthinking is about partitioning the new drive. There doesn't seem to be much point in putting Windows on it (see below; the old drive has/had a Windows partition that I haven't used since I got it), so the real questions are: how many different Linux distros do I want to install, and how should I organize the disk to support that?

Installing and playing with Linux distros is enormous fun, and a tremendous time-sink. The most sensible thing would be to just install Ubuntu, which I'm already using, on my main machine, and play around on a machine I don't use daily, perhaps finally settling on some other distro that I prefer, and switching to it.

Anyone who expects me to be sensible about this doesn't know me very well.

The distros I'm most interested in investigating are Mint with the MATE desktop, which is based on Gnome-2, and Ubuntu Studio, which has the low-latency kernel and defaults to a multimedia production environment. My current desktop is Gnome Flashback on Ubuntu, which isn't as close to Gnome-2 as I'd really like, and I'm still using Ubuntu 18.04, which has gotten a little long in the tooth by now.

So the minimum set of distros to install are Mint and Ubuntu Studio. Ubuntu Studio is just Ubuntu with a different set of defaults; mainly the low-latency kernel, so I don't have to bother with installing regular Ubuntu. Linux Mint comes in two flavors -- LMDE (Linux Mint Debian Edition), and Mint 20, which is based on Ubuntu 20.04. Modulo hardware support I think I'd lean toward LMDE; there are also some indications that Mint 20 identifies itself as Ubuntu to the EFI bootloader, which could be a problem. I'll make four distro-root partitions, because I might need to drop back to Ubuntu 18.04 if something goes really wonky (like support for XMonad), and in any case I want to have some room to experiment.

I see that the root partition of my current install on Raven is using 14G out of a 20G partition, so I'm thinking somewhere between 25 and 32 would be a good size; I'll go with the high end because I can. That means 128 GB for roots. Eventually I expect to settle on Mint for most things plus Studio for audio, but you never know...

At first I wasn't sure that a GPT partition table (that's an unnecessary redundancy, of course) would be a good idea; I've had a lot of trouble with that in the past. But the idea of having an actual boot manager (with a better UI than Grub) is attractive, as is the idea of not having the stupid distinction between primary and logical partitions. And "Setting up a multi-boot of 5 Linux distributions | by Manu Järvinen" looks pretty straightforward. It's definitely worth a try. I can always nuke it and start over if I get into serious trouble, though I don't think I will.

The remaining question is what to do with the left-over 800+ GB of space, and that's one I actually have a good answer to. I need to have a home directory on each distro, because they'll all have mostly-incompatible config files. So the big partition is where all of the state that I can share will live. It will have a symlink or bind mount on each of the separate homes, and many of the config files and others will live in it. That goes for Documents, Downloads, etc. as well.

The traditional name for that partition is vv, and I have no reason to change it. The name comes from bygone days when I split up a brand-new, enormous 120(?) GB drive into partitions called uu, vv, ww, xx, yy and zz. They were originally mirrors for partitions called uu, v, w, x, y and z; when the first drive crashed, as they do, ...

I used to put /usr on u, and /var on v, using the rest for the roots of various distros. So v was always the biggest one, at least on the server. Most of the lettered partitions became unnecessary once I stopped playing around with multiple distros quite as much, and vv, mounted via NFS from the file server, remained as the place where websites, writing, and other projects ended up. My current server, Nova, has both vv and home in separate partitions and ~/vv is a symlink. Everywhere else, including my web host, it's a real directory tree under my home directory.

(aside) Have I written about how I organize things under ~/vv/*? (Grep, grep, grep.) No, apparently not. (/me adds a to-do item.) But I have written about the origin of this partitioning scheme, in Playing with Multiple Distros 2003/6/9. First of a series called How I Work, which I seem to have abandoned back in 2006. Oops!

Each distro will have its own set of home directories; that keeps any distribution-specific configuration files from getting clobbered. Any config files that aren't distro-specific will be symlinks into vv; mostly vv/prj/Honu, which is my generic configuration and setup repository, or vv/prj/Mathilda, which is its machine-specific counterpart. Downloads, Documents, etc. will also be symlinks into vv, so that they're all accessible from every distro. Home directories get backed up into vv/backups on the fileserver; because almost everything is symlinked, they tend to be quite small.

I think, in a nod to tradition, I'm going to label the various root partitions ww, xx, yy and zz. And I'll probably make a small partition for boot or swap if anything needs it, otherwise it may end up with a lightweight distro on it... So should I call that uu?...

Dreamwidth makes an excellent rubber duck -- thanks for listening.

The Curmudgeon Contemplates Keyboards

2020-09-02T00:00:00-07:00

For the last week or two my external keyboard has been flaking out -- dropping keystrokes, and occasionally barfing out a string of repeats. The cats, of course, know nothing about this. Or will admit to nothing, in any case. So yesterday, after determining that a blast of canned difluoroethane wasn't going to fix it, I finally started to think seriously about replacing it.

The keyboard has only a limited set of plausible replacements, because there are only two types of external keyboard that I can stand: the Model M and the ThinkPad TrackPoint Keyboard. The Model M and the oldest of the Thinkpad keyboards (the marvelous SK-8845 Ultranav) can be dismissed out of hand because they lack a logo key, which I've gotten used to using as Xmonad's Mod key. Most Model Ms lack a trackpoint, although I have one that has it -- and two PS-2 connectors on the cable. Besices, I'm not positive that I can find my Model M at this point, and it takes up a lot of desk space that I don't have anymore.

The second generation of Thinkpad keyboards -- the SK-8855 -- have a logo key, and an attached USB cable that stows into a recess on the back, but have the page-up and page-down keys on the right-hand edge, in what has become, for me, the wrong place. That makes them just enough different from the keyboards on the newer Thinkpads that it's annoying. I have one that I'd consider using anyway, but it's broken; my second one is out on loan.

(You might well ask why, since both of the laptops I'm using -- Sable and Raven -- are Thinkpads with the right keyboard, I would be looking at external keyboards. I blame the cats. If I have an external keyboard and an external monitor on my desk, I can close the lid and let Desti sit on it. Come to think of it, that may be why I need a replacement keyboard in the first place.)

There are three Thinkpad keyboards with the new layout -- the KU-1255, which is what I'm looking to replace, the Bluetooth version, and the shiny new ThinkPad TrackPoint Keyboard II. The Bluetooth version has gotten poor reviews -- apparently it tends to be laggy -- and in any case one of the laptops it needs to go with doesn't have Bluetooth. (I know -- dongles. I'm also running out of USB ports.) The Keyboard II has both Bluetooth and a wireless USB dongle. (It would, of course, be ideal if it were compatible with Logitech's, but of course it wouldn't be.)

I was just about to order one when I saw this line on Lenovo's website:

Ships in more than 5 weeks.

So it looks as though I get to spend $60 on a KU-1255 to use while I'm waiting. Or instead. Or maybe an SK-8855, because they have an attached USB cable instead of requiring a (fragile) micro-USB, except that those appear to be made of unobtainium today. And I can get the KU-1255 from Amazon and have it delivered tomorrow.

Just for the record, here's what I like (and some reviewers detest, of course) about the newer Thinkpad keyboards:

Page-up and page-down keys. (Many -- perhaps most -- newer compact keyboards require using the function key on the up and down arrows, which makes it hard to hit one-handed. Because cat.)
The cursor keys are all in one place on the lower right: the arrows in an inverted-T arrangement, with the page-up and page-down on either side of the up-arrow in what practically every other keyboard leaves as empty space. Huh?
Trackpoint -- the little red pointing stick between the G, H, and B keys. I don't always use it, but it's there when I need it. And you can scroll with it.
Along with the trackpoint, there are three buttons directly under the space bar. The middle one is what you hold down to scroll with the trackpoint; on Linux it's also "paste selection" in most places, and "download" in browsers.
The classic Thinkpad key-feel. A lot like a Model M clicky-key only silent. Less travel than the mechanical keys on the Model M, but I've come to prefer that.

I'm still waffling over the II. It's hard to justify, now that I have a 1255 on order. But not impossible. Meanwhile I'll just sit here listening to The Typewriter (a concerto for orchestra and solo typewriter) by Leroy Anderson). (There's a version that includes a repeat performance using an IBM Selectric, but I can't seem to find it now. It would have been perfect for this post.)