It seems like you can't go a day with any exposure to media without hearing about machine learning, or developing software which isn't designed to do anything in particular but is capable of teaching itself to carry out tasks tasks and make educated predictions based upon its training and data already available to it. If you've ever had to deal with a speech recognition system, bought something off of Amazon that you didn't know existed (but seemed really interesting at the time), or used a search engine you've interacted with a machine learning system of some kind. That said, here's …
Well, I'm back from DefCon in sunny and hot Las Vegas, Nevada and more or less reinserted back into my everyday life. I'm just about caught up on everything that happened at work and finally finished the notes that are going to comprise this article. I'll type up the notes I took during the talks at DefCon in a couple of days; they've voluminous and I want to get the experience out of my head and into external storage before the memories fade much more. Unfortunately, I didn't make it to any of the villages so I don't have anything …
Now our hypothetical trusted and open computing platform needs applications so you can get real work done. Text editors, scripting languages, officeware, and probably a desktop of some kind. To stick with our security practice of keeping systems as spare as possible, I recommend only installing applications and their dependencies as you need them. In the last post I suggested picking a package management system of some kind if one isn't already a core component of the OS that we recompiled and installed. If you get in the habit of building and using packages now you'll save yourself a lot …
Now we need an operating system for the trusted, open source computer. As previously mentioned, Windows and MacOSX are out because we can't audit the code, and it is known that weaponized 0-days are stockpiled by some agencies for the purpose of exploitation and remote manipulation of systems, and are also sold on the black and grey markets for varying amounts of money (hundreds to multiple thousands of dollars). It has been observed by experts many a time that software being open source is not a panacea for security. It does, however, mean that the code can be audited for …
After rethinking this post a little, I feel a need to caveat things: In a previous post in this series I mentioned the possibility of using an open source System On A Chip because it would simplify the construction process somewhat. I've been doing some more research and I'm not certain that all SoC's (if that is the direction a project like this would go in) require system firmware of the sort we're about to discuss. The Broadcom BCM2835 mentioned earlier, for example, has firmware on board that is sufficient to initialize the hardware and then try to load the …
On most of my desktop machines I use a system monitoring application called GKrellM to keep an eye on the amount of memory in use, aggregate network activity, swap space, and battery life. It's a handy utility and is very configurable. I have a couple of tweaks that I like to make to my settings to make its output a little more useful by increasing the granularity. I'm going to assume that you're interested enough in GKrellM to play around with the settings (right click on the GKrellM panel, Configuration). In the interest of full disclosure, I also intend on …
Late last year, known and respected information security researcher Dragos Ruiu began tweeting about something he called #badBIOS - a malware agent of some kind that he says jacks the BIOS of a machine and sets itself up as a hypervisor-cum-backdoor beneath the operating system. He's gathered got some evidence that instances of the beastie communicate via near-ultrasound by directly manipulating the soundcard without interacting with the OS' drivers. Whether or not he's actually right, some of the NSA's older existing tools aside - it was surprising how fast corroborating details started popping up around the Net.
In an application development team consisting of n engineers, expect n distinct APIs or translation layers to be developed for use inside the application they are building, all of which are designed "To simplify the API of the other layers my code interfaces with."
The sum total of the Edward Snowden revelations have pretty conclusively proved one thing: That we can't trust anything. The communications networks wrapped around the globe like a blanket are surveilled so minutely that Russian President Vladimir Putin has openly stated his admiration for the US getting away with it so successfully. Much of the cryptographic infrastructure used to protect our communications and data at rest is known to be vulnerable to one or more practical attacks that, in the end they can't really be called effective if one wants to be honest. The company RSA has all but admitted …
