Making progress towards finding “a set of floating point calculations [that] can uniquely identify any processor…They can’t yet spot specific processors but they can use this technique to identify families of them…this kind of approach would allow much more specific cyberattacks than are possible today.”

“Individual users who do not want to enroll could stay in the ‘wild, wild west’ of the unprotected internet…I think it’s gonna have to be voluntary…People could opt into protection – or choose to stay out. Individual users may well choose to stay out…But it’s the vulnerability of certain critical infrastructure – power, transportation, finance. This starts to give you an angle at doing that.”

The idea that deploying Einstein more widely is anything more than a step towards a government-sponsored security monoculture escapes me. There is no way that this will get any real traction because it’s not like the USG can credibly claim that its own networks are secure. If Einstein is free, then companies might use it. But that’s about as far as that goes.

Other stuff:

“the vast majority of vulnerabilities, both client-side and server-side, are being sold for less than $5,000″

Point: “some of the most alluring approaches to assuring information security [and] why they fail to make a difference to regular users and businesses alike”

Counterpoint: “blaming security engineering for the impact of targeted attacks is a herring as red as they come”

OK, now VMs are totally safe! No need to worry about escape attacks or rootkits…but seriously, it’s good that not everyone takes hypervisor security for granted.

“there is now a significant body of work showing how to break conventional quantum cryptography systems based on various practical weaknesses in the way they are set up…while the known loopholes can be papered over, it’s the unknown ones that represent threats in the future…[researchers have shown that it's easy] with a little malicious intent to bend the assumptions behind perfect quantum cryptography.”

“[An IPv4 address space] black market already exists, albeit on a small scale…[currently] IPv4 addresses are still relatively easy to get…[some believe] that regional registries such as ARIN should head off a potentially deleterious black market by creating a “white market” with established rules for trading IPv4 addresses at market-established costs…But the opportunity to cleanly switch from IPv4 to IPv6 passed many years ago. The current transition strategy, called “dual stack,” requires businesses to remain connected to both IPv4 and IPv6 networks until most of the Internet gets to “the other side” — a process expected to take at least five years.”

“Frosted windows may never be private again”

“a fundamental limit to the level of privacy that is possible when social networks are mined for recommendations”

“The 605-page [NSA IAD] PDF document reads like a listing of the pros and cons for a huge array of defensive and counterintelligence approaches and technologies that an entity might adopt in defending its networks…[one] section delves into the challenges of attributing the true origin(s) of a computer network attack”

Cyberwings. That’ll raise morale. Or not.

Computer security on the Death Star was a joke

Cyberdeterrence through tattlling? This is ridiculous. Not bloody likely that will work against serious hackers. And not bloody likely that it would be done in cases where potentially state-sponsored hackers were caught.

Cybersecurity and National Policy

“It’s safe to say that when someone pays that much for a bug, they’re not going to tell the vendor to patch it.”

“Regulation is not the primary driver for new technology, new investment, or new training; the threats are”

Protecting Europe against large-scale cyber attacks

Would you have spotted this ATM skimmer?

DoE and power grid security

“[A researcher] gave a talk on his then current project to prove a certain OS kernel was secure…they hoped in two years to have a proof of the OS’s correctness. What struck me during his talk was he could write down on the board, a [formula that] captured the notion of data security: if a certain function f had this property, then he would be able to assert his OS could not leak any information…At the end of his talk I asked him if he wanted a proof now that his function f satisfied the formula. He looked at me puzzled, as did everyone else. He pointed out his f was defined by his OS, so how could I possibly prove it satisfied his formula—the f was thousands of lines of code. He added they were working hard on proving this formula, and hoped to have a full proof in the next 24 months…I walked to the board and wrote out a short set theory proof to back up my claim—any f had his property…I thought he would be shocked. I thought he might be upset, or even embarrassed his formula was meaningless. He was not at all. [He] just said they would have to find another formula to prove.”

“it’s possible to focus light through opaque materials and detect objects hidden behind them, provided you know enough about the material”