intern4tional

This is not the case. Probably more relevant is that there are dedicated AI / Cloud Computing meetups and groups in the Bellevue and Seattle area that employees of all the companies attend. This means that the people that do this research and build these products frequently chat with each other.

I know my counterparts at AWS as a result and as we are friends, I push for collaboration whenever opportunities arise. At least on the MS side of the house these sorts of outreach and collaborative projects are a ground up push.

I work part time as an adjunct at a local 4 year college in WA state and am paid a flat fee of $150 a student per class. For one of my higher level (400 level) courses, I have 4-5 students usually and prep work to keep the course current still requires at least 2-3 hours a week in addition to teaching class.

At the end of the day, I make less than minimum wage teaching these students. I'm lucky that I have another job that supports me.

Colleges and Universities are not lean organizations. My department has significant amounts of overhead - people that in some cases work full time doing administrivia or extra paperwork and they require a salary. The buildings and labs also require upkeep and technology has a fairly high turnover cost. Add in the racket that is software + books and things add up quickly.

I'd estimate that my department has almost a 1 to 1 back office staff to professor ratio - simply due to the lack of automation (and no desire to automate) many portions of the work that is done at the school. Many of the back office staff are full time and they receive a regular salary rather than a flat fee per student.

He's most likely referencing his next two lines down, "As part of Google's mandatory diversity training, one is presented with Google's internal research claiming that unconscious bias is real and measurable, and that diversity hiring yields both better individual and group performance. Google has a line which they feel is backed by research..." so he can't post that data publicly as it is Google's private research.

It doesn't mean it doesn't exist though, just that we won't get access to it.

Not really. Very few attacks dedicate enough effort to evasion or anti-forensics to be completely untraceable.

There are plenty of things that get reused such as public keys that can be reliably tied to a group. There are also many private indicators that are not released to the general public Discovering who funds that group or where they operate from can be tougher, but APT groups are trackable.

Why is the revenue generating argument weak? Even Kasperky who was unsure of the author is leaning towards it being NK.

Quoting you, "I'm just not sure how anyone could claim that an OS that updates without your permission, sends and stores your encryption keys, captures browser history and all keystrokes, etc is not considered malware."

I'm making that claim and I don't think you have a clue on how security works.

1. Transmitting encryption keys is something many people want as it removes the overhead of them having to manage them on their own. Businesses use this too (via the cloud) in many cases. As for doing it in the background - how else should it do it? Have a big flashy screen that will confuse the average user? This feature allows Microsoft to gradually raise the bar on its OS security and prevent data recovery from physically stolen devices; while still allowing the user to recover their data if they lock themselves out.

2. The cost comparison is valid. Disk is cheap, and key management should be (this I don't know) automated. Microsoft stores tons of data already (all major software vendors do).

3. Windows Updates should trend towards automation frankly for the consumer versions of the product. Those versions don't have sufficient security features to not get updated.

4. No PII is sent with the core dumps; it's debugging information and helps make the product more secure - that's kind of something you want right?

5. The NSA key is a known falsehood. I'm not even going to bother to address it.

I'm honestly not sure if you're a troll or a rabid conspiracy theorist at this point.

Bullshit.

I'm going to address your specific link.

Microsoft has different classes of customers and the functionality that you don't want, many customers request and may even require. You aren't obligated to use their disk encryption or functionality. You can install your own WDE product, but you appear to want the features of a Ferrari for the price of a Ford Focus, which is not reasonable.

Microsoft is not trying to mess with your system via that method. If anything, that is a blanket improvement prior by default there was no encryption. Could the design be made better? Maybe, with any implementation of a security feature there are always trade-offs. Microsoft could force users to store the key locally or print it, but then millions of people would simply turn encryption off or lose their key. This does not grant MS remote access to your system.

There are plenty of things that are wrong with MS, but saying Windows is malware is FUD plain and simple.

Oh come on, this is stretching the accepting definition of malware a mile and then some.

This is FUD plain and simple without facts to back it up.

Microsoft releasing details of vulnerabilities in advance to premier customers is not something new. All software companies have that practice and we have seen it happen with recent OpenSSL vulnerabilities when CloudFlare has been given advance notice.

I haven't looked at it in years, but that hodge-podge of material was more than enough to provide an executive with the basics that they needed to know to manage an IS organization which IMO is the goal of the certificate. As others have mentioned, it is a management cert, not one for normal use.

There are plenty of worse certificates out there - I would argue that the CEH is probably the worst one at the moment (although they are making some changes to improve)

Well then your exposure is limited. Boeing's corporate information security organization has around that number, as do several of the other major defense contractors.

At least with Windows, UAC isn't considered a security boundary by Microsoft, it's more of a generic item there to make users aware that the software they are going to run is asking for special permissions.

That's an impressive resume of roles, but security is more than just those areas.

I think the grandparent is trying to say that the CISSP is largely for non-technical security roles. People that manage large security organizations are generally believed to be the ones that benefit from the CISSP as they are not interested in the details and more on a 1000 foot strategic view.

Without knowing more details about the your specific expertise, I would say you probably haven't been in a role that would benefit from the CISSP by just looking at your list. If you've been the CISO for a large company with 400+ people reporting to you doing IS work, having a CISSP should at least help you prioritize the work that needs to be done. Likewise for many companies that have non-technical management in security organizations, a CISSP helps provide some background for them.

IMO only the last of the three flaws is something that would be practically exploitable by a burglar. The rest, while poor coding practices and do illustrate some flaws with the system are not likely that a burglar would exploit.

This is FUD causing article.

No one is saying that effective mentoring cannot take place over the internet; the statement is simply being made that it is much easier to do in person.

Less tooling may be required, less time invested, etc. to have effective mentoring happen when you are in person.

My experience has been the opposite of yours.

I worked on a remote team for several years and recently migrated to an in the office job in a similar line of employment and was surprised how often such things occur. In your case it may either be that your work does not lend itself to such activities or you are potentially unaware that they are occurring.

Slack is poor replacement for face to face. It is good for communication for many types of projects and teams, but it cannot convey a person's facial expressions or emotions that otherwise might be present in their voice. My current organization, while onsite, has teams spread across the globe that we interact with. Attempting to solve complex engineering problems via email and chat is doable, but takes longer than throwing a couple of the engineers in a room with a whiteboard (and so the company pays for travel when that is needed).

In my experience, remote work is very situational. Certain jobs, tasks, and teams will lend themselves to remote work, but those items are not the majority of work yet.

This isn't really a problem with MailChimp, it's with their customers using weak forms of authentication and a few accounts were compromised. MailChimp has 2FA available and this should encourage users to adopt it.

Any mass emailing service would be targeted for something like this. IMO, not news.

Not the grandparent, but I think the issue is that people want clients to have an uptime that is comparable to a server.

Windows Server has controllable updates and reboots. Win 10 - is a client OS and wasn't designed with the same level of hardening and shouldn't have the same uptime requirements.

The challenge is convincing the general public of this; people want a Ford Fiesta with the speed and features of a Audi R8, meaning they want the best of all worlds at reasonable cost and no penalties.

By forcing updates on clients, MS has eliminated a generation of machines being owned by various botnets. They've also made it relatively cheap to get a server in Azure should you have a temporary need for uptime (like a research project for a week).

That aside, some portions of those updates are bad (like removing functionality, pushing telemetry, etc), but the overall strategy of auto updating isn't a bad idea if they can convince people to adjust to it and use Server when they need stability.

I don't think criminals are stupid; they're simply lazy. They put the minimum amount of effort is into a scam like this in order to make it profitable.

An off the shelf key logger is used; a couple of stolen email accounts, and a spammer is used for delivery. There are automated tools that will pack the key logger executable in a word document also.

As for the part of the security researcher; reversing .net code isn't challenging. This is by design - the framework does not obfuscate or make it challenging to look at the code. The author of the key logger could have built in protections or obfuscated his executable but for one reason or another has not.

Most likely all of the reversing or analysis was also done with automated tools, and the analyst simply had to run them. OfficeMalScanner can be used to locate packed executables in MS documents and extract them, and then it is simply a matter of dumping the binary in the .NET decompiler of your choice (the author uses ILSpy, I personally prefer RedGate Reflector) and looking at the code.

IMO this is a marketing piece that happens to have an interesting story attached to it.

While the items noted in the article could cause disruption, pain, or confusion to the community for some time, none of them really seem to be a linchpin that will actually bring down Bitcoin.

Social, strategic, and unconventional attacks can and do work against a technical or online community, but they need to be modified to account for the countermeasures the community will put in place.

Lastly, while the author has interesting experience, that doesn't make it relevant to bitcoin. A former employer of mine once hired a former secret services person to run and manage a red team. He was great with physical security, but didn't understand the technical layer and so a lot of his efforts went no where.

I've seen this same thing frequently when evaluating security engineers. They often can talk the talk, but when given a simple task to perform more often than not will fail.

Coding exercises might not be a great measure, but as far as I have experienced, they are better than other items out there.