Stories
Slash Boxes
Comments

SoylentNews is people

Log In

Log In

Create Account  |  Retrieve Password


Site News

Join our Folding@Home team:
Main F@H site
Our team page


Funding Goal
For 6-month period:
2022-07-01 to 2022-12-31
(All amounts are estimated)
Base Goal:
$3500.00

Currently:
$438.92

12.5%

Covers transactions:
2022-07-02 10:17:28 ..
2022-10-05 12:33:58 UTC
(SPIDs: [1838..1866])
Last Update:
2022-10-05 14:04:11 UTC --fnord666

Support us: Subscribe Here
and buy SoylentNews Swag


We always have a place for talented people, visit the Get Involved section on the wiki to see how you can make SoylentNews better.

What is your favorite keyboard trait?

  • QWERTY
  • AZERTY
  • Silent (sounds)
  • Clicky sounds
  • Thocky sounds
  • The pretty colored lights
  • I use Braille you insensitive clod
  • Other (please specify in comments)

[ Results | Polls ]
Comments:63 | Votes:109

posted by cmn32480 on Thursday August 11 2016, @10:48PM   Printer-friendly
from the addiction-of-their-own dept.

USA Today reports that Drug Enforcement Administration agents regularly mine Americans' travel information in order to seize hundreds of millions of dollars of cash:

Federal drug agents regularly mine Americans' travel information to profile people who might be ferrying money for narcotics traffickers — though they almost never use what they learn to make arrests or build criminal cases.

[...] It is a lucrative endeavor, and one that remains largely unknown outside the drug agency. DEA units assigned to patrol 15 of the nation's busiest airports seized more than $209 million in cash from at least 5,200 people over the past decade after concluding the money was linked to drug trafficking, according to Justice Department records. Most of the money was passed on to local police departments that lend officers to assist the drug agency.

"They count on this as part of the budget," said Louis Weiss, a former supervisor of the DEA group assigned to Hartsfield-Jackson Atlanta International Airport. "Basically, you've got to feed the monster." In most cases, records show the agents gave the suspected couriers a receipt for the cash — sometimes totaling $50,000 or more, stuffed into suitcases or socks — and sent them on their way without ever charging them with a crime.

[...] USA Today identified 87 cases in recent years in which the Justice Department went to federal court to seize cash from travelers after agents said they had been tipped off to a suspicious itinerary. Those cases likely represent only a small fraction of the instances in which agents have stopped travelers or seized cash based on their travel patterns, because few such encounters ever make it to court. Those cases nonetheless offer evidence of the program's sweep. Filings show agents were able to profile passengers on Amtrak and nearly every major U.S. airline, often without the companies' consent. "We won't release that information without a subpoena," American Airlines spokesman Ross Feinstein said.

[...] Agents seized $25,000 from Christelle Tillerson's suitcase in 2014 as she was waiting to board a flight from Detroit to Chicago. [...] Tillerson told the agents that her boyfriend had withdrawn the money from his U.S. Postal Service retirement account so that she could buy a truck, according to court records. Agents were suspicious; Tillerson was an ex-convict, who had spent time in prison for driving a load of marijuana into the United States from Mexico. She seemed to have little money of her own. And a police dog smelled drugs on the cash.

Agents seized the money, and let Tillerson go. Her lawyer, Cyril Hall, said she was never arrested, or even questioned about whether she could give agents information about traffickers. A year and a half later — after she produced paperwork showing that much of the money had indeed come from her boyfriend's retirement fund — the Justice Department agreed to return the money, minus $4,000. A spokeswoman for the U.S. Attorney's office in Detroit, Gina Balaya, said prosecutors concluded that "a small percentage of the funds should be forfeited."


Original Submission

posted by n1 on Thursday August 11 2016, @08:56PM   Printer-friendly
from the cash-prizes-to-be-won dept.

Last week Apple made its belated entrance into the bug bounty market, announcing a top award of $200,000 for major flaws in iOS, but Cook & Co have been comprehensively outbid.

On Tuesday, exploit trading firm Exodus Intelligence said it is willing to pay $500,000 for a major flaw in iOS 9.3 and above – and the exploit to use it. Researchers can either take a lump sum or accept a smaller sum and quarterly payments until the exploit is found, which the company's founder told The Reg could add up to even more.

"The majority of our clients are defensive vendors, penetration testers, and red/blue teams," said Logan Brown, president of Exodus.

Apple exploits get the highest reward, reflective of their scarcity. Microsoft and Google's bug bounty programs will also need to up their rewards to match Exodus's prices.

[...] Security experts are worried that the hoarding of serious flaws will have a deleterious effect on overall security for everyone. Exodus attempted to reassure people on this front by beginning a vulnerability disclosure process back in February, but it only discloses after it has extracted the "maximum value for our customers."


Original Submission

posted by janrinok on Thursday August 11 2016, @07:21PM   Printer-friendly
from the blame-the-bogey-man dept.

Australian Census Attacked by Hackers

The Australian census website was shut down by what authorities said was a series of deliberate attacks from overseas hackers.

Millions of Australians were prevented from taking part in the national survey on Tuesday night. The Australian Bureau of Statistics (ABS) had boasted only hours before that its website would not crash.

The prime minister assured the public that their personal information was not compromised. Debate about privacy concerns has been raised despite assurances from the government that security would not be compromised. Prime Minister Malcolm Turnbull said that public's personal information was safe and and stressed the "unblemished record" of the ABS.

"The one thing that is absolutely crystal clear is that there was no penetration of the ABS website," Mr Turnbull said.

"What you saw was the denial of service attack or a denial of service attempt which, as you know, is designed to prevent access to a website as opposed to getting into the server behind it. Some of those defences failed, frankly."

[Continues...]

However:

The comments contradict earlier comments issued by the ABS which stated that there were four "attacks". The opposition party called for Mr McCormack to resign over the website crash.

"This has been the worst run census in Australian history," said Andrew Leigh, the assistant shadow treasurer. "If we don't get an accurate snapshot on census night, we can't allocate resources properly."

The ABS is now working with authorities to determine the source of the "denial of service" attacks. "The Australian Signals Directorate are investigating, but they did note that it was very difficult to source the attack," chief statistician David Kalisch told the ABC. "The scale of the attack, it was quite clear it was malicious.

[...] In the lead-up to the census, crossbench Senator Nick Xenophon's concerns about privacy were dismissed by the government as "tinfoil hat" politics.

He said it wasn't clear who should be wearing the hat now.

"Look, there are real concerns," Mr Xenophon said. "The census, the ABS, has had five years to get this right." After weeks of reminders to "get online August 9", millions of Australians were frustrated to find they could not complete the survey.

Thousands of people poked fun at the situation on social media with references to the popular television shows including The IT Crowd, The Simpsons and Monty Python.

All of this is somewhat contradicted by IT Security specialists around the world who cannot find evidence of a DDOS having taken place, as described in the next piece:

Networking Wonks Can't Find the DDOS Claimed to Cause #Censusfail

The failure of the Australian census seems to be a failure of planning.

The Federal Government is blaming a distributed denial of service attack (DDoS) and an abundance of caution for sending the once-every-five-years Antipodean citizen survey into a grinding halt beginning last night and continuing as of the time of writing.

Yet your correspondent would hazard should the question of 'what will bring down the Census' be asked on Family Feud, the top scoring answer would be a DDoS attack. So how is it that the world's most boring attack vector was able to crush a multi-million dollar Federal Government operation some five years in the planning?

Multiple prominent networking and security people The Register has spoken to have not seen evidence of a large DDoS attack.

That does not mean the attack did not happen, or that apparent woeful internal technical failures were solely to blame, and the Government has lied about the cause of the outage.

Skeeve Stevens, founder of peering provider eintellego Networks, is one of many in the telco community who has not seen evidence of a large flood capable of taking down Census assets. ("Although I could have taken it out in the blink of an eye," Stevens reckons.) Distributed denial of service attack mitigation company Arbor has not seen attack traffic either. Nor have other networking and security specialists at rival global DDoS attack mitigation companies. Some of these folks strongly question whether there was a DDoS at all.

Arbor reckons DDoS mitigation and best practice infrastructure should have punted the attackers, had it been in place. It is not known if DDoS mitigation was used, or indeed what any controls were in place, other than a geo-IP blocker that failed and let in bad traffic from the United States, so says the Government.

And that bring us to the central question; how is it that an attack vector any internet idiot can pull off with DDoS booter services was able to best the Federal Government and its AU$9.6m Census contractor IBM?

[...] So it was obvious a DDoS attack on Tuesday night would be a likely event.

And with Prime Minister Malcolm Turnbull losing the day's media cycle, losing public confidence in government cyber security, and losing progress towards national e-voting in Australia, you can bet he will asking them. ®


Original Submission #1Original Submission #2

posted by martyb on Thursday August 11 2016, @05:49PM   Printer-friendly
from the about-headlines:-don't-use-no-double-negatives dept.

The Register has a story about a court ruling that possibly puts one nail in the coffin of the attempt by the FCC (Federal Communications Commission) to prevent states from banning municipal ISPs.

The Sixth Circuit Court of Appeals said on Wednesday [PDF] that the American regulator lacks the authority to overrule state laws that prevent cities from operating their own ISPs.

Last year, the watchdog declared it was unfair of North Carolina and Tennessee to block community-run broadband. Now an appeals court has said the FCC overstepped the mark by trying to undo that block with a preemptive order. In other words, in this case, the US states can't be pushed around and overruled by the communications regulator as it lacks the clear authority to do so.

"This preemption by the FCC of the allocation of power between a state and its subdivisions requires at least a clear statement in the authorizing federal legislation," the judges noted.

"The FCC relies upon S706 of the Telecommunications Act of 1996 for the authority to preempt in this case, but that statute falls far short of such a clear statement. The preemption order must accordingly be reversed."

We obviously have not seen the last of this, especially since the amateur lawyer in me believes the court decision was in error.


Original Submission

posted by martyb on Thursday August 11 2016, @04:16PM   Printer-friendly
from the "Here-be-dragons" dept.

Google has been accused of deleting Palestine from Google Maps – but the truth is, it was never labelled by Google in the first place.

When searching for Palestine on Google Maps, it shows an outline, but with no label for Palestine and Israel labelled alongside it. While 136 members of the United Nations recognise Palestine as an independent state, the US and much of the west does not.

[...] A Google spokeswoman said: "There has never been a 'Palestine' label on Google Maps, however we discovered a bug that removed the labels for 'West Bank' and 'Gaza Strip'. We're working quickly to bring these labels back to the area."

[...] A 2014 project called Disputed Territories documented how Google Maps attempts to stay out of geographical disputes and issues of national identity.

For example: users in Russia see a solid boundary line around Russia and Crimea. Outside of Russia, Crimea is surrounded by dashed lines, indicating it as occupied territory.

Source: The Guardian


Original Submission

posted by martyb on Thursday August 11 2016, @02:44PM   Printer-friendly
from the Note-to-self:-do-NOT-overcharge-the-Tesla dept.

An Anonymous Coward writes:

The Formula Student Germany competition includes both combustion and electric classes, small cars built by engineering students around the world. Their press release https://www.formulastudent.de/press-pr/news/news-details/article/incident-at-hotel-in-hockenheim/ says,

Yesterday a battery pack of one of the registered teams for FSG 2016 caught fire in a hotel room in Hockenheim. The incident injured 4 of the team members that were treated in hospital. 3 were released later during the day whereas one of the team members is still in treatment with burn injuries.

The fire substantially damaged the building and a part of the hotel had to be closed. The fire and the incident overall have been handled by the local fire department, ambulance service and police.

A local paper (in German) also has a story with photo of the burned out room, http://www.heidelberg24.de/region/hockenheim-zimmer-hotel-karlsruher-strasse-ausgebrannt-drei-verletzte-6649509.html
Google Translates at https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=http%3A%2F%2Fwww.heidelberg24.de%2Fregion%2Fhockenheim-zimmer-hotel-karlsruher-strasse-ausgebrannt-drei-verletzte-6649509.html&edit-text=

Three hotel guests - members of a Chinese student group, the participants of the event Formula Student [strike]are probably[/strike] at the Hockenheimring - brought with suspected smoke inhalation in a hospital.

The cause of the fire and the amount of damage is not yet known. It remains unclear even if the occupied hotel can be based again on the same day.

Battery packs for these cars are typically in the range of 5kWh, for example see this student paper, http://dspace.mit.edu/bitstream/handle/1721.1/83741/864601926-MIT.pdf?sequence=2 (from MIT, not the same team involved in the fire).


Original Submission

posted by martyb on Thursday August 11 2016, @01:09PM   Printer-friendly
from the what-you-lookin-at? dept.

http://motherboard.vice.com/read/heres-the-internal-presentation-the-fbi-uses-to-train-surveillance-pilots

A presentation released to Motherboard under the Freedom of Information Act details how the FBI briefed pilots and agents about its aviation programs.

The "Indoctrination to Bureau Aircraft Operations" presentation comes in three parts, and is dated April 2009. Across over 330 pages, the Field Flight Operations Unit spells out a wealth of legal, technical, and safety issues for operating aircraft on FBI missions.

[...] "Put simply, you can't look through walls of a home without a search warrant," the presentation neatly summarizes. This is the same advice given to agents by a separate FBI presentation on drone use.

The three parts of the "Indoctrination to Bureau Aircraft Operations" are available on documentcloud: Part #1, Part #2, and Part #3.


Original Submission

posted by martyb on Thursday August 11 2016, @11:32AM   Printer-friendly
from the TLA++ dept.

Forget the 60 TB SSD. Toshiba is teasing a possible 100 TB SSD:

The Flash Memory Summit saw Toshiba deliver a presentation about quad level cell (QLC) technology – adding substantially to the prospect of a product being delivered in the "near future". We have heard about this QLC (4bits/cell NAND technology) quite recently.

After Seagate tantalised us with a 60TB SSD, along comes Toshiba with a 100TB QLC SSD concept.

Flash Memory Summit attendees saw Toshiba presenters put flesh on the bones and envisage a QLC 3D SSD with a PCIe gen 3 interface and more than 100TB of capacity. It would have 3GB/sec sequential read bandwidth and 1GB/sec sequential write bandwidth. It would do random reading and writing at 50,000 and 14,000 IOPS respectively. The active state power consumption would be 9 watts, the same as a 3.5-inch, 8TB SATA 6Gbit/s disk drive, while the idle power consumption be less than 100 mWatts, compared to the disk drive's 8 watts.

Even if the "near future" isn't so near, or the final capacity does not end up at around 100 TB, it is still interesting to see 3D NAND technology enabling a serious push for 4-bits-per-cell NAND, which would normally face endurance issues.


Original Submission

posted by n1 on Thursday August 11 2016, @09:58AM   Printer-friendly
from the enhanced-reality dept.

Scientists have found a way to increase the duration of DMT hallucinogenic experiences:

Known in drug lore as "the businessman's trip" for its lunch-break-size 15-minute duration, DMT (N,N-dimethyltryptamine) is infamous for blasting its users into vivid alien worlds. It's among the most literally hallucinogenic of all the psychedelics, and now a pair of veteran researchers have proposed a method to safely extend the experience beyond its normal length. Dr. Rick Strassman and Dr. Andrew Gallimore published their paper in Frontiers in Psychology last month, under the name "A Model for the Application of Target-Controlled Intravenous Infusion for a Prolonged Immersive DMT Psychedelic Experience." Its implications could turn DMT research on its head, allowing for new scientific (and potentially medical) insights into the principle ingredient in ayahuasca. Using techniques borrowed from anesthesiology, the method will regulate the amount of DMT in the body and, more important, the brain. Though still untested on no-doubt-willing psychonauts, Strassman and Gallimore's technology is all but ready for assembly.

Strassman, author of DMT: The Spirit Molecule (2001) and DMT and the Soul of Prophecy (2014) and perhaps the world's foremost clinical DMT researcher, argues the substance provides access to what users experience as mystical states, comparable to those described in the Hebrew Bible. Gallimore, a computational neurobiologist, is also a historical scholar of DMT. His overview "DMT Research from 1956 to the Edge of Time" recounts a wide range of possibilities researchers have offered over the years (including the notion that DMT is a doorway into an alternate universe). Other theories involve its role in human brain at the time of death, as well as countless South American beliefs inseparable from ayahuasca and DMT snuff traditions. But perhaps the only universal experience of smoked DMT is its brevity.

A Model for the Application of Target-Controlled Intravenous Infusion for a Prolonged Immersive DMT Psychedelic Experience (open, DOI: 10.3389/fphar.2016.00211)

[Continues...]

From the abstract:

Using pharmacokinetic modeling and DMT blood sampling data, we demonstrate that the unique pharmacological characteristics of DMT, which also include a rapid onset and lack of acute tolerance to its subjective effects, make it amenable to administration by target-controlled intravenous infusion. This is a technology developed to maintain a stable brain concentration of anesthetic drugs during surgery. Simulations of our model demonstrate that this approach will allow research subjects to be induced into a stable and prolonged DMT experience, making it possible to carefully observe its psychological contents, and provide more extensive accounts for subsequent analyses. This model would also be valuable in performing functional neuroimaging, where subjects are required to remain under the influence of the drug for extended periods. Finally, target-controlled intravenous infusion of DMT may aid the development of unique psychotherapeutic applications of this psychedelic agent.


Original Submission

posted by n1 on Thursday August 11 2016, @08:22AM   Printer-friendly
from the welcome-to-the-club dept.

Resistance, as they say, is futile. According to the Google Transparency Project, and reported by watchdog.org "More than 250 people have moved from Google and related firms to the federal government or vice versa since President Barack Obama took office."

22 former White House officials went to work for Google and 31 executives from Google and related firms went to work at the White House or were appointed to federal advisory boards by Obama. Those boards include the President's Council on Science and Technology and the President's Council on Jobs and Competitiveness.

Of additional interest, besides revolving doors between Google and the FCC, 25 officials in national security, intelligence or the Department of Defense joined Google, and three Google executives went to work for the DOD.

I think ordinary discussion of market forces, laissez-faire and the role of Government is irrelevant in regards to a system in which this is normal and institutionalized practice.


Original Submission

posted by n1 on Thursday August 11 2016, @06:42AM   Printer-friendly
from the nothing-to-hide,-everything-to-fear dept.

Thailand is considering a proposal to track the location of all SIM cards acquired by foreigners, be they tourists or resident aliens.

The plan's been floated as a way to assist law enforcement agencies combat trans-national crime. Thailand borders Cambodia, Laos and Burma, three nations that have reasonably porous borders, seldom score well on measures of incorruptibility or governance and have form as participants in heroin supply chains.

[...] The good news is that if your phone roams, you'll be exempt. And with roaming plans now catering to travellers there's a good chance you can bring your phone to Phuket without taking a bath on roaming charges.

Resident aliens will be moved to the trackable SIMs. Many such folk move to Thailand to invest or bring expertise to the nation and are unlikely to be happy that their every move is observed. One small upside is that the nation's telecoms regulators aren't entirely sure how to make the tracking work, with cell connection data and GPS both under consideration.


Original Submission

posted by n1 on Thursday August 11 2016, @05:05AM   Printer-friendly
from the it-was-some-puerto-rican-guy dept.

WikiLeaks has announced a $20,000 bounty for information leading to a conviction in the case of a murdered Democratic National Committee staffer:

The speculation started within days of Seth Rich being gunned down in what D.C. police believe was an attempted robbery near his townhouse in the Bloomingdale neighborhood of Northwest Washington.

Some on the Internet wondered if Rich was killed because of his work as a staffer with the Democratic National Committee, even suggesting he had handed WikiLeaks the 20,000 emails that embarrassed the DNC and forced the ouster of its chairwoman. Others suggested he was helping the FBI expose wrongdoing in the presidential election, and that made him a target.

On Tuesday, WikiLeaks shoved those conspiracy theories into the mainstream when it announced on Twitter a $20,000 reward for information leading to a conviction in Rich's killing on July 10 in the 2100 block of Flagler Place NW. It adds to a $25,000 reward offered by D.C. police, customary in all District homicides.

Julian Assange maintains that the organization does not reveal its sources, even after their deaths:

Speaking to Dutch television program Nieuswsuur Tuesday after earlier announcing a $20,000 reward for information leading to the arrest of Seth Rich's killer, Assange said the July 10 murder of Rich in Northwest Washington was an example of the risk leakers undertake. "Whistle-blowers go to significant efforts to get us material and often very significant risks," Assange said. "As a 27-year-old, works for the DNC, was shot in the back, murdered just a few weeks ago for unknown reasons as he was walking down the street in Washington."

When the interviewer interjected that the murder may have been a robbery, Assange pushed back. "No," he said. "There's no finding. So... I'm suggesting that our sources take risks." When pressed as to whether Rich was, in fact, the leaker, Assange stated that the organization does not reveal its sources.

Also at Slate and WAMU.


Original Submission

posted by janrinok on Thursday August 11 2016, @02:52AM   Printer-friendly

Moon or Mars? It isn't a mutually exclusive choice but we'd be idiots to ignore the ideal staging post.

NASA engineer, Wingo, makes a detailed, costed argument that the current best-of-breed technology should be directed to the Moon. Specifically, the Saturn program should be continued in preference to SLS. The reason is quite simple. With advances in manufacturing, materials and guidance systems, a known quantity with known corner cases can be made safer and cheaper. (It would also avoid launchpad upgrades and other superfluous costs.)

As a matter of international co-operation, this could be augmented with Russian technology and suchlike. Yes, redundant airlocks or airlock adaptors may be required. However, does it really matter if a substantial structure requires seven payloads or eight payloads? From our current position eight is cheaper and more certain even if seven would be better in the long-term.

What would this structure be? A waystation in high Earth orbit for fueling and crew transfers. Fueling of what? Initially, craft to bootstrap a permanent base on the Moon with solar and nuclear power. Fueling is also needed until there is sufficient infrastructure on the Moon to produce fuel locally. Even then, fuel is required in high Earth orbit for emergencies. Overall, this is a plan to go from zero presence to an economic break-even point and beyond.

[Continues...]

A mineral mining expedition to the Moon has an estimated ROI of 22 years. More worryingly, the total cost is dwarfed by student loans, mortgage fraud and bank bail-outs - and that's just counting US figures. That's the most damning part. If we never get off Earth it will be due to the soul-sucking 1%ers and the legions of B-Ark space-cadets. On that basis, we deserve to not get anywhere.

Admittedly, figures for mineral mining assume that a glut in the market won't cause a price crash. There is a certain irony that a mining expedition to the Moon may never be economically feasible if it makes resources too plentiful. But seriously, that is a risk worth taking because it provides opportunity to move the majority of heavy industry outside of the biosphere. Even ignoring this, it would be possible to drop titanium airships into the atmosphere with a cargo of tritium from the Moon's South Pole. Or lithium. Or neodymium. Do you think there's enough lithium or neodymium for everyone to have an electric car? There is if we mine the Moon. (Or maybe that's why we don't go? Would we use the resources sensibly prior to mass population reduction and careful management of MTE?)

The typesetting is a bit dodgy but the message is clear. Until transport to the Moon becomes routine, human missions further afield are a work of speculative fiction. Actually, there comes a point when sending robotic probes further into the solar system becomes cheaper when sent from the Moon. And that's the point where we should seriously consider further expansion. Not before.


Original Submission

posted by janrinok on Thursday August 11 2016, @01:20AM   Printer-friendly
from the undampened-enthusiasm dept.

Creative meth makers set up underground in Buffalo NY suburbs, http://live.buffalonews.com/2016/08/09/see-inside-the-subterranean-entrance-to-the-amherst-meth-lab/

It had to be one of the oddest crime scenes in recent memory: a subterranean drug lab, 12 feet underneath a Walmart parking lot at Sheridan Drive and Bailey Avenue in Amherst, that was being used to cook methamphetamine.

As cars whizzed by on Sheridan, one of the busiest thoroughfares in the region, and shoppers pulled in and out of the sprawling lot to stock up on groceries and other necessities of daily life, police say someone had set up a rather elaborate meth lab.

The photos show the sewer entrance with stagnant water at the end of a concrete tunnel, perhaps 10 feet wide, 4 feet high. Another shot inside shows the ceiling about 6 feet (1.8m) high. Pallets were dragged into the sewer to keep the "lab" above the small amount of water on the floor. With record-setting drought in the Buffalo area, there hasn't been any chance of a storm surge.


Original Submission

posted by martyb on Wednesday August 10 2016, @11:51PM   Printer-friendly
from the key-mistake dept.

Microsoft leaked the golden keys that unlock Windows-powered tablets, phones and other devices sealed by Secure Boot – and is now scrambling to undo the blunder.

These skeleton keys can be used to install non-Redmond operating systems on locked-down computers. In other words, on devices that do not allow you to disable Secure Boot even if you have administrator rights – such as ARM-based Windows RT tablets – it is now possible to sidestep this block and run, say, GNU/Linux or Android.

What's more, it is believed it will be impossible for Microsoft to fully revoke the leaked keys.

And perhaps most importantly: it is a reminder that demands by politicians and crimefighters for special keys, which can be used by investigators to unlock devices in criminal cases, will inevitably jeopardize the security of everyone.

Microsoft's misstep was uncovered by two researchers, MY123 and Slipstream, who documented their findings here in a demoscene-themed writeup published on Tuesday. Slip believes Microsoft will find it impossible to undo its leak.

[Continues...]

[...] People are particularly keen to unlock their ARM-powered Surface fondleslabs and install a new operating system because Microsoft has all but abandoned the platform. Windows RT is essentially Windows 8.x ported to 32-bit ARMv7-compatible processors, and Microsoft has stopped developing it. Mainstream support for Surface RT tabs runs out in 2017 and Windows RT 8.1 in 2018.

A policy similar to the leaked debug-mode policy can be used to unlock Windows Phone handsets, too, so alternative operating systems can be installed. A policy provision tool for Windows Phone is already available. We expect to hear more about that soon.

[...] The Secure Boot policies Microsoft is rushing to revoke can't be used to backdoor conversations or remotely hijack systems, but they remind us that this kind of information rarely stays secret.

"This is a perfect real world example about why your idea of backdooring cryptosystems with a 'secure golden key' is very bad," Slipstream wrote, addressing the FBI in particular.

"Smarter people than me have been telling this to you for so long. It seems you have your fingers in your ears. You seriously don't understand still? Microsoft implemented a 'secure golden key' system. And the golden keys got released by Microsoft's own stupidity. Now, what happens if you tell everyone to make a 'secure golden key' system?"

The article goes into considerable background on the leaked keys and how you can use them to circumvent Secure Boot. Happy hacking to anyone who has (or can get a good deal on) a Windows RT tablet!


Original Submission