#cause dn has been adapted..quite a few times

[oreolesbian]

the duffer brothers…want to make (yet another!) live-action death note…for the love of god leave that series alone 😭

[bestaccountinghelp]

How to Fix QuickBooks Error H505 Easily?

QuickBooks Desktop is one of the most mainstream privately introduced bookkeeping software arrangements utilized by organizations, bookkeepers, and business people. The software is ground-breaking with a scope of highlights and administrations. The drawback of the nearby establishment model is that the product is defenseless against blunders that must be settled by the end-clients. These blunders are principally caused because of design issues. QuickBooks Error 505 is one such issue a QuickBooks Desktop client may experience. In this blog, we will research the insights concerning QuickBooks Error H505, its causes, side effects and the means to determine the mistake. 

For what reason Do I See QuickBooks Error 505?

The most regular appearance of QuickBooks Error H505 is when clients attempt to switch between single-user and multi-user mode on QuickBooks Desktop and the application can't set up an association with the server. There can be just a single system that goes about as the server facilitating QuickBooks company file in the multi-user mode. Users attempting to get to QuickBooks company file on the server may see the mistake either when the host isn't arranged appropriately or because of system issues. The following are a few factors that could bring about the issue.

Mistaken or harmed. ND files.

QuickBooksDBXX and QBCFMonitor services are not working.

Failure to discover the server IP address.

Inappropriate facilitating setup.

Host mode killed on the server.

Broken firewall settings setup.

Issues with DNS settings.

How to Identify QuickBooks Error Code H505?

Aside from the error message that is shown alongside the error code in a spring up a message box, users may encounter the accompanying side effects when they experience QuickBooks Error 505.

Failure to work in multi-user mode.

I can’t open the QuickBooks company file on the server.

QuickBooks application may crash.

Every single open window and information techniques may get inert.

The application may freeze for the long term before tossing an error message.

What to Do to Fix QuickBooks Error H505?

QuickBooks Error H505 can be fixed by diagnosing and correcting issues that may be blocking multi-user association with the server facilitating the company files.

Follow the means beneath to distinguish potential causes and the vital strides to address them. These means are pertinent just in the event that you are facilitating QuickBooks on your own system where the QuickBooks Database Server Manager has been set up in the Server Only choice and the outputs don't uncover any issue. 

Stage 1: Ensure that there is just a single server with Multi-User Access

Recognize all PCs on the systems showing QuickBooks Error H505.

Guarantee that the alternative 'Host Multi-User Access' is accessible in the entirety of the PCs. On the off chance that there is a PC with the choice 'Quit Hosting Multi-User Access', click on it to incapacitate the element.

Continue to the server facilitating the QuickBooks company file and guarantee that it has the 'Host Multi-User Access' choice empowered. 

Stage 2: Replace Company File Folder

In the event that the server has been designed effectively, odds are, the issue is with the company file.

Make a new folder on the host PC and move the substance to it with full authorizations.

Make the .qbw file in the multi-user mode.

Check if the company file is open from all systems over the network.

Stage 3: Check Windows firewall setup

Firewall settings can regularly meddle with the file get to required for working QuickBooks in the multi-user mode. Follow the means beneath to deal with the firewall settings on the PC tossing the error.

Quest for Firewall Settings in the Control Panel. Explore to 'Permit a Program through Firewall.' Add QuickBooks to the list. Restart the PC to apply the changes.

On the off chance that the issue isn't in the firewall, check if the ports are designed accurately.

Click on the Advanced Settings in the Firewall Settings.

Include 'New Rule' in 'Outbound Rules' and 'Inbound Rules'.

Include the suitable local ports for QuickBooks Desktop.

Guarantee that Network Discovery is turned on.

Stage 4: Confirm if the services are running

Users can't get to files if the QuickBooks services are not working.

Guarantee that you discover the server name on every PC.

Info services.msc in the Run exchange box and open the Task Manager.

Click on Open Services and search for QuickbooksDBXX (where XX) indicates the QuickBooks Server Manager adaptation.

Double-tap the service name.

Select Automatic for the Startup type in Properties. Guarantee that the status of the service is either Started or Running.

Select Restart the Service for both First disappointments just as Second Failure and Subsequent disappointments in the Recovery tab.

Rehash the procedure for QBCFMonitorService.

Stage 5: Edit Windows host file

Since QuickBooks depends on Windows to work, there is a slim chance that making changes to the Windows file can help recoup from the error.

Utilize the Command Prompt on the server to execute the "ipconfig/all" order after you open Run on the server.

Open the Hosts file with Notepad from C:\Windows\System32\Drivers\Etc or C:\Windows\System32\Drivers\Etc relying on the Operating System variant.

Include all the IP locations of the PCs with QuickBooks Desktop establishment on the system.

A Better Solution for QuickBooks Errors

There are such a significant number of forerunners to QuickBooks Error H505 that it is practically unfeasible to analyze the issue rapidly with no personal time. The essential issue of introducing QuickBooks on a private system and permitting multi-user to get to is the multifaceted nature it involves. The subsequent choice of settling on QuickBooks Enterprise may be unreasonably costly for generally little and medium organizations. That leaves most users with the choice of QuickBooks facilitating. This is the most dependable alternative as organizations don't need to deal with the foundation prerequisites along these lines limiting the chance of such errors. The specialist organization will likewise have the option to give specialized help if need be.

If you still face issue then you should call QuickBook proadvisor or expert, they will provide you the best solutions for your error.

[samtheflamingomain]

welcome to death note, where the plot makes no sense and the rules don’t matter

Unless you've been living under a rock the past few months, you're aware that there's a live-action American Death Note movie on Netflix.

I wasn't going to watch it because I knew it would be bad and I am a MASSIVE DN fan. I didn't want it to ruin one of my favourite things.

While I wouldn't say it did that, I will say that it was, without exaggeration, the worst screen adaptation of anything I've ever seen.

I went in with low expectations and knowing they'd have to change the plot around to fit into 90 minutes. The bar was so low and yet they managed to disappoint me at every turn.

So let's get into the details. Spoilers ahead, but who cares this movie is garbage.

I'll break it down into several aspects: acting and characterization, pacing and plot, visuals and sound, and finally, the sheer amount of nonsense and bullshit this film vomited into my face.

Okay. I hated every single character's personality. NONE of the characters were even remotely similar to the characters in the manga/anime. Light is a stupid, naive teenager who thinks with his dick. Mi(s)a is a sociopathic, manipulative cunt, Light's father is EXTREMELY stupid, Ryuk is not a neutral character (which is extremely important), and, finally, L. Oh, lord, L.

L is a cold, detached, calculating super genius detective. In the original. In the movie, he's a ballsy, irrational, emotional mess who somehow knows how to drive and wield a gun - unthinkable of OG L.

And to touch briefly on the acting: Nat Wolff is the only one I really have a problem with. He wears a constant look of confusion the whole movie and acts like a troubled child, not like a fucking serial killer.

Now, to your immense surprise, there is one character that I found was nearly spot-on: Watari.

And finally, the movie lacked in sheer number of characters. The ones I listed are, quite literally, the only ones in the film who speak. I get it, they didn't have time to do the Near, Mello, Takada, or Mikami plots. But I guarentee this movie would've greatly benefited from a Matsuda character, a Rem character, and Light's mother and sister.

Onto pacing and plot.

Again, I know they only had 90 minutes, but within the first ten minutes, Light has the notebook and hooks up with someone he barely knows (Mia), shows her the notebook, and they’re instantly dating and having some creepy murder sex. Within the first 30 minutes, nearly everyone knows Light is Kira.

Now to the main problems with the plot itself: there is no reason to give Light more motive to become a killer. It's his personality and his worldly outlook that causes him to take up killing. In the movie, they sloppily throw in some bullshit about his mom being killed, but they don't make that the actual motivation for killing. How do we know this? Well...

In the movie, his first kill is a bully at school (something OG Light was smart enough to realize is fucking stupid) and when told to add a cause of death, he immediately jumps to "decapitation" - revealing instantly that he's a sick fuck. Sure, bullies suck, but do they deserve to be fucking decapitated? Light Yagami only killed actual criminals (until he has to kill people investigating him).

This might seem petty, but it's actually super important: Ryuk shows up before Light kills anyone. In the original, Light needed no prodding from a Death God to begin his murder spree. In the movie, it's Ryuk that goads him into his quest. This goes back to the fact that Ryuk is supposed to be neutral. It takes away Light's agency and makes it feel like Ryuk is controlling him.

L makes WAY too many guesses with little logic or evidence. It takes a lot longer for L to deduce Light is Kira in the original. Movie L makes some very uncharacteristic leaps of logic just for the sake of driving the movie on.

There's a scene pretty early on that mimics a similar scene in the original with Light and L sitting in a diner together. In the original, it’s not super important. Movie version involved L outright accusing him of being Kira on flimsy-at-best evidence, and then, in what might be the worst event in the movie, Light readily admits to being Kira and taunts him about not knowing how he kills.

After some bullshit about Light mind-controlling Watari (more on that later) to try and get L's name and Watari dies, L goes on a destructive car/foot chase with Light. In the original, it's important for L to figure out how Kira kills before killing him. This movie L doesn't seem to care about anything but revenge and being proven right.

I keep saying this, but another horribly-written thing happens that might be the worst part: L has Light cornered with a gun on him and someone randomly comes and knocks L over the back of the head, the very epitome of a Deus Ex Machina.

Then we get to the climax, which is an extremely long scene where Light and Mia hijack the Seattle ferris wheel, take it to the top and fight over who should own the book. They've both written each others' names down and the pages need to be burned by midnight if they want to live (groan, unnecessary race-against-time). They spend a good 5 minutes dangling from the wheel when RYUK causes it to collapse; something OG Ryuk would have NEVER EVER DONE, because, as the movie fails to explain, Ryuk’s motivation is supposed to be boredom. I’ll touch more on why this happens in a bit. Mia falls to her death, Light falls into the water, into a coma, and wakes up two days later.

Okay, now I do have to give the movie a bit of credit here: it seems at first like a bunch of ridiculous coincidences that lead to Light outliving Mia. Turns out he saw all this coming (somehow) and had quickly used the book to ensure that: the wheel collapses, Mia falls from the wheel and dies, the page with his name is burned so he will live, that he's rescued from the water after his fall, that he's in a coma but murders continue via a random criminal writing in the book before delivering it back to Light just as he wakes from the coma. I'll pick this part apart in a minute because there is just so much wrong with this sequence of events that I can’t even.

And finally, the ending, if you can call it that. The writers were VERY clearly trying to be clever and leave us with a cliffhanger.

L is "proven wrong" about Light being Kira because the murders continued while he was in a coma, and is supposed to go back to Japan, before he suddenly remembers that Mia has a page of the book at her house. He gets there and finds the page she used to kill invesigators behind Light's back. The movie ends with L, shaking in uncharacteristic anger, about to write Light's name. Fade to black.

Finally, one last thought on the plot before I touch on other elements: this is a terrible adaptation, but an even worse movie. As a stand-alone movie, viewers new to Death Note would no doubtedly leave feeling confused and like nothing important was said in the movie. It does nothing to touch on the ambiguity of Kira's actions vs. L's. It has no underlying takeaway besides "Hey look at this cool book!"

Okay, quick thoughts on visuals and sound. Visuals are great (minus whatever bullshit paper mache project that is Ryuk). They dont' shy away from gruesome depictions of murders. I'd cite the incredible series of events that lead to Kenny being decapitated as the best example.

Hated the audio. Random songs start playing where score would've been better.

Okay, now onto the nitty-gritty details that make this movie absolutely fall apart.

Most of them are to do with the mechanics of how the Death Note is supposed to work. The original only has one page of rules and no names in it yet. Movie Book has pages and pages of rules and names filled in. There are rules that don't exist in the original (like the burning of the page to save the life of the victim, the fact that Mia can't see Ryuk after touching the note*, and most deplorably, the rule about "must be physically possible" being shattered into pieces at every turn.

*When Light first shows Mia the book and has her touch it, he assumes she’ll be able to see Ryuk WITH NO REASON TO BELIEVE THIS. In the original, Ryuk has to tell Light about this rule. In the movie, Light GUESSES that that’s how it works. And he’s wrong: unlike the original where Mia would’ve seen Ryuk, Ryuk claims in the movie that only the owner of the book can see him - super convenient for Light, who walks around school with the book in full view.

But there's a lot of other bullshit that ruins this monstrosity. There's a turning point in the movie where Mia tries to convince Light to kill his own father. The prompting event doesn't happen in the original, but I have no doubt that OG Light would've killed him without hesitation, as he outright says in the original. Because OG Light would be smart enough to know that leaving his father alive in that situation would immediately implicate him.

Here's one of the worst offenses (again, I know): Light writes the name "Watari" in the book. And it works. Watari is not his real name, and even if it were, who only has one name?

L does the whole "taunting Kira to kill him on TV" as in the original, but this event leads him to the conclusion that Light needs a name and a face - something that makes absolutely no sense for him to instantly know after one test.

Now, about the ending sequence at the ferris wheel and the hospital. The police are chasing Light and Mia, the two threaten the wheel's operator with a gun to take them up. And then he's later "officially" exonerated because the murders continued while he was in a coma, but because Light killed his mother's killer, his father "knows” he's Kira, which, of course, Light admits. If he's "officially" not Kira, why did he run from the cops and hijack a ferris wheel? L knows the power of killing can be transferred to another, yet doesn't explain this fact to anyone when the killings continue during Light’s coma.

And the biggest shitshow of nonsense? The way Light kills Mia and ensures he lives and ends up with the book again. Waaay too much of it is contingent on luck, along with some great rule-breaking.

Light writes: Mia takes the book, the wheel collapses, she falls to her demise, and the page with his name on it is burned. That's not how it works. There cannot be a passive action in a Death Note murder. He would've had to write: Mia takes the book, burns Light's page, then falls to her demise.

He also writes that he himself falls but goes into a coma, set to wake up in two days. Also impossible. You can't create a sequence of events that affect someone other than the murder victim. And you especially can’t use it to (directly) save someone’s life.

Essentially, Light is writing things he'd like to happen in the book. It's a Death Note, not a Life Note, and certainly not a Wish Note.

He also writes that criminal number one retrieves him from the water and revives him. The criminal would have to know there's a kid in the water, where he is, and how to revive him. Possible, but not foolproof because of the "physically possible" rule. If dude didn't know CPR, Light would've died.

Then, he has criminal number two retrieve the Death Note and continue writing names in the book for the two days he's in the coma, and then return it to him in the hospital. This is less about "physically possible" and more about somehow being able to brainwash him. The events leading up to his death have to be something he could conceiveably do on his own. See also: the brainwashing of Watari.

Let me explain a bit more: in the original, Light experiments with the "physically possible" rule. In one test he writes: (criminal) draws a perfect likeness of L's face on his prison wall before dying. This isn't physically possible because the criminal doesn't know what L looks like, so it's inconcievable that he could, under any circumstance, draw L's face.

Similarly, there's no way that Watari would think of going back to the orphanage to get L's real name, nor is there a conceivable way that a criminal would think to go to Light's specific hospital room and leave him the book. It has to be something they could potentially think of themselves.

Now, I know these are a lot of extremely fine details, but to people who know how the book is supposed to work, it all looks messy and contrived.

Finally, let me leave you with one last gripe/thought. Death Note is an IP originating from Japan. I get that it's a purposely American adaptation meant for American audiences, but something in the movie happens that kind of pissed me off:

Light chooses the name Kira (instead of his fans choosing the name) largely because it means "killer" in Japan, then decides to try and throw people off his scent by focusing his murders in Japan. I have no doubt that this was meant to be a nod to its Japanese origins, but it comes off as... kind of like kicking the original when it's already down. You're taking a Japanese IP, taking it to America, then using Japan as a scapegoat for American Light. Maybe it's just me, but it really made me think, "Haven't they suffered enough just by the fact that this movie exists?"

I'm sure there's a bunch of stuff I've missed due to repressing the memory of ever seeing this terrible movie, but those are my major (and minor) problems with it.

Don't see it. It's bad.

And DEAR GOD, PLEASE DON'T MAKE A SEQUEL.

Stay Greater.

[terabitweb]

Original Post from SC Magazine Author: Bradley Barth

In the film “Ocean’s 11,” Danny Ocean and his team of expert cybercriminals execute a daring casino heist in glitzy Las Vegas.

This past summer at the Black Hat and DEF CON conferences in Sin City, the editorial staff at SC Media attempted to pull off a less ambitious – and decidedly more legal – caper of its own. With far less success.

The job: Complete a full series of video interviews with leading cyber experts, all while riding the world’s largest ferris wheel.

As a bonus, we even invited a pair of wireless researchers from the DEF CON Wireless Village to accompany us on the ride and use their equipment to sniff out whatever devices and signals they could detect along our 360-degree journey.

Our crew was set: one reporter + one cameraman + two wireless researchers + five experts + two PR associates for logistical support = SC’s 11.

As it turned out, Ocean’s 11 would have a much easier time of it.

The first challenge was getting on the ride in the first place, without breaking any rules. Ferris wheel policy didn’t allow professional video cameras, so we steered clear of this problem by filming only with an iPhone. Meanwhile, wireless researchers Rick Falcone and Rick Mellendick inquired in advance to make sure nothing they would bring on board was forbidden and were given a thumbs up that all was well.

Still, it was tempting fate when, for dramatic effect, Mellendick decided to handcuff himself to the protective case carrying his equipment. Surely, even in Vegas, this odd sight would cause a scene once we reached security, wouldn’t it? But after a few curious questions from the guards at the metal detectors, we were sent on our way.

Bradley felt like a big shot when a passerby saw the SC logo on the microphone and asked if he was with SportsCenter. Of course, reporting for SC Media is pretty darn cool too.

The next phase of the plan was to perform four interviews with our five experts (two were a duo who were interviewed together) in 30 minutes of ride time, before we quite literally came full circle. Mission accomplished there – just barely – as we finished our final interview right as it was time to disembark. Feeling victorious, we hurriedly gathered our belongings and stepped out of the cabin.

That’s when we ran into security. And they were not happy.

The woman in charge began interrogating our group, insisting that we should never have been allowed to board the ferris wheel while carrying electronic equipment – especially during DEF CON week. But since we didn’t actually bring any officially prohibited items, she let us pass. But not before making an ominous statement along these lines: “Excuse me, I have to go fire some people.” (We certainly hope no one was actually fired when it appears everyone had followed the rules.)

Whew. That was a close one. But at least we got our footage, right? Well, not exactly. The next morning, we discovered that the audio did not record correctly. Nothing but static. It was the equivalent of the Ocean’s 11 crew escaping the casino with bags of loot, only to find they were filled with Monopoly money.

But we weren’t about to let that stop us. So, nearly three months later, SC Media is finally pleased to present a photo essay of our Las Vegas (mis)adventure, featuring Q&A commentary from our guests, who were kind enough to recreate some of their talking points from the ride.

Who would have thought that a slow, scenic trip on a ferris wheel would turn into such a roller coaster ride?

See our interviews, below:

Sherrod DeGrippo (right), senior director of threat research and detection, Proofpoint.

Our first guest passenger was Sherrod DeGrippo, senior director of threat research and detection at Proofpoint.

SC: Sherrod, during our ferris wheel interview you described some of the recent activity of the cybercriminal threat group TA505, which historically has been associated with the Dridex banking trojan and Locky ransomware. What are the latest developments with this actor?

SD: This summer, we observed TA505 introduce a new downloader malware, AndroMut, which has some similarities in code and behavior to Andromeda, a long-established malware family. Our researchers identified two distinct campaigns by TA505 that used AndroMut to download [the remote access trojan] FlawedAmmyy. These attacks appeared to be targeted carefully by geography and somewhat targeted by industry, especially in Singapore and the UAE, where attacks were dramatically skewed towards financial services organizations.

Our research has followed TA505’s evolution over the last few years from an extremely high-volume actor dealing in global ransomware and banking Trojan campaigns to a targeted actor focused on regional campaigns and malware ranging from downloaders to sophisticated remote access trojans. This group is both adaptable and adept at following the money. They tend to set trends across the malware landscape, so, at this point, it appears that they are adapting to changing conditions based on regional and vertical targeting, as well the types of malware they are distributing. Some of these conditions may relate to cryptocurrency volatility and adaptations of defenders to previous malware strains they distributed en masse.

SC: During the interview, we noted that you are from Georgia, which has been hit repeatedly by ransomware attacks on a local and city level. Please explain why municipalities have become such an appealing target. Also, you mentioned that you may have even been indirectly affected by the SamSam ransomware attack on Altanta. Please explain.

SD: Threat actors recognize that municipalities typically have outdated information security protections and lack the resources necessary to recover quickly from an attack. These factors, along with their broad swath of responsibilities and relatively deep pockets, have made them more attractive targets in recent years. Additionally, ransomware actors look for the best, highest payout potential and focus their efforts there. A municipality has access to funds in excess of what consumer users or most small or medium businesses would have available that they can relatively easily divert to regain access to their systems, making them a lucrative target. 

I was actually pulled over by a police officer in Atlanta during the city’s SamSam ransomware attack. Because the police department’s systems were down, I was let go without a ticket. 

SC: You also mentioned the most paranoid thing you’ve seen someone do to keep secure at Black Hat and DEF CON. Is there such a thing as being too paranoid?

SD: I don’t think there is such a thing as too paranoid. Everyone should take every possible precaution to protect themselves and their digital identities. However, I have seen extreme acts taken at Black Hat/DEF CON that don’t have any impact on security, like tinfoil-wrapping an entire hotel room. That’s probably more for fun than actual security. I’ve seen people handcuff their tech to their wrist. That’s pretty paranoid, but also important if you’re forgetful.

Tyler Moffitt (left), senior threat research analyst, and Jason Davison (center), advanced threat research analyst, Webroot.

As we climbed toward the apex of our ascent, we were joined by a duo from Webroot: Tyler Moffitt, senior threat research analyst, and Jason Davison, advanced threat research analyst.

SC: Last year, the big ransomware threat was GandCrab. That changed following the developers’ supposed retirement. Now there’s a new threat, Sodinokibi, which also uses a ransomware-as-a-service model. Based on your observations, what makes this threat unique and dangerous? And what has led experts to conclude that Sodinokibi was created by GandCrab’s developers? 

TM and JD: GandCrab was one of the most successful RaaS (Ransomware as a Service) operations we’ve seen to date. Due to their success, they [GandCrab’s developers] received attention from researchers and the media alike. It’s not uncommon for successful threat actors who receive a lot of attention to try and start new projects in an attempt remain successful. There are extremely strong ties between Gandcrab and Sodinokibi. We even found an early decryptor binary listed as “gc6” (assumed to be GandCrab 6, since the last known distributed version of GandCrab was version 5.2) in the PDB path. 

SC: You’ve also been following several DNS hijacking campaigns in which malicious actors, perhaps government-sponsored, are altering internet records to reroute website visitors to attacker-controlled sites. Explain how this scheme works and explain why this is such a serious threat to the integrity of the internet’s infrastructure?

TM and JD: DNS is an older, fundamental part of networking that didn’t really account for security too much when it was initially designed. Attacks have been reported targeting mainly government and military organizations in the Middle East and North Africa regions. At a high level, the attack is to manipulate DNS name records to then redirect to hacker-controlled servers. This is critical because attackers are leveraging the trust placed on DNS systems to successfully attack users.

SC: We also talked about DEF CON being famous for hackers trying to hack into everything – elevators, hotel rooms, ATMs, etc. What’s the most unusual device/system hack you’ve researched or witnessed, at DEF CON or elsewhere?

TM and JD: I haven’t seen anything too crazy with my own eyes other than construction signs hacked to say “ZOMBIES AHEAD.” Also, all the speakers at the Bellagio casino were once hijacked to play Rick Astley’s “Never Gonna Give You Up.”

Dr. Richard Gold (left), director of security engineering, Digital Shadows.

Halfway home! Our next guest was Dr. Richard Gold, director of security engineering at Digital Shadows.

SC: Over the summer, the Senate Intel Committee released volume one of a report detailing Russian interference in the 2016 U.S. elections. You have followed reputed Russian APT actor APT 28/Fancy Bear closely. What were your reactions to the report?

RG: The report really lays out how the Russian intrusion groups took an “offense in depth” approach to their activities; that is, they conducted a very broad campaign against a number of targets using a wide variety of methods. The report goes into detail on the activity around the election infrastructure in a number of states. This is all in addition to the intrusions into the DNC [Democratic National Committee] and the DCCC [Democratic Congressional Campaign Committee] and the misinformation campaigns that have also been attributed to Russian groups. With the 2020 election looming large, the report clearly indicates the need for shoring up the security of any systems around elections and political campaigns.

SC: How great is your concern that Fancy Bear is willing and able to take more extreme measures next year and actually alter voter information (to cause chaos or disqualify certain voters) and/or change vote tallies?

RG: It is certainly possible. However, they had this access in 2016 and they did not use it, indicating that they didn’t need to use this access in order to achieve their goals. That does not mean that they will not use this access in 2020 as the target environment for these groups has changed in the last four years. There is more awareness of the threat posed by foreign interference than there was in 2016 so it may require hostile groups to go further in order to achieve their goals.

SC: You also have closely followed Hidden Cobra/Lazarus Group. During Black Hat, news broke that the reputed North Korean ATP group has collected $2 billion in illegal funds. What has made Lazarus Group so effective and lucrative over the years?

RG: Lazarus/Hidden Cobra are adept at “following the money,” to use a well-known phrase. They have consistently targeted organizations that handle large sums of money but do not necessarily have the same level of security as some more mature organizations. They have targeted cryptocurrency exchanges and financial institutions where the attackers had uncovered security weaknesses. This increased the likelihood that their intrusions would be successful, that they would be able to steal substantial amounts of money, and would be unlikely to be detected.

Ben Seri (left), VP of research, Armis.

Our final on-board guest was Ben Seri, vice president of research at Armis. Ben took us through the Armis team’s discovery of URGENT/11, a series of vulnerabilities found in the real-time operating system (RTOS) VxWorks. More than 2 billion devices operate on VxWorks, about 200 million of which were judged to be affected by the flaws.

SC: Ben, please summarize your URGENT/11 presentation at Black Hat, and the nature of the vulnerabilities you discovered.

BS: At Black Hat, we presented our findings, and did a deep dive on some of the most interesting of the discovered vulnerabilities. Many of the discovered vulnerabilities were found in esoteric features of the TCP and IP protocols, that are rarely used but nevertheless implemented, even in modern TCP/IP stacks. These esoteric features tend to be overlooked by both developers and pen testers, and therefore might end up containing very critical vulnerabilities.

SC: We talked about how vulnerability researchers have largely overlooked real-time operating systems. Why is this the case?

BS: There are a couple of reasons researchers overlook real-time operating systems. First of all, researching RTOSs is challenging – many of these operating systems are closed-source, and not easily debuggable. So to start hunting for vulnerabilities in such systems, a researcher would first need to invest significant time in preparing tools. Other reasons might be the competitive nature of researchers, who are mainly focused on the security of their personal devices – PCs and mobile phones. In addition, researchers have a much greater incentive to search for vulnerabilities in devices of companies that have bug bounty programs, for instance.

SC: I understand that since we last spoke in Vegas, it was determined that other RTOSs are similarly affected by the vulnerabilities because they share the flawed TCP/IP stack component known as IPnet. Please elaborate.

BS: The IPnet TCP/IP stack was indeed a standalone product that was licensed to users of various RTOSs in the past. Armis actually discovered this through the BD Alaris Infusion pump, a widely used Infusion pump that was detected as running the IPnet stack in a hospital environment where the Armis solution is used. The surprising factor was that this device is not based on VxWorks. That fact led us to further investigate the reach of these URGENT/11 [vulnerabilties]. It is surprisingly difficult to determine the OS used by medical devices, and embedded devices in general, let alone the TCP/IP stack that powers the network connectivity function of these devices. A vulnerability in a widespread component, such as the IPnet stack, is a case of a software supply chain vulnerability that unfortunately affects any device or operating system that uses it.

Rick Mellendick (left), chief security officer, PI Achievers, and Rick Farina (right), senior product manager, Aruba, a Hewlett Packard Company.

With our feet firmly planted back on earth, we finally turned to our wireless detectives Rick Mellendick, chief security officer at PI Achievers, and Rick Farina, senior product manager with Aruba, a Hewlett Packard Company. The two Ricks ran this year’s Def Con Wireless Village, and so we had asked them to bring some special equipment aboard the ride to passively – and legally – monitor the local environment for notable device activity. (You might remember them from our 2019 Trolley Talk segment at the RSA conference.)

SC: Explain your point of view of what happened at the end of the ride with ferris wheel security.

RF: The most likely explanation? The manager saw what appeared to be an interview and accosted the people who looked like they were carrying camera equipment. When she realized we didn’t have professional camera equipment, she claimed DEF CON attendees aren’t allowed to bring any electronics, which seems reductio ad absurdum. In truth, their physical security was about what would be expected at most places. We had a briefcase full of stuff, we showed them inside, it wasn’t dangerous or otherwise prohibited, so they let us through (despite the silliness with the handcuffs). Once we were past main security, and we powered up the kit, I am a bit surprised no one cared that Rick and I were tethered together. Again, all of our stuff was already checked, but I would say we behaved sufficiently atypical in a manner that would have easily justified additional scrutiny.

SC: Describe the equipment you brought with you for this particular mission, and what you were looking for.

RF: We brought a hard case full of wireless monitoring equipment; specifically, a small Intel compute stick, four general purpose software-defined radios for looking at different types of standard sensors and wireless remotes, one ADS-B-specific SDR (Software Defined Radio) for tracking airplanes, three Wi-Fi cards for monitoring Wi-Fi traffic, one Bluetooth dongle for monitoring Bluetooth and Bluetooth smart, two 802.15.4 (Zigbee) dongles for monitoring 802.15.4 in 900 MHz and 2.4GHz, and 2 Crazyradio PA dongles for monitoring wireless keyboards and mice. Basically, our goal was to see everything we could easily see passively, specifically using a free open-source tool called Kismet.

SC: Did the height of the ferris wheel present any unique opportunities to capture data? Also, did the ferris wheel present any unique challenges or obstacles that hindered data collection?

RF: The overall design of a ferris wheel does obviously lend a great opportunity for gaining some altitude, which removes the lower height obstructions like buildings and lets us pick up signals from farther away. Being Vegas, however, the pods of the ferris wheel likely use nice expensive low-e glass, which works as a shielding against much of the electromagnetic spectrum, as it is specifically designed to block out things such as infrared light. While these two things balanced out quite a bit, being in an enclosed space that was moving around (a ferris wheel in our case, but it could be a subway or a train or a bus) gave us the unique opportunity to really “get to know” everyone around us. We profiled how many phones we saw, and based on signal strength and duration seen it was obvious who was in the pod with us and who was not. While we only acted passively, there was more than enough time to consider a targeted attack against our fellow ride enthusiasts, which remained purely theoretical. The same thing could easily happen every day on the yellow or blue metro lines in Washington DC, or anywhere else where it may be interesting to profile people via their electronics.

SC: Ultimately, what did you find? Give us some specific examples of interesting observations, and then share with us your total statistics!

RM: We saw seven wireless mice and keyboards, as well as hundreds of active Bluetooth radios (both associated and probing). We saw a typical amount of Wi-Fi, and many other associated signals.

The stats: * 1,496 Bluetooth devices * 1,286 Wi-Fi devices including both clients and access points * two temperature sensors * seven wireless mice and/or keyboards * 65 aircraft

RF: So here’s how I broke it down and my assumptions: Wireless keyboards and mice have a fairly short range. The low-e glass also limits our range.  As such, it’s extremely likely that the wireless keyboards and mice were in use on the [cocktail] bar-equipped ferris wheel cars.

The temperature sensors are also pretty short range typically. We saw one that was an appropriate temperature for a refrigerator, and one that was the current outside temperature. Range is a bit further on these things, but I wouldn’t be surprised to learn that one was in a refrigerator and one was monitoring outdoor temperature for some monitor system or a sign with the temperature.

SC: Finally, a question for Rick M.: Explain why you handcuffed yourself to the equipment and, since you didn’t have a key, how long did it take to pick yourself out of it?

RF: I’m not Rick M, but I’m going to go out on a limb and say “because it was funny.” It does prevent security from attempting to confiscate things if they don’t like something, but we did unlock the case and show them everything inside before gaining entry. As for the picking, I think it was about 20 seconds for the first cuff and 10 for the second. Don’t let him convince you he did both cuffs in 10 seconds.

RM: The handcuffs were just for show, and to be different. It forced questions, and allowed for us to possibly have some teaching moments. If we just had backpacks, no one would have asked much of anything. And I think Rick’s estimation of the time to get out is a bit high, but it was very quick and during a discussion, while talking to a colleague.

* Q&A responses were minimally edited for content and clarity.

Related Articles

Trolley Talk, RSA 2019 edition: SC’s second annual cable car chats (video)

Trolley Talk: SC cruises the cable car line with cyber experts

Trolley Talk – The Full Ride

TA505 cybergang debuts ‘AndroMut” downloader to deliver FlawedAmmyy RAT globally

Report suggests GandCrab’s developers may have created Sodinokibi ransomware

‘Brazen’ nation-state actors behind ‘Sea Turtle’ DNS hijacking campaign

DHS issues emergency directive to protect federal domains from DNS hijacking campaign

Report: Russian-sponsored hackers could have modified U.S. voter data, but didn’t

Second Senate Intel committee report confirms Russia social media campaign to influence 2016 election, skewer Clinton

U.S. sanctions North Korea hacking groups, says attacks funded missile program

Over 200M devices affected by critical flaws found in real-time operating system

The post We interviewed leading cyber experts on the world’s tallest ferris wheel. Then security showed up. appeared first on SC Media.

#gallery-0-5 { margin: auto; } #gallery-0-5 .gallery-item { float: left; margin-top: 10px; text-align: center; width: 33%; } #gallery-0-5 img { border: 2px solid #cfcfcf; } #gallery-0-5 .gallery-caption { margin-left: 0; } /* see gallery_shortcode() in wp-includes/media.php */

Go to Source Author: Bradley Barth We interviewed leading cyber experts on the world’s tallest ferris wheel. Then security showed up. Original Post from SC Magazine Author: Bradley Barth In the film “Ocean’s 11,” Danny Ocean and his team of expert cybercriminals execute a daring casino…