From appleinsider.com:

The director took multiple precautions to keep the screenplay out of eager fans of the movie series, advising of the use of a MacBook Air in the Wall Street Journal's My Tech Essentials column. According to [Rian] Johnson [writer and director of Star Wars: the Last Jedi], the MacBook Air was the only device used for the initial production of the script, with considerable efforts made to keep it a secret.

For security it was 'air-gapped,' never connected to the Internet, said Johnson. In security circles, air-gapping a device prevents any software updates or other unwanted items from being installed onto the computer, effectively blocking any data from leaving the device, as well as stopping the installation of any software or malware that could force open a connection and allowing any data to leak out to third parties.

It's really that easy, folks. Hey, Equifax, Office of Personnel Management, and, um, any freaking hospital --

You know how you keep private information private? You take it off of the internet.

Firewalls don't count. OFF of the internet. If you have sensitive, proprietary data, "air gap" that portion of your company's network.

If you have to shoeleather data you don't mind getting out from one network to another, you essentially completely eliminate the possibility of a non-geographically confined attack against the data you want to keep safe. That is to say, people in Russia can't steal your data unless your network extends to Russia. Pro tip: The internet extends to Russia.

There's this bad joke in the preamble to the Dead Milkmen's song, Bitchin' Camaro (lyrics here, but they're not safe for polite consumption) that goes something like this...

• Oh, how you gettin' down to the shore?
• Funny you should ask; I've got a car now.
• Ah wow, how'd ya get a car?
• Oh, my folks drove it up here from the Bahamas.
• You're kidding!
• I must be, the Bahamas are islands.

YOU CAN'T STEAL A CAR FROM THE BAHAMAS AND DRIVE IT TO THE US. Get my drift? You want a car to be reasonably safe from US car thieves, put it in the Bahamas. Geography still matters. You want to keep your data safe from data thieves? Don't put it on a network that extends to their apartment.

More to the point, why is my personal credit data on the same network as Playboy? Doesn't that strike anyone else as a little odd?

It drives me absolutely mad how much we pay every year in breaches for the convenience of not having to separate networks. I can wait 48 hours to know if I qualify for a car loan, okay? Or, crazy thought, how about have the dealership call in the request?

Now all that said, please heavens tell me this dude knew to make periodic backups onto at least two jump drives. Or to at least print it out every so often.

Right?

Labels: internet, networking, privacy, security

Daring Fireball, quoting the NY Post:

Master keys for every elevator in the city, major construction sites, subways and skyscrapers are being freely sold online, despite a city law that makes it illegal for unauthorized persons to possess them.

A New Jersey-based lock company is peddling an unlimited supply of New York City’s “1620” fire service keys on eBay at $15.50 for two.

Access to the Big Apple keys is sharply restricted. It’s unlawful for anyone other than firefighters, law-enforcement personnel, elevator contractors or inspectors and building owners to have them.

But a Post reporter bought two keys to the city with no questions asked from UltimateSecurityDevices.com, an online arm of Northeast Lock Corp. in Clifton, NJ.

Gruber's response:

This is, effectively, what the Department of Justice wants for the iPhone.

Here's the part that I think is widely underreported/argued/claimed, and it's painful to see Gruber skip over it: Networked devices aren't like physical ones in that there's not absolute geographical protection. If you want to break into my elevator, you at also have to be there. If you want to break into Director Comey's car trunk, you have to be beside his car. And I bet there's at least one camera on you.

I can't break into a NY elevator or Directory Comey's car trunk from overseas. But folks can break into your PC or phone more easily overseas than they can in your driveway.

Your "back door", if you have one, is accessible to anyone on the network, not just the guys who drive to your neighborhood. Joel Spolsky talks about barriers to entry. Actually having to get there is one of the biggest.

This is why I wrote, "A better neighborhood for our personal data". We have one small street, geographically speaking, with a billion-plus people all living there, their personal data exposed to any other unscrupulous schmoe living on our single street. A locksmith once told me that a lock keeps an honest man honest. A billion men aren't all going to be honest, man.

PS Google: Beetee Dub, I didn't write about better neighborhoods for our data in 2002, okay? Why can't Google index blogspot correctly? I've consistently seen search issues (or items that would pop up in blogger's interface when searching, but not on Google) with my blog. I mean, it is at least marginally in Google's own interest to support blogspot well, right? Right? /sheesh

Labels: encryption, gruber, networking, safety

A security hole in FCA’s Uconnect internet-enabled software allows hackers to remotely access the car’s systems and take control. Unlike some other cyberattacks on cars where only the entertainment system is vulnerable, the Uconnect hack affects driving systems from the GPS and windscreen wipers to the steering, brakes and engine control.
...
The hack was demonstrated by Charlie Miller and Chris Valasek, two security researchers who previous demonstrated attacks on a Toyota Prius and a Ford Escape. Using a laptop and a mobile phone on the Sprint network, they took control of a Jeep Cherokee while Wired reporter Andy Greenberg was driving, demonstrating their ability to control it and eventually forcing it into a ditch.

Unlike the majority of hacking attempts on cars, the vulnerability within the Uconnect system allows cybercriminals to take control of the car remotely, without the need to make physical contact with the car.

Labels: fail, networking, prediction, security