-
As of today ICMag has his own Discord server. In this Discord server you can chat, talk with eachother, listen to music, share stories and pictures...and much more. Join now and let's grow together! Join ICMag Discord here! More details in this thread here: here.
top of the heap to third world status in one generation
- Thread starter Gry
- Start date
I Spent a Week Exploring How We’ll Have to Live in Post-Water America
Cutting water consumption requires more consideration than you'd think.
https://getpocket.com/explore/item/...n-post-water-america?utm_source=pocket-newtab
Cutting water consumption requires more consideration than you'd think.
https://getpocket.com/explore/item/...n-post-water-america?utm_source=pocket-newtab
M
moose eater
Maybe we'll have the suits they wore in Frank Herbert's Dune Trilogy, where there's tubes running from our urinary tracts, back through a purification system in our suits, providing fresh drinking water on a self-contained basis.
It's often been sci-fi that casts an image of what the future ends up actually looking like or pursuing.
It's often been sci-fi that casts an image of what the future ends up actually looking like or pursuing.
As long as you had the water rights.
there is plenty of water. most has salt in it, which is a problem lots of folks are working on. much is polluted, and getting WORSE, because those doing the polluting have the attention of those that control policy & enforce laws RE water pollution. in any case, you can forget washing your car or watering your yard...
St. Phatty
Active member
Not that big a deal but the Yuppies & King/Queen Wannabe's will SCREAM in protest.
dry (waterless) septic = not a big deal.
though it's a huge deal in terms of water use.
It's also possible to flush a toilet without using any extra water.
If you have a bucket.
From the article -
" 1,320 gallons per day, compared with the American average of 2,088 gallons per day."
I use about 40 gallons a day, plus whatever is used manufacturing what I eat or buy, maybe.
Our well is 20 gallons per minute. I have thought about selling water.
If there's anyone in California who could use a 1000 gallons ...
have you seen the Netflix doc called "inside Bills' Brain" or something like that? they have toilets now that self-power by burning the dried solid waste, and produce clean drinking water as well. some of Bill Gates cash pile is paying dividends. had an informative section on nuclear power plants they engineered. trade war has shelved it temporarily at least...
Described as a three part series, will reach for it.
Recall his statement about no machine ever needing more than four megs of ram.
Often found myself wondering, exactly who he bought that first OS from.
Hell of a salesman.
M
moose eater
Classic!! All that was missing was an intro by Ed Sullivan and some champagne w/ soap bubbles in the air.
Very nice!!
Very nice!!
M
moose eater
I just realized my midnight brain crossed Ed Sullivan with Lawrence Welk (spelling?)...
I think my synapses are suffering a greater number of shorts than normal, maybe?
uh oh...
White Beard
Active member
Always figured that who ever produced it would have been among his first hires.
Amazing how much is a con.
Planting Tiny Spy Chips in Hardware Can Cost as Little as $200
A new proof-of-concept hardware implant shows how easy it may be to hide malicious chips inside IT equipment.
More than a year has passed since Bloomberg Businessweek grabbed the lapels of the cybersecurity world with a bombshell claim: that Supermicro motherboards in servers used by major tech firms, including Apple and Amazon, had been stealthily implanted with a chip the size of a rice grain that allowed Chinese hackers to spy deep into those networks. Apple, Amazon, and Supermicro all vehemently denied the report. The NSA dismissed it as a false alarm. The Defcon hacker conference awarded it two Pwnie Awards, for "most overhyped bug" and "most epic fail." And no follow-up reporting has yet affirmed its central premise.
But even as the facts of that story remain unconfirmed, the security community has warned that the possibility of the supply chain attacks it describes is all too real. The NSA, after all, has been doing something like it for years, according to the leaks of whistle-blower Edward Snowden. Now researchers have gone further, showing just how easily and cheaply a tiny, tough-to-detect spy chip could be planted in a company's hardware supply chain. And one of them has demonstrated that it doesn't even require a state-sponsored spy agency to pull it off—just a motivated hardware hacker with the right access and as little as $200 worth of equipment.
"It’s not magical. It’s not impossible. I could do this in my basement."
Monta Elkins, FoxGuard
At the CS3sthlm security conference later this month, security researcher Monta Elkins will show how he created a proof-of-concept version of that hardware hack in his basement. He intends to demonstrate just how easily spies, criminals, or saboteurs with even minimal skills, working on a shoestring budget, can plant a chip in enterprise IT equipment to offer themselves stealthy backdoor access. (Full disclosure: I'll be speaking at the same conference, which paid for my travel and is providing copies of my forthcoming book to attendees.) With only a $150 hot-air soldering tool, a $40 microscope, and some $2 chips ordered online, Elkins was able to alter a Cisco firewall in a way that he says most IT admins likely wouldn't notice, yet would give a remote attacker deep control.
"We think this stuff is so magical, but it’s not really that hard," says Elkins, who works as "hacker in chief" for the industrial-control-system security firm FoxGuard. "By showing people the hardware, I wanted to make it much more real. It’s not magical. It’s not impossible. I could do this in my basement. And there are lots of people smarter than me, and they can do it for almost nothing."
A Fingernail in the Firewall
Elkins used an ATtiny85 chip, about 5 millimeters square, that he found on a $2 Digispark Arduino board; not quite the size of a grain of rice, but smaller than a pinky fingernail. After writing his code to that chip, Elkins desoldered it from the Digispark board and soldered it to the motherboard of a Cisco ASA 5505 firewall. He used an inconspicuous spot that required no extra wiring and would give the chip access to the firewall's serial port.
The image below gives a sense of how tough spotting the chip would be amidst the complexity of a firewall's board—even with the relatively small, 6- by 7-inch dimensions of an ASA 5505. Elkins suggests he could have used an even smaller chip but chose the ATtiny85 because it was easier to program. He says he also could have hidden his malicious chip even more subtly, inside one of several radio-frequency shielding "cans" on the board, but he wanted to be able to show the chip's placement at the CS3sthlm conference.
Elkins programmed his tiny stowaway chip to carry out an attack as soon as the firewall boots up in a target's data center. It impersonates a security administrator accessing the configurations of the firewall by connecting their computer directly to that port. Then the chip triggers the firewall's password recovery feature, creating a new admin account and gaining access to the firewall's settings. Elkins says he used Cisco's ASA 5505 firewall in his experiment because it was the cheapest one he found on eBay, but he says that any Cisco firewall that offers that sort of recovery in the case of a lost password should work. "We are committed to transparency and are investigating the researcher’s findings," Cisco said in a statement. "If new information is found that our customers need to be aware of, we will communicate it via our normal channels."
Once the malicious chip has access to those settings, Elkins says, his attack can change the firewall's settings to offer the hacker remote access to the device, disable its security features, and give the hacker access to the device's log of all the connections it sees, none of which would alert an administrator. "I can basically change the firewall's configuration to make it do whatever I want it to do," Elkins says. Elkins says with a bit more reverse engineering, it would also be possible to reprogram the firmware of the firewall to make it into a more full-featured foothold for spying on the victim's network, though he didn't go that far in his proof of concept.
A Speck of Dust
Elkins' work follows an earlier attempt to reproduce far more precisely the sort of hardware hack Bloomberg described in its supply chain hijacking scenario. As part of his research presented at the Chaos Computer Conference last December, independent security researcher Trammell Hudson built a proof of concept for a Supermicro board that attempted to mimic the techniques of the Chinese hackers described in the Bloomberg story. That meant planting a chip on the part of a Supermicro motherboard with access to its baseboard management controller, or BMC, the component that allows it to be remotely administered, offering a hacker deep control of the target server.
Hudson, who worked in the past for Sandia National Labs and now runs his own security consultancy, found a spot on the Supermicro board where he could replace a tiny resistor with his own chip to alter the data coming in and out of the BMC in real time, exactly the sort of attack that Bloomberg described. He then used a so-called field reprogrammable gate array—a reprogrammable chip sometimes used for prototyping custom chip designs—to act as that malicious interception component.
"For an adversary who wants to spend any money on it, this would not have been a difficult task."
Security researcher Trammell Hudson
Hudson's FPGA, at less than 2.5 millimeters square, was only slightly larger than the 1.2-millimeters-square resistor it replaced on the Supermicro board. But in true proof-of-concept style, he says he didn't actually make any attempts to hide that chip, instead connecting it to the board with a mess of wiring and alligator clips. Hudson argues, however, that a real attacker with the resources to fabricate custom chips—a process that would likely cost tens of thousands of dollars—could have carried out a much more stealthy version of the attack, fabricating a chip that carried out the same BMC-tampering functions and fit into a much smaller footprint than the resistor. The result could even be as small as a hundredth of a square millimeter, Hudson says, vastly smaller than Bloomberg's grain of rice.
"For an adversary who wants to spend any money on it, this would not have been a difficult task," Hudson says.
"There’s no need for further comment about false reports from more than a year ago," Supermicro said in a statement.
But Elkins points out that his firewall-based attack, while far less sophisticated, doesn't require that custom chip at all—only his $2 one. "Don’t discount this attack because you think someone needs a chip fab to do it," Elkins says. "Basically anyone who’s an electronic hobbyist can do a version of this at home."
Elkins and Hudson both emphasize that their work isn't meant to validate Bloomberg's tale of widespread hardware supply chain attacks with tiny chips planted in devices. They don't even argue that it's likely to be a common attack in the wild; both researchers point out that traditional software attacks can often give hackers just as much access, albeit not necessarily with the same stealth.
But both Elkins and Hudson argue that hardware-based espionage via supply-chain hijacking is nonetheless a technical reality, and one that may be easier to accomplish than many of the world's security administrators realize. "What I want people to recognize is that chipping implants are not imaginary. They’re relatively straightforward," says Elkins. "If I can do this, someone with hundreds of millions in their budget has been doing this for a while."
written by Andy Greenberg for Wired https://www.wired.com/story/plant-s...ap-proof-of-concept/?utm_source=pocket-newtab
A new proof-of-concept hardware implant shows how easy it may be to hide malicious chips inside IT equipment.
More than a year has passed since Bloomberg Businessweek grabbed the lapels of the cybersecurity world with a bombshell claim: that Supermicro motherboards in servers used by major tech firms, including Apple and Amazon, had been stealthily implanted with a chip the size of a rice grain that allowed Chinese hackers to spy deep into those networks. Apple, Amazon, and Supermicro all vehemently denied the report. The NSA dismissed it as a false alarm. The Defcon hacker conference awarded it two Pwnie Awards, for "most overhyped bug" and "most epic fail." And no follow-up reporting has yet affirmed its central premise.
But even as the facts of that story remain unconfirmed, the security community has warned that the possibility of the supply chain attacks it describes is all too real. The NSA, after all, has been doing something like it for years, according to the leaks of whistle-blower Edward Snowden. Now researchers have gone further, showing just how easily and cheaply a tiny, tough-to-detect spy chip could be planted in a company's hardware supply chain. And one of them has demonstrated that it doesn't even require a state-sponsored spy agency to pull it off—just a motivated hardware hacker with the right access and as little as $200 worth of equipment.
"It’s not magical. It’s not impossible. I could do this in my basement."
Monta Elkins, FoxGuard
At the CS3sthlm security conference later this month, security researcher Monta Elkins will show how he created a proof-of-concept version of that hardware hack in his basement. He intends to demonstrate just how easily spies, criminals, or saboteurs with even minimal skills, working on a shoestring budget, can plant a chip in enterprise IT equipment to offer themselves stealthy backdoor access. (Full disclosure: I'll be speaking at the same conference, which paid for my travel and is providing copies of my forthcoming book to attendees.) With only a $150 hot-air soldering tool, a $40 microscope, and some $2 chips ordered online, Elkins was able to alter a Cisco firewall in a way that he says most IT admins likely wouldn't notice, yet would give a remote attacker deep control.
"We think this stuff is so magical, but it’s not really that hard," says Elkins, who works as "hacker in chief" for the industrial-control-system security firm FoxGuard. "By showing people the hardware, I wanted to make it much more real. It’s not magical. It’s not impossible. I could do this in my basement. And there are lots of people smarter than me, and they can do it for almost nothing."
A Fingernail in the Firewall
Elkins used an ATtiny85 chip, about 5 millimeters square, that he found on a $2 Digispark Arduino board; not quite the size of a grain of rice, but smaller than a pinky fingernail. After writing his code to that chip, Elkins desoldered it from the Digispark board and soldered it to the motherboard of a Cisco ASA 5505 firewall. He used an inconspicuous spot that required no extra wiring and would give the chip access to the firewall's serial port.
The image below gives a sense of how tough spotting the chip would be amidst the complexity of a firewall's board—even with the relatively small, 6- by 7-inch dimensions of an ASA 5505. Elkins suggests he could have used an even smaller chip but chose the ATtiny85 because it was easier to program. He says he also could have hidden his malicious chip even more subtly, inside one of several radio-frequency shielding "cans" on the board, but he wanted to be able to show the chip's placement at the CS3sthlm conference.
Elkins programmed his tiny stowaway chip to carry out an attack as soon as the firewall boots up in a target's data center. It impersonates a security administrator accessing the configurations of the firewall by connecting their computer directly to that port. Then the chip triggers the firewall's password recovery feature, creating a new admin account and gaining access to the firewall's settings. Elkins says he used Cisco's ASA 5505 firewall in his experiment because it was the cheapest one he found on eBay, but he says that any Cisco firewall that offers that sort of recovery in the case of a lost password should work. "We are committed to transparency and are investigating the researcher’s findings," Cisco said in a statement. "If new information is found that our customers need to be aware of, we will communicate it via our normal channels."
Once the malicious chip has access to those settings, Elkins says, his attack can change the firewall's settings to offer the hacker remote access to the device, disable its security features, and give the hacker access to the device's log of all the connections it sees, none of which would alert an administrator. "I can basically change the firewall's configuration to make it do whatever I want it to do," Elkins says. Elkins says with a bit more reverse engineering, it would also be possible to reprogram the firmware of the firewall to make it into a more full-featured foothold for spying on the victim's network, though he didn't go that far in his proof of concept.
A Speck of Dust
Elkins' work follows an earlier attempt to reproduce far more precisely the sort of hardware hack Bloomberg described in its supply chain hijacking scenario. As part of his research presented at the Chaos Computer Conference last December, independent security researcher Trammell Hudson built a proof of concept for a Supermicro board that attempted to mimic the techniques of the Chinese hackers described in the Bloomberg story. That meant planting a chip on the part of a Supermicro motherboard with access to its baseboard management controller, or BMC, the component that allows it to be remotely administered, offering a hacker deep control of the target server.
Hudson, who worked in the past for Sandia National Labs and now runs his own security consultancy, found a spot on the Supermicro board where he could replace a tiny resistor with his own chip to alter the data coming in and out of the BMC in real time, exactly the sort of attack that Bloomberg described. He then used a so-called field reprogrammable gate array—a reprogrammable chip sometimes used for prototyping custom chip designs—to act as that malicious interception component.
"For an adversary who wants to spend any money on it, this would not have been a difficult task."
Security researcher Trammell Hudson
Hudson's FPGA, at less than 2.5 millimeters square, was only slightly larger than the 1.2-millimeters-square resistor it replaced on the Supermicro board. But in true proof-of-concept style, he says he didn't actually make any attempts to hide that chip, instead connecting it to the board with a mess of wiring and alligator clips. Hudson argues, however, that a real attacker with the resources to fabricate custom chips—a process that would likely cost tens of thousands of dollars—could have carried out a much more stealthy version of the attack, fabricating a chip that carried out the same BMC-tampering functions and fit into a much smaller footprint than the resistor. The result could even be as small as a hundredth of a square millimeter, Hudson says, vastly smaller than Bloomberg's grain of rice.
"For an adversary who wants to spend any money on it, this would not have been a difficult task," Hudson says.
"There’s no need for further comment about false reports from more than a year ago," Supermicro said in a statement.
But Elkins points out that his firewall-based attack, while far less sophisticated, doesn't require that custom chip at all—only his $2 one. "Don’t discount this attack because you think someone needs a chip fab to do it," Elkins says. "Basically anyone who’s an electronic hobbyist can do a version of this at home."
Elkins and Hudson both emphasize that their work isn't meant to validate Bloomberg's tale of widespread hardware supply chain attacks with tiny chips planted in devices. They don't even argue that it's likely to be a common attack in the wild; both researchers point out that traditional software attacks can often give hackers just as much access, albeit not necessarily with the same stealth.
But both Elkins and Hudson argue that hardware-based espionage via supply-chain hijacking is nonetheless a technical reality, and one that may be easier to accomplish than many of the world's security administrators realize. "What I want people to recognize is that chipping implants are not imaginary. They’re relatively straightforward," says Elkins. "If I can do this, someone with hundreds of millions in their budget has been doing this for a while."
written by Andy Greenberg for Wired https://www.wired.com/story/plant-s...ap-proof-of-concept/?utm_source=pocket-newtab
