NFC tags, RF shielding, intelligence & covert action, cyber security, Cloudflare, Access Controls & Audits

Post date: Jul 18, 2016 4:07:07 PM

• Read more about ISO/IEC 14443 tags. I've been writing some NFC related integrations. But I haven't had to deal with the low level stuff ever. Usually the application just uses "unique blob" and I don't care what that is. I got to the page because I were interested about ATQA SAK and ATS values + wanted to know how long tie UID is. Even if some apps seem to call it Serial Number? Which basically is the same thing. I'm glad that the password protection features worked well with NFC tags. As I've reported earlier some EddyStone BlueTooth Beacons are totally broken and won't basically allow setting any other than the static default password. Which of course is a major security fail.
• Configured few tags to configure Guest WiFi + Open Company Web Page whenever touched. That's pretty neat. Printed a few standard plastic credit card size cards with NFC symbol and WiFi information in reception and meeting rooms.
• Added internal tinfoil lining to my wallet to prevent remote NFC card reading without taking cards out of the wallet. It worked really nicely.
• Watched long documentary about intelligence services and covert action and sabotage they're taking. Small groups of hackers, seeming to be independent actors. Naturally most of interesting questions and topics were classified and not discussed publicly. KW: Zero Day Attacks, Intelligence, Espionage, Sabotage. Quick Money, Hacktivist, Sending Political Message, Nation-State Actors, Cyber Weapons, Cyber Command, Air Gap Jumping, Weaponized Code, Advanced Capacity and Capability is highly Classified, International Law. Everything you can get away with is ok in Cyber Realm. Cyber-Attack Targeting and Intelligence. Critical Infrastructure Vulnerabilities. Botnets, Destructive Activities. Computer System Knock Out, State-sponsored Cyber Sleeper Cells, Data Exfiltration, Infiltrated Command And Control Systems, Nitro Zeus, Attribution hard.
• New article about Cloudflare: We Have a Problem. Well, I think the article didn't provide any new information. That's just how Cloudflare works. For some cases it's ok, and for others, it isn't. I do use Cloudflare for a few free sites, but none of business sites are using it. Also SPAs got mentioned. MitM risks, maliciously intercept traffic, dragnet interception, TLS/SSL breaking, and so on.
• The same issues apply to running your own email server. Sure it can be hacked, of course. But it still requires someone bothering to do so. Instead of collecting your data directly from 'cloud hosted email' as the usual mass surveillance.
• New broke out that health care system allowed people to watch highly confidential diagnosis information of individuals without that access being logged. Surprised? - No. That's just how things usually work. In many cases system isn't being used as it's designed, and when there are such changes, some of the other features break simultaneously. In this case they claimed that the 'browsing mode' was only ment for system administrators. But for some reason it was enable for other personnel too. - Business as usual. There's nothing surprising with that. It's all the time that things like this happen. System is designed for case A but then there's some kind of need which requires configuration changes and then those are made as cheaply and quickly as possible. Which usually means that all the security controls and other 'what if' cases are purely forgotten. Because now it 'works' as they wanted it to work. And they can do what needs to be done.