![Cybercrime busts, wormable Home windows, and the disaster of featuritis [Podcast + Transcript] – Bare Safety](https://nakedsecurity.sophos.com/wp-content/uploads/sites/2/2021/09/ns-1200-logo-podcast-with-mic.png?w=775 "Cybercrime busts, wormable Home windows, and the disaster of featuritis [Podcast + Transcript] – Bare Safety"){kind=logo}
[ad_1]
With Doug Aamoth and Paul Ducklin.
DOUG AAMOTH. Romance, scams, bugs, worms and REvil ransomware.
All that and extra on the Bare Safety Podcast.
[MUSICAL MODEM]
Welcome to the podcast, everyone.
I’m Doug; he’s Paul…
PAUL DUCKLIN. Properly executed, Doug… proper approach spherical this week!
DOUG. Why, thanks! Final week I obtained combined up…
DUCK. You didn’t confuse your self.
DOUG. Nevertheless it took 65 episodes for me to make that mistake, so I’m fairly pleased with myself.
It would occur once more, however…
DUCK. That’s proper: we’re on Route 66 at this time!
DOUG. We’re.
DUCK. That’s fairly an enormous deal, Doug.
DOUG. Sure.
And similar to Route 66, now we have numerous sights to take a look at this week – a full docket.
DUCK. [LAUGHS AT SEGUE] I really like your work!
DOUG. We do like to begin the present with a Enjoyable Truth.
And often the enjoyable truth is said to the This Week in Tech Historical past phase.
Not this week, although, as a result of it’s been very chilly right here and lots of people have been carrying winter hats. I used to be a bunch of individuals and I assumed, “What are these pom-poms on the highest of the hats? The place did that come from?”
So I regarded it up, and in case you ever surprise why some winter hats have these fluffy pom-poms on prime, apparently they have been worn by French sailors within the olden days to guard their heads from banging in opposition to the low ceilings of ships whereas out at sea.
They have been particularly efficient in tough waters.
So when you’ve got a pom-pom on the highest of your hat, you’ve a French sailor to thank for it.
DUCK. Oh, so it was truly padding?
DOUG. Sure.
I’ve a really low ceiling in our basement and laundry room, so perhaps I’ll go put a pom-pom hat on and stroll round and see if it helps, as a result of I hit my head fairly a bit.
DUCK. You might simply duct tape a mouse mat… you already know, put it on prime of your head and duct tape it beneath your chin.
DOUG. [LAUGHS] I don’t know if they’d neoprene again in these days, nevertheless it’s a good suggestion.
Properly, let’s speak about… we’ve obtained numerous tales to cowl.
The primary one: now we have successfully ended ransomware with the alleged bust of the REvil ransomware crew in Russia.
[SARCASTIC] It’s the tip of ransomware as we all know it, proper?
DUCK. Properly, even the Federal Safety Bureau of Russia, the FSB, didn’t truly say that, although they did truly do a bust.
There’s been numerous criticism prior to now…
…Russians, I feel, just like the Germans and French, and a complete load of nations, don’t extradite their very own residents. So, if you wish to get individuals in these international locations prosecuted for crimes they dedicated in opposition to one other nation, you principally have to supply the nation with the proof it wants.
And there’s numerous criticism that Russia didn’t appear very prepared to try this.
On this case, it seems to be like they have been: apparently, 25 avenue addresses obtained raided in a wide range of totally different cities.
They talked about 14 individuals being focused, although they don’t say what number of of these finally obtained arrested.
However there have been some arrests; plus 20 fancy automobiles towed away, apparently purchased with the proceeds of crime. And as we’ve stated earlier than, there’s most likely a bunch of forensic knowledge within the common fancy automotive today, when it comes to the leisure system, satnav, telephones constructed into the automotive and all that type of stuff.
And so they obtained one thing like $6,000,000 to $7,000,000 in rubles, US {dollars}, euros and cryptocoins.
So the FSB was fairly bullish about what it had achieved, stating that, on account of the raid, “this cyber gang ceased to exist and its felony infrastructure was neutralized.” So, that’s REvil.
They didn’t say, ” It’s the tip of ransomware as we all know it,” as a result of clearly it isn’t.
There are two issues, even when REvil actually has sunk with out a hint now: [a] there are many different ransomware gangs the place REvil got here from; and [b], sadly, there are many different varieties of cybercrime involving crooks which have little no real interest in ransomware, however are nonetheless able to doing loads of evil, albeit that they’re not REvil.
DOUG. Sure, Sir!
However a step in the appropriate route nonetheless?
DUCK. Sure, I don’t suppose we are able to complain!
Nevertheless it’s nonetheless all about: patch early, patch usually; don’t let your guard down; prevention is best than treatment; and put money into your customers.
DOUG. We’ve obtained extra recommendation in our State of Ransomware 2021 report, which is linked to within the article known as REvil Ransomware crew allegedly busted in Russia, says FSB on nakedsecurity.sophos.com.
Let’s simply shimmy proper alongside to a different bust: a romance scammer who focused nearly 700 girls has gotten 28 months in jail.
DUCK. Because the Nationwide Crime Company of the UK level out, in respect of romance scams usually, they are saying, “We need to encourage all those that suppose they’ve been a sufferer of romance fraud to not really feel embarrassed or ashamed, however please report it.”
The Nationwide Crime Company can’t make a case the place any person hasn’t advised them, “Hey, I despatched cash to this individual and I now suppose I shouldn’t have,” as a result of in the event that they insist that they despatched the cash willingly, and so they don’t take into account that they have been defrauded, then I assume fraud hasn’t occurred.
And that’s the issue with a cybercrime like this.
DOUG. Sure, we do have one heartbreaking touch upon the article, and one other uplifting remark on the very finish.
One in all our readers thinks his mother is being scammed, and she or he’s not reacting effectively to her household making an attempt to speak her out of it; after which now we have one other one the place they caught a scammer red-handed, which was type of an fascinating story.
DUCK. Sadly, these crimes don’t simply depart individuals brokenhearted and destitute. They will additionally depart you with an enormous rift in your loved ones circle.
That man stated, “My mother stop speaking to me as a result of I don’t imagine that is the love of her life.”
The one recommendation we are able to actually give is that when you’ve got even an inkling that you just may be in a rip-off, irrespective of how heart-rending it’s going to be to should admit that, don’t “present the hand” to your family and friends in the event that they’re making an attempt to warn you.
They may be flawed, however they may very, very effectively be proper… so give them a good listening to.
DOUG. OK, we’ve obtained recommendation within the article, and a useful video known as Romance Scams: What to do?.
We talked about listening to your family and friends in the event that they attempt to warn you; we even have issues like: take into account reporting it to the police; don’t blame your self in case you get reeled in; search for a assist group; and most significantly, get out as quickly as you understand it’s a rip-off.
DUCK. Sure, my recommendation there, very significantly, is: don’t say to the scammer, “Oh, I’m starting to suspect you. I’ll provide you with one final likelihood to show your self.”
Keep in mind, if they’re a scammer, they’ve already reeled you on this far.
Do you suppose they’re going to have an excessive amount of hassle with one little objection that you just’re bringing now?
In case you’ve determined it’s a rip-off, don’t inform them – simply lower contact after which go and search for a neighborhood assist group.
And, by the best way, be very cautious, in case you break off reference to the scammers, in case you all of the sudden get contacted by any person claiming to signify a assist group, or legislation enforcement, or an organization that may enable you get your scammed a refund.
As a result of that’s the basic “counter-scam”.
When the crooks understand you actually have determined they’re scammers, then they arrive in making an attempt to faux to be the antiscammers!
There are quite a few circumstances of individuals getting scammed twice. In case you’re going to withdraw from a rip-off, solely take care of individuals you truly know, and may meet, and you can belief nose to nose.
Don’t simply take assist from anybody who comes up providing it on-line – it may very well be the scammers coming again.
DOUG. [SAD] Fantastic. The thrill of human behaviour.
That’s Romance scammer who focused 670 girls will get 28 months in jail on nakedsecurity.sophos.com.
We shift from human worms to Home windows worms: a wormable Home windows HTTP gap.
What do we have to learn about this, Paul?
DUCK. This was an enchanting begin to 2022, wasn’t it? It was one of many many safety bugs mounted on this month’s patch Tuesday…
DOUG. That was an enormous one!
DUCK. I feel there have been 102 bugs!
However one among them didn’t appear too dangerous at first, maybe as a result of it didn’t say, “This bug is within the Microsoft internet server that everybody is aware of.”
It was simply described as HTTP protocol stack distant code execution vulnerability, or CVE-2022-21907.
So that you type of suppose, “Oh, it’s some low degree code factor; most likely doesn’t apply to me, as a result of I’m not operating IIS.”
And in that sense, it was a bit of bit just like the hassle we had with Log4j, the place everybody stated, “I don’t have any Java servers.”
And we stated: no, it’s not about servers; it’s about apps which can be written in Java.
“I don’t have a lot of these…” Are you positive?
“Properly, I do have a few of them, however not a lot of them run Log4j…” Are you positive?
After which, as we’ve stated on a few earlier podcasts, when individuals would go searching for Lg4j, they’d discover, “Golly, there’s much more of it than I assumed.”
The issue right here may be very comparable, specifically that HTTP.sys is a low degree driver that gives HTTP providers for whenever you want a program that can settle for and reply internet requests, *together with IIS*.
In actual fact, IIS is applied on prime of this HTTP.sys, nevertheless it’s simply one among dozens, or a whole lot, or hundreds of purposes you might have which may use this factor.
Any program you’ve, whether or not you realizs it or not, that accommodates some type of internet console, or internet interface, or internet port you’ll be able to connect with, may very well be vulnerable to this bug in case you haven’t patched.
And what obtained everybody excited is, as Microsoft stated of their Regularly Requested Questions checklist for this specific patch, “Is that this wormable?”, that means might any person use it to put in writing a self-spreading virus…
DOUG. Sure!
DUCK. They actually did simply put that one phrase!
DOUG. [LAUGHS] “Sure. Full cease.”
DUCK. And so they stated, “Microsoft recommends prioritising the patching of affected servers.”
Now, my opinion is that the wording of that was considerably unlucky, as a result of it leads you to deduce that this solely impacts servers. The place else would you’ve an HTTP service listening than on a server?
After all, the reply is: hundreds and a great deal of packages today use HTTP as their GUI, as their interface, don’t they? Many have an online console, even when they’re packages designed for an finish person.
The bug is a perform of a low-level driver in Home windows itself, and that’s what must be patched.
I assume the good-news a part of that’s, when you’ve executed this patch, each program that will depend on HTTP.sys is implicitly patched together with it as a result of all of them depend on the identical low-level driver.
DOUG. Okay, what… taking part in Satan’s advocate. What ought to I do if I’m not in a position to patch instantly for some purpose?
DUCK. I got here up with a repair which labored in my restricted testing. Quite simple.
You simply go into your registry (we’ve obtained a script on Bare Safety that reveals you the way to do that), and you modify what’s known as the “begin code” for the HTTP Home windows service from the worth 3, which suggests begin when wanted, to the worth 4.
You simply should know that 4 means disabled; can’t begin.
And that basically fixes this drawback, as a result of no software program can truly fireplace up this driver, subsequently nothing can truly use it, subsequently the bug can’t be tickled.
The flipside of that’s no software program can use this HTTP service, so if it seems that you just *do* have an app the place, with out you realising it, a part of its administration depends on a web-based console or an online primarily based API… then that’s not going to work both.
So this isn’t a everlasting answer; it’s only a workaround.
You finally want to repair this HTTP.sys file as a part of the Patch Tuesday replace.
DOUG. OK, that’s Wormable Home windows HTTP gap – what it is advisable to know on nakedsecurity.sophos.com.
Now, it’s time for This Week in Tech Historical past.
Lest you suppose we’d solely speak about worms as soon as on this episode… this week, on 20 January 1999, the world was launched to the HAPPY99 worm, often known as Ska or Iworm. HAPPY99 was reported by a number of anti-virus distributors to be a fairly large ache within the neck.
DUCK. Imagine me, it was jolly enormous.
And it had a trick that you’ll grudgingly like, Doug.
The crooks did what you name the “B factor”: greatest/good.
They averted making spelling errors or typos or writing dangerous English.
They averted all these issues just by having no textual content.
DOUG. Aaargh.
DUCK. Brilliantly easy, isn’t it?
DOUG. Arrrrrgh!
DUCK. When you have zero characters, then it’s essential to, ipso facto, have zero spelling errors, typos, grammos, et cetera.
It merely arrived; it was an executable; it stated HAPPY99.EXE; and in case you ran it, it confirmed you a bit of fireworks show.
DOUG. [DOWNCAST] Sure, certainly.
All proper, effectively, we’ve obtained two Severe Safety articles lined up.
The primary is a few Linux full disk encryption bug that has been mounted. However what occurred earlier than it was mounted?
DUCK. Normally, on Linux, whenever you’re doing full disk encryption – that’s the stuff that makes positive that if somebody steals your laptop computer as soon as it’s powered off, the disk’s simply shredded cabbage until you place in a password…
…on Linux, you’re most likely utilizing a factor known as LUKS, Linux Unified Key Setup. And that will help you handle LUKS, there’s a program known as cryptsetup.
Sadly, as usually occurs with full disk encryption as a result of it’s so helpful, cryptsetup has an terrible lot of options – most likely much more than you’d ever think about you wanted.
And one of many issues that cryptsetup can do – the choice known as reencrypt.
What it means is that as an alternative of simply altering the password that decrypts the grasp encryption key, it truly decrypts and reencrypts your complete laborious drive *when you’re utilizing it*, so that you don’t should decrypt the entire thing and danger having it unencrypted for some time.
All of it sounds unbelievable, besides that what the cryptsetup crew did is: they figured, “Hey, we might use the identical code if somebody must decrypt the disk,” like they really need to take away the encryption for some purpose.
Or in the event that they’ve obtained a disk that by some means by no means was encrypted and now they need to add encryption again.
So that they thought, “Properly, these are simply particular circumstances of reencrypt. So let’s fudge the system as an alternative of writing them as separate utilities.”
Let’s simply do them as “deviant circumstances” of reinfection…
DOUG. [LAUGHS]
DUCK. To chop a protracted story brief, it seems that in case you’re utilizing decrypt or encrypt features, relatively than the reencrypt perform, then cryptsetup doesn’t take enough care about what you may name the metadata – the momentary knowledge – that information how far it’s obtained.
So, any person who has entry to your pc *however doesn’t know your password* can modify your laborious disk and principally trick the system into pondering, “Oh, I used to be in the course of decryption, nevertheless it broke midway via.”
In case you tried to try this when the individual was *reencrypting*, it would go, “Uh oh! Somebody’s been tampering together with your disk: it is advisable to examine!”.
However these checks, in case you have been utilizing the pure *decrypt*, weren’t made.
So any person might get your pc when you weren’t trying, fiddle with it, after which whenever you rebooted and really put in your password, not less than some a part of the disk may get decrypted.
And also you wouldn’t realise, however you’d find yourself with not less than one little little bit of your disk decrypted.
Which implies that in case you’re counting on full disk encryption to say to the regulator, “By the best way, if this laptop computer is stolen, I can promise you there is no such thing as a plaintext knowledge on right here in any respect”…
…effectively, you won’t be telling the reality, as a result of there may be a small, medium or massive chunk of knowledge that *did* get decrypted with out you realising it.
And it will get worse!
What an individual might do is that this: they may decrypt a piece of your disk after which come again later. In case you haven’t observed, they may dig round in that decrypted knowledge, which is now not integrity protected; it’s simply plaintext.
They may make some crafty modifications: perhaps they may change a file title, or, if they may discover fragments of one thing that regarded like your shopping historical past, they may insert shopping historical past that made you seem like a really naughty individual certainly.
Then they may run the bug backwards! They may say, “That you must reencrypt these items.”
And the subsequent time you booted and put in your password, your disc would “heal itself” by reencrypting the stuff that had inadvertently been decrypted, however *with unauthorized modifications in it*.
DOUG. Ooooooooooh.
DUCK. So this appears like, “Properly, that’s not likely a bug, is it?”
However what it means is that any person together with your worst pursuits at coronary heart (say, any person who needs to gaslight you), if they’ve entry to your pc whenever you’re not trying, they may, *with out ever having to search out your password*, sew you up with knowledge in your disk that’s encrypted together with your password.
So they may say, “How on Earth might I’ve executed that? I don’t know the password. I can show I don’t know the password, past affordable doubt, at any charge. If it’s encrypted together with your password, effectively, then *you* should have executed it.”
DOUG. Sure.
DUCK. And this was a bit of loophole that meant that assumption didn’t essentially maintain…
…and subsequently it is best to get the most recent model of the cryptsetup program, as a result of it provides the checks that ought to have been within the pure decrypt and pure encrypt features.
It provides integrity checks that ensure that no one tries to set off decryption or encryption with out truly having identified the password upfront.
When you have cryptsetup, the model you need is 2.4.3 or later.
DOUG. All proper, you’ll be able to be taught extra about that – the article is on Bare Safety at Severe Safety: Linux full disk encryption bug mounted – patch now.
Properly, it feels good to be getting again right into a rhythm, a cadence, the place one other week goes by…
…and we now have an Apple bug to speak about.
DUCK. [LAUGHS] I used to be questioning the place you have been going with that, Doug!
Sure, that is an Apple bug. And annoyingly, it’s a bug in Safari, or maybe extra importantly, in WebKit, which is what you may name the browser engine that Safari makes use of.
DOUG. [IRONICALLY] Then I imagine I’ll simply go obtain Firefox for my iPad and I’ll be simply superb, Paul. Proper?
DUCK. Properly, that’s the issue. If it’s not macOS, however relatively iOS or iPadOS, Apple requires all internet shopping apps to make use of WebKit.
So in iOS and iPadOS, you don’t actually have a workaround. Or extra importantly, in case you suppose, “Oh, I’ll simply go and get Firefox,” it gained’t prevent from this bug.
DOUG. So what truly causes the issue right here?
DUCK. It’s Featureitis and Complexity Thought-about Dangerous but once more, Doug.
DOUG. What, once more?
DUCK. Once more, once more.
DOUG. That is turning into a theme!
DUCK. As our listeners will certainly know, what’s known as stateful HTTP knowledge – in different phrases, issues that your browser remembers in order that whenever you return to a web site, the web site can inform that it’s you coming again…
Clearly, that’s good for monitoring, nevertheless it’s additionally good for issues like, “Ought to I take advantage of the large fonts or the small fonts? Ought to I be in cell phone mode or desktop mode?” All of these issues that you just need to retain between one web site go to and the subsequent.
…historically, these have been dealt with by knowledge objects known as cookies.
And with out cookies, we might by no means have had web sites that allowed you to login, as a result of the web site wouldn’t be capable to bear in mind, “Hey, this is similar individual coming again.”
Nevertheless it seems that cookies are inefficient, as a result of whenever you ship cookies, you need to ship all of the cookies ever set by a web site, each time you join any web page on the web site, even when that web page doesn’t want them.
And subsequently most browsers have a strict restrict on how a lot cookie knowledge you might have.
So guess what occurred? The browser individuals obtained collectively and so they stated, “Hey, let’s have a factor known as internet storage,” which is like large cookies you can entry with JavaScript. You solely entry internet storage with JavaScript from a selected internet web page, when you already know you want the info.
So that you had cookies and internet storage; two totally different applied sciences. One didn’t require JavaScript; one did require JavaScript. One was restricted in how a lot state knowledge it might save; the opposite was way more versatile, and allow you to save a lot greater objects.
However even internet storage wasn’t adequate, Doug, as a result of the humorous factor appears to be that the extra we embrace the cloud, the extra we anticipate our browser to behave as if it have been a domestically put in utility.
So, alongside got here a factor known as IndexedDB, which is, in case you like, a THIRD kind of cookie.
We’ve obtained cookies that go within the internet headers; we’ve obtained internet storage, which is a type of unfastened, casual little mini-database that JavaScript can entry; and we’ve obtained IndexedDB, which is nearly-but-not-quite a browser-side SQL database.
It doesn’t truly use SQL, nevertheless it permits you to retailer a lot bigger chunks of knowledge – akin to complete paperwork or complete units of paperwork, In case you’re doing a content material administration system, or huge photos, in case you’re writing a cloud-based picture processing program, for instance.
You’ve obtained cookies for small quantities of knowledge; internet storage the place you want a bit extra; and IndexedDB the place you need vital quantities of structured knowledge.
As a result of when two issues can do one thing badly…
DOUG. [LAUGHS]
DUCK. …three issues can do it even [PAUSES] higher, apparently.
And the issue is – it’s actually tiny – that on Safari, or on WebKit, there’s a particular perform known as indexedDB.databases that, whenever you name it, provides you an inventory of all of the presently lively IndexedDB databases identified to the browser.
Nevertheless it provides any internet web page, any tab, any window, any web site, entry to the total checklist of database *names*.
It enforces the Similar Origin Coverage that claims that web site X can not learn the IndexedDB databases of web site Y, so a web site can solely entry its personal cookie, its personal internet storage, and its personal IndexedDB knowledge.
However all tabs can entry the checklist of database *names*, which, as tiny because it sounds, seems to be a step too far.
As a result of because the researchers who discovered this – it’s an organization known as Fingerprint JS; they go searching for browser anomalies…
…as they found, plenty of mainstream web sites, once they create one among these IndexedDB databases for their very own use, give it a little bit of a telltale title.
They don’t simply name it blah or db; they’ll title it in a approach that signifies what service it belongs to.
That is like saying to a criminal, “I’ve locked you out of all the info on my pc, however I *will* allow you to obtain an inventory of all my filenames.”
DOUG. Ah hah!
DUCK. You’ll be able to think about that there are numerous secrets and techniques in your file names, in your so known as metadata.
And the opposite factor the researchers found – they significantly regarded into this for Google, however this isn’t actually Google’s fault; not blaming Google…
…apparently Google makes use of your Google Person ID as a database title, which is a few random string of characters.
Now, that doesn’t inform any person who can checklist that distinctive identifier *who* you’re. A criminal with a web site that’s abusing this perform gained’t know that “Doug” is represented by this specific hexadecimal string.
However each time “Doug” visits their web site, even when “Doug” has monitoring safety on that tries to cease them figuring the place you’ve been…
…you’ll come again *with the identical Google Person ID* in case you’re nonetheless logged into Google.
So that they gained’t know who you’re, however they’ll know that it’s the identical individual coming again again and again – with out setting any cookies or doing something devious of their very own.
It’s nearly as if this IndexedDB database checklist can act like a type of a supercookie: I don’t know who it’s, however I do comprehend it’s the identical individual each time.
That’s info that you just most likely by no means supposed to present out.
And that’s why this bug is essential, contemplating the trouble that browser makers over time have put into eliminating all this treachery that folks might do with so-called supercookies – that’s the place crooks use issues like “which web sites have you ever visited utilizing HTTPS as an alternative of HTTP?” as a approach of monitoring who you’re, or “which fonts do you’ve put in?”, or “what display screen decision are you utilizing?”
All these issues that folks would dubiously use to attempt to fingerprint you as a person person may be executed with IndexedDB.
And as we’ve lamented many occasions earlier than, Apple aren’t saying once they’re going to repair this.
However the purpose that Fingerprint JS wrote about it now’s that they will see, from the open supply parts in WebKit, that Apple programmers appear to be this, and so they’re starting to merge in a complete load of modifications which can repair it.
So there’s a patch to Safari/WebKit most likely coming quickly… however Apple doesn’t imagine in telling you that it’s coming.
You simply should assume that it’s. So watch this house.
DOUG. OK, we’ll keep watch over that! That’s Severe Safety: Apple Safari leaks personal knowledge through database API – what it is advisable to know, on nakedsecurity.sophos.com.
And it’s that point of the present: the Oh! No! of the week.
Reddit person dilgentcockroach700 writes…
DUCK. Does that imply there are 699 diligent cockroaches earlier than her or him?
DOUG. I do know! Think about making an attempt to safe that username!
DUCK. [PRETENDING TO BE A SUPPORT BOT] “Different usernames you may like…”
DOUG, Sure, 700: numerous cockroaches; they’re laborious to kill.
[TELLING THE STORY] Again within the Nineteen Eighties, I used to be working for a telecomms firm within the UK. We had a Digital Tools Company PDP-11 that I used to be accountable for, which was in an environmentally managed room.
One Monday morning, I obtained to the workplace to search out the pc was fully lifeless. I rushed into the pc room to search out ladders, pots of paint, paint brushes, and an enormous dustsheet fully overlaying the PDP-11, which by now was so scorching it was nearly glowing.
(If nobody’s ever seen a type of, it’s in regards to the dimension of a fridge that you just put in your kitchen… it’s an enormous pc.)
Apparently the Workplace Providers Division had determined the room wanted adorning, however didn’t hassle to inform anyone.
I shut the ability off to the pc, eliminated the mud sheet, and left it to chill down.
Later, I attempted to reboot it nevertheless it wouldn’t work. Ended up having to name in DEC engineers from the US, and changing many of the fried internals. My supervisor made the Workplace Providers Division pay the several-thousand-pound invoice out of their finances.
So, think about – an enormous pc the scale of a fridge – how scorching that may get…
DUCK. [LAUGHS]
DOUG. …after which placing a painter’s tarp over it to color the room it was in.
DUCK. That was the world’s costliest paint!
DOUG. Uh huh!
Properly, I’m guessing that by now they’ve most likely changed that PDP-11 with one thing a bit of bit extra svelte.
DUCK. Most likely ten occasions extra highly effective, like a Raspberry Pi Zero.
DOUG. Or a cellphone!
Anyway, when you’ve got an Oh! No! you’d prefer to submit, we’d like to learn it on the podcast.
You’ll be able to electronic mail ideas@sophos.com, you’ll be able to touch upon any of our articles, or you’ll be able to hit us up on social @nakedsecurity.
That’s our present for at this time – thanks very a lot for listening.
For Paul Ducklin, I’m Doug Aamoth, reminding you…
Till subsequent time…
BOTH. …keep safe!
[MUSICAL MODEM]
[ad_2]
