The Dark Escrow

Security Now! Transcript of Episode #820 Page 1 of 22 Transcript of Episode #820 The Dark Escrow Description: This week we examine Firefox's just-released and welcome re-architecture under codename "Fission." We look at a new and recently active ransomware player named "Conti" and at a recently paid, high-profile mega ransom. We then ask the question, "When they say IoT, do they mean us?" We examine the implications of a new industry term, "mean time to inventory." We'll then lighten things up a bit with a new form of CAPTCHA and, of all things, a screensaver I discovered that I cannot take my eyes off of. (Leo, it's not quite as bad as whatever that game is that you cannot stop playing, but still.) We'll then share an ample helping of closing-the-loop feedback from our terrific listeners, after which I want to conclude by predicting what I would bet we're probably going to next see emerge from the evolving ransomware business model sad though it is to utter the phrase "ransomware business model." High quality (64 kbps) mp3 audio file URL: http://media.GRC.com/sn/SN-820.mp3 Quarter size (16 kbps) mp3 audio file URL: http://media.GRC.com/sn/sn-820-lq.mp3 SHOW TEASE: It's time for Security Now!. Steve Gibson is here. We've got a great show for you. Brand new feature in Firefox. It's called Firefox Fission. Steve explains it and shows you how to turn it on. I did immediately. We'll also talk about a new form of CAPTCHA that involves playing Doom. I like this. Even has the sound. And then Steve's vision for the future of ransomware. Sort of. It's all coming up next on Security Now!. Leo Laporte: This is Security Now! with Steve Gibson, Episode 820, recorded Tuesday, May 25th, 2021: The Dark Escrow. It's time for Security Now!, the show where we cover your security, your privacy, your safety online with Mr. Steven Gibson of GRC.com. Hello, Steve. Steve Gibson: And yes, ladies and gentlemen, those of you listening and watching live, check your clocks. It's actually not quite 1:30 a.m. Wait, p.m. Leo: We're early. Shall we just stop and wait for three minutes? Steve: No, no, no, no. Let's see how much we can cram in before the clock hits 1:30 and the official start time. This is Episode 820 for May 25th. And I titled this "The Dark Escrow" just because dark is cool; you know? I mean, you can kind of have like dark anything, and it's neat. Like the dark melon. Well, maybe not that. But anyway, as a consequence of some of the aftermath of what happened with the DarkSide ransomware Security Now! Transcript of Episode #820 Page 2 of 22 when they tiptoed into the Colonial Pipeline mess, and some things that have happened since, which we're going to talk about, I have sort of some thoughts about where we're probably going to go next. So I wanted to share that. But we've got lots of interesting stuff to talk about. We've got Firefox's just-released and welcome re-architecture under codename "Fission." We've been waiting for this for a while. They're a little late to the game. It turns out - we'll talk about this - it's difficult to do what they've done. Chrome did it, and the Firefox, we've been waiting for them to follow. And it's now something that all Firefox users can turn on. I immediately did. And it's a good thing. We're going to look at a new and recently active ransomware player named Conti since they're looking like they're going to be something we'll be talking about to some degree in the future. So I thought I would introduce our listeners to Conti. And also at a recently paid, high-profile, what you would have to call literally a "mega ransom." We then ask the question, when they say IoT, do they mean us? And we examine the implications of a new industry term, "mean time to inventory." And it's not good. We'll then lighten things up a bit with a new form of CAPTCHA. And anyone who wants to cheat can - I'll tell you that it's this week's GRC shortcut. So those who've been paying attention know what the URL would be for this week's shortcut, and it's kind of fun. Then, of all things, I want to share a screensaver that I discovered, that I cannot take my eyes off of. And Leo, it's not quite as bad as whatever that game is that you cannot stop playing. But still it's absorbing more of my time than I want to admit, just sitting there, like, whoa, look at that. Leo: I don't know if staring at a screensaver's worse than playing a game. But, all right. Steve: Yeah, I'm not getting any points for it, that's for sure. Okay. Then we're going to share an ample helping of closing-the-loop feedback from our terrific listeners because there was just a bunch of stuff that came in that I wanted to share. And then we're going to conclude by predicting what I would bet we're probably going to next see emerge from the evolving ransomware business model, sad though it is to even utter the phrase "ransomware business model." Oh, and we do have a great Scott Adams cartoon as our Picture of the Week. So I think another great podcast for our listeners. And we can begin officially, now that it is now 1:30. I've had this one in the queue for a while, and I thought, yeah, now is the time. This is on the theme of being careful what you ask for. So we have a three-frame cartoon by the brilliant Scott Adams. We have the boss is addressing three of his employees. And so in the first frame we have the boss saying, "Our goal is to write bug-free software. I'll pay a $10 bonus for every bug you find and fix." And then in the middle frame we have the three employees. The first one, "Yahoo!" And then the second one says, "We're rich." And the third one says, "Yes! Yes! Yes!" And then, sort of wondering if he's come up with the right policy, we see the boss saying, "I hope this drives the right behavior." And one of the employees says, "I'm going to write me a new minivan this afternoon." So, yeah, if your employees are able to find their own bugs, well, that may not be the best way to produce bug-free software, is the point. So Firefox has finally achieved sustained Fission. Fission is Mozilla's name for full-site isolation. That is, fission of course being breaking things apart. The original design for all web browsers was as a single app running on an operating system. Or a bit more formally, a process being hosted by the OS. And the trouble was browsers have kept Security Now! Transcript of Episode #820 Page 3 of 22 growing more and more complex, to the point that the line you know has become blurred between an OS app and what a browser can do with a web page. Case in point, the other day I followed a link to a drag-and-drop mechanical electrical circuit design page where, for example, a capacitor was emulated by a balloon being filled up. An inductor was created by a flywheel. A resistor was a narrowing pipe and so on. And I initially took the page for granted, until it occurred to me that this amazing, fully animated creation was not an app in a classic sense, but this was being entirely done on a web page in my browser. And we're all kind of getting used to that. So yeah. Today's browsers have become incredibly complex and capable. But as we know, complexity is the enemy of security. It's not impossible to have both. But it turns out that it's impractically expensive to actually have both. So we get features that mostly work. And as for security, we hope for the best while we fix the flaws that are later uncovered on the fly, after the fact. But browsers are sort of a special case for problems because the presence of the near certainty of flaws as we just keep fussing with our browsers, making them more and more capable, but more and more complex, raises the specter of containment. If flaws are inevitable, then what we want is to at least contain them. The last thing we want is for a flaw to be leveraged to reach across web browser pages, or really across domains, to infect an unrelated page to leverage its access to some other site, for example, where we're logged into our banking site. We don't want some sketchy page we're visiting to be able to peruse the other tabs we have open and say, oh, look what we found here. Let's go there. And a perfect analogy is, for example, of like this problem, the need for separation is my insistence upon applying network segmentation for IoT devices which are inherently high risk.

Load more