Internet Archive Lost The Fight - ThreatWire

[@craxxysum1264]

As the old saying goes "once physical access is aquired, all bets are off"

[@anti-popfpv4638]

You don't have baby mommas like mine. Straight escorts. Social engineering my boy

[@HasturBeta]

I wonder if anyone at defcon has released a joke white paper about a new CVE that allows an attacker access to all passwords an accounts of a target and only requires being within point blank range of your target and using a revolver.

[@craxxysum1264]

​@@HasturBeta nope, but that would be awesome

[@HasturBeta]

@@craxxysum1264 Now I kinda want to write it... and in true defcon humor style have it spiral into absurdity by asking "but what happens if your target happens to also be running this exploit?" * shows slide image of two stick figures now points revolvers at each other * and so on until it's a slide of one giant stick figure mexican standoff

[@craxxysum1264]

@@HasturBeta Dude, you know what will make it even better joke, if you manage to actually get a real CVE score on it

If buying isn't owning, then duplicating isn't stealing.

[@eadweard.]

Irrelevant slogan.

[@im7254]

​@@eadweard. Archive stole nothing. Copying is never stealing anyway

[@eadweard.]

@@im7254 It is if it appropriates Cultures of Color.

[@im7254]

@@eadweard. Data is just numbers, using a number someone else used isn't stealing a number. None of the words you said mean anything to me.

[@eadweard.]

@@im7254 You mean a number like 7 or something?

[@rubberonasphalt]

Was worried for my Yubikey for a moment there... left feeling more impressed

[@DedesFewscres]

😂 I cant believe hak5 click baits. I have to get me a yubikey

[@walkinmn]

Yeah I mean, if you're in a government with access to vulnerable stuff or in charge of an international company, then yeah, this is important to consider and to update the YubiKeys, but for most of us this is not much of an issue.

[@MinnesotaCouchpotato]

​@Willam_J if you're talking about the disk detainer lock pick, you can buy it at sparrows lock picks.

[@Mastarfiin]

EXACTLY!! you stated it better than I could have. This isn't really a VULNERABILITY since Yubikey has always stated that in order to hack it (the Yubikey) hackers would need actual physical access to your Yubikey to hack it. That being said means nothing has really changed in my mind except maybe being even more impressed with the Yubikey's security.

[@Mrshutter]

​@@walkinmnnot even. The token would be considered lost and reported missing and revoked access way before you could clone it making the clone useless. Stealing a yubi key without a plan to use it immediately is a bad idea.

[@alan_marx]

The Internet Archive portal is a heritage of humanity. Future generations, when they look back, will be perplexed by the pettiness of our time.

[@IfImCommentingStopMe]

ummm, no, it's just some dude who blew off the importance of intellectual property and tried to do a thing that was obviously illegal which made a bunch of people happy who are too cheap to pay for the content they want to enjoy or too lazy to visit a library

[@IfImCommentingStopMe]

And plenty of classic titles are already available for free across various platforms

[@bernardmueller5676]

They will be perplexed by the dumbness of 99.99 percent of humans.

[@Arigriphantua]

@@IfImCommentingStopMe Intellectual property that has been out of print for decades if not centuries? Video games that are now abandonware and will never be rereleased again? Not to mention that nowadays, for example, an unattractive man simply looking at a member of the opposite persuasion leads to him being locked up. Maybe you should stop using legality as a defense.

[@thedevilsadvocate5210]

​@@IfImCommentingStopMe You must be a paid shill. You are such a lap dog. I bet you have never gone over the speed limit either. For shame on your servitude

[@anandsharma7430]

Are publishers going after the Internet Archive because they maintained an open library during the once-in-a-century pandemic when everything was locked down? Copyright started as 14 years. It lost all meaning when it crossed the period of "life of author". Now it's just another industry with regulatory capture.

[@Rickmakes]

From what I understand, they loaned out more digital copies than they had of physical copies. It was a risky move that backfired.

[@anandsharma7430]

@@Rickmakes That's not the point. It was the COVID lockdown. All laws and "due processes" were suspended indefinitely to varying degrees across varying regions.

[@KRAFTWERK2K6]

And Disney made sure the freaking Copyright laws got expanded to absurd lengths....

[@bobSeigar]

​@@anandsharma7430 You reek of entitlement.

[@knghtbrd]

The publishers' attack on the Internet Archive's emergency library create not only a moral justification, but in fact the same MORAL OBLIGATION that exists with Adobe products. I see Ally hit a nerve today. 😉

[@yumri4]

going by the legal filing of internet archive they got the wrong type of book license for the emergency national library. They got single use per book for physical book license by buying the physical books in the amount they allowed to be loaned out instead of the special license public libraries get with publishers which costs more per book and is alike to a subscription instead of you buy it you own it kind of thing. The only reason i even know that type of license exists is i have a mom who is very much into books and spends a lot of time in public libraries talking to the librarian. So it came up a few times. Is it alike to what Adobe is doing? Yes just more expensive over time even though most are pay per decade per book not Adobe's thing of pay per month per user or group of users or pay per year per user for the entire adobe suite.

[@PiDsPagePrototypes]

The provision of a short term emergency access service, with fixed start and end dates, deserves protection.

[@yumri4]

@@PiDsPagePrototypes So you want to make a new type of license that takes effect and terminates itself automatedly? That will die in court when and if a law that makes that a thing as it will give anyone and everyone a limited time license for books at however they define " a short term emergency". Right now we already have a license type that covers it. The bulk volume license USA public libraries use. Like in the bottom of my common it is a license for of 5, 10 or 20 years per book and every book needs a license. It also costs a lot more than just buying the book as it is made with the intention the book will be read from cover to cover by hundreds of people.

[@PiDsPagePrototypes]

@@yumri4 Not the intention, and I think you know that. I'll spell it out this way for everyone to be clear, If a nation or state declares an emergency, such as a natural disaster or a pandemic, then it would apply. Not laymen deciding they have a personal emergency.

[@yumri4]

@@PiDsPagePrototypes Even the laws about what powers go to who during emergencies have to be passed by congress and/or a regulatory body empowered by congress or the president to be in effect then they can be used. If we go with what you are suggesting a new type of license is needed if i am correct they got the wrong type of license for what they did.

[@GabrielTobing]

Remember, its morally right to pirate Adobe and books.

[@TheTweaker1]

I used internet archive to view my textbooks instead of having to pay hundreds of dollars to see it online. Sucks that people can't use this resource anymore..

[@SeqK]

I wish I knew prior, I could of filled a large external hard drive.

[@matthias7534]

You could easily download the textbooks for offline use

[@PatrickBryson]

Where there is will there's a way. One day the Revolt will come

[@jonbob9872]

Use 'Anna's Archive'

[@Batmann_]

@@SeqK That is a bummer, because maybe some more reading would help you figure out that "could of filled" makes zero sense.

[@V530-15ICR]

If these book publishers don't want people to read their books, then don't make books.

[@walkinmn]

They're not in the business of letting people read their books, they only care about selling books, which yes, sadly is very different and it sucks.

[@V530-15ICR]

@@walkinmn Yeah exactly. They ONLY care about money. They don't want to make people happy or to learn anything.

[@michaelgreaves2375]

Remember kids... pirate your books honestly and responsibly.

[@TheNefastor]

​@walkinmn if they could, they'd totally sell blank books with nothing on the cover and have bots give it glowing reviews.

[@BeardyMacBeardFace]

@@michaelgreaves2375 Always. Pirate it, read it, was the value worth the asking price? If yes, buy it, if not, lucky you pirated it first!

[@willm5800]

Why does watching Hak5 feel like watching a high school media broadcast???

[@jayhache5609]

Because a certain segment of society never matures beyond a 16-year-old level, but we can't say who. You know, freedom of speech and all that jazz.

[@user-qw9yf6zs9t]

​@@jayhache5609 am i too liberal to understand this i feel like id have to go to a trump rally to gain insight on how to unravel this comment

[@jayhache5609]

@@user-qw9yf6zs9t Perhaps. Trump is an effect, not the cause.

[@mendodave]

@@jayhache5609Which is vastly different than saying “Trump is in effect ” even though the two phrases are almost identical. 😉

[@usernamehandle]

Because of her vocal cadence and the static camera

[@QualityDoggo]

the exploit requires physical access, but really anytime a hardware key gets into unauthorized hands it should be reset/replaced and associated accounts checked since in some cases it may have been used to add the attacker's own key to an account

[@queenannsrevenge100]

It’s actually pretty good news the lengths attackers had to go to, since it means you have a chance to replace keys and change secrets before the original key is exploited.

[@donbluth84]

It needs physical access and from the sounds of it, quite a bit of time…this sounds to me like a “technical” exploit, but not one I would expect would happen often.

[@geroffmilan3328]

​@@donbluth84 yes, the 2 main real-world scenarios here are in espionage: nation-state or corporate They'd be targeting less frequently used Yubikeys, where a key theft might go undetected long enough for the attack to succeed. Detailed monitoring of logins by such accounts is probably the best defense

[@Kenionatus]

Potentially, keys like that could also be used to secure things like government backdoors, with the physical key making use monitorable. That falls apart when the key can be cloned. Then again, that's a level of accountability that I probably shouldn't expect from governments.

[@MrJackets]

I mean, if I've got direct physical access to your house key and car key (or even a clear enough picture [image]), you should probably change your locks as soon as you notice... any 2fa dongle is the same idea, unrestricted physical access isn't really an exploit 🤔

[@nicholaslafferty3928]

Guess they would have to take my yubikey from my cold dead hands first

[@MAcDaTHo]

easy!

[@mustangjay559]

Growing up in the 80-90s with punk and hacker culture. I never imagined the hacker space being against free speech or big government. We must remember the second we allow a government to dictate speech we welcome both side to open a police state to their beliefs.

[@indigoskywalker]

we arrived here several years ago

[@MoreEvilThanYahweh]

It's disappointing how many embraced censorship and authoritarianism "for a good cause". So many are under the delusion that only what is traditionally considered the right wing want to put a boot on us.

[@jshowao]

This is a naive request. Nobody wants unfettered and unregulated free speech, not even the US government allows it. Also, Twitter is not known to promote free speech at all given numerous examples of Elon banning journalists that criticize him and accounts publishing publicly available data of his jet. No corporate entity is free speech no matter how many times Musk lies about it

[@c1ph3rpunk]

Same, and helped build the Internet in the 90’s, I’m in security now and can say, the corporate culture has taken over.

[@jshowao]

@@c1ph3rpunk Please elaborate on what this exactly means?

[@adin_finitum]

thank you for your services! I also watch Saytonic

[@PiDsPagePrototypes]

TL;DR - It's applicable for State Agencies on hardware siezed under Warrant, or maybe hardware disposed of incorrectly.

[@deusexaethera]

"Oops, sorry, I dropped my keys on the ground and stepped on them."

[@st.john_one]

Live Long Internet Archive!!

[@Raylightsen]

Big corpos pay money for laws to be made against users. Screw corpos and their greed.

[@techwg]

Not YubiKey. Infineon created a weak link. Again. Second time Infineon cause problems. Last time there was a replacement program for effected Yubikeys to get a replacement.

[@pcartisan2721]

Great details on the YubiKey Issue.

[@coreyfro]

How much, in dollars, did Elon Musk lose as a consequence? About a Brazilian...

[@Luiz__Silva]

Ba hum tss

[@Tolcum]

This breakdown is what we needed. It's so good to put this into context

[@propeacemindfortress]

you miss the story... it's the same system used by biometric passports... yubikey is not the story here

[@RussMichaels]

Attacker would need to steal the key to do this, in which case if they have the key what's the point in cloning it. Not really much of a threat.

[@cloudyview]

Clone and replace But, it's still an extreme edge case

[@RussMichaels]

​@@cloudyviewnote how long the process takes, what would be the point in replacing the key, they will have noticed it's missing, plus it clearly states you need to destroy the key. I think the user might notice this.

[@jshowao]

Because cloning it would allow you to produce multiple copies of the same key and sell it to people over and over for profit.

[@mwatcherfl]

@@jshowao This is ... perhaps the bigger problem altogether. (?) if you and others bought one of these copies, everyone who also bought a copy with the same key signature (assuming passkey, and not MFA) could in theory log in as you/each other (?).

[@jshowao]

@@mwatcherfl Yes, they could access every account that person owns that has 2FA with the Yubikey. All Yubikey does is generate a cyclical code (kind of like the rolling codes in garage door openers) upon touch of the key or through the app. If it was copied, and you knew the username and password of the account, the 2FA on the account is now bypassable.

[@fastshuther]

This should be a constitution everyone would be a scholar and more educated "information should always be free, if not at least in 3-5 years, not entertainment, just general knowledge"

[@anandsharma7430]

All publicly funded research and results should always be free for the public but credited everywhere. Research that is based on or uses or cites publicly funded research should be free to use after a small period under 5/10 years for the private players to recuperate their costs, which should vary based on industry and constitutional rights. These terms should be decided proactively by executive govt and not have to be fought in the courts as the first step.

[@XantheFIN]

Your house should be free rest room too. Open the door COMMUNISM COMING ITS OURS NOW!

[@glytchd]

The old skool internet was "Share and share alike" "Information needs to be free"

[@William0271]

Absolutely not. So long as we have rivals such as China, or as some would claim, Russia, we should not have every new technology be open to where they can easily copy and improve on it. If there were a new theorem on rocket boosters, we shouldn't let them get a hold of it to use against us for economic or territorial gain, which is what would happen if our whole society could access the information with no barriers.

[@anandsharma7430]

@@William0271 Intellectual Property laws do not prevent enemy states from accessing information because the laws don't apply to them. Your example is not a good argument for copyright protection. A better argument would be that businesses would not invest in creative endeavours without IP laws, which would lead to stagnation in tech fields.

[@jasonjust-jason9489]

This is exactly the overview I wanted. Thank you.

[@petergerdes1094]

So it's basically a worry for people targeted by large intelligence agencies.

[@KRAFTWERK2K6]

aren't we ALL at this point?

[@vadnegru]

​@@KRAFTWERK2K6 unless you run some drug network, no

[@PinguinoDragon]

but if you already have phisical access to the key and know the first auth method key, why bother to clone the yubikey instead of just... ussing it??

[@ryanmigliori660]

If you can get fined for using a VPN. Then it's not really private.

[@darkguardian1314]

Guess I’ll have to go to Anna to “borrow” my books.😏 The Internet Archive was as the name suggested an Emergency Lending Library because of the pandemic lockdown. It’s better to lend and borrow then for readers to pirate. Publishers forcing readers hands. Amazon has a Kindle Unlimited lending library but a majority of their stuff are self published pamphlets and fictions from weekend inspiring authors of varying quality.

[@KryptKicker5]

I agree, Internet Archive shouldn't lend anything. Let's just download it. :/

[@foxriver9156]

Yubikey: ha! They have to defeat my first layer of security then, finding the dang thing in one of my many junk drawers!

[@starmap]

I enjoyed this news segment immensely.

[@bahaiwebsites]

I'm out of the loop. Where's Shannon?

[@TheSecdroid]

Steve Gibson's "Security Now" podcast

[@ernestmedina2448]

What happened to Shannon Moris she was awesome. FYI I really didn't appreciate the Ill part guess she doesn't like X formally Twitter. Wonder if she would also say ill to Twitter when it wasn't owned by Elon Musk. Think the thing people miss is they froze bank accounts this not only happened with him but also with the trucker movement in Canada and here in the US one reason for Bitcoin being such a hot Item is because of desegregation.

[@seb_gibbs]

Note that Internet Archive held the physical books for everything it shared, and only one person could access each book at any given time; ie. same as a library.

[@CM-mo7mv]

it's a feature of OK. they are a low budget company, but the tech is OK, and you can have backups

[@JuanesChiwirosky]

I can't belive that those publishers are going after Open Archive, lending digital books is very restrictive to avoid getting sued and even then they sued Open Archive, they are greedy and evil!!

[@pqsk]

Did she say X eww? 3:35

[@user-qw9yf6zs9t]

probably "x brazil" but "braz" cut off for some reason

[@camixxx]

Yeah that's what it sounds like to me. Her saying 'eww' to a company trying to uphold the freedom of speech makes her sound like a freaking id10t. So much for fighting for the free flow of information and not allowing governments to silence their citizens.

[@deusexaethera]

Does it really count as a hack if you have to use an electrical engineering lab to do it? I think yubikey users are safe for all practical purposes.

[@coisasnatv]

Every serious security professional I talk to tells me that physical security keys are nonsense. Personally, I refuse to use one.

[@deusexaethera]

Do they say why?

[@Cineenvenordquist]

Do these serious security professionals tell you to memorize sets of 30 Kanji poems?

[@coisasnatv]

@@deusexaethera "Do they say why?" Yes, one lost his home, the computer and the security keys in a flood (1 key and 2 recovery), he had to talk by phone with the representative, share personal documents, etc.; and as far as I know, he lost the account. You can do a test yourself, call support and tell them you lost your keys and computers in a flood, fire, or whatever, and see how it goes from there.

[@coisasnatv]

@@Cineenvenordquist "Do these serious security professionals tell you to memorize sets of 30 Kanji poems?" No, 26 is fine they say.

[@Cheezus]

I guess educational value is no value? A lot of these books you can't even buy anymore.

[@KRAFTWERK2K6]

Yup and that has a reason. Because all that knowledge is not allowed in a Post-Reset Era and society.

[@dennis8196]

More accurate less sensational clickbait version from Steve Gibson on Tuesdays security now podcast. TL:DR - yubikey still secure.

[@knghtbrd]

…still secure ENOUGH, for almost everybody. There's definitely folks whose threat model includes this kind of attack. Mine absolutely doesn't, I don't need to replace any devices over THIS exploit.

[@tmdrake]

just the steps to break it requires a full lab with all the right gear.

[@AdrianPatten]

💯 So much hype.

[@joto1580]

"needs physical access"... well I never thought my yubikey would still be save when physically accessed by some one else

[@ShaunVillafana]

Is it this same with the google titan keys? Do they need to be physically had and taken apart too or is there a nonlocal risk virtually as well

[@franciscoferreira-eh1yu]

Thanks for talking about the fight of Xandao The Dictator vs X

[@yanuriroschev7270]

You had me worried there....for a second at least

[@SivoTV]

Threat actors in Russia & China mostly. Recently some small outfits in the Middle East...

[@bskarpa]

I’d be more worried that if they were able to get access to the key in the first place.

[@ejakabatcheej4974]

Security Now podcast on TWIT

[@aqueleAntonino]

coughed coffee all over my keyboard at 3:36 "x... ew"

[@PhilipSHempel]

Loved that!

[@anti-popfpv4638]

Are the dolphins at it again

[@punkbuster2004]

I'm actually surprised at the effort needed to read that token !!!

[@JonMurray]

I came across a cyber security headlines KZbin channel called CISO series if that’s any use!

[@GNARGNARHEAD]

oh yeah they're great!

[@MrKeith5021]

It's still 100x more secure than a house key.

[@ltxr9973]

I guess secure hardware always has an inherent security by obscurity component to it. Quite a lot of effort required to beat a simple yubikey, it's impressive in a way.

[@davegrootwassink5191]

So Yubi needs to put an internal Faraday cage inside?

[@MinnnDe]

Fugg my mind just shuts off when the data dump begins, I think a montage walk through about like the ubikey thingy would have been helpful. Idk. maybe I'm just stoopid. 🤣

[@LTPottenger]

So the government can break in and hack me but not some guy in china with a script which is the one I worry about

[@danohanlon8316]

Or, “How to completely baffle all your customers in one easy podcast.”

[@callmebigpapa]

Unless you are targeted by a nationstate you are ok on this one (Yubi).

[@z3r0c00l2]

What locks .... Can always be unlocked 🔓

[@asificam1]

I prefer if the future uses U2F second factor authentication instead of using password-less passkeys or really any stored resident credentials for 2 reasons. First is limited number of storage slots on most keys, they may increase in the future but are still going to be less than infinite. Second is deniability and security, if you have someone's U2F key, you cannot possibly figure out which accounts that key opens without trying it on EACH account you suspect it opens... but with resident credentials, it is possible to at least know where that key goes... so if you can somehow bypass or guess the PIN... you have the key and know which lock it opens. But with U2F, you only have the key, which might be PIN secured in some cases anyhow, so you still don't know which of the billions of accounts the key opens... giving time to de-register the stolen or lost key.

[@cloudyview]

Yeah, for yubikey, the fact that you need physical access pretty much kills this 'hack'. The other requirements are also insane 😄 -Physical access -$10k+ in equipment -Significant time -Significant knowledge

[@RickGreen-p6y]

I HOPE THERE ARE STILL BRAZILIAN BUNS ON "X"

[@AnonymousVv3]

Oh this is why I have problems with people like this

[@BlockedAds]

Pretty soon hackers will be able to create an account with your face, fingerprints, ssn, mothers maiden name, your physical address, and picture ID. oh wait...

[@_BangDroid_]

I have a few security related Google Alerts set up, a few email newsletters, and whatever the algorithm wants to feed me recommended

[@john_in_phoenix]

If it requires extended physical access to the key, then they should just use the key.

[@ElektrischInkorrekt]

I have multiple places, where I get cybersecurity-news. Most of them are either pretty slow or not in english, like fefe's blog or talks directly at local conferences.

[@tesla2115]

Go X, GO Elon Musk, Go TRUMP!

[@vladx3539]

x iuh? really ?

[@ticler]

This smells like a backdoor.

[@edwinphilips5212]

Once again, thank you for providing FUD-free, non-sensationalist analysis of security news. 👏

[@JOEYCarr-o7o]

Thank you Ali . I was about to throw mine away

[@Sarge92]

translation the CIA and NSA have been using this for years

[@jrm523]

What frustrates me more than anything is the majority of people who dont care. 😢

[@KhalidALJuhani-z7u]

You hacked my mind where no security required, I Like ninja 😍

[@pehden]

Well, floatplane media would be the next best place.

[@AnonymousVv3]

Also commented before DNS / VULN

[@sfuoncall]

I listen to the Risky Business podcast with Patrick Gray. Awesome podcast

[@UNcommonSenseAUS]

This channel is garbage

[@UDIHQ]

Thanks for mentioning this! Already watched 8 :D

[@seraphuziel]

I was wondering how long it would take.

[@DaveXYZ369]

"It´s Free = not fair use" Say what now?

[@sanantohomie]

just wrap your yubikey in a gum wrapper while you use it EZPZ

[@ricead]

I have lot's of sources. MSN is actually pretty good for me. I also am a member of the 2600 group some of the original phone phreakers.

[@bjcanz]

did scheme the output of the device to replicate the action?

[@camgere]

My YubiKey is just protecting my online bank account. No biggie.

[@youruiz]

So this attack would also apply to TPM?

[@sbutcher79]

Security now with Steve Gibson and also Shannon Morse for news

[@donutwindy]

Once you have the yubikey, couldn't you just use it? Much faster than cloning it.

[@gamagama69]

this feels like a glowie backdoor tbh

[@exponentialnegative1]

Oh, I also watch Mental Outlaw, but its more history than news

[@Mrshoujo]

All Internet Archive needs to do is offload the material onto a webserver located in a country where the laws are different & thumb their noses at their opponents.

[@MrXeroliphe]

So we know it won't be used outside of nation states.

[@megamanx466]

Ars Technica isn't a bad place to get Information Age security advise from, but they aren't perfect either. 🤷‍♂ A "journal" would be the fastest and best place to find out about software/hardware exploits, but they typically have subscriptions that aren't cheap... at least if they use the typical branch of science reporting method. 🤔

[@elizabeth3280]

even easier to clone any authenticator app

[@rwg1811]

Once they have your Yubikey, why do they need to clone it???? They already got the key.

[@AlexandruCucu]

So that they give it back before you revoke access based on it 😅

[@leicaman]

So, keep it in your pocket.

[@AnonymousVv3]

Isn't banning against censorship laws

[@sethitsseth]

yeah; but what happened with your project to use github as a dating app?