Open Season - Building Syria's Surveillance State - Privacy International

Once again, here's some great work done by "Privacy International" revealing the Syrian governments repressive surveillance state. The report dives into how they perform surveillance, the middlemen involved and how the Assad regime has used technology as a weapon against their own people.

As the report mentions, "The lead up to the Arab Spring was open season for surveillance companies - they provided technologies to eager government clients widely know to be publicly engaged in repression." Seeing the tragedy of Aleppo unfold in the media, it's hard to believe how these surveillance companies sleep at night.

Take a look at the report here: https://privacyinternational.org/sites/default/files/OpenSeason.pdf

A Look Back at 2016

Here's an article I contributed to for Tripwire tying up the some of the biggest items of the year. Lots of other really good contributors on here too.

Into the Abyss - What is Upstream Surveillance?

This is infographic made by the ACLU on "Upstream Surveillance". You can read the article in it's entirety here.

CLDAP DDoS Amplification is a Thing

Just about any protocol, if not protected properly, can be abused my attackers. We've see this recently with CLDAP being used in DDoS amplification attacks across the internet. In this article, I explain what DDoS amplification is and why leaving unneeded services on the internet provides attackers ammunition to quickly launch attacks against their victims. With any amplification DDoS, attackers rely on insecure, misconfigurationed or unpatched systems sitting on the public internet to be used as a weapon in their assault. At this point, our negligence in using technology properly (patching and configuration) becomes an enabler for attackers looking to abuse them for their own gain.

What happens after a malicious link is clicked?

Most security teams are focused on how to stop people from clicking malicious links, which they should be, but I don't see enough thought on what should be done after a link has been clicked. Yes, we need to spend time implementing tools that will help prevent "click happy" people, but we also need to prepare for the inevitable. Seriously, it's going to happen and it won't stop anytime soon.

So, in this article I wrote for SearchSecurity I go over a few areas we should be thinking about after a malicious link has been clicked. I think it's equally important to know how to react to these situations as it is implementing technology that will prevent it. It's a big deal.

Love my new shirt from eff.org

Change the candidates by changing the process

In order to establish change in a nation we need to bring solutions to issues, not complaints. During the 2016 election cycle I’ve heard more gripping about the available candidates then I’ve ever heard during any other previous Presidential election. The reason citizens are voting today isn’t because they think their candidate will serve this country with respect, but because they're scared of the “other” candidate winning. People are no longer voting for candidates of quality, but being pushed to vote in fear that a candidate they dislike less will be elected. When we cast our ballot for the lesser of two evils we’re still voting for evil. That’s what people don’t seem to realize when they state this logic.

Anyway, that’s the issue, but we’re not here to just complain without action. What can we do in order to fix this this? In my opinion we need more transparency with the government. I think we’ve seen many candidates promoted based of wealth and being part of an already established agreement. With the release of documents by WikiLeaks we saw just how much of this was true within the Democratic party. When your own party leadership has to resign due to back channel deals being made to promote one candidate and suppress another it removes democracy from the people. When a candidate can make crude claims you don’t agree with personally, but it’s the party you voted for in the past and you’re now feeling remorse about your available options; we have a problem as a nation. This is what many Americans feel right now and it these two candidates that will receive the majority of the votes during this election. 

In order to add more transparency to this process and to bring about change from the people, I think we should add an additional voting option. I’ve heard many people say this election that they’re not only upset about the candidates, but so annoyed with the options they’re not voting. This is the type of outrage that our government needs to hear by the casting of ballots, but when your protest vote doesn’t get recorded how do you bring about change?

What if, this is hypothetical here, we had the option to vote “abstain” on the ballot? Many people will abstain from voting and not vote in protest, but what if your protest vote was tallied and recorded? We’ve tried to start other parties and this hasn’t really taken with the majority of Americans in a two party system, but if there was an option to vote your displeasure with the available candidates it might assist with getting better party nominees. Too many people feel the need to vote for anyone within their party, but this allows you to go outside it. The need for additional parties would be a welcome change, but having the option to show recorded protest is another I find very interesting.

Now you’re probably saying, “So what, you’re just taking a vote away from a candidate. Who cares?” Well what if we had enough people vote in this manner that the majority of the people “abstained” from selecting an available candidate? If these states or even the country isn’t satisfied with them we have it pushed to the House to vote on like they would do if a candidate doesn’t reach the 270 electoral votes. This of course isn’t perfect, but it’s an option and it gives transparency to the voting process and allows candidates to be held responsible. Essentially, this gives the power back to the people, not the party.

I’d be very interested in your thoughts.