Divers

  • Les pires mots de passe de 2019 (Génération NT: logiciels)
    Et voilà le beau classement des pires mots de passe de 2019 concocté comme de tradition par SplashData.
  • Un SSD d'iMac 2017 dans un Macbook Pro 2015, ça marche. (MacBidouille)

    Nous donnons la parole à Gilles.

    Je viens de faire un test sympa : mettre un SSD NVMe des nouveaux iMacs 2017 dans les anciens MacBook Pro...
    Et ça fonctionne plutôt bien !

    Ma machine de test est un MacBook Pro retina 15" fin 2015 2,2Ghz (MacBookPro11,4), acheté 1600 euros à la fnac quand ils étaient en promo en novembre dernier...
    Le SSD est un 2 To pièce d'origine destiné à un iMac 2017.

    Le tout sous 10.11.6

    Le SSD est parfaitement reconnu comme périphérique NVM express, il est parfaitement bootable et fonctionne très, très vite...

    voici quelques photos dans l'ordre :


    ancien SSD ahci de 512 Go



    nouveau SSD NVMe de 2 To

    infos système Apple

    disk speed test


    C'est une bonne nouvelle à relativiser car il est difficile de se procurer un tel SSD d'Apple, qui est facturé par le SAV (si l'on arrive à le commander) 1300 Euros.

    Gilles va maintenant tenter de brancher sur sa machine un SSD NVMe M2 avec un adaptateur à bas coût que l'on trouve assez facilement sur la toile.

  • Windows 10 par abonnement : retour de la rumeur avec Microsoft 365 (pour les particuliers) (Génération NT: logiciels)
    Microsoft n'a pas fait mystère d'un abonnement Microsoft 365 pour le grand public. Avec Windows 10 compris ? C'est le retour de la rumeur.
  • Microsoft offre un nouveau logo à Windows 10 (Génération NT: logiciels)
    Microsoft avait annoncé une refonte visuelle majeure de l'ensemble de ses produits et services, et voilà que l'on découvre les logos en question, y compris celui de Windows 10.
  • HP Updates Z8 Workstations: Up to 56 Cores, 3 TB RAM, 9 PCIe Slots, 1700W (AnandTech)

    HP has updated its most powerful dual-processor Z8 workstation line with the latest components. The new systems contain up to two Intel Skylake-SP Xeon CPUs with up to 56 cores in total, up to 3 TB of DDR4 RAM, terabytes of storage as well as up to 9 PCIe slots along with optional TB3 and 10 GbE support via add-in cards. The HP Z8 workstation will be the pinnacle of HP’s computers for personal and professional use and its price in high-end configurations will surpass even the top-of-the-range gaming PCs.

    Historically, most high-end workstations relied on server platforms to support more than one CPU and thus offer higher performance than any consumer desktop. The emergence of dual-core and then multi-core CPUs a little more a decade ago changed the workstation market quite quickly and significantly. In a world with quad-core CPUs, 4-way workstations did not make a lot of sense for 99% of the users and therefore they quickly became extinct. Moreover, by now, even 2-way workstations became rare. Today, the vast majority of workstations use one multi-core CPU that provides enough compute horsepower for professional workloads, whereas GPU-based accelerators are used for tasks like simulations. Nonetheless, there are still users who need maximum x86 performance and who therefore require 2-way workstations — and the HP Z8 is aimed precisely at such users. While the Intel Xeon Scalable processors with extreme core count were developed primarily with servers in mind, the Z8 is a system that people put on their desks and therefore it has a number of specific requirements regarding noise levels, features, security, compatibility with components and so on.

    One of the key components of all PCs is its microprocessor. When it comes to the HP Z8, it is based on up to two Intel Xeon Platinum 8180 with 28 cores and 205 W TDP each, which means that the system has to remove 410 W of thermal energy only from CPUs, and this requirement had a significant impact on the design of the whole system. The company did not want to use a liquid cooling system, so it had to design an air cooling solution capable of cooling down two extremely hot CPUs as well as up to 24 DDR4-2666 memory modules. Each processor has its own radiator equipped with a high-pressure air fan (which speed is regulated by BIOS in accordance with system temperature monitored by numerous sensors). In addition, the system has multiple airflow vents on the front and on the top as well as one fan that exhausts hot air on the back. According to HP, such a chassis architecture ensures that the second CPU does not re-use warm air from the first one, but since they are located in close proximity, one will always affect another with its heat. Finally, the system has additional fans that cool down other components and produce more airflow within the chassis.

    Speaking of other components, the HP Z8 supports plenty of them — whatever one might want. First off, the system has four PCIe 3.0 x16 slots for graphics cards or SSDs (up to AMD Radeon Pro, NVIDIA Quadro P100 or GP100, up to 4 TB HP Z Turbo Drive Quad Pro, etc.) three PCIe 3.0 x8 (two are non-hot swap) slots for SSDs and two PCIe 3.0 x4 slots. In addition to PCIe-based storage, the Z8 also features four 2.5”/3.5” bays for SATA/SAS SSDs or HDDs as well as two external 5.25” bays that can also accommodate drive form-factor storage devices using appropriate adapters. Those who need it, HP may also install an SD card reader as well as a slim DVD or Blu-ray ODD.

    When it comes to connectivity, the HP Z8 has all the bases covered. By default, the system supports two GbE connectors (powered by Intel controllers), an 802.11ac Wi-Fi + Bluetooth module (Intel Wireless-AC 8265 controller), two USB 3.1 Type-C ports and two USB 3.1 Type-A ports on the front, four USB 3.1 Type-A ports on the back, multi-channel audio connectors (a Realtek HD ALC221 controller) on the back, a TRRS audio connector on the front and so on. Meanwhile, owners can optionally order to install two 10 GbE controllers, a Thunderbolt 3-supporting add-in-card and a variety of custom components for various industries and workloads (an external audio solution for a 5.25” bay, for example).

    Since many businesses and enterprises require robust security for all of their machines, the HP takes everything seriously and ships the Z8 with a whole set of security features that it calls HP SureStart. The system features secure authentication, full volume encryption, TPM 2.0, has a Kensington lock and so on.

    All the CPUs, GPUs, SSDs and other components require a lot of power and HP Z8 has plenty of it. The manufacturer offers 1125 W, 1450 W or 1700 W internal PSUs with up to 90 % efficiency. The PSU is located in a compartment behind the motherboard, so chances are that HP uses proprietary units.

    General Specifications of the HP Z8 2017
      HP Z8 G4
    CPU Family Intel Xeon Scalable processor
    Models Xeon Platinum 8180 (2.5GHz/3.8GHz, 38.5MB cache, 28 cores)
    Xeon Platinum 8160 (2.1 GHz/3.7 GHz, 33 MB cache, 24 cores)
    Xeon Gold 6152 (2.1 GHz/3.7 GHz, 30.25 MB cache, 22 cores)
    Xeon Gold 6154 (3 GHz/3.7 GHz, 24.75 MB cache, 18 cores)
    Xeon Gold 6148 (2.4 GHz/3.7 GHz, 27.5 MB cache, 20 cores)
    Xeon Gold 6142 (2.6 GHz/3.7 GHz, 22 MB cache, 16 cores)
    Xeon Gold 6136 (3 GHz/3.7 GHz, 24.75 MB cache, 12 cores)
    Xeon Gold 6140 (2.3 GHz/3.7 GHz, 24.75 MB cache, 18 cores)
    Xeon Gold 6134 (3.2 GHz/3.7 GHz, 24.75 MB cache, 8 cores)
    Xeon Gold 6132 (2.6 GHz/3.7 GHz, 19.25 MB cache, 14 cores)
    Xeon Gold 6130 (2.1 GHz/3.7 GHz, 22 MB cache, 16 cores)
    Xeon Gold 6128 (3.4 GHz/3.7 GHz, 19.25 MB cache, 6 cores)
    Xeon Gold 5120 (2.2 GHz/3.2 GHz, 19.25 MB cache, 14 cores)
    Xeon Gold 5118 (2.3 GHz/3.2 GHz, 16.5 MB cache, 12 cores)
    Xeon Gold 5122 (3.6 GHz/3.7 GHz, 16.5 MB cache, 4 cores)
    Xeon Silver 4116 (2.1 GHz/3 GHz, 16.5 MB cache, 12 cores)
    Xeon Silver 4114 (2.2 GHz/3 GHz, 13.75 MB cache, 10 cores)
    Xeon Silver 4112 (2.6 GHz/3 GHz, 8.25 MB cache, 4 cores)
    Xeon Silver 4108 (1.8 GHz/3 GHz, 11 MB cache, 8 cores)
    Xeon Bronze 3106 (1.7 GHz, 11 MB cache, 8 cores)
    Xeon Bronze 3104 (1.7 GHz, 8.25 MB cache, 6 cores)
    Graphics Entry NVIDIA Quadro P400 (2 GB GDDR5)
    NVIDIA Quadro P600 (2 GB GDDR5)
    AMD FirePro W2100 (2 GB DDR3)
    Mid-Range NVIDIA Quadro P1000 (4 GB GDDR5)
    NVIDIA Quadro P2000 (5 GB GDDR5)
    AMD Radeon Pro WX 3100 (4 GB GDDR5)
    AMD Radeon Pro WX 4100 (4 GB GDDR5)
    High-End NVIDIA Quadro P4000 (8 GB GDDR5)
    AMD Radeon Pro WX 7100 Graphics (8 GB GDDR5)
    Ultra High-End NVIDIA Quadro P5000 (16 GB GDDR5X)
    NVIDIA Quadro P6000 (24 GB GDDR5X)
    AMD Radeon Pro WX 9100 Graphics (16 GB HBM2)
    NVIDIA Quadro GP100 (16 GB HBM2)
    RAM 24 DDR4 DIMMs, up to 1.5 TB of DDR4-2666
    (3TB options in H1 2018, when M CPUs are available)
    Storage Bays 4 × 2.5"/3.5", 2 × 5.25", 1 × slim 5.25" for ODDs
    Options 300 GB SAS (15000 rpm)
    500 GB up to 2 TB SATA (7200 rpm)
    500 GB SATA SED (7200 rpm)
    1 TB up to 4 TB 7200 rpm SATA Enterprise
    256 GB up to 2 TB SATA SSD
    256 GB up to 512 GB SATA SED Opal 2 SSD
    240 GB up to 480 GB SATA Enterprise SSD
    256 GB up to 1 TB HP Z Turbo Drive PCIe SSD M.2
    256 GB up to 512 GB HP Z Turbo Drive PCIe SED SSD M.2
    256 GB up to 4 TB HP Z Turbo Drive Quad Pro PCIe SSD
    HP Slim DVD-ROM
    HP Slim Blu-ray Writer
    HP Slim DVD-Writer
    Networking GbE Integrated Intel I219-LM PCIe GbE
    Integrated Intel X722 PCIe GbE
    Intel I350-T2 dual-port GbE NIC
    Intel I350-T4 dual-port GbE NIC
    Intel I210-T1 PCIe GbE
    10 GbE Intel X550-T2 dual-port GbE NIC
    Intel X710-DA2 dual-port GbE NIC
    Intel 10 GbE SFP+ SR transceiver
    HP dual-port 10GBase-T NIC
    Wireless Intel Dual Band Wireless-AC 8265 802.11a/b/g/n/ac (2x2) Wi-Fi and Bluetooth 4.2 Combo, non-vPro
    PCIe 3.0
    Expansion Slots
    x4 2
    x8 3
    x16 4
    Notes 1 PCIe x8 has rear bulkhead access and 2 PCIe x8 are internal access only. Slot 1: Transforms to PCIe x8 when 2nd CPU is installed.
    Slots 3 and 6: are available only when 2nd processor is installed.
    PCIe x16 - Available only when 2nd processor is installed
    USB 3.1 2 × Type-A, 2 × Type-C
    3.0 4 × Type-A
    2.0 unknown
    Thunderbolt Optional Thunderbolt 3 add-in-card
    Card Reader 4-in-1 card reader
    PSUs 1125 W, 1450 W, 1700 W
    Other I/O Audio connectors, Realtek HD ALC221 controller
    Input Devices HP Wireless Business Slim Keyboard and Mouse Combo
    HP USB Business Slim Keyboard
    USB Premium wired keyboard
    USB Smart Card (CCID) keyboard
    3Dconnexion CADMouse
    HP USB Optical Mouse
    HP PS/2 Mouse
    HP USB Hardened Mouse
    Dimensions 8.5 × 21.7 × 17.5 in
    21.59 × 55.12 × 44.45 cm
    Weight Starting at 49.4 lb
    Starting at 22.4 kg
    Operating System Windows 10 Pro for Workstations
    HP Installer Kit for Linux
    HP Red Hat Enterprise Linux
    Price Starting at $2,439

    Now, time to talk about availability and pricing. HP intends to ship the HP Z8 workstations in October. An entry-level model with one CPU, a basic GPU and storage will cost $2,439. Meanwhile, once the system is equipped with two Xeon Platinum 8180 CPUs, NVIDIA Quadro P100/GP100 graphics, multiple PCIe SSDs, 3 TB of DDR4 memory, several 12 TB HDDs and various advanced I/O capabilities (TB3, 10 GbE, etc.), its price will easily hit tens of thousands of dollars.

    It's normally at this point that a vendor such as HP states that the high-end models are likely to be sold under B2B contracts, where per-unit costs are not as severe. One OEM has told us that only 5% of sales of their high-end workstations come through direct sales for onlike pricing.

    Related Reading

  • Fin de Windows 7 : une alerte en plein écran mi-janvier (Génération NT: logiciels)
    La fin de support de Windows 7 est pour le 14 janvier 2020. Le 15 janvier, Microsoft le dira au plus grand nombre d'utilisateurs concernés avec l'affichage d'une notification en plein écran.
  • DDoSing a Cell Phone Network (Schneier on Security)

    Interesting research:

    Abstract: The HLR/AuC is considered to be one of the most important network elements of a 3G network. It can serve up to five million subscribers and at least one transaction with HLR/AuC is required for every single phone call or data session. This paper presents experimental results and observations that can be exploited to perform a novel distributed denial of service attack in 3G networks that targets the availability of the HLR/AuC. More specifically, first we present an experiment in which we identified and proved some zero-day vulnerabilities of the 3G network that can be exploited by malicious actors to mount various attacks. For the purpose of our experiment, we have used off-the-shelf infrastructure and software, without any specialized modification. Based on the observations of the experiment, we reveal an Advanced Persistent Threat (APT) in 3G networks that aims to flood an HLR/AuC of a mobile operator. We also prove that the discovered APT can be performed in a trivial manner using commodity hardware and software, which is widely and affordably available.

    The attack involves cloning SIM cards, then making multiple calls from different handsets in different locations with the same SIM card. This confuses the network into thinking that the same phone is in multiple places at once.

    Note that this has not been tested in the field, but there seems no reason why it wouldn't work.

    There's a lot of insecurity in the fact that cell phones and towers largely trust each other. The NSA and FBI use that fact for eavesdropping, and here it's used for a denial-of-service attack.

  • CYCLONE Hx9: NSA Exploit of the Day (Schneier on Security)

    Today's item from the NSA's Tailored Access Operations (TAO) group implant catalog:

    CYCLONE Hx9

    (S//SI//FVEY) EGSM (900MGz) macro-class Network-In-a-Box (NIB) system. Uses the existing Typhon GUI and supports the full Typhon feature base and applications.

    (S//SI//REL) Operational Restrictions exist for equipment deployment.

    (S//SI//REL) Features:

    • EGSM 900MHz
    • Macro-class (+43dBm)
    • 32+Km Range
    • Optional Battery Kits
    • Highly Mobile and Deployable
    • Integrated GPS, MS, & 802.11
    • Voice & High-speed Data
    • GSM Security & Encryption

      (S//SI//REL) Advanced Features:

      • GPS -- Supporting Typhon applications
      • GSM Handset Module -- Supports auto-configuration and remote command and control features.
      • 802.11 -- Supports high speed wireless LAN remote command and control

        (S//SI//REL) Enclosure:

        • 3.5"H x 8.5"W x 9"D
        • Approximately 8 lbs
        • Actively cooled for extreme environments

          (S//SI//REL) Cyclone Hx9 System Kit:

          • Cyclone Hx9 System
          • AC/DC power converter
          • Antenna to support MS, GPS, WIFI, & RF
          • LAN, RF, & USB cables
          • Pelican Case
          • (Field Kit only) Control Laptop and Accessories

            (S//SI//REL) Separately Priced Options:

            • 800 WH LiIon Battery Kit

              (S//SI//REL) Base Station Router Platform:

              • Overlay GSM cellular communications supporting up to 32 Cyclone Mx9 systems providing full mobility and utilizing a VoIP back-haul.
              • GPRS data service and associated application

                Unit Cost: $70K for two months

                Status: Just out of development, first production runs ongoing.

                Page, with graphics, is here. General information about TAO and the catalog is here.

                In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.

  • Mises à jour et téléchargements de la semaine (Génération NT: logiciels)
    Retrouvez notre résumé des mises à jour et téléchargements récemment proposés.
  • Votre Téléphone et Windows 10 : les appels disponibles pour tous avec Android (Génération NT: logiciels)
    Avec l'application Votre Téléphone, tous les utilisateurs de smartphone Android peuvent prendre des appels mobiles depuis leur ordinateur Windows 10.
  • Corsair Announces 16GB DDR4-4600 Vengeance LPX DRAM Kits (AnandTech)

    Corsair on Thursday announced two fresh Vengeance LPX memory kits that set new performance records for the product family. The new dual-channel memory kits are intended for Intel’s Kaby Lake-X CPUs and Intel’s X299 platforms, and they operate at DDR4-4500 and DDR4-4600 MT/s data transfer rates and require over 1.4 V.

    Corsair’s new fastest-ever DDR4 memory kits have a combined capacity of 16 GB and are rated for DDR4-4500 with CL19-19-19-39 timings at 1.45 V and for DDR4-4600 at CL19 26-26-46 at 1.5 V. Corsair verified stable performance of its DIMMs at transfer rates well beyond those recommended by JEDEC using an Intel Kaby Lake-X CPU and ASRock’s X299 OC Formula motherboard. The OC Formula motherboard only runs at one DIMM per channel (vs. 2 DPC on most X299 mainboards) in a bid to guarantee a  “cleaner” data path and stable power supply to maximize overclocking potential for DRAM. Given the increased speeds and required overvoltage over the standard, the quality of the motherboard DRAM VRM becomes crucial for stability in case of DDR4-4500 and DDR4-4600 modules. For the same reason, Corsair does not equip its ultra-fast Vengeance LPX DIMMs with RGB LEDs because they may affect power supply and stability.

    The new Corsair Vengeance LPX DDR4-4500 and DDR4-4600 memory kits are based on Samsung’s B-die, produced using 20 nm process technology. These memory ICs have been used by makers of leading-edge DDR4 memory modules (Corsair, G.Skill, GeIL, etc.) for a couple of years and by now they all know what to expect from these devices even in extreme conditions, such as operation with a 20 or 25% overvoltage.

    The new Vengeance LPX memory modules from Corsair come with regular black aluminum heat spreaders that work well with all types of CPU coolers. The embedded XMP 2.0 SPD settings to make it easy for end users to set up correct timings and sub-timings.

    Corsair's 'Extreme' Vengeance LPX Memory for Intel's X299 Platform
    Speed CL Timing Voltage Kit Capacity P/N
    DDR4-4500 CL19 19-19-39 1.45 V 2×8 GB 16 GB CMK16GX4M2F4500C19
    DDR4-4600 CL19 23-23-43 1.5 V CMK16GX4M2F4600C19

    Corsair’s new Vengeance LPX 16 GB (8 GB×2) DDR4-4500 and DDR4-4600 kits are going to hit the market in the coming days, and they are going to be expensive. The DDR4-4500 kit will retail at $479.99, whereas the DDR4-4600 kit will retail for $549.99.

    Related Reading

  • OnePlus : un Bug Bounty pour la sécurité de sa plateforme (Génération NT: logiciels)
    Comme promis après la fuite de données de novembre, OnePlus inaugure un programme de Bug Bounty pour notamment renforcer la sécurité de son site.
  • Apple ouvre à tous sa grosse chasse aux bugs de sécurité (Génération NT: logiciels)
    Juste avant la fin de l'automne, Apple ouvre comme promis son programme de bug bounty à tous les chercheurs en sécurité tiers. Il concerne notamment l'ensemble de ses systèmes d'exploitation, macOS compris.
  • Windows 10 : un énigmatique pack pour les nouvelles fonctionnalités (Génération NT: logiciels)
    Une expérience Windows Feature Experience Pack ? Une mystérieuse apparition pour Windows 10, y compris dans le Microsoft Store.
  • Running Cyrus IMAP (BSD DevCenter)
    tile imageAs laptops and mobility become more effective and prevalent, your job as a system administrator is to provide users with easy, secure access to their data. IMAP is one way to allow users to receive email wherever they go. Cyrus IMAP is a popular server, but installation and configuration is a bear. Fortunately, Francisco Reyes has the answer in this tutorial on installing and configuring Cyrus IMAP with Postfix.
  • CTL Launches New Chromebook For Education (AnandTech)

    The education sector is one area where Google’s Chromebook has proved very popular. Relatively inexpensive devices, which are easier to manage, and include just a lightweight operating system, have certainly gained a foothold there. School Divisions which have bought into the Google Apps ecosystem would seem to have an easy decision to move to Chrome OS.

    There are several companies which specialise in the education sector. CTL is one of those companies, and today they are launching a new even lower cost entry into the Chrome OS education market. The CTL Chromebook J2 and J4 for Education both feature the quad-core Cortex A17 based processor, and in this case it is the RK3288 made by Rockchip. The differentiation is laid out in the name, with the J2 featuring 2 GB of memory, and the J4 having 4 GB of RAM.

    As these are aimed at the less than forgiving student population, they are available with a three year warranty with accidental damage coverage. Also, of interest to the sector, they will come with one year of Securly content filtering and analysis, so that schools and parents can set automatic filters for approved sites. In addition, they can be bundled with the Chrome Device Management licenses, Hapara licenses, and Pearson Education Software and eTextbooks.

    These are low cost devices, and as such are outfitted with some low cost components. The J2 starts at $179, or $199 with the Chrome Device Management license. The J4 bumps the price to $209 and $229 respectively. Both feature an 11.6 inch 1366x768 matte display, 16 GB of eMMC storage, and a 1.3 MP webcam.

    CTL lists the new Chromebook at over nine hours of battery life though, which should be adequate for most school tasks. The device is relatively thin and light too, with it coming in at just 2.46 lbs (1.12 kg) and they feature an HDMI port, two USB 2.0 ports, a micro SD card slot, and 802.11ac wireless.

    While these will not be the fastest devices available with Chrome OS (for that a school would have to purchase the new Pixel) getting the price down should help out with school budgets.

    For those in education who want to check out the new devices, the CTL Chromebook for Education J2 and CTL Chromebook for Education J4 can be sourced from www.ctl.net.

    Source: CTL

  • Friday Squid Blogging: Bobtail Squid Photos (Schneier on Security)

    Pretty.

    As usual, you can also use this squid post to talk about the security stories in the news that I haven't covered.

  • Intel voudrait vendre aux enchères son portefeuille de brevets liés aux modem GMS (MacBidouille)

    Intel a annoncé son retrait du marché des modem GSM destinés aux téléphones mobiles. Sa division est en train d'être fermée et on savait qu'Apple était intéressée pas le rachat de certains de ses actifs.
    Selon IAM, la société pourrait mettre aux enchères ses portefeuilles de brevets, 6000 concernant les 3G, 4G et 5G et 1700 sur les technologies sans fil.

    C'est un trésor de guerre qui pourrait fortement intéresser Apple pour non seulement se lancer dans la production de telles puces ou pour négocier dans le futur avec Qualcomm.

  • Was the iOS SSL Flaw Deliberate? (Schneier on Security)

    Last October, I speculated on the best ways to go about designing and implementing a software backdoor. I suggested three characteristics of a good backdoor: low chance of discovery, high deniability if discovered, and minimal conspiracy to implement.

    The critical iOS vulnerability that Apple patched last week is an excellent example. Look at the code. What caused the vulnerability is a single line of code: a second "goto fail;" statement. Since that statement isn't a conditional, it causes the whole procedure to terminate.

    The flaw is subtle, and hard to spot while scanning the code. It's easy to imagine how this could have happened by error. And it would have been trivially easy for one person to add the vulnerability.

    Was this done on purpose? I have no idea. But if I wanted to do something like this on purpose, this is exactly how I would do it.

    EDITED TO ADD (2/27): If the Apple auditing system is any good, they would be able to trace this errant goto line not just to the source-code check-in details, but to the specific login that made the change. And they would quickly know whether this was just an error, or a deliberate change by a bad actor. Does anyone know what's going on inside Apple?

    EDITED TO ADD (2/27): Steve Bellovin has a pair of posts where he concludes that if this bug is enemy action, it's fairly clumsy and unlikely to be the work of professionals.

  • GENESIS: NSA Exploit of the Day (Schneier on Security)

    Today's item from the NSA's Tailored Access Operations (TAO) group implant catalog:

    GENESIS

    (S//SI//REL) Commercial GSM handset that has been modified to include a Software Defined Radio (SDR) and additional system memory. The internal SDR allows a witting user to covertly perform network surveys, record RF spectrum, or perform handset location in hostile environments.

    (S//SI//REL) The GENESIS systems are designed to support covert operations in hostile environments. A witting user would be able to survey the local environment with the spectrum analyzer tool, select spectrum of interest to record, and download the spectrum information via the integrated Ethernet to a laptop controller. The GENESIS system could also be used, in conjunction with an active interrogator, as the finishing tool when performing Find/Fix/Finish operations in unconventional environments.

    (S//SI//REL) Features:

    • Concealed SDR with Handset Menu Interface
    • Spectrum Analyzer Capability
    • Find/Fix/Finish Capability
    • Integrated Ethernet
    • External Antenna Port
    • Internal 16 GB of storage
    • Multiple Integrated Antennas

      (S//SI//REL) Future Enhancements:

      • 3G Handset Host Platform
      • Additional Host Platforms
      • Increased Memory Capacity
      • Additional Find/Fix/Finish Capabilities
      • Active Interrogation Capabilities

        Status: Current GENESIS platform available. Future platforms available when developments are completed.

        Unit Cost: $15K

        Page, with graphics, is here. General information about TAO and the catalog is here.

        In the comments, feel free to discuss how the exploit works, how we might detect it, how it has probably been improved since the catalog entry in 2008, and so on.

  • Using FreeBSD's ACLs (BSD DevCenter)
    tile imageThe standard Unix permissions scheme works fine if you have simple needs, but juggling groups and users can grow unwieldy very quickly. FreeBSD's Access Control Lists give you more control over who can access files and directories. Dru Lavigne explains how to enable, understand, and use them appropriately.
  • Mise à jour AirPort pour les bases 802.11n (MacBidouille)

    Près d'un mois après avoir proposé une mise à jour pour ses bornes AirPort 802.11ac, Apple propose maintenant son pendant pour ses anciens produits 802.11n (bornes AirPort, Time Capsule et AirPort Express).
    Il s'agit d'une mise à jour de sécurité importante à réaliser.

  • Synaptics at CES 2017: Advanced Touch and DDIC (AnandTech)

    To some extent, Synaptics is not nearly as visible to consumers as a company like Intel or Qualcomm, but their role in touch interfaces and display driver ICs is a critical part of the user experience. A touchscreen with low processing latency, truly invisible touch sensing, and excellent noise rejection isn’t really what you’ll see on billboards, but if these things aren’t done properly just about anyone will notice the results. Similarly, if a fingerprint scanner has high processing latency and doesn’t have features like learning from a partial match and noise rejection, it’ll be very noticeable if you try a device that has all of these features. Probably the best example of this was the difference in TouchID quality from the iPhone 5s and iPhone 6 to the iPhone 6s and iPhone 7.

    At CES they had a number of new things to show off. The first was a 30 dollar low profile USB fingerprint scanner, which was designed to retrofit laptops and similar devices without a fingerprint scanner in order to enable the use of Windows Hello. I went ahead and tried it and it works flawlessly from what I can see.

    Synaptics is also working on integrating a fingerprint scanner into trackpads and power buttons to enable more seamless designs instead of having a random sensor on the palmrest or somewhere similarly obvious. We also saw their FS4400 and FS4500 fingerprint scanners, which have entered mass production. These sensors enable fingerprint scanning under the glass bezel of a smartphone. There were also prototypes of fingerprint scanners on smart watches, although these prototypes are at an early stage and are more a proof of concept than anything else.

    On the automotive side, Synaptics also showed off a neat prototype that enabled force sensing with only four force sensors at the corners of the display. Judging by the state of the prototype this is only for engineering samples at this point, but may have interesting applications.

    On the DDIC side of things, Synaptics has been working on new solutions for things like large touchscreens. Using technology borrowed from their smartphone designs, they have been able to reduce the number of components and board area needed to enable large touchscreens in applications like mall kiosks.

    On the mobile side of things, the ClearView R63353 is a DDIC on glass that reduces the amount of bezel that it takes compared to previous display drivers and is currently available for sampling. The Synaptics engineers on site to discuss the issue of bezels did mention that it would be possible to drive down the amount of bezel used by moving to a chip on flex arrangement. However, I suspect that there are other engineering considerations at play as most devices, even those with thin bezels, continue to use a CoG packaging for the DDIC.

    In addition to smaller DDICs, Synaptics has also been working on enabling better OLED displays through new features like smoother dimming and software tools to emulate various subpixel arrangements to determine the best possible subpixel design given design rules. PenTile is mostly here to stay for OLED, but choosing something other than diamond subpixel arrangements can significantly reduce the amount of color shifting when changing viewing angles.

    Overall, while Synaptics doesn’t necessarily have the flashiest technologies, the kinds of things that they’re working on remain critical to the end user experience and it’s impressive to see that they continue to iterate and improve upon their products to enable a better user experience.

  • Apple 2017: Announcing a new Apple Watch Series 3, with Intel LTE/Cellular (AnandTech)

    Today at Apple’s new Steve Jobs Theatre, Apple announced its new Apple Watch, called the Series 3. This is a new model above the Series 2 announced last year, with the new headline feature being LTE support through an integrated modem, which we believe to be an Intel modem according to trusted analysts.

    With other watch makers having had LTE models, it had been one of the missing features with the Watch Series 2. Now Apple is making that leap, supporting both LTE and UTMS by using the display as the antenna, rather than internal antennas that might take up extra space. Rather than use a regular SIM, Apple is implementing an eSIM to save on size, which was demonstrated on AT&T during the presentation. To that end, Apple stated that the Watch Series 3 is only 0.25mm wider than the Watch Series 2 on the rear crystal, with all other dimensions the same. With LTE, Apple states that users can use features such as Maps, take calls, and stream Apple music.

    At the heart of the Watch Series 3 is a new processor – moving up to a dual core version over the Series 2. Apple gave very little information on the processor, except that it offers 70% more performance over the Series 2 but stays at the same size. No details on the cores inside, or the node, but with the new LTE add-in, Apple is quoting the same 18 hours of battery life with a mix of LTE, WiFi and screen-off use during that time.

    Also in the hardware is a new wireless chip, called the W2. Again Apple was light on details, except to say that it offers 85% faster WiFi combined with a 50% higher efficiency. On the health side, there is a new barometric altimeter, for calculating air pressure and detecting going up stairs.

    For software, Apple is going to launch WatchOS4 on September 19th , which will ship on the new Watch Series 3. This update will bring the heart rate detection to now display directly on the display, with an enhanced heart-rate detection mechanism that will provide resting heart rate data, calculated based on continuous data over several days. Apple will also add in notifications for users that might experience abnormal heart rates when exercise is not detected. This will be in conjunction with Apple’s new Heart Study, which will use Watch data to analyse arrhythmia in a collaboration with Stanford Medical and the FDA. The first phase of this Heart Study will be available to download in the US early next year.

    For prices, Apple gave the base Watch Series 3 as $329, but in order to have the LTE version the price increases to $399. It looks like Apple will be discontinuing the Series 2 as it was not mentioned, but the Series 1 model will still be available at $249. Orders will begin on September 15th, with availability on the 22nd.

    The Apple Watch Numbers

    During the presentation, Apple stated that the Apple Watch is now the #1 watch brand worldwide, up from #2 in 2016, supplanting Rolex. This is on the back of a 50% year-on-year growth in Apple Watch sales, with Apple citing a 97% customer satisfaction rate. Apple did not disclose the exact number of unit sales, due to bundling the numbers in with other products, and so did not disclose if the 50% YoY was on unit sales or overall revenue from accessory or app sales.

  • Office 365 gratuit pour les associations et organismes à but non lucratif (Génération NT: logiciels)
    Microsoft annonce Office 365 for Nonprofits. Les associations et organismes à but non lucratif vont pouvoir s'abonner à Office 365 gratuitement ou à prix réduit.
  • SilverStone Launches SX800-LTI: SFX-L, 800 W, 80 Plus Titanium (AnandTech)

    SilverStone has quietly published specifications of its new SFX-L power supply with 800 W output on its website. The SX800-LTI is designed for small form-factor gaming PCs that use SFX compliant PSUs and can accommodate an SFX power supply that is 3 cm deeper than specified by the standard. The novelty will be one of a few SFX-class PSUs on the market supporting multi-GPU systems and custom-built graphics cards as well as the second PSU to carry the 80 Plus Titanium label.

    Growing demand for high-performance SFF gaming PCs in the recent years has catalyzed a number of PSU suppliers to add SFX power supplies into their product lineups. In the meantime, the market of SFF gaming PCs inevitably got segmented, departing from canonical SFF computers but still not transforming into orthodox high-performance desktops. For example, there are Mini-ITX/Micro-ATX systems that can accommodate many hardware components, and there are ATX systems that can take advantage of smaller PSUs, slim/mobile ODDs and so on. Specifically for such PCs (and at requests by select customers), SilverStone last year introduced its first SFX-L PSU, which is 3 cm deeper than specified by the standard (more details at FormFactors.org), but which could provide up to 700 W of power and featured proper cooling using a 120-mm fan. The SFX-L PSUs cannot fit into traditional chassis that follow the SFX spec (for miniature desktops or DVRs/HTPCs) down to the last letter in a bid to minimize dimensions, but most gaming cases have an extra 3 cm and thus are compatible with such power supplies. This year, SilverStone is further increasing the output of its SFX-L to 800 W.

    SilverStone SFX-L Series DC Output Specifications (Rated @ 40 °C)
      SX700-LPT SX800-LTI
    Rated Combined Rated Combined
    +3.3V 22 A 120 16 A 80 W
    +5V 22 A 15 A
    +12V 58.4 A 700 W 66 A 792 W
    -12V 0.3 A 3.6 W 0.3 A 3.6 W
    +5Vsb 3 A 15 W 2.5 A 12.5 W
    Total Power 700 W 800 W

    The SilverStone SX800-LTI PSU is compliant with the SFX12V V3.3 as well as ATX12V V2.4 specifications and carries the 80 Plus Titanium certification badge (which means that it is at least 90% – 94% efficient under a 20%, 50% and 100% load for 110V), just like its predecessor. The power supply’s chassis is 125 mm wide, 63.5 mm tall, but is 130 mm deep, up from 100 mm specified by the standard. Surprisingly, SilverStone does not bundle an SFX to ATX adapter bracket with the SX800-LTI PSU (similar to its predecessor) but users can buy it separately for $17, which is odd as the adapter is bundled with less powerful SFX PSUs.

    The SX800-LTI is equipped with a 120-mm fan featuring intelligent RPM control (and speeds from 955 RPM to 1695 RPM) that does not spin at loads below 30%. The PSU has a modular design with flexible flat-type cables to ensure easy cable management. Just like other high-end PSUs, the SilverStone unit has over power, over-current, over-voltage and over-temperature protection as well as short circuit protection, and uses Japanese electrolytic capacitors rated to handle increased temperatures.

    Silverstone SFX-L PSU Series
    Connector type 700 W
    SX700-LPT
    800 W
    SX800-LTI
    ATX 24 Pin 1
    EPS 4+4 Pin 1
    PCIe 6+2 Pin 4
    SATA 9 12
    4P Molex 3
    Floppy 1

    As for connectivity, the SilverStone SX800-LTI PSU has EPS12V power connectors (one 24-pin and a 4+4-pin connector), four PCIe 6+2-pin power connectors, 12 SATA power connectors, three 4-pin Molex plugs and even an FDD header. The presence of four 8-pin (6+2) auxiliary PCIe power connectors makes the power supply compatible with all high-end graphics cards released in the recent years, including NVIDIA’s GeForce GTX cards that have up to two 8-pin power inputs, AMD’s Radeon R9 Fury X that needs two 8-pin power plugs as well as highly-custom video cards like EVGA’s GeForce GTX 980 Ti K|NGP|N that needs two 8-pin and one 6-pin connector.

    In fact, SilverStone’s SFX-L PSUs are the only SFX-class power supplies that can boast with such compatibility with advanced graphics adapters. By contrast, most gaming-grade SFX PSUs have one 8-pin connector that is enough for the vast majority of SFF gaming PCs (in the end, you cannot install more than one GTX 1080-class video cards into a Mini-ITX build), but not for those systems pack custom or multi-GPU graphics adapters.

    SilverStone’s SX800-LTI PSU is expected to hit the market in the coming weeks, but there is nothing more precise that we can share at this point. MSRP of the unit s also unknown but the previous-generation SFX-L power supply from the company, the SX700-LPT, can be obtained for $160.

    Related Reading:

  • Censorship in Dubai (Schneier on Security)

    I was in Dubai last weekend for the World Economic Forum Summit on the Global Agenda. (I was on the "Future of the Internet" council; fellow council members Ethan Zuckerman and Jeff Jarvis have written about the event.)

    As part of the United Arab Emirates, Dubai censors the Internet:

    The government of the United Arab Emirates (UAE) pervasively filters Web sites that contain pornography or relate to alcohol and drug use, gay and lesbian issues, or online dating or gambling. Web-based applications and religious and political sites are also filtered, though less extensively. Additionally, legal controls limit free expression and behavior, restricting political discourse and dissent online.

    More detail here.

    What was interesting to me about how reasonable the execution of the policy was. Unlike some countries -- China for example -- that simply block objectionable content, the UAE displays a screen indicating that the URL has been blocked and offers information about its appeals process.

  • Electromagnetic Pulse Grenades (Schneier on Security)

    There are rumors of a prototype:

    Even the highly advanced US forces hadn't been generally thought to have developed a successful pulse-bomb yet, with most reports indicating that such a capability remains a few years off (as has been the case for decades). Furthermore, the pulse ordnance has usually been seen as large and heavy, in the same league as an aircraft bomb or cruise missile warhead -- or in the case of an HPM raygun, of a weapons-pod or aircraft payload size.

    Now, however, it appears that in fact the US military has already managed to get the coveted pulse-bomb tech down to grenade size. Colonel Buckhout apparently envisages the Army electronic warfare troopers of tomorrow lobbing a pulse grenade through the window of an enemy command post or similar, so knocking out all their comms.

  • Using PC-BSD (BSD DevCenter)
    tile imageA few user-friendly distributions of FreeBSD have appeared lately. PC-BSD is one suitable for the corporate and home desktops, even those of users unfamiliar with Unix. Dru Lavigne walks through the installation and configuration of PC-BSD to provide a modern, powerful workstation.
  • Avast et AVG : les extensions de sécurité pour Firefox sont réintégrées (Génération NT: logiciels)
    Cela semble être la levée de l'interdiction. Pour Firefox, les extensions Avast Online Security et AVG Online Security ont signé leur retour.