Imagine being able to disconnect or redirect Internet traffic destined for some of the world’s biggest companies — just by spoofing an email. This is the nature of a threat vector recently removed by a Fortune 500 firm that operates one of the largest Internet backbones. //

For a long time, any changes to an organization’s routing information with an IRR could be processed via email as long as one of the following authentication methods was successfully used:

• A password is added to the text of an email to the IRR
• The requestor signs the email containing the update with an encryption key
• The requestor sends the record changes in an email to the IRR, and the authentication is based solely on the “From:” header of the email.

Of these, MAIL-FROM has long been considered insecure, for the simple reason that it’s not difficult to spoof the return address of an email. And virtually all IRRs have disallowed its use since at least 2012, said Adam Korab, a network engineer and security researcher based in Houston.

All except Level 3 Communications, a major Internet backbone provider acquired by Lumen/CenturyLink.

“LEVEL 3 is the last IRR operator which allows the use of this method, although they have discouraged its use since at least 2012,” Korab told KrebsOnSecurity. “Other IRR operators have fully deprecated MAIL-FROM.”

Importantly, the name and email address of each Autonomous System’s official contact for making updates with the IRRs is public information. //

Lumen told KrebsOnSecurity that it continued offering MAIL-FROM: authentication because many of its customers still relied on it due to legacy systems. Nevertheless, after receiving Korab’s report the company decided the wisest course of action was to disable MAIL-FROM: authentication altogether. //

While it’s nice that Lumen is no longer the weakest link in the IRR chain, the remaining authentication mechanisms aren’t great. Claffy said after years of debate over approaches to improving routing security, the operator community deployed an alternative known as the Resource Public Key Infrastructure (RPKI).

“The RPKI includes cryptographic attestation of records, including expiration dates, with each Regional Internet Registry (RIR) operating as a ‘root’ of trust,” wrote Claffy and two other UC San Diego researchers in a paper that is still undergoing peer review. “Similar to the IRR, operators can use the RPKI to discard routing messages that do not pass origin validation checks.”

However, the additional integrity RPKI brings also comes with a fair amount of added complexity and cost, the researchers found. //

Dave
November 26, 2021

The problem with RPKI as a security mechanism is that they handed the problem of securing BGP over to a bunch of X.509 fanboys, and so the result was something that looked suspiciously like X.509…. no, I stand corrected, it is X.509. It’s an attempt to use an X.509 certificate in a way that was never designed for, combined with the mass of other problems that make X.509 such a joy to use.

People have always explored and modified the technologies in their lives, whether crystal radios, automobiles, or computer software. Reverse engineering is one expression of this tinkering impulse. Unfortunately, legal regulation of reverse engineering can impact the Freedom to Tinker in a variety of ways. This FAQ gives some information that may help coders reduce their legal risk.

“The East India Company was no apparition though; it was the template for many subsequent corporations […] Liberals betray themselves […] the moment they turn a blind eye to this kind of hyper-concentrated power. […] This is why trading in apples does not come even close to trading in shares. Large quantities may produce, at worse, lots of bad cider, but large amounts of money invested in liquid shares can release demonic forces that no market or state can control.”
― Yanis Varoufakis, Another Now: Dispatches from an Alternative Present

Built of cobbled hubris and copied code we sail a vast uncharted ocean of extremely hungry sharks, no “plan” at any point but sink or swim, and no rudder. Greater speed the only virtue and destination. You can imagine how it goes, when it does. The looks on people’s faces in the inconvenient reality. Wherever this course leads, faster. More coal to the boilers now. Release date approaches.

While many children who do catch COVID have few to no symptoms, those with underlying health conditions may be at increased risk of severe illness. //

Taiwan has temporarily suspended giving second doses of the Pfizer-BioNTech vaccine to children and adolescents between 12 and 17 years over concerns from the risk of myocarditis (inflammation of the heart muscle) and pericarditis (inflammation of the outer lining of the heart), according to media reports. //

In Norway, which is not part of the EU, the Pfizer-BioNTech vaccine has been approved for those aged 12 to 15. But health authorities have paused the rollout of second doses, partly due to a rare side effect linked to heart inflammation. //

Since the beginning of the pandemic, children represented 16.9 percent of all confirmed cases, according to the American Academy of Pediatrics. In the week ending November 18, children made up 25.1 percent of reported cases. Children make up 22.2 percent of the US population.

Holy Night” has to be one of the most-sung Christmas songs out there and why not? It’s a pretty song with theologically rich verses and a high note that feels like a tightrope walk for even the most gifted vocalists. But what a lot of people don’t know is that the Christmas Carol has a long legacy of being an anthem of abolitionism.

In 1843, a French poet and wine merchant named Placide Cappeau was commissioned to write a Christmas piece to celebrate the renovation of a church organ in his hometown. Cappeau was keen on the idea, even though he himself was an atheist, and wrote “Minuit, chrétiens,” or “Midnight, Christians.” The music was supplied by a Jewish composer named Adolphe Adams and the song became a holiday hit in France in spite of — or maybe because of — its author’s socialist leanings.

Many took to social media to share their frustration at the royal figure’s sentiment, with some connecting the statement to “eco-fascism” – a theory that argues humans are overburdening the planet and that some populations are more responsible than others. //

Heather Alberro, a lecturer in global sustainable development at Nottingham Trent University, told Al Jazeera that equating population growth with climate change, or conservation, is a complex issue.

“Focusing only on human numbers functions as a red herring,” she said. “What research increasingly shows is that extreme poverty, socioeconomic inequality and capitalist systems predicated on endless growth for maximising shareholder value are greater predictors of ecological decline.

“Is it any wonder [then], that a poacher, driven by poverty and the lucrative price tag associated with ivory, would be compelled to kill an elephant?”

Alberro explained that the narrative on blame needed to shift. Instead, she argued, the focus should be on how global inequities are at the heart of the climate crisis.

“Reckoning with the ongoing, violent legacies of colonial capitalism, which continue to drive the exploitation of people, places, resources, other species, is an important first step towards truly transformative change,” she said.

“The irony is that recent research has found that Indigenous peoples are often the best stewards of ecosystems.” //

Josina’s collective focuses on building relationships with the land, particularly for people from Black and Brown communities, that “exist beyond the dynamics of extraction”.

“‘Conservation’ comes from a very colonial time. It treats people who are living there as feckless and worthy of being kicked off the land,” Josina added.

“Some of the most dangerous narratives come from upper-class environmentalists. It’s not just Prince William; it’s not just his father, it’s also David Attenborough, it’s also Jane Goodall,” they said, referring to the British broadcaster and natural historian, and English primatologist.

“All these people promote this idea that it’s other people irresponsibility, that it’s poor people’s responsibility.”

Scott Morefield
@SKMorefield
QAnon Shaman gets 41 months in prison for walking around the Capitol.

Leftist Antifa member gets probation & a fine for taking an axe to a senator's door, and the FBI even returned the axe.

Sounds about right.

8:42 PM · Nov 29, 2021 //

Starks pled guilty to the destruction of government property. Federal sentencing guidelines recommended that he get between 10-16 months. But instead, he was given probation and only had to pay $2,784 in restitution. He even got the ax he used in the commission of the offense back. Starks mocked the FBI for giving the ax back to him. //

More differences? Starks got to raise money for his defense on GoFundMe while the effort to raise money for Kyle Rittenhouse was pulled by GoFundMe officials.

Three North Dakota Democratic officials even donated to Starks. //

We are a country based on the rule of law, which includes the concept of equal treatment under the law. But when we see things like this, it eats away and erodes that basic foundational principle of our government. It makes us question if there still is that equal treatment under the law or whether your politics determine how you will be treated. It would be an incredibly dangerous thing to lose that cornerstone on which we were built.