Kaspersky

There was a great article from the Council on Foreign Relations regarding the hypocrisy surrounding Kaspersky since the U.S. government earlier this month banned federal agencies from using Kaspersky Lab software.  Best Buy is getting in on the action and will stop selling Kaspersky products because of possible(?) ties to the Russian government.  Why doesn’t Best Buy get rid of some of the other shit-for-security products on its shelves as well if it’s so concerned about security?

The U.S. House Science Committee received a classified briefing Tuesday related to Kaspersky.  I’d really wish some more details over the alleged collusion between Kaspersky and the Russian government would see the light of day.

And what would a Kaspersky post be without an RT link!?  ‘It’s crazy’: Kaspersky Lab attacked in US only for being Russian, says founder

Old Passwords

I went into my password vault the other day to retrieve a password.  For the application in question I had noted in the comments “old password may be ________”.  I’m not sure why I felt the need at some point to record a previous password.  This is terrible opsec practice to leave old passwords lying around.  Ask yourself, how many folks do you think use old passwords as seeds for new passwords?

monkey12 -> monkey123

password! -> password!!

mommieOct06 -> MommieDec08

Coast Guard Prints Spare Parts While at Sea

Wow, imagine the possibilities….

The U.S. Coast Guard is developing the use of 3-D printers to create spare parts on board its ships.The technology has already been used to produce spare parts, and is now being trialed more widely to print parts that are not normally kept on vessels and which may be difficult to source. The Coast Guard said this will improve mission readiness and logistical support.

“Sometimes those parts have lead times of weeks… maybe months, depending on the workload of the manufacturer,” said Captain Joseph Dugan, manager for the National Security Cutter Program.

HT: CIPS

Russians give up!

Roskomnadzor, Russia’s internet regulator, decided to end its blogger registry because it has become inefficient. In 2014, Russia passed a regulation requiring bloggers to register which would monitor their blogs for content deemed illegal. The regulation’s intent was to eliminate anonymous blogging and to curtail libel and defamation, but bloggers believed “the goal [was] to kill off the political blogosphere,” according to a popular anti-Putin blogger.

HT: https://translate.google.com/translate?sl=auto&tl=en&js=y&prev=_t&hl=en&ie=UTF-8&u=https%3A%2F%2Fwww.vedomosti.ru%2Fpolitics%2Farticles%2F2017%2F08%2F01%2F727388-roskomnadzor-reestr-blogerov&edit-text=

You did these all right?

All of these settings can be controlled via Group Policy / Local Security Policy:

1. Rename the Local Administrator Account

2. Disable the Guest Account

3. Disable LM and NTLM v1

4. Disable LM hash storage

5. Minimum password length

6. Maximum password age

7. Event logs

8. Disable anonymous SID enumeration

9. Don’t let the anonymous account reside in the everyone group

10. Enable User Account Control

HT: http://www.csoonline.com/article/3212948/windows/the-10-windows-group-policy-settings-you-need-to-get-right.html

Army Halt Use of Chinese-Made DJI Drones

Citing a worry over “cyber vulnerabilities,” the U.S. Army this week ordered that all drones built by China-based DJI, the world’s biggest drone maker, be immediately removed from Army service. The order comes following a classified study of the issue completed in May by the Army Research Laboratory, and the simultaneous release of a Navy memorandum titled “Operational Risks with Regards to DJI Family of Products.”

He says NASA and the Department of Energy have already stopped using DJI products. When Egan looked into why, he says they weren’t allowed to use the drones “because they are Chinese.”

HT: http://www.airspacemag.com/daily-planet/us-army-stops-using-chinese-made-dji-drones-180964324/