Hacker Factor

I'm Neal Krawetz, a computer security specialist and forensic researcher. I run FotoForensics, Hintfo, and RootAbout. Sleep is not necessary.

Website: https://hackerfactor.com/?social=noc.social
Blog: https://hackerfactor.com/blog/
FotoForensics: https://fotoforensics.com/
Hintfo: https://hintfo.com/

Public Key

npub1juzxwk54l455a96gh2ujty02wt3urjhht4q2uwzq8ctjvt26e88q7sse9n

NIP-05 Address

hackerfactor_at_noc.social@momostr.pink

Profile Code

nprofile1qqsfwpr8t22l662wjayt4wf9j8489c7petm46s9w8pqru9ex94dvnnsprpmhxue69uhhyetvv9ujumt0d4hhxarj9ecxjmntqyvhwumn8ghj7un9d3shjtnddakk7um5wgh8q6twdvhslvev2a

Publishing to

relay.momostr.pink

Author Public Key

npub1juzxwk54l455a96gh2ujty02wt3urjhht4q2uwzq8ctjvt26e88q7sse9n

Show more details

Last Notes

2024-09-18 05:26:22

The Hacker Factor Blog: Throwing a Red Flag https://www.hackerfactor.com/blog/index.php?/archives/1043-Throwing-a-Red-Flag.html

2024-09-11 21:43:41

I wish I was making this up. This really just happened.
https://noc.social/system/media_attachments/files/113/121/099/719/763/621/original/c695ba8b75fa7b18.png

2024-09-08 18:45:16

The Hacker Factor Blog: The Watermarking Paradox https://www.hackerfactor.com/blog/index.php?/archives/1042-The-Watermarking-Paradox.html

2024-09-06 19:13:25

- reply

They're still trying, but it's much slower. 40,728 requests for the same 4 pages in the last 13 hours.

2024-09-06 19:10:37

- reply

I use nginx. I added:
if ($http_user_agent ~ (facebook.com/)) { return 418 "418 I'm a teapot\n"; }

2024-09-06 15:32:06

- reply

Lots of blog entries on this:
https://hackerfactor.com/blog/index.php?/archives/1022-Catching-Flies-with-Honey.html
https://hackerfactor.com/blog/index.php?/archives/997-No-NOC-Networking-Part-3.html
As far as setup: For this honeypot, I registered a new domain name (years ago), put up a minimal web site, and enabled tons of tracking and logging.
Since it's not advertised or mentioned anywhere, all the bots find it organically. (I haven't identified how Facebook found it.)

2024-09-06 13:03:46

- reply

I have a tracking token in the URL:
https:// mysite/path/file?time=$time
That's it. Most bots are smart enough to recognize and ignore this. Facebook used to be smart too. But something changed yesterday and they now think they are ALL different web pages that need indexing!

2024-09-06 12:59:49

- reply

It's not one IP! It's over 350 different IPs, all from AS32934 (Facebook).
You know how rack servers crank up the fans when under a high load? Facebook pinned the fans at max. (Sounded like a jet taking off.)
My solution: Block the user-agent string in the sites-available file and return a "418 I'm a teapot". Fans immediately dropped to the idle rate.
It's been 7 hours. Facebook is STILL trying but has slowed down to 30,000 requests in 7 hours.

2024-09-06 05:42:47

- reply

I'm not kidding. Over 106,798 URLs requested in the last few hours. It's the exact same 5 URLs, but with a different tracking parameter each time.
$ grep 05/Sep/2024 access.log | grep facebook.com | wc
106951 1711216 23969257

2024-09-06 05:27:57

OMG... Facebook found one of my honeypots and is going crazy! Its crawler is caught in an infinite loop. I can't believe it, I needed to add in a rule to block Facebook's crawler from my honeypot.

2024-09-03 19:12:54

I keep hearing about AI being used to replace artists, writers, creators, editors, fact checkers, accountants, etc. How soon before AI replaces CEOs and other executives?

2024-08-30 02:44:58

- reply

Amazing how apt everything she says still is. And, OMG, she's incredibly funny!

2024-08-28 19:47:37

- reply

I had a manager tell me that my cubicle pranks were getting out of hand. People were afraid to take time off because they didn't know what they would come back to. (Imagine 100+ people in a department, and nobody taking time off.) 🤣

2024-08-27 22:53:31

Many years ago, I worked in a cubicle farm. We'd do pranks when people took time off. For one of my coworkers, I had the department fill his cubicle with pink and blue balloons, some said "It's a boy!" or "It's a girl!"
One coworker remarked: "I didn't know he was taking time off for a new child!" My reply: "Child? He's not even seeing anyone as far as I know! He's just on vacation." This is "2 gross bags" of balloons (almost 300).
https://noc.social/system/media_attachments/files/113/036/433/161/209/807/original/ebc430c7d70a4c27.jpeg

2024-08-25 23:27:14

- reply

The EU law you cited has the same problem. It defines the scope of the problem and what is forbidden (good). But never uses the word "CSAM" (or spelled out). So if the warrant required CSAM, then CSAM is not defined and the request can be ignored.

2024-08-25 13:48:54

- reply

Not trying to defend Telegram.
While "CSAM" is the preferred term these days, it is not well-defined and not in any legal statute. CSAM includes some content that may be disgusting, but is not illegal. The only legal definitions in federal law are in 18 USC 2251, 2251a, 2252, 2252a, 2252b, and 2260. None of these laws mention "CSAM".

2024-08-25 02:51:55

Oh no! One of my RAID hard drives just got 4 bad sectors. (Sudden bad sectors usually means the drive is dying.) How long has this drive been in continuous use? 13 years.

2024-08-25 01:19:50

- reply

"Greatest Hits from 1720" -- the entire album.

2024-08-23 18:50:22

The Hacker Factor Blog: Game of Life https://www.hackerfactor.com/blog/index.php?/archives/1041-Game-of-Life.html

2024-08-19 12:18:08

LinkedIn "download all of my information" doesn't download any of the media you have posted.

2024-08-09 16:17:38

- reply

I just posed a new blog entry showing how CBC/Radio-Canada's C2PA example fails to authenticate. Can you explain to me how CBC's example does NOT show a fundamental failure with C2PA?
https://www.hackerfactor.com/blog/index.php?/archives/1040-C2PA-and-the-CBC.html

2024-08-08 15:26:01

- reply

If you're going to be validating the authenticity using something other than C2PA, then why use C2PA?
C2PA is no more reliable than an EXIF comment or XMP text field containing the name and attribution. C2PA is added complexity for no added value. It keeps honest people honest, but does nothing to deter dishonest people.

2024-08-07 23:28:16

- reply

Or worse:
1. You think you trust Nadia.
2. Malory takes a Nadia photo and backdates it, claiming that Nadia plagiarized it.
Provide it wasn't plagiarized since both signatures are valid.

2024-08-07 23:24:58

- reply

1. Malory hates Nadia and buys a C2PA-equipped camera.
2. Malory sets it to claim to be Nadia and takes a photo.
3. Malory sends the fake Nadia photo to you (maybe even impersonating Nadia's email) and says that Nadia got a new camera.

2024-08-05 17:19:44

- reply

Oh, and a specific attack against your scenario? Sure!
https://hackerfactor.com/blog/index.php?/archives/1037-C2PA-and-Untrusted-Certificates.html. Scroll down to the section "See One, Do One, Teach One". There's an example that does it.

2024-08-05 01:26:49

- reply

Reading over your 2023 write-up, it definitely sounds like you've been drinking the Kool-Aid. You wrote that you're not a crypto expert. Here's a surprise for you: neither are the people who created C2PA. (If they were, then they wouldn't be trying to bypass the crypto security by using X.509 certs wrong, ignoring expiration dates, issuing their own root certs, etc.) They don't follow the X.509 standard and they don't follow industry best practices.

2024-08-05 01:26:49

- reply

2024-08-05 01:17:25

- reply

You can disagree, but then how do you account for working examples of forgeries using tools provided by C2PA members? (I don't just say there are problems; I demonstrate the problems.)
Creating a forged signing certificates: https://www.hackerfactor.com/blog/index.php?/archives/1037-C2PA-and-Untrusted-Certificates.html
Altering "cryptographically signed" timestamps with nothing more than hexedit: https://www.hackerfactor.com/blog/index.php?/archives/1031-C2PA-from-the-Attackers-Perspective.html
And a long list of other vulnerabilities: https://www.hackerfactor.com/blog/index.php?/archives/1010-C2PAs-Butterfly-Effect.html
In my opinion, C2PA is nothing more than snake oil.