Tag Archives: Uncategorized

US Treasury Department Sanctions Chinese Company Over Cyberattacks

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2025/01/us-treasury-department-sanctions-chinese-company-over-cyberattacks.html

From the Washington Post:

The sanctions target Beijing Integrity Technology Group, which U.S. officials say employed workers responsible for the Flax Typhoon attacks which compromised devices including routers and internet-enabled cameras to infiltrate government and industrial targets in the United States, Taiwan, Europe and elsewhere.

re:Invent 2024 DevOps and Developer Productivity Playlist

Post Syndicated from Brian Beach original https://aws.amazon.com/blogs/devops/reinvent-2024-devops-and-developer-productivity-playlist/

The dust has settled after another re:Invent. I once again had the privilege of organizing the DevOps and Developer Productivity (DOP) track along with Jessie VanderVeen, Krishna Dalal, Megan Sattler and countless others. For 2024, the DOP track included 60 sessions. If you weren’t able to attend, I have compiled a list of the on-demand sessions for you below.

DOP220 Reimagining the Developer Experience at AWS – Software development is undergoing a seismic shift driven by generative AI, transforming how developers work, what they build, and who can become a developer. AWS empowers developers to fearlessly embrace this evolution, integrating cutting-edge yet responsible generative AI solutions across the development lifecycle. Explore real-world use cases accelerating legacy modernization, elevating cloud-native innovation, and unlocking remarkable results. Gain insights into AWS’s pragmatic approach, fueling creativity and customer impact. Join the vibrant community on this transformative journey, where generative AI is redefining software development, opening new frontiers for innovation, and democratizing access to coding for diverse creators shaping technology’s future.

DOP201 AWS infrastructure as code: A year in review – AWS provides services that enable the creation, deployment and maintenance of application infrastructure in a programmatic, descriptive, and declarative way. These services provide rigor, clarity, and reliability to application development. Join this session to learn about the new features and improvements for AWS infrastructure as code with AWS CloudFormation and AWS Cloud Development Kit (AWS CDK) and discover how they can benefit your team.

DOP202 Continuous integration and continuous delivery (CI/CD) for AWS – AWS provides one place where you can plan work, collaborate on code, and build, test, and deploy applications with continuous integration and continuous delivery (CI/CD) tools. In this session, learn about creating complete CI/CD pipelines using infrastructure as code on AWS.

DOP203 Governance and security with infrastructure as code – In this session, learn how to use AWS CloudFormation and the AWS CDK to deploy cloud applications in regulated environments while enforcing security controls. Find out how to catch issues early with cdk-nag, validate your pipelines with cfn-guard, and protect your accounts from unintended changes with CloudFormation Hooks.

DOP204 Amazon Q Developer: Your gen AI assistant for software development In this session, learn how Amazon Q Developer is transforming the developer experience by speeding up a range of tasks that support you as you research how to get started, evaluate system design, build secure and scalable applications, upgrade existing applications, and optimize application performance. Learn firsthand how Amazon Q capabilities for building, troubleshooting, and transforming applications faster and more easily frees you up to focus on experimentation and innovation.

DOP208 Accelerate .NET porting from Windows to Linux with Amazon Q Developer – Are you dreading the complexity and costs of migrating legacy .NET applications from Windows to Linux? Generative AI can help. In this session, learn how Amazon Q Developer transformation capabilities now automate .NET modernization tasks like dependency analysis and version upgrades, reducing costs by up to 40%. Explore how to rapidly port .NET applications to Linux, transition away from Windows, and break free of the security issues, rising license costs, and challenges with scaling—all while freeing your teams to focus on high-impact features that deliver business value.

DOP209 Accelerate application maintenance and upgrades with generative AI Developers spend significant time completing the undifferentiated work of maintaining and upgrading legacy applications. Teams need to balance investments in building new features with mandatory patching and update work. Now, using the power of generative AI, the Amazon Q Developer agent for code transformation can expedite these critical upgrade tasks, transforming applications to use the latest language features and versions in hours or days and saving significant costs. Join the session to learn what’s new and how your team can automate Java application upgrades.

DOP210 Accelerate multi-step SDLC tasks with Amazon Q Developer Agents While existing AI assistants focus on code generation with close human guidance, Amazon Q Developer has a unique capability called agents that can use reasoning and planning capabilities to perform multi-step tasks beyond code generation with minimal human intervention. Its agent for software development can solve complex tasks that go beyond code suggestions, such as building entire application features, refactoring code, or generating documentation. Join this session to discover new agent capabilities that help developers go from planning to getting new features in front of customers even faster.

DOP211 Optimize your AWS operations with generative AI and Amazon Q Developer Unlock the power of Amazon Q Developer to streamline your AWS operations. In this session, discover how to use this innovative tool within the AWS console to accelerate deployment, configuration, troubleshooting, and more across AWS Lambda, Amazon ECS, Amazon EC2, Amazon S3, and beyond. Harness first-party skills for Amazon Redshift, AWS Glue, and Amazon VPC, and explore third-party integrations with Wiz and Datadog. Gain insights into optimizing your AWS environments and supercharging operational tasks, empowering you to work smarter, not harder.

DOP213 Amazon Q Developer, Amazon Inspector & AI remediation for secure SDLCElevate your security posture with AWS offerings across the software development lifecycle (SDLC). Use Amazon Q Developer in the IDE to scan code before committing, Amazon CodeGuru in the CI/CD pipeline to block insecure deployments, and Amazon Inspector at runtime for continuous scanning. Harness the power of generative AI to automate remediation of security findings. This session demonstrates how to seamlessly integrate these services, empowering you to proactively identify and mitigate vulnerabilities throughout the SDLC, ensuring robust security from code to production.

DOP214 Unleashing generative AI: Amazon’s journey with Amazon Q Developer Join us to discover how Amazon rolled out Amazon Q Developer to thousands of developers, trained them in prompt engineering, and measured its transformative impact on productivity. In this session, learn best practices for effectively adopting generative AI in your organization. Gain insights into training strategies, productivity metrics, and real-world use cases to empower your developers to harness the full potential of this game-changing technology. Don’t miss this opportunity to stay ahead of the curve and drive innovation within your team.

DOP215 Next-generation CDK development with Amazon Q DeveloperThe AWS Cloud Development Kit (AWS CDK) has emerged as a powerful infrastructure as code tool, but building custom high-level constructs can be challenging. This session demonstrates how to leverage Amazon Q Developer, an AI-powered assistant for software development, to create tailored CDK constructs that encapsulate cloud architecture patterns. Learn to design effective constructs, utilize Amazon Q’s features for automated documentation and testing, and explore customization options to optimize the developer experience with infrastructure as code using AWS CDK and Amazon Q Developer.

DOP216 Customize Amazon Q Developer to speed up enterprise development Significantly accelerate development by customizing Amazon Q Developer. Generate even more relevant inline code recommendations and chat responses (in preview) by making it aware of your internal libraries, APIs, best practices, and architectural patterns. Save time building new features, refactoring code, improving application performance, or onboarding to a new codebase. In this session, learn how you can take advantage of Amazon Q Developer and your internal codebases to improve your developer experience and productivity. Also learn how National Australia Bank is using Amazon Q Developer to enable their development teams to ship faster and innovate more for their customers.

DOP217 Best practices for customizing Amazon Q DeveloperWith Amazon Q Developer, you can securely connect to your private repositories to generate even more relevant code recommendations based on your internal code repositories, ask questions about your company code, and understand your internal code bases faster. In this session, learn how to set up customizations and generate code based on your internal repos. Use the Amazon Q Developer chat in your IDE to ask questions about how your internal code base is structured, where and how certain functions or libraries are used, and how to use specific functions, methods, or APIs.

DOP218 Ship faster with Amazon Q Developer agent for software development With Amazon Q Developer, you can securely connect to your private repositories to generate even more relevant code recommendations based on your internal code repositories, ask questions about your company code, and understand your internal code bases faster. In this lightning session, you’ll learn how to set up customizations and generate code based on your internal repos. We’ll also use the Amazon Q Developer chat in the IDE to ask questions about how your internal code base is structured, where and how certain functions or libraries are used, or how to use specific functions, methods, or APIs.

DOP221 Modernize mainframe applications faster using Amazon Q Developer – Modernizing and migrating mainframe applications to cloud can require prolonged efforts including assessment, planning, and project execution. Generative AI can simplify and accelerate the journey. This session provides an overview of how Amazon Q Developer transformation capabilities can intelligently automate many of the burdensome steps involved in code base analysis, code documentation, code decomposition, modernization planning, and code refactoring, and can assist modernization consultants and mainframe teams with intelligent guidance rooted in mainframe and cloud expertise. Learn how modernization teams can focus on higher-value tasks with less undifferentiated heavy lifting and deliver modernized cloud-based applications fueling agility and innovation.

DOP223 What’s new with Amazon Q Developer agents Amazon Q Developer– agent capabilities can perform a range of tasks with minimal input—from implementing features and documenting and refactoring code to performing software upgrades. In this session, learn about the newly launched capabilities of the Amazon Q Developer agents. With a deep understanding of your code base, the agents can now help you generate in-depth documentation from source code, iteratively create unit tests across your code base, automatically perform code reviews, and assess the deployment risk of your code updates. See how these new capabilities can help you significantly speed up your entire software development lifecycle and ship higher-quality code to your customers.

DOP224 Accelerate modernization of VMware workloads using Amazon Q Developer – Ready to learn about how the new Amazon Q Developer transformation capabilities can simplify and automate the modernization and migration of VMware environments to AWS? This session shows you how Amazon Q Developer accelerates transformation projects from discovery, planning, and replatforming to deploying your VMware environments in Amazon EC2. Learn how the generative AI–powered capabilities help you scale and innovate by streamlining VMware migrations to AWS in a matter of months. Gain insights into how modernization teams can reduce undifferentiated heavy lifting, be more productive, and deliver business value faster.

Gift Card Fraud

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2024/12/gift-card-fraud.html

It’s becoming an organized crime tactic:

Card draining is when criminals remove gift cards from a store display, open them in a separate location, and either record the card numbers and PINs or replace them with a new barcode. The crooks then repair the packaging, return to a store and place the cards back on a rack. When a customer unwittingly selects and loads money onto a tampered card, the criminal is able to access the card online and steal the balance.

[…]

In card draining, the runners assist with removing, tampering and restocking of gift cards, according to court documents and investigators.

A single runner driving from store to store can swipe or return thousands of tampered cards to racks in a short time. “What they do is they just fly into the city and they get a rental car and they just hit every big-box location that they can find along a corridor off an interstate,” said Parks.

Casino Players Using Hidden Cameras for Cheating

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2024/12/casino-players-using-hidden-cameras-for-cheating.html

The basic strategy is to place a device with a hidden camera in a position to capture normally hidden card values, which are interpreted by an accomplice off-site and fed back to the player via a hidden microphone. Miniaturization is making these devices harder to detect. Presumably AI will soon obviate the need for an accomplice.

Today I should have been ninety four

Post Syndicated from Григор original http://www.gatchev.info/blog/?p=2658

Нещо, което ще е добре да си припомняме занапред. Ще ни трябва.
За мой срам, не зная кой е авторът.

Today I should have been ninety four,
I would be having a party with cake
I’d have two fine sons and a daughter too
Grandchildren to cuddle and stay.
I’d have met a great man, dashing and tall
He’d have worked in an office in town
We’d have lived in the country, two dogs and a cat
I’d have had a fine wedding gown.
Margot would have lived nearby,
Surely a mother herself?
My mother and father would have been so proud
We’d have raised a glass to good health.
Instead we slept on wooden slats
As we shivered with hunger and cold
We were beaten for any discriminatory thing
We were given no toys to hold.
My mother was starving, she gave us her food
Scabies was rife in our camp
I wanted to die, this wasn’t life
Living with rats in the damp.
My best friend was in the camp next door
I missed her riotous laugh
I was glad to have my sister with me
Loneliness, was my first and my last.
I dreamed of food that I could eat
I wished for potatoes and meat
If I survived, I’d wash it all down
With wine and something sweet.
Typhus arrived and we both got sick
Doctors were never called in
We died one by one, Margot went first
Death was an easier win.
I hope I didn’t die in vain
I hope the world has learned
Hatred has no place in life
My diary forever preserved.

In honour of Anne Frank 12.06.1929 – 1945

Spyware Maker NSO Group Found Liable for Hacking WhatsApp

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2024/12/spyware-maker-nso-group-found-liable-for-hacking-whatsapp.html

A judge has found that NSO Group, maker of the Pegasus spyware, has violated the US Computer Fraud and Abuse Act by hacking WhatsApp in order to spy on people using it.

Jon Penney and I wrote a legal paper on the case.

Hacking Digital License Plates

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2024/12/hacking-digital-license-plates.html

Not everything needs to be digital and “smart.” License plates, for example:

Josep Rodriguez, a researcher at security firm IOActive, has revealed a technique to “jailbreak” digital license plates sold by Reviver, the leading vendor of those plates in the US with 65,000 plates already sold. By removing a sticker on the back of the plate and attaching a cable to its internal connectors, he’s able to rewrite a Reviver plate’s firmware in a matter of minutes. Then, with that custom firmware installed, the jailbroken license plate can receive commands via Bluetooth from a smartphone app to instantly change its display to show any characters or image.

[…]

Because the vulnerability that allowed him to rewrite the plates’ firmware exists at the hardware level­—in Reviver’s chips themselves—Rodriguez says there’s no way for Reviver to patch the issue with a mere software update. Instead, it would have to replace those chips in each display.

The whole point of a license plate is that it can’t be modified. Why in the world would anyone think that a digital version is a good idea?

Short-Lived Certificates Coming to Let’s Encrypt

Post Syndicated from Bruce Schneier original https://www.schneier.com/blog/archives/2024/12/short-lived-certificates-coming-to-lets-encrypt.html

Starting next year:

Our longstanding offering won’t fundamentally change next year, but we are going to introduce a new offering that’s a big shift from anything we’ve done before—short-lived certificates. Specifically, certificates with a lifetime of six days. This is a big upgrade for the security of the TLS ecosystem because it minimizes exposure time during a key compromise event.

Because we’ve done so much to encourage automation over the past decade, most of our subscribers aren’t going to have to do much in order to switch to shorter lived certificates. We, on the other hand, are going to have to think about the possibility that we will need to issue 20x as many certificates as we do now. It’s not inconceivable that at some point in our next decade we may need to be prepared to issue 100,000,000 certificates per day.

That sounds sort of nuts to me today, but issuing 5,000,000 certificates per day would have sounded crazy to me ten years ago.

This is an excellent idea.

Slashdot thread.

Upcoming Speaking Events

Post Syndicated from B. Schneier original https://www.schneier.com/blog/archives/2024/12/upcoming-speaking-events-2.html

This is a current list of where and when I am scheduled to speak:

The list is maintained on this page.