Re: [AusNOG] Risks to country and business infrastructure

2019-09-12 Thread Chad Kelly
: Wednesday, September 11, 2019 10:26 PM To: Chad Kelly Cc: ausnog@lists.ausnog.net; ausnog-requ...@lists.ausnog.net Subject: Re: [AusNOG] Risks to country and business infrastructure The person that got access to their system was not an AWS employee when the breach happened. The person got access via

Re: [AusNOG] Risks to country and business infrastructure

2019-09-11 Thread John Edwards
The world was much simpler when ISP's could just print Invoices direct to customer printers on Windows 95 dialup connections.. On Thu, 12 Sep 2019 at 08:20, Matt Palmer wrote: > On Wed, Sep 11, 2019 at 10:25:49PM +1000, Andras Toth wrote: > > This is the same as saying it's Amazon's fault

Re: [AusNOG] Risks to country and business infrastructure

2019-09-11 Thread Matt Palmer
On Wed, Sep 11, 2019 at 10:25:49PM +1000, Andras Toth wrote: > This is the same as saying it's Amazon's fault that people make their S3 > buckets public and information gets exposed. Misconfigure it once, shame on you. Misconfigure it 1,000 times, shame on the system. Also, AWS have been doing

Re: [AusNOG] Risks to country and business infrastructure

2019-09-11 Thread Andras Toth
The person that got access to their system was not an AWS employee when the breach happened. The person got access via a misconfigured server/system that wasn't Amazon's fault. See the original court case for details: http://regmedia.co.uk/2019/07/29/capital_one_paige_thompson.pdf This is the

Re: [AusNOG] Risks to country and business infrastructure

2019-09-10 Thread Chad Kelly
On 9/11/2019 12:00 PM, ausnog-requ...@lists.ausnog.net wrote: > When someone questions whether this-or-that was predicted, this seems most > likely to indicate either the plausibility of the threat, or which side of > a closed door the questioner was on when the discussions were held. I'd worry

Re: [AusNOG] Risks to country and business infrastructure

2019-09-10 Thread Tim Sheahan
Let's all bear in mind that we're still operating within the imagination constraint of human agency. As long as we're imagining, I'd like to see more people thinking about how the rules might change in the information security sphere, if someone seems to be approaching the achievement of

Re: [AusNOG] Risks to country and business infrastructure

2019-09-10 Thread Chris Macko
Macko > *Sent:* Tuesday, 10 September 2019 1:15 PM > *To:* Phillip Grasso > *Cc:* Ausnog > *Subject:* Re: [AusNOG] Risks to country and business infrastructure > > > > Hi Phillip > > > > Thanks for that, from memory I already reached out to them the last

Re: [AusNOG] Risks to country and business infrastructure

2019-09-10 Thread Dave Fairbairn
Wouldn’t it be more realistic for someone to sneak in an EMP inside a server case? Regards Dave From: AusNOG On Behalf Of Chris Macko Sent: Tuesday, 10 September 2019 1:15 PM To: Phillip Grasso Cc: Ausnog Subject: Re: [AusNOG] Risks to country and business infrastructure Hi Phillip Thanks

Re: [AusNOG] Risks to country and business infrastructure

2019-09-09 Thread Chris Macko
Hi Phillip Thanks for that, from memory I already reached out to them the last time I mentioned this issue but I’ll try again. Have a good day. Chris On Tue, 10 Sep 2019 at 10:22 am, Phillip Grasso wrote: > suggest you work with The National Security Hotline (NSH) 1800 123 400. I > think

Re: [AusNOG] Risks to country and business infrastructure

2019-09-09 Thread Phillip Grasso
suggest you work with The National Security Hotline (NSH) 1800 123 400. I think that might be a better direction for your msg. On Fri, 6 Sep 2019 at 20:15, Chris Macko wrote: > Hi Mark, > > You do realise how easy it is to get ammonium nitrate in WA goldfields and > even easier on Australian

Re: [AusNOG] Risks to country and business infrastructure

2019-09-08 Thread Chris Macko
John, a valid and good point, thanks for sharing On Mon, 9 Sep 2019 at 8:03 am, John Edwards wrote: > A movie that details such a corporate destruction is “Fight Club” and I > note that pushing additional risk-solving process onto security staff may > have actually exacerbated that scenario. >

Re: [AusNOG] Risks to country and business infrastructure

2019-09-08 Thread John Edwards
A movie that details such a corporate destruction is “Fight Club” and I note that pushing additional risk-solving process onto security staff may have actually exacerbated that scenario. > On 6 Sep 2019, at 10:51 am, Mark Newton wrote: > > That’s a bit of a movie-plot threat, though.

Re: [AusNOG] Risks to country and business infrastructure

2019-09-08 Thread Mark Newton
On 5 Sep 2019, at 11:55 PM, Chris Macko wrote: > Examples of this include TIA942 and the Uptime Institute specs requiring > bullet proof glass yet no one has a procedure to stop 1kg let alone 100kg of > servers filled with explosives from entering our data centres disguised as > normal server

Re: [AusNOG] Risks to country and business infrastructure

2019-09-06 Thread Chris Macko
Mind you we can move that decision in our favour by boosting Darwin as hydro agricultural hub and supplying China Indonesia and India with at least 20% of their fresh fruit and veg produce. It’s an achievable plan. But our government does require to scan all incoming and outgoing containers and

Re: [AusNOG] Risks to country and business infrastructure

2019-09-06 Thread Chris Macko
Further, For now things appear to be safe but a snare has been set and things go to motion if anyone attempts to use this risk against our democratic process. I’m not at liberty to share details. As for the NT minister responsible for renting out port of Darwin to China for 100 years (and don’t

Re: [AusNOG] Risks to country and business infrastructure

2019-09-06 Thread Chris Macko
Hi Mark, You do realise how easy it is to get ammonium nitrate in WA goldfields and even easier on Australian Opal fields? Not even requirements for cctv from governance bodies for storage locations so completely lack of regard for explosives security in that area exposed. Matey pull your finger

Re: [AusNOG] Risks to country and business infrastructure.

2019-09-05 Thread Jason Xiros
Hi Chris, In no way intending to be facetious, but given the sensitive nature of your request you could at a minimum include a PGP key in your email signature. (...and I am aware of the irony that I have not either) Kind regards, Jason > Date: Thu, 5 Sep 2019 21:55:25 +0800 > From: Chris