Encryption

With HTTPS Everywhere, EFF Begins Plans to Eventually Deprecate 'HTTPS Everywhere' Extension (therecord.media) 48

Posted by EditorDavid from the extension-endings dept.
The Record reports: The Electronic Frontier Foundation said it is preparing to retire the famous HTTPS Everywhere browser extension after HTTPS adoption has picked up and after several web browsers have introduced HTTPS-only modes." "After the end of this year, the extension will be in 'maintenance mode' for 2022," said Alexis Hancock, Director of Engineering at the EFF. Maintenance mode means the extension will receive minor bug fixes next year but no new features or further development.

No official end-of-life date has been decided, a date after which no updates will be provided for the extension whatsoever.

Launched in June 2010, the HTTPS Everywhere browser extension is one of the most successful browser extensions ever released. The extension worked by automatically switching web connections from HTTP to HTTPS if websites had an HTTPS option available. At the time it was released, it helped upgrade site connections to HTTPS when users clicked on HTTP links or typed domains in their browser without specifying the "https://" prefix. The extension reached cult status among privacy advocates and was integrated into the Tor Browser and, after that, in many other privacy-conscious browsers. But since 2010, HTTPS is not a fringe technology anymore. Currently, around 86.6% of all internet sites support HTTPS connections. Browser makers such as Chrome and Mozilla previously reported that HTTPS traffic usually accounts for 90% to 95% of their daily connections.
From EFF's announcement: The goal of HTTPS Everywhere was always to become redundant. That would mean we'd achieved our larger goal: a world where HTTPS is so broadly available and accessible that users no longer need an extra browser extension to get it. Now that world is closer than ever, with mainstream browsers offering native support for an HTTPS-only mode.

With these simple settings available, EFF is preparing to deprecate the HTTPS Everywhere web extension as we look to new frontiers of secure protocols like SSL/TLS... We know many different kinds of users have this tool installed, and want to give our partners and users the needed time to transition.
The announcement also promises to inform users of browser-native HTTPS-only options before the day when the extension reaches its final sunsetting — and ends with instructions for how to activate the native HTTPS-only features in Firefox, Chrome, Edge, and Safari, "and celebrate with us that HTTPS is truly everywhere for users."
The Internet

VoIP.ms Battles Week-Long Sustained DDoS-for-Ransom Attack (bleepingcomputer.com) 37

Posted by EditorDavid from the denial-of-phone-service dept.
Slashdot reader Striek writes: VoIP.ms, a Canadian VoIP provider [also serving the US], has been under a sustained, and presumably massive DDoS attack which started on the September 16th, 2021. The attack has been disruptive enough to be covered by major media outlets, including Hacker News, ZDNet, Ars Technica, BleepingComputer, CTV News, and The Toronto Star.

They have so far refused to pay a ransom demand, which has grown from 1 bitcoin at the outset ($45,000 USD at that time), to 100 bitcoin now, or $45 million. Similar attacks have occurred recently on several UK based VOiP providers.

With DDoS attacks against VOiP infrastructure difficult to defend against — or at least more difficult than your bog-standard denial of service, this may be setting a worrying trend.
Bleeping Computer reported Monday that the attack was "severely disrupting the company's operation: As customers configured their VoIP equipment to connect to the company's domain name, the DDoS attack disrupted telephony services, preventing them from receiving or making phone calls. As DNS was no longer working, the company advised customers to modify their HOSTS file to point the domain at their IP address to bypass DNS resolution. However, this just led the threat actors to perform DDoS attacks directly at that IP address as well.

To mitigate the attacks, VoIP.ms moved their website and DNS servers to Cloudflare, and while they reported some success, the company's site and VoIP infrastructure still have issues due to the continued denial-of-service attack.
ZDNet has been following the story: In an update on Wednesday, VoIP.ms apologized to customers and confirmed it was still being targeted by what it described as a 'ransom DDoS attack' . VoIP.ms says it has over 80,000 customers in 125 countries.
And in addition, this afternoon the company's Twitter account announced that "Our main U.S. upstream carrier is currently experiencing major issues on their network affecting inbound and outbound calls and messaging to US numbers. We have already been in contact with their senior leadership team and they are on it along with their whole NOC."
Microsoft

Microsoft Rushes To Register Autodiscover Domains Leaking Credentials (bleepingcomputer.com) 20

Posted by BeauHD from the quick-before-it's-too-late dept.
Microsoft is rushing to register Internet domains used to steal Windows credentials sent from faulty implementations of the Microsoft Exchange Autodiscover protocol. BleepingComputer reports: On Monday, Guardicore's Amit Serper released new research about how the issue caused the exposure of close to 100,000 unique Windows and email credentials. When users configure their Exchange accounts on email clients, the app will attempt to authenticate to various Autodiscover URLs associated with Microsoft Exchange servers for their organization. If a successful authentication occurs, the Exchange server will send back settings that the mail client should use. However, many mail clients, including some versions of Microsoft Outlook and Office 365, incorrectly implement the Autodiscover protocol causing them to try and authenticate to third-party autodiscover.[tld] URLs that are not related to a user's organization. Examples of such domains include autodiscover.com, autodiscover.uk, and autodiscover.de. Threat actors could register autodiscover.[tld] domains and begin collecting the leaked Windows and email credentials for attacks against the organization. In response to Serper's report, Microsoft issued the following statement: "We are actively investigating and will take appropriate steps to protect customers. We are committed to coordinated vulnerability disclosure, an industry standard, collaborative approach that reduces unnecessary risk for customers before issues are made public. Unfortunately, this issue was not reported to us before the researcher marketing team presented it to the media, so we learned of the claims today."

"Since then, Microsoft has been rushing to register any autodiscover.[tld] domains it can find to prevent them from being used to steal Windows credentials," adds BleepingComputer. "At the time of this writing, [...] Microsoft registered at least 68 domains related to Autodiscover."
Security

ExpressVPN Employees Complain About Ex-Spy's Top Role At Company (reuters.com) 28

Posted by BeauHD from the internal-turmoil dept.
An anonymous reader quotes a report from Reuters: When a senior executive at virtual private network company ExpressVPN admitted to working on behalf of a foreign intelligence service to hack American machines last week, it stunned employees at his new company, according to interviews and electronic records. What ExpressVPN said after the U.S. Justice Department's deferred prosecution agreement disturbed some employees further. The company had known about Dan Gericke's history as a mercenary hacker for the United Arab Emirates. The VPN provider said it had no problem with the former intelligence operative protecting the privacy of its customers. In fact, the company had repeatedly given Gericke more responsibility at ExpressVPN even as the FBI investigation of his conduct pressed toward its conclusion.

Gericke was named chief technology officer in August, according to an internal email at the time, and remains in the post. Shortly after the court filings showed Gericke and two other former U.S. intelligence operators agreeing to pay a fine and give up any future classified work, he emailed his colleagues at ExpressVPN. "I can imagine that this kind of news is surprising or even uncomfortable," Gericke wrote in the message obtained by Reuters, then assured them that he had used his skills to protect consumers from threats to their security and privacy.

When senior company executives during a regular online question-and-answer session last Friday with employees accepted queries about Gericke's deal and then discussed the sale announced days earlier of the company to British-Israeli digital security software provider Kape Technologies PLC, the workforce vented its anger. One employee wrote anonymously on an internal chat board: "This episode has eroded consumer's trust in our brand, regardless of the facts. How do we intend to rebuild our reputation?" Asked about the controversy, ExpressVPN said in a statement that the exchange was part of a regular monthly session between management and employees. "As a company, we value openness, dialogue and transparency -which includes robust debate and incisive questioning," the company said. It said it had not known of the federal investigation or the details of Gericke's work in UAE, and it said that country's surveillance campaign was "completely antithetical to our mission."

At ExpressVPN's session with leaders Friday, the second-most supported question also concerned him. "As an individual I have a problem accepting that Dan was hired despite disclosing past actions. These actions are not small thing we can easily forget or accept. Don't they go against all the things XV stands for?" that person asked. To Reuters, the company responded: "It's only through clear commitment and contributions to our mission that Daniel has been able to earn senior leadership roles within the company and the full confidence of our co-founders."
IT

UK Airports Briefly Snarled By Border Force Software Outage (bloomberg.com) 6

Posted by msmash from the it-outages dept.
A software outage temporarily affected the U.K. Border Force's automated entry gates, slowing arrivals at airports across the country. From a report: Hubs in London Heathrow and Manchester reported issues before the Home Office said the problem was resolved. "We're aware of a systems failure impacting the e-gates, which are staffed & operated by Border Force," Heathrow said in a tweet. "This issue is impacting a number of ports of entry." Travelers reported long lines at Heathrow, with documentary filmmaker Louis Theroux describing a "human logjam" at the nation's largest airport.
IOS

Researcher Dumps Three iOS Zero-days After Apple Failed To Fix Issues for Months (therecord.media) 64

Posted by msmash from the security-woes dept.
A security researcher has published details about three iOS zero-day vulnerabilities, claiming that Apple has failed to patch the issues, which they first reported to the company earlier this year. From a report: Going by the pseudonym of Illusion of Chaos, the researcher has published their findings on Russian blogging platform Habr and has released proof-of-concept code for each vulnerability on GitHub. This includes:

1. A vulnerability in the Gamed daemon that can grant access to user data such as AppleID emails, names, auth token, and grant file system access.

2. A vulnerability in the nehelper daemon that can be used from within an app to learn what other apps are installed on a device.

3. An additional vulnerability in the nehelper daemon can also be used from within an app to gain access to a device's WiFi information.
Security

Hackers Breached Computer Network At Key US Port But Did Not Disrupt Operations (cnn.com) 17

Posted by BeauHD from the crisis-averted dept.
Suspected foreign government-backed hackers last month breached a computer network at one of the largest ports on the US Gulf Coast, but early detection of the incident meant the intruders weren't in a position to disrupt shipping operations, according to a Coast Guard analysis of the incident obtained by CNN and a public statement from a senior US cybersecurity official. CNN reports: The incident at the Port of Houston is an example of the interest that foreign spies have in surveilling key US maritime ports, and it comes as US officials are trying to fortify critical infrastructure from such intrusions. "If the compromise had not been detected, the attacker would have had unrestricted remote access to the [IT] network" by using stolen log-in credentials, reads the US Coast Guard Cyber Command's analysis of the report, which is unclassified and marked "For Official Use Only." "With this unrestricted access, the attacker would have had numerous options to deliver further effects that could impact port operations." The Port of Houston is a 25-mile-long complex through which 247 million tons of cargo move each year, according to its website.

In the case of the Port of Houston, the unidentified hackers broke into a web server somewhere at the complex using a previously unidentified vulnerability in password management software at 2:38 p.m. UTC on August 19, according to the Coast Guard report. The intruders then planted malicious code on the server, which allowed further access to the IT system. Beginning about 90 minutes after the initial breach, the hackers stole all of the log-in credentials for a type of Microsoft software that organizations use to manage passwords and access to their networks, according to the report. Minutes later, cybersecurity staff at the port isolated the hacked server, "cutting off unauthorized access to the network," the advisory said.

It's unclear who was behind the breach, which appears to be part of a broader espionage campaign. When asked about the incident at a Senate hearing on Thursday, US Cybersecurity and Infrastructure Security Agency Director Jen Easterly said she believed a foreign government-backed hacking group was responsible. Attribution of cyberattacks "can always be complicated," Easterly told the Senate Homeland Security and Governmental Affairs Committee. "At this point in time, I would have to get back with my colleagues, but I do think it is a nation-state actor."
Security

2021 Has Broken the Record For Zero-Day Hacking Attacks (technologyreview.com) 17

Posted by BeauHD from the it's-not-as-bad-as-it-sounds dept.
According to multiple databases, researchers, and cybersecurity companies who spoke to MIT Technology Review, 2021 has had the highest number of zero-day exploits on record. "At least 66 zero-days have been found in use this year, according to databases such as the 0-day tracking project -- almost double the total for 2020, and more than in any other year on record," the report says. From the report: One contributing factor in the higher rate of reported zero-days is the rapid global proliferation of hacking tools. Powerful groups are all pouring heaps of cash into zero-days to use for themselves -- and they're reaping the rewards. At the top of the food chain are the government-sponsored hackers. China alone is suspected to be responsible for nine zero-days this year, says Jared Semrau, a director of vulnerability and exploitation at the American cybersecurity firm FireEye Mandiant. The US and its allies clearly possess some of the most sophisticated hacking capabilities, and there is rising talk of using those tools more aggressively.

Attackers are exploiting the same types of software vulnerabilities over and over again, because companies often miss the forest for the trees. And cybercriminals, too, have used zero-day attacks to make money in recent years, finding flaws in software that allow them to run valuable ransomware schemes. "Financially motivated actors are more sophisticated than ever," Semrau says. "One-third of the zero-days we've tracked recently can be traced directly back to financially motivated actors. So they're playing a significant role in this increase which I don't think many people are giving credit for."

While there may be an increasing number of people developing or buying zero-days, the record number reported isn't necessarily a bad thing. In fact, some experts say it might be mostly good news. No one we spoke to believes that the total number of zero-day attacks more than doubled in such a short period of time -- just the number that have been caught. That suggests defenders are becoming better at catching hackers in the act. You can look at the data, such as Google's zero-day spreadsheet, which tracks nearly a decade of significant hacks that were caught in the wild. One change the trend may reflect is that there's more money available for defense, not least from larger bug bounties and rewards put forward by tech companies for the discovery of new zero-day vulnerabilities. But there are also better tools. Defenders have clearly gone from being able to catch only relatively simple attacks to detecting more complex hacks, says Mark Dowd, founder of Azimuth Security. "I think this denotes an escalation in the ability to detect more sophisticated attacks," he says. Further reading: Emergency Software Patches Are on the Rise
Education

Today's Students Don't Understand the Basics of Computer Operations (theverge.com) 493

Posted by msmash from the closer-look dept.
DesScorp writes:

A new article in The Verge reports that professors are increasingly seeing the rise of a generation that can't understand even the basic fundamentals of how computers and operating systems work. The very concept of things like directories, folders, and even what a file is seem to baffle a generation that was raised on Google and smartphones, and have no concept of what storage is or how it works. To this generation, all your "stuff" just goes someplace where stuff is kept. Physics professor Catherine Garland was stunned to find that her students couldn't grasp the concept of organized file storage:

"She asked each student where they'd saved their project. Could they be on the desktop? Perhaps in the shared drive? But over and over, she was met with confusion. "What are you talking about?" multiple students inquired. Not only did they not know where their files were saved -- they didn't understand the question.

Gradually, Garland came to the same realization that many of her fellow educators have reached in the past four years: the concept of file folders and directories, essential to previous generations' understanding of computers, is gibberish to many modern students.

The new generation of students sees storage as a "giant laundry basket", where everything is just thrown in, and you go get what you need when you need it. One professor now incorporates an additional two hour lecture and demo in their subject just to teach new students how things like directories work in computer systems. Teachers worry that students will be ill-prepared for professional environments, especially STEM fields, that require rigid organization to keep volumes of data organized. But some professors seem to think that they'll eventually have to surrender to how the young do things.
Youtube

YouTube Tests Video Downloads for Your Desktop Browser (theverge.com) 37

Posted by msmash from the nice-things dept.
YouTube is testing an official way to download videos on your desktop web browser. From a report: If you want to see if you're eligible for the test, which runs through October 19th, check out YouTube's experimental features page, which lists tests available for Premium subscribers. If you're opted-in and on a supported browser ("the latest versions of Chrome, Edge, or Opera," according to Google), when you're watching a video, you should see an option to download the video under the player. When you click it, YouTube will download the video, which you can then watch from the Downloads section that's accessible from the hamburger menu on the left side of the screen.
IT

Catalogue of Errors Led To $1.36 Billion of State Pension Underpayments (bbc.com) 36

Posted by msmash from the closer-look dept.
Repeated human errors made for years were to blame for a scandal which led to more than 1bn pound of state pensions not being paid, a report has concluded. BBC: The National Audit Office (NAO) said 134,000 pensioners, mostly women, were underpaid pensions because outdated computer systems led to mistakes. Among them was 74-year-old Irene Wise, who said women like her were "short-changed" for years. The government said everyone would receive what they were owed. However, the report raises huge questions for the Department for Work and Pensions (DWP) over the way the state pension system functions and the mistakes that led to such a massive shortfall in payments. Reacting to the report, Meg Hillier, who chairs the Public Accounts Committee, said: "This is not the first widespread error we have seen in the DWP in recent years. Correcting these errors comes at great cost to the taxpayer. "The DWP must provide urgent redress to those affected and take real action to prevent similar errors in future."

The problem relates to the "old" state pension system where married women who had a poor pension in their own right could claim a 60% basic state pension based on their husband's record of contributions. A review is taking place to trace those affected by systemic failures to award these pension rises, stretching back to 1985. But only some women are being fully paid. Others will only be able to claim for 12 months of missed payments. The DWP is expecting to pay the affected pensioners it can trace a total of 1.05bn pound, at an average of 8,900 pound per pensioner affected. That exercise will cost the taxpayer 25m pound in staff costs and will not be completed until the end of 2023. An estimated 40,000 affected women have already died.
Businesses

US Committee Is Reviewing Zoom's $14.7 Billion Deal For Five9 On National-Security Grounds (cnbc.com) 11

Posted by BeauHD from the foreign-participation dept.
A U.S. government committee is reviewing Zoom's agreement to acquire cloud contact center software company Five9 for $14.7 billion on national-security grounds. CNBC reports: According to a letter dated Aug. 27, the Federal Communications Commission was asked to refer the case to the Committee for the Assessment of Foreign Participation in the United States Telecommunications Service Sector. Attorney General Merrick Garland is chair of the committee. Zoom announced the deal with Five9 in July, marking the video-chat company's first billion-dollar-plus acquisition. Zoom ballooned in value during the pandemic and, with Five9's technology, is trying to expand into adjacent markets.

Zoom is based in San Jose, California, and founder and CEO Eric Yuan, a native of China, is a U.S. citizen. The company has a significant research and development hub in China, and last year House Speaker Nancy Pelosi of California referred to Zoom as "a Chinese entity" during an MSNBC interview. "USDOJ believes that such risk may be raised by the foreign participation (including the foreign relationships and ownership) associated with the application, and a review by the Committee is necessary to assess and make an appropriate recommendation as to how the Commission should adjudicate this application," David Plotinsky of the Justice Department wrote in the letter to the FCC. Zoom still expects the acquisition to close in the first half of 2022, a company spokesperson told CNBC in an email. "We have made filings with the various applicable regulatory agencies, and these approval processes are proceeding as expected," the representative said.
Security

FBI Held Back Ransomware Decryption Key From Businesses To Run Operation Targeting Hackers (washingtonpost.com) 45

Posted by BeauHD from the controversial-trade-offs dept.
An anonymous reader quotes a report from The Washington Post: The FBI refrained for almost three weeks from helping to unlock the computers of hundreds of businesses and institutions hobbled by a major ransomware attack this summer, even though the bureau had secretly obtained the digital key needed to do so, according to several current and former U.S. officials. The key was obtained through access to the servers of the Russia-based criminal gang behind the July attack. Deploying it immediately could have helped the victims, including schools and hospitals, avoid what analysts estimate was millions of dollars in recovery costs. But the FBI held on to the key, with the agreement of other agencies, in part because it was planning to carry out an operation to disrupt the hackers, a group known as REvil, and the bureau did not want to tip them off. Also, a government assessment found the harm was not as severe as initially feared. The planned takedown never occurred because in mid-July REvil's platform went offline -- without U.S. government intervention -- and the hackers disappeared before the FBI had a chance to execute its plan, according to the current and former officials. The previously unreported episode highlights the trade-offs law enforcement officials face between trying to damage cyber criminal networks and promptly helping the victims of ransomware -- malware that encrypts data on computers, rendering them unusable.
Security

Crypto Channels Targeted in Biden's Fight Against Ransomware (bloomberg.com) 19

Posted by msmash from the moving-forward dept.
The Biden administration plans a fresh campaign against ransomware attacks through sanctions to cut off criminals' cryptocurrency pipelines, and it urged companies to report extortion attempts and better protect themselves from them. From a report: Deputy Treasury Secretary Wally Adeyemo told reporters that the sanctions would be imposed on Suex, a cryptocurrency transferring service that's registered in the Czech Republic. He said Suex had "facilitated transactions involving illicit proceeds for at least eight ransomware variants. He said "exchanges like Suex are critical to attackers' ability to extract profits," pointing out that this was the first such action by the Office of Foreign Assets Control against a virtual currency exchange. Both Adeyemo and Deputy National Security Adviser Anne Neuberger, who also briefed reporters in a conference call on Monday evening, underscored the importance of ransomware victims coming forward and vulnerable businesses and organizations taking steps to bolster their security. Adeyemo announced new Treasury Department guidance that makes "an express statement that the U.S. government strongly discourages the payment of cyber ransoms or extortion demands."
Iphone

Researcher Discloses iPhone Lock Screen Bypass on iOS 15 Launch Day (therecord.media) 25

Posted by msmash from the security-woes dept.
On the day Apple released iOS 15, a Spanish security researcher disclosed an iPhone lock screen bypass that can be exploited to grant attackers access to a user's notes. From a report: In an interview with The Record, Jose Rodriguez said he published details about the lock screen bypass after Apple downplayed similar lock screen bypass issues he reported to the company earlier this year. "Apple values reports of issues like this with up to $25,000 but for reporting a more serious issue, I was awarded with $5,000," the researcher wrote on Twitter last week. [...] Because of the unprofessional way Apple handled his bug report, the researcher published today a variation of the same bypass, but this time one that uses the Apple Siri and VoiceOver services to access the Notes app from behind the screen lock. Further reading: Apple Pays Hackers Six Figures To Find Bugs in Its Software. Then It Sits On their Findings.
Microsoft

The Pandemic Made Our Workweeks Longer (axios.com) 48

Posted by msmash from the closer-look dept.
The average American's workweek has gotten 10% longer during the pandemic, according to a new Microsoft study published in Nature Human Behaviour. From a report: These longer hours are a key part of the pandemic-induced crisis of burnout at U.S. firms -- and workers are quitting in droves. Microsoft calculated the length of the workday based on the time between Teams users' first email, message or work call and their last. So the longer workweeks don't necessarily mean we're working more, the study says. People may be spending more time logged on because they are distracted with other obligations while working from home and so are less productive. This contributes to burnout because the lines between work life and home life are increasingly blurred, experts say. Further reading: Study of 61,000 Microsoft Employees Finds Remote Work Threatened Productivity and Innovation.
Security

BlackMatter Hits Grain Cooperative With Ransomware Attack (bloomberg.com) 25

Posted by msmash from the tussle-continues dept.
Iowa-based grain cooperative New Cooperative was struck by ransomware in recent days and has shut down its computer systems as it tries to mitigate the attack. From a report: The attack occurred on or around Friday, according to Allan Liska, senior threat analyst at the cybersecurity firm Recorded Future. The ransomware gang, which goes by the name BlackMatter, is demanding a $5.9 million ransom, Liska said. New Cooperative confirmed that they had been attacked and said they had contacted law enforcement and were working with data security experts to investigate and remediate the situation.

"New Cooperative recently identified a cybersecurity incident that is impacting some of our company's devices and systems," according to a statement from the cooperative. "Out of an abundance of caution, we have proactively taken our systems offline to contain the threat, and we can confirm it has been successfully contained." New Cooperative has communicated with its feed customers and is working to create workarounds to get feed to animals while its systems are down, a person familiar with the matter said.
Security

Alaska Discloses 'Sophisticated' Nation-State Cyberattack on Health Service (therecord.media) 11

Posted by msmash from the security-woes dept.
A nation-state cyber-espionage group has gained access to the IT network of the Alaska Department of Health and Social Service (DHSS), the agency said last week. From a report: The attack, which is still being investigated, was discovered on May 2, earlier this year, by a security firm, which notified the agency. While the DHSS made the incident public on May 18 and published two updates in June and August, the agency did not reveal any details about the intrusion until last week, when it officially dispelled the rumor that this was a ransomware attack. Instead, the agency described the intruders as a "nation-state sponsored attacker" and "a highly sophisticated group known to conduct complex cyberattacks against organizations that include state governments and health care entities."
Data Storage

What's the Best Ransomware Backup Solution: Disk or Tape? (esecurityplanet.com) 165

Posted by EditorDavid from the daring-RAIDs dept.
Slashdot reader storagedude writes: With the release of LTO-9, just about every tape vendor has pushed its wares as a solution to the ransomware problem. After all, is there any backup technology that's more air-gapped?

Tape IS great for backup — just not so much for recovery. Writing for eSecurity Planet, [CTO of Seagate Government Solutions] Henry Newman notes that not only is disk about 80% cheaper than LTO tape, but even an entry-level RAID card can restore data 6 times faster than tape. "Backup is not about backing up the data, but the time it takes to restore that data to meet your business requirements," writes Newman. "Tape drives are not striped, but disks generally are put into stripe groups," he writes. "With RAID controllers and/or software RAID methods, you can easily get many 10s of GB/sec of bandwidth to restore data from a single set of SAS connections. Doing that with tape is very expensive and requires architectural planning. So the bottom line is you can surely backup to tape and it is cost effective – for backup, that is. If you actually need to restore that data quickly, you have my best wishes."

Tape may have a better bit error rate than disk, but disk can be architected in a way that removes that reliability advantage, he notes. "Tape vendors often state that the BER (bit error rate) of tape is far better than disk, which is 100% true, but you can make up for tape's advantage with RAID methods that check the reliability of your data and ensure that what you wrote is what you read. This has been the case with RAID since the early 1990s, with parity check on read to validate the data. With other ANSI standard techniques – which sadly are not used often enough – such as T10 PI/DIX you can achieve data integrity on a single device equal to or greater than tape. The net-net here is disk is far faster than tape, as there is native striping that has been in use at least since the 1980s with RAID methods, and disk can achieve equal data integrity to tape."

"The most often overlooked part of data backup is the recovery part – the longer it takes to restore your data, the more damage it can do to your business," Newman writes. He concludes: "Yes, tape can be air gapped but so can disk. Does tape provide better protection against ransomware? Likely, but is it so much slower than disk that you can turn off your system and turn on when you need to. Does having slower restoration make tape a better defense against a ransomware attack? As far as I can see, the marketing claims made by tape vendors do not hold up to a rigorous engineering analysis. If you want to use tape, that is your choice and there might be good reasons, but disk-based backups can be air gapped just like tape, for lower cost and with a much faster recovery time. Why tape vendors are making claims such as this, I will leave it to readers to speculate."
But Slashdot reader BAReFO0t takes the "tape" side of the argument. "Being slower does not equal it not working as a solution at all," they argue in a comment on the original submission — adding "Also, it's not even slower, since tape can just as easily be made into a RAID. You can flood ANY bus if you just use enough mirrors, no matter the medium."

And a follow-up comment also defended tapes. "If tape meets the service level agreement and provides a reasonable risk mitigation from ransomware, then it's still a perfectly viable solution regardless of certain performance limitations. LTO development would have likely died long ago otherwise."

But what do other Slashdot readers think? Share your own experiences and opinions in the comments. What offers a better ransomware backup solution: disk or tape?
Earth

Global Computing's Carbon Footprint Is Bigger Than Previously Estimated (upi.com) 41

Posted by EditorDavid from the running-hot dept.
An anonymous reader quotes a report from UPI: According to a new study, published Friday in the journal Patterns, information and communications technology, or ICT for short, is responsible for a greater share of greenhouse gas emissions than previously estimated.

When researchers at Lancaster University analyzed earlier attempts to calculate ICT's carbon footprint, they determined scientists had failed to account for the entire life-cycle and supply chain of ICT products and infrastructure.

This would include, for example, the emissions produced by makers of ICT components, or the emissions linked with the disposal of ICT products.

Scientists have previously pegged ICT's share of greenhouse gas emissions at between 1.8% and 2.8%. But the latest findings suggest global computing is more likely responsible for between 2.1% and 3.9% of greenhouse gas emissions.

If the latest estimates are accurate, ICT would have a larger carbon footprint than the aviation industry, which is responsible for 2 percent of greenhouse gas emissions.

Slashdot Top Deals