3 ms·

Honestly, the cryptography part of it is the least concerning (if it was just that it would be an easy fix). Here's a summary with some screenshots of the code:

Honestly, the cryptography part of it is the least concerning (if it was just that it would be an easy fix). Here's a summary with some screenshots of the code: https://paul.reviews/cyberalarm-an-independent-security-review-and-why-you-should-avoid-it/ https://paul.reviews/cyberalarm-an-independent-security-revi... The entire project is an unsalvageable mess and so is their response - clearly they've outsourced the entire thing to idiots and are trying to cover their ass now that it's been publicized.

CiPHPerCoder 4y ago
I agree. This was just a write-up I promised the Twitter thread. https://twitter.com/CiPHPerCoder/status/1538574970011500546 https://twitter.com/CiPHPerCoder/status/1538574970011500546
CommieBobDole 4y ago
Wow. Worrying about the cryptography on this thing is like worrying about the quality of the padlock you're using to secure the flaps of a cardboard box.
GordonS 4y ago
I thought this might be an exaggeration, but... wow, just... wow. IMO the NPCC should sue Pervade and take them to the cleaners. Pervade are clearly incapable of developing a secure system, and have completely misrepresented their abilities. They also appear to have blatantly lied to the NPCC numerous times.
- Nextgrid 4y ago
  > NPCC should sue Pervade and take them to the cleaners You're assuming that the point was to actually deliver something of value that would help track cybercrime and that the contract was awarded fairly. I'm not sure this was the case. Most likely, the brokenness of the system is a feature to justify endless busywork for various people at all levels of the stack, where as a working implementation would not only require little/no maintenance but would actually deliver actionable evidence forcing them to do real police work.
  - GordonS 4y ago
    I can understand why you'd think that, but it's too cynical a take even for me ;) For an infosec company to behave like, there is a huge risk of completely and utterly decimating their reputation, possibly forever. My guess is that either (1), or both - (2) and (3): 1. There was skulduggery involved during the bidding process 2. Those at the NPCC responsible for awarding the contract did not have the required competence to do so 3. Those at the NPCC tasked with overseeing operations do not have the competence, or even the mindset, to do so Regardless, to call it an "absolute clusterfuck" would be generous. I'm genuinely disgusted that the NPCC and Pervade have put so many organisations in jeopardy, and furthermore that they continue to do so, even when in possession of the facts. Astonishing.
IceDane 4y ago
It's just blatantly obvious that the people building this are simply amateurs. My first guess would be that this is being built 100% by out-sourcing this to a bunch of cheap labor overseas that has no horse in this race and doesn't care about much more except getting it working. If it's not that, then someone hired a couple of interns that are woefully under-equipped(and probably underpaid).
- pessimizer 4y ago
  I'd say it's most likely that they paid a fortune to a friend, family member, business partner, or ex-coworker of the people responsible for awarding the contract. The tell will be if they react viciously to criticism, because they're afraid of investigation. Being incompetent will get you mildly reprimanded. Self-dealing might get you jailed.
_the_inflator 4y ago
According to any MBA, the possibility to do scapegoating is the most important part whenever you are doing outsourcing. It doesn't solve your problem in the first place, but hey, at least you can blame someone - psychological safety not for the faint of heart. ;)
- lovemenot 4y ago
  It's ironic that you have opted to castigate an entire cadre of people (MBA holders) rather than to focus solely on the bad behaviour (scapegoating) done by whomsoever.

CiPHPerCoder 4y ago

I agree. This was just a write-up I promised the Twitter thread. https://twitter.com/CiPHPerCoder/status/1538574970011500546 https://twitter.com/CiPHPerCoder/status/1538574970011500546

CommieBobDole 4y ago

Wow. Worrying about the cryptography on this thing is like worrying about the quality of the padlock you're using to secure the flaps of a cardboard box.

GordonS 4y ago

I thought this might be an exaggeration, but... wow, just... wow. IMO the NPCC should sue Pervade and take them to the cleaners. Pervade are clearly incapable of developing a secure system, and have completely misrepresented their abilities. They also appear to have blatantly lied to the NPCC numerous times.

Nextgrid 4y ago
> NPCC should sue Pervade and take them to the cleaners You're assuming that the point was to actually deliver something of value that would help track cybercrime and that the contract was awarded fairly. I'm not sure this was the case. Most likely, the brokenness of the system is a feature to justify endless busywork for various people at all levels of the stack, where as a working implementation would not only require little/no maintenance but would actually deliver actionable evidence forcing them to do real police work.
- GordonS 4y ago
  I can understand why you'd think that, but it's too cynical a take even for me ;) For an infosec company to behave like, there is a huge risk of completely and utterly decimating their reputation, possibly forever. My guess is that either (1), or both - (2) and (3): 1. There was skulduggery involved during the bidding process 2. Those at the NPCC responsible for awarding the contract did not have the required competence to do so 3. Those at the NPCC tasked with overseeing operations do not have the competence, or even the mindset, to do so Regardless, to call it an "absolute clusterfuck" would be generous. I'm genuinely disgusted that the NPCC and Pervade have put so many organisations in jeopardy, and furthermore that they continue to do so, even when in possession of the facts. Astonishing.

IceDane 4y ago

It's just blatantly obvious that the people building this are simply amateurs. My first guess would be that this is being built 100% by out-sourcing this to a bunch of cheap labor overseas that has no horse in this race and doesn't care about much more except getting it working. If it's not that, then someone hired a couple of interns that are woefully under-equipped(and probably underpaid).

pessimizer 4y ago
I'd say it's most likely that they paid a fortune to a friend, family member, business partner, or ex-coworker of the people responsible for awarding the contract. The tell will be if they react viciously to criticism, because they're afraid of investigation. Being incompetent will get you mildly reprimanded. Self-dealing might get you jailed.

_the_inflator 4y ago

According to any MBA, the possibility to do scapegoating is the most important part whenever you are doing outsourcing. It doesn't solve your problem in the first place, but hey, at least you can blame someone - psychological safety not for the faint of heart. ;)

lovemenot 4y ago
It's ironic that you have opted to castigate an entire cadre of people (MBA holders) rather than to focus solely on the bad behaviour (scapegoating) done by whomsoever.