---

Weekly Axis Of Easy #170

---

Last Week’s Quote was  “Birds born in a cage think flying is an illness” by Alejandro Jodorowsky, winner was DW

This Week’s Quote: “A society that puts equality before freedom will get neither. A society that puts freedom before equality will get a high degree of both” By….???

THE RULES:  No searching up the answer, must be posted to the blog.  The place to post the answer is at the bottom of the post, in the comments section.

The Prize:  First person to post the correct answer gets their next domain or hosting renewal on us.

---

 

Drop what you’re doing AGAIN and upgrade Chrome AGAIN

This is not a misprint, as we were going to press today details emerged of another Chrome 0-day being actively exploited in the wild.  So if you’re using Chrome and you already upgraded to  86.0.4240.199 in response to CVE-2020-15999 last week, now you have to make sure you’re at version 86.0.4240.183 in response to CVE-2020-16009.

Details are hush about what it is exactly, while Google gives people a chance to upgrade before details are shared but the word on the street is that it’s a problem with Chrome’s V8 Javacript rendering engine which can lead to the dreaded remote code execution.

This probably also affects Chromium as well, including Microsoft Edge, so check your vendors.

Or just switch browsers. This is beginning to exhibit a pattern. Some users recommend Firefox, I am personally nearly all the way migrated to Brave.

Update on Chrome 0-day, Chromium, Edge also impacted

Last week we sent out a “Drop what you’re doing” issue to warn all our readers about a Chrome 0-day, CVE-2020-15999.  So hopefully you’ve taken care of that.

But what AoE reader Paul Russell points out is that CVE-2020-15999 also affects Chromium browsers, including Microsoft’s Edge, because Chromium uses the same FreeType component.  It looks like Microsoft Edge did release an update last week.


New scam using Google to send malware links

If you’ve been receiving notices and emails pushing you toward documents on Google Drive that look sketchy, you’re not alone.  A newly discovered weakness in Google Drive is being exploited by cybercrooks to send web push notifications and legit looking emails that send people toward document collaborations on Google Drive.  Those docs contain links to malware sites. 

The rest is standard issue malware infection, but the problem is that they’ve gamed Google to send out the notifications itself, and those notifications look legit, because they’re actually coming from Google.


Mailchimp will henceforth deactivate accounts sending “misinformation”

When I wrote Unassailable, I cited Mailchimp specifically as an example of a mailing list management platform that has in the past terminated accounts based solely on the content of the messages being sent.  At the time, I was referring specifically to their history of banning accounts sending so-called “anti-vaxxer” content.  As I said in the book then:

“What you or I believe about vaccinations is immaterial.  In my mind, it is indefensible for an infrastructure provider to make any subjective opinion about the content of its downstream, paying customers.  The only thing an email service should concern itself with is whether the recipient list is clean, that their user is not spamming anybody, and that the content being sent is virus free.  That’s it.”

We went on to cancel our remaining Mailchimp accounts on principle.  Mailchimp, for their part has now doubled down on this policy in their updated Terms of Service, informing THEIR CUSTOMERS that the company

“does not allow the distribution of content that is, in our sole discretion, materially false, inaccurate, or misleading, in a way that could deceive or confuse others about important events, topics, or circumstances.”

In this era of expert authorities flip-flopping and being behind the curve on such important topics as masks and lockdowns, this in essence sets up Mailchimp as yet another arbiter of truth.  And yet, mail sending services are not Twitter or Facebook.  They don’t have a quasi-monopoly on the public square the way the Big Tech platforms do.  Sending email is thankfully an open protocol with ubiquitous adaptation and thus, when Mailchimp sets themselves up to referee your content, you can ditch them. 

The alternatives may not be much better.  Klaviyo once automatically suspended our account because an issue of AxisOfEasy contained the word “Bitcoin.”  They reinstated our account, long enough for us to ditch them too. 

We now use Mautic, an open source mail marketing system that we run on one of our own VPS nodes and we don’t have to worry what über-woke busy-bodies in Silicon Valley unicorns think of our content.  If you’re using Mailchimp we suggest you think about it as well, especially if you’re going to colour outside the lines of mainstream media brainwashing narratives
 
Mautic:  https://www.mautic.org/


Canadian mall giant caught harvesting shopper images

Privacy watchdogs say that Canadian-based mall operator Cadillac-Fairview improperly gathered facial images of 5 million shoppers.  This was done via cameras installed inwherein the directory information kiosks in 12 malls across Canada.  A report by the Canadian Privacy Commissioner found that the kiosks used “Anonymous Video Analysis” (AVA) technology – which captured “temporary” digital images of faces within the field of vision of the kiosks. The images were then converted into “biometric numerical representations” of the faces and could be used to “identify individuals based on their unique facial features” and then deleted, according to the report.

Canadian Privacy Commissioner Daniel Therrien issues a statement saying that 

“Shoppers had no reason to expect their image was being collected by an inconspicuous camera, or that it would be used, with facial recognition technology, for analysis,”

Cadillac Fairview said the analysis was used to identify foot traffic patterns, including genders and ages throughout their malls but not to identify any individuals.  They had already suspended the program in 2018.

Cadillac Fairview has been owned by the Ontario Teachers Pension since 2000 and is an easyDNS client.


Trump campaign website hacked and defaced

On October 27th, the Trump campaign website at donaldjtrump .com was hacked by attackers unknown.  They defaced the homepage, replacing it with a mock seizure notice and a message that the attackers had obtained compromising material on the incumbent. 

They posted two Monero addresses and asked visitors to send crypto currency to one address to vote for withholding the material and to send crypto to the other to have it released. Monero is an alternative crypto-currency with untraceable transactions.

The website was hastily restored and the exact attack vector is not yet known.  The website uses a CMS called Expression Engine (I’m not familiar with it tbh).

This WordFence analysis does a good job describing the incident and running through the various possible attack vectors.  What I can add is that we can eliminate the possibility that the registrar was compromised and the site’s nameservers switched, as that would have updated the “Last Updated” time stamp in the Whois record, and that is currently set at June 29, 2020.

Paypal terminates ICANN registrar over alternative currency

PayPal has terminated services to ICANN registrar Epik over their use of an alternative currency.  Epik’s “Masterbucks” was rolled out by the company to provide liquidity to domainers within the Epik platform (domainers are people who invest in domain names on the aftermarket), and was fully convertible into USD.  Epik is a larger player within the domainer ecosystem and are also especially evangelical about free speech (how evangelical? They make easyDNS look like moderates by comparison). 

According to PayPal, the Masterbucks currency allowed for money laundering and tax evasion and the company purportedly notified Epik and tried to bring them into compliance for about a month before finally pulling the plug on them.  Epik alleges that PayPal is operating from an anti-Conservative bias. 


Twitter suppression debacles roll on like a slow motion car-crash

The slow motion car crash over the Hunter S. Biden laptop debacle continued to unravel last week.  A scandal in which one could make the case only became a scandal in response to Twitter and Facebook’s failed attempts to quash the story.  My gut says if they simply left it alone it would have fizzled, but instead the suppression became the story.  Twitter founder Jack Dorsey (along with Zuck and that Google guy) got hauled in front of a US Senate Judiciary Committee and grilled by Ted Cruz (R-TX), where he basically admitted that the company’s moderation policy is prone to mob rule. Twitter’s stock cratered 20%.

Twitter finally reinstated the NY Post’s account after locking them out of it for 16 days and made a symbolic gesture at even-handedness, removing a Tweet by the former Malaysian Prime Minister declaring that “Muslims have a right to be angry and kill millions of French people for the massacres of the past” (a.k.a victims of terrorism had it coming).

After all of this craziness, a mainstream media outlet in ABC finally picked up the laptop story, breaking ranks from CNN and NBC who roundly attacked them for doing so. Meanwhile, Glenn Greenwald, resigned from The Intercept, the news outlet he co-founded, over its suppression of the laptop story.  Greenwald is the journalist who broke the Edward Snowden whistleblower revelations that our governments illegally surveil everybody, all the time.

In a separate matter the US Department of Homeland Security sent a letter to @jack accusing Twitter’s moderation policies of being a national security threat after acting director of US Customs and Border Patrol (CBP) had his account suspended for tweeting about the progress of the border wall being constructed in Texas.  Twitter moderators deemed his tweet offensive.


Trudeau:  Free Speech has its limits

Speaking of how victims of terrorism bring their fates on themselves, Canada’s Prime Minister Justin Trudeau, declared without evidence, that “Free Speech is not without limits” as he hedged his condemnation of the terror attacks in France over the publication of cartoons critical of a major world religion.  Despite condemning the violence absolutely, Justin went on to chide:

“Freedom of expression is not without limits. We do not have the right, for example, to shout ‘fire!’ in a movie theatre crowded with people. There are always limits. We owe it to ourselves to act with respect for others and to seek not to arbitrarily or unnecessarily injure those with whom we are sharing a society and a planet.”

Justin’s advice contravenes both Section #2 of the Canadian Charter of Rights and Freedoms as well as the Article 19 of the United Nations Universal Declaration of Human Rights. (I think the US Constitution has something about free speech in there as well).  The upshot is you can’t cut anybody’s head off no matter how much they bug you.  Doing so would be disrespectful.


AxisOfEasy #28:  This Show has been brought to you by the letter K(leptocracy)

I thought we were all supposed to do last week’s Salon from our respective private jets and then I was the only guy who showed up in one.  Awkward.

We talked about the letter “K” – as in Kleptopia, Kleptocracy and K-shaped recovery.

Watch: https://axisofeasy.com/podcast/salon-28-todays-show-is-brought-to-you-by-the-letter-kleptrocracy/