|
ate all the Oreos posted:im the well-named and properly self-documenting backdoor functions better documented than my coworkers' code (thousand lines long sql scripts, commentless)
|
#
?
Sep 18, 2017 14:43
|
|
|
|
| # ? May 15, 2024 17:42 |
|
|
aug 15th- sep 12th means a lot of shoddy it support companies doing updates post-emotet 'fixed' a lot of machines
|
|
#
?
Sep 18, 2017 14:54
|
|
|
Cocoa Crispies posted:gg on shipping the debug symbols they didn't ship the debug symbols, just the link to the debug symbols: a UUID and the original path to the PDB file. what's worrying is that they apparently compromised one of the developer machines, because it appears the malware was built there
|
|
#
?
Sep 18, 2017 14:55
|
|
|
on the other hand: that looks like the symbols for the installer itself, not the malware part, which is probably just a self-contained .obj dropped somewhere on the build machine and sneakily added to the linker's command line. from how it's described to work, it's trivial to make it self-contained: the payload is saved in a big static array, and the bootstrap function is registered as a TLS constructor by declaring a pointer to it in one of the specially named sections that the linker merges to form the array of TLS constructors
|
|
#
?
Sep 18, 2017 15:02
|
|
|
in the wild memory leak in apache for non-default configs: https://blog.fuzzing-project.org/60-Optionsbleed-HTTP-OPTIONS-method-can-leak-Apaches-server-memory.html
|
|
#
?
Sep 18, 2017 15:16
|
|
|
Wiggly Wayne DDS posted:in the wild memory leak in apache for non-default configs: Lol, Apache is such an unadulterated gigantic poo poo show.
|
|
#
?
Sep 18, 2017 15:24
|
|
|
Wiggly Wayne DDS posted:in the wild memory leak in apache for non-default configs: "Optionsbleed" gently caress everything
|
|
#
?
Sep 18, 2017 15:31
|
|
|
mrmcd posted:Not a lawyer, so just pure speculation: If you get arrested and had previously written "the code is 1-2-3-4" on your arm, and the cop saw that and unlocked the phone with all the evidence, I seriously doubt any court is going to consider that a violation of your rights. Facial unlock seems more or less like writing the pin code of your face in magic iPhone-only readable ink. I guess what I'm saying is if you're the kind of person who likes to commit crimes or doesn't trust police, don't use biometric unlock features. Literally no-one should trust cops. Hth, Bunk.
|
|
#
?
Sep 18, 2017 15:42
|
|
|
Wiggly Wayne DDS posted:in the wild memory leak in apache for non-default configs: lmbo
|
|
#
?
Sep 18, 2017 15:43
|
|
|
lol if you ever use a tool that says it "cleans your registry to make things crash less" and "delete old files and settings to make your computer run faster"
|
|
#
?
Sep 18, 2017 15:43
|
|
|
Pikavangelist posted:"Optionsbleed" quote:That clearly looked interesting - and dangerous. It suspiciously looked like a "bleed"-style bug, which has become a name for bugs where arbitrary pieces of memory are leaked to a potential attacker. 
|
|
#
?
Sep 18, 2017 15:48
|
|
|
lmao i know what our SCCM guys will be doing tomorrow
|
|
#
?
Sep 18, 2017 15:50
|
|
|
Wiggly Wayne DDS posted:aug 15th- sep 12th means a lot of shoddy it support companies doing updates post-emotet 'fixed' a lot of machines wait, what was emotet
|
|
#
?
Sep 18, 2017 15:59
|
|
|
imhotep imhotep imhotep
|
|
#
?
Sep 18, 2017 16:01
|
|
|
fishmech posted:wait, what was emotet
|
|
#
?
Sep 18, 2017 16:02
|
|
|
i got fed up with the yosmas present i sent last year not being solved and made a thread for it https://forums.somethingawful.com/showthread.php?threadid=3834637
|
|
#
?
Sep 18, 2017 16:06
|
|
|
everyone that thinks police won't try to hold you indefinitely for not giving up your password if they think it's protecting relevant evidence realize that's already happening in the USA right? like the biggest current trial is a excop cp sharing dude so they purposely chose the least appealing person to build case law off of, but the end result for everyone else is going to be the same if they win
|
|
#
?
Sep 18, 2017 16:07
|
|
|
huh this story is familiar https://arstechnica.com/information-technology/2017/09/devs-unknowingly-use-malicious-modules-put-into-official-python-repository/
|
|
#
?
Sep 18, 2017 16:16
|
|
|
pr0zac posted:everyone that thinks police won't try to hold you indefinitely for not giving up your password if they think it's protecting relevant evidence realize that's already happening in the USA right? what if you have 2FA using an OTP app on a phone you leave at home in another country and don't have with you when you go through customs and you don't have secondary 2FA like SMS configured so you literally cannot give them your password?
|
|
#
?
Sep 18, 2017 16:24
|
|
|
cheese-cube posted:what if you have 2FA using an OTP app on a phone you leave at home in another country and don't have with you when you go through customs and you don't have secondary 2FA like SMS configured so you literally cannot give them your password? It's  as gently caress that you think this would, in any way, protect you or limit the length of your detention.
|
|
#
?
Sep 18, 2017 16:29
|
|
|
Schadenboner posted:It's when did i even imply that it would you fuckin bonehead? i was just wondering how they'd respond in such a situation (prolly still infinite detention i guess)
|
|
#
?
Sep 18, 2017 16:36
|
|
|
or if you're really worried about customs digging through your phone, make a backup beforehand, wipe your phone, and hand it to them to look over.
|
|
#
?
Sep 18, 2017 16:37
|
|
|
i mean if we're posting crackpot theories on how to hide from cbp. basically gently caress cbp.
|
|
#
?
Sep 18, 2017 16:37
|
|
|
necrotic posted:huh this story is familiar yeah i posted it not even 2 pages ago i think
|
|
#
?
Sep 18, 2017 17:00
|
|
|
ah totally missed that.
|
|
#
?
Sep 18, 2017 17:18
|
|
|
the real option is a shadow os on phones/laptops. There was a story about kevin mitnick (or someone) going to the border and getting hauled aside and told to log on to his laptop so they could check it. He had some other account setup and logged on with that showing that it was just a boring old windows account or something. The real pro-tip: fly without anything and buy a chromebook/phone when you land and sell/return when you leave. But if you're that paranoid just don't travel at all.
|
|
#
?
Sep 18, 2017 17:21
|
|
|
cheese-cube posted:what if you have 2FA using an OTP app on a phone you leave at home in another country and don't have with you when you go through customs and you don't have secondary 2FA like SMS configured so you literally cannot give them your password? im not talking about customs, im talking about being arrested by the police in the usa, customs as a non American you already have zero rights
|
|
#
?
Sep 18, 2017 17:25
|
|
|
https://www.piriform.com/news/blog/...t-windows-usersquote:At this stage, we don’t want to speculate how the unauthorized code appeared in the CCleaner software, where the attack originated from, how long it was being prepared and who stood behind it. The investigation is still ongoing. We want to thank the Avast Threat Labs for their help and assistance with this analysis. quote:The code then read a reply from the same IP address, providing it with the functionality to download a second stage payload from the aforementioned IP address. The second stage payload is received as a custom base64-encoded string, further encrypted by the same xor-based encryption algorithm as all the strings in the first stage code. We have not detected an execution of the second stage payload and believe that its activation is highly unlikely.
|
|
#
?
Sep 18, 2017 17:25
|
|
|
pr0zac posted:everyone that thinks police won't try to hold you indefinitely for not giving up your password if they think it's protecting relevant evidence realize that's already happening in the USA right? there's a world of difference between "cop pulled you over and decided to rifle through your phone while he's there" and "police have good reason to believe your electronics are full of illegal poo poo and got a search warrant and court order for your electronics"
|
|
#
?
Sep 18, 2017 17:28
|
|
|
im the last 7 words in the i'm also the
|
|
#
?
Sep 18, 2017 17:35
|
|
|
Mr. Nice! posted:or if you're really worried about customs digging through your phone, make a backup beforehand, wipe your phone, and hand it to them to look over. like that won't get you detained, interrogated and refused entry
|
|
#
?
Sep 18, 2017 18:12
|
|
|
Optimus_Rhyme posted:the real option is a shadow os on phones/laptops. thegrugq works or is otherwise involved in a company making shadow os phones. for obvious reasons they don't advertise a lot, the photos on the site are completely unbranded devices, and they aren't mass marketed. iirc they don't even list prices
|
|
#
?
Sep 18, 2017 18:14
|
|
|
Optimus_Rhyme posted:the real option is a shadow os on phones/laptops. i don't know if i would trust anything kevin mitnick says about himself ever
|
|
#
?
Sep 18, 2017 18:43
|
|
|
pr0zac posted:im not talking about customs, im talking about being arrested by the police in the usa, customs as a non American you already have zero rights I thought everyone had the same rights with customs (nil), and it was immigration that Americans had an advantage with
|
|
#
?
Sep 18, 2017 18:46
|
|
|
ate all the Oreos posted:i don't know if i would trust anything kevin mitnick says about himself ever
|
|
#
?
Sep 18, 2017 18:52
|
|
|
Subjunctive posted:I thought everyone had the same rights with customs (nil), and it was immigration that Americans had an advantage with if you can prove american citizenship, you can not be prevented from entering the country and you aren't supposed to be detained for more than a few hours none of your possessions have the right of entry and ofc the normal police can then detain you as soon as customs clears you
|
|
#
?
Sep 18, 2017 19:04
|
|
|
anthonypants posted:i could be mistaken but it was my understanding that you could set up a kind of "panic button"-type logon for truecrypt/veracrypt, where you put in a password and it takes you to a fake desktop, which is functional but doesn't have all your supersecret hacker junk on it https://veracrypt.codeplex.com/wikipage?title=Hidden%20Volume https://veracrypt.codeplex.com/wikipage?title=VeraCrypt%20Hidden%20Operating%20System The catch is that the decoy OS doesn't know the hidden one exists, it just thinks that's blank space. Inadvertently writing too much data to the disk can start to overwrite the hidden partition. Depending on how you set it up this can make things complicated if you want to keep your decoy OS plausibly used and up-to-date.
|
|
#
?
Sep 18, 2017 19:05
|
|
|
CLAM DOWN posted:https://nakedsecurity.sophos.com/2017/09/17/vevo-hacked-3-12-tb-of-data-leaked/
|
|
#
?
Sep 18, 2017 20:19
|
|
|
Some nice security questions for my council's website...
|
|
#
?
Sep 18, 2017 20:21
|
|
|
|
| # ? May 15, 2024 17:42 |
|
|
b-b-b-b--but why is linkedin blocked
|
|
#
?
Sep 18, 2017 20:22
|
|
