|
Condiv posted:tons of posts on reddit about "well, if you have local access to the computer then you can do anything so when you think about it this is NBD" with regards to the apple root hole idk about reddit but it's true that if someone with half a brain has physical access you get pwned back in the day it was taking the cmos battery out so you could reset the BIOS pw but that's gone the way of the dodo and microsoft is kind of nifty about protecting critical files now, you can encrypt your whole sdd/hdd if you feel like you need to but then try to reinstall windows and clean up the files left behind elevate privileges as much as you want ms defender will be "this is a critical system file"
|
#
?
Nov 29, 2017 20:46
|
|
|
|
| # ? May 14, 2024 16:10 |
|
|
Powaqoatse posted:guess its fixed now my money's on a braceless conditional.
|
|
#
?
Nov 29, 2017 21:09
|
|
|
syscall girl posted:idk about reddit but it's true that if someone with half a brain has physical access you get pwned Install a shim in yo usb port. Flash in a bugged BIOS if the hardware isn't protected against it. Physical access is still game over, but it takes at least some effort now if you're good about protecting yourself.
|
|
#
?
Nov 29, 2017 22:08
|
|
|
syscall girl posted:idk about reddit but it's true that if someone with half a brain has physical access you get pwned There's an important distinction between physical access and physical control. A machine in a public computer lab I have physical access to. A machine I can take home (or have stolen) I have physical control over. The difference is what I can do to the machine without raising suspicion. Those public computer lab machines can be secured to a reasonable extent by password protecting the BIOS/OpenFirmware/EFI/whatever and boot menu then locking the case closed to prevent people from resetting it easily. An attacker generally can't start cutting the case with tools in the middle of a public area without people noticing. They can, however, use this bug to enable an admin account on the machine from which they can do pretty much whatever else they want. A machine I can bring to a private location and disassemble without interference on the other hand is basically pwned unless it's using good encryption.
|
|
#
?
Nov 29, 2017 22:24
|
|
|
haveblue posted:it's fixed and apple seems to have taken the very rare step of making the update a mandatory insta-install yea i clicked "details" when the notification came up & when the app store opened, it was already installed
|
|
#
?
Nov 29, 2017 22:36
|
|
|
wolrah posted:There's an important distinction between physical access and physical control.
|
|
#
?
Nov 29, 2017 23:16
|
|
|
wolrah posted:There's an important distinction between physical access and physical control. i've never done a mr. robot black hat thing in my life okay once in hs but that place was ridiciulous just saying you can talk to the lab attendant while you're you're doing something awful to one of his or her machines and then get the whole network because who cares none of that is remotely interesting compared to real exploits anyway
|
|
#
?
Nov 29, 2017 23:26
|
|
|
syscall girl posted:i've never done a mr. robot black hat thing in my life The only awful thing here is your posts!
|
|
#
?
Nov 29, 2017 23:27
|
|
|
wolrah posted:There's an important distinction between physical access and physical control. Destructive v non destructive is also an important distinction for stuff like evil maid
|
|
#
?
Nov 29, 2017 23:28
|
|
|
endlessmonotony posted:Flash in a bugged BIOS if the hardware isn't protected against it. BitLocker with TPM protector key will ensure that the disk becomes undecryptable as a result, so things are moving in the right direction in protecting against this.
|
|
#
?
Nov 29, 2017 23:59
|
|
|
anthonypants posted:physical access also relates to evil maid-style attacks, or plugging in a mitm keylogger on that computer lab workstation I like how the Dell "all-in-one" stands for mounting SFF PCs to the back of monitors have a cover that goes over the "rear" ports (which would otherwise be exposed on the left side in this configuration) that interlocks with the cable lock slot. Without the key you'd have to break it to install a MITM device. A Kensington lock isn't exactly high grade security but it's effective enough for most environments. I wish I could get something similar that could attach to the back of full-size PCs in some secure manner. apseudonym posted:Destructive v non destructive is also an important distinction for stuff like evil maid
|
|
#
?
Nov 30, 2017 01:18
|
|
|
Schadenboner posted:The only awful thing here is your posts! it's true i'm sorry (not sorry)
|
|
#
?
Nov 30, 2017 01:23
|
|
|
apseudonym posted:It's an abstraction layer for vendor code, of course it loving includes the word vendor. Yes. And vendors care deeply about software quality and timely updates (yes yes, this update improves the situation). apseudonym posted:No, the vendor code cannot inject a tracking dll into apps. Section "Same-Process HAL (SP-HAL)" https://source.android.com/devices/architecture/vndk/ It's the graphics driver, not the sound driver, my bad. Any process with access to graphics gets the vendor graphics driver DLL loaded, so technically it's not a DLL injection, you're right. And that DLL survives a system upgrade. How is that DLL protected against modifications? How is it certified not to contain potentially unwanted software? (yesyes, this applies even more so to the current situation). My initial post was made tongue-in-cheek on a dying comedy forum, sorry if it was misinterpreted as a Serious Security Review Of The Product instead of a cheap LOL.
|
|
#
?
Nov 30, 2017 01:41
|
|
|
If you want people to think you're making a joke you should try being funny.
|
|
#
?
Nov 30, 2017 01:49
|
|
|
Jabor posted:If you want people to think you're making a joke you should try being funny. Is "Malware Abstraction Layer" better?
|
|
#
?
Nov 30, 2017 01:53
|
|
|
where is the OP? she's a gas and a genius it's all idiots without her
|
|
#
?
Nov 30, 2017 01:56
|
|
|
Jabor posted:If you want people to think you're making a joke you should try being funny. My experience is that I can just live my life normally and people are always laughing around me.
|
|
#
?
Nov 30, 2017 02:06
|
|
|
karoshi posted:Is "Malware Abstraction Layer" better? Jabor posted:If you want people to think you're making a joke you should try being funny.
|
|
#
?
Nov 30, 2017 03:19
|
|
|
Jabor posted:If you want people to think you're making a joke you should try being funny. turn on you’re monitor
|
|
#
?
Nov 30, 2017 04:32
|
|
|
Jabor posted:If you want people to think you're making a joke you should try being funny. Goddamn...
|
|
#
?
Nov 30, 2017 07:45
|
|
|
faceid update: doesn’t recognize your face at a 90-degree angle
|
|
#
?
Nov 30, 2017 08:04
|
|
|
syscall girl posted:where is the OP? pls come back lain and yell at ppl when they go off topic
|
|
#
?
Nov 30, 2017 10:26
|
|
|
here have a fuckup our hr dpt use an external provider for "training" and I was trying to access it the other day so searched our intranet for "training" and hit the sponsored link they've stuck in and got taken to a branded page asking for a logon. that's not too unusual for hr because their systems suck and don't SSO half the time but then I checked the url and it's actually a 3rd party site of [company].Vendor.com that's been branded with our logo and is asking for a logon. turns out the "correct" link is via a proxy that authorises via SSO and logs you on the the vendor, but it does this via a redirect so the url you see (and bookmark or copy and paste) doesn't contain the proxy. so every time somebody tries to send a link to the training site they'll send a link to a branded external website that requests a logon. loving nice we've phished ourselves
|
|
#
?
Nov 30, 2017 11:56
|
|
|
Shaggar posted:my money's on a braceless conditional. https://objective-see.com/blog/blog_0x24.html
|
|
#
?
Nov 30, 2017 14:40
|
|
|
bicycle posted:pls come back lain and yell at ppl when they go off topic
|
|
#
?
Nov 30, 2017 16:51
|
|
|
anthonypants posted:as someone who has only ever interacted with her online she seems very happy now, and if leaving the forums was good for her mental health then i don't mind if she never comes back i miss the posts, but the change in happiness seems pretty clear from the view from online.
|
|
#
?
Nov 30, 2017 16:54
|
|
|
i thought her twitter got immediately happier when she transitioned and didn't really correlate it with the forums at all but if that's why then yeah never come back lol
|
|
#
?
Nov 30, 2017 16:56
|
|
|
bicycle posted:pls come back lain and yell at ppl when they go off topic i've been busy the past few months with a dayjob project and such y'all are terrible for getting off-topic. c'mon anthonypants posted:as someone who has only ever interacted with her online she seems very happy now, and if leaving the forums was good for her mental health then i don't mind if she never comes back oh. i am much, much happier now than say a year ago and even a decade ago. i have my own challenges to deal with but i am not losing my mind all the time anymore <3 as for the forums, i am still on them but i have been doing a lot less stuff outside of work just to reduce my stress. i'm working on something at the moment that i'll be posting in yospos at some point but otherwise yeah actually, i have two things on the go but the latter is waiting on an amazon order
|
|
#
?
Nov 30, 2017 17:02
|
|
|
Lain Iwakura posted:oh. i am much, much happier now than say a year ago and even a decade ago. i have my own challenges to deal with but i am not losing my mind all the time anymore <3 
|
|
#
?
Nov 30, 2017 17:06
|
|
|
Lain Iwakura posted:actually, i have two things on the go but the latter is waiting on an amazon order allow me to take the opportunity to preemptively welcome you to the Proud Owners of an Internet Buttplug club (also i'm really glad to hear you're doing well!)
|
|
#
?
Nov 30, 2017 17:07
|
|
|
even more embarrassing
|
|
#
?
Nov 30, 2017 17:13
|
|
|
Lain Iwakura posted:oh. i am much, much happier now than say a year ago and even a decade ago. i have my own challenges to deal with but i am not losing my mind all the time anymore <3 
|
|
#
?
Nov 30, 2017 17:24
|
|
|
Lain Iwakura posted:i've been busy the past few months with a dayjob project and such  Edit: Here's a funny to avoid an ironic thread derail: https://twitter.com/info_dox/status/936258429861146624 Tails just sent a bunch of people an email with everyone in the To: field. Their fix is they will install a browser add-on to avoid it in the future! bicycle fucked around with this message at 18:02 on Nov 30, 2017 |
|
#
?
Nov 30, 2017 17:58
|
|
|
anthonypants posted:as someone who has only ever interacted with her online she seems very happy now, and if leaving the forums was good for her mental health then i don't mind if she never comes back taking a break from online stuff when you’re too involved with it is very good for your mental health I’ve barely been back on Facebook since I went on social media break and I don’t miss that poo poo at all glad to hear you’re doing better Lain
|
|
#
?
Nov 30, 2017 18:44
|
|
|
Number19 posted:taking a break from online stuff when you’re too involved with it is very good for your mental health me too! i've been avoiding local infosec groups lately due to personal reasons although i cannot go to the usual meetup anymore as i've been doing roller derby on the same nights. that and it always takes place at the pub and i have quit drinking i'll be at bsides vancouver this march for sure however (btw roller derby is rad as heck and i find it hilarious that i am gunning to do a full-contact sport)
|
|
#
?
Nov 30, 2017 20:04
|
|
|
actually, if all goes to plan, i am going to be working in ireland for a bit this coming summer (have to deal with legal issues revolving around my name and gender marker and then dealing with a new passport) and if timing works right i am going to fly back via nyc to attend HOPE for the first time in six years
|
|
#
?
Nov 30, 2017 20:07
|
|
|
Lain Iwakura posted:me too! i've been avoiding local infosec groups lately due to personal reasons although i cannot go to the usual meetup anymore as i've been doing roller derby on the same nights. that and it always takes place at the pub and i have quit drinking i can't go to the local meetups anymore either because they conflict with my parenting schedule. it's too bad because i liked chatting with people but that's life i guess. maybe i'll try to go to bsides. it'll depend on when it is and if my ex-wife will agree to a time swap
|
|
#
?
Nov 30, 2017 20:11
|
|
|
roller derby is indeed the poo poo and there's probably a local team you've never heard of in your very own hometown, go watch a jam and cheer and have fun
|
|
#
?
Nov 30, 2017 20:13
|
|
|
Number19 posted:i can't go to the local meetups anymore either because they conflict with my parenting schedule. it's too bad because i liked chatting with people but that's life i guess. there's a defcon 604 meet once a month that may or may not be good. i have been interested in attending but because i haven't been before i am unsure how much fun i'll have considering other events' gender imbalances. it's really annoying because there are good people but i've always gotten on better with women than men and i feel like that this may be a challenge for me also sup fellow divorce(d|ing) friend
|
|
#
?
Nov 30, 2017 20:14
|
|
|
|
| # ? May 14, 2024 16:10 |
|
|
Lain Iwakura posted:there's a defcon 604 meet once a month that may or may not be good. i have been interested in attending but because i haven't been before i am unsure how much fun i'll have considering other events' gender imbalances. it's really annoying because there are good people but i've always gotten on better with women than men and i feel like that this may be a challenge for me I also don't like hanging out with men that much. I basically avoid it outside of work obligations and it has significantly reduced my stress level.
|
|
#
?
Nov 30, 2017 20:16
|
|
