Space Gopher posted:

I'm guessing that there's some level of two-person-rule code review in the merge to master, too.

evil_bunnY posted:

IIRC A factory reset kills the runtime, and after they seized the c2 domain the bootlader can’t grab the runtime and fails silently to normal operation. The problem is of course that none of these POS devices have any kind of security updates process, so they’re effectively just waiting for the next exploit to come along.

CommieGIR posted:

From what I'm reading, Stage II is the actual malware and for me would be the largest issue, because its active after every reboot and can receive instruction and actually carry out tasks. According to what I'm reading, Stage III is just optional modules that can be installed.

So unless you actually do get a full firmware update, its persistent.

Jabor posted:

Where's it going to receive commands from?

D. Ebdrup posted:

BGP really needs some form of overhaul.

Absurd Alhazred posted:

Well, if it isn't FSLabs, up to their old bullshit...


Nice!

https://forums.flightsimlabs.com/index.php?/topic/17444-flight-sim-labs-statement-on-cmdhost/ posted:

Over the past few hours we have become aware of rumours circulating on social media about the cmdhost file installed by the A320-X and wanted to clear up any confusion or misunderstanding.

cmdhost is part of our eSellerate infrastructure - which communicates between the eSellerate server and our product activation interface. It was designed to reduce the number of product activation issues people were having after the FSX release - which have since been resolved.

This is not a new discovery or something we have ever sought to hide away. Indeed, we directly addressed the nature of this file way back in February:

https://forums.flightsimlabs.com/index.php?/topic/16306-p3dv4-problems-with-installing-the-latest-spotlight-version-cmdhostexe/

The file has been passed to all the major antivirus houses in order for them to verify that it is legitimate, and is also reported clean by Virus Total. If you have any concerns, we urge you to submit it to your preferred antivirus company for testing.

anthonypants posted:

anthonypants posted:

quote:

Although this thread has been approved, I would like to point out a few things:

• This account was created today with the sole purpose of posting the thread
  
• Sockpuppet accounts were created today, around the same time as this one, to post very pro-FSL comments
  
• A handful of fake accounts were created and used to attack members of our community during the previous accusations of malware against FSL
  

Do with that information what you will.

C.M. Kruger posted:

FSLabs is now threatening to sue reddit because they got caught doing shady poo poo again.
https://www.reddit.com/r/flightsim/comments/8nfozz/cmdhostexe_what_is_it/


https://www.reddit.com/r/flightsim/comments/8nxcl5/an_open_letter_to_flight_sim_labs/

Diametunim posted:

Can we talk boring rear end USB Device Control Policy for a bit? I'm curious as to what y'all are using to encrypt removable USB devices. I'm looking for an easy, cross platform, and preferably free way to device encrypt USB Drives that are handed out to end users for temporary use. My company is by majority Windows but we do have ~100 OSX devices in circulation which makes using Bitlocker an issue. I know there are solutions out on Github for OSX and Bitlocker but lets be honest, there's no way your standard end user is going to take the time to figure that solution out.

astral posted:

This is the NYT article referenced by the Reuters article that was linked to by that tweet if you want to read more about it:
https://www.nytimes.com/interactive/2018/06/03/technology/facebook-device-partners-users-friends-data.html

Harik posted:

Somewhat esoteric question here, but is there a good read on why it's okay to lose the diffusion property of block ciphers by running them in xor stream mode?

I suspect it's along the lines of "there are so many ways to fuckup final block padding that it's overall safer" but that's just guessing.

fwiw I just use TLS when possible and NACL *_box otherwise.

ozymandOS posted:

Diffusion is important in several common modes of creating a stream cipher from a block cipher. For example CTR mode would not generate a random stream if the block cipher did not have the diffusion property.

Proteus Jones posted:

Even better, you’ll be hooking evidence drives to a read-only connector, pressing a button to make a bit-level copy, and then sealing it in a custody bag with yours and your supervisor’s signatures.

Over and over.

quote:

Hackers stole personal data for more than 57 million Uber customers and drivers in 2016. This was one of the biggest data breaches that took place in 2016 and it’s likely you never heard about it until now. That’s because Uber responded by paying the hackers $100,000 to keep the breach quiet and to delete the data.

quote:

MyHeritage, an Israeli-based genealogy and DNA testing company, disclosed today that a security researcher found on the Internet a file containing the email addresses and hashed passwords of more than 92 million of its users.

MyHeritage says it has no reason to believe other user data was compromised, and it is urging all users to change their passwords. It says sensitive customer DNA data is stored on IT systems that are separate from its user database, and that user passwords were “hashed” — or churned through a mathematical model designed to turn them into unique pieces of gibberish text that is (in theory, at least) difficult to reverse.

MyHeritage did not say in its blog post which method it used to obfuscate user passwords, but suggested that it had added some uniqueness to each password (beyond the hashing) to make them all much harder to crack.

...

MyHeritage added that it is expediting work on an upcoming two-factor authentication option that the company plans to make available to all MyHeritage users soon.

“This will allow users interested in taking advantage of it, to authenticate themselves using a mobile device in addition to a password, which will further harden their MyHeritage accounts against illegitimate access,” the blog post concludes.

Kerning Chameleon posted:

Have something a little fresher: Researcher Finds Credentials for 92 Million Users of DNA Testing Firm MyHeritage


Why... yes... of course we... "salted" the passwords hashes protecting your extremely personal and identifying genealogical information, as the kids these days say. Oh, our hashing method? Why, it's, uh... _{mumblemumblemumble...} Also, pay no attention to the fact we suddenly care very strongly about implementing 2FA that we definitely were planning to do before this incident!

Boris Galerkin posted:

I read this post and thought “I should turn on 2FA on my 23andme account.”

Turns out they don’t support it either.

Internet Explorer posted:

Alternatively, I was raised Jewish and there's no way in hell I'm doing anything to make easier for someone to throw me in an oven.

quote:

The investigation of the genetic relationship among three Jewish communities revealed that Kurdish and Sephardic Jews were indistinguishable from one another, whereas both differed slightly, yet significantly, from Ashkenazi Jews. The differences among Ashkenazim may be a result of low-level gene flow from European populations and/or genetic drift during isolation. Admixture between Kurdish Jews and their former Muslim host population in Kurdistan appeared to be negligible. In comparison with data available from other relevant populations in the region, Jews were found to be more closely related to groups in the north of the Fertile Crescent (Kurds, Turks, and Armenians) than to their Arab neighbors.

Boris Galerkin posted:

I read this post and thought “I should turn on 2FA on my 23andme account.”

Turns out they don’t support it either.