Chris Knight posted:

physical secfuck

https://twitter.com/lockpickinglwyr/status/1007613178249965569

Lutha Mahtin posted:

i have never heard of AT commands before this

Agile Vector posted:

i just saw an ad for this on actual tv and the example users are people too dumb to remember a combo or remember their keys after being out and locking their bikes so idk maybe this is a real deterrent to that audience

anthonypants posted:

lmao

ate all the Oreos posted:

Optimus_Rhyme posted:

This *is* my favorite time of year as paid research gets accepted to blackhat, especially the stunt hacking and now all the press release and marketing hype begins.

Saw a great talk at hushcon about the difference between them having their corp pr and marketing behind them for a talk (articles in sites, magazines, blog posts, interviews) and having them be actively silenced and having no pr/marketing cause of a lawsuit threat (and other shenanigans).

However I generally do talks with no PR or marketing so...............

ate all the Oreos posted:

i mean it's not even a normal screw it's one of those magical torx bits that only the police are allowed to have probably

atomicthumbs posted:

atomicthumbs posted:

spankmeister posted:

I broke into a server room with a set like that once.

atomicthumbs posted:

atomicthumbs posted:

~Coxy posted:

if you're carrying those around it's evidence of malfeasance

spankmeister posted:

I broke into a server room with a set like that once.

apseudonym posted:

More than you think do, but even if they didn't the majority of devices are still newer than 2014.


Your unpatched phone from 2014 is still more trustworthy than your laptop

Celexi posted:

Yes, my laptop that gets firmware,driver, software updates on the regular is less secure than an android from 2014 unpatched

it's why I do all my banking and sensitive phone on my huawei from 2014

I would love to continue this convo but I have to go to the bank to ask what some transactions on my statement are as my balance is lower than usual

apseudonym posted:

Updates are an important but not remotely sufficient part of a secure device because the vast majority of malware exploits no bugs. Masturbating about updates misses the point on how malware actually works in the real world, you don't need to exploit anything on your laptop to get your banking creds out of your browser so why would I bother?

Hot takes are fun but do you know the malware numbers on Android? They're published every year.

quote:

For the last few years, advertising Trojans have been one of the main threats facing Android users. First, they are very widespread, accounting for more than half of the entries in our ratings. Secondly, they are dangerous, with many exploiting system vulnerabilities to gain root privileges. The Trojans can then get full control of a system and, for example, install their modules in system folders to prevent their removal. In some cases, even resetting the device to factory settings is not enough to get rid of the rooting malware.

However, the vulnerabilities that allow attackers to gain super-user rights are only found on older devices, and their share is declining. As a result, advertising Trojans are increasingly confronted with devices on which they cannot gain a foothold. This means the user has the chance to get rid of this malware once it starts aggressively displaying ads or installing new applications. This is probably why we are now seeing more and more advertising Trojans that don’t show ads to the user; instead, they click on them, helping their owners earn money from advertisers. The user may not even notice this behavior because the only telltale signs of infection are increased traffic and battery use.

Trojans that target WAP billing sites use similar techniques. They receive a list of links from the C&C, follow them and ‘click’ on page elements using a JS file received from the malicious server. The main difference is that they click not only advertising links but on WAP billing sites as well, which results in the theft of money from the user’s mobile account. This type of attack has been around for several years now, but it was only in 2017 that these Trojans appeared in significant numbers, and we assume this trend will continue in 2018.

In 2017, we discovered several modular Trojans that steal money via WAP billing as one of their monetization methods. Some of them also had modules for crypto-currency mining. The rise in price of crypto currency makes mining a more profitable business, although the performance of mobile devices is not that good. Mining results in rapid battery consumption, and in some cases even device failure. We also discovered several new Trojans posing as useful applications, but which were actually mining crypto currency on an infected device. If the rise of crypto currency continues in 2018, we’ll most probably see lots of new miners.

Captain Capacitor posted:

Sec fuckup #1: Physical access is your weak point, always.



Ubiquiti cables are tasty to cats, apparently.

ate all the Oreos posted:

i mean it's not even a normal screw it's one of those magical torx bits that only the police are allowed to have probably

Phone posted:

the only secure fastener are those screws they use on bathroom dividers

and nintendo security bits

jerry seinfel posted:

Just had a microsoft account with a unique 40+ character paasword that I haven't logged into in months get owned. Microsoft blocked the login but how the hell does that happen

Subjunctive posted:

also the welded plastic bubble packages small electronics come in

jerry seinfel posted:

Just had a microsoft account with a unique 40+ character paasword that I haven't logged into in months get owned. Microsoft blocked the login but how the hell does that happen

Daman posted:

arrogant security nerds getting phished is more likely than a Hotmail breach

Chalks posted:

Microsoft just loves to pop up random login prompts with no way to know what application they come from so I'm waiting for some malware that does this to grab login creds.

akadajet posted:

iOS does this too. Random "enter your gmail password" prompts. Why? Who's asking for it?