|
Related to not rolling your own crypto, V8's Math.random() has some gnarly collision issues. Includes a graphical representation of noise generated by Safari's Math.random() vs. noise generated by V8's Math.random(). Patterns are immediately visible in the V8 one, while the Safari one is much more random.
|
#
¿
Nov 21, 2015 03:02
|
|
|
|
| # ¿ May 3, 2024 12:03 |
|
|
I didn't actually read what his situation was, I just assumed it was the gambling equivalent of bitcoin and was curious as to how he hosed everything up.
|
|
#
¿
Nov 21, 2015 21:38
|
|
|
Spambots sure are getting complex these days.
|
|
#
¿
Mar 28, 2016 22:15
|
|
|
There was an ffmpeg vuln a little while ago that allowed remote attackers to see files on a system that executed a malformed playlist file. So if you don't keep VLC up to date you could be vulnerable to that. That kind of thing could happen in video files. Software is full of bugs. I guess the point is that lazy programming or poor code testing could result in vulnerabilities in anything, so it's entirely possible.
|
|
#
¿
May 3, 2016 21:32
|
|
|
That payload was written by some old-school virus/malware guys. Or maybe it's the era of the revival of boot sector viruses. Either way, that's pretty great. I mean, being hit by something like that sucks, but it's nostalgic as all hell.
|
|
#
¿
Aug 3, 2016 05:55
|
|
|
Man I wish I still lived in Vancouver. Good food and security poo poo with chill sec goons? I should see if I can swing a week at our Burnaby office...
|
|
#
¿
Sep 4, 2016 23:34
|
|
|
We run SourceFire/AMP for Endpoints. We're a Cisco shop so we eat our own dogfood. We've had a couple false positives but also catch a fair amount of nasty poo poo. That and common sense. Common sense is the real antivirus.
|
|
#
¿
Dec 13, 2016 22:34
|
|
|
The Free Software Foundation's developers being anti-women turbospergs who are actually really bad at what they do is entirely unsurprising
|
|
#
¿
Dec 21, 2016 17:32
|
|
|
Good lord, that may as well read "under complex micro-architectural conditions, processor may not work when processing data".
|
|
#
¿
Jun 4, 2017 08:06
|
|
|
Dylan16807 posted:It's not quite that bad. You have to be using the H registers, which access the next-to-lowest 8 bits of the full register value. Probably uncommon, and easy to avoid. Yes, I know. I can think of at least three functions in one of my hobby projects that are susceptible to this bug. I just haven't had a Kaby Lake box to test on yet. Time to rewrite those loops...
|
|
#
¿
Jun 8, 2017 23:09
|
|
|
Good news is the next big Windows 10 update in the fall will be disabling SMBv1 by default. Hopefully there'll be a similar change in a contemporary Server 2016 update.
|
|
#
¿
Jun 28, 2017 23:30
|
|
|
TBH I'd be okay with the NSA giving out free wildcards if it would mean people would finally stop doing logins and poo poo over plain HTTP. It's all about the Mossad/Not-Mossad threat model, and logins over plain HTTP falls squarely in the not-Mossad category.
|
|
#
¿
Jul 7, 2017 00:20
|
|
|
It's all Juniper and WatchGuard for me from now on 
|
|
#
¿
Jul 10, 2017 00:57
|
|
|
LibreSSL, and throw libtls on top of it so you don't have to write a massive framework for dealing with all the legacy OpenSSL API poo poo. e: My bad, libtls is a core part of LibreSSL. No extra libraries needed, just grab the LibreSSL suite and call it a day. Kazinsal fucked around with this message at 18:47 on Jul 18, 2017 |
|
#
¿
Jul 18, 2017 18:41
|
|
|
That looks like a separate problem as the processor will probably just fail to resolve addresses in the speculative fetcher and do something undefined -- I would love to know exactly what, but LOL at the magic that is Free Software coding standards; "will explode dangerously" and "bad things happen" like come on now Linux people you can loving comment better than that.
|
|
#
¿
Jan 3, 2018 08:10
|
|
|
Lain Iwakura posted:Here are CPUs that are safe: I'll be over in the corner with my 68040 trying to get something newer than System 7.6 booting.
|
|
#
¿
Jan 4, 2018 20:43
|
|
|
The only Power Mac I've got is a G5, and the oldest booting Pentium I have is a PII... Time for me to go find a 604.
|
|
#
¿
Jan 4, 2018 20:48
|
|
|
Zen is still vulnerable to Spectre.
|
|
#
¿
Jan 4, 2018 21:49
|
|
|
Absurd Alhazred posted:I can't find "predict" or "pipeline" in the wiki page; if the architecture doesn't have any of that, why would they be vulnerable? SPARC is an interesting case in that it's a specification for a processor architecture as seen from the assembly level up, not the processor's internals themselves. Oracle doesn't make SPARC processors themselves; they license the specifications out to other companies like Fujitsu, Weitek, Texas Instruments, LSI, etc. who then go design and build their own SPARC architecture processors. I know Fujitsu's had pretty deep speculative execution in their SPARCs since 2001. Possibly earlier.
|
|
#
¿
Jan 10, 2018 04:35
|
|
|
So many of our machines are pre-Haswell or are Haswell and are from a local computer store, not an actual vendor. gently caress me sideways.
|
|
#
¿
Jan 10, 2018 19:13
|
|
|
Hey fun fact, all of Cisco's recent routers running IOS-XE and the current generation of ASAs are all using modern Intel CPUs for multiple planes. I don't know what's in the new Catalyst 9000 series but I'd bet there's some Intel in those too. gently caress everything, let's go back to the days of shoving a 68030 into every device under the sun.
|
|
#
¿
Jan 13, 2018 03:39
|
|
|
anthonypants posted:What is your threat model where you are worried about Spectre/Meltdown privilege escalation on a networking appliance. What would your infrastructure even look like for that to be a concern. There have been multiple ASA patches in the past year for remote code execution.
|
|
#
¿
Jan 13, 2018 05:13
|
|
|
anthonypants posted:Were any of those due to Intel CPU bugs? No, but imagine a combination of the two. Remote code execution + a kernel mode exfiltration bug. Same kind of implications as RCE on a desktop, except on a router or security appliance.
|
|
#
¿
Jan 13, 2018 05:39
|
|
|
anthonypants posted:Okay, so let's go back to my original question: If you've already got an existing buffer overflow, and you can remotely exploit that buffer overflow to execute arbitrary code, what attacker is going to spend time trying to trigger a CPU bug afterward? The kind who wants to exfiltrate secure data from kernel space and from other processes like encryption keys and passphrases.
|
|
#
¿
Jan 13, 2018 06:00
|
|
|
waloo posted:How does this change, if at all, for somebody using a chromebook a lot? A small notepad with your passwords written down in it, preferably attached to or stored in your wallet. This is infinitely less likely to get your poo poo stolen than using LastPass.
|
|
#
¿
Feb 25, 2018 01:46
|
|
|
I was in a meeting and missed it  Really looking forward to the video+slides of it being posted!
|
|
#
¿
Mar 13, 2018 20:03
|
|
|
No paper trail for the existence of the company behind the findings, no disclosure period, disclaimer in the whitepaper admitting financial connection and interest in AMD's competitors, marketing buzzwords instead of technical details, citations to random PDFs on the internet, and to top it all off, no HTTPS on a supposed security consultancy's website. This reeks of corporate hit piece.
|
|
#
¿
Mar 13, 2018 20:33
|
|
|
Zil posted:That can only be intentional to get business off 7? Right? Genuinely would not be surprised. gently caress I hope it works
|
|
#
¿
Mar 28, 2018 07:46
|
|
|
Ah, lovely. A bug where the result is encryption being so broken the workaround is to send things in plaintext because you're hosed anyways.
|
|
#
¿
May 14, 2018 08:31
|
|
|
Judge Schnoopy posted:They're calling it Foreshadow. L1TF affects Intel's Software Guard Extensions (SGX) feature and the researchers said after the Meltdown and Spectre discoveries, looking at SGX was the next step. "When you look at what Spectre and Meltdown did not break, SGX was one of the few things left" The good news is I don't think anyone ever wrote any software to use SGX outside of research papers.
|
|
#
¿
Aug 15, 2018 05:12
|
|
|
CyberPingu posted:Do responsible disclosure stuff not exist in the US? If you can be successfully sued for it despite covering your rear end and doing it in good faith, you don't do it in America.
|
|
#
¿
Aug 25, 2020 10:51
|
|
|
EVIL Gibson posted:for example: This seems like the genesis of an Auto-BOFH.
|
|
#
¿
Sep 28, 2020 09:34
|
|
|
ohhhhh shiiiiit I forgot about that ARG thing maybe reddit is a better place to try my guy, no one here really wants to burn the time or effort to do weird crypto puzzles these days
|
|
#
¿
Apr 6, 2021 04:29
|
|
|
CommieGIR posted:Can't wait for another round of "Just move to O365" recommendations that ignores moving on prem Exchange to O365 is easily a 6month to 1 year project all on its own that needs a budget. If your org has so much insane bureaucracy that moving to O365 takes a year, it's probably going to take you that long just to get the OK to patch all your Exchange servers.
|
|
#
¿
Apr 13, 2021 22:54
|
|
|
CommieGIR posted:"I MD5'ed the MD5 of the password, it should be secure!" drat, now instead of taking one nanosecond per guess, it takes TWO. Time to wrap up the mass cracking effort.
|
|
#
¿
Apr 27, 2021 20:51
|
|
|
I'm the additional opsecfuck of the excel spreadsheet in the downloads of people_i_bribe_for_their_connections.xlsx
|
|
#
¿
Jun 7, 2021 04:02
|
|
|
He spent at least two decades hiding and making his own drugs in South American jungles because he was an insane pseudo-sovcit libertarian who thought taxes were illegal. During that time, he committed a murder, faked several heart attacks, faked a grand jury indictment, and finally ended up being arrested in Spain because he wasn't cognizant of their extradition treaty with the US. Dude was *insane*.
|
|
#
¿
Jun 23, 2021 20:49
|
|
|
CLAM DOWN posted:eat your own dick to pay respects to John, who will never have the chance to follow through on this threat to eat his own dick
|
|
#
¿
Jun 23, 2021 22:15
|
|
|
Internet Explorer posted:*takes massive bong rip* Like, ARGs, man. Friggin' weird stuff. *passes the dutchie* e: ahahaha I just saw that GBS mod challenged the weird ARG person and they *completed* it, fuckin kudos 
Kazinsal fucked around with this message at 19:19 on Jun 29, 2021 |
|
#
¿
Jun 29, 2021 19:17
|
|
|
|
| # ¿ May 3, 2024 12:03 |
|
|
RFC2324 posted:yeah, it has been known since the 90s that the internet isn't an actual planned thing, but rather an organic thing that happened on accident and rests upon dozens, if not hundreds of single points of failure. Every few months the number of routes in the full BGP tables hits a point where a whole bunch of old core routers and route servers are about to poo poo the bed and major ISPs scramble to figure out how to avoid the internet falling apart out of the blue
|
|
#
¿
Jul 3, 2021 06:49
|
|