rjmccall posted:

my faithful Horse William threw a Shoe this Morning on another of these damned Spanish Roads. as this is a fairly ordinary Matter i would of course think Nothing of it but i had just rounded a Hill-top from which one might perceive a great Distance, and i had on my Person a Telescope following the Design of the august Sir Robert Hooke, which i regularly employ to spy upon the Game in these blighted Lands. and so i am left to wonder if an Agent of the hated Enemy might have mistaken my Activity for a Spy-ing of a quite different Nature

do not shy to speak me of the Truth, good sir, i beg of you: it was fouché, was it not

Rufus Ping posted:

he applied for an internship at trailofbits

started by asking the CEO if he was gonna be asked "useless computer science questions"

was asked to complete a programming test in which he was given skeleton code for an llvm analysis pass and asked to make it do simple obfuscation of constants

the example assembly given to him shows mov eax,(some const we want to obfuscate) being replaced by mov eax,(different const); xor eax,(appropriate mask)

he doesnt understand and repeatedly asks someone on twitter to explain it to him, @'ing in the trailofbits company account

trailofbits reply saying he has failed the interview test

he then tweets a screenshot of the TOB interview task + emails and goes on a rant about how TOB set a stupid question that doesnt harness the full power of llvm and thats why he didnt understand, because it was too simple for him

Carbon dioxide posted:

With the way bitcoins work, the amount of bitcoins mined per period of time cannot change, I think.

So if you were to kill a majority of bitcoin miners, those who are left over would suddenly get way more bitcoins way faster.

Powerful Two-Hander posted:

security fuckup megathread: /* should we even bother? */.

funny Star Wars parody posted:

unironically though is there any one framework that has security benefits over another or is it poo poo all the way down?

one of the projects i inherited has a server file browser written in php and after loving around with the html portion of it to make it look like it's from 2017 I'm starting to realize that the php portion is utter garbage and if that's as good as it gets maybe we should find a different solution

ate poo poo on live tv posted:

How do you determine "some minimum amount of entropy" in a byte stream that you do not know the source of?
Hint: You can't

Meat Beat Agent posted:

what

Meat Beat Agent posted:

oh haha, i remember that

CVE-2013-4866 posted:

The LIXIL Corporation My SATIS Genius Toilet application for Android has a hardcoded Bluetooth PIN, which allows physically proximate attackers to trigger physical resource consumption (water or heat) or user discomfort.

Rufus Ping posted:

No that sounds like jscript.exe

VikingofRock posted:

basically the plot of snow crash minus the cyberspace samurai

qkkl posted:

So WCry sends the private key it generates to the main WCry servers. Shouldn't that be enough to figure out where the WCry servers are located? Once they are located the private keys can be extracted and given out to infected users for free.

surebet posted:

wcry monetization update:



180k detected hits as of right now against 60 transactions on the know addresses used. of those:
- 9 of them were literally idiots throwing cash at the addresses to track them (avg txval of $3.63 & lol avg txfee of $8.36)
- 1 of them was for $235, which is lower than the required $300 unlock bounty
- 35 were within the range of $300
- 15 were above the required bounty, which supposes multiple hits per owner (9x $600, 3x $900, 2x $1200 & 1x $3300) which i'm not sure helps since iirc each machine requires a unique unlock code

so we're looking at a conversion rate of 51/180k or 0.00028̅3%, with a return of about $25k (13¢ per infection), with the usual caveats of converting bitcoin into something useful.

e: how does the worm talk to it's c&c to generate the unlock key, is it via the sinkholed domain? not that i condone paying these idiots, but doesn't that screw the infected people out of the possibility of recovery?

Chalks posted:

Yeah, but there have been some instances of "scam" ransomware that just encrypts your poo poo without bothering to have the whole unique key retrieval infrastructure.

Given their 0.000283% conversion rate I wonder how much the faith thing really matters. I mean how many people would pay up without researching whether it works?

I'm kinda surprised the rate is so low, but I guess that reflects the fact that vulnerable systems were mostly clients without any valuable data on them. In the UK reports say there was no data lost from NHS systems at least.

RFC2324 posted:

My first computer porn was downloading a pic a Kathy Ireland at 2400 baud, only to discover it was so badly airbrushed her bush was 3 inches down her left leg.

cinci zoo sniper posted:

hows that a fuckup

let i hug posted:

want to know if this is the most worthless security article ever written or if I'm just not used to people thinking an undergrad cybersecurity course teaches them everything they need to know about secure OS design: https://mortoray.com/2017/05/17/microsoft-is-absolutely-at-fault-for-wannacry/

spankmeister posted:

One good example is google translate

it can now translate the content of other apps via an overlay

ate all the Oreos posted:

lol what is that from i absolutely need it

funny Star Wars parody posted:

the Bible doesn't talk about how much Jonah enjoyed being swallowed whole now that I think of it

Instant Grat posted:

I read the argument a while ago that if someone wants to kill you by reprogramming the pacemaker, and they have to get close enough to do it that they'd be able to stab you to death anyway, extra authentication and poo poo on the pacemaker isn't gonna save your life

wolrah posted:

In either case those who say you could just stab the person are missing the point. Stabbing tends to create a scene, leave evidence, etc. Reconfiguring a pacemaker could look just like a hardware failure or simply a known questionable heart giving up, depending on what sorts of audit logging these devices actually keep.

Imagine a gold digging spouse or just a pissed off lover reprogramming a pacemaker while the victim sleeps. An "evil maid" works pretty much the same way. Depending on how much time the initial authentication takes and the range at which it works an attacker might even just be able to bump in to the target or stand near them in a crowd, then they'd be able to do the rest from a moderate distance.

Stabbing is generally easier to do, but a lot harder to get away with.

Deep Dish Fuckfest posted:

check /var/log?

jre posted:

Unless of course you think it's likely that someone would put the effort into finding someone in the .001% of the population who are paced, find out which model they have and then following them round with a big gently caress off attenna

ymgve posted:

Not sure what my current home reporting device does under the hood but it's not connected to my home internet, and the previous one just used a direct phone connection (complete with loud 28K modem sounds when it connected). I also haven't seen any doctor programming devices being connected via wired networking but there are probably some stupid vendors that make them wifi compatible with all the issues that will cause.

To get around the "just crank the power of the transmitter to 1000x" issue, you could probably do some extreme low-latency stuff in the initial handshake - like you'd need to overcome the speed of light if you want to do anything from more than a few inches away.

Midjack posted:

then you get to have a wonderful debate over whether the online communion involves transfiguration of the data packets upon receipt or if you are downloading the actual body and blood of christ

anthonypants posted:

oops http://gizmodo.com/1795669632

ate poo poo on live tv posted: