45h34jh53k4j

28 ms·

271.
by 45h34jh53k4j 10y ago
I agree transcoding all user content is a must, but even that can be dangerous :-) as with ImageTragick which lcamtuf discussed here: https://lcamtuf.blogspot.com/2016/05/clearing-up-some-miscon...
272.
by 45h34jh53k4j 10y ago
No private keys were leaked; however a signed policy file, that lets you disable the protections within secureboot was discovered and repurposed. Its not so much a backdoor key, but an overly permissive mechanism within microsofts secureboo
273.
by 45h34jh53k4j 10y ago
So from this I think you could say this is a universal microsoft secureboot implementation bypass. all you need is the signed policy file and an older more obscure (signed) non-blacklisted bootmgr and you can exploit secureboot to glory. it
274.
by 45h34jh53k4j 10y ago
Not to be rude, but in the USA (where SWIFT or bank wire transfers can be expensive) an email address as a recipient of an online fund transfer is a pretty common; ie: paypal, venmo, chase quickpay now specifically in this case, lcamtuf (at
275.
by 45h34jh53k4j 10y ago
Brilliant work ryan and fillipo! I was at the talk, and very impressed with both the content and your presentation style.
276.
by 45h34jh53k4j 10y ago
its not longer fair to call game over with physical access; indeed countermeasure like full disk encryption, computrace and Mac firmware passwords are all examples of things we do to raise the difficulty for a physical attacker.
277.
by 45h34jh53k4j 10y ago
Routine updating of Administrator privileged binaries over HTTP is endemic especially by OEMs, and yes, ASUS should know better. I hope this incident will push them towards https for all their http offerings. There really is no excuse anymo
278.
by 45h34jh53k4j 10y ago
One game that seems to work for me in VR is EVE: Valkyrie; An arcade style multiplayer dogfighting in 0G space. As you are in space, the lack of an 'up' feels like you are never at the 'wrong' direction. It took some get
279.
by 45h34jh53k4j 11y ago
I can't see how this could be real. Faking GPS data and simulating movement on a device you control is trivially easy. Add an incentive to obtain a benefit by deception and you have one broken product.