RL_Quine

67 ms·

691.
by RL_Quine 8y ago
The reason for that response is: * this all seems within reason, knowing the hardware * the denials are unusually strong If any of it is true or not I don't know, but the IPMI stuff is crappy, if not backdoored.
692.
by RL_Quine 8y ago
Right. The classic is an email account is compromised, a forward to rule is added, and nobody ever notices. It’s a false sense of security if preventing persistence is the goal. Usually instantaneous access is going to be the most disastrou
693.
by RL_Quine 8y ago
I argue that most compromises are effectively instantaneous. There’s usually little value in being a persistent threat when it takes only a moment to, for example, dump a database or an IMAP folder. Forcing rapid rotations just encourages p
694.
by RL_Quine 8y ago
> This was the rationale behind password change frequency rules too. If I can try 100 passwords per day, and I'm sure you've picked 1 of 1000000 passwords I have a good chance to find which one in a few years. But if you'
695.
by RL_Quine 8y ago
For the models I was looking at a number of years ago, the options were through IPMI or via a USB Floppy Drive. Perhaps my memory is failing me here, but I seem to remember being quite enraged at the prospect and would have done a lot not t
696.
by RL_Quine 8y ago
That's a crazy module, I had no idea anything of that scale existed for Bluetooth radios.
697.
by RL_Quine 8y ago
This comment is specific to the parent talking about their experiences producing credit card terminals that ended up with PCBs implanted in them. Here it is appropriate.
698.
by RL_Quine 8y ago
Get an x-ray machine? They are surprisingly cheap pieces of hardware if you are willing to deal with a small area, low penetration image. Low penetration means no lead, which makes for something that's about as cumbersome as a large ba
699.
by RL_Quine 8y ago
SuperMicro hardware in particular always struck me as such. Asking users to pay a license fee to be able to update the BIOS on their devices (after paying tens of thousands for the hardware itself) is a kick in the teeth. https:/&#x2F
700.
by RL_Quine 8y ago
This sounds strange but it's commonplace to make parts like this. Some DCDC converter modules have silicon dies embedded into their PCBs to save physical footprint, most notably there's a family of Texas Instruments ones which use
701.
by RL_Quine 8y ago
It's not particularly magical, there's consumer chips around which are not a whole lot bigger (though obviously in a more standard package). You don't get a lot of resources, but you don't really need it if all the other
702.
by RL_Quine 8y ago
No. SuperMicro make some models which appear to be for government application which lack the ASIC completely, they were available on NewEgg with no further description of purpose at one point. https://my.mixtape.moe/sorqql.j
703.
by RL_Quine 8y ago
In the parent I described a system which would be able to communicate through those restrictions to another compromised host (remember we're assuming everything is compromised for the sake of this article, which actually seems like a g
704.
by RL_Quine 8y ago
I've worked on systems deployed in the financial sector in high risk environments. This sort of monitoring doesn't happen in the real world.
705.
by RL_Quine 8y ago
Effectively nothing can be constrained by a whitelisting firewall if you have a sufficiently bored actor. You can smuggle data through a variety of benign looking protocols, things that wouldn't matter in the least generally. Your aver
706.
by RL_Quine 8y ago
SuperMicro hardware has very extensive IPMI integration into the mothebroard, which amongst other things can take over and inject frames into the network interface, emulate a VGA device, talk to the CPUs serial lines directly, flash firmwar
707.
by RL_Quine 8y ago
Fascinating. A company I used to work for dismissed this sort of situation as a problem and ended up using SuperMicro boards in a security crucial product. Their hardware has always been notably very crappy, with the IPMI interface defaulti
708.
by RL_Quine 8y ago
Making it a better sentence is possible, making the system itself exist in the real world much less so. You can't make systems like this as described due to the reality that all decentralized systems face; the sybil problem, and by ext
709.
by RL_Quine 8y ago
It's listed in many BIOS screens under "security".
710.
by RL_Quine 8y ago
There's something to be said about intent there. The distinction between "we are a dumb store for images" and "we process all of your images, extract facial recognition data, and match them to landmarks" is stark, b
711.
by RL_Quine 8y ago
They simply don't, and are unlikely to every comfortably do so due to how custom the hardware is getting (ie, the keyboard is a SPI device).