bri3d

32 ms·

421.
by bri3d 1y ago
1) Anthropic are US based, maybe you're thinking of Mistral? 2) Are government agencies sending prompts to model inference APIs on remote servers? Of course, look up FedRAMP. Depending on the assurance level necessary, cloud services r
422.
by bri3d 1y ago
Yes, this means it was exploited in a spyware campaign in the wild. The full exploit chain seems to target WhatsApp directly using a second bug in WhatsApp; although this vulnerability is definitely present anywhere this kind of image is pr
423.
by bri3d 1y ago
iOS 16.7.12 was released on September 15, 2025 (to fix this same bug) and runs on the iPhone 8.
424.
by bri3d 1y ago
And since nobody got to it in the other thread, https://www.whatsapp.com/security/advisories/2025/ . It seems to me that this exploit was used in a chain with a WhatsApp issue that would trigger the malicious
425.
by bri3d 1y ago
> If it's true that 90% of fraud comes from mobile despite all of the restrictions Statistics on mobile vs. desktop banking will really shock you; the mobile usage penetration is easily well upwards of 90% in many markets. There&#x2
426.
by bri3d 1y ago
* Your bank (and Google) want to deal with as little fraud as possible. * Market forces demand they provide both a website and an Android app. * If both platforms are equally full of fraud, have the same features, and both have similar use,
427.
by bri3d 1y ago
> You can root and leave your bootloader unlocked That's Google, not GrapheneOS.
428.
by bri3d 1y ago
> Patch iOS and Android applications, embedding a Frida gadget that can be used with objection or just Frida itself. This is the key thing, and the part that will change next year: previously, you could unpack, patch, and repack an APK w
429.
by bri3d 1y ago
I don't think any vendor should be solving for "I want to do app RE and banking on the same device at the same time;" that seems rather foolish. These are sort of orthogonal rants. People view this as some kind of corporate p
430.
by bri3d 1y ago
Ha! I actually use TinyPilot all the time, nice! > I agree that would be nice, but it also doesn't sound all that practical for a small vendor. Personalizing / customizing per device always introduces a huge amount of complexit
431.
by bri3d 1y ago
No, if you buy the camera, plug it in, and forget to set it up, then someone can use the default password and key material stored in the app to pretend to be the app and provision it on your behalf. That's the only real vulnerability h
432.
by bri3d 1y ago
Overall: yes, but it will get much harder for apps which need attestation, which is sort of the point, for better or for worse. As far as I know you'll still be able to OEM unlock and root phones where it's always been allowed, li
433.
by bri3d 1y ago
The device should ideally have some kind of secret material derived per device, like a passphrase generated from an MCU serial number or provisioned into EEPROM and printed on a label on the device. Some form of "enter the code on the
434.
by bri3d 1y ago
The information leak in this bug is particularly useful for Windows 24H2 and later only because _prior_ to 24H2, there were immensely simpler methods that made the protection this bypasses (KASLR) completely useless anyway. And KASLR is sti
435.
by bri3d 1y ago
In addition to the original EntryBleed article, https://exploits.forsale/24h2-nt-exploit/ and the corresponding https://github.com/exploits-forsale/prefetch-tool are useful for understanding the s
436.
by bri3d 1y ago
I don't think I agree with this assessment; I have a lot of respect for GrapheneOS but they are very prone to this type of puffery, especially in face of criticism. The information in this and other GrapheneOS articles comes from a lea
437.
by bri3d 1y ago
Almost all of AOSP is under the Apache or BSD licenses, not the GPL. Very few GPL components remain (the kernel being the large and obvious one). So, yes, making a GPL request will work for the very few components still under GPL, if a vend
438.
by bri3d 1y ago
This is a deeply horrible take. “From a forensic perspective” if one uses a cheap Chinese phone, as you suggest, anyone with one of tens of forensic extraction tools (including the US government!) will immediately own your phone as soon as
439.
by bri3d 1y ago
> To anything interacting with the memory subsystem, there is one bus, and the tags flow with the data on it. To the architecture, there is one access mechanism with the tag bit set and one separate mechanism with the tag bit unset, no?
440.
by bri3d 1y ago
FWIW (I am a nobody compared to you; I didn't make FIL-C :) ) - I think that MIE/MTE are practically superior to CHERI. I also think this argument is compelling because one exists in millions of consumer drives, to-be-more (MTE -&
441.
by bri3d 1y ago
CHERI fundamentally relies on capabilities living in memory that is architecturally separate from program memory. You could do so using a bus firewall, but then you're at the same place as MIE with the SPTM.
442.
by bri3d 1y ago
I think I broadly agree with you. IMO tagging is practically much, much more valuable than capabilities systems modeled like CHERI.
443.
by bri3d 1y ago
True! On the flip side, MTE sucks at intra-object corruption: if I get access to a heap object with pointers, MTE doesn't affect me, I can go ahead and write to that object because I own the tag. Overall my _personal_ opinion is that C
444.
by bri3d 1y ago
Why would you need CHERI if you have working mitigations that don't demand a second bus? I think it's two halves of the same coin and Apple chose the second half of the coin. The two systems are largely orthogonal; I think if Appl
445.
by bri3d 1y ago
IMO it's the latter; CHERI requires a lot of heavy lifting at the compile-and-link layer that restricts application code behaviors, and an enormous change to the microarchitecture. On the other hand, heap-cookies / tag secrets can
446.
by bri3d 1y ago
And of note, the Apple implementation basically forces the invariants documented in the author's talk: * use synchronous exceptions (“precise-mode”), which means the faulted instruction cannot retire and cause damage * re-tag allocatio
447.
by bri3d 1y ago
The problem with PowerPC AS tagging was that it relied entirely on the trap instruction. If you could control execution at all, you could skip the trap instruction and it did nothing. This implementation, by my reading, essentially adds a s
448.
by bri3d 1y ago
Substantially less complex and therefore likely to be substantially easier to actually use. CHERI-Morello uses 129-bit capability objects to tag operations, has a parallel capability stack, capability pointers, and requires microarchitectur
449.
by bri3d 1y ago
I would deeply, strongly caution against using public exploit availability as any evidence of security. It’s a bad idea, because hundreds of market factors and random blind luck affect public exploitability more than the difficulty of devel
450.
by bri3d 1y ago
Only if you enable Advanced Data Protection, but in that case, yes, absolutely

More ›