ge0rg

29 ms·

241.
by ge0rg 10y ago
That sounds like either clueless reporting or an attempt at blame shifting. The heating system of a building is not a typical DDoS target, and it's improbable that somebody living outside of that building had a take against the inhabit
242.
by ge0rg 10y ago
I suppose most customers will be strongly opposed to being filmed, for fear of blackmail or leakage.
243.
Turkey Doubles Down on Censorship with Block on VPNs, Tor(motherboard.vice.com)
1 points by ge0rg 10y ago|0 comments
244.
by ge0rg 10y ago
It would be interesting to know how this relates to Axolotl and "the Signal protocol".
245.
Singapore telco visits customers' homes to secure devices after cyberattack(out-law.com)
3 points by ge0rg 10y ago|0 comments
246.
by ge0rg 10y ago
It's not such a good thing to have to update each and every application whenever there is a vulnerability in a library.
247.
by ge0rg 10y ago
Not just that, playing the game (once logged in) turned out to be hardly possible at certain times of the day, and the game freezes due to communication timeouts didn't help the situation either.
248.
by ge0rg 10y ago
Unless you also want to perform the AES operations in your head, you have to rely on the hardware and software of your computer to perform them. An attacker could then replace the AES routine you use with one that stores a shadow copy of yo
249.
by ge0rg 10y ago
This is usually only true for amplification attacks. The new 1Tbps and 600+Gbps attacks reported about are direct traffic attacks from the actual bot IP addresses.
250.
by ge0rg 10y ago
Google already has a similar mechanism in place where they require captchas from IP addresses that abused Google APIs previously. The combination of that with Google Shield might actually work to inform the users, but then again users are c
251.
by ge0rg 10y ago
I can't see how end users could be possibly empowered to analyze the IT security risks of off-the-shelf IoT devices, before buying them. There are already safety standards and according mandatory certification processes in place that (
252.
by ge0rg 10y ago
Yeah, and having an automatic, secure, reliable patching routine for embedded devices is not trivial (and thus really expensive). What's even worse, we already have millions of deployed devices, and some of these probably don't su
253.
by ge0rg 10y ago
Finally, the WiFi router invasion that we were warned of as early as 2007 is coming: https://www.flickr.com/photos/dullhunk/3109815261 (original source from 2007 is 404)
254.
by ge0rg 10y ago
This is addressed in the document as well: WoSign/StartCom could back-date certificates to get around this restriction. And there is, as we have explained, evidence that they have done this in the past. However, many eyes are on the W
255.
by ge0rg 10y ago
And then there would be malware running in your browser that uses the API to expose your IoT devices. There is precedent for that where Javascript in the browser was accessing your router's web interface (with default credentials) to c
256.
Car Hacking Research: Remote Attack Tesla Motors(keenlab.tencent.com)
4 points by ge0rg 10y ago|0 comments
257.
by ge0rg 10y ago
TL;DR: t-mobile's captive portal doesn't block access to URLs containing "/speedtest", so you can proxy all your Web traffic appropriately and get free access.
258.
by ge0rg 10y ago
Actually, video games are the main exploit vector for game consoles. Out of my memory there was the name buffer overflow in Zelda for Wii, and a font corruption issue in King Kong for the Xbox 360, which both were used to allow running home
259.
by ge0rg 10y ago
Signal uses a home-brewed crypto protocol(^) and their CTO disallows third party clients, even based on their own open source code. Just use XMPP. (^) Granted, moxie can be considered a crypto expert, and the design got some public auditing
260.
by ge0rg 10y ago
The new extensions are all public and supported by the two main server implementations, prosody and ejabberd. You can nicely ask your server operator to enable them.
261.
Leaked Cisco ASA Exploit Adapted for Newer Versions(securityweek.com)
4 points by ge0rg 10y ago|0 comments
262.
by ge0rg 10y ago
Also its hard dependency on fetching everything from the servers (it looks like that even includes the pokemon 3D models - sometimes you clicked on a Pokemon, and had the catch screen with only the shadow of the Pokemon shown for some secon
263.
by ge0rg 10y ago
In my experience, twitter is one of the worst offenders here, with an exorbitant amount of HTML, Javascript and pop-ups just to prevent me from reading 140 characters.
264.
by ge0rg 10y ago
when they could just as well get their malware EFI module signed by MS This is exactly what the FBI tried with Apple, causing an enormous public mud fight. Besides, the outlined method would rather be deployed by NSA, or maybe a foreign s
265.
by ge0rg 10y ago
a deliberate effort by righteous free software-minded people who happen to work at Microsoft Or maybe a deliberate effort by developers who are paid by a three letter agency to sneak in a backdoor that looks like an accidental bug. In thi
266.
by ge0rg 10y ago
I think thereg didn't get that quite right. From reading the original advisory, I would conclude that this is not a backdoor (a by-design security "override"), but an actual vulnerability in the boot loader, where it does not
267.
by ge0rg 10y ago
I don't know the full set of security measures on Windows RT devices, but if it doesn't have an effective hardware-level flash write protection in place, you should be able to change the policy with admin/kernel code executio
268.
by ge0rg 10y ago
I tried to remain as neutral as possible with the summary. My personal opinion is that it should be possible for the owner of a device to install any OS they wish, and do so without compromising the device security. Unfortunately, we are ve
269.
by ge0rg 10y ago
TL;DR: Microsoft's Secure Boot bootloader is vulnerable to an attack where you use a (Microsoft-signed) supplemental boot policy instead of a regular boot policy, effectively removing the Secure Boot lock and allowing to run unsigned c
270.
by ge0rg 10y ago
This is not sufficient. One known vector is to emulate a USB network device that provides a nameserver via DHCP, but no default route,allowing the attacker to MitM chosen connections. And of course you have a plethora of different USB devic

More ›