m0nastic

26 ms·

181.
by m0nastic 14y ago
So I've tried to be careful to not discuss anything on here that I wouldn't give in a talk in a public forum (we are working on sharing nonclass information, as many of the companies in my area are all particular targets for these attacks.
182.
by m0nastic 14y ago
You aren't assuming, you are looking on all machines for IOC's (specifically machines that have been compromised before), and hopefully making use of all that fancy network security monitoring technology you paid entirely too much money for
183.
by m0nastic 14y ago
I don't disagree with anything you've written, but remediation from these attacks almost never involves replacing any of the hardware (with the possible exception of when a laptop belongs to an executive, and it becomes easier to just set t
184.
by m0nastic 14y ago
Sorry, I should have stated that better. I'm not talking about, "best practice for an advanced attack from an unknown perpetrator". I absolutely agree with you in general. I'm saying that, this particular attacker, is a known, identifiable
185.
by m0nastic 14y ago
All of those things are technically true, but don't match up with the M.O. of the perpetrators in question (they're not actually using any super-fancy BIOS rootkits). Also, the remediation process is exactly that, a process. It involves a p
186.
by m0nastic 14y ago
Edit: It took me so long to write that that you edited your comment before I finished. ;) I think we're in agreement. It's not really about privacy (which was why when I saw the quote in the article, I giggled, and thought "That reporter's
187.
by m0nastic 14y ago
Symantec (or any software company) isn't going to comment to a reporter about why it's product didn't perform adequately, regardless of whether it's related to that reporters parent organization. If a reporter asked Oracle for a comment eve
188.
by m0nastic 14y ago
That means that the hackers pivoted from one system to the Domain Controller (with an account they cracked previously, or the results of a pass-the-hash attack), and got access to all of the account hashes (which they then would crack offli
189.
by m0nastic 14y ago
Superficially, this sounds similar to what CurveCP[1] does (modulo the cryptography being done on the latter). [1] http://curvecp.org/index.html
190.
by m0nastic 14y ago
How many of these 900 jobs are developers? Not that I feel great about anyone losing their jobs, but it's hard to get a sense of what this means for VMWare without knowing their "restructuring plan". Are they HR department consolidations fr
191.
by m0nastic 14y ago
I'd like to think that if a company doesn't have the resources to properly maintain security patches on their deployed applications, they would use some app hosting platform (like Heroku), but I suspect that there are indeed many companies
192.
Memory Errors: The Past, the Present, and the Future (2012) [pdf](isg.rhul.ac.uk)
3 points by m0nastic 14y ago|0 comments
193.
by m0nastic 14y ago
The work was being done in Costa Rica, onsite. And the software was used for their own online gambling site (we were testing the production site, not software that they provided to other people). I concur that it was probably a more complic
194.
by m0nastic 14y ago
Yes. Although obviously, there would most likely not be any consequence from doing so. This occurs more frequently in cases of sex tourism (most particularly in countries like Thailand), and online gambling. A few years ago at a previous em
195.
by m0nastic 14y ago
Governments tried something similar with various housing project initiatives throughout the later part of the twentieth century. It was an unmitigated disaster, and public policy has now shifted 180 degrees (with the biggest change in polic
196.
by m0nastic 14y ago
Yes, it looks the same (I actually still see it on Coursera, but the link takes you to this site). I'm not sure if maybe they decided for the second time offering the class to do it themselves (I am now "enrolled" at about a half-dozen diff
197.
by m0nastic 14y ago
Right, the Phusion post was referring to the previous bug though, right? I disagree with Moe that labeling the latest bug as an SQL-I instead of RCE is a good strategy to ward off blackhats.
198.
by m0nastic 14y ago
Mis-labeling a Remote Code Execution vulnerability as SQL-I is absolutely downplaying the severity. SQL-I is a bad finding, RCE is tantamount to the worst thing you could possibly find in an application. There were people on this very site
199.
by m0nastic 14y ago
If a Linux distro released a kernel patch for a super-critical security vulnerability that lied about its nature, AND downplayed its importance, users would go apeshit (justifiably).
200.
by m0nastic 14y ago
Would you invest time in a framework where the developers knowingly lie about security vulnerabilities and provide fixes that are intentionally complicated? That seems like something that would ruin any future credibility of the project. No
201.
by m0nastic 14y ago
So you're advocating releasing a "decoy" patch that's intentionally obtuse and doesn't actually fix the issue? And then downplaying the severity by not encouraging developers to take the follow-up patch seriously? That's a flat out terrible
202.
by m0nastic 14y ago
An empty wine bottle filled partly with water can substitute for a rolling pin (minus the "whacking things" use case you outlined) for people who really don't do much baking. We have a Vic Firth one that gets used about a half dozen times a
203.
by m0nastic 14y ago
I would want to make sure that the declining languages had a good foothold in a lucrative industry. COBOL programmers are increasingly valuable both because of their scarcity, and the fact that the small number of places that will need to c
204.
by m0nastic 14y ago
All software has bugs, and the subset of bugs which turn out to be security vulnerabilities is borderline asymptotic. That's not to say all frameworks are created equally secure, but the differences have more to do with the culture around t
205.
Schemaless Data Structures (martinfowler.com)
2 points by m0nastic 14y ago|0 comments
206.
by m0nastic 14y ago
Figures I see floating around for worldwide Hollywood Movie Studio revenue for 2012 are around 90 billion dollars (or about twice Google's revenue).
207.
by m0nastic 14y ago
I participated in one such example of this oversight (most fun test I ever did). We were hired by a Special Master that Congress appointed to conduct a pen test against a branch of the DoI without their knowledge[1] [1] As part of this clas
208.
by m0nastic 14y ago
I just tested one recently that used client-side Javascript to generate the new temporary password for whatever account was submitted in the POST parameter. Needless to say, you could arbitrarily set any account's password to whatever you w
209.
by m0nastic 14y ago
Here's a thought experiment: Many people here seem to be okay with the idea of this being a punishable offense, but take issue with the length of the sentence (which I'll admit, seems excessive on first blush). But what would an acceptable
210.
by m0nastic 14y ago
You're not nitpicking at all, that's a good counter example of what I'm talking about!

More ›