mzs

859 ms·

2671.
by mzs 12y ago
-w
2672.
by mzs 12y ago
RC4 in TLS is pretty bad too: http://www.isg.rhul.ac.uk/tls/ "Our second attack applies to TLS and can be carried out in a single connection or session (but tolerates multiple connections/sessions). It exploi
2673.
Golden frog comments fcc gn 14-28 final [pdf](s3.documentcloud.org)
1 points by mzs 12y ago|0 comments
2674.
by mzs 12y ago
How about you have your employees contact their clients saying that they have found a good match on OKC and send the profile with that message. Then if the client is interested, that client can reach out on OKC personally, making an OKC acc
2675.
by mzs 12y ago
Looks like I was wrong cause I checked too late, Belkin moved to AWS as part of the fix, doh! https://news.ycombinator.com/item?id=8429789
2676.
by mzs 12y ago
Do a dig of heartbeat.belkin.com and you get a bunch of 54.0.0.0/8 addresses that Amazon bought from Merck. It's using AWS.
2677.
by mzs 12y ago
Nah, this is the best explanation from a reddit thread, looks like it was pinging heartbeat.belkin.com to verify network connectivity after getting DNS servers from DHCP: http://www.reddit.com/r/technology/comments
2678.
by mzs 12y ago
No, it does not include that: usa$ head -5 yob2008.txt Emma,F,18791 Isabella,F,18598 Emily,F,17419 Olivia,F,17066 Ava,F,17024 The USA Census Bureau released names.zip and namesbystate.zip back in May and they i
2679.
by mzs 12y ago
Not sure about that, there should have been about 50 if so and from the readme provided by the census "To safeguard privacy, we restrict our list of names to those with at least 5 occurrences." usa$ grep -i bacon yob????.txt
2680.
by mzs 12y ago
Cyrix had this too, probably first, you used those fake outb addresses that the CPU noticed to set up how many cachelines to lock.
2681.
by mzs 12y ago
If your PPC is using a Discovery PHC you can map half or all of your L2 to a block of PAs and then map it where ever you want with VM. I'm sure this was cause of the experience that Genesis had with MIPS. It's a nifty feature.
2682.
by mzs 12y ago
Along the same lines couldn't per user log files be used for apached, googling reveals a number of recipes for that, or alternatively hack suexec in a same way to that end?
2683.
by mzs 12y ago
You should email Jan and ask, I'm curious too.
2684.
by mzs 12y ago
Author of linked piece replied to an email from me, the radio piece was this one from February 25, 2014 of WFAE from Charlotte (the first part is also pretty interesting - about HAM radio): http://wfae.org/post/ham-radi
2685.
by mzs 12y ago
good find: @@ -2189,6 +2190,11 @@ *msr_content = vcpu_vlapic(v)->hw.apic_base_msr; break; + case MSR_IA32_APICBASE_MSR ... MSR_IA32_APICBASE_MSR + 0x3ff: + if ( hvm_x2apic_msr_read(
2686.
by mzs 12y ago
The link to 'PAUSE history' requires a login.
2687.
by mzs 12y ago
No not like that, something more like this: ()SOMEVAR@%=... You will get a parse error. There is little more than [a-zA-Z0-9_] you can use in identifiers (except bash adds a few more, grrrr). You can probably pull it of with /usr/
2688.
by mzs 12y ago
"the most recent way to exploit it is to export an environment variable of, say, ls to a bash function." Even before the redhat patch you would need something to set echo=() { ... but how will an attacker do that when they can onl
2689.
by mzs 12y ago
Anyone have a link to the NPR interview? I searched the NPR site and only found a story back from February of this year.
2690.
by mzs 12y ago
I should not have replied until I had more time to respond clearly, sorry. The BASH_FUNC_foo()=() { ... is nice, it's how it should have been from the get go. Besides having a nice prefix that owns them all (what about arrays though)it
2691.
by mzs 12y ago
Personally I like this approach from netbsd much better, it's not ripped-out, just disabled by default. Though it would be nice if there was a single char shopt so set, $-, and shebangs could all work with it, but then again it might b
2692.
by mzs 12y ago
You need to use export -f now, the specifics of how functions are exported have changed in the redhat patch, ls='() { ... is not sufficient anymore. Nothing has broken unless you had something calling bash that was not bash and you use
2693.
by mzs 12y ago
I don't use redhat, but my hunch is that the redhat patch is much more like Florian's (redhat security person): http://seclists.org/oss-sec/2014/q3/693
2694.
by mzs 12y ago
ha, I forgot one more point! The fact that I have export -f in my bashrc, broke the common later () { a=[><]\ style redirect IO parser exploit. I thought that was funny.
2695.
by mzs 12y ago
Doh, forgot to get back to the first point, sorry. My thinking is that at this point the whole exporting functions (and anything else other that environment variables, like arrays) is just a bad idea in the default case. I actually do do it
2696.
by mzs 12y ago
Wow this is getting out of hand, that's not really a security vulnerability anymore. That's how bash passes exported functions, I'll get back to that. There is some misunderstanding though regarding the suid shell script. I c
2697.
by mzs 12y ago
$ /usr/bin/env - /usr/local/bin/bash -c set sh BASH=/usr/local/bin/bash ...
2698.
by mzs 12y ago
Yes, I'm getting really annoyed seeing comments like this pop-up repeatedly, ash has no exporting of functions even: # type foo foo is a shell function # export -f foo -sh: export: Illegal option -f
2699.
by mzs 12y ago
My version of ash seems unaffected. Do you have more info? # env x='() { :;}; echo vulnerable' /bin/sh -c "echo this is a test" this is a test # env x='() { :;}; echo vulnerable' /b
2700.
by mzs 12y ago
Oh man no, go take a look at the launchd sources and see how much is hard coded in for how Apple wanted it - likely when you run into something unexpectedly not working how you wanted or expected.

More ›