w8rbt

58 ms·

511.
Remote Exploitation of an Unaltered Passenger Vehicle(defcon.org)
3 points by w8rbt 11y ago|0 comments
512.
by w8rbt 11y ago
Although many new hams still learn and use International Morse Code as it is very efficient and gets through a lot of noise. Also, individuals can build and actually understand simple CW transceivers. It's a very basic technology that
513.
by w8rbt 11y ago
You are correct. The patch is meant for IT security research and honeypots. The purpose is to see what passwords the SSH brute-force bots are using. It should not be used on production systems where legit users are logging in via SSH. That
514.
by w8rbt 11y ago
Here's a one-line patch that logs the passwords the bots are trying too. http://w8rbt.org/patches/sshlog.patch
515.
by w8rbt 11y ago
Or test on an official research highway such as Virginia Tech's Smart Road: https://en.wikipedia.org/wiki/Virginia_Smart_Road
516.
by w8rbt 11y ago
If your account is part of Google Apps for Education, or some other managed Google Apps account, you should contact your Google Apps admin. If it's just a normal Google account, I'm not sure there's much more that you can do.
517.
by w8rbt 11y ago
I believe that Google Authenticator uses TOTP. Six digit HMAC-SHA1 TOTP from a base32 encoded secret using a 30 second timestep. At least, that has been my experience. I wrote an OATH client and it works with Google Authenticator using thos
518.
by w8rbt 11y ago
I'm not sure that it took them "a decade to realize the mistake". They realized it early on. It just took them awhile to fix it.
519.
by w8rbt 11y ago
There are too many commercials on satellite/cable TV. When I'm paying 80 to 100 dollars each month for the service, why do I also have to view commercials every eight minutes? That's why I cancelled.
520.
by w8rbt 11y ago
One thing to keep in mind. If your friend has a Google device using Chrome, and you are close to them (in the same room) it hears your voice as well.
521.
by w8rbt 11y ago
No where electronically. A simple word or phrase in the user's mind would do. Rather than being stored for later retrieval, complex passwords could be generated on-the-fly (when needed) using this word/phrase as input combined wit
522.
by w8rbt 11y ago
The fundamental design flaw of all of these compromised password managers, keychains, etc. is that they keep state in a file. That causes all sorts of problems (syncing among devices, file corruption, unauthorized access, tampering, backups
523.
Password Security – Past, Present and Future(openwall.com)
2 points by w8rbt 11y ago|0 comments
524.
by w8rbt 11y ago
I hope that Microsoft donates money to OpenSSH/OpenBSD. The way I read this, they indicated that they would. "I’m pleased to announce that the PowerShell team will support and contribute to the OpenSSH community."
525.
by w8rbt 11y ago
"Everyone uses the same software, so fixing us means fixing them, and leaving them vulnerable means leaving us vulnerable." As a third option, a country may decide to just patch their devices, but not disclose the vulnerabil
526.
by w8rbt 11y ago
You can buy them for less than $20. I bought a refurbished Tracfone LG 505C about 2 years ago. I use it daily. The battery lasts about a week. Edit: I paid $9.99 for the phone.
527.
by w8rbt 11y ago
"None of which would have mattered if Putty.exe was codesigned. Unfortunately it is not." You mean Autenticode on Windows? I once had an Authenticode code signing cert that I used to sign Windows executables. Mostly, I signe
528.
by w8rbt 11y ago
I would not do this. Intercepting cell phone signals is illegal in the US. If you do this and are caught (brag on Facebook, Twitter), the penalties may be harsh. https://www.law.cornell.edu/uscode/text/18/
529.
by w8rbt 11y ago
Thanks for that explanation. I've never placed any of my GPG keys on a Yubikey. I just assumed that the key password remained.
530.
by w8rbt 11y ago
I don't know how difficult it would be to obtain the key from the device. However, if you have a strong passphrase on the key itself, then even if an attacker obtained the key, there would not be a lot to worry about. Just revoke it an
531.
Bruce Schneier – Surveillance or Security (2014) [video](bbc.com)
32 points by w8rbt 11y ago|5 comments
532.
by w8rbt 11y ago
The 'Recap' section has good advice to address the issue of data loss: My recommendations for Elasticsearch users are unchanged: store your data in a database with better safety guarantees, and continuously upsert every documen
533.
by w8rbt 12y ago
They do. They are bi-endian and default to little on most systems I have seen. The only real big endian system I have left is an old sun Netra.
534.
by w8rbt 12y ago
Great programmers don't typically write books. They are busy writing programs. 'de Raadt on C' would be a good book, wouldn't it? But he'll never have time to write it.
535.
by w8rbt 12y ago
What would happen if tens of millions of vehicles started feeding power grids while sitting in parking lots. I think that could happen someday soon. Edit: Bob Bruninga has written a bit about solar power in cars. Great content. http:/
536.
by w8rbt 12y ago
I knew a guy who had moderate PTSD. He could work and keep a steady job. His number one issue was loud, unexpected noise and sudden surprises. Slamming an office door, for example, would cause him to jump under a desk, run outside, etc. Onc
537.
by w8rbt 12y ago
Convenience and radio waves will be the death of us all. Why do car companies not have expert security and RF guys on staff? This is so predictable.
538.
by w8rbt 12y ago
It should not be difficult to limit ANY queries on Linux systems. Something such as this perhaps (which could be tweaked in various ways): iptables -A INPUT -p udp --dport 53 -m string --from 50 --algo bm --hex-string "|0000FF000
539.
by w8rbt 12y ago
And email is under constant attack. Especially corporate/business email, but personal accounts are now targets as well. Basically anyone with a bank/ebay/paypal account is a target if they have an email address. Spam, malware
540.
by w8rbt 12y ago
telnet and get

More ›