wepple

76 ms·

961.
by wepple 10y ago
> Why are security-aware people not bothered by this idea? I personally don't think we can stop the tide of devices like this. I'm very selective about which devices & services I choose to partake in. > gizmo that I can&
962.
by wepple 11y ago
It gets more interesting when someone has written random data to a disk to wipe it, and authorities assume it's some form of encryption.
963.
by wepple 11y ago
If it was compromised via SQLi, it's likely a lower-tech group. But even fairly advanced attackers don't necessarily know their way around SCADA systems. nor have the resources to take control of often very tech-specific PLC'
964.
by wepple 11y ago
I'd go higher than that. whoever defined the specifications of the project, should've included security as a key component. Of course, there also has to be budget and time allowances to actually make it happen.
965.
by wepple 11y ago
When she started the repetition of 'championships..'; for some reason it seemed too doctored to be part of real story telling.
966.
by wepple 11y ago
lets not forget that this isn't actually all that practical in practice. It's not executing any old binary: the 'shellcode' has to be position-independent and can't rely on any normal PE features; it has to do all i
967.
by wepple 11y ago
it mandates providing capability for interception, interference, and acquisition. I wonder if we're going to see companies making increased efforts to make as much customer information completely unavailable to themselves to make these
968.
by wepple 11y ago
The PDF format is unbelievably complex, far more than is necessary for the average sales brochure or report. Given that nearly all reader implementations are written in C/C++, it's always going to be an easy target. Sandboxing has
969.
by wepple 11y ago
I'd hazard a guess that unless the vendor can provide over-the-air updates and every system which plugs into these telematics units can also be easily upgradeable to incorporate the new added auth functionality, it might be better just
970.
by wepple 11y ago
I don't think it's impossible. Manufacturers should provide the software for audit and assessment. Car tinkerers[1] can usually quite easily pull various firmwares directly off chip, and if the two diverge in a significant way the
971.
by wepple 11y ago
if you don't mind; which country & what value do people see in them? I'm new to all the smart-this smart-that, but know there are likely useful features.
972.
by wepple 11y ago
agree; a device cheaper than a steak connecting to an IP address isn't news - just because it's a Chinese IP address doesn't mean you've got awesome presentation material.
973.
by wepple 11y ago
"only works half the time" is a bit of a stretch. what's your OS kernel written in? I agree we could do better than C. Everyone here talks about it every time this happens, but does nothing. I'll take battle-hardened C o
974.
by wepple 11y ago
I'd argue Comodo isn't a security company. It's a software company that markets software which intends to have a positive effect on one aspect of your security (namely, malware). They're using 20 yearold ineffective tech
975.
by wepple 11y ago
In fact, I'd be intrigued if you could name many other people who've made such a massive fortune and then risked bankruptcy over such ambitious ideas? The Gates and Zuckerbergs of this world are prepared to part their amassed fort
976.
by wepple 11y ago
Yeah exactly my thoughts. The cynic in me is thinking "hey, funny that a company selling SSL Certs wrote an article about how great SSL Certs are which doesn't do much more than state side-benefits to one primary benefit of having
977.
by wepple 11y ago
Think of it as occuring between TCP and HTTP. So you browser establishes a network connection to example.org, then negotiates to speak SSL/TLS, and then all the web things happen over the top of that (there are minor exceptions for vho
978.
by wepple 11y ago
In Shenzhen? Yeah everything is off by just enough to make google maps no good - it shows several streets in the PRC side accidentally go across the river to HK. I spent several months there and Bing maps was the winner.
979.
by wepple 11y ago
This may be a good time to bring up the various big corps who are trying to prevent reverse engineering... while even they can't keep tabs on knowing what is actually being executed on the hardware we pay them for.
980.
by wepple 11y ago
I feel that privilege escalation/lateral movement is implicitly discluded from almost all bug bounty programs, most researchers know that. It's a really grey area beyond an initial 'access bug', so it pays not to go ther
981.
by wepple 11y ago
This isn't working for me, the code I'm supposed to scan won't show up, just Connecting.... (I installed from github)
982.
by wepple 11y ago
This isn't working for me - the code that is supposed to show up for me to scan doesn't work, I just see: connecting....
983.
by wepple 11y ago
You may have a point there, but what are you suggesting we do about making progress on this?
984.
by wepple 11y ago
I've been living in the UK for 2 years now, and just came back from several months in China. Having been fairly 'cautious' about the surveillance situation in China, I returned only to realise it isn't a whole lot better
985.
by wepple 11y ago
I agree. If/when anyone starts building programs people care about in rust/go/etc - there will be vulnerabilities. Suggesting that throwing thousands of lines worth of virtual machine behind a piece of code will solve secur
986.
by wepple 11y ago
paper: https://www.usenix.org/sites/default/files/sec15_supplement.... "The transponder uses a 96-bit secret key and a proprietary cipher in order to authenticate to the vehicle." not sure there&#x2
987.
by wepple 11y ago
This should be read as "race for armed AI", not "an arms race toward the goal of AI". Very sneakily worded.
988.
by wepple 11y ago
Any chance there's a recorded talk of this? It'd be awesome to have some of the detail filled in
989.
by wepple 11y ago
another security: risky.biz A good honest news segment highlighting the things you should know, plus a generally good feature, and a sprinkling of humour across it all.
990.
by wepple 11y ago
I would however appreciate more detail on the breach. This would at least give an indication of their general security posture. I'm reading this as an embarrassing security lapse in general security, so they misdirect by talking in dep

More ›