CommieGIR posted:

And BMW, and Mercedes, and basically everyone.

quote:

The signature check was simply bypassed however by….wait…let’s see if you can see the problem. Here is CmdAgent.exe resolving the COM client’s process name to later invoke a signature check from disk:

(diagram showing call to GetModuleFileNameEx)

As you may know, GetModuleFileNameEx just queries the target process’ PEB->Ldr->InMemoryOrderModuleList for full image name. This is in our control of course and can be easily changed within our own process.

CommieGIR posted:

Caveat: SSH should always be behind a VPN. Always.

Midjack posted:

iirc there’s something in the pci spec that requires a human readable number on the card for offline processing

motoh posted:

possibly stdh, but also, brilliant capturing of hostile resources

Diva Cupcake posted:

this should be fun. ms08-067 and eternalblue redux.

https://twitter.com/malwrhunterteam/status/1237438376032251904

klosterdev posted:

quote:

While millions of kids are doing remote learning? That seems like a terrible idea, there is tons of educational sites using flash.

quote:

my kids' teachers have still been assigning Flash websites as school tasks - "play this educational game" sort of stuff - in recent months.

quote:

My teachers are also using Flash-enabled sites for their quiz and presentation

evil_bunnY posted:

my favorite secfuck was a customer putting a not-free coffee machine by the consultants' offices, and us figuring out how to make it spit free coffee in exactly one day.

some HN commenter posted:

I'm surprised congressional office's laptops do not embed remotely detonated explosives/destruction devices triggered with sat or cellular comms.

quote:

An Amazon engineer thought @amazonnews had been hacked because its tweets are so “unnecessarily antagonistic”, per internal problem ticket leaked to me (screenshot below)

quote:

According to Recode, the suspicious tweets in fact came at the behest of Amazon CEO Jeff Bezos, who had recently conveyed disappointment to Amazon officials that the company was not pushing back against criticisms that he considered misleading.

Buck Turgidson posted:

couldn't you just make it one key

Shaggar posted:

case sensitive file systems are incredibly stupid

Shaggar posted:

non-english languages should just be abandoned rather than trying to cater to all their stupid, pointless edge cases.

BrianRx posted:

So uh... is this thread remarkably linguistically diverse (for a US message board), are polyglots overrepresented in the security community, or what? This is all super interesting to me, but this is not the subforum where I expected to read it.

spankmeister posted:

nah this is one of his gimmicks

of course it makes perfect sense for them to substitute the sz character with ss and not sz like the character is called because of course

spankmeister posted:

Its only saving grace is that it's so ubiquitous.

Methanar posted:

my favorite language fact is that the finnish language has no future tense.

Shame Boy posted:

in the specific case of "weird letters for S" it's because the long S and the german ß were both descended from the same original character (do not steal) in ancient roman cursive

lovely cyberpunk near future posted:

The application, entitled “Cryptocurrency System Using Body Activity Data” explains how a “brain wave or body heat emitted from the user when the user performs the task provided by an information service provider, such as viewing an advertisement or using certain internet services, can be used in the mining process.”

By tracking brainwaves when someone watches an advert, Microsoft hopes to use the data generated as a “proof-of-work.” This is the validation of a transaction, or the completion of a task, in a blockchain system, and the way in which creation of currency is validated in a cryptocurrency model.