Replying to
@thedarktangent@defcon.social @dcuthbert@defcon.social sounds like they need to replace the antenna with an attenuator, rather than just leaving it disconnected.
Remote
Rogan Dawes
@RoganDawes@infosec.exchange
mastodon 4.8.0-alpha.3+glitchInfosec researcher @ OrangeCyberDefense.
ALL people have the right to exist.
281 Followers
342 Following
35 Posts
Joined November 04, 2022
Replying to on bertha.social
@eltonfc@bertha.social ssh with password auth is a bad idea. But if you use key auth, and disable password auth entirely, I don’t imagine they should have a problem.
Replying to
@n8dmt@mastodon.radio @forty2@oldbytes.space I suggest researching “degloving injuries”, to understand some of the possible downsides of using gloves around power tools. Skin is (fortunately!) relatively weak. If the glove gets caught by the power tool, it can get very ugly!
Replying to
@suriq@infosec.exchange my point is, won’t the scanner read the same (tampered) bytes from the page cache when it tries to calculate the checksum after the exploit? Assuming the cached page has not been evicted, of course.
Replying to
@mkj@social.mkj.earth @eltonfc@bertha.social the advantage is that your IT/security department can audit the security of the ssh configuration externally, without even having to have login access. If you connect to the ssh server and it doesn’t even offer password auth, then you don’t have to worry about how strong any passwords are.
Replying to
@dougmerritt @feld @spaf seems like the original videos were made in the 80/90’s, so maybe that was the quality available at the time. And never redigitised.
Replying to
@LaF0rge I’m in South Africa, work for @sensepost, mostly into #hardwarehacking and making electronic things.
Replying to
@IvanDSM@mastodon.social @f4grx@chaos.social he’s not outside the realm of possibility claiming adb. Just because the rest of user space is not Android, doesn’t mean that you cannot run adbd. It offers some very useful services, that are not Android-specific. In fact, my LTE modem runs adbd (with no other Android bits).
Replying to
@baloo @mica @rebane2001 it’s a good security default. Imagine a bastion host or other program that allows you to ssh to a target host. The expectation is that all you can do is interact with the terminal on the target, or exit. However, the ssh escape allows you to create and delete tunnels, amongst other things, which might not have been anticipated. Disabling by default removes the surprise.
Replying to
@old_angry_queer pretty sure my dad used to cut two longitudinal slits into the middle of the end end, and just bend the the resulting tab up/down as needed.
Replying to
@aparcar@chaos.social @T_X@chaos.social yeah, second the appreciation. It’s a game changer, as long as you remember to add any customisations to the save file.
Possibly silly suggestion: while scanning installed packages, also look for any files on flash that are not part of the packages, or explicitly listed to keep that would otherwise be discarded, and prompt? I realise that it could be quite resource intensive - basically a diff between “find / -xdev -type f” and “for all installed packages: list installed files”
Replying to
@cynicalsecurity@bsd.network @mischa@exquisite.social @dartov@hachyderm.io I mean, this is a simple hardware error that only manifests when in a non-manufacturer-blessed state, but it otherwise IS a serial console design from the 80’s! (TTL serial vs RS-232, if you want to be picky! 😎)
Replying to
@TheRealPomax@mastodon.social @misty@digipres.club out of curiosity, were you able to find any details about the chip inside? Could it be easily reflashed with your own firmware? Eg esphome
Replying to
@Junicast@chaos.social it’s really funny. Tasmota started as the project that you didn’t have to compile yourself, while esphome you did. But then Tasmota split into this mage and that image, with different drivers compiled in each. And now ….
Replying to
@Natasha_Jay without wanting to downplay the importance of this, in such a small study, this is really a case of “50% of the time, it works all the time”.
Those who responded survived! How many responded? “Only” 50%.
But of course, 50% is much better than 0%! Super exciting to even get to that point!
Replying to
@cynicalsecurity@bsd.network @mischa@exquisite.social @dartov@hachyderm.io my Wink hub fails to boot with no serial console attached. Reason is that I have jailbroken it and allowed a keypress to interrupt u-boot. Underlying reason is that there is no pull-up resistor on the rx line, and so it picks up interference, simulating a keypress. Added a pull-up/pulldown resistor and the problem went away.
Replying to
@awfulwoman@indieweb.social I don’t believe they interfere with the readings, but they may interfere size-wise, especially if you choose split-core CT’s - they appear to be a little bigger than solid core, but then installation is more complicated.
Replying to
@whitequark@social.treehouse.systems @haroonmeer@infosec.exchange @ThinkstCanary@mastodon.sdf.org the results of the corruption, presumably?
Replying to on blog.rozman.info
Replying to
@shermozle@aus.social @km@aus.social you don’t power them from mains while reprogramming them. That would be likely to let the smoke out of you and your computer.
Replying to
@jpm@aus.social @hacks4pancakes@infosec.exchange drove a Crumpler for about 20 years until the zip finally gave in. Now got a Goruck GR1 I’m happy enough with.
Replying to
@suriq@infosec.exchange would it really stay green? Surely checksumming the file reads it in exactly the same way that the kernel does to load it into memory. In which case, I would expect it to sum differently to expected.
Replying to
@gregdavill@chaos.social aren’t they light sensitive, though? Cf Pi’s rebooting under flash photography…
Replying to
Replying to
@faebudo@ioc.exchange @ifrauding@don.linxx.net @goncalor@infosec.exchange @campuscodi@mastodon.social literally nothing uses the hdmi Ethernet channel, other than the marketing teams selling cables.
Seems like a handy thing to have, but I think routing complexities (and cost) killed it.
Replying to
@ifrauding@don.linxx.net @goncalor@infosec.exchange @faebudo@ioc.exchange @campuscodi@mastodon.social afaik, the only bidirectional data channels in a display cable are hdmi-cec, and DDI (basically i2c). I’d be interested to see the threat model that they are targeting with this device, that can’t be circumvented by just unplugging it.
Seems like a very particular setup, where eg the computer itself is physically secure, but the display is not.
Replying to
#caturday Three foster kittens settled for a nap within 10 minutes of arriving.
Replying to on chaos.social
@jaseg@chaos.social @gsuberland@chaos.social @azonenberg@ioc.exchange @aleksorsist@mastodon.social reminded me of this hack from 10 years ago: https://hackaday.com/2016/03/15/sdram-logic-analyzer-uses-an-avr-and-a-dirty-trick/
Wonder if it might be possible to do something similar with a high speed ADC and DDR5 DRAM?
