hybridfree/eevblog-posts huggingface dataset:
AMD CPUs: Transient Scheduler Attacks - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: July 09, 2025, 07:52:45 am
content: Transient Scheduler Attacks are a new class of speculative side channel attacks, found by Microsoft, and considered moderately dangerous.Media:- New security vulnerabilities in various modern AMD Ryzen and Epyc processors -https://www.heise.de/en/news/New-security-vulnerabilities-in-various-modern-AMD-Ryzen-and-Epyc-processors-10479684.html- Linux Patched For Transient Scheduler Attacks "TSA" Impacting AMD CPUs -https://www.phoronix.com/news/Transient-Scheduler-AttacksAMD:- AMD Transient Scheduler Attacks -https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7029.htmlAffected CPUs: specific CPU models based on Zen 3 and 4 architectures (family 19h)
KeePass: a long-running phishing attack - Page 1
Forum section: electronics / general

author: golden_labels
author_rank: Super Contributor
timestamp: May 16, 2025, 03:00:10 am
content: WithSecure’s incident response team uncovered a long-running phishing atack against KeePass users:press release from WithSecure→full report (PDF).tl;dr. The victim downloads a fake installer, which installs a slightly modified version of KeePass. It works like normal KeePass, until a database file is loaded into KeePass. At this point, and only in that scenario, it makes a plaintext copy of the database and drops a trojan to provide access.A pretty rare style, for the 2020s.

author: Halcyon
author_rank: Unknown
timestamp: May 16, 2025, 03:04:31 am
content: There are a lot of users still using KeePass for various reasons. A common one is people "don't trust the cloud" to store passwords.

author: golden_labels
author_rank: Super Contributor
timestamp: May 16, 2025, 05:16:45 am
content: Quote from: Halcyon on May 16, 2025, 03:04:31 amIf that’s a comment referring to my “pretty rare style, for the 2020s,” a clarification. It’s not the target (KeePass) that is rare, but the attack style itself.When it comes to data exfiltration and unauthorized access/use attacks, nowadays it’s usually hit-and-run tactics. Break in, grab whatever you can, disappear; or use to maximum extent until detected and then disappear. The entire attack takes under a second, maybe minutes. Resource use attacks may last days or weeks, until detection, but in this case the adversary just gets lucky; the assumption would still be hours at most.Whereas this case of data exfiltration involves dormant malware waiting for the opportunity weeks or months. In this sense it’s rare. Kind of “old style.”

author: bingo600
author_rank: Super Contributor
timestamp: May 16, 2025, 11:55:39 am
content: Isn't this an "old" attack form ?I'm quite sure that i enabled some Keepass warning, about saving the db in cleartext.Tat advice was in a previous (year+) old warning, about the same stuff.
another Secure Boot bypass - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: June 11, 2025, 02:00:07 pm
content: This time by misusing an NVRAM variable:- A Vulnerability in UEFI Applications allows for secure boot bypass via misused NVRAM variable -https://kb.cert.org/vuls/id/806555- A vulnerability in Insyde H2O UEFI application allows for digital certificate injection via NVRAM variable -https://kb.cert.org/vuls/id/211341- Another Crack in the Chain of Trust: Uncovering (Yet Another) Secure Boot Bypass -https://www.binarly.io/blog/another-crack-in-the-chain-of-trust
Does Lyft record passengers without their consent? - Page 1
Forum section: electronics / general

author: SiliconWizard
author_rank: Super Contributor
timestamp: April 16, 2025, 10:10:30 pm
content: https://www.cbc.ca/news/canada/toronto/lyft-conversation-transcribed-1.7508106They partially admitted it, then retracted. That smells fishy. What do you think? Does any of you know Lyft well enough to have an "insider" view on this?

author: RoGeorge
author_rank: Super Contributor
timestamp: April 17, 2025, 05:24:06 am
content: LOTR: The Fellowship of the Ring--Sam eavesdroppingTheRebricker
MITRE warns that funding for critical CVE program expires today - Page 1
Forum section: electronics / general

author: bitwelder
author_rank: Super Contributor
timestamp: April 16, 2025, 08:13:33 am
content: https://www.bleepingcomputer.com/news/security/mitre-warns-that-funding-for-critical-cve-program-expires-today/MITRE is the organization behind the CVE program, widely used to classify security vulnerabilities.The future of the CVE is uncertain, it might be that MITRE will regain at the last minute its funding, or perhaps a more international (and likely not US-lead) program will take its place.

author: madires
author_rank: Super Contributor
timestamp: April 16, 2025, 10:08:35 am
content: I hope they'll get the funding to continue their work. But I fear that we will see more victims of the current US administration.

author: bitwelder
author_rank: Super Contributor
timestamp: April 16, 2025, 02:01:01 pm
content: There already a couple of announcements, regarding new options:- 'CVE Foundation':https://www.thecvefoundation.org/- 'Global CVE' allocation system:https://gcve.eu/news/

author: bitwelder
author_rank: Super Contributor
timestamp: April 16, 2025, 04:33:07 pm
content: And in the last hours, CISA stepped in and extended the CVE contract, it seems for 11 months:https://www.bleepingcomputer.com/news/security/cisa-extends-funding-to-ensure-no-lapse-in-critical-cve-services/

author: TimFox
author_rank: Super Contributor
timestamp: April 16, 2025, 04:35:15 pm
content: During my career, when an executive higher on the food chain did something I thought unwise, I often asked him "Whom did you ask?".

author: SiliconWizard
author_rank: Super Contributor
timestamp: April 16, 2025, 04:36:34 pm
content: So the contract expired and was renewed within a few hours.
Alert: Registered Offender 0 miles from your home - Page 1
Forum section: electronics / general

author: Stray Electron
author_rank: Super Contributor
timestamp: April 10, 2025, 02:33:51 am
content: My wife got an alert today that a sex offender had moved into a home directly behind us. But I started doing some checking and the criminal statute that they quoted is from North Carolina (several hundred miles from here) and the name of the organization that is supposed to have sent the warning is also listed as being in North Carolina and is NOT connected to Law enforcement. I did a Google search on the name of the organization,Neighborhood Alerts in Raleigh North Carolina, and I quickly found out that they're also sending out all sorts of notices about lost dogs, real estate sales and other unrelated issues. Then I noticed that the Email contained a number of links to forward the warning to Facebook, X, Next Door and other social media sites. So this is almost certainly a Phishing attempt to get people to click on the links and connect to a bogus website that will capture their Facebook (and other) ids and passwords.So if you get an unexpected alert, pay close attention to it anddo not clickon any of the links in it!

author: Halcyon
author_rank: Unknown
timestamp: April 10, 2025, 04:13:08 am
content: Interesting new phishing technique. Not one I've seen before. Do you happen to have a screen shot of the message you can send me?

author: Stray Electron
author_rank: Super Contributor
timestamp: April 10, 2025, 09:40:53 pm
content: My wife forwarded it to me but I will try to get her to make a screenshot of the original message and I will send that to you.

author: madires
author_rank: Super Contributor
timestamp: April 10, 2025, 10:05:48 pm
content: Seems that phishing campaigns are rampant at the moment. Over here I see a lot of aggressive home banking phishing for the last few weeks. Anyhow, the sex offender scheme isn't new. I've read about it a while back at some security blog.

author: Analog Kid
author_rank: Super Contributor
timestamp: April 10, 2025, 10:48:02 pm
content: Quote from: Halcyon on April 10, 2025, 04:13:08 amNot only interesting, but I'd say probably highly effective too.Sounds like a really effective snare likely to catch a lot of cluelesspeople. Which is not to say they're necessarily stupid, just ignorant of what they're dealing with.

author: SiliconWizard
author_rank: Super Contributor
timestamp: April 10, 2025, 10:55:11 pm
content: Quote from: Stray Electron on April 10, 2025, 02:33:51 amGood thing that it didn't point to your own home.

author: madires
author_rank: Super Contributor
timestamp: April 11, 2025, 11:08:31 am
content: From 2015: Phishing scam tricks users by acting as fake child sex offender alert,https://www.scworld.com/brief/phishing-scam-tricks-users-by-acting-as-fake-child-sex-offender-alert
MediaTek WLAN Vuln Score 9.8 - Also affects OpenWrt 19.07, 21.02 (for MT6890) - Page 1
Forum section: electronics / general

author: bingo600
author_rank: Super Contributor
timestamp: April 08, 2025, 12:44:28 pm
content: https://www.cvedetails.com/cve/CVE-2025-20654/https://corp.mediatek.com/product-security-bulletin/April-2025Code:TitleOut-of-bounds write in wlanSeverityCriticalVulnerability TypeRCECWECWE-787 Out-of-bounds WriteDescriptionIn wlan service, there is a possible out of bounds write due to an incorrect bounds check. This could lead to remote code execution with no additional execution privileges needed. User interaction is not needed for exploitation.Affected ChipsetsMT6890, MT7622, MT7915, MT7916, MT7981, MT7986Affected Software VersionsSDK version 7.4.0.1 and before (for MT7622 and MT7915) / SDK version 7.6.7.0 and before (for MT7916, MT7981 and MT7986) / OpenWrt 19.07, 21.02 (for MT6890)
BMC time again: AMI MegaRAC - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: March 19, 2025, 02:23:35 pm
content: Media:- New Critical AMI BMC Vulnerability Enables Remote Server Takeover and Bricking,https://thehackernews.com/2025/03/new-critical-ami-bmc-vulnerability.html- Critical AMI MegaRAC bug can let attackers hijack, brick servers,https://www.bleepingcomputer.com/news/security/critical-ami-megarac-bug-can-let-attackers-hijack-brick-servers/Security researchers:- BMC&C: Redfish Alert 3,https://eclypsium.com/blog/ami-megarac-vulnerabilities-bmc-part-3/Affected vendors (so far, expected to be more than a dozen):- Asus- ASRock Rack- HPE- Lenovo

author: Halcyon
author_rank: Unknown
timestamp: March 21, 2025, 03:30:44 am
content: Another perfect reason not to expose management interfaces to the internet, but people keep doing it!It wasn't that long ago that iLO-1 and iLO-2 interfaces were being popped and replaced with malicious copies of the firmware.Nothing, other than what you want the public to touch, should ever be on the internet with a public IP or via a port forward, with the exception of your VPN server itself.

author: bitwelder
author_rank: Super Contributor
timestamp: March 21, 2025, 08:44:52 am
content: And besides, for something really critical it might be also worth to consider to disable the BMC entirely (there is likely some dip switch or jumper on the mainbord for that), if the price to pay for the loss of serviceability is acceptable.
Vo1d botnet controls 1.6M TVs - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: February 28, 2025, 01:30:50 pm
content: Long Live The Vo1d Botnet: New Variant Hits 1.6 Million TV Globally:https://blog.xlab.qianxin.com/long-live-the-vo1d_botnet/Unfortunately nothing about how the smart TVs got hacked (besides some speculation about supply chain or user behavior).
AMI BMC Vuln - Score = 10 - Page 1
Forum section: electronics / general

author: bingo600
author_rank: Super Contributor
timestamp: March 12, 2025, 03:11:17 pm
content: Just saw this one.I suppose some guyzz here uses AMI BMC.AMI BMC Vuln - Score = 10https://www.cvedetails.com/cve/CVE-2024-54085/https://nvd.nist.gov/vuln/detail/CVE-2024-54085
Google/Mandiant's M-Trends 2025 report - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: April 24, 2025, 11:53:37 am
content: Google/Mandiant's M-Trends 2025 report:- M-Trends 2025: Data, Insights, and Recommendations From the Frontlines,https://cloud.google.com/blog/topics/threat-intelligence/m-trends-2025- PDF:https://services.google.com/fh/files/misc/m-trends-2025-en.pdf- comment from Kevin Beaumont (https://cyberplace.social/@GossiTheDog/114391474274944937):Quote
HP laser printers: RCE via PostScript - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: February 17, 2025, 09:36:20 am
content: Certain HP LaserJet Pro, HP LaserJet Enterprise, HP LaserJet Managed Printers – Potential Remote Code Execution and Potential Elevation of Privilege (https://support.hp.com/us-en/document/ish_11953771-11953793-16/hpsbpi04007)'Certain' is an understatement for 100+ printer models.

author: 5U4GB
author_rank: Super Contributor
timestamp: February 17, 2025, 10:58:42 am
content: You can do it with PCL as well. 30-odd years ago I used to modify the LCD displays on the work printers to say things like "Insert 20c" (from video games) or "Out of cheese".

author: Halcyon
author_rank: Unknown
timestamp: February 17, 2025, 11:23:45 am
content: Quote from: 5U4GB on February 17, 2025, 10:58:42 am"PC Load Letter" was a personal favourite... since we use A4, not letter.

author: peter-h
author_rank: Super Contributor
timestamp: February 17, 2025, 03:45:21 pm
content: This is better thoughhttps://www.eevblog.com/forum/security/hacking-a-toothbrush/

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 18, 2025, 02:36:06 am
content: Typical print jobs on these printers areexecutedon these printers, and the results printed on paper; PostScript itself is actually a programming language. The privilege escalation is valid issue, butremote code executionwhen that's their primary purpose?

author: SiliconWizard
author_rank: Super Contributor
timestamp: February 18, 2025, 04:20:43 am
content: A Postscript interpreter that would allow any kind of escalation is pretty bad IMHO, but if you implement this on a relatively general-purpose OS (which I guess is what printers have now) with no particular isolation, that's what you are bound to get. Maybe the solution is to avoid asking script kiddies to design printers.

author: peter-h
author_rank: Super Contributor
timestamp: February 18, 2025, 09:40:03 am
content: I would have expected the original Laserjet to have been written in assemblerWhat is the problem with a printer being hacked to run code of the attacker's choosing and use this to print something? I suppose you could do practical tricks like randomly changing currency symbolsWhat would be a problem, and this is true for anything on a LAN, is using the device to attack other devices from the inside. For example set up a fake DNS server. That could be very useful.

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 18, 2025, 09:50:13 am
content: Yeah, the actual issue is obviously that malformed inputs can cause the PostScript/PCL interpreter to goof up, and execute some of the input as underlying machine code. I was really poking fun at the reporting, as so few people even remember that PostScript is alanguage, not just an image format of some kind. Would they report a similar bug in the Python interpreter as RCE?
Rsync Vulnerabilities  - Page 1
Forum section: electronics / general

author: SiliconWizard
author_rank: Super Contributor
timestamp: January 18, 2025, 04:17:27 am
content: https://kb.cert.org/vuls/id/952657

author: golden_labels
author_rank: Super Contributor
timestamp: January 18, 2025, 05:44:12 am
content: Update to 3.4.1, not 3.4.0. One of the original fixesintroduced a new bug.Also don’t panic. This vulnerability set is a huge pain to those affected. However, only a very small portion of users is exposed.Naked, anonymous rsync servers are nowadays used primarily for content dissemination. In other cases it’s tunneled over SSH and requires authentication. Even the vulnerable instances, if run on a reasonably well configured system, are containerized.I suspect we will see a rise in botnets size, eagerly eating unupdated mirrors. But not much more at a large scale. It’s not like the world is devastated, because of how ubiquitous rsync is.

author: SiliconWizard
author_rank: Super Contributor
timestamp: January 18, 2025, 06:54:46 am
content: Ah yes, the initial fix was apparently fun. I have looked at the original source code, but not at the fix in 3.4.0 yet - curious to see what they did here.Yes, it's not too bad in practice. But the case is interesting.

author: DiTBho
author_rank: Super Contributor
timestamp: January 18, 2025, 10:33:14 am
content: Running 2009 version

author: DiTBho
author_rank: Super Contributor
timestamp: January 18, 2025, 10:36:35 am
content: My only use case:Gentoo: emerge --syncTo update the portage.No panic.

author: golden_labels
author_rank: Super Contributor
timestamp: January 18, 2025, 03:47:35 pm
content: Quote from: SiliconWizard on January 18, 2025, 06:54:46 amI’d say it’s in that weird quadrant of bad, where alsostaphsits.My post was mostly meant to counter news reports, which just copy paste data from Shodan in an attempt to make headlines more scary.
Cisco: alleged data breach - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: October 15, 2024, 12:06:12 pm
content: Cisco investigates breach after stolen data for sale on hacking forum (https://www.bleepingcomputer.com/news/security/cisco-investigates-breach-after-stolen-data-for-sale-on-hacking-forum/)Maybe they should have asked some network security experts. Wait a second. Oopsie!

author: madires
author_rank: Super Contributor
timestamp: October 20, 2024, 11:00:25 am
content: Update:- Cisco takes DevHub portal offline after hacker publishes stolen data (https://www.bleepingcomputer.com/news/security/cisco-takes-devhub-portal-offline-after-hacker-publishes-stolen-data/)- Cisco Event Response: Reports of Security Incident (https://sec.cloudapps.cisco.com/security/center/resources/october_15_2024)Still ongoing, as the leaker claims to have sensitive data which Cisco denies.

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 31, 2024, 08:41:21 pm
content: Well, they are confident.Let's see if confidence is a legit security measure.
Go Supply Chain Attack - Page 1
Forum section: electronics / general

author: SiliconWizard
author_rank: Super Contributor
timestamp: February 11, 2025, 07:56:47 am
content: Socket researchers have discovered a malicious typosquat package in the Go ecosystem, impersonating the widely used BoltDB database module (github.com/boltdb/bolt), a tool trusted by many organizations including Shopify and Heroku.https://socket.dev/blog/malicious-package-exploits-go-module-proxy-caching-for-persistence
Google, OAuth and recycled domains - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: January 15, 2025, 01:09:40 pm
content: Millions of Accounts Vulnerable due to Google’s OAuth Flaw (https://trufflesecurity.com/blog/millions-at-risk-due-to-google-s-oauth-flaw, includes link to Shmoocon talk).

author: Halcyon
author_rank: Unknown
timestamp: February 06, 2025, 06:50:32 am
content: Eh, I feel like this is blown out of proportion.Firstly, if the defunct company was a user of various tools, unless they keep paying the bill (unlikely), then their services will be terminated and ultimately, deleted, along with their data.I feel, whoever set up these services for these defunct companies in the first place, wasn't doing things correctly. Things like secrets, should never be able to be exploited after a domain or service stops existing (or even whilst it still exists).

author: Siwastaja
author_rank: Super Contributor
timestamp: February 06, 2025, 07:53:14 am
content: Quote from: Halcyon on February 06, 2025, 06:50:32 amMany services are billed annually and/or could have "money in" for a year or even longer; after that runs out, they don't just delete data and prevent access, they transition into "free versions", with data still available. Besides, some services are completely free of cost.QuoteIt is easy to blame them, but it's not an obvious vulnerability at all. I mean, even you fail to recognize it as a serious vulnerability:Quote from: Halcyon on February 06, 2025, 06:50:32 amI never thought about this either. And probably the rest 99% of system admins neither.It's not like Google is the only responsible in this mess, but I always had a feeling that easy centralized log-in could be a colossally bad idea security-wise. But you don't get fired by buyingIBMOAuth.

author: Halcyon
author_rank: Unknown
timestamp: February 06, 2025, 10:56:08 am
content: Even with the disclosure, I'm not about to start scrambling and start doing things differently. It's a matter of monitoring it, like any number of vulnerabilities that come out every week, and if needed, change the way you do things as a CIO/CTO/Head of IT. Which brings me to a point I've been making for years. Senior leadership should understand their craft to some degree, and not simply be a "leader".
Firefox Zero-Day Under Attack: Update Your Browser Immediately - Page 1
Forum section: electronics / general

author: radiolistener
author_rank: Super Contributor
timestamp: October 11, 2024, 12:06:42 pm
content: Mozilla has revealed that a critical security flaw impacting Firefox and Firefox Extended Support Release (ESR) has come under active exploitation in the wild.The vulnerability, tracked asCVE-2024-9680(CVSS score: 9.8 ), has been described as a use-after-free bug in the Animation timeline component."An attacker was able to achieve code execution in the content process by exploiting a use-after-free in Animation timelines," Mozillasaidin a Wednesday advisory."We have had reports of this vulnerability being exploited in the wild."Security researcher Damien Schaeffer from Slovakian company ESET has been credited with discovering and reporting the vulnerability.The issue has been addressed in the following versions of the web browser -Firefox 131.0.2Firefox ESR 128.3.1, andFirefox ESR 115.16.1.There are currently no details on how the vulnerability is being exploited in real-world attacks and the identity of the threat actors behind them.That said, such remote code execution vulnerabilities could be weaponized in several ways, either as part of awatering hole attacktargeting specific websites or by means of adrive-by downloadcampaign that tricks users into visiting bogus websites.Users are advised to update to the latest version to stay protected against active threats.Source:https://thehackernews.com/2024/10/mozilla-warns-of-active-exploitation-in.html

author: Bryn
author_rank: Regular Contributor
timestamp: October 11, 2024, 01:46:14 pm
content: Thank christ I updated my Firefox from 78 ESR yesterday (but for another reason) to 115 ESR...

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 11, 2024, 08:59:08 pm
content: Use after free? I don't get it. I thought Rust had now replaced most of the legacy code?
Exposing The Flaw In Our Phone System - Veritasium video - Page 1
Forum section: electronics / general

author: RoGeorge
author_rank: Super Contributor
timestamp: October 03, 2024, 09:46:39 am
content: Exposing The Flaw In Our Phone SystemVeritasiumSurprised?TL;DR for those not watching the video, a demo of impersonating a mobile phone call and/or rerouting it, with no info other than your phone number. Also location tracking without GPS and all the fun. Requires buying/renting SS7 access services, which should not be anonymous, but still, a 3rd party can spy on your calls, texts, geo-location.

author: madires
author_rank: Super Contributor
timestamp: October 03, 2024, 10:35:18 am
content: Nope! SS7 security issues are known for a long time (the protocol wasn't designed with security in mind). BTW, Karsten Nohl demonstrated that in 2016 in 60 Minutes (https://www.cbsnews.com/news/60-minutes-hacking-your-phone/) and at several CCC congresses, e.g.https://media.ccc.de/v/31c3_-_6122_-_en_-_saal_1_-_201412271830_-_mobile_self-defense_-_karsten_nohl(in 2014). Just cheap clickbaiting.

author: golden_labels
author_rank: Super Contributor
timestamp: October 05, 2024, 01:23:33 am
content: I wouldn’t call that “cheap clickbaiting”. Many videos — including a large portion of Veritasium’s — have clickbaity titles. But that’s just a consequence of being on the algorithm’s treadmill. I wouldn’t hold that against their concent. The content is solid and not cheap sensationalism. Note he even made effort to move away from typical sensationalistic themes: he explained the whys, sketched this as a consequence of structural and organizational complexity instead of malice or ignorance, and shown work is actively done to amend the problem.Take the right perspective. For you or me that kind of attack, and weakness of infrastructure in general, is something obvious. So that may look as painting an ordinary thing like a major discovery. But we are special. We are exceptional among 8 billion people on this planet. We were lucky enough to dive into a topic, most people never even had a chance to scratch the surface of. Look from their perspective.Compared to the infamous electricity incident, I find this video very well made and valuable. And uncomparably better to what a typical journalist would do: post a fear inspiring, oversimplified, half-wrong article in a major newspaper, removing all the context and skipping all parts that could disturb the choosen bias. In the best scenario spreading misinformation, in the worst case making lawmakers take action.
clever new phish weaponizing PowerShell - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: September 20, 2024, 04:21:06 pm
content: This Windows PowerShell Phish Has Scary Potential (https://krebsonsecurity.com/2024/09/this-windows-powershell-phish-has-scary-potential/)

author: ataradov
author_rank: Super Contributor
timestamp: September 20, 2024, 05:55:25 pm
content: I would not call it clever. The instructions are basically "download and runs the virus". Some thinking is required, not just blindly following random instructions that appear on the screen.

author: magic
author_rank: Super Contributor
timestamp: September 20, 2024, 07:15:40 pm
content: But you don't need to download the virus, just paste this command and it downloads itselfI like it.Windows 13 will remove the run dialog

author: coromonadalix
author_rank: Super Contributor
timestamp: September 20, 2024, 07:22:25 pm
content: loll win 14 they wont use 13 lollshould use : force to type the " .\ " to run an command ??
August Windows security update breaks dual boot on Linux systems - Page 1
Forum section: electronics / general

author: bingo600
author_rank: Super Contributor
timestamp: August 21, 2024, 05:41:02 pm
content: https://www.bleepingcomputer.com/news/microsoft/august-windows-security-update-breaks-dual-boot-on-linux-systems/

author: madires
author_rank: Super Contributor
timestamp: August 21, 2024, 06:04:32 pm
content: It's kind of silly since Secure Boot is broken anyway. My advice would be to move from dual-boot to linux running Windows in a VM. This limits Windows' blast radius and is less a hassle.

author: madires
author_rank: Super Contributor
timestamp: August 22, 2024, 12:40:11 pm
content: Fromhttps://learn.microsoft.com/en-us/windows/release-health/status-windows-11-23H2#3377msgdesc:QuoteUsually updates are meant to fix things. But at Microsoft it's the other way around.

author: Infraviolet
author_rank: Super Contributor
timestamp: August 30, 2024, 06:10:04 pm
content: The one piece of good news here, is most dual boot users are more keen on Linux than they are on Windows. When M$ angers this crowd they're a lot more likely to say "**** it, I'm getting M$ out of my life full stop" than to let Linux slip away instead. If their intention was to make things harder for Linux distros as competitor OS's to their's, then Microsoft may have score a serious own-goal here.

author: pcprogrammer
author_rank: Super Contributor
timestamp: August 30, 2024, 06:56:06 pm
content: Quote from: madires on August 21, 2024, 06:04:32 pmDoes not work so good for gaming. That is the only reason I have Windows 10 in a dual boot mode on one of my systems. I like me some gaming now and then.And almost every time I start it up to play a game it pisses me off with yet another update or other bullshit, that might be possible to turn off, but I don't want to go in depth to find out where.I do have a second system (old laptop) running Windows 7 just for my fischertechnik Robopro stuff. Might work under wine, but that is also some trouble to get it up and running. Much easier to just use the separate laptop.

author: themadhippy
author_rank: Super Contributor
timestamp: August 30, 2024, 07:06:19 pm
content: QuoteThats why i bought a games console,plus it breaks the constant upgrade cycle every 6 months to play the latest game

author: pqass
author_rank: Super Contributor
timestamp: August 30, 2024, 08:37:39 pm
content: Hang on....So NEW machines with a NEW (MS approved) UEFI firmware won't let a Linux with a vulnerable GRUB boot?"...many Linux users say that their systems (running Ubuntu, ...) no longer boot after installing the August 2024 Windows updates on the Windows OS." Why is MS f-ing with my firmware?

author: radiolistener
author_rank: Super Contributor
timestamp: August 31, 2024, 12:17:06 am
content: because this is Trojan horse...

author: themadhippy
author_rank: Super Contributor
timestamp: August 31, 2024, 02:13:20 am
content: Quotenot the latest ubuntu,thats a noble numbat
MS Recall is coming back - Page 1
Forum section: electronics / general

author: SiliconWizard
author_rank: Super Contributor
timestamp: August 27, 2024, 09:55:41 pm
content: ... and it's angry.https://arstechnica.com/gadgets/2024/08/microsoft-will-try-the-data-scraping-windows-recall-feature-again-in-october/

author: dferyance
author_rank: Regular Contributor
timestamp: August 29, 2024, 01:25:01 pm
content: They have to show investors that they found a way to make AI useful. Otherwise, that would be throwing money away. Windows is long past the point where features are added to make users or developers lives easier. It is all about monetization and investors.

author: radiolistener
author_rank: Super Contributor
timestamp: August 30, 2024, 03:16:44 am
content: They need to rename their product from Windows to Spyware. For example "MS Spyware 12"... looks good

author: Halcyon
author_rank: Unknown
timestamp: August 30, 2024, 05:00:00 am
content: Just another reason to switch over to Linux or MacOS.

author: radiolistener
author_rank: Super Contributor
timestamp: August 30, 2024, 04:24:30 pm
content: Quote from: Halcyon on August 30, 2024, 05:00:00 amIt looks they deliberately doing all things in order to move Windows users to Linux. And now even don't hide it.
Windows RCE via IPv6 packet (CVE-2024-38063) - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: August 14, 2024, 01:47:47 pm
content: CVE-2024-38063:- Windows TCP/IP Remote Code Execution Vulnerability (https://msrc.microsoft.com/update-guide/vulnerability/CVE-2024-38063)- Critical 0-Click RCE in Windows TCP/IP Stack Impacts All Systems (https://cybersecuritynews.com/0-click-rce-windows-tcp-ip/)If you can't install the latest Windows updates for whatever reason you should disable IPv6.
AMD CPUs: SinkClose - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: August 10, 2024, 12:57:34 pm
content: CVE-2023-31315:- New AMD SinkClose flaw helps install nearly undetectable malware (https://www.bleepingcomputer.com/news/security/new-amd-sinkclose-flaw-helps-install-nearly-undetectable-malware/)- ‘Sinkclose’ Flaw in Hundreds of Millions of AMD Chips Allows Deep, Virtually Unfixable Infections (https://www.wired.com/story/amd-chip-sinkclose-flaw/)- AMD's Security Bulletin: Guest Memory Vulnerabilities (https://www.amd.com/en/resources/product-security/bulletin/amd-sb-7014.html,list of affected CPUs)

author: Ranayna
author_rank: Super Contributor
timestamp: August 12, 2024, 08:52:46 pm
content: Yeah, thats an ugly one.A bit related, i stumbled over this one when i was looking for UEFI Updates for my MSI board:Another SMM related security flaw with Mainboards by MSI. Affecting both Intel and AMD Boards.https://jjensn.com/at-home-in-your-firmware/Fixes are available for that one.For SinkClose we will likely have to wait a bit for updated UEFI versions.
Microsoft 365's useless anti-phishing measures - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: August 11, 2024, 12:12:28 pm
content: A little bit CSS and everything looks hunky-dory:- Exploring Anti-Phishing Measures in Microsoft 365 (https://certitude.consulting/blog/en/o365-anti-phishing-measures/)Classic snake oil security!
M365 Copilot: remote code execution via email - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: August 11, 2024, 06:36:43 am
content: Living off Microsoft Copilot:- BlackHat 2024: Remote code execution attack on M365 Copilot via email (https://borncity.com/win/2024/08/11/blackhat-2024-remote-code-execution-attack-on-m365-copilot-via-email/)- How to Weaponize Microsoft Copilot for Cyberattackers (https://www.darkreading.com/application-security/how-to-weaponize-microsoft-copilot-for-cyberattackers)- Links and materials for Living off Microsoft Copilot (https://labs.zenity.io/p/links-materials-living-off-microsoft-copilot)
0.0.0.0 Day - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: August 09, 2024, 11:48:52 am
content: 0.0.0.0 Day: Exploiting Localhost APIs From the Browser (https://www.oligo.security/blog/0-0-0-0-day-exploiting-localhost-apis-from-the-browser)Affected: all Chromium based browsers, Firefox and Safari running on Linux and MacOS.The issue is known for 18 years (https://bugzilla.mozilla.org/show_bug.cgi?id=354493).

author: SiliconWizard
author_rank: Super Contributor
timestamp: August 09, 2024, 09:51:21 pm
content: 18 years open, nice job.

author: golden_labels
author_rank: Super Contributor
timestamp: August 10, 2024, 06:17:57 pm
content: Another branded vulnerability receiving much more attention than it should.It’s a bypass type vulnerability, which can’t be used by itself. Carrying out an attack requires another program, which already contains a serious vulnerability. Improper handling of data arriving at the socket, an authentication bypass or request handling vulnerability, or no authentication at all.While 0.0.0.0 is kind of special, similar to often overlooked port 0, this is a member of the entire family of issues. Almost all of them not even being bugs and working as intended. A mismatch between how things are meant to work and what programmers and netops did, with browser vendors being expected to fix others’ mistakes to not face FUD.A thing often missed from “0.0.0.0-day” reports is that UDP services are also potentialy vulnerable due to HTTP/3. The risk is even lower than with TCP services, but can’t be ruled out.

author: magic
author_rank: Super Contributor
timestamp: August 10, 2024, 07:20:16 pm
content: Yeah, but there is lots of buggy applications out thereThink all the routers with web UIs, for example. I consider it kinda WTF that Mozilla doesn't see cross-site requests to 192.168.0.0/16 as a problem.
another Microsoft fail: Smart App Control and SmartScreen bypass - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: August 07, 2024, 11:57:04 am
content: Windows Smart App Control, SmartScreen bypass exploited since 2018 (https://www.bleepingcomputer.com/news/microsoft/windows-smart-app-control-smartscreen-bypass-exploited-since-2018/)

author: dferyance
author_rank: Regular Contributor
timestamp: August 08, 2024, 04:30:17 pm
content: Very interesting. It goes to show of how software complexity is the enemy of security. I'm sure the link fixing code was written by someone totally different than the malware detection code. I didn't even know Windows did this link fixing, I bet the team testing the security detection logic didn't either.While it is a fail, honestly, it doesn't seem very bad to me. You download software off the web and run it as your user account, then it can do whatever your user account can. This happens if you get a security popup and bypass it or don't get any popup. I don't believe I've seen Linux or MacOS have any equivalent protection. So in worst case it is as insecure as the alternatives.As an application developer, I've found smartscreen to be annoying. I've had customers complain that we had malware when it was just a new software build that MS hadn't seen before. Or I'll get smartscreen complains on development tools and pre-compiled binaries because they aren't common.
Windows 0day: Windows Update downgrade attack - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: August 08, 2024, 07:10:19 am
content: The 0day:- Windows Update downgrade attack "unpatches" fully-updated systems (https://www.bleepingcomputer.com/news/microsoft/windows-update-downgrade-attack-unpatches-fully-updated-systems/).- Your victim's Windows PC fully patched? Just force undo its updates and exploit away (https://www.theregister.com/2024/08/08/microsoft_windows_updates/)- Black Hat 2024 presentation (https://www.blackhat.com/us-24/briefings/schedule/index.html#windows-downdate-downgrade-attacks-using-windows-updates-38963,link to PDF at the end)- Researcher's blog post: Windows Downdate: Downgrade Attacks Using Windows Updates (https://www.safebreach.com/blog/downgrade-attacks-using-windows-updates/)Unpatched for 6 months! So much for their 'security first' pledge.
Voice over Wi-Fi: Diffie Hellman Picture Show - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: July 30, 2024, 08:43:21 am
content: Diffie Hellman Picture Show: Key Exchange Stories from Commercial VoWiFi Deployments (https://cispa.de/de/research/publications/79513-diffie-hellman-picture-show-key-exchange-stories-from-commercial-vowifi-deployments)(just preprint paper, more to come at Usenix con)The highlight is ZTE using the same ten predefined DH exchange keys in all devices (CVE-2024-22064).
Secure Boot: PKfail - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: July 30, 2024, 08:26:43 am
content: When mainboard manufacturers don't replace test keys:- PKfail: Untrusted Platform Keys Undermine Secure Boot on UEFI Ecosystem (https://www.binarly.io/blog/pkfail-untrusted-platform-keys-undermine-secure-boot-on-uefi-ecosystem)Binarly says that about 10% of the firmware images in their dataset have untrusted platform keys.
Microsoft Security vs. Others for $$$ - Page 1
Forum section: electronics / general

author: EPAIII
author_rank: Super Contributor
timestamp: July 21, 2024, 05:33:18 am
content: I have had the Norton security package for several years now. In spite of having fiber service, my computer takes too long to load pages. I mean, with fiber, they should jump on my screen, shouldn't they.In addition, I am fed up with the constant barrage to buy additional Norton features. Over and over messages pop up urging me to buy this and that add-on.Do I really need anything other than what is provided for free with Windows? And if I do, are there versions available that do not have constant pop-ups? If I don't, how do I turn on all the Windows protections?

author: Halcyon
author_rank: Unknown
timestamp: July 21, 2024, 07:10:40 am
content: For home users, Windows Defender actually does a pretty decent job and would be perfectly fine alone, for many users.If you do want a different anti-virus tool, I personally like ESET. They have a decent product. Bitdefender is also good. It just depends on what features you want. At that consumer level, they all pretty much do the same thing.

author: Psi
author_rank: Super Contributor
timestamp: July 21, 2024, 07:29:24 am
content: Norton security package is bloatware and adware combined.There are zero reasons to use it.If that thing has touched a windows install I always nuke it and start again because it is impossible to remove. It has too many hooks deep into windows that impact performance.The Windows Defender that comes free with windows is great.Combine that with using the virustotal.com website to scan any exe files you download before running them and you are sorted.

author: rsjsouza
author_rank: Super Contributor
timestamp: July 21, 2024, 11:25:40 am
content: One more vote for ESET. They leave you alone and have a reasonable level of alerts.I also installed it on my mother's and mother-in-law's computers since it helps me deflect several simple questions and attempts to sell more stuff.

author: amwales
author_rank: Regular Contributor
timestamp: July 21, 2024, 11:42:17 am
content: Another vote for eset here, non-intrusive the package I have includes a firewall and been using it for many years without complaints.
OpenSSH: regreSSHion — when one vulnerability gets two CVE numbers - Page 1
Forum section: electronics / general

author: golden_labels
author_rank: Super Contributor
timestamp: July 02, 2024, 03:58:39 am
content: The Register,Qualys.CVE-2006-5051 got patched in 2006, but the patch effects were disabled, so now we have CVE-2024-6387.Update to 9.8p1. Don’t forget to restart sshd.
overview of researchers scanning the internet - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: June 22, 2024, 02:06:08 pm
content: When you connect anything to the internet it will be scanned for vulnerabilities. Someone at the Internet Storm Center posted a nice overview about 'security researchers' scanning the whole internet:Friend, foe or something in between? The grey area of 'security research' (https://isc.sans.edu/diary/30670)
buffer overflow in Phoenix UEFI (CVE-2024-0762) - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: June 21, 2024, 01:00:10 pm
content: It's UEFI time again:- Phoenix Technologies Buffer Overflow Vulnerability in TPM Configuration:https://www.phoenix.com/security-notifications/cve-2024-0762/- UEFIcanhazbufferoverflow - Widespread Impact from Vulnerability in Popular PC and Server Firmware:https://eclypsium.com/blog/ueficanhazbufferoverflow-widespread-impact-from-vulnerability-in-popular-pc-and-server-firmware/
RCE in WiFi driver, all supported versions of Windows - Page 1
Forum section: electronics / general

author: golden_labels
author_rank: Super Contributor
timestamp: June 16, 2024, 10:27:21 pm
content: CVE-2024-30078 (GHSA)

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 19, 2024, 01:47:01 am
content: Yep, that's a nice one.

author: Ranayna
author_rank: Super Contributor
timestamp: June 19, 2024, 02:22:55 pm
content: Microsoft lists Server 2008 as affected.That makes it extremely likely that Windows 7 is also affected by this issue. And i wouldn't expect Windows 7 to get an update to fix the problem. Maybe someone can hack the Server 2008 patch.If that is not possible, that marks the end of any reasonable usability of windows 7 systems that rely on wireless connectivity

author: golden_labels
author_rank: Super Contributor
timestamp: June 19, 2024, 02:57:22 pm
content: I wonder, if versions before 6.x are affected. WindowsXP SP3 is still widely used in niche applications and they do use WiFi.Perhaps barcode scanners in stores and screens with advertisements are not high-value targets. Defacing is the primary concern and the PR branch will cover up for that. As far as I understand the attack also requires having access to the network, which reduces its usability against such targets. After all many of them don’t use encryption and are vulnerable to rogue DHCPs in the first place, requiring no sophisticated attacks. But this could still be an interesting situation.
Microsoft whistleblower about Golden SAML and the SolarWinds hack - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: June 14, 2024, 08:22:37 am
content: Microsoft Chose Profit Over Security and Left U.S. Government Vulnerable to Russian Hack, Whistleblower Says:https://www.propublica.org/article/microsoft-solarwinds-golden-saml-data-breach-russian-hackersTL;DR: MS knew about Golden SAML in 2016 but didn't fix the security issue because money comes first. As the US government went cloud a known major security issue would be bad for business. Then the supply chain attack via SolarWinds happened in 2020 (utilizing Golden SAML).
Why no reprogrammable microcode in Apple Silicon (re. security exploits)? - Page 1
Forum section: electronics / general

author: Scratch.HTF
author_rank: Regular Contributor
timestamp: August 13, 2024, 12:48:59 am
content: I've discovered that since Apple has moved to their own ARM-based silicon, the M1/M2/M3 has security flaws which cannot be fixed since the designs had no capability for microcode reprogramming to fix this problem.One possible outcome that it could be used to make ARM-based macOS run on other ARM-based platforms such as the Raspberry Pi (which Apple disallows in their EULA which has been the subject of at least one lawsuit).

author: ataradov
author_rank: Super Contributor
timestamp: August 13, 2024, 02:05:32 am
content: It does not mean there is no microcode at all. Not all issues can be fixed by the microcode. Microcode is not magic, it can't change fundamental architecture of the chip.Also, if you are talking about GoFetch specifically, then it can be fixed by disabling DMP unit, which can be done from the kernel code. And it only really matters during security processing, so you can switch it on and off. So, while it can't be fixed, it can be worked around in the software at a very slight performance degradation.

author: Halcyon
author_rank: Unknown
timestamp: August 13, 2024, 09:57:14 am
content: I believe the Spectre/Meltdown vulnerabilities were similar. Sure they can be fixed with code, at the expense of something else (usually performance).The Apple M-series processor vulnerability was the same. My understanding is that theycouldpatch it, but it would result in quite a significant performance penalty. It also relies on the user being stupid and installing (forcefully) something they shouldn't. If you ask a user "Are you sure?" 3 times, I mean, whose fault is it really?
Windows Security Center API reverse engineered - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: May 24, 2024, 04:39:32 pm
content: Another case of security by obscurity is revealed: the Windows Security Center API is protected by an NDA. Someone had a bit of fun with reverse engineering the API and published a small tool (https://github.com/es3n1n/no-defender).

author: 5U4GB
author_rank: Super Contributor
timestamp: May 25, 2024, 09:02:05 am
content: In this case I think it's justified, years ago MS found so much junk that wanted to do unsavoury things turning the built-in AV off that they made it hard to do it easily. By "unsavoury" I don't mean actual malware but more legit but annoying stuff that wanted to do things that were in the vendor's interest but not the user's interest.