hybridfree/eevblog-posts huggingface dataset:
Neat site that lists IP ranges per country (downloadable tables) - Page 1
Forum section: electronics / general

author: bingo600
author_rank: Super Contributor
timestamp: May 19, 2024, 03:09:56 pm
content: Nice site with "Consolidated CIDR's" of different countries.https://ipv4.fetus.jp/Githttps://github.com/fetus-hina/ipv4.fetus.jp-exports/tree/masterI used "Raw git" lists directly in my firewall, updated once a day.I know it's not much worth securitywise, as hackers also know VPN & Hosting and often uses other hacked machines as proxy.But it gave me a"Nice ..."feeling to block a few countries./Bingo

author: madires
author_rank: Super Contributor
timestamp: May 19, 2024, 04:09:52 pm
content: There are many websites providing lists of country specific network prefixes. If you need IPv4 and IPv6 have a look athttps://github.com/herrbischoff/country-ip-blocks. Or you can consult the sources of all that data, i.e. the whois databases of the RIRs.

author: golden_labels
author_rank: Super Contributor
timestamp: May 19, 2024, 09:36:11 pm
content: This seems like nothing more than a compilation from RIRs. That is: one is receiving registration country ofthe AS owner. While there is a high correlation between the AS and location of addresses within it, address leasing and IP anycast make it less reliable. This is very different from e.g. what Maxmind offered in their now defunct database or what market intelligence services sell.That doesn’t mean it’s useless. It removes pointless load from upstreams and saves users some work. But don’t get a wrong picture of what’s delivered.The use is also limited. It may be used to set the default options for the client: e.g. legal framework, shipping options, taxation, CDN etc. But not only often these are poorly implemented or outright abused,(2)Much more often it’s simply used to enforce racist stances or implement atavistic reactions. It bears zero relevance to security: if anything, bloclists (e.g. from spamhaus) are working well. But even them are controversial on many levels.(1)The most famous example: AS15169 is registered in US, yet many of its addresses are physically neighbours of AS5617 in Warsaw (Poland). You may recognize this ASN from 8.8.8.8 being in it, but it’s much bigger than just the DNS service.(2)eBay is a good example of both. Services facing registered users get confused and you receive a mix of two language versions. On top of that eBay limits service’s features based on your location.
CVE-2024-3661: forcing any VPN traffic to be routed outside the VPN tunnel - Page 1
Forum section: electronics / general

author: golden_labels
author_rank: Super Contributor
timestamp: May 06, 2024, 09:24:09 pm
content: ArsTechnica: Novel attack against virtually all VPN apps neuters their entire purposeThe attack goes against deployment, not the technology itself. VPN protocols and implementations are not affected.
another Microsoft oopsie - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: April 10, 2024, 10:33:06 am
content: Microsoft employees exposed internal passwords in security lapse:https://techcrunch.com/2024/04/09/microsoft-employees-exposed-internal-passwords-security-lapseQuote

author: SiliconWizard
author_rank: Super Contributor
timestamp: April 16, 2024, 08:42:38 pm
content: That shows interesting methods at MS.

author: radiolistener
author_rank: Super Contributor
timestamp: April 26, 2024, 01:00:18 pm
content: This is Microsoft...
BatBadBut, command injection on Windows - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: April 10, 2024, 01:39:58 pm
content: BatBadBut: You can't securely execute commands on Windows:https://flatt.tech/research/posts/batbadbut-you-cant-securely-execute-commands-on-windows/Quote

author: ejeffrey
author_rank: Super Contributor
timestamp: April 18, 2024, 03:27:18 am
content: This requires that you pass raw user input on the command line to CreateProcess and the executable resolved to a batch file. That should be relatively rare. Still it's annoying the way command line expansion works in Windows. You have to know whether the target of CreateProcess is a binary or script to decide whether you should escape the arguments or not. Running scripts like this on Unix systems is also a potential source of problems.but at least execve works relatively predictably.
Putty/FileZilla - Keygen Vuln - Page 1
Forum section: electronics / general

author: bingo600
author_rank: Super Contributor
timestamp: April 16, 2024, 04:16:30 am
content: Not likely to be a "bad one" , unless you are commting to git etc. with Putty.But do update your Putty, FileZilla etc ...https://www.cvedetails.com/cve/CVE-2024-31497/https://cve.mitre.org/cgi-bin/cvename.cgi?name=CVE-2024-31497All NIST P-521 client keys used with PuTTY must be considered compromised, given that the attack can be carried out even after the root cause has been fixed in the source code (assuming that ~60 pre-patch signatures are available to an adversary).### MitigationsThis vulnerability has been fixed in PuTTY 0.81, FileZilla 3.67.0, WinSCP 6.3.3, and TortoiseGit 2.15.0.1. Users of TortoiseSVN are advised to configure TortoiseSVN to use Plink from the latest PuTTY 0.81 release when accessing a SVN repository via SSH until a patch becomes available.

author: Halcyon
author_rank: Unknown
timestamp: April 16, 2024, 04:58:48 am
content: Revoke and regenerate keys on the server end as well.
HTTP/2 CONTINUATION Flood - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: April 05, 2024, 12:12:19 pm
content: For anyone running an HTTP/2 webserver:https://nowotarski.info/http2-continuation-flood/From the webpage:QuoteBTW, Apache httpd v2.4.59 (includes fix) was released yesterday.
Problem with high CPU consumption by the WMIPrvSE service - Page 1
Forum section: electronics / general

author: max-bit
author_rank: Frequent Contributor
timestamp: April 02, 2024, 04:24:07 pm
content: Problem with high CPU consumption by the WMIPrvSE service.At all times, this service consumes approximately 2-5% of CPU power.Even if I delete the process, it comes back after a while and continues to do the same thing
Apple CPUs: side-channel attack via DMPs (GoFetch) - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: March 21, 2024, 09:26:17 pm
content: https://gofetch.fail/:QuoteAffected CPUs are m1, m2 and m3.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 22, 2024, 12:03:15 am
content: This is actually not the first DMP vulnerability that has been found:https://www.prefetchers.info/
AnyDesk hacked - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: February 05, 2024, 01:01:26 pm
content: In case you're using AnyDesk make sure to update to the latest version (Windows client v8.0.8, signed with a new certificate). You can find a quite comprehensive report athttps://borncity.com/win/2024/02/03/anydesk-confirmed-they-have-been-hacked-in-january-2024-production-systems-affected/(several parts).

author: kripton2035
author_rank: Super Contributor
timestamp: February 05, 2024, 01:15:11 pm
content: seems like version 8 is for windows. what about the macos or linux v7 ?thanks for the info.

author: madires
author_rank: Super Contributor
timestamp: February 05, 2024, 02:57:35 pm
content: The latest version for macOS is v7.3.0 and for linux v6.3.0.

author: madires
author_rank: Super Contributor
timestamp: February 06, 2024, 12:44:01 pm
content: Update:Custom clients (customized version of the AnyDesk client) are still signed with the old cert when generated by the website, but they should be fine. In a few weeks they'll be signed with the new cert.

author: madires
author_rank: Super Contributor
timestamp: February 12, 2024, 02:40:11 pm
content: Update:A third party asked the CA (DigiCert) to revoke the old cert and the CA agreed. Tomorrow the old cert becomes invalid. At the moment no custom clients can be generated. This leaves support teams using a custom client in limbo, as the custom client with the old cert should be rejected soon by the OS when the CRL (certificate revokation list) is updated.
Linux Debian12 How to bypass login and password? - Page 1
Forum section: electronics / general

author: Jester
author_rank: Frequent Contributor
timestamp: January 15, 2024, 05:33:12 pm
content: I'm a total Linux newbie, so please bear with me....I have installed LinuxCNC 2.91 under Debian12. Everytime the machine starts I need to enter username and password. This PC will be dedicated to a milling machine and will only be by used by me, and will probably not be connected to the internet so it would be more convenient if on power-up the login and password screen would simply be bypassed. I did find one reference stating to modifylightdm.confSo I opened a command prompt and typed "sudo nano /etc/lightdm/lightdm.conf" and then removed (under the "[Seat:*]" section, the '#' for the following two lines (I assume the # means comment) and added my user name after =Changed.....#autologin-user=#autologin-user-timeout=0toautologin-user=myusernameautologin-user-timeout=0I then did ^O, and ^X the file appears to have been updated, because when I reopen the file I can see my changes.This does NOT seem to work and does not address the password aspect.myusername is my actual usernameSuggestions welcome.

author: madires
author_rank: Super Contributor
timestamp: January 15, 2024, 06:33:34 pm
content: Do you run the LightDM window manager? If yes, have you also set up the autologin group? Please seehttps://wiki.archlinux.org/title/LightDM#Enabling_autologin.

author: Jester
author_rank: Frequent Contributor
timestamp: January 15, 2024, 07:03:12 pm
content: This is resolved, stupid one extra l in the username in the file
SMTP Smuggling - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: December 23, 2023, 04:04:39 pm
content: Some security researchers had fun with SMTP's end-of-message sequence (<CR><LF>.<CR><LF>):SMTP Smuggling - Spoofing E-Mails Worldwide (https://sec-consult.com/blog/detail/smtp-smuggling-spoofing-e-mails-worldwide)A few MTAs accept variations of the end-of-message sequence, e.g. <CR>.<CR>, and enable an attacker to smuggle and spoof emails including SPF. GMX and Microsoft have fixed the security issue, while Cisco claims it's a feature. It can be configured by the customer, but the default setting is to allow messages with an invalid end-of-message sequence and to convert it into the standard format.

author: Halcyon
author_rank: Unknown
timestamp: December 24, 2023, 09:13:22 am
content: So the takeaway is, implement a strong DMARC policy (which is the default recommendation on all reputable email services, including Google Workspace, Microsoft 365 etc...).For those on M365, set up a mail flow rule that actually rejects emails that fail DMARC (as opposed to going to Quarantine). Microsoft in their wisdom ignore thep=rejecttag and decide to do their own thing.Sysadmins that think their mail servers that they set up 15 years ago are still secure need to reconsider their profession.

author: madires
author_rank: Super Contributor
timestamp: December 24, 2023, 11:59:19 am
content: ... after an extensive period of testing. SPF is pretty simple, but DKIM causes headaches. Some large mail hosters do stupid things which break the DKIM check when receiving emails. For example, one mail hoster adds a specific header line if it's not set already. When the sender MTA signs the non-existence of that header line in DKIM, the mail hoster's MTA adds the header line and the DKIM verification fails. Also, the RFCs for DKIM are sloppy and a few mail hosters have created their own standards.
Downfall (Intel) and Inception (AMD) - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: August 09, 2023, 11:45:07 am
content: Another round of CPU vulnerabilities.Intel:- Downfall Attacks (https://downfall.page/)- New Downfall attacks on Intel CPUs steal encryption keys, data (https://www.bleepingcomputer.com/news/security/new-downfall-attacks-on-intel-cpus-steal-encryption-keys-data/)AMD:- Inception: how a simple XOR can cause a Microarchitectural Stack Overflow (https://comsec.ethz.ch/research/microarch/inception/)- New Inception attack leaks sensitive data from all AMD Zen CPUs (https://www.bleepingcomputer.com/news/security/new-inception-attack-leaks-sensitive-data-from-all-amd-zen-cpus/)

author: SiliconWizard
author_rank: Super Contributor
timestamp: August 09, 2023, 09:50:32 pm
content: Pretty interesting.

author: DavidAlfa
author_rank: Super Contributor
timestamp: August 09, 2023, 10:29:04 pm
content: Great, the same shit again, buy the latest powerful CPU, then see how the performance decays by 50% in 2 years because all the security microcode patches.
Mozilla VPN client disaster (linux) - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: August 04, 2023, 02:55:16 pm
content: Mozilla VPN: CVE-2023-4104: Privileged vpndaemon on Linux wrongly and incompletely implements Polkit authentication:https://www.openwall.com/lists/oss-security/2023/08/03/1As you can see in the timeline, Mozilla handles this issue very professionally.

author: SiliconWizard
author_rank: Super Contributor
timestamp: August 04, 2023, 09:28:06 pm
content: Haven't they rewritten this in Rust already?

author: madires
author_rank: Super Contributor
timestamp: August 05, 2023, 10:14:47 am
content: No idea!

author: Nominal Animal
author_rank: Super Contributor
timestamp: August 05, 2023, 01:22:38 pm
content: Polkit itself should be burninated with extreme prejudice, being a critical security component developed by a small group of inept programmers, resulting in pretty damning CVE's at regular intervals, with at least two CVEs with known public exploits for local privilege escalation. Maybe just rename it to Insecit...

author: SiliconWizard
author_rank: Super Contributor
timestamp: August 06, 2023, 08:54:57 pm
content: Yep.
Mirai still active - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: June 30, 2023, 08:22:47 am
content: IoT Under Siege: The Anatomy of the Latest Mirai Campaign Leveraging Multiple IoT Exploits:https://unit42.paloaltonetworks.com/mirai-variant-targets-iot-exploits/This means that there are still tons of unpatched devices.
Mailserver hacking attempts increased quite a bit - Page 1
Forum section: electronics / general

author: bingo600
author_rank: Super Contributor
timestamp: July 29, 2023, 12:28:11 pm
content: My Fail2Ban is currently banning 200+ unsuccesful maillogin attempts per day, on my server.That's a huge increase that has occurred, during the last 2 month or so.Nothing to do about itGlad i have fail2ban installed/Bingo

author: bitwelder
author_rank: Super Contributor
timestamp: July 31, 2023, 06:23:40 am
content: "maillogin" i.e. somebody trying to authenticate on it to send (likely) spam around the 'net ?But yes, fail2ban is often quite essential if one has to keep a server exposed

author: madires
author_rank: Super Contributor
timestamp: August 04, 2023, 02:36:06 pm
content: A few weeks back some botnet started running a new spam method. They are performing RCPT flooding, i.e. one email with 100 receipients (random names from a list, same domain). At first I set up an increasing delay (below the TCP timeout) for each RCPT, causing the bots being kept busy for several hours.Then I switched to a filter rule which responds with an error after a few failed RCPTs. Around last weekend there was an aggressive classic SPAM compaign.
Zenbleed (AMD's Zen-2 CPUs affected) - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: July 25, 2023, 12:39:46 pm
content: Do you remember Spectre? There's something similar specificly for AMD's Zen-2 CPUs:https://lock.cmpxchg8b.com/zenbleed.htmlMicrocode updates are already available for Epyc CPUs (all other Zen-2 CPUs: Q4).

author: SiliconWizard
author_rank: Super Contributor
timestamp: July 25, 2023, 09:37:21 pm
content: Yes i've seen that in Linux kernel discussions.
Rowhammer's little brother: RowPress - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: June 27, 2023, 11:43:07 am
content: A new sidechannel attack on DRAM:RowPress: Amplifying Read Disturbance in Modern DRAM Chips (https://dl.acm.org/doi/abs/10.1145/3579371.3589063)
MOVEit - secure data transfers with 0-day - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: June 06, 2023, 01:00:37 pm
content: The 0-day:Zero-Day Vulnerability in MOVEit Transfer Exploited for Data Theft (https://www.mandiant.com/resources/blog/zero-day-moveit-data-theft)The victims:MOVEit hack: BBC, BA and Boots among cyber attack victims (https://www.bbc.com/news/technology-65814104)The bad guys:Microsoft Links MOVEit Attack to Cl0p as British Airways, BBC Fall (https://www.darkreading.com/application-security/microsoft-links-moveit-attack-cl0p-british-airways-fall)

author: madires
author_rank: Super Contributor
timestamp: June 16, 2023, 08:38:06 am
content: Used since 2021:Clop Ransomware Likely Sitting on MOVEit Transfer Vulnerability (CVE-2023-34362) Since 2021 (https://www.kroll.com/en/insights/publications/cyber/clop-ransomware-moveit-transfer-vulnerability-cve-2023-34362)And there's a second vulnerability:MOVEit Transfer Critical Vulnerability – CVE Pending (June 15, 2023) (https://community.progress.com/s/article/MOVEit-Transfer-Critical-Vulnerability-15June2023)More victims:State governments among victims of MoveIT Transfer breach (https://www.techtarget.com/searchsecurity/news/366541896/State-governments-among-victims-of-MoveIT-Transfer-breach)US gov agencies slammed by MOVEit hack (https://cybernews.com/security/us-gov-agencies-hit-moveit-attack-clop/)Russian cybercrime gang hacks federal agencies (https://www.politico.com/news/2023/06/15/multiple-federal-agencies-hit-by-hack-00102229)

author: madires
author_rank: Super Contributor
timestamp: June 21, 2023, 02:33:13 pm
content: Another victim: NortonLifeLockNortonLifeLock Hacked, Cl0p Ransomware Gang Takes Responsibility (https://thecyberexpress.com/nortonlifelock-hacked-cl0p-ransomware-moveit/)And there's already a database of victims:MOVEit victim list (https://konbriefing.com/en-topics/cyber-attacks-moveit-victim-list.html)

author: SiliconWizard
author_rank: Super Contributor
timestamp: June 21, 2023, 09:50:47 pm
content: Well, the name is well choosen, data is being moved all over the place indeed.Nice web site:https://www.progress.com/moveit
HP again: 50+ LaserJet MFPs with buffer overflow (CVE-2023-1329) - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: June 15, 2023, 09:41:25 am
content: Certain HP Enterprise LaserJet MFP Products – Potential Buffer Overflow, Remote Code Execution:https://support.hp.com/us-en/document/ish_8585737-8585769-16/hpsbpi03849
False-positive Defender virus detection in Firefox en-GB language extension - Page 1
Forum section: electronics / general

author: HwAoRrDk
author_rank: Super Contributor
timestamp: June 12, 2023, 03:45:31 pm
content: Anybody else recently been getting a virus detection by Windows Defender for 'Trojan:Script/Wacatac.B!ml' in the en-GB language pack for Firefox?It detects it inextensions\langpack-en-GB@firefox.mozilla.org.xpiin the Firefox profile directory.Judging from a quick Google search, 'Wacatac' seems to be notorious for false-positive detections in all sorts of things, so I'm pretty sure it's a false positive. So, no thank you Defender, I don't want you to quarantine or delete the file - I need it for my web browser to work!However, that being said, if I remove the extension (via the proper means, not deleting the file), will my Firefox revert to a default interface language, presumably en-US? I suspect I'm going to get bothered by this false detection every day until the Defender signatures get updated (or the extension is updated to avoid whatever triggers detection).

author: bitwelder
author_rank: Super Contributor
timestamp: June 14, 2023, 10:41:52 am
content: Have you tried to upload that file to virustotal.com and see what it reports?
Unplug your Nexx IoT! - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: April 06, 2023, 08:57:41 am
content: Nexx did a lot of stupid things securitywise:- Open garage doors anywhere in the world by exploiting this “smart” device (https://arstechnica.com/information-technology/2023/04/open-garage-doors-anywhere-in-the-world-by-exploiting-this-smart-device/)- The Uninvited Guest: IDORs, Garage Doors, and Stolen Secrets (https://medium.com/@samsabetan/the-uninvited-guest-idors-garage-doors-and-stolen-secrets-e4b49e02dadc)
script kiddie at work :) - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: March 09, 2023, 03:11:20 pm
content: Logfiles are a great source of information. Not just for debugging or statistics, but also to see what the bad guys are doing at the moment. While looking at webserver logs I stumbled across multiple log entries with a specific request:"POST /boaform/admin/formLogin HTTP/1.1"The first thing I noticed is that the request comes from just a few IPv4 addresses, each one trying up to three times a day for the last week (at least). After the first try and a 404 response from the webserver it should be clear that it doesn't work. Why keep running the same request multiple times each day anyhow? A quick search returned a link to an exploit (https://github.com/Haniwa0x01/CVE-2022-30023) for the Tenda HG9, a GPON ONT / WiFi router, and CVE-2022-30023 (https://nvd.nist.gov/vuln/detail/CVE-2022-30023). So someone is looking for vulnerable Tenda HG9s and the multiple requests each day make sense now, as SOHO routers can get a new IP address after running for a while or a power outage (classic dynamic IP address scheme). However, many telcos migrate (or already have) to CGNAT or DS-lite because of the lack of IPv4 addresses and it becomes harder to connect to SOHO routers via IPv4.
BingBang: MS screwed up Azure AD configuration - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: March 30, 2023, 12:04:36 pm
content: BingBang: The AAD misconfiguration that led to Bing.com results manipulation and account takeover explained (https://www.wiz.io/blog/azure-active-directory-bing-misconfiguration)
MSI screwed up Secure Boot default setting for >290 mainboards - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: January 17, 2023, 07:08:29 pm
content: MSI accidentally breaks Secure Boot for hundreds of motherboards:https://www.bleepingcomputer.com/news/security/msi-accidentally-breaks-secure-boot-for-hundreds-of-motherboards/

author: magic
author_rank: Super Contributor
timestamp: January 17, 2023, 08:28:38 pm
content: Meh, just changed the default settings.Reminder to always review all relevant BIOS settings before assuming that something will work

author: Infraviolet
author_rank: Super Contributor
timestamp: March 01, 2023, 06:36:54 pm
content: Sounds good news to me. If one is relying on "secureboot" to keep one "secure", then one's OS has already been hacked in practice and a hacker can access any files and modify any system settings as if they were the system's highest level of administrator. Secureboot is a line of "defence" which is behind all the things you want to protect, the only thing it is about securing is M$'s monopoly against competitor operating systems. I'd be much happier with a PC that doesn't secure boot by default (because this so-called screw-up was just a default setting not even a total inability to do it) or doesn't have secureboot at all, than with one which has a locked secureboot (which M$ seems to be working towards with the Pluton SoC concept) forcing users in to the Windows stockade.

author: Siwastaja
author_rank: Super Contributor
timestamp: March 02, 2023, 07:25:18 am
content: "Over 290 MSI motherboards are reportedly affected by an insecure default UEFI Secure Boot setting settings that allows any operating system image to run regardless of whether it has a wrong or missing signature."So they accidentally supplied a working firmware, bypassing Microsoft's bullcrap, which never had anything to do with security despite the name? What a pity.

author: DimitriP
author_rank: Super Contributor
timestamp: March 02, 2023, 08:29:01 am
content: Quote from: Siwastaja on March 02, 2023, 07:25:18 amThey "accidentally" made it work with "any" operating system.If I were MSI I would be accident-prone too

author: RoGeorge
author_rank: Super Contributor
timestamp: March 02, 2023, 08:40:46 am
content: MSI did the good thing. Mandatory secure boot is a plague.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 02, 2023, 10:01:38 pm
content: Quote from: RoGeorge on March 02, 2023, 08:40:46 amIndeed.
UEFI bootkit BlackLotus - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: March 02, 2023, 12:56:42 pm
content: BlackLotus UEFI bootkit: Myth confirmed:https://www.welivesecurity.com/2023/03/01/blacklotus-uefi-bootkit-myth-confirmed/

author: Messtechniker
author_rank: Frequent Contributor
timestamp: March 02, 2023, 02:08:16 pm
content: This had to happen. UEFI replacing BIOS was a bad idea from the start. No more basic any more. Thus increasing vulnerability. Also not having a write protection jumper is security-wise a bad idea. Even not all BIOSes had one. So there we are now.
GoDaddy: multi-year attack - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: February 18, 2023, 02:54:11 pm
content: When you slowly figure out that you got owned for years...GoDaddy: Hackers stole source code, installed malware in multi-year breach (https://www.bleepingcomputer.com/news/security/godaddy-hackers-stole-source-code-installed-malware-in-multi-year-breach/)

author: golden_labels
author_rank: Super Contributor
timestamp: February 18, 2023, 05:40:15 pm
content: Assuming admins and sec team discovering the incident were working in the company for years, hence this being their responsibility, imagine what was going in their heads when they were learning about the scale of the problem. A guess a few of them were hoping this is just a nightmare and they’ll wake up any moment.But don’t worry, I am sure the PR branch of GoDaddy is already working hard on covering that. They may even get premium this month. Everything is fine, the society may continue as if nothing has happened. /s

author: Nominal Animal
author_rank: Super Contributor
timestamp: February 19, 2023, 10:05:11 am
content: "sophisticated threat actor group" ... that penetrated our cPanel.That's like claiming a highly-organized, well-funded militant group raided the local supermarket, with all lollipops on the bottommost shelf being taken and nothing else.

author: Halcyon
author_rank: Unknown
timestamp: February 21, 2023, 09:26:51 am
content: Quote from: Nominal Animal on February 19, 2023, 10:05:11 amSimilar assumptions were going around regarding the Optus hack when it couldn't be further from the truth. The exploit was simple and as a result of stupid.

author: madires
author_rank: Super Contributor
timestamp: February 27, 2023, 04:23:07 pm
content: When Low-Tech Hacks Cause High-Impact Breaches:https://krebsonsecurity.com/2023/02/when-low-tech-hacks-cause-high-impact-breaches/
Update on CVE-2021-35394 (Realtek Jungle SDK) - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: January 26, 2023, 02:50:23 pm
content: Do you remember CVE-2021-35394 (Realtek Jungle SDK) which affected tons of WiFI routers? If not, please see: Advisory: Multiple issues in Realtek SDK affect hundreds of thousands of devices down the supply chain (https://onekey.com/blog/advisory-multiple-issues-realtek-sdk-iot-supply-chain/). This vulnerability is still actively exploited: Realtek SDK Vulnerability Attacks Highlight IoT Supply Chain Threats (https://unit42.paloaltonetworks.com/realtek-sdk-vulnerability/).It's sad to see so many unpatched routers still in service.
when your TV box comes preinstalled with malware - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: January 14, 2023, 09:44:41 am
content: Android TV box on Amazon came pre-installed with malware:https://www.bleepingcomputer.com/news/security/android-tv-box-on-amazon-came-pre-installed-with-malware/If you have such a T95 TV box you can check it for the malware and clean it up:https://github.com/DesktopECHO/T95-H616-Malware

author: SiliconWizard
author_rank: Super Contributor
timestamp: January 14, 2023, 10:15:01 pm
content: Yep, really not surprising.Those devices are all over the place on Aliexpress. (But for a fraction of the price.)
DoS with Rust and Hyper lib - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: January 06, 2023, 04:05:51 pm
content: Watch out for DoS when using Rust’s popular Hyper package:https://jfrog.com/blog/watch-out-for-dos-when-using-rusts-popular-hyper-package/As a reminder, a programming language doesn't create automagically secure software, it's the job of the software developer to understand the risks and to write good code.
several Netgear routers: pre-auth buffer overflow and DoS - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: December 30, 2022, 12:03:38 pm
content: Security fixes for a bunch of Netgear routers:- Security Advisory for Pre-Authentication Buffer Overflow on Some Routers, PSV-2019-0208 (https://kb.netgear.com/000065495/Security-Advisory-for-Pre-Authentication-Buffer-Overflow-on-Some-Routers-PSV-2019-0208)- Security Advisory for Denial of Service on Some Routers, PSV-2019-0104 (https://kb.netgear.com/000065497/Security-Advisory-for-Denial-of-Service-on-Some-Routers-PSV-2019-0104)
windows 7 64bit, disable driver signature enforcement - Page 1
Forum section: electronics / general

author: pcprogrammer
author_rank: Super Contributor
timestamp: December 22, 2022, 07:13:00 am
content: I have an older laptop setup with windows 7 64 bit to use with my fischertechnik Robo interface, but it won't use the driver due to it not being signed. I got the latest version of the software from the fischertechnik site.Found the, at startup, push F8 and select the “Disable Driver Signature Enforcement” option, which indeed works. But it is a bit of a pain in the but to have to do it every time I startup the laptop.Tried the other options mentioned on many sites, like with bcdedit running as administrator and setting the several options like:Code:bcdedit.exe /set nointegritychecks onbcdedit -set loadoptions DISABLE_INTEGRITY_CHECKSbcdedit -set loadoptions DDISABLE_INTEGRITY_CHECKSbcdedit -set TESTSIGNING ONNone of these did the trick. Verified the settings actually being there with "bcdedit /enum". With the "TESTSIGNING ON" I had the "test mode" message in the bottom right of the display, but still no dice.Also tried the global policy option with which it can be set to "ignore", but again it fails.The only thing I did not try is the self signing option I found somewhere. Needed a lot of Microsoft stuff to be installed and in the comments I read that it did not work, so skipped that one.Is it true that on the 64 bit version the F8 method is the only working option?

author: Mechatrommer
author_rank: Super Contributor
timestamp: December 22, 2022, 08:55:15 am
content: Quote from: pcprogrammer on December 22, 2022, 07:13:00 amisnt that once you installed the driver using this trick, you dont have to F8 anymore later? iirc i did this on one my driver before, i cant remember which. once installed, its done.

author: pcprogrammer
author_rank: Super Contributor
timestamp: December 22, 2022, 09:59:52 am
content: It concerns an USB device, and when I start the computer without using the F8 option and insert the USB cable it loads the driver with an exclamation mark indicating there is an issue with it. The information window in the driver pane shows the driver not being signed, and it does not work.When I start with the F8 option and plug the cable in, it works as it should.
WiFi with Linux kernel >=5.1 - it's really bad - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: October 15, 2022, 06:04:15 pm
content: Anything with linux kernel >= 5.1 running WiFi needs a kernel update:- CVE-2022-41674- CVE-2022-42719- CVE-2022-42720- CVE-2022-42721- CVE-2022-42722

author: DiTBho
author_rank: Super Contributor
timestamp: October 16, 2022, 07:01:29 am
content: what?why?

author: magic
author_rank: Super Contributor
timestamp: October 16, 2022, 08:09:08 am
content: I used to run mainline kernels but I have been on longterm for several years now...

author: madires
author_rank: Super Contributor
timestamp: October 16, 2022, 12:59:01 pm
content: Quote from: DiTBho on October 16, 2022, 07:01:29 amhttps://lwn.net/ml/oss-security/ff7256bc-418b-e833-18d8-bc9700f6d77e@seemoo.tu-darmstadt.de/

author: madires
author_rank: Super Contributor
timestamp: October 16, 2022, 03:31:03 pm
content: For OpenWrt:https://openwrt.org/releases/22.03/notes-22.03.2

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 16, 2022, 06:47:10 pm
content: Oh, that's terrifying.

author: 2N2222A
author_rank: Regular Contributor
timestamp: December 05, 2022, 02:11:37 am
content: What's the status of Android?What amazes me is that if the majority of Android devices were affected, that an entire continent of Android devices could be exploited within two or three days. The exploit would be released at a major airport. Within a matter of minutes it would have infected every Android device in the airport. Within a few hours every affected Android device in most hotels and every device along the road to every destination from the airport would be infected. By the next every airport with a scheduled flight from there would be infected.

author: madires
author_rank: Super Contributor
timestamp: December 05, 2022, 03:14:07 pm
content: No idea!

author: SiliconWizard
author_rank: Super Contributor
timestamp: December 06, 2022, 08:58:30 pm
content: I personally am not too scared about those security issues:- I mostly use a rolling release and thus get kernel updates in an extremely timely manner. Fixes come in very fast.- WiFi should not be used for anything security-critical.Android could be more of a problem as kernel updates tend to lag a lot more. But Android is being very conservative - Android 13 uses linux 4.14.
Strange Instagram link... Feels like Phishing - Page 1
Forum section: electronics / general

author: edy
author_rank: Super Contributor
timestamp: July 21, 2021, 12:25:03 pm
content: I've been trying to figure out what's going on with this message and link I received from Instagram. It looks like this:This took me 3 hours to make. I hope you like it, Lookhttps://toyou174.xyz/g/?&ure=MYUSERNAME(Where MYUSERNAME is my Instagram account name (I redacted it for this post)That redirects me to...https://instagram.com-verify-1489788456268679154344343179665471433.us/?ure=MYUSERNAME(Again, I've replaced my username with MYUSERNAME)I cannot figure out but suspect this is a phishing attack. However when I break up the URL and try to go there directly it brings me to what looks like Instagram official page. I wonder if that site (with the .us domain) redirects you to the normal Instagram page if the URL is not formatted exactly as formed. For example, browsing only to the URL below takes me to Instagram:http://com-verify-1489788456268679154344343179665471433.usDoes anyone have any idea if this is some official Instagram way of doing things or the next level of phishing scam, because it smells an aweful lot like it.

author: edy
author_rank: Super Contributor
timestamp: July 21, 2021, 02:30:03 pm
content: I did a who.is lookup on the root domain and found this:https://who.is/whois/com-verify-1489788456268679154344343179665471433.usQuote(I'm surprised the information is not private, but I suspect it's fake or misleading)... And this .....https://who.is/whois/toyou174.xyzQuoteIt looks like they are popping up these domains faster than anyone can keep up and then trying to phish unsuspecting folks, not sure how they can leverage it for money or if it's used as leverage for more specific monetizable attacks.

author: UART.io
author_rank: Newbie
timestamp: July 31, 2021, 05:05:50 am
content: Definitely phishing. That domain structure is pretty common and used to confuse people - It looks like instagram.com with the rest of the URL behind it, but the real domain is "com-verify-1489788456268679154344343179665471433.us" as you figured out. But, to most people, they just see the "instagram.com" portion and tune out on the gibberish afterwards.Like you said, they stand these domains up quickly and send out phishing e-mails. The goal is typically credential capture - people "log in" and the attackers record the username/password, and then the victim is redirected to the official Instagram domain.

author: Bud
author_rank: Super Contributor
timestamp: October 27, 2022, 08:25:07 pm
content: It is a phony contact address. There is no building number 87 on Nykolskaya St in Moscow according to Google maps.Edit: and a quick search on "Kalkofnsvegur 2 City Reykjavik" produces a bunch of results about scammers registered at that general office rental building.

author: NiHaoMike
author_rank: Super Contributor
timestamp: October 29, 2022, 05:26:01 am
content: Time for a white hat to write a script that feeds that site junk data.
IoT Security next step? : Matter v1.0 - Page 1
Forum section: electronics / general

author: Kjelt
author_rank: Super Contributor
timestamp: October 10, 2022, 09:51:10 am
content: Looks like we finally get a new open secure standard for IoT.It was about time.Looking at the large amount of A brand companies involved this could become a defacto standard.Now waiting for the technical details to be published and the security academics to try to attack itAlso I am very interested to see how much the resources for RAM and ROM will be for this protocol.https://csa-iot.org/newsroom/matter-arrives/

author: golden_labels
author_rank: Super Contributor
timestamp: October 10, 2022, 02:30:23 pm
content: Before the details are released, we may already derive some things from the PR fart.“Over 280 member companies — including Amazon, Apple, Comcast, Google, Samsung SmartThings, and Signify — have brought their technologies, experience, and innovations together to ensure Matter met the needs of all stakeholdersincluding users,product makers, and platforms.”— and somehow only mentioning entities representing the latter two.“Matter is also striking new ground with security policies and processes using distributed ledger technology and Public Key Infrastructure to validate device certification and provenance.”— so security understood as “protecting producers from consumers” mislabeled as “security for users”. And, assuming it does not require resources to run the ledger on IoT devices, “distributed” inside a centralized group.

author: ataradov
author_rank: Super Contributor
timestamp: October 10, 2022, 04:15:24 pm
content: I would not be too excited. This is a rebranding and repackaging of the existing stuff. None of the members here have any interest in working with each other.I predict another flop.Matter uses existing Thread stack, so you can easily estimate the resources. It is bloated for what it is.
Insulin pumps - Page 1
Forum section: electronics / general

author: SiliconWizard
author_rank: Super Contributor
timestamp: October 02, 2022, 06:56:53 pm
content: https://www.healio.com/news/endocrinology/20220920/fda-warns-of-possible-cybersecurity-risk-with-medtronic-minimed-600-series-insulin-pumps
HP printers again - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: September 23, 2022, 09:20:56 am
content: CVE-2022-28721 & CVE-2022-28722Certain HP Print Products - Potential Buffer Overflow, Remote Code Execution:https://support.hp.com/us-en/document/ish_6839789-6839813-16/hpsbpi03810Affected printers a some Inkjet, LaserJet Pro and PageWide Pro.

author: SeanB
author_rank: Super Contributor
timestamp: September 23, 2022, 12:52:06 pm
content: So basically all with either wireless or wired ethernet connections. Why do you want to have a printer exposed to thewide internet in any case, you really want a good firewall before it, just so that you are not used as a source of scrap paper generation.

author: madires
author_rank: Super Contributor
timestamp: September 23, 2022, 01:11:32 pm
content: Yep, strongly recommended. However, that's not the complete story. There are reports about attacks using the office PCs as point of entry and then deploying scanners, proxys and other tools on printers to gain long-term access and control. It seems that printers are often overlooked by IT security.
spell-jacking with Chrome and Edge - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: September 20, 2022, 09:30:52 am
content: Chrome & Edge Enhanced Spellcheck Features Expose PII, Even Your Passwords:https://www.otto-js.com/news/article/chrome-and-edge-enhanced-spellcheck-features-expose-pii-even-your-passwordsNow I know what those companies mean when they say that they care about our privacy and security.
Nice Teams! - Page 1
Forum section: electronics / general

author: SiliconWizard
author_rank: Super Contributor
timestamp: September 18, 2022, 12:55:28 am
content: https://www.engadget.com/microsoft-teams-has-been-storing-auth-tokens-in-plaintext-093510463.html

author: ataradov
author_rank: Super Contributor
timestamp: September 18, 2022, 01:13:56 am
content: Teams is such a piece of garbage. Forced to use it at work, hate every second of it. It is hard to imagine buggier mess. And their desire to use web for real applications is not working out, the UI is janky and does not work half the time.It is fine if it leaks private info, hopefully businesses get owned through it and finally abandon it.Although Discord has an actual web interface and is orders of magnitude better, so it is possible that MS is just really bad at writing software. And I guess enterprises are locked into buying any crap they produce, so there is no incentive to make it any better.

author: NiHaoMike
author_rank: Super Contributor
timestamp: September 18, 2022, 05:18:50 am
content: Quote from: ataradov on September 18, 2022, 01:13:56 amThat's not news at all, see Windows ME for a really infamous example.

author: rsjsouza
author_rank: Super Contributor
timestamp: September 18, 2022, 07:40:16 am
content: Every time I need to join an external meeting with MS Teams I cringe. The interface is terrible and the bugs galore.Our cimpany uses Cisco Webex, which has its stupidities as well but it is moderately reliable.

author: Nominal Animal
author_rank: Super Contributor
timestamp: September 18, 2022, 05:09:30 pm
content: According to another threadhere, you are all wrong, and Teams is perfect software, because it is made by Microsoft, which is a very successful company, and they employ only the best developers.

author: eutectique
author_rank: Frequent Contributor
timestamp: September 18, 2022, 10:09:53 pm
content: Made me remember the ancient joke about Microsoft®-branded vacuum cleaner.

author: Ed.Kloonk
author_rank: Super Contributor
timestamp: September 19, 2022, 07:42:58 am
content: Quote from: eutectique on September 18, 2022, 10:09:53 pmOnly thing from them that doesn't suck?

author: pcprogrammer
author_rank: Super Contributor
timestamp: September 19, 2022, 07:48:16 am
content: Quote from: Nominal Animal on September 18, 2022, 05:09:30 pmDon't forget that they are brilliant too. And since it has over a million lines of code it must be good.
Comic about the dark side of Google Chrome - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: August 30, 2022, 01:03:49 pm
content: A comic about the dark side of Google Chrome:https://contrachrome.com/(German version:https://contrachrome.com/comic/279/)

author: Jester
author_rank: Frequent Contributor
timestamp: August 30, 2022, 05:48:55 pm
content: And the punchline ……… they have started charging their users monthly fees for workspace.What are you going to do? I just moved my email away from Google

author: Monkeh
author_rank: Super Contributor
timestamp: August 30, 2022, 05:56:01 pm
content: Quote from: Jester on August 30, 2022, 05:48:55 pm'started'? Businesses have had to pay their own way for a while.

author: SiliconWizard
author_rank: Super Contributor
timestamp: August 30, 2022, 08:00:26 pm
content: F*ck Chrome.
new Windows feature: ping with remote code execution (CVE-2023-23415) - Page 1
Forum section: electronics / general

author: madires
author_rank: Super Contributor
timestamp: March 20, 2023, 02:15:55 pm
content: Internet Control Message Protocol (ICMP) Remote Code Execution Vulnerability:https://msrc.microsoft.com/update-guide/vulnerability/CVE-2023-23415It seems that all current WIndows versions are affected (most likely also old versions out of support). But there's is one prerequisite to exploit the vulnerability, an application needs to be bound to a raw socket.

author: pdenisowski
author_rank: Super Contributor
timestamp: March 20, 2023, 02:49:52 pm
content: Wow. Just wow.

author: MrMobodies
author_rank: Super Contributor
timestamp: March 20, 2023, 04:29:40 pm
content: https://nvd.nist.gov/vuln/detail/CVE-2023-23415#vulnConfigurationsAreaQuote

author: jpanhalt
author_rank: Super Contributor
timestamp: March 20, 2023, 04:55:42 pm
content: This is all well above my head. Found that my Windows 7 will support raw sockets by following these directions:https://learn.microsoft.com/en-us/windows/win32/winsock/tcp-ip-raw-sockets-2?redirectedfrom=MSDNSee attachment.How can you know whether a raw socket is actually enabled? And, how to disable, if enabled.

author: SiliconWizard
author_rank: Super Contributor
timestamp: March 20, 2023, 08:09:41 pm
content: Would be interesting to know what the cause is, but I guess we'll never get access to that, it's not open source.

author: madires
author_rank: Super Contributor
timestamp: March 21, 2023, 10:09:26 am
content: Quote from: jpanhalt on March 20, 2023, 04:55:42 pmnetstat?

author: jpanhalt
author_rank: Super Contributor
timestamp: March 21, 2023, 11:43:43 am
content: OK, I ran netstat (portion attached). There are 4 statused as "ESTABLISHED," one that is "FIN_WAIT_1" and the rest are "TIME_WAIT." What should one look for? I see nothing with "RAW" in it.

author: madires
author_rank: Super Contributor
timestamp: March 21, 2023, 05:17:49 pm
content: The netstat command should have multiple options, but I don't know if the windows netstat is able to list the socket type.

author: jpanhalt
author_rank: Super Contributor
timestamp: March 21, 2023, 06:01:20 pm
content: Since the RAW was in IPv6 , I used -s to get statistics (attached). Google showed [-w] for socket type = RAW, but: netstat -w just gave a return of allowed extensions of which -w was not one.Found this from Microsoft:QuoteI can't claim to understand it, but the last sentence seems clear if reliable.@ madires, Thank you so much. This is a new word for me.

author: madires
author_rank: Super Contributor
timestamp: March 21, 2023, 07:36:34 pm
content: If I'm understanding the documentation for raw sockets in Windows correctly, then any ICMP based application would open a raw socket.