IllNess

joined 2 years ago
[–] IllNess@infosec.pub 5 points 8 hours ago

I am not a mechanical engineer. I just love going to all the stuff on this site and seeing what I could potentially make.

Note, I have never made anything that isn't made of wood, Lego bricks, paper, or paracord. Lol.

[–] IllNess@infosec.pub 15 points 2 days ago

AlternativeTo is one of favorite websites. You can filter down to open source.

[–] IllNess@infosec.pub 31 points 1 week ago

Depending on how Bluetooth stacks handle HCI commands on the device, remote exploitation of the backdoor might be possible via malicious firmware or rogue Bluetooth connections.

I really wish these articles just tell us what these scenarios are. I understand companies need publicity or need to sell software but if it isn't replicatable and the article says "might be possible" it kind of sounds like a secuity sales pitch.

This is especially the case if an attacker already has root access, planted malware, or pushed a malicious update on the device that opens up low-level access.

This part basically sounds more like a software issue where the attacker has a way in already. The system is already vulernable at this point before using the exploit found.

I don't think there's enough information out yet.

It is very interesting though.

[–] IllNess@infosec.pub 23 points 1 week ago (4 children)

The company would have 20 days to comply with Brazil’s antitrust legislation, otherwise it would be fined more than $40,000 a day.

Apple would rather pay the $14.6 to $14.64 million per year.

[–] IllNess@infosec.pub 30 points 2 weeks ago (3 children)

Why would Humane delay an OTA update to give access to the device just because a small group of users are using an access certificate? You are punishing the entire class just because one student kept on talking.

I don't trust this company. They have been lying to their users from the very beginning.

[–] IllNess@infosec.pub 2 points 2 weeks ago

I use F-droid. I don't check hash keys but having that kind reassurance is definitely better than trusting F-droid blindly.

I have had issues F-droid uploads before.

So Accrescent has only a limited number of apps and only installs on Android 10 and up.

If you want something with less limits, you can use Obtanium with AppVerifier, or APKMirror, which also has the hash keys available.

[–] IllNess@infosec.pub 12 points 2 weeks ago

Mullvad no longer has port forwarding.

[–] IllNess@infosec.pub 15 points 2 weeks ago

Also great for the environment. Replacing a part is significantly better than the waste products and energy used in recycling facilities.

[–] IllNess@infosec.pub 4 points 2 weeks ago

The seminar name Tariff-ic.

[–] IllNess@infosec.pub 2 points 3 weeks ago

When you say hosting do you mean yourself or a company?

If a company, I do this with Dreamhost. Email hosting comes with web hosting. I might as well.

It's been a while since I last looked but I haven't read anything about whether they read my mail or not. They definitely could though.

Also their email spam filters are not very good.

[–] IllNess@infosec.pub 5 points 3 weeks ago (1 children)

Well you'r towelie.

 

Security researchers have discovered an arbitrary account takeover flaw in Subaru's Starlink service that could let attackers track, control, and hijack vehicles in the United States, Canada, and Japan using just a license plate.

Curry says Subaru patched the vulnerability within 24 hours of the researchers' report and was never exploited by an attacker.

 

A North Korean threat group has been using a technique called RID hijacking that tricks Windows into treating a low-privileged account as one with administrator permissions.

 

The CloudSEK researchers disrupted the botnet by utilizing hard-coded API tokens and a built-in kill switch to uninstall the malware from infected devices.

 

"Mac Homebrew Project Leader here. This seems taken down now," tweeted McQuaid.

 

To safeguard against such attacks, it's advised to monitor suspicious processes, events, and network traffic spawned by the execution of any untrusted binary/scripts. It's also recommended to apply firmware updates and change the default username and password.

 

A malicious package named 'pycord-self' on the Python package index (PyPI) targets Discord developers to steal authentication tokens and plant a backdoor for remote control over the system.

view more: next ›