0
58
cheet

@infosec.pub

cheet 142 points 2 years ago

Im a security professional who works to harden medical devices. I use the flipper zero to easily test many different protocols that would be a pain in the ass to do "manually".

The flipper makes it easy for me to verify IR, sub GHz, USB, SPI, and many other protocols while being able to walk around the devices I test.

Without the flipper I could totally do these checks with homebrew tools, a pi and an rtlsdr (unless thats gonna be illegal too?) But it would take me writing new tools and procedures rather than the ease of the flipper.

Anybody in the know can tell you that the hardware isn't anything special, and like many others have said, its like making a swiss army knife illegal cause the toothpick can be used to pick a lock.

This isn't gonna stop anybody, if pentest tools are showing flaws in your product, maybe we should send flippers to the car manufacturers and tell them to fix their shit. You shouldn't be allowed to sell a car that can be wirelessly hacked like this, just like how the FDA doesn't let you sell medical devices that can be hacked like that.

You don't just put the cat back in the bag...

path: 0 7411068, hotness: undefined, score: 142, children: 5
cheet 54 points 2 years ago

I had a headhunter complain to me on LinkedIn about ignoring their connection request, as if I owe them something. They really are unhinged sometimes.

path: 0 11471224 11471459 11471907 11471998, hotness: undefined, score: 54, children: 4
cheet 51 points 2 years ago

We use gitlab ultimate at my work, I'm the main admin of the instance. Like 2 weeks ago when there was the cvss 10 vuln, gitlab sent us a .patch file to apply to the instance instead of releasing a new minor cause they didn't wanna make the vuln public yet. I guess that's coordinated disclosure, but I still found that remarkably jank.

path: 0 7103896, hotness: undefined, score: 51, children: 2
cheet 46 points 10 months ago

PS2 keyboards use interrupts rather than polling in USB, meaning every time a key is pressed the CPU stops what its doing to process it.

path: 0 18762409 18762859 18762953 18763046, hotness: undefined, score: 46, children: 7
cheet 39 points 3 years ago

I'm a torrenter with the sonarr radar lidarr prowlarr *arr setups.

I've dabbled with Usenet and here's my understanding.

With torrents you're all sharing something live, if you want ubuntu.iso and I have ubuntu.iso you can get it from me and many others who seed this file. A torrent tracker (or the dht) helps put us in touch so you know where the file is.

With Usenet it's more like I dead drop this file, zipped and encrypted(?) onto a Usenet news server. All the Usenet providers mirror each other or something like that, so if you're on a diff provider than me that same file should still be available. Then I tell an indexer, like dognzb or nzbgeek that this file is in fact ubuntu.iso and not garbage data. When you want ubuntu.iso you ask the indexer, indexer gives you a link and you get the file.

Beyond this, I don't know about how much safer it is, but my immediate guess is that since you're not seeding there's less risk.

Now if you're really snobby like me, you'll quickly realize that the release groups you're used to aren't as well represented. I've often landed in situations where episode 7 of 20 is missing on Usenet...

As a snob, I've decided private trackers are probably the best place to be to keep my quality expectations satisfied.

Hope this helps.

path: 0 4104010, hotness: undefined, score: 39, children: 6
cheet 30 points 2 years ago

Try to take it easy man, don't burn yourself out over work, your health is important.

path: 0 8199200 8199606 8199917 8201676, hotness: undefined, score: 30, children: 0
cheet 21 points 2 years ago

Specifically the album "audio video disco"

path: 0 10257609 10258777 10259189, hotness: undefined, score: 21, children: 0
cheet 18 points 2 years ago

In addition to what the other commented said, a lot of sys and net admins really don't like the idea of every lan device being globally addressable, while there's ways around it, a standard ipv4 Nat is a safety blanket to a lot of admins... Not that it should be like that, just my observation.

path: 0 7282804 7283586, hotness: undefined, score: 18, children: 12
cheet 17 points 2 years ago

Unfortunately a lot of rentals dont have their own laundry, or have to use a shared building laundry.

At my last place we had to pay 3$ for a wash and 6$ for a dry. Had to use a credit/debit machine to load a card, and the machine was frequently broken, so I'd have to go to another building in the area to reload it, but I'd have to wait for someone to let me tailgate in the lobby.

Just own it is like saying people should just buy homes or move to a better apt.

path: 0 11479698 11480712 11480920, hotness: undefined, score: 17, children: 1
cheet 16 points 2 years ago

The blog post they did showing how they do a sort of regression testing is still some of the coolest devops I've seen.

Check the FifoCI stuff here.

https://dolphin-emu.org/...

path: 0 7677048 7679533 7687274, hotness: undefined, score: 16, children: 0
cheet 15 points 2 years ago

Yeah I'm still not over losing my notification led either. Was a staple of the android experience imo

path: 0 6238571 6238708, hotness: undefined, score: 15, children: 0
cheet 14 points 2 years ago

Holy shit, that's actually hilarious, I imagine someone would have noticed when their paste/auto type password managers didn't work

For those confused, this sounds like instead of making a real website, they spin up a vm, embed a remote desktop tool into their website and have you login through chrome running on their VM, this is sooooo sketch it, its unreal anyone would use this in a public product.

Imagine if to sign into facebook from an app, you had to go to someone else's computer, login and save your credentials on their PC, would that be a good idea?

path: 0 9855694 9858308, hotness: undefined, score: 14, children: 2
cheet 14 points a year ago

Wait, the Dread Pirate Roberts got pardoned? How does that fix anything???

path: 0 14847523 14847735, hotness: undefined, score: 14, children: 6
cheet 12 points 2 years ago

Tramp, ASCII and Neo?

path: 0 11854615 11854806, hotness: undefined, score: 12, children: 5
cheet 12 points 8 months ago

PrismLauncher by far

path: 0 20238327 20238607, hotness: undefined, score: 12, children: 0
cheet 12 points 2 years ago

I wish it would have 2 ports, top and bottom, so I can be more creative with my accessories.

path: 0 12201052 12201399, hotness: undefined, score: 12, children: 4
cheet 11 points a year ago

Its kinda useful for devices where userland is also protected against exfil, like a kiosk or windows lock screen.

If the bios is hardened, secure boot on, bitlocker on, and windows is locked with a password, you can't simply take the disk out and manipulate it cause bitlocker with TPM means only that specific hardware profile will decrypt the disk automatically.

You can't get to explorer cause the system is locked with windows auth, and you can't reset the PW cause bitlocker is on, and you cant remove the disk cause the TPM protects against that with bitlocker.

Its really not perfect, and I'm not advocating for it, but its a decent protection in systems where adding another pin/password isn't practical.

Even Microsoft recommends at least also using a pin with bitlocker.

path: 0 14325489 14325684 14326586, hotness: undefined, score: 11, children: 0
cheet 10 points 2 years ago

The thing is, if there's a wireless exploit/hack that can cause "patient harm" the FDA+Health Canada would force a recall the sec its publicly known.

The flipper wouldn't be the only thing able to exploit it, anybody with a radio and some software would be able to. It just so happens the flipper can also do it cause its a swiss army knife and has a general purpose radio.

Generally by the time an attack exists on the flipper, its already been mastered on laptops and raspberry pis and stuff, putting it on the flipper is more to make it available to test easily without having to lug out the laptop. Nobody is inventing new exploits for such underpowered hardware as the flipper. People are porting known exploits to it.

I can't say how concerned you should be, but this won't make her any safer than before, equal risk. Just as likely someone with a laptop in a backpack doing that. We don't make laptops illegal tho.

What I would be concerned about is the idea that the company that makes the implant would not be able to easily test for issues in the implant with such an "illegal" device. Yes they could use a laptop, but you don't use an xray machine to find a stud, you use a handheld studfinder cause its cheap and easy.

Hope that helps explain a bit

path: 0 7411068 7417495 7429278, hotness: undefined, score: 10, children: 1
cheet 10 points 2 years ago

I see this kinda like any% speed runs where they use ACE and crazy crazy exploits that totally bypass the point of the game. Or maybe its more like a TAS, or "pure hackmons" in Pokémon talk.

Anyways, I find the concept interesting, so long as people don't get hurt significantly more than they do with "regular" sport. To see how far the human body can go, including all the tech and science possible.

I could legit for see a future where the Paralympics are "more impressive" (whatever that means) due to incredibly powerful prosthetics.

Ethically speaking, idk anything, I'm just a dude on the internet.

path: 0 7161361, hotness: undefined, score: 10, children: 1
cheet 10 points 2 years ago

Funny packets make things behave funny sometimes. Sometimes you just need to see how something behaves when you send it illegal packets that the real software would never send.

It also makes it possible to cheat in some games by lying to the game server about interactions in game.

Essentially hackers need a way to talk to machines at every level of every protocol and Scapy is a pretty standard way of achieving that.

path: 0 11685812 11686021 11686297 11690177 11691161 11692054, hotness: undefined, score: 10, children: 0

thanks for using Leebra!

go to feed...