IgorBog61650384

Hi, author of the blog post. This is correct - keeping PII protected has always been their concern, but recent breaches in thier's and other industries (including some they heard of and were not publicized) made them even more concerned.

Yep!

Thanks, fixed it

The SolarWinds incident was detect because of bad opsec by the operators who performed the FireEye op. I would image the capability was developed by an expert group in some intelligence agency, and then used as an entry point by a different operator group with lower standards. But who is to day there aren't more of this kinds of attacks out there, just no one has made a foolish error using them yet? If we assume that, we have to assume this operation was somewhere in the middle of a normal curve of complexity, and there are even more sophisticated backdoored systems like that we just don't know about. Imagine any medium-large code base (100+ of KLoCs), that is deployed widely, and has an auto update mechanism. Most companies don't have very strict access to the build process (and even if they do, all you need is to corrupt one employee), so it shouldn't be to hard to patch binaries before they are signed (especially bytecode in .NET and Java) , and add another URL and/or signature for verification (for sig only the attacker needs access to the web site/CDN too). The change will be only a few lines, so is very hard to detect automatically - it will look like regular code for tools.

You're right, as long as the hardware switch is really hardware and not fake-hardware-implemented-in-software like many vendors.

I love the idea but is scaring me a bit security wise. This can be a really hidden persistence method for malware.

Imagine the following scenario - memory only malware lands on my computers, identifies the keyboard, uploads a malicious firmware and disappears. Using basic heuristics like time and entropy it detect when I logon to the machine, get my passwords, understands my OS, and what for a hidden signal by the memory only malware. If the signal is not detected for a while because I rebooted my computer or reinstalled it, It unlocks the computer with the password at a time of inactivity, and types in a command like wget/curl to to download the malware again, and so on.

I think this can even be used for Virtual Machine escape, as many VMs just pass-through HID commands, so its possible the firmware can be updated from a VM.

Kudos to System76 though for providing the firmware, this helps in auditing it and running tools like lint or PVS studio to decrease the chance of bugs like that. They are consistent in being open source and I hope more vendors with firmware follow their lead.

Nice article, thanks for the tips at the end!

Personal perspective: I've been trying intermittent fasting for about four years, and found it helped a little in the beginning but then petered out.

What happened was I did not eat until 7PM, then ate a little bit, but once I started eating I could not stop. It was never a matter of hunger, I barely ever feel hunger at all, it was like a deep primal drive to eat once the gates had opened - each and every evening.

The one thing that actually worked for me for a while was almost complete fasting - I would eat one meal one Saturday, one meal one Sunday, and that's all. The first two weeks were hard, but then it became quite easy, except the time aches Monday morning. It also lowered my resting heart rate by 10 BPM. I managed to drop about 40lbs in 6 month. Then I started on a really tough and stressful project at work, stayed late with coworkers, they ordered pizza night after night, I ate, and the fasting was over. Couldn't get back on the wagon since ...

Exploits are possible even without DMA. Windows had a slew of USB stack exploits, ranging from the serial and modem drivers to HID device and more. There have also been in the past (and probably still exist) exploits over serial lines, over I2C and SMBus, etc'. Not having DMA makes it much, much harder, but not impossible.

So having the modem connected by USB does not make attacking through it impossible - how can you tell there are no bugs in the iOS USB stack?

I love hearing great news about the space industry, that the way to get us humans into outer space.

Can any one a little more knowledgeable explain the difference between this 3d printed engine and RocketLab's one? Thanks!

I don't think this should surprise anyone. The FBI has multiple methods for accessing locked phones: using physical exploits like those provided by Cellbrite, or through baseband attacks - i.e. first attacking the cellular modem and from there using an exploit to get to the main ARM cpu, or through exploits or backdoors in any app the phone had that do background refresh through the web while the phone is locked. I think the current status of infosec means that anyone that is the target of a nation state intelligence agency or counter intelligence agency can be hacked. The question if that is actually done or not depends on how interesting they are and the lawfulness of the action and not on technical capabilities.

Love the post, good luck!

Re “Productivity equiation” from Ali Abdaal: Productivity = Useful output / time x f (where f is the ‘fun factor’), but treating f as constant is wrong - even fun projects can get tiresome . A good measure might be instead an inverse 'tediousness' factor, e.g. how tedious are the worst expected tedious parts of the project (like the 'fun' bottleneck) and make sure you don't get stuck when you reach those points.

Also fun project tend to be novel, but novel project have the highest amount of unexpectedness, so its good to decide on a few 'novel' things and let the rest of the project be based on stuff you know well.

The only reason this was detected was very overt behavior - opening AD popups. So I guesstimate for each one of these we have 10 that go undetected. This means the whole ecosystem is broken, as there is no reason this will happen only for updates and not for new apps as well. Apple's ecosystem is somewhat better, but I can't imagine they go through every line of code in each package, so most of their review is probably done with some combination of automatic static and dynamic analysis, and these can be fooled. The problem with both platforms is that they don't provide run of the mill users the option of installing an effective firewall and security solutions.