alexbakker
Joined 9 years ago
Karma
214
Submissions
36
Member since
Oct 9
Recent submissions
Comment · 4 years ago
Correct.
Comment · 4 years ago
You're right, it's been a while, but we actually issued a beta release for 2.1 today!
Comment · 4 years ago
There's a third option to switch from Google Authenticator to Aegis. You can simply scan those export QR codes of Google Authenticator with Aegis.
Comment · 4 years ago
Aegis is fully offline and doesn't have an official desktop application. You could of course create an export of your Aegis vault and import it in a third-party desktop application, like GNOME's Authenticator or OTPClient.
Comment · 4 years ago
It's just a group name for the two guys working on it. Source: I'm one of them (Hi!)
Comment · 4 years ago
This is amazing work!
I was surprised to see that the reward was set at 10k initially. Granted, it was bumped to 75k later, but even that seems on the low side considering the degree of compromise that occurred here.
I may have given up too early during my (fairly brief) research on CVE-2019-9465. I let the lack of firmware source code availability stop me at the time, but in hindsight the presence of "0dd0adde0dd0adde" in the ciphertext likely indicated a crash in Titan M as well. Perhaps there would have been a similarly interesting path to exploitation there.
Comment · 4 years ago
I'm seeing this as well. While the amount of traffic has certainly decreased compared to the first couple of days after the CVE was announced, https://log4shell.tools is still being used by people every day.
Comment · 4 years ago
Glad to hear you like it!
Comment · 4 years ago
> android.permission.INTERNET is frankly hilarious since that permission no longer does anything (every app has access to the internet).
This is incorrect. If an app doesn't specify this permission in its manifest, it cannot access the internet.
Comment · 4 years ago
It sucks to see your open source work being abused like this, and there's seemingly nothing we can do about it.
Every now and then I scour the play store to see if I can find any Aegis clones. We've reported a couple that didn't have a link to the source code and/or were linking proprietary libraries (as per our license), but they're still up. Of course, those cases aren't as bad as this one where actual malware was included, but it's pretty telling about the state of the Google Play Store.
Comment · 4 years ago
You're right, but this has always been the trade off with tools like this. You put some trust in the tool's authors and gain some insight in return. Remember the services that tested for Heartbleed (e.g. https://filippo.io/Heartbleed/)? Fairly similar trade-off, but still these tools were widely used.
If you don't trust me and have some technical know-how, you can self host the service. It's open source: https://github.com/alexbakker/log4shell-tools.
Comment · 4 years ago
I can't say I'm feeling the same. Still lots of people testing over at https://log4shell.tools almost a week after this vulnerability became widely known. Plenty of people still discovering they're vulnerable as well. I think it's likely that these are just the people who know they're using log4j. If you're running a black box product from some vendor you'll have no clue you're vulnerable until it's too late.