gquere
Joined 3 years ago
Karma
123
Submissions
43
Member since
Aug 24
Recent submissions
Comment · 8 days ago
Comment · 9 days ago
Their OTP solution is bruteforceable as well: https://mastodon.catgirl.cloud/@49016/117475921584308861
Comment · 9 days ago
"It doesn't solve anything because they don't monitor the logs" feels like a completely different thing than "It doesn't solve anything".
Comment · 10 days ago
Certificate Transparency solves the rogue CA scenario for domain owners.
Comment · 10 days ago
Wiping local app storage fixes this.
Comment · 10 days ago
Doesn't ACME+CT solve this threat?
Comment · 10 days ago
There's a beginning of an explanation in the mozilla bugrepor thttps://bugzilla.mozilla.org/show_bug.cgi?id=2083449
Comment · 8 months ago
RDP2 has been cracked by glitching. You first need to downgrade RDP2 to RDP1 then do the RDP1 bootloader glitch. It's not exactly easy but it's well documented and can be done given enough time. Though the STM32F4 targets do have a high chance of bricking during this attack.
Comment · 8 months ago
First I'd like to point out that "Decryptor" is an ill-chosen term: there's no encryption mechanism here, RDP is a software lock based on an internal flash state.
This dongle is very likely to be this original attack https://github.com/JohannesObermaier/f103-analysis/tree/mast... but now packaged. If you want to read more this repo has the best doc: https://github.com/CTXz/stm32f1-picopwner. It's a multi-step attack where a payload is executed from persisted SRAM (RDP1 means you can read/write to it) after a quick reset. The fact that they mention freezing the chip heavily weighs in that direction since it's needed for higher clock chips.
Comment · 9 months ago
I've tried this locally on a known-vulnerable piece of software using the hugginface Q8 model + llama. It did find the vuln when given the entrypoint in the lib and user-controlled buffer. Otherwise it produced false positives.
Comment · 1 year ago
AFAIK you don't need a credit card linked to the account, you can get in-store credit from selling the guaranteed drop items from playing a few matches, this is enough to get you started trading.
Comment · 1 year ago
Read up on the story, look at the influencers promoting it and the ecosystem that grew around it. Valve is willfully running a casino for underage and have bypassed local laws that protect against this using technicalities. It's frightening.
I wasn't aware of that, I know of a few teams that do this internally and seemingly have no problems, I'll ask them next time I get a chance. Thanks for your answer.