stedaniels

It is very trivial to serve different code to someone inspecting the code than when they pipe it to bash. In the very rare case someone inspected it they’d likely do so in a way that was vulnerable to this.

It wasn't when I tried it earlier.

What platform are you on? Doesn’t CTRL+SHIFT+V work for you?

Anecdotally, having worked on identity management systems, and merged a number of them, this hasn’t ever seemed like an edge case for me. It’s pretty high up on the list. I’d imagine the folks they’ve got working on these systems are paid an order of magnitude more than myself.

I have no comment on the security of Hikvision devices.

However, a lot of cameras these days come with a good sized amount of processing power onboard. This can be used for object detection amongst other things. Even without network access the devices could communicate and act on the command of others in many ways. A couple of ideas. You could communicate with the IR LEDs. You could blank the video feed if a certain QR code or flashing light pattern is detected. I'm sure there are more, but you get the idea.

You've misinterpreted the comment, this is exactly what they mean. The recent band, has made the term ungoogleable.

A link to the "Remote working" policy document publicly hosted on their main domain would be a solid choice, with key points summarised in the job posting.

That's a pretty narrow view of society. Many people work with people they don't want to, don't like, hate, despise even.

Supermarket deliveries are popular, but are third party delivery services for groceries? I don't have any stats, but anecdotally I'd say not.

Note however this is only partially true for single user devices, where lack of admin rights does prevent some attacker persistence, and is not at all true for multi user devices e.g. the shared family PC.

You are arguing a different point. They argued that doing exercise burns more calories than sitting idle.

@1_player said: > Your body burns incredibly more energy just "being there" than you burn moving about.

They also _coincidentally_ implemented a feature that autoran ImageGlass as a background service a day before the malware was slipped in.

Coordinating with CSIRTS and the big security vendors, think WAFs, XDRs, etc., would allow the impact of a disclosure to be heavily mitigated.