Забавные новости 0й-Ti :)

UbIvItS · 6 янв 2019

Many of today's most popular home router models don't take full advantage of the security features that come with the Linux operating system, which many of them use as a basis for their firmware.
Security hardening features such as ASLR (Address Space Layout Randomization), DEP (Data Execution Prevention), RELRO (RELocation Read-Only), and stack guards have been found to be missing in a recent security audit of 28 popular home routers.
Security experts from the Cyber Independent Testing Lab (Cyber-ITL) analyzed the firmware of these routers and mapped out the percentage of firmware code that was protected by the four security features listed above.
https://www.zdnet.com/article/most-...vantage-of-linuxs-improved-security-features/
Нажмите, чтобы раскрыть...

ну-дык, ханипоты и должны быть дырявкой

--- Сообщение объединено, 6 янв 2019 ---

по-поводу трёпа клоуна сего хотелось бы сделать ряд ремарок..

1. буст процессоров делался засчёт небезопасной арх-и, тч их индустриальное применение в общем и целом крайне нежелательно.. к примеру, построение умных домов на современных железках и софте небезопасно для здоровья/жизни хозяев таких домов. В сущности достаточно глянуть на лицухи платного софта == там можно найти много строчек практически прямых угроз за, так сказать, нелегальное использование софта. Но в сих умилительных текстах не получится обнаружить чётких гарантий безопасности и надёжности поставленного ПО + указание АДЕКВАТНОЙ ответственности разработчика/поставщика за нарушение оных гарантий.
2. полученный всеми правдами и неправдами буст на гламурных процах в общем и целом уходит в молоко, пч современная софтина является глючной блоутварой.
======
вот и получаем, что бла-бла про экспоненциальное развитие технологий не выдерживает критики даже в случае ой-ти

UbIvItS · 14 янв 2019

A recently discovered ransomware group has netted almost $4 million since August, in large part by following a path that’s uncommon in its industry—selectively installing the malicious encryption software on previously infected targets with deep pockets. The method differs from the usual one of indiscriminately infecting all possible victims. That’s the take of two analyses published Thursday, one by security firm CrowdStrike and the other by competitor FireEye.
Both reports say that Ryuk, as the ransomware is known, infects large enterprises days, weeks, or as much as a year after they were initially infected by separate malware, which in most cases is an increasingly powerful trojan known as Trickbot. Smaller organizations infected by Trickbot, by contrast, don’t suffer the follow-on attack by Ryuk. CrowdStrike called the approach “big-game hunting” and said it allowed its operators to generate $3.7 million worth of Bitcoin across 52 transactions since August.
Besides pinpointing targets with the resources to pay hefty ransoms, the modus operandi has another key benefit: the “dwell time”—that is, the period between the initial infection and the installation of the ransomware—gives the attackers time to perform valuable reconnaissance inside the infected network. The reconnaissance lets attackers CrowdStrike dubs Grim Spider maximize the damage it causes by unleashing the ransomware only after it has identified the most critical systems of the network and obtained the passwords necessary to infect them.
CrowdStrike researcher Alexander Hanel wrote:

Some of TrickBot’s modules (such as pwgrab) could aid in recovering the credentials needed to compromise environments—the SOCKS module in particular has been observed tunneling PowerShell Empire traffic to perform reconnaissance and lateral movement. Through CrowdStrike IR engagements, GRIM SPIDER has been observed performing the following events on the victim’s network, with the end goal of pushing out the Ryuk binary:

An obfuscated PowerShell script is executed and connects to a remote IP address.

A reverse shell is downloaded and executed on the compromised host.

PowerShell anti-logging scripts are executed on the host.

Reconnaissance of the network is conducted using standard Windows command-line tools along with external uploaded tools.

Lateral movement throughout the network is enabled using Remote Desktop Protocol (RDP).

Service User Accounts are created.

PowerShell Empire is downloaded and installed as a service.

Lateral movement is continued until privileges are recovered to obtain access to a domain controller.

PSEXEC is used to push out the Ryuk binary to individual hosts.

Batch scripts are executed to terminate processes/services and remove backups, followed by the Ryuk binary.

https://arstechnica.com/information...lion-by-adopting-a-big-game-hunting-strategy/
Нажмите, чтобы раскрыть...

и акь же загрузчик в системе объявляется.. чой-то смахивает на работу крота == крот может написать скриптик на месте

UbIvItS · 14 янв 2019

https://www.zdnet.com/article/ranso...of-del-rio-back-to-the-days-of-pen-and-paper/
вот вона цифирьковая экономика

UbIvItS · 29 янв 2019

How Does CFG Really Work?
Software vulnerabilities are often exploited by providing unlikely, unusual, or extreme data to a running program. For example, an attacker can exploit a buffer overflow vulnerability by providing more input to a program than expected, thereby over-running the area reserved by the program to hold a response. This could corrupt adjacent memory that may hold a function pointer. When the program calls through this function it may then jump to an unintended location specified by the attacker.
However, a potent combination of compile and run-time support from CFG implements control flow integrity that tightly restricts where indirect call instructions can execute.
The compiler does the following:

Adds lightweight security checks to the compiled code.

Identifies the set of functions in the application that are valid targets for indirect calls.

The runtime support, provided by the Windows kernel:

Efficiently maintains state that identifies valid indirect call targets.

Implements the logic that verifies that an indirect call target is valid.

https://docs.microsoft.com/en-us/windows/desktop/SecBP/control-flow-guard
Нажмите, чтобы раскрыть...

зачётные костыли, то бишь прошу прощения, фичи (хотел сказать) то есть сделать элементарную проверку (размер буфера вс размер данных) религия запрещает.

https://arstechnica.com/gaming/2018...-to-getting-a-uwp-game-to-work-on-windows-10/

ваще, хочу выразиться в терминах старины - курцвейла == скоро наступит точка сингулярности, когда запустить вынь-легаси под виртой на лине будет проще и всячески эффективней, чем использование нового фэнси софта мокрых

UbIvItS · 2 фев 2019

After careful deliberation, NASA has decided to cancel the competition it announced six weeks ago that was designed to solicit the public’s help in speeding up its Pleiades supercomputer software.
Called the High Performance Fast Computing Challenge, the contest was designed to reward qualified contenders who could change the agency’s FUN3D design software so that it could run 10 to 1,000 times faster without a decrease in accuracy.
The extremely high number of applicants, more than 1,800, coupled with the difficulty in satisfying the extensive vetting requirements to control the public distribution of the software made it unlikely they would achieve the challenge’s original objectives in a timely manner.
NASA looked at several alternatives to keep the challenge design intact – things like significantly extending the challenge performance period, and offering a much smaller portion of the code. Neither were considered viable options.
“We truly appreciate the huge amount of interest shown in this challenge,” said Richard Barhydt,” deputy director of NASA’s Transformative Aeronautics Concepts Program. “It shows that people support what we’re doing and want to get involved.”
At this time, NASA has no plans to reorganize and offer this particular challenge again. However, the agency firmly supports the use of prize challenges to solve difficult problems and engage a broader community in agency activities.
J.D. Harrington
Last Updated: Aug. 22, 2017
Editor: Lillian Gipson
https://www.nasa.gov/aero/nasa-cancels-its-high-performance-fast-computing-challenge
Нажмите, чтобы раскрыть...

боян, но забавно: наса прикрыла свой бредовый челендж по оптимизации своих старых кодов на фортране по аэро/гидродинамике. это, кстати, весьма показательный пример про "супер секретные проекты".

SadKo · 2 фев 2019

UbIvItS сказал(а): ↑

боян, но забавно: наса прикрыла свой бредовый челендж по оптимизации своих старых кодов на фортране по аэро/гидродинамике. это, кстати, весьма показательный пример про "супер секретные проекты".
Нажмите, чтобы раскрыть...

Да, скорее, увидели кипы замудрёного кода на фортране, прикинули, сколько всё это будет стоить в сопровождении, и решили забить.

UbIvItS · 2 фев 2019

SadKo, да-этЪ чистой Воды анекдот == такая работёнка без проблем загрузит целый универ и можь дажь не один + нужОнЪ прямой доступ к железкам, на коих сии коды будут бегать.

UbIvItS · 5 фев 2019

https://www.zdnet.com/article/linux-kernel-gets-another-option-to-disable-spectre-mitigations/
новая забава нас постигла == теперь отключаем митигошены в линь ядре

--- Сообщение объединено, 5 фев 2019 ---

https://access.redhat.com/articles/3311301

UbIvItS · 18 фев 2019

SAY THIS MUCH for the “reproducibility crisis” in science: It’s poorly timed. At the same instant that a significant chunk of elected and appointed policymakers seem to disbelieve the science behind global warming, and a significant chunk of parents seem to disbelieve the science behind vaccines … a bunch of actual scientists come along and point out that vast swaths of the social sciences don’t stand up to scrutiny. They don’t replicate—which is to say, if someone else does the same experiment, they get different (often contradictory) results. The scientific term for that is bad.
What’s good, though, is that the scientific method is built for self-correction. Researchers are trying to fix the problem. They’re encouraging more sharing of data sets and urging each other to preregister their hypotheses—declaring what they intend to find and how they intend to find it. The idea is to cut down on the statistical shenanigans and memory-holing of negative results that got the field into this mess. No more collecting a giant blob of data and then combing through it for a publishable outcome, a practice known as “HARKing”—hypothesizing after results are known.
And self-appointed teams are even going back through old work, manually, to see what holds up and what doesn’t. That means doing the same experiment again, or trying to expand it to see if the effect generalizes. It’s a slog—boring, expensive, and time-consuming. To the Defense Advanced Research Projects Agency, the Pentagon’s mad-science wing, the problem demands an obvious solution: Robots.
https://www.wired.com/story/darpa-wants-to-solve-sciences-replication-crisis-with-robots/
Нажмите, чтобы раскрыть...

с помощью современного ии решать задачу валидности проектов/экспериментов, это широко улыбает

UbIvItS · 21 фев 2019

https://www.technologyreview.com/s/...nhackable-blockchains-are-now-getting-hacked/

UbIvItS · 10 мар 2019

https://arxiv.org/pdf/1903.00446.pdf по сути атаки начинают переходить от логических абстракций к кондовой физике == тот же ро-хаммер ужо стал потолком для дальнейшего развития озу. проблема спекулятивок вводит фатальный клинч меж секурой и скоростью.

UbIvItS · 13 мар 2019

Друзья, довольно забавная весть имеет место быть..

The Japanese Ministry of Internal Affairs and Communications revealed in a recent report that 2/3 of cyber attacks in 2016 were aimed at Internet of Things (IoT) devices. This coupled with preparing for the 2020 Olympics, resulted in the Japenese Government passing a law to allow for penetration testing on citizens’ IoT devices.
This will form part of a survey from the National Institute of Information and Communications Technology (NICT). With Japan’s Ministry of Internal Affairs and Communications, the NICT will gather a list of unsecured devices and pass these onto the Internet Service Providers (ISP). Thereafter, authorities and ISPs will let individuals know the weaknesses they will need to remedy such as passwords. The NICT will test over 200 million IoT devices including cameras, appliances and routers.
https://latesthackingnews.com/2019/...-test-citizens-iot-devices-ahead-of-olympics/
Нажмите, чтобы раскрыть...

теперь хак-бэки становятся официальными.

UbIvItS · 1 апр 2019

Ransomware Attacks on Governments Continue
In the past few days, the City of Albany, New York, was attacked by ransomware, according to their mayor.
Over the past year, there were numerous cities, counties and state government agencies hit by ransomware.
Back in 2017, I wrote this piece of ransomware attacks in government up to that time. And since 2017, attacks have only accelerated.
If you think insurance will take care of any costs, you may need to think again. I was surprised to read that some insurers are not paying if they can claim “an act of war.” Consider this article:
Citing “Act of War” Clauses, Insurers Refusing to Compensate Firms Hit in Ransomware Attacks – “Global insurance firm Hiscox is the now second insurance firm known to have refused to pay out a company damaged in a NotPetya cyberattack, Verdict reports. …
Danish shipping giant Maersk has reportedly claimed that NotPetya malware, whereby hackers encrypt data and will not release it unless a cryptocurrency ransom is paid, resulted in losses of $378 million to the company.
FedEx subsidiary TNT Express pegged NotPetya losses at $374 million.
The other insurer that has reportedly used “Act of War” provisions to refuse to make NotPetya payout is Zurich, insurer of Mondelez, a large American food company.
Mondelez is now suing Zurich for $100 million. Mondelez says that 1700 servers and 24000 laptops were destroyed in its NotPetya hack.”
https://www.govtech.com/blogs/lohrm...ore-widespread-destructive-and-expensive.html
Нажмите, чтобы раскрыть...

страховщикам даже можно посоветовать добавить пункт об ОТСУТСТВИЕ ДОЛЖНОЙ ОРГАНИЗАЦИИ СИСТЕМ БЕЗОПАСНОСТИ. одмины реально не тащат даже самых базовых решений. к примеру, вся почта работников должна быть на серверах фирмы и открываться под виртуалками, а работник получает на своём компе просто видеопоток с вирты. в худшем случае рэнсом опрокинет вм-ку, затем рестарт и вуаля == всё пашет дальше. следующий момент - это борьба с кротами: с нормальной локалкой получить малварю со внешки физ. невозможно.

UbIvItS · 4 апр 2019

https://www.zdnet.com/article/this-...nternet-for-systems-info-on-valuable-targets/

UbIvItS · 17 май 2019

http://www.whichfaceisreal.com в некоторых моментах действительно сложно определить, но в основном варианты палевные == либо по фону, либо по несуразным деталям лица.

Indy_ · 4 июн 2019

Вот и до яндекса рф добралась. Потиху проект по отключению реализуется.

Rel · 4 июн 2019

Indy_ сказал(а): ↑

Вот и до яндекса рф добралась. Потиху проект по отключению реализуется.
Нажмите, чтобы раскрыть...

все правильно, нечего в этих ваших интернетах сидеть, этот ваш интернет простому россейскому православному человеку не нужон вообще...

f13nd · 4 июн 2019

Ага, яндекс решил взять и уйтись российского рынка через отказ отдавать ключи фсбшникам. Очевидно потому что он популярней сервисов гугла и свободно может с ним конкурировать там за бугром.

Indy_ · 4 июн 2019

Rel,

Верно, правильным интернетом должен управлять патриарх бородатый и хитрый. Всё остальное не православненько.

f13nd,

А какие там варианты, сливать потихому инфу гэбью, так это быстро раскроют. По мойму вариантов вообще нет. На запрос придётся ответить да или нет, иначе если что то не внятное, то это по дефолту да и рынок потерян вслед за доверием.

f13nd · 4 июн 2019

Indy_ сказал(а): ↑

А какие там варианты, сливать потихому инфу гэбью, так это быстро раскроют. По мойму вариантов вообще нет. На запрос придётся ответить да или нет, иначе если что то не внятное, то это по дефолту да и рынок потерян вслед за доверием.
Нажмите, чтобы раскрыть...

Это какой-то секрет полишинеля, что скайп например с 2012 официально поддерживает прослушку? (даже на википедии об этом сказано) Что произошло со скайпом от этого "раскрытия" и "утраты доверия"? Ничто?

ЗЫ: кстати о птичках, у телеграма нету разве проблем с властями США в связи с политикой дурова в отношении ключей? Интересно почему.

Войти или зарегистрироваться

Забавные новости 0й-Ti :)

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

SadKo Владимир Садовников

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

Indy_ Well-Known Member

Rel Well-Known Member

f13nd Well-Known Member

Indy_ Well-Known Member

f13nd Well-Known Member

Войти или зарегистрироваться

Забавные новости 0й-Ti :)

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

SadKo Владимир Садовников

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

UbIvItS Well-Known Member

Indy_ Well-Known Member

Rel Well-Known Member

f13nd Well-Known Member

Indy_ Well-Known Member

f13nd Well-Known Member

Быстрый поиск