Someone slipped a vuln into crypto-wallets via an NPM package. Then someone else siphoned off $13m in coins to protect it from thieves
White Hat hack. This time.
2 Likes
Rich Text Office files, who could have imagined that!
Microsoft has never seen a pure data file format yet that it didnât go and stick some hook into to make it executable without warning. (Script, VBS, native code, byte code, hook to a COM objectâŚ) If there was a data format guaranteed by THOU SHALT NOT definitions not to have any auto-script capabilities, youâd still have to station people with cricket bats at Microsoft to stop them from adding that.
6 Likes
Is ODT better or just not used enough to be targeted?
I donât know if ODT has any defined provision for auto-script on open, so it would depend on whose code was opening the file.
Back in a day, there was a Microsoft exploit in plain XML files, where if you slipped a UUID value in, it would look it up in the registry and try to open the file with whatever it was, no indication or warning.
lmao nice
1 Like
Everyone is warning about the BlueKeep exploit on legacy Windows boxes.
Apparently the thing to do is patch them, now, and Microsoft is even patching end-of-lifed versions.
And yet, I think thereâs an XKCD for this. âHorribly wrongâ. I never have Remote Desktop running on Windows boxes. On headless Pis, I switch it on, do stuff, disable it. I never punch a hole in the router to allow anyone from the Internet to even try that port. If I had to RDP from somewhere else, Iâd set up a VPN rather than expose that port.
People should skip to the NSAâs suggested additional measures, and then worry about patching. If itâs not running, and no one can get to it, patching is a much lower priority.
1 Like
Thatâs been my thought exactly for a long time. Neither RDP nor VNC belongs out in the open.
If I expose SSH to the public, itâs configured for key-based authentication only. No key, no access.
1 Like
Hacking these medical pumps is as easy as copying a booby-trapped file over the network
Patching is good, I guess, but somehow horribly wrong. The real problem is that people are making their Wi-Fi extenders (or anything they donât have to) visible on the Internet.
2 Likes
Spin the wheel and find todayâs leaky cloud DB⌠clack clack⌠clack A huge trove of medical malpractice complaints
1 Like
1 Like
4 Likes
Heh. A nice article, but from the Washington Post, which wonât let me read anything if I block the slightest tracking site.
2 Likes
kevin mitnick is a huge jerk i refuse to give him press
this is a known issue with TOTP codes and other tools like dave kennedyâs âsocial engineering toolkitâ can be used to similar aims
1 Like
okay dokey
To be clear, by huge jerk I donât mean just âdifficult to get along withâ, but serious allegations of abusive behavior, doxing, and stealing otherâs work and passing it off as his own.
I personally saw him be ejected from a charity fundraiser because he felt he shouldnât have to pay the modest entry fee (IIRC 20 bucks?).
He nearly had to be physically ejected.
1 Like
Stop us if youâve heard this one: US government staff wildly oblivious to basic computer, info security safeguards
2 Likes
Good news: NASA and Homeland Security just passed their government IT exams â and we really mean just
2 Likes
