Bonus

programming & hardware & security 🦆 Pretending I know what I'm doing at @stm_cyber. Playing CTFs for @p4_team.

[Michał Leszczyński @icedevml]

Now live: a GUI for Step CA that allows to visualize all issued certificates; it also allows to create "invitations" to easily onboard (even non-technical) people onto your private CA through a friendly web-based flow.

GitHub icedevml/tinypki:
https://t.co/xzkWOFGNoN

[Bonus @BonusPlay3]

@FrankOverF1ow Selinux adds access control limiting access to objects even if you change your user, but not your context. If you want to test your poc against something that could prevent it, give @lkrg_org a try.

[Bonus @BonusPlay3]

@layle_ctf Cool. What are the advantages over sleigh (other than usable build via cargo)?

[Bonus @BonusPlay3]

I've sailed for the uncharted lands, and I'm slowly loosing sanity...

[CERT Polska @CERT_Polska_en]

‼️At the end of last year, there was a series of coordinated attacks in Polish cyberspace.

📌Today, our team is publishing a report describing the technical analysis of these events. We show the scheme of operation and the tools used by the attackers.

➡️https://t.co/A7EuPsL12h

[Bonus @BonusPlay3]

@i2cjak What do you use for generating via stitching in kicad?

[Bonus @BonusPlay3]

@mebeim @awawawhoami Every year is a banger year at CCC.

[Bonus @BonusPlay3]

@matiasgoldberg @telxius They just ignore some of your ICMP requests. Event if there are 5 more hops that don't respond what's important is that last hop (target) responds and gets all the packets. You have 0 packet loss to the target, so that's not the reason for your issues.

[Bonus @BonusPlay3]

@angealbertini How does it handle polymorphic files?

[Bonus @BonusPlay3]

@gynvael @S1r1u5_ Sure, but my point is that transparency has a cost. Not everyone is famous enough to get google to pay for their lawyers. The threat of big company lawsuit removes "90 day disclosure" from the table as they can dictate the terms.

[Bonus @BonusPlay3]

@gynvael @S1r1u5_ Expanding a little bit more, the core of the problem lies in "one policy doesn't fit all sizes". While it might fit heavily updated firmware with good update procedures (e.g. mobile or web apps), its unusable to others like embedded deployments.

[Bonus @BonusPlay3]

@gynvael @S1r1u5_ It would be nice to get them fixed+deployed in a year. But honestly I don't feel like I can demand anything from vendor. I'm just do security audits for my clients so that they can do risk modeling. Would you prefer if vendor made faulty patches during 90 days to satisfy clients?

[Bonus @BonusPlay3]

@gynvael @S1r1u5_ Yes, they are aware, but as there are no patches they can't do much. Also, once you buy devices, you have little to no leverage over vendor, as worst you can do is not buy more, which you probably will do anyway, since you've already integrated your systems into their environment

[Bonus @BonusPlay3]

@S1r1u5_ I have vulnerabilities that were disclosed 2 years ago and are still not patched, because most attackers try to blow up/pull out an ATM instead of hacking into it. In that case, screaming "90 days" and going public doesn't help anyone (vendor, clients), except researchers ego.

[Bonus @BonusPlay3]

@S1r1u5_ It all depends on the threat model. If it's a public facing web app? Sure, try to get vendor to patch ASAP. But for example, ATM/POS solution could require manual intervention in thousands of deployed units to get them patched. 90 days isn't realistic in that case.

[Bonus @BonusPlay3]

@RueNahcMohr ???
Literally all you need is to grab an older quartus (web edition) and you can generate & program bitstream.

You can check "purpose" of the chip here: https://t.co/p9qOgc1i9u
And a pinout for your exact fanout: https://t.co/NBNxmmWFoh

[Bonus @BonusPlay3]

@RueNahcMohr Huh? What about:
https://t.co/zXJBKsdfaz

[Bonus @BonusPlay3]

@travisgoodspeed Consider purchasing dedicated capacitor discharging device for safety reasons.