PC Ekspert Forum - Privatnost i sigurnost podataka i korisnika

Stranica 2 od 9

Zadnja »

Show 40 post(s) from this thread on one page

PC Ekspert Forum (https://forum.pcekspert.com/index.php)

- Razno (https://forum.pcekspert.com/forumdisplay.php?f=13)

- - Privatnost i sigurnost podataka i korisnika (https://forum.pcekspert.com/showthread.php?t=322402)

Jerry Drake

22.04.2025. 21:15

NIsma našao posebnu temu, a možda je zgodno to i ovdje ubaciti.

Ima li netko od vas iskustva iz prve ruke s NIS2?

Naime, firma u kojoj trenutno radim dobila je neke naznake da će biti uključena u NIS2 priču pa bismo se htjeli pripremiti za isto.

Znam ono što se da zguglati o inicijatiivi i ono što se traži. Međutim je zapravo vrlo malo konrketnog napisano o tome.

Ono što mene zanima su neki konkretni tehnički setup detalji.
Što točno treba biti implementirano? IDP sistem? EDR? IDS? SIEM? Sve to?

Mi recimo u firmi imamo već Fortigate firewall s pretplatom za cloud sigurnosne servise, i tu već ima svašta unutra, da li je to dovoljno?
Mailovi su nam u 365 officu, s enkripcijom, imamo i enkripciju od windowsa na hardovima.

tomek@vz

23.04.2025. 06:53

Citiraj:

Autor Jerry Drake (Post 3800653)

https://nis2direktiva.hr/

Nazalost nekaj pametnijeg nemam u rukavu osim ako netko od kolega ima dublje iskustvo.

tomek@vz

25.04.2025. 12:27

Heads up...

Citiraj:

“This evasion technique has been available since io_uring was added to the Linux kernel, but until now, no one had developed a fully functional rootkit that demonstrated its true potential,” said Ben Hirschberg, CTO and co-founder at ARMO.
“Leading cybersecurity vendors are still treating Linux as a second-class citizen. This is a huge gap, especially with the widespread cloud-native adoption, which is mostly Linux based. This is a wake-up call for the entire cybersecurity industry that cloud-native security is a discipline in its own right.”

> Techzine

Citiraj:

You are probably going to see a lot of news about the new Curing vulnerability which can take advantage of the io_uring system call interface which is enabled in many Linux kernels. At a glance it seems terrifying, a way to infect a machine that is essentially invisible to current antivirus software is not a good thing, but in order to make use of it you already have to have root privileges. If an attacker already has root, then the game is finished. Then again, a way to leverage this Curing rootkit without having root privileges then you can rightfully panic.
What is interesting about Curing is what it reveals about how security software functions, and that they all definitely have a blind spot. Current protections monitor system calls, which are certainly things which need to be closely watched, but Curing reveals that they need to do more. The article is light on details, likely on purpose to ensure bad actors can’t immediately leverage this possible vulnerability, but apparently Curing can be used to make network connections or tamper with files without your antivirus programs detecting it.

> PcPer

tomek@vz

01.05.2025. 08:49

Citiraj:

The majority of the traffic on the web is from bots. For the most part, these bots are used to discover new content. These are RSS Feed readers, search engines crawling your content, or nowadays AI bots crawling content to power LLMs. But then there are the malicious bots. These are from spammers, content scrapers or hackers. At my old employer, a bot discovered a wordpress vulnerability and inserted a malicious script into our server. It then turned the machine into a botnet used for DDOS. One of my first websites was yanked off of Google search entirely due to bots generating spam. At some point, I had to find a way to protect myself from these bots. That’s when I started using zip bombs.

↫ Ibrahim Diallo

mkey	01.05.2025. 14:08

> These are RSS Feed readers, search engines crawling your content, or nowadays AI bots crawling content to power LLMs. But then there are the malicious bots. These are from spammers, content scrapers or hackers.

Ma nemoj me. Search engines/AI bots <> content scrapers?

tomek@vz

01.05.2025. 15:00

Citiraj:

Apple sent notifications this week to several people who the company believes were targeted with government spyware, according to two of the alleged targets. In the past, Apple has sent similar notifications to targets and victims of spyware, and directed them to contact a nonprofit that specializes in investigating such cyberattacks. Other tech companies, like Google and WhatsApp, have in recent years also periodically sent such notifications to their users. As of Wednesday, only two people appear to have come forward to reveal they were among those who received the notifications from Apple this week.

One is Ciro Pellegrino, an Italian journalist who works for online news outlet Fanpage. Pellegrino wrote in an article that he received an email and a text message from Apple on Tuesday notifying him that he was targeted with spyware. The message, according to Pellegrino, also said he wasn't the only person targeted. "Today's notification is being sent to affected users in 100 countries," the message read, according to Pellegrino's article. "Did this really happen? Yes, it is not a joke," Pellegrino wrote.

The second person to receive an Apple notification is Eva Vlaardingerbroek, a Dutch right-wing activist, who posted on X on Wednesday. "Apple detected a targeted mercenary spyware attack against your iPhone," the Apple alert said, according to a screenshot shown in a video that Vlaardingerbroek posted on X. "This attack is likely targeting you specifically because of who you are or what you do. Although it's never possible to achieve absolute certainty when detecting such attacks, Apple has high confidence in this warning -- please take it seriously." Reacting to the notification, Vlaardingerbroek said that this was an "attempt to intimidate me, an attempt to silence me, obviously."

Citiraj:

Wired reports that a vulnerability in Apple's software development kit (SDK) means that tens of millions of those devices could be compromised by an attacker: "On Tuesday, researchers from the cybersecurity firm Oligo revealed what they're calling AirBorne, a collection of vulnerabilities affecting AirPlay, Apple's proprietary radio-based protocol for local wireless communication. Bugs in Apple's AirPlay software development kit (SDK) for third-party devices would allow hackers to hijack gadgets like speakers, receivers, set-top boxes, or smart TVs if they're on the same Wi-Fi network as the hacker's machine [...]

Oligo's chief technology officer and cofounder, Gal Elbaz, estimates that potentially vulnerable third-party AirPlay-enabled devices number in the tens of millions. 'Because AirPlay is supported in such a wide variety of devices, there are a lot that will take years to patch -- or they will never be patched,' Elbaz says. 'And it's all because of vulnerabilities in one piece of software that affects everything.'"

For consumers, an attacker would first need to gain access to your home Wi-Fi network. The risk of this depends on the security of your router: millions of wireless routers also have serious security flaws, but access would be limited to the range of your Wi-Fi. AirPlay devices on public networks, like those used everywhere from coffee shops to airports, would allow direct access. The researchers say the worst-case scenario would be an attacker gaining access to the microphones in an AirPlay device, such as those in smart speakers. However, they have not demonstrated this capability, meaning it remains theoretical for now.

tomek@vz

04.05.2025. 19:18

Prijateljski podsjetnik...

https://i.postimg.cc/Y9K7YXLG/9thcjjifxrxe1.png

> HiveSystems

kopija

04.05.2025. 20:47

Ovo FTW!

https://imgs.xkcd.com/comics/password_strength_2x.png

Libertus

04.05.2025. 21:04

Tako je! Moje glavne koje trebam pamtiti su takve godinama. Mislim da sam to vidio kod Snowdena na twitteru kad je savjetovao kako imati sigurnu lozinku, a da možeš zapamtiti.

Tipa:
gledam pce svaki dan

Onda staviš malo velikih slova

gledamPCEsvakiDAN

Onda dodaš neki broj i znak

gledamPCEsvaki1DAN!

I eto gadne lozinke za pogoditi a relativno lake za zapamtiti. :)

Bubba

04.05.2025. 21:22

Citiraj:

Autor tomek@vz (Post 3802619)

Prijateljski podsjetnik...

Ovo je vec godinama jedna od glupljih tablica koja kola internetima i poslovicno pali... sve koji vole infografike bez konteksta i minimuma pozadinskog znanja.

Bonjour tristesse, niti itko normalan vise ne koristi hashiranje bez salta vec... desetcima godina kao industrijski standard. Mozda sam malo i rekao.

Uz to sto vise nitko ne bruteforcea passworde isto tako svih tih... desetak godina, nego ih ukrades kako je Bog i zamislio - na izvoru!

tomek@vz

04.05.2025. 21:28

No eto čovjek nešto nauči svaki dan :lol2:

medo	05.05.2025. 10:19

Ima nas koji smo koristili smart kartice prije 23 godine jer je firma passworde smatrala nesigurnima. Zbog toga smo žurili s migracijom na XP :)

mkey	05.05.2025. 10:50

Htio sam ovo komentirati, ali onda sam ponovno pročitao i vidio da piše "nitko normalan". Tako da teza ipak drži vodu :D

tomek@vz

05.05.2025. 21:32

Citiraj:

If you use Microsoft’s Authenticator app on your mobile phone as a password manager, here’s some bad news: Microsoft is discontinuing the “autofill” password management functionality in Authenticator. According to the announcement post (spotted by BleepingComputer), the transition will take place in three stages over this summer.

> Pcworld

The Exiled

05.05.2025. 21:51

Citiraj:

Unofficial Signal app used by Trump officials investigates hack:kafa:

Citiraj:

TeleMessage, an Israeli company that sells an unofficial Signal message archiving tool used by some U.S. government officials, has suspended all services after reportedly being hacked. Smarsh, the parent company of TeleMessage, confirmed that all TeleMessage services have been suspended while it's investigating what it described as "a potential security incident." TeleMessage provides secure:hitthewal: mobile messaging services for businesses, including tools to archive messages exchanged via secure end-to-end encrypted messaging apps like Telegram, WhatsApp, and Signal. "We cannot guarantee the privacy or security properties of unofficial versions of Signal," a Signal spokesperson told Reuters earlier this week, while White House deputy press secretary Anna Kelly told NBC News that "Signal is an approved app for government use and is loaded on government phones." Signal automatically encrypts messages as they travel between users. But the details around TeleMessage’s encryption and security protocols aren’t fully clear.

Izvor: BleepingComputer i The Verge

StručLJaci za Trumpova državna pitanja uspješno koriste (nešto kao, a moglo bi biti nalik, dosta je slično, pa valjda i sigurno kao) Signal koliko i Severina PEZ bonbone za kontracepciju.:):D

OuttaControl

05.05.2025. 23:01

Citiraj:

Autor Bubba (Post 3802641)

Bonjour tristesse, niti itko normalan vise ne koristi hashiranje bez salta vec... desetcima godina kao industrijski standard. Mozda sam malo i rekao.

Uz to sto vise nitko ne bruteforcea passworde isto tako svih tih... desetak godina, nego ih ukrades kako je Bog i zamislio - na izvoru!

Ima nazalost puno nenormalnih i dalje :beer:

A svak normalan ce throttleat loginove nakon faila, i onemogucit login nakon x,

A opet kako si rekao niko nece vise brute forcat nego ce ko normalni svit, ukrast od onih istih nenormalnih koji ne da nisu hashali password nego ga enkriptirali, sa keyem iz baze, koja je dostupna sql injectionom. Pa ce dekriptirati i najsigurniji password od 487541 random znakova il rijeci, i ako isti koristis na gmailu sa svim accountovima.... well..... a cak te i 2fa nasamare, nasamarili su Troy Hunta, pa mogu i nekog tipicnog advanced usera....

spiderhr

06.05.2025. 09:42

Jel ovo tema da priupitam jel koristi tko Yubikey ili nešto slično?

Razmišljam da nabavim možda jedan ili dva (drugi za backup).

medo	06.05.2025. 09:54

Privatnost i sigurnost podataka i korisnika

Citiraj:

Autor spiderhr (Post 3802828)

Jel ovo tema da priupitam jel koristi tko Yubikey ili nešto slično?

Razmišljam da nabavim možda jedan ili dva (drugi za backup).

Pazi koju verziju softwarea imaju. Prošle godine je otkriven vulnerability koji te ne bi trebao pretjerano zabrinjavati ali kad već uzimaš novo… iz sigurnosnih razloga Yubikey ima zapečen firmware - nema updatea.

Meni je osobno Yubikey a must have.

Onaj s fingerprint readerom mi slabo očitava prste. Imam suhi kožu pa je možda do toga. Moram stisnuti prst a onda savijam USB-C port… a ako tri puta ne očita prst ili fula PIN onda pobriše (sve) sa sebe.

Citiraj:

Autor OuttaControl (Post 3802794)

Ima nazalost puno nenormalnih i dalje :beer:

A svak normalan ce throttleat loginove nakon faila, i onemogucit login nakon x,

Lupam bezveze neke passworde iz bilo kojeg kraja svijeta i zalokam ti account. Samo trebam znati tvoj username.

Super scenarij za tebe ako radiš od doma :D

xlr	06.05.2025. 10:05

2 komada je neki standardni slucaj, ne bi uzimao samo jedan kljuc osim za inicijalnu probu da se uvjeris treba li ti to i da vidis kako radi.

Ovdje smo pisali dosta o kljucevima:
http://forum.pcekspert.com/showthread.php?t=216268

Osobno imam Token2 kljuceve jer su visestruko jeftiniji od jubija, a podrzavaju sve sto mi REALNO treba (passkey, TOTP, CLI/GUI appovi za pristup kljucu ako ikad zatreba).

Osobno kljuc koristim za ulazak u password manager i par drugih accounta. Neke usluge imam slozene na nacin da im mogu pristupiti s kljucem i sa passkeyem spremljenim u password manageru - u slucaju da nemam komp ili lak pristup password manageru na ovaj ga nacin mogu zaobici samo koristenjem kljuca - pod uvjetom da me taj servis u praksi NE pita password nego da mu je dosta samo passkey... Jbga, jedini pass koji znam napamet je taj od password managera. Sve ostalo mi je 20+ random znakova i ovisim o manageru.

Kakogod, passkey spika je dosta sarena i nisam odusevljen kako to sve radi. Zato fokus stavljam na otkljucavanje password managera pa dalje sve vadim iz njega, passworde, passkeyeve, sve.

mkey	06.05.2025. 13:36

Imam dvije pričice za ne povjerovati :D

Citiraj:

Autor OuttaControl (Post 3802794)

sa keyem iz baze, koja je dostupna sql injectionom.

Dakle, na svoje sam oči vidio kako su majstori u produkcijskom okruženju koristili user/pass za pristup db serveru u plain text formatu u sklopu konfiguracijskog JSONa i to vidljivog u aplikacijskim postavkama, kojima (makar read only) pristup imaju svi korisnici sajta :D Istina je da su korisnici glup k'o k*rac i ne umiju čitati JSON, ali svejedno.

Lijeno programiranje na 15tu, liku se jednostavno nije dalo to napraviti kako treba, zadovoljio je KPI, pripremili su skripte, deployali u produkciju (dakle, više ljudi je sudjelovalo u tom procesu) i onda je to stajalo tako tko zna koliko dugo dok ja na to nisam naletio. Užas.

Citiraj:

Autor medo (Post 3802830)

Lupam bezveze neke passworde iz bilo kojeg kraja svijeta i zalokam ti account. Samo trebam znati tvoj username.

Netko isto tako pametan kao ovaj iz gornjeg primjera u produkcijskom okruženju podesio da se neki vanjski servis logira u web aplikaciju koristeći administratorski account. Kako je bila konfigurirana kriva (stara) lozinka, nakon 5 pokušaja account bi se zaključao na 5 minuta. Servis se pokušavao spojiti više puta svaku sekundu tako da je account bio konstantno zaključan.

Govorim kolegama šta se dešava, i kažem kako je taj account stalno zaključan već duže vrijeme. Ma kakvi, nema šanse :D Prvotno sam napravio drugi account (tako da sam administratorski privremeno preimenovao kroz bazu da mogu ući unutra) da mogu odraditi što treba.

Onda kada mi je dopizdilo (6 mjeseci kasnije) išao sam tražiti po konfiguracijskim fajlovima i naravno našao konfiguraciju za taj servis. Naučio sam da nije dovoljno ukazati na problem nego treba i prstom uprti u rješenje, staviti pokoji uskličnik, podcrtati, uokviriti, poslati pokoji nadrkani mail i tako ukrug. Također užas.

Libertus

06.05.2025. 14:05

Citiraj:

Autor mkey (Post 3802865)

Naučio sam da nije dovoljno ukazati na problem nego treba i prstom uprti u rješenje, staviti pokoji uskličnik, podcrtati, uokviriti, poslati pokoji nadrkani mail i tako ukrug. Također užas.

LoL :D

Ja odmah šaljem nadrkane mejlove pa se proces ponešto skrati. :D

Druga opcija je staviti alarm dvaput dnevno, nazvati i pitati što ima, gdje smo stigli s tim. Nakon nekog vremena dopizdi im pa riješe.

tomek@vz

06.05.2025. 15:07

Citiraj:

Autor Libertus (Post 3802872)

Osim ak si "eksterni" a problem je "interno".

mkey	06.05.2025. 15:48

Razmišljao sam o tome da im napravim alarme, ali debelo je izlazilo izvan okvira mojeg i tako opširnog radnog mjesta. Npr. slanje nadrkanih mailova definitivno nije bilo u mom platnom razredu, nego bi me svako toliko nasrdili pa bih poslao te mailove pro bono.

Evo eksterno vs interno je kod njih bilo novo vs staro. A "staro" je bilo sve ono što je makar jednu sekundu u produkciji :D

Pupo	06.05.2025. 18:04

Citiraj:

Autor medo (Post 3802830)

Taj vulenrability je nemoguće reproducirati u RL situaciji. Što je dobro iz dvije stvari, znači da ima ekipe koja se rješava starih yubikijeva za smješne pare zbog "vulenrabilitija" pa se isti ti mogu naći za pola cijene.
A bolje uzeti 2 s vulnerabilitijem nego jedan bez, jer samo jedan koristiti za sve bez sekundarnog. Bolje da ga ne izgubite il da krepa.:D

medo	07.05.2025. 14:53

Citiraj:

Autor Libertus (Post 3802872)

Takvi poput tebe su mi u block listi na mobitelu i u filterima na Outlooku :D

Ivo_Strojnica

07.05.2025. 23:59

ja sam iša korak dalje, imam skriptu koja čita key words iz maila određenih ljudi i šalje poruku: "sjaši." :D

tomek@vz

09.05.2025. 07:42

Ono kad dodes na visoku poziciju preko veze :lol2:

Citiraj:

Facepalm: Studies show that most people still reuse weak passwords across multiple accounts despite years of warnings from cybersecurity experts against the practice. Recent leaks reveal that poor password discipline even occurs at the upper levels of the United States government.

Leaked passwords from past security breaches reveal that Tulsi Gabbard, who recently became the US Director of National Intelligence, reused a weak password on multiple accounts for email and other services. All of the breaches occurred several years ago, and a spokesperson claimed Gabbard changed the passwords multiple times since then, but the revelations might add to recent scrutiny of government cybersecurity discipline.

> Techspot

tomek@vz

12.05.2025. 06:29

Citiraj:

Cybersecurity researchers have flagged three malicious npm packages that target the macOS version of AI-powered code-editing tool Cursor, reports The Hacker News:
"Disguised as developer tools offering 'the cheapest Cursor API,' these packages steal user credentials, fetch an encrypted payload from threat actor-controlled infrastructure, overwrite Cursor's main.js file, and disable auto-updates to maintain persistence," Socket researcher Kirill Boychenko said. All three packages continue to be available for download from the npm registry. "Aiide-cur" was first published on February 14, 2025...

In total, the three packages have been downloaded over 3,200 times to date.... The findings point to an emerging trend where threat actors are using rogue npm packages as a way to introduce malicious modifications to other legitimate libraries or software already installed on developer systems... "By operating inside a legitimate parent process — an IDE or shared library — the malicious logic inherits the application's trust, maintains persistence even after the offending package is removed, and automatically gains whatever privileges that software holds, from API tokens and signing keys to outbound network access," Socket told The Hacker News.

"This campaign highlights a growing supply chain threat, with threat actors increasingly using malicious patches to compromise trusted local software," Boychenko said.

The npm packages "restart the application so that the patched code takes effect," letting the threat actor "execute arbitrary code within the context of the platform."

tomek@vz

12.05.2025. 06:29

Citiraj:

"A China-linked unnamed threat actor dubbed Chaya_004 has been observed exploiting a recently disclosed security flaw in SAP NetWeaver," reports The Hacker News:
Forescout Vedere Labs, in a report published Thursday, said it uncovered a malicious infrastructure likely associated with the hacking group weaponizing CVE-2025-31324 (CVSS score: 10.0) since April 29, 2025. CVE-2025-31324 refers to a critical SAP NetWeaver flaw that allows attackers to achieve remote code execution (RCE) by uploading web shells through a susceptible "/developmentserver/metadatauploader" endpoint.

The vulnerability was first flagged by ReliaQuest late last month when it found the shortcoming being abused in real-world attacks by unknown threat actors to drop web shells and the Brute Ratel C4 post-exploitation framework. According to [SAP cybersecurity firm] Onapsis, hundreds of SAP systems globally have fallen victim to attacks spanning industries and geographies, including energy and utilities, manufacturing, media and entertainment, oil and gas, pharmaceuticals, retail, and government organizations. Onapsis said it observed reconnaissance activity that involved "testing with specific payloads against this vulnerability" against its honeypots as far back as January 20, 2025. Successful compromises in deploying web shells were observed between March 14 and March 31.

"In recent days, multiple threat actors are said to have jumped aboard the exploitation bandwagon to opportunistically target vulnerable systems to deploy web shells and even mine cryptocurrency..."

tomek@vz

12.05.2025. 06:32

Citiraj:

"Login credentials belonging to an employee at both the Cybersecurity and Infrastructure Security Agency and the Department of Government Efficiency have appeared in multiple public leaks from info-stealer malware," reports Ars Technica, "a strong indication that devices belonging to him have been hacked in recent years."
As an employee of DOGE, [30-something Kyle] Schutt accessed FEMA's proprietary software for managing both disaster and non-disaster funding grants [to Dropsite News]. Under his role at CISA, he likely is privy to sensitive information regarding the security of civilian federal government networks and critical infrastructure throughout the U.S. According to journalist Micah Lee, user names and passwords for logging in to various accounts belonging to Schutt have been published at least four times since 2023 in logs from stealer malware... Besides pilfering login credentials, stealers can also log all keystrokes and capture or record screen output. The data is then sent to the attacker and, occasionally after that, can make its way into public credential dumps...

Lee went on to say that credentials belonging to a Gmail account known to belong to Schutt have appeared in 51 data breaches and five pastes tracked by breach notification service Have I Been Pwned. Among the breaches that supplied the credentials is one from 2013 that pilfered password data for 3 million Adobe account holders, one in a 2016 breach that stole credentials for 164 million LinkedIn users, a 2020 breach affecting 167 million users of Gravatar, and a breach last year of the conservative news site The Post Millennial.

The credentials may have been exposed when service providers were compromised, the article points out, but the "steady stream of published credentials" is "a clear indication that the credentials he has used over a decade or more have been publicly known at various points.

"And as Lee noted, the four dumps from stealer logs show that at least one of his devices was hacked at some point."

Ovi preko bare više nisu ni smješni...

tomek@vz

12.05.2025. 12:23

Citiraj:

A critical Proof-of-Concept (PoC) exploit has been released for a significant vulnerability in the Linux kernel’s nftables subsystem, tracked as CVE-2024-26809.

This flaw, rooted in the kernel’s netfilter infrastructure, exposes affected systems to local privilege escalation through a sophisticated double-free attack.

Security researchers, including the user “conlonialC,” have demonstrated how this bug can be weaponized to achieve root-level access, underscoring the urgency for system administrators to apply available patches.

Citiraj:

CVE-2024-26809 affects Linux kernel versions 5.15.54 and later, including the 6.1 and 6.6 LTS branches.

The vulnerability has been addressed in recent kernel updates, with distributions such as Debian, Ubuntu, and SUSE releasing patches for all supported versions.

> CSNews

tomek@vz

13.05.2025. 20:29

Citiraj:

Chipmakers typically use microcode updates to fix bugs and improve CPU reliability. However, this low-level layer between hardware and machine code can also serve as a stealthy attack vector – capable of hiding malicious payloads from all software-based defenses. As threats evolve, even the deepest layers of a system can no longer be assumed safe.

A security researcher designed a way to "weaponize" microcode updates to install ransomware directly onto the CPU. Rapid7 analyst Christiaan Beek drew inspiration from a critical flaw in AMD's Zen processors, discovered by Google researchers earlier this year. The flaw could allow attackers to modify the RDRAND instruction and inject a custom microcode that always selects "4" when generating a random number.

> Techspot

tomek@vz

15.05.2025. 05:39

Citiraj:

European Union public vulnerability database enters beta phaseEurope has a backup plan in case the CVE system tanks

> Techspot

tomek@vz

16.05.2025. 08:33

Citiraj:

Windows 11 and Red Hat Linux hacked on first day of Pwn2Own

> BleepingComputer

tomek@vz

16.05.2025. 12:50

Citiraj:

Lawmakers say TP-Link's rock-bottom prices fuel Chinese cyberattacks, back US sales ba

Citiraj:

Discount routers, premium threat?

Night

16.05.2025. 16:29

Taj TP Link je odavno problem u USA i šire, pogotovo jer im je firmware sigurnosna katastrofa.

kopija

16.05.2025. 17:07

Ako tplinkovi imaju backdoor šta onda tek ovi huaveiji šta naši dijele imaju?
Možda su napravljeni od plastičnog eksploziva pa će rvacka da se trese ako AP verbalni delikt počini protivu Partije.

tomek@vz

17.05.2025. 06:11

Problem je kak se meni čini da trenutno samo možemo birat špijuna. Ili preći na nešto što vrti OpenWRT.

tomek@vz

17.05.2025. 20:43

Citiraj:

A Curl contributor replaced an ASCII letter with a Unicode alternative in a pull request, writes Curl lead developer/founder Daniel Stenberg. And not a single human reviewer on the team (or any of their CI jobs) noticed.

The change "looked identical to the ASCII version, so it was not possible to visually spot this..." The impact of changing one or more letters in a URL can of course be devastating depending on conditions... [W]e have implemented checks to help us poor humans spot things like this. To detect malicious Unicode. We have added a CI job that scans all files and validates every UTF-8 sequence in the git repository.

In the curl git repository most files and most content are plain old ASCII so we can "easily" whitelist a small set of UTF-8 sequences and some specific files, the rest of the files are simply not allowed to use UTF-8 at all as they will then fail the CI job and turn up red. In order to drive this change home, we went through all the test files in the curl repository and made sure that all the UTF-8 occurrences were instead replaced by other kind of escape sequences and similar. Some of them were also used more or less by mistake and could easily be replaced by their ASCII counterparts.

The next time someone tries this stunt on us it could be someone with less good intentions, but now ideally our CI will tell us... We want and strive to be proactive and tighten everything before malicious people exploit some weakness somewhere but security remains this never-ending race where we can only do the best we can and while the other side is working in silence and might at some future point attack us in new creative ways we had not anticipated. That future unknown attack is a tricky thing.
In the original blog post Stenberg complained he got "barely no responses" from GitHub (joking "perhaps they are all just too busy implementing the next AI feature we don't want.") But hours later he posted an update.

"GitHub has told me they have raised this as a security issue internally and they are working on a fix."

medo	18.05.2025. 15:48

Citiraj:

Autor tomek@vz (Post 3804626)

Problem je kak se meni čini da trenutno samo možemo birat špijuna. Ili preći na nešto što vrti OpenWRT.

Dašta :)

Sva vremena su GMT +2. Sada je 07:01.

Stranica 2 od 9

Zadnja »

Show 40 post(s) from this thread on one page