harrysintonen

joined 2 years ago
sorted by: new top controversial old
#curl predecessor httpget 0.2 from around 1996/1997 is 165 lines. Needless to say, it has multiple critical security vulnerabilities. How many can you spot? in c/[email protected]
[–] [email protected] 1 points 1 week ago* (last edited 1 week ago)

The httpget 0.2 doesn't quite work in the form it was uploaded.

First it uses hardcoded argv, argc instead of getting from the app invocation (as args in main, the code uses void main).

Second obtaining any data from the socket will result in the app stopping and leaving behind an empty file (if (nread) break;).

This program could never download anything. It is likely some work in progress or modified test version of httpget. Since it includes some windows specific headers and has disabled the unix ones I can only presume it was some earlier attempt to get the tool running on windows.

So while the code has a local stack buffer overflow it can't be triggered for this early version.

1
#curl predecessor httpget 0.2 from around 1996/1997 is 165 lines. Needless to say, it has multiple critical security vulnerabilities. How many can you spot? (infosec.exchange)
 

#curl predecessor httpget 0.2 from around 1996/1997 is 165 lines. Needless to say, it has multiple critical security vulnerabilities. How many can you spot?

If you build it on a modern system and want to try exploiting it in true 90s fashion, be sure to turn off address space layout randomisation (ASLR).

https://github.com/curl/httpget/blob/master/httpget-0.2.c

#infosec #cybersecurity

As expected #Apple has nuked Advanced Data Protection (ADP) for UK users. What does this mean in practice? UK govt will be able to decrypt all UK user's #iCloud data at will. in c/[email protected]
[–] [email protected] 1 points 1 week ago

If this trend continues, we will be losing the ability to use secure means of communication with UK friends and colleagues. For example, #signalapp will rather get out of the UK than add backdoors: https://www.bbc.com/news/technology-64584001

4
As expected #Apple has nuked Advanced Data Protection (ADP) for UK users. What does this mean in practice? UK govt will be able to decrypt all UK user's #iCloud data at will. (fedia.io)
 

As expected #Apple has nuked Advanced Data Protection (ADP) for UK users. What does this mean in practice? UK govt will be able to decrypt all UK user's #iCloud data at will.

Existing users' access will be disabled at a later date - this will likely mean that unless if you accept the new policy Apple will delete your existing iCloud data. Which I would recommend you do right now anyway - never trust someone else's computer with sensitive data.

https://www.bbc.com/news/articles/cgj54eq4vejo

#cybersecurity #privacy #enshittification

8
#OpenSSH client is vulnerable to MitM attacks if VerifyHostKeyDNS is enabled - https://www.openwall.com/lists/oss-security/2025/02/18/1 (infosec.exchange)
 

#OpenSSH client is vulnerable to MitM attacks if VerifyHostKeyDNS is enabled - https://www.openwall.com/lists/oss-security/2025/02/18/1

#CVE_2025_26465 #coordinateddisclosure #infosec #cybersecurity

#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now. in c/[email protected]
#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now. in c/[email protected]
[–] [email protected] 1 points 2 weeks ago

#Nordnet services appear to be back.

#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now. in c/[email protected]
[–] [email protected] 1 points 2 weeks ago (2 children)

Nordnet has a lot of technical issues to sort out. If the malfunction allowed unauthorized parties to operate the accounts it will be quite messy to sort out.

Among with technical part, they will have to deal with the regulatory issues, in particular the Financial Supervisory Authority. They will demand answers.

4
#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now. (fedia.io)
 

#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now.

https://www.nordnet.fi/

#infosec #infosecurity #cybersecurity #privacy

4
Another reminder to keep your critical content out of the cloud - Do no trust someone else's computer. (infosec.exchange)
 

Another reminder to keep your critical content out of the cloud - Do no trust someone else's computer.

https://www.msn.com/en-us/news/technology/uk-orders-apple-to-let-it-spy-on-users-encrypted-accounts/ar-AA1yzETB

#apple #icloud #privacy

In my youth I wrote m68k assembly programs with tens of thousands of lines and speed optimized every section of the code, even initialization/cleanup executed exactly once. It was very very silly. It in c/[email protected]
[–] [email protected] 1 points 3 weeks ago* (last edited 3 weeks ago)

I still occasionally write some m68k code and apps. These are from 2024:

- Execute code in #amiga color registers: https://sintonen.fi/src/colexec/colexec.asm
- RXS-M-XS 32bit->32bit Permuted Congruential Generator: https://sintonen.fi/src/misc/pcg/_rand.asm
- Minimal modplayer (protracker music player): https://sintonen.fi/src/minimod/ (the replayer routine is mostly from Frank Wille however)

In my youth I wrote m68k assembly programs with tens of thousands of lines and speed optimized every section of the code, even initialization/cleanup executed exactly once. It was very very silly. It in c/[email protected]
[–] [email protected] 1 points 3 weeks ago

I also participated in very useless size/speedcoding competitions - some of them are still accessible from this old web page: https://amycoders.org/compo/

Note that some of the HTML is a bit broken, for example https://amycoders.org/compo/circlecompo.html - you can view source to see the full routine

#m68k #assembly #sizecoding #speedcoding

2
In my youth I wrote m68k assembly programs with tens of thousands of lines and speed optimized every section of the code, even initialization/cleanup executed exactly once. It was very very silly. It (infosec.exchange)
 

In my youth I wrote m68k assembly programs with tens of thousands of lines and speed optimized every section of the code, even initialization/cleanup executed exactly once. It was very very silly. It was a lot of fun.

#development #assembly #coding #programming

#cURL doesn't validate SSH host identity if known_hosts file is missing. I think this is a #vulnerability, but the project disagrees. Advisory is here: in c/[email protected]
[–] [email protected] 2 points 3 weeks ago

@[email protected] Curl will likely address this eventually even though they don't consider it a vulnerability. See https://github.com/curl/curl/issues/16197

#cURL doesn't validate SSH host identity if known_hosts file is missing. I think this is a #vulnerability, but the project disagrees. Advisory is here: in c/[email protected]
[–] [email protected] 3 points 3 weeks ago

The latest curl version 8.12.0 (released today) is affected.

14
#cURL doesn't validate SSH host identity if known_hosts file is missing. I think this is a #vulnerability, but the project disagrees. Advisory is here: (infosec.exchange)
 

#cURL doesn't validate SSH host identity if known_hosts file is missing. I think this is a #vulnerability, but the project disagrees. Advisory is here: https://sintonen.fi/advisories/curl-ssh-insufficient-host-identity-verification.txt

#infosec #cybersecurity #nocve

Apparently there's a major #vulnerability in #AMD CPUs: "AMD Microcode Signature Verification Vulnerability." in c/[email protected]
[–] [email protected] 1 points 3 weeks ago

The details of the #AMD Microcode Signature Verification #Vulnerability are out:

#infosec #infosecurity #cybersecurity

Easy prediction: Lesser #NVIDIA 5000 series graphics cards will suck since multi frame generation won't really help due to increased latency (not to mention the added artifacting). Unfortunately it's in c/[email protected]
[–] [email protected] 1 points 1 month ago

In total surprise to no one, #NVIDIA #RTX5080 card is just "meh": https://www.youtube.com/watch?v=sEu6k-MdZgc

1
Easy prediction: Lesser #NVIDIA 5000 series graphics cards will suck since multi frame generation won't really help due to increased latency (not to mention the added artifacting). Unfortunately it's (infosec.exchange)
 

Easy prediction: Lesser #NVIDIA 5000 series graphics cards will suck since multi frame generation won't really help due to increased latency (not to mention the added artifacting). Unfortunately it's likely that many non-experts will drink the NVIDIA "RTX4070 better than RTX4090" kool-aid.

https://youtu.be/B_fGlVqKs1k "Hardware Unboxed - Is DLSS 4 Multi Frame Generation Worth It?"

#gaming #dlss #framegeneration

44
Warning: Do not trust *.g.co urls! #GoogleWorkspace domain verification seems to be quite lax and allow arbitrary .g.co to be created. This allows for extremely convincing #phishing to be performed (infosec.exchange)
 

Warning: Do not trust *.g.co urls! #GoogleWorkspace domain verification seems to be quite lax and allow arbitrary .g.co to be created. This allows for extremely convincing #phishing to be performed where all communication appears to be coming from "google".

ref. https://gist.github.com/zachlatta/f86317493654b550c689dc6509973aa4

#infosec #cybersecurity

Apparently there's a major #vulnerability in #AMD CPUs: "AMD Microcode Signature Verification Vulnerability." in c/[email protected]
[–] [email protected] 3 points 1 month ago

So what could you do if the microcode signature verification can be bypassed? While not directly applicable, this #defcon presentation "DEF CON 31 - Backdoor in the Core - Altering Intel x86 Instruction Set at Runtime - Krog, Skovsende" gives some ideas: https://www.youtube.com/watch?v=Zda7yMbbW7s

22
Apparently there's a major #vulnerability in #AMD CPUs: "AMD Microcode Signature Verification Vulnerability." (fedia.io)
 

Apparently there's a major #vulnerability in #AMD CPUs: "AMD Microcode Signature Verification Vulnerability."

The vulnerability was leaked by #ASUS in their beta BIOS changelog:

https://web.archive.org/web/20250106151231/https://rog.asus.com/motherboards/rog-strix/rog-strix-x870-i-gaming-wifi/helpdesk_bios/

ASUS has since removed this entry from the changelog since it likely broke the embargo. Either way, this is not great as the new firmware is largely not yet available and likely won't be for a long while.

#infosec #cybersecurity

25
If you're using #Adobe #Acrobat you might want to check if your organization allows use of the by default enabled generative AI features: Acrobat sends the documents to cloud for processing, which (fedia.io)
 

If you're using #Adobe #Acrobat you might want to check if your organization allows use of the by default enabled generative AI features: Acrobat sends the documents to cloud for processing, which likely goes against the data #privacypolicy of many orgs.

If unsure, go to Preferences > Generative AI and deselect "Enable generative AI features in Acrobat".

https://helpx.adobe.com/acrobat/using/disable-generative-ai.html

#privacy #defaults #enshittification

35
Apparently #macOS now considers #Docker malware. (fedia.io)
 

Apparently #macOS now considers #Docker malware.

#infosec #cybersecurity

view more: next ›