|
Google Project Zero's security researchers have discovered another critical remote code execution (RCE) vulnerability in Microsoft’s Windows operating system, claiming that it is something truly bad. "Nice army base here, Colonel. We wouldn't want anything to happen to it."
|
|
|
|
|
But for sure it is not Windows 10, only those old editions already out of use...
Skipper: We'll fix it.
Alex: Fix it? How you gonna fix this?
Skipper: Grit, spit and a whole lotta duct tape.
|
|
|
|
|
Microsoft has released a patch: Microsoft Security Advisory 4022344[^]
It is really bad:
Quote: The update addresses a vulnerability that could allow remote code execution if the Microsoft Malware Protection Engine scans a specially crafted file. An attacker who successfully exploited this vulnerability could execute arbitrary code in the security context of the LocalSystem account and take control of the system.
It shows again that exploiting virus scanners is the best way to infect a system beacuse those are running with high privileges.
[EDIT]
See also 1252 - MsMpEng: Remotely Exploitable Type Confusion in Windows 8, 8.1, 10, Windows Server, SCEP, Microsoft Security Essentials, and more. - project-zero - Monorail[^]:
Quote: On workstations, attackers can access mpengine by sending emails to users (reading the email or opening attachments is not necessary), visiting links in a web browser, instant messaging and so on.
...
Vulnerabilities in MsMpEng are among the most severe possible in Windows, due to the privilege, accessibility, and ubiquity of the service.
[/EDIT]
|
|
|
|
|
Buckaroo uses Facebook's Buck build system, and has its own curated repository of packages as well Just the thing that those, "rewrite everything myself" folk have been demanding
|
|
|
|
|
Dr Tromer, of Tel Aviv university, his colleague Roei Schuster and Vitaly Shmatikov of Cornell have worked out how those leaks can identify the film you are watching—even if they cannot directly observe the stream of bits delivering it, or obtain access to the device on which you are watching it.
The TL;DR for the attack is that it floods your wifi with traffic and uses variations in its latency to estimate the sizes of the variable bit rate data packets that Netflix/etc are sending. It then uses a neural network to get a 99% match with a few minutes of data collection on any videos that it's previously recorded the data sizes of.
Did you ever see history portrayed as an old man with a wise brow and pulseless heart, waging all things in the balance of reason?
Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful?
--Zachris Topelius
Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies.
-- Sarah Hoyt
|
|
|
|
|
Jeeze, it would be simpler to set up a telescope across the road!
I wanna be a eunuchs developer! Pass me a bread knife!
|
|
|
|
|
Far Side
... such stuff as dreams are made on
|
|
|
|
|
Dunno about that. Tricking you into loading hostile JS seems easier than traveling to wherever you live and trying to find a spot I can watch you without being seen...
Did you ever see history portrayed as an old man with a wise brow and pulseless heart, waging all things in the balance of reason?
Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful?
--Zachris Topelius
Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies.
-- Sarah Hoyt
|
|
|
|
|
|
The problem is that it doesn't scale the same way that pwning everyone who visits a site I can con into loading my "analytics" script onto.
Did you ever see history portrayed as an old man with a wise brow and pulseless heart, waging all things in the balance of reason?
Is not rather the genius of history like an eternal, imploring maiden, full of fire, with a burning heart and flaming soul, humanly warm and humanly beautiful?
--Zachris Topelius
Training a telescope on one’s own belly button will only reveal lint. You like that? You go right on staring at it. I prefer looking at galaxies.
-- Sarah Hoyt
|
|
|
|
|
But where's the fun in that?
Way more fun seeing what people are doing watching in their bedrooms!
I wanna be a eunuchs developer! Pass me a bread knife!
|
|
|
|
|
I know what most of you are watching anyway!
... such stuff as dreams are made on
|
|
|
|
|
I found another way to identify what videos you're streaming without access to the datastream; ask.
|
|
|
|
|
The fast food chain's 15-second television ad targeted Google Home, a speaker that can answer questions and control other smart appliances. "Hail to the king, baby"
|
|
|
|
|
Quote: (Just imagine a burglar spying a voice assistant and asking it to unlock all the doors.)
Uuuhm.. Aren't those voice assistants supposed to be *inside*? I mean - One can't command the assistant to unlock the doors if the assistant is locked inside. Maybe if a window is leaned on - But shouting "OK GOOGLE - UNLOCK ALL DOORS" is probably noisier than just opening the window the old-fashioned way 
I only have a signature in order to let @DalekDave follow my posts.
|
|
|
|
|
Marco Bertschi (SFC) wrote: Uuuhm.. Aren't those voice assistants supposed to be inside? I mean - One can't command the assistant to unlock the doors if the assistant is locked inside. Maybe if a window is leaned on - But shouting "OK GOOGLE - UNLOCK ALL DOORS" is probably noisier than just opening the window the old-fashioned way
Most doors in the UK have letterboxes you can shout through.. might be easier than trying to shout through a closed window.
Alternatively, if the homeowner has an answerphone and you know their number you could call them, wait for it to pick up and then issue your command (most answerphones go to loudpspeaker when they answer). Just don't forget to delete your message on your way out!
Now is it bad enough that you let somebody else kick your butts without you trying to do it to each other? Now if we're all talking about the same man, and I think we are... it appears he's got a rather growing collection of our bikes.
modified 31-Aug-21 21:01pm.
|
|
|
|
|
Brent Jenkins wrote: Most doors in the UK have letterboxes you can shout through.. might be easier than trying to shout through a closed window.
My point was that, even when one is shouting through a gap, it is likely to be heard by your neighbors. If you're not well known for shouting at your voice assistant it will draw attention.
Brent Jenkins wrote: Alternatively, if the homeowner has an answerphone and you know their number you could call them, wait for it to pick up and then issue your command (most answerphones go to loudpspeaker when they answer). Just don't forget to delete your message on your way out!
You got a point there. But this can be avoided by placing your device away from your answerphone, or getting an answerphone which doesn't shout out loud.
I only have a signature in order to let @DalekDave follow my posts.
|
|
|
|
|
So my next patent will be for a shouting-through-letterboxes hood and hose!
... And you never know when I'll be in your town!
I wanna be a eunuchs developer! Pass me a bread knife!
|
|
|
|
|
Try it. First of all, I don't own a voice assistant. Second, I don't have a hole in my door.
I only have a signature in order to let @DalekDave follow my posts.
|
|
|
|
|
Hmm.
So I'll have to incorporate a tank-cutter and a couple of waldoes for the homes of luddites.
Thanks for the inspiration!
(No, you don't get a cut of the huge profits!)
I wanna be a eunuchs developer! Pass me a bread knife!
|
|
|
|
|
Marco Bertschi (SFC) wrote: Try it. First of all, I don't own a voice assistant. Second, I don't have a hole in my door.
Have you got a chimney? Santa must get in somehow..?
Now is it bad enough that you let somebody else kick your butts without you trying to do it to each other? Now if we're all talking about the same man, and I think we are... it appears he's got a rather growing collection of our bikes.
modified 31-Aug-21 21:01pm.
|
|
|
|
|
Nope. Always been naughty. You don't wanna hear details, don't you?
I only have a signature in order to let @DalekDave follow my posts.
|
|
|
|
|
|
So Mr Logic has a crystal ball nowadays?
Stephen Hawking claims: Professor Stephen Hawking thinks the human species will have to populate a new planet within 100 years if it is to survive,
I'd make a strong claim in the opposite direction. Moving to mars would fail if done too quick, and it would mean a throwback for earth.
Earth will not be 'guaranteed uninhabitable' in 100 years, and we have more urgent problems than the TV-movie based fear of a professor.
Bastard Programmer from Hell 
If you can't read my code, try converting it here[^]
|
|
|
|
|
in the face of catastrophes like climate change, asteroid strikes, epidemics and overpopulation.
An good asteroid strike would solve the last two, and eventually the first one would recover.
So what's the problem? 
Marc
Latest Article - Merkle Trees
Learning to code with python is like learning to swim with those little arm floaties. It gives you undeserved confidence and will eventually drown you. - DangerBunny
Artificial intelligence is the only remedy for natural stupidity. - CDP1802
|
|
|
|
General 
News 
Suggestion 
Question 
Bug 
Answer 
Joke 
Praise 
Rant 
Admin 
Submit an article or tip
