2,498 karma · joined August 21, 2014
What does Edge do? It shows you a unskippable, un-closable "how-to" (as if I've never used a browser), and a make-an-account-and-sync nag. It takes a minute to click though, what a turn off!
It hasn't popped up for me in a while, but it definitively happens sometimes.
A central list of exploitable drivers serves as a starting point for both attackers and defenders. Attackers can use it for their research if they want to raise their privileges by loading code into the kernel (rootkits), or attack protected processes (PPL and up, think anti-virus and anti-malware processes, DRM). For defenders it serves as a curated list of drivers to look out for in their environment. For example, to raise alerts if a Lenovo driver is loaded on a Dell system.
A similar site is the LolBAS site, where signed Windows binaries are listed for their ability to serve as trusted "proxy" executables into which attackers can somehow inject or load their code.
The exploit can still be deployed by malicious actors on patched devices because they can bring old vulnerable signed bootloaders. And roll back any applied patches.
These old signed bootloaders could technically by revoked, but if Microsoft does that then all old backups, possibly going back years, will no longer boot when restored. I can imagine there's many hundreds of thousands of backups that would then be silently broken. Imagine you find that out when you restore after a disaster...
Google gave me listicles instead...
Not all combinations are tested, all branches are both taken and not taken, but not all combinations of taken/not taken are tested.
Entities (ab)using remote attestation in order of 'screws over those below them':
Government > Cyber criminal groups > Large organizations > Normal people.
Do you want to live in a world where a large corp can dictate which $VERSION of $APPROVED_SOFTWARE you should be running? I think fundamentally it's just not the direction we should be going. I don't actually doubt that proper remote attestation eventually would be possible, but before then it will be possible to bypass it in countless ways. Probably eventually you'd end up with only a single software stack, assumed to be flawlessly secure.
I think, luckily, this will severely limit the usability of the technology that can work in this way. Developing for this stack will be a pain, the machine will have all sorts of super annoying limitations: can't use that display the driver is not vetted, can't use that USB webcam it might have DMA, etc. That will hopefully harm the uptake of such technologies.
Like often in tech remote attestation in your case is a technical fix for a social problem. If the problem is sharing sensitive data with institutions you don't trust then you need to build that trust, or transform the institutions so that they can be trusted. Transparency, laws, oversight, that type of stuff.
# cat /etc/shadow root:
And there it goes:
# cat /etc/shadow root:$6$fT8xrJ$Zx7rC6X0lHlHqLbZkT/HtYQxUY.WZ4.2UgX0w.XKbZbFfqxR.zGw9yZsX2l.3Ls/sL.qg7uB1:0:0:99999:7::
Or:
-----BEGIN OPENSSH PRIVATE KEY-----
Or:
# ip a
Is it possible, that with a specific enough prompt it will regurgitate its training data exactly?
What if the west is certain they can take down their land based launch sites? What if they only need to concern themselves with the submarines? What if the west knows where those are? (Sonar has had huge developments 1990-$NOW) What if sonar technology has developed to a point the west have a fix on 50% of Russian subs? What then?
MAD only works if MAD means MAD, not if MAD means 50% assured destruction... The loss of life, wealth and security if one side of this insane pact ever lets down their part of the deal...
What do you mean learning from history? The historic parallels to another leader are so overwhelming that I'm not even going to point them out to you.
Their "viewpoint" is that other, free, people should be forced with violence to bow to his will.
I dread every time I need to install a (older) package from source. I think around a quarter of the time it turns into a multiple hour adventure of frustration, only to discover the library it was missing is called $NAME-dev on my distro...
I think it would be detected quickly because the most likely payload dropped would be ransomware. which makes it immediately obvious to users they got owned. I don't think it would take longer than a day to discover a zero day exists in $BROWSER once a group starts a campaign using it.
All software distributors that expose attack surface to a large consumer base have all had plenty of time to learn how to deal with a major security hole that needs to be patched asap. Once a researcher tweets about a 0day in $BROWSER, there'll be an incomplete patch 1 day later. 4 days later the final patch is out. Auto updates ensure every user has the patch the moment they go online.
But I do think we can still see a CCG using a browser exploit to infect people, but I don't think we'd see exploits packaged and sold inside exploit kits.
The job is frustrating because many socs are beholden to central IT to fix even high severity issues, this generates a lot of friction. Most organizations have a big feed of alerts that trigger on everything from ransomware, to a user plugging in a razor mouse... This makes the job frustrating and boring. Contrast this to red team positions. If they're lucky they get to cowboy all through the network never asking permission after initial sign-of. And why would they? Nobody spots what they're doing anyway, as long as you don't create problems in prod.
This is the source of many people's frustration, and the source of forced synonyms. A dumb tool that adapts to humans as they use it and tries to be "smart" prohibits us from getting more skilled in the usage of the tool. It becomes unpredictable, and it introduces significant friction each time it does something dumb.
Even if the tool is correct 90% of the time, it is wrong 100% of the time on an emotional/ux level. The successes are invisible in aggregate, but each mistake sticks out like a sore thumb. I guess why this is: modern understanding of our brains (as I, a lay man, understand it) is that they attempt to continuously predict what's going to happen next in their environment. When all predictions are correct it feels good, and there's no tension. A tool that adapts and changes makes our brains predictions turn out wrong, and our brains punish us with tension and attention each time the tool does not do what we want, since it failed to predict the desired behavior.
Previous versions of google felt so nice precisely because our brains, or at least those of hackers, could adapt to its various tricks and shortcuts.
Then they also inject themselves into processes and 'hook' into operating system routines to check things the feeds to not provide: which files are being accessed, how often, what memory is allocated, what type of memory is allocated, which threads are running, where they are running and what they are doing, if there's mismatches between what the operating system told are the modules loaded, and what it can find in memory.
Most of this software can be configured so that the resource usage is relatively tame, but then on the next pentest the security people will notice all sorts of ways the products did not catch them (this is the usual case). And then things are tuned to max in short order :) And then you have security software running multiple rules and scans on each file any process opens. And processes open a lot of files, all the time.
It's becoming more and more difficult to write an initial access file for every single EDR and anti-virus combination out there. But if you know what you're working towards it's a breeze :)
The government, for the most part, is not an evil cabal of deep state cultists (in most countries that describe themselves as liberal today). People like you or me can join a party, and then get elected within a year or two.
What I absolutely do believe is that people elected, through what is essentially a harmless popularity contest in peace time, are the worst type of people you want to have taking decisions in a crisis. People worried about their next re-election are _not_ going to make the right decisions, apart from the fact that in peace time the electorate optimizes for populism and extremism, and the candidates are sometimes more like actors than leaders. In short: they are incompetent, heavy handed and not even remotely equipped to deal withe massive leverage attached to the levers they control.
1) Initially, when a new technology is discovered and leads to a paradigm shift, commercial/capitalist ventures are most efficient at digging down and innovating quickest. A depth first search if you will: relentlessly driving down costs, improving the technology and consuming or destroying the competition. Then, once the time is right, the exploitation begins. No longer are the newest models of $TECHNOLOGY strictly better than their predecessors, any progress is incremental and genuine innovation is partially co-opted by marketing.
When this happens the screws start getting tightened. Companies used to rapid growth due to merit try to maintain growth velocity by cutting cost, exploiting regulatory loopholes yet to catch up with the paradigm shift, and any other things not directly related to their new niche that the risk/reward calculators deem worth it (breaking laws, anti-patterns, etc.).
The reaction to this is two fold: 1a) governments want to stick their hand in the newly-added piece of the pie, 1b) people don't like being more and more exploited.
2) People understand when they're being screwed. Our sense of 'justness' is about as evolved as can get, people might not always be able to pinpoint what is screwing them over, but the anger still builds. I believe (really can't justify any of the things I'm claiming here as truth, it's just my opinions) that trust takes longer to build than to destroy. I loved google for 2 years, I've hated them for much longer. I feel intuitively that I'm being exploited when forced to help their machine learning algorithm detect traffic signs that only a few people will profit off. I feel like I've never entered into a fair contract where I'm obtaining search results in exchange for some of my attention; I'm just forced to fill these things out every once in a while to access a site unrelated to google. Can you believe my GP's site has a google captcha page on the contact form? Where I enter medical data? I _HATE_ that.
3) People like me (and you?) spread the word. After the initial rush described in point 1. other ways of working gain speed. Technology, organization, open source, education, they all make it easier and easier to replicate what was an enterprise deployment a decade ago as a small group, or even individual, today. One day a matrix bridge will allow me to message all my friends from a single, polished place, with good UX. One day later a friend will see me using it, and the word will spread.
The inherent nature of information favors the communicators, integrator and middle men. It's impossible for a silo to detect with certainty that you are not actually using a third party app, like a matrix bridge, to talk to your friends. A false positive will lead to more feelings as shown in point 2, a false negative is the natural result of progress in point 3.
4) Governments cannot afford a completely tech illiterate population. Security and military forces around the world have recognized for years already that information technology is another avenue to achieve their goals. Knowledge of the possibilities of information technology is a natural (but certainly not perfect) antidote to some of the ways an opponent might exploit your population. Organizations (in a liberal country) in this sphere will focus on education, partially to increase their own resilience against attack, and create a fertile recruiting ground for new recruits.
We gotta hold on till we get there.
It will take a while of it getting progressively worse before an apathetic consumer class will finally be exploited enough to start demanding proper rules around all of this. I don't think progress will stop when the situation at it's worst. But I do think we'll have to get through that first.
Each particle of dust is a tiny computer with simple sensors, near field laser beam directed stealth communication node, FOF identification sensor, and maybe more. Soldiers could plug into this network (all properly encrypted, yadayada) en see and listen to the enemy. Dust covered vehicles could be tracked as long as they stay in a well-dusted area.
The idea is not that the enemy cannot see that you've 'dusted' their country/battlefield, but that you've dropped so much of this self-organizing sensor dust that they cannot block it all.
I'm assuming that the dust could be radiation hardened against EMP or other area of effect 'cleanup' measures, and that they are powerful enough to run proper cryptographic code, to ensure proper functioning of FOF and the communications.