@whitequark undeniably true. I'd also add that these attacks, while pretty niche, do attract the attention to a platform which was previously deemed "unbreakable".

In many ways this is similar to how work by people in the 90s (TESO, for example) drew my attention to µcode and John Heasman's work on ACPI to NIC firmware. Now look at the µcode panorama where you have an attack a day or firmware where there's an attack an hour (OK, sort of)

Nothing like breaking a myth.

I’ll reiterate what many others have said about the yubikey story - unless you’re the target of super sophisticated actors who do not want you to know they’ve stolen your yubikey*, this is a bit of a non-event and highlights the importance of keeping track of your yubikeys. Please don’t toss them, but do keep an eye out for further developments. Once an issue like this is identified, it attracts a lot of attention from many smart people and there may will be other findings in the future, but for now, yubikeys are good enough for most of us.

* I know there are a bunch of people convinced you’re being pursued by these advanced adversaries. I worry about you. For many reasons.

Tired of using debuggers and manually exploring the program's state space? Too annoying to find the inputs you need to trigger the bug? Ever wanted to interactively see what your static analysis tool was really thinking?

With my collaborators from the University of Tartu (Karoliine Holter, Juhan-Oskar Hennoste, Simmo Saan, Vesal Vojdani), we have an Onward! paper about abstract debugging, where you can "step through" the abstract state of the program, as computed by a static analysis tool.

To appear at Onward! 2024: "Abstract Debuggers: Exploring Program Behaviors Using Static Analysis Results".

https://patricklam.ca/papers/24.onward.abs-debug.pdf

And a special thanks to the SIGPLAN-M mentoring program for matching me with these collaborators!

Hello, Fediverse! We're Kagi, and we're on a mission to create a friendlier, more human-centric internet that has the users' best interest in mind.

Our core product is a search engine that is ad-free, tracking-free, and fully supported by our users. We've worked hard to deliver a high-quality, fast, and reliable search experience without compromising user privacy: https://kagi.com/

Excited to engage with the community here.

#Search #Privacy #AdFree

s/middleware/dark matter/

@lethalbit C->Pascal transpiler!

Absolute funniest TikTok trend in history went down this weekend. Someone posted about this “ATM glitch” they found. They went on to explained that you can deposit checks into ATMs and some of the money becomes available for withdrawal immediately, so you can write fake checks, deposit them, then withdraw the money before the check clears.

They made it sound like some kind of life hack and I guess most of TikTok is too young to know what check fraud is, so they had like hundreds of people uploading videos of themselves writing and depositing fraudulent checks into their own bank accounts tied to their real identities 💀

@mttaggart @Viss @siliconshecky people really have zero clue even after all this time how to layer and scale security solutions based on legitimate risks of threats. Susan in accounting might need a little more security than Joe in the mail room, but they dont need the full paranoid hardware token suite that the security / domain admins need. It blows my mind that "security professionals" cannot assess these risks and scale appropriately. Perfection is the enemy of good, and this industry is still tripping over its own feet....

@circuit_cat @capnhoppy "whoa! what instance do you live in?" this happens when you navigate away from your instance, typically in a webview e.g. by clicking a quoted post. in that case you navigate to another instance that has 0 info about your session or your home instance so it'll try to redirect you.

@soatok @duxsco @filippo @mbmcloughlin The flaw was fixed in firmware 5.7, which is also the firmware that added Ed25519 support to PIV. So the mitigation for vulnerable YubiKeys can't be Ed25519 for the PIV applet as it doesn't exist there.

Between that and explaining the difference between ECC and ECDSA to users, I'm not surprised they just say "use RSA".

Saying the quiet part out loud

https://futurism.com/the-byte/openai-copyrighted-material-parliament

@jon "would not provide AI systems that meet the needs of today's citizens" someone should tell these fuckers that literally no one asked for stochastic parrots, ever.

The YubiKey 5, the most widely used hardware token for two-factor authentication based on the FIDO standard, contains a cryptographic flaw that makes the finger-size device vulnerable to cloning when an attacker gains brief physical access to it, researchers said Tuesday.

The cryptographic flaw, known as a side channel, resides in a small microcontroller that’s used in a vast number of other authentication devices, including smartcards used in banking, electronic passports, and the accessing of secure areas. While the researchers have confirmed all YubiKey 5 series models can be cloned, they haven’t tested other devices using the microcontroller, which is SLE78 made by Infineon and successor microcontrollers known as the Infineon Optiga Trust M and the Infineon Optiga TPM. The researchers suspect that any device using any of these three microcontrollers and the Infineon cryptographic library contains the same vulnerability.

https://arstechnica.com/security/2024/09/yubikeys-are-vulnerable-to-cloning-attacks-thanks-to-newly-discovered-side-channel/

@dcoderlt Reminded me of this project: https://github.com/astrelsky/Ghidra-Cpp-Class-Analyzer - it seems I have to look into recent advances in C++ class analysis in #Ghidra...

fuck yeah, another ghidra feature that I could never find in IDA 😎

You can make a typedef for an offset pointer, as in, “this is a pointer to offset 0x4 within a FooClass object”. And then the decompiler sees code like `SUB dword ptr [ESP + 0x8], 4` and figures out “ah, this turns it into a normal FooClass*” and makes things readable. Quite nice for inspecting C++ inheritance forests.

@LinuxAndYarn @zackwhittaker if i was elon musk rich, i'd never have let thinkgeek go away

This is a real story. https://www.nytimes.com/2024/09/03/us/politics/trump-prank-devices.html

Security Week: CISA Warns of Avtech Camera Vulnerability Exploited in Wild
In yesterday's CISA ICS Advisory AVTECH IP Camera, CISA includes the following verbiage:

ATTENTION: Exploitable remotely/low attack complexity/public exploits are available/known public exploitation

Additionally, "An anonymous third-party organization confirmed Akamai's report and identified specific affected products and firmware versions." AVTECH SECURITY Corporation has not responded to requests to work with CISA to mitigate these vulnerabilities.

So there you have it CVE-2024-7029 (8.8 high) command injection vulnerability is likely an unpatched and exploited zero-day.

#CVE_2024_7029 #activeexploitation #zeroday #vulnerability #cve #avtech #cisa

A couple notes about the Infineon timing side channel affecting most YubiKeys.

1. yubikey-agent is unaffected in the evil maid threat model as the attacker needs physical access *and PIN*

2. lol, Infineon

3. Go mitigates timing side-channels in ECDSA nonce inversion by not being clever and just using Fermat's little theorem, which is as simple as a constant time exponentiation by p - 2 (which can be optimized with @mbmcloughlin's addchain)

https://ninjalab.io/eucleak/
https://www.yubico.com/support/security-advisories/ysa-2024-03/

@jerry computers are weird... thanks again!