Wonderfully elegant term for exploit development from 1980: "Synthetic Programming"
Wow, a fairly serious auth bypass in Next.js, a super popular frontend framework:
If a Next.js application is performing authorization in middleware based on pathname, it was possible for this authorization to be bypassed.
Unveiling Hidden Transformers in Windows ANSI! https://worst.fit/assets/EU-24-Tsai-WorstFit-Unveiling-Hidden-Transformers-in-Windows-ANSI.pdf
Don't fix what isn't broken: https://www.tomshardware.com/desktops/indiana-bakery-still-using-commodore-64s-originally-released-in-1982-as-point-of-sale-terminals
In my professional opinion this is the best malware protected setup I have seen for years.
👋 Looking for some cool research opportunities in 2025?
We still have an open position in our 2024-2025 internships season.
Take a look and hurry up to submit, those satellites won't hack themselves
https://blog.quarkslab.com/internship-offers-for-the-2024-2025-season.html
Ed Zitron went to Amazon and bought its best-selling laptop — a $238 machine running Microsoft S, a hobbled version designed to limit what a user can do
The laptop is janky, slow, awful — and the internet it opens onto is a shitshow of upselling, slop, and con schemes, where the walled gardens are preferable mostly because they offer an illusion of order
His point: for *most* people, computing is psychologically abusive
He’s right
Read the whole thing!
Shot: US considers banning TP-Link routers over cybersecurity concerns https://securityaffairs.com/172128/uncategorized/us-considers-banning-tp-link-routers.html
Chaser: Today, NY Times Wirecutter recommends.... wait for it... TP-Link routers, writing: "we’ve spent hundreds of hours testing and evaluating more than 110 routers, and we’ve determined that the best router for wirelessly connecting your laptops, your smart devices, and anything else your daily life depends on is the TP-Link Archer AX3000 Pro." https://www.nytimes.com/wirecutter/reviews/best-wi-fi-router/
Juniper: 2024-12 Reference Advisory: Session Smart Router: Mirai malware found on systems when the default password remains unchanged
Juniper warns that customers with Juniper Session Smart Routers (SSR) are getting infected with Mirai DDoS botnet malware because they didn't change from the default password. 🤦♂️
#juniper #threatintel #cybersecurity #infosec #mirai #botnet #securitybestpractice
What do you think, AI slop or not? It's not always easy to tell...
Petition to flood GitHub with AI-generated code to trigger model collapse.
Hi Mastodon hivemind, a friend has a Gemmacert device and the company behind it has gone bankrupt. He's wondering whether someone has already reverse engineered it, so he can continue to use his expensive machine to measure how potent his weed is
New attack on x86 secure enclaves, specifically AMD SEV this time. SEV is AMD's answer to Intel TDXs.
Basically tricking the CPU into thinking the DRAM is a different size, causing physical address aliasing, which can then be exploited
"Your GitHub account now includes free use of GitHub Copilot"
LOL get fucked
Why do iOS apps update so much. “Bug fixes and improvements.” You’ve said that every week for eight years. I’m impressed by the commitment honestly but what are you DOING in there
Biden has just pardoned the entire executive team behind the Windows 11 out of box experience.