191–200 of 358 posts
Earlier quoted context omitted.
Product idea: internal condoms for every USB port on a business computer. Let employees charge their phones in USB ports or plug whatever in, data wires never connect - problem solved: Employees can charge their ${device} without risking security compromise of the host workstation.
Which is totally redundant because that can be done on operating system level, but hey, bottled water is a huge industry too.
Earlier quoted context omitted.
At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.
That's shocking. I know people are dopey, but 50%? I'd have guessed 20% at most.
Earlier quoted context omitted.
That's shocking. I know people are dopey, but 50%? I'd have guessed 20% at most.
Never underestimate the distribution of stupid. I worked at a hardware / software company where management distributed USB drives as a reward for something or other. The USB drives weren't even in blister packs they were just loose in plastic envelopes. I threw mine out, and wrote a complaint.
Earlier quoted context omitted.
so the spoofer distributing these devices is going to all this trouble/expense/risk in the hope there is a http downloaded exe it can corrupt, then hopes the hashing doesn't fail on that corrupt exe, and hopes the user ignores the untrusted source warning so that it can install a trojan?
If you download putty, it comes from an http link. Try it right now
Earlier quoted context omitted.
Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.
The box controls the DNS; majorwebsite.com points to any sever the attacker likes. The only defense is HSTS/certificate-pinning, for sites previously visited with that browser & device (it’s a TOFU security model). HN has HSTS, but not Reddit, or my credit union, or my local pizza place, or Kaiser Permanente, etc. etc. etc. EDIT: I believe e.g. Chrome and Firefox bake in some major certificates, which would also like…
If I had to guess, it's providing VPN endpoint/relay services to scammers (CC fraud, etc) who need actual residential IPs to buy things from. Or to use to set up accounts/sockpuppet accounts for things like automated reddit vote manipulation. It's obviously located "inside" the residential end user's router/NAT, on their wifi, so it'll have something like an openvpn or ipsec daemon on it that initiates a connection t…
Chrome Pinsets https://cs.chromium.org/chromium/src/net/http/transport_secu...
Earlier quoted context omitted.
At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.
So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution? Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard…
Conducting that test produced something tangible for whoever made the purchasing decision: It clearly illustrated a need for the services rendered, did it in a way that offered job security to management by giving them license to assert the position over their subordinates, and established a metric by which to evaluate the security company's performance which can be easily, repeatably, and predictably improved over time.
It also checked a lot of boxes that will be useful in court if they ever need to prove that they weren't negligent on privacy and security, which is a form of insurance that has real measurable value when it comes to legal claims.
Earlier quoted context omitted.
This is why I keep a large supply of "USB Condoms" (little dongles that short circuit the data, and allow charging/power only)
Product idea: internal condoms for every USB port on a business computer. Let employees charge their phones in USB ports or plug whatever in, data wires never connect - problem solved: Employees can charge their ${device} without risking security compromise of the host workstation.
So you'll have to replace all of your intentionally-broken computers with good ones, which will cost a fortune on top of all the employees' lost work time and no one will want to buy the broken computers from you so you'll have to pay to have them scrapped.
Earlier quoted context omitted.
The first comment in the thread you link to says the Raspberry Pi connects to botnets and records all network traffic.
> It records EVERY KEYSTROKE sent of the network, even SSL connection. One wonders how it does that.