141–150 of 172 posts
Earlier quoted context omitted.
Presumably if they have the number to text to, they already roughly know the geolocation for most people, through the area code.
Only in the US (or whole NANP?) Mobile numbers are non-geographic everywhere else that I know of.
Earlier quoted context omitted.
Sure, they're not working well enough by the look of it... The people are severely repressed, it's hard to imagine how much North Koreans suffer, look up Yeonmi Park's story. What we seem to do is ignore these maniacs, until it's too late or it's absolutely critical, then they hold us hostage, like Putin.
Yeonmi Park claimed that it takes months to go from one place to another, and that they'd have to push trains (!!) https://youtu.be/KK6psAnynUA (edit: another old article that points out inconsistencies in Yeonmi Park statements: https://thediplomat.com/2014/12/the-strange-tale-of-yeonmi-p... ... The JRE interview wasn't a fluke) I don't think that you can reasonably treat Yeonmi Park as a reliable witness. North Kor…
Earlier quoted context omitted.
I'm very curious how we can attribute a threat to a particular nation state, given pretty much anything in code/IP/modus operandi/etc. can be faked by one party to look like another. I went through both links and all I found was a lot of hand-wavings like > One of the top identifiers of Lazarus is their dual attack mission – money theft and espionage. This modus operandi is unique to North Korea, as other state actor…
I've posted this elsewhere, but https://www.justice.gov/opa/press-release/file/1092091/downl... This is about WannaCry, but it shows how multi-source attribution is done.
Lol
A vulnerability is a vulnerability. Why bring politics in, right in the title? It would feel much more OK if simply said in the text, that a NK hacker group is currently known for exploiting it.
Imagine it was a vulnerability being exploited by a TLA of the US of A. What would Google say? Or would they have received a gag order to not talk about it at all? But then what happens if some third-party researcher discovers the vulnerability independently and reports it? What would Google say?
Earlier quoted context omitted.
> These groups' activity has been publicly tracked as Operation Dream Job and Operation AppleJeus. Following those links yield these two documents, which both have "Attribution" sections. Presumably some of these tell-tale signs were identified in the ongoing exploitation. https://www.clearskysec.com/wp-content/uploads/2020/08/Dream... https://securelist.com/operation-applejeus/87553/#attributio...
I'm very curious how we can attribute a threat to a particular nation state, given pretty much anything in code/IP/modus operandi/etc. can be faked by one party to look like another. I went through both links and all I found was a lot of hand-wavings like > One of the top identifiers of Lazarus is their dual attack mission – money theft and espionage. This modus operandi is unique to North Korea, as other state actor…
In the real world you can't possibly fake every single code comment left in Russian as long as these comments make sense and there's enough of them. It takes a lot of effort to actually truly fake something, at certain point it becomes the same as completely doing the job itself in order to properly fake it.
Earlier quoted context omitted.
Ah, yes, I’m sure the Chrome team is entirely unfamiliar with ways to improve memory safety. Snark aside, every browser vendor is working on this, it’s just that migrating is nontrivial.
What approaches are being considered here out of interest? I’m only familiar with Firefox’s use of Rust, but haven’t heard anything about other browsers trying to use that particular approach.
Earlier quoted context omitted.
Only in the US (or whole NANP?) Mobile numbers are non-geographic everywhere else that I know of.
Well, depends. For example, Singapore's numbers are 'non-geographic' in that sense. But Singapore itself is small enough.
Landlines used to be geographic but this isn't relevant any more again new to number portability.
Does firejail or any of those similar tools offer protection from this sort of thing?
As regarding effectiveness of firejail, then it relies on Linux container protection which is quite good given that many providers use that to run untrusted code.
However, the problem with firejail or similar tools is that that try to integrate with GUI and that makes the attack surface vastly bigger. To protect against highly sophisticated attacks something like Qubes OS should be used with explicit whitelisting of domains to connect.
Earlier quoted context omitted.
What approaches are being considered here out of interest? I’m only familiar with Firefox’s use of Rust, but haven’t heard anything about other browsers trying to use that particular approach.
The edge team have talked about it a bit in the following blog posts: https://microsoftedge.github.io/edgevr/posts/Super-Duper-Sec... https://microsoftedge.github.io/edgevr/posts/Introducing-Enh...
What they've found is that JIT can be disabled in most sites with no user-visible impact.
This, combined with WebAssembly, is a game-changer in waiting for browser security.
Earlier quoted context omitted.
It does not matter because JS is not going anywhere. Whether it’s more secure or not, it’s still additional attack surface.
I believe it does Of course JS ain't gonna go anywhere now, but if popular JS frameworks started emitting WebAssembly behind the scenes, so devs could still write their JS(and C++/C#/etc) code, but it'd use WASM under the hood then that'd start process of the deprecation of JS. Which would mean that after all popular JS frameworks managed to migrate and popular sites adopted to this, then in ideal world you'd be able…
What could happen is that browsers will support wasm natively and they'll translate JS into wasm. I'm not qualified enough to judge whether it would be possible to achieve current levels of JS performance with that approach, but theoretically it could be possible. In this case only wasm security will matter.
But I did not hear about any kinds of those plans, those are just my wild speculations. So deprecating of JS is not going to happen anytime soon. Wasm will accompany JS and that's about it for the foreseeable future.