81–90 of 97 posts
Those attacks would not work if they did not enable JavaScript on every website by default.
Interesting to me that the attackers were well equipped in their phish and 0days, but then opted to drop fairly detectable RATs.
This point to an actual use of the cryptocurrency - exploiting a 0 day against someone who might have a crypto wallet means you can actually directly make money off exploits. Prior to crypto, having a 0 day wasn't equal with ability to make blackhat money with it...
> This point to an actual use of the cryptocurrency - exploiting a 0 day against someone who might have a crypto wallet means you can actually directly make money off exploits. Prior to crypto, having a 0 day wasn't equal with ability to make blackhat money with it... Why would that be the case when it is not illegal to sell exploits?
Earlier quoted context omitted.
That doesn't explain listing Bitcoin Cash (Bcash) - an altcoin that shares its mining algorithm with Bitcoin but only has a very small amount of hash rate backing it. Any small Bitcoin miner can decide at any moment to switch to mining Bitcoin Cash and cause block reorgs or mine blocks with no transactions at all. A similar event actually happened with another asset they offer - Ethereum Classic. https://cointelegrap…
The infrastructure to carry out that attack against BCH would cost around a billion dollars in mining equipment and power. Not exactly what you would call a small miner. BCH also has rolling 10 block checkpoints so max you could reorg would be 10 blocks or In reality there is nowhere you could rent this hashpower and miners that do have it would never risk the legal, social and monetary consequences to rollback 2 hou…
Earlier quoted context omitted.
Banking malware has existed for a while.
Banking has insurance against fraud and transactions are generally reversible.
Not really. If your account is compromised you may indeed get your money back from the bank's insurance (although in some countries that is less likely than others). However, the criminal behind the malware will probably have got at least some of the money.
International transfers are not generally reversible. Cash withdrawals are not reversible. Even electronic transfers to another bank in the same country (maybe this varies by country) are only reversible if the money has not been withdrawn.
And then there have been cases of actual bank systems being compromised so that criminals can just increase the balance of accounts directly.. And cashpoints (atms) being compromised.
Interesting to me that the attackers were well equipped in their phish and 0days, but then opted to drop fairly detectable RATs.
Those attacks would not work if they did not enable JavaScript on every website by default.
I see my colleague making a web app that forces the browser into 100% CPU on scroll, just to animate a shrinking nav bar. Also a page that wont settle in for 15 seconds until assets from Google Fonts downloaded and all scripts have run. So I secretly pray for a draconian anti-js order imposed on us, even though my minimal Vue scripts will go away.
By default, browsers should throttle websites. Throttle their CPU and their ram usage, and websites can then ask for permission to be unthrottled.
We have very capable computers now. But the web feels just as slow. Some negative pressure against bloat is sorely sorely needed.
Earlier quoted context omitted.
Breaking out of a docker container with default settings is hard. You would be making the headlines if you could do so. Now breaking out of a docker container with --privileged or even just CAP_SYS_ADMIN is much easier.
There was a CVE in February [0][1] that escaped out of Docker's default settings. runc has a few of these over the last few years, it isn't inconceivable that there are more to be found. Docker does do a decent job of setting some sensible defaults - but it isn't a security sandbox and they don't market it as such. [0] https://blog.dragonsector.pl/2019/02/cve-2019-5736-escape-fr... [1] https://seclists.org/oss-sec/20…
Earlier quoted context omitted.
I have never even heard of an internal site-wide pentest that failed.
I'm guessing Coinbase hiring a pentester and giving them 'employee level access' would be a needless formality?
Earlier quoted context omitted.
I'm guessing Coinbase hiring a pentester and giving them 'employee level access' would be a needless formality?
People do internal pentests even though everyone knows the pentesters will win; you still learn something from the experience.