Posts by Robin Bradshaw

HP investigating BIOS updates that leave premium laptop users in boot loop limbo

Secure boot doesn't check the date of certificates so won't fail if you change the date (that was apple iphones)

Re: "Purported"

UEFI is way better than the old BIOS images, for starters its signed and has boot attestation with a TPM.

Old BIOS based machines didnt even used to have signed images so you could do stupid stuff like patch it to add a SLIC table so you didnt have to pay for windows 7

Or patch the computrace anti theft option rom rom to animate nyan cat pre boot https://www.youtube.com/watch?v=1uQ0qEsXL5c

Even the early signed bios you could bypass by flashing in crisis mode which didnt check the signature.

While UEFI isnt perfect its way better than BIOS.

Taiwan cops say student's radio kit brought bullet trains to a standstill

Re: TETRA

It would be a shame if the ETSI had deliberately crippled the crypto so governments could listen in and this was now known so others can play along too.

https://www.midnightblue.nl/research/tetraburst

Government upgrades drones, deploys joystick tweakers to catch illegal dumpers

Performative Nonsense

All of the large scale illegal dumps that have made the news recently had been reported to the Enviroment Agency who then did nothing. Drones arent going to fix this as finding the dumps was never the problem.

Brussels plots open source push to pry Europe off Big Tech

Yellow star linux

They will demand you only install euro linux with its builtin client side scanning and approved key escrow communications.

DVSA's clapped-out booking system gets bot slapped as new boss rides in

I must be misunderstanding this. Why are they not requiring a named candidate that you can't change when making the booking? You can't tout a ticket if the driving licence number has to match the booking and you can't change it.

China recruiting spies in the UK with fake headhunters and ‘sites like LinkedIn’

Hypocrisy

So the same people who are wailing that "companies subject to the national intelligence law of the People’s Republic of China" may be forced to assist the Chinese government are also the people who will force UK companys to provided access. I believe we call them a Technical Capacity Notice and one was used earlier in the year to force Apple to weaken iCloud backup encryption.

I presume they will also be issuing a warning soon to the rest of the world to remove any British made products as they can't be trusted either.

Imgur yanks Brit access to memes as parent company faces fine

Reddit next

While looking at the age verification of Reddit I noticed it only forces you to verifiy your age if you are logged in. To view adult subreddits without verifying your age you can logout or open an incognito window then right click and inspect element on the mature content warning and delete the "blocking-modal" to view it. Ublock origin already has rules for this in its optional "uBlock filters – Annoyances" list.

With blocking that innefective im sure they will be next for a fine from the ICO/Ofcom and posibly blocking the UK as its easier.

UK agency makes arrest in airport cyberattack investigation

Re: What I would like to know ...

Perhaps the women are just better at it and arent getting caught so they dont appear in the statistics.

Anthropic scanning Claude chats for queries about DIY nukes for some reason

What am I going to do with all this plutonium now?

Could you contact them for a quote about how they are dealing with people abusing the chat to get advice on unicorn poaching too?

Californian man so furious about forced Windows 11 upgrade that he's suing Microsoft

Does setting the registry key HKEY_LOCAL_MACHINE\SYSTEM\Setup\MoSetup\AllowUpgradesWithUnsupportedTPMOrCPU=1 and then opening the win11 iso in explorer and running setup.exe not still work to upgrade on unsupported hardware? Im pretty sure thats how I got win11 on this unsupported dell.

Uncle Sam kills funding for CVE program. Yes, that CVE program

Does the NSA not want free vulns anymore?

Perhaps China will step up and run the CVE system then they can get access to all the good bugs first.

If they dont there is always the fulldisclosure mailing list.

Linus Torvalds affirms expulsion of Russian maintainers

Good point how's reiserFS doing these days, is it still popular?

ByteDance 'would rather' torpedo TikTok than sell it off

They will make even more money once they launch the ByteDance VPN so the colonials can still access the cool content

Fujitsu: Miscreants infected our systems with malware, may have stolen customer info

Hahahahahahahaha

Couldn't have happened to a more deserving company.

I hope they got all the executives emails so we can find out who knew what about Horizon.

UK and US lack regulation to protect space tourists from cosmic ray dangers

How did they solve this problem on the international spacestation? last year Frank Rubio spent a year in space on the ISS so if its safe for him for a year a quick jolly to the Kármán line and back should be OK

Microsoft might have just pulled support for very old PCs in Windows 11 24H2

Installation media

You can download the windows install media for free from microsoft either as an iso or they have a tool that will create a bootable USB stick for you.

Search for "Create installation media for Windows" and look for the result on microsoft.com

250 million-plus reserved IPv4 addresses could be released – but the internet isn’t built to use them

Musical chairs

Instead of trying to find more ipv4 addresses every year they should be taking them away, we could have an annual lottery style draw to see what range gets deleted that year. A few years of this and people will stop pissing about and switch to ipv6.

Raspberry Pi Pico cracks BitLocker in under a minute

Re: Missed The Edit Window Due To Work Disrupting My Shirk.

Even if you steal the TPM chip you wont be able to recreate the state of the PCR registers in another machine so it wont be able to decrypt the VMK, you'd have to steal the whole computer and then snik the key.

Use TPM and PIN the TPM enforces anti hammer so you get i think 30 attempts at the pin then it locks for an hour per guess and it wond decrypt the VMK until you get the PIN correct.

ICANN proposes creating .INTERNAL domain to do the same job as 192.168.x.x

Re: I use....

The internet isn't just english they had to allow 64 characters incase Germany started regestering TLD's

Someone might want .Rindfleischetikettierungsüberwachungsaufgabenübertragungsgesetz

Driverless cars swerve traffic tickets in California even if they break the law

Re: Driver and insurance should pay

"Enlighten me, how does one imprison a corporation?"

One executive at a time, staring at the top.

X may train its AI models on your social media posts

Project Tay 2.0

What could possibly go wrong?

After all it worked so well for Microsoft when they tried it

https://www.theregister.com/2016/03/24/microsoft_ai_goes_troll/

Microsoft pushes out PowerShell scripts to fix BitLocker bypass

Re: Data access governed by opaque TPM

What do you think a TPM actually does?

Its basically just a grumpy oracle that might or might not decrypt some data for you depending on how it feels and you can change how it feels by hashing data into its PCR registers.

For TPM only bitlocker the VMK is encrypted by the TPM and stored in the bitlocker metadata, then when the machine boots the bootloader takes the encrypted VMK from the metadata and sends it to the TPM in a message saying "Decrypt Plz?" if the TPM is in a good mood (ie the PCR registers 7 and 11 have the right value) it will decrypt this and send the VMK back (which you can sniff with a logic analyser)

Its a bit more complex for TPM+PIN as you have to send the correct pin to the TPM before it will talk to you but its not some super secret deep state control chip™

Thats pretty much it, thats all it does it either does or doesn't decrypt some data if its happy or not.

Python head hisses at looming Euro cybersecurity rules

s/code/legislation/g

Perhaps with a simple search and replace the same law they are proposing could be applied to the process of making legislation where those failing to anticipate every corner case of their legislation could be held liable for the damages.

That would, im sure, lead to the same improvements they are expecting this legislation to lead to.

US cyber spymaster calls TikTok China's 'Trojan horse'

They are going to loose their mind when they find out where their Lenovo laptops come from.

Europol warns ChatGPT already helping folks commit crimes

s/ChatGPT/Librarys/g

I can't help but feel that simply googeling for the information I want would be a quicker and more reliable way to become a criminal genius than reading half baked information regurgitated by a GPU powered T9 dictionary.

London cops break into gallery to rescue lifelike art installation

We have all been there

Many was the time when I was younger and would wake up on a Sunday morning having slept on a half eaten kebab.

I'd be really annoyed if the police had put my door in for being so drunk I slept on my food

Dell opts out of Microsoft's Pluton security for Windows

Its a silicon feature not a vendor addon

How would dell opt in to using pluton security? Start fabbing their own custom intel chips with a pluton proceesor added?

National Cyber Strategy will lead to BritChip for mobile devices by 2025, claims UK.gov

Re: new strategy is to produce "a new microprocessor design" for smartphones by 2025

I cant wait for the blazing performance of the 100MHz dual core 6805 they will come up with, perhaps they will see great sucess running the no doubt fantastic mobiles they will use for the Emergency Services Network handsets when they finally switch off airwave some time in the mid 2050's

Microsoft makes tweaks to Windows 11 Start Menu for Insiders but stops short of mimicking Windows 10

Re: Combining task bar buttons?

Do you mean how you hover over the icon in the task bar and see mini versions of all the windows pop up and you can then move the mouse over the one you want to show it on the screen and then click on it to focus? Because that works fine on windows 11

Linux 5.13 hits rc5, isn’t yet calm, Linus Torvalds is only mildly perturbed

Re: Still brickin'...

I had a very quick look and I *think* firmware-amd-graphics and firmware-brcm80211 are going to be what you need to get things to a useable state where you can then add the non-free repo and install anything else you need

Re: Still brickin'...

Debian by design doesnt support non-free drivers or firmware out of the box you have to specifically enable that and that position will never ever change as its somewhat central to debians ethos.

Its quite likely that your network chip and gfx card require firmware and/or non free driver to operate.

You might want to look into installing the appropriate nonfree firmwares or at least whatever your network interface needs, then enableing the non-free repo and installing the rest.

You can also get unnofficial install media with the nonfree drivers builtin which might be easier for you.

https://cdimage.debian.org/cdimage/unofficial/non-free/cd-including-firmware/

Oracle sues Envisage claiming unauthorized database use amid licensing crackdown

Please give generously

Larry wants a new mega yacht so its time to turn out your pockets

China says its first Mars rover Zhurong has landed on the Red Planet

Re: Quality Counts

"a drone or AI craft that just likes smashing itself into the ocean at high speed, for no particular reason."

That must be the British militarys super secret new Watchkeeper 2.0, crashing at high speed for no reason is sort of their signature move.

NHS-backed org reacted to GitHub leak disclosure with legal threats and police call, complains IT pro

Re: Sorry, Fail - Rob

Yeah how dare you *checks notes* clone a repo from github.

Dont you know everything on github is a private secret not meant to be cloned by the public.

Some of the responses are making me wonder how many people here are keeping private photos on imgur.com and are going to act all shocked pikachu when they find out everyone can see them.

Do you expect me to talk? Yes, Mr Bond, I expect you to reply: 10k Brits targeted on LinkedIn by Chinese, Russian spies

Dont let the Russians steal your shitposts

I presume the "figure of 10,000 compromise attempts over five years was a conservative one" as they didnt count all the UK's operations or the ones were we were merely tampering with a linkedin profile in transit as that doesnt count.

https://www.theregister.com/2013/11/11/gchq_used_fake_linkedin_profiles_to_access_belgian_telco/

Docking £500k commission from top SAS salesman was perfectly legal, rules judge

Doesn't this mean that their sales team are going to stop caring once a sale gets beyond ~9 million or so as they won't get any increase in comission beyond that?

So difficult to negotiate £27 million contracts will become super easy to negotiate £10 million contracts? granted possibly not quite so extreme.

What happens when back-flipping futuristic robot technology meets capitalism? Yeah, it’s warehouse work

How do they cut the shrink wrap off the pallets?

How do they move and stack the empty pallets?

And who cleans up when the bottom of the box givesway and dumps the contents on the floor?

City of London Police warn against using ‘open science’ site Sci-Hub

Re: Is Sci-Hub perhaps publishing

In fairness the CoL havent exactly covered themselves in glory running Action Fraud:

https://www.thetimes.co.uk/article/action-fraud-investigation-victims-misled-and-mocked-as-police-fail-to-investigate-wlh8c6rs6?

But then aslong as its individuals being defrauded and not one of their paymasters in the financial services industry they aren't going to care.

It only took four years and thousands of complaints but ICANN finally kills off rogue Indian domain registrar

Can we do Namecheap next?

Police drone plunged 70ft into pond after operator mashed pop-up that was actually the emergency cut-out button

Re: Touch screen emergency shut off?

Given that the whole world has been trained to click the piss off button on any popup (we use cookies/gdpr/use the app instead etc etc) that gets in the way like they were some kind of demented pigeon, so they can do what they were trying to do, even multiple clicks is not safe.

Do Thales make police drones too?

Have they added the Army's Watchkeeper lithobraking technology to police drones now?

Is this what people mean when they talk about the militarisation of the police?

UK infoseccer launches petition asking government not to backdoor encryption

Re: Breaking encryption not needed

The other way to look at it is that ISP 's are businesses and will look to monetise any asset they control so they are probably selling that data, theres a reason they started squealing about mozilla adding DoH support https://www.theregister.com/2019/07/10/ispa_clears_mozilla/

Spending Review: We spy a stray £60m – is that all you can spare to help 5G market recover from UK kicking out Huawei?

Re: But what about 2025?

Could you send the power to run this ATA over the phone lines like power over ethernet

Software engineer leaked UK missile system secrets and refused to hand cops his passwords, Old Bailey told

Secrets?

Am I the only one thinking that we will eventually find out that the only secret about the missile system is that we are getting the crippled version and paying 3x what everybody else is for the full fat model?

We're not getting back with Galileo, UK govt tells The Reg, as question marks sprout above its BS*

Re: European Union

Yet here we are doing just that

Raytheon techie who took home radar secrets gets 18 months in the clink in surprise time fraud probe twist

Re: Nope

would-be adversaries should have to buy the weapons systems to find out what they might be facing, just like everybody else, won't somebody think of the shareholders.

Far-right leader walks free from court after conviction for refusing to hand his phone passcode over to police

Re: And the moral of this story is ...

If they vast majority of police were doing the best they can the first thing they would do is rat out all the bad apples and get rid of them,

Therefore I can only assume they arent doing the best they can.

Freedom of Information coverup clerk stung for £2k after deleting council audio recording

There is muck to be raked here

I just googled this case and found an article on the whitchurch heralds website* that quoted the judge as saying:

"All parties need to take a long, hard look at themselves. I suspect if the residents of Whitchurch saw those emails, they would be deeply shocked."

Which seems to be in reference to:

"[Young] found herself the subject of criticism from some councillors, which affected her health," said Mr Hanratty. "Including 250 emails from two councillors in a short period of time.

As they seem to have been evidence in court can you FOI request the emails so the residents of Whitchurch, and us in the peanut gallery, can read them and be deeply shocked?

*https://www.whitchurchherald.co.uk/news/18312091.whitchurch-town-council-branded-toxic-clerk-fined-deleting-meeting-recording/

Criminalise British drone fliers, snarl MPs amid crackdown demands

Re: Electronic conspicuousness

I cant think of a worse outcome than creating the conditions that would result in china making tiny ADS-B transmitters, pry one out of a crashed drone, prod the electronics a bit to make it report as being several jumbo jets vaguely near the current location, strap it to a seagull and head to your nearest airport to cause havok