Posts by GarethWright.com

WhatsApp security snafu allows sneaky 'message manipulation'

Github

Here's the link you all really want...

https://github.com/romanzaikin/BurpExtension-WhatsApp-Decryption-CheckPoint

Not so private eye: Got an Axis network cam? You'll need to patch it, unless you like hackers

Re: Attack Vector

I won't say where (though it's trivial to establish with a little Google foo), but a large number of Axis cams were installed in a new build and linked to the B.M.S.

The cameras were all added to CCTV module which was compiled with hard coded credentials...which of course were default. To make matters worse the the BMS company (Massive "professional" outfit) installed the cameras and BMS on the same VLAN as the standard traffic. Anyone on the WiFi or plugging into an ethernet port (oh btw they fitted active ones in the loos) can simply load up the Axis camera management tools and discover and access every camera on the network without needing any CVEs at all.

So yeah....plenty of places with Attack Vectors, some places are worse and have them on the internet

https://www.shodan.io/search?query=AXIS

Yubico snatched my login token vulnerability to claim a $5k Google bug bounty, says bloke

Happens more than you'd think

A number of years ago I contacted Apple and Facebook regarding a security flaw whereby tokens and passwords were accessible in plists.

I didn't hear back from Apple and Facebook said it wasn't a flaw so I reported it to El Reg who published the article.

A few weeks later and a vast number of Apps on the app store has been updated to mitigate the flaw, iOS had been updated to prevent file level access and someone else wrote up the same exploit citing my work and got a bug bounty from Facebook.

I guess Facebook were just pissed off they had egg on face.

Drone-maker DJI's Go app contains naughty Javascript hot-patching framework

Security Concerns - Not rocket science.....

The military security concerns revolve around the black box SD card glued into the drones.

It stores flight logs, co-ordinates, images used for precision takeoff and landing as well as logs re: rf interference etc.

Should a drone crash or be shot down, an enemy can recover and gather valuable intel.

First-day-on-the-job dev: I accidentally nuked production database, was instantly fired

So....restore from backup

The issue is with the docs.

CTO is a knob and why is this an issue because they obviously have backups don't they....

Pluto's emitting X-rays, and NASA doesn't quite know how

Emanating?

X-Rays are not emanating from Pluto at all. Inaccuracy for the sake of a tag line

Apple must help Feds unlock San Bernardino killer's iPhone – judge

Sod the phone reset the account password and get from icloud

...simple really.

Drones are dropping drugs into prisons and the US govt just doesn't know what to do

Jam 2.4GHz RF and GPS

Just block the controller and GPS signals, that'll sort out the majority of Drones from being flown in. Simples

TalkTalk attack: Lad, 15, cuffed by UK cyber-cops

Re: Disingenuous

Noddle is really good, but yes already a free service.

How long does it take an NHS doctor to turn on a computer?

Re: Oh ha ha

So I hear.

Meditech 5 - yuuuuuuuk!

Re: And your point is?

You forget that at this point they've been running from one side of the hospital to another for 14 hours straight with no break, nothing to drink or something to eat. Shouted at, argued with, comforted a family who child has just died. Spent an hour waiting for results from one system or another to print because printers are the spawn of Satan himself. Heel pricks, jabs, bags, drips, broken limbs and then there's the larger louts and pissed up arseholes, the attempted suicides and the successful the parents who bring their kids into A&E rather then buy some feckin calpol.

I've worked in IT all my life. I've also been a carer, and I'm married to a Dr I barely ever get to see because she's constantly working 13-15 hours a day, before driving home crashing for a few hours then going back to work. Granted, she wouldn't have made the mistake of not turning a computer on, but I, sitting at home with my laptop wouldn't have blamed her if she did.

Does common sense suffer with sleep deprivation? YES! Does that make them any less professional, no.

Yet our government is trying to remove the maximum working hours and drop their pay by upto 30% and most of the British public doesn't have a clue about it.

French hacker besmuts road sign right under Les Plods' noses

OOK is not OK

Few UK ones using OOK. Trivial to change even with a cheap radio or RasPi

Though so do Remotes for Yale House Alarms

Security by obscurity...or who let these lazy bastards work here...

Can't get a woop, woop! Twitter gives politicians nice Gaffe-Delete button

Just open source the app, or create another one with a new api key...carry on

+5 ROOTKIT OF VENGEANCE defeats forces of gaming good

Re: "Fully streamed"

CSS/HL/Team Fortress/L4D are all easily hookable and hackable.

Valves Anti-Cheat is one of the most easily bypassed.

Hilton, Marriott and co want permission to JAM guests' personal Wi-Fi

Two can play at that game.

DNS tunnel out on the hotel Wifi so you don't have to pay the extortionate charges, De-auth any macs that aren't my spoofed one and set up my own Wifi network with the hotels SSID and provide the free WiFi the hotel should be providing in the first place to anyone in range.

They're playing a dangerous game which is sure to escalate quickly and frankly my Wi-Fu is better than theirs.

Need a green traffic light all the way home? Easy with insecure street signals, say researchers

Re: All Sorts of Problems

Some very prevalent brands of temporary traffic lights in the UK use the same basic OOK now that those particular sets of lights in Sheffield used in the 1980s.

As such they don't care if it's AM/FM etc so long as the carrier wave is at about the right frequency. I wouldn't be surprised if it was just the presence of a cw that triggered the lights as you'd have to be pretty fluky to nail the OOK sequence.