Posts by Outer mongolian custard monster from outer space (honest)

Loose .zips sink chips: How poisoned archives can hack your computer

*Sigh*, I tested this as soon as THN broke it on twitter, its just for libraries.

Untarring and unzipping as root is dumb (I did it on a throwaway vm so you don't have to...) but linux command line zip and tar are both patched in the shell anyway, since the 1990's for tar and somewhere around 2006 for zip. I didn't even bother testing the other variants. It really is the old 2006 path recursive attack that some libraries were never fixed for still in use, except it has a logo, and people running round twitter trying to make a "name" for themselves in the security community to get hired.

root@testbox:/home/testuser/zip-slip-vulnerability/archives# tar -xvf zip-slip.tar

good.txt

tar: Removing leading `../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../' from member names

tar: ../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../tmp/evil.txt: Member name contains '..'

tar: Exiting with failure status due to previous errors

root@testbox:/home/testuser/zip-slip-vulnerability/archives# ls -la *evil*

ls: cannot access '*evil*': No such file or directory

root@testbox:/home/testuser/zip-slip-vulnerability/archives#

root@testbox:/home/testuser/zip-slip-vulnerability/archives# unzip zip-slip.zip

Archive: zip-slip.zip

extracting: good.txt

warning: skipped "../" path component(s) in ../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../../tmp/evil.txt

extracting: tmp/evil.txt

root@testbox:/home/testuser/zip-slip-vulnerability/archives# ls -lR tmp

tmp:

total 4

-rw-r--r-- 1 root root 20 Apr 15 22:04 evil.txt

root@testbox:/home/testuser/zip-slip-vulnerability/archives#

Advanced VPNFilter malware menacing routers worldwide

Update time el reg?

https://www.thedailybeast.com/exclusive-fbi-seizes-control-of-russian-botnet

Seriously, Cisco? Another hard-coded password? Sheesh

cve-2018-0222 "because in this day and age, no serious enterprise class vendor still hard codes credentials and embeds secret hidden accounts in firmware" - as said by some clueless middle manager commentard, whilst belittling my experience for even suggesting it still happens.

Time to ditch the front door key? Nest's new wireless smart lock is surprisingly convenient

Chris, you know your mac address is a software config right? You want to base your home security and not letting in strangers on the basis that they also don't know this fact?

Intel admits a load of its CPUs have Spectre v2 flaw that can't be fixed

I use the 6600 as a vm host using vmware/virtual box and use a completely different machine for browsing with a kvm for when doing research, as er, it can end up in some less salubrious places quite often so that's even more critical to stay on top of & I'll have to uplift that because its running a ivybridge 2127U but that's not a big loss, any cheap box will do for that, its just a glorified web browser + vpn client host. I'm still a bit annoyed that the 6600 needs isolating and its instances not allowed to route out as a fix though as to upgrade to something more modern but capable takes what I consider a not insignificant* sum of money.

But, yeah, hands up, I'm being super grouchy, I have to make some investment in new kit because of someone else's mess. I know the nuances and I'm just going to have to suck it up and pass this cost onto my clients. But when it comes to SME's, you try telling 9/10ths of the world they need to landfill their devices because there's a unpatched flaw in the cpu they use on the machine and they absolutely must be able to use facebook and twitter while at their desk. And are all the affected machines going to go to landfill or end up in corporate disposal for the next decade?

I personally think intel should have ate the extra dev + test costs as a goodwill gesture and supported the mess they made, rather than apparently trying to turn it into a profit op to drive new cpu purchases to replace the ones they already sold you. Even if they prioritized the newer arches first it would have kept more options open longer term. At the end of the day, they made this mess with their product, washing their hands isn't going to take all of the compromised product out of the second user ecosystem for years.

*i.e. its mine and I've got short arms and deep pockets

I'm hoping they were asking how many vulnerabilities do I develop per day. Sorry, I don't have a metric for that you can put in a spreadsheet to decide how to crank the hamster wheel HR want to put all our staff* on.

Latest shiny is for all those cool kids who game on their pc's isn't it? for computational loads it copes rather well.

If you meant how out of date is it? I'm assuming from the idiocy you are a PHB, but the packages were updated last night by cron if that helps.

There's security – then there's barbed wire-laced pains in the arse

Shhh Sonia, stop making sense. The management lynch mobs will be along for you shortly :-)

Europe dumps 300,000 UK-owned .EU domains into the Brexit bin

Re: Plenty of venom still

MonkeyCee, upvoted also. Summarises the situation precisely for me also.

I come on here, comment on security stuff because that's my speciality, yet when the words "brexit" or it seems a article by Kieran arrives, there's this big flood of new usernames and anon posters. And the usual names who only ever comment on brexit stuff (Phil O, Leadswinger etc).

I should just not bother reading anything brexit related on el reg, which Ive decided to do hereon (though I'm going to hit submit for one last time). Easier to just move on I guess, and thats my entire attitude to brexit now, when they accept my citizenship application that puts me beyond expecting some politicians to do the right thing I'll be able to do that.

Cambridge Analytica seeks data protection assistant

I showed this to my wife, and she said immediately "oh there you go, you like a challenge, you should apply". Thats why I love her, she's such a subtle troll at times :-)

One does presume it comes with a entire fireproof bodysuit and a liking for being pursued by angry mobs however. Perhaps they should rejig the title, "wanted, snowball juggler for important mission navigating hell".

Fake news is fake data, 'which makes it our problem', info-slurpers told

So, I interviewed for a role answering to the c-suite's at a data processing company recently who held masses of 3rd parties customer confidential data in a cloud env to process it, and the overwhelming thing I came away with about the entire company from the various interviews is that they don't give a rats ass about the data itself or if they have a corporate trustworthy stance, and their entire focus all about protecting their ip algo from walking out the doors because they trust none of their minimum wage coders and data scientists. No I didn't take the role.

So to distil the recommendations down to plain speak, be trustworthy = write nice words on the website and pretend to care so that people will keep giving them not fake data because it ruins their business model. Not unlike Facebook are currently desperately trying to do.

Me? I have a fb account. Perhaps more than one. Happily peeing in the well to poison their data sets while at the same time maintaining placeholder accounts to stop someone else spaffing things on my behalf.

Sigh. Cisco security kit has Java deserialisation bug and a default password SNAFU

Re: In 2018?

But Jack, in 2018 its preposterous to imagine a professional vendor doing this* and you must be an idiot to suggest otherwise.

*Source some middle managers pretending to be technical on El Reg's forums.

UK.gov cooks up code of conduct to enforce a smidge of security on Internet of S**t kit

Re: No password reset

No, that implies that THAT device has a unique password.

So if you push the "oh poo make everything default button", it should revert its firmware to that unique password stored somewhere as a backup.

Perhaps we could then retain access to that backup with something high tech, like having it printed on the case somewhere out of sight requiring physical access and interaction to view should we loose it?

Also strikes me that install of the backup recovery firmware defaulting to a generic could be acceptable as long as thats not the out of the box firmware applied.

The bit I do not agree with is that all devices should update automatically as a mandatory thing. No, I don't want to give manufacturers carte blanche to push new unwanted features at me and delete functionality they decide was a bit too generous in future. I'm ok if its a feature I can disable deliberately knowing this however.

CryptoLurker hacker crew skulk about like cyberspies, earn $$$

Re: "If the user tries to stop the process, the computer system reboots."

Please dont wish that onto linux Pascal. We need windows as a buffer zone against average idiocy.

Some might say that process of improving the user experience at the expense of unixifcation has already started of late...

10 PRINT "ZX81 at 37" 20 GOTO 10

Re: I still use mine

"

I still use mine

It's in the loft, controlling my central heating. Needs to be started up again whenever there's a power outage but other than that, it's been fine for over thirty years (so far).

"

You sir win the internets. And to think I still feel guilty when I go to my old house and see the underfloor heating controller running on a pentium 90 powered toshiba laptop with a broken screen, running some years out of date version of redhat linux (hedwig I think was the last time it got upgraded, relax its now totally airgapped for some years now, although at one point it was the NAT and fax gateway for the house via a modem at the same time :p ). When I power it up and hear that brick being dragged round on a slate roof from the tiny hard disk and marvel that apache still manages to come up clean and present a working gui, until that bit works parts of my nether anatomy tighten slightly while I worry if I can rebuild it and redeploy all the source to something newer assuming I can find something with the right hardware ports to interface to my homemade controller while wondering if its finally time I swapped it for a atmel based pic system I made a few years back as contingency.

I bet you have a couple of spare zx81's stashed as DR too...

I had one, well a couple after accidents with shorts and electrical issues, 1k at first, then the infamous sinclair ram pack. Cured wobbly ram pack crashes by gluing zx81 and rampack solidly to a formica board, end of crashes.

Also decided to get a bit experimental, built my own full size keyboard from a recycled industrial keyboard from the "Computer Junk Shop" in wallasey (magic emporium) which at the time was jammed full of weird stuff and PETS and decomissioned mini's amongst other wonders and learnt about keyboard matrix's etc. Also added a extra chip piggybacked on the char rom, and this meant that the ascii charset got shunted into ram and could be edited for customisable graphics!

Also remember the wonderful "Buzz" organ, which drew bands onto a CRT tv causing it to hum loudly with the abuse. Different keys produced different band frequencies, which caused different tones of hum, voila a organ on a machine with no sound hardware.

For tapes we found a certain brand of small tape deck was perfectly matched, and I still have one today (it was a sharp, I'd have to go dig it out as my zx81 today is a display cabinet thing rather than in actual use, and its original not sprouting hook up wire out of every melted in hole in its casing like my real one was)

Did the writing stuff in z80, then encoding it into hex, then ascii, and storing it as a load of REM statements and jmp into it to run like another poster above. Tedious but fun to learn and do. It was just what you did back in those days wasn't it? I think it was fantastic and I really pity a youngster of today trying to try and understand the innards of a x64 apu based black box system to the same level we were able to read and understand that simple little 8 bitter. I showed my son zx81 basic and helped him write the classic hello world goto 10 3 liner in it on the actual computer and he got it straight away, so still some value in simplicity.

Also have the cushions in my gamesroom with mazogs on them, ascii graphics being perfectly suited to replication in patchwork designs, also in tiling, although the floor has a giant space invader tiled in, as my wife said mazogs would be a bit too obscure if we ever sold the house :D

Nostalgia, still, glad time and performance has moved on, and the original keyboard is still bloody awful even today.

Apple 'wellness' unit launched for staff: The genius will see you now

Actually rather astute move, I know its traditional to hate apple but, think. What does sickness and absenteeism cost companies?

I worked a contract where they had regular deliveries of "free*" fruit, because they found it reduced the sickness and time off problem, increasing productivity. Same place also had drinks machines on free vend. I asked why, and was told because the cost of a can of coke was less than the time downtime cost for some crucial dev to wander down the street, cross the road to the newsagents and buy their own.

Great working environment too, often found myself working on something until 10pm or later to get something done to help hit the team deadlines (paid by hourly rate, so don't cry for me too much). We actually appreciated the cold callous social tuning efforts. My wife calls it my unicorn contract, in that its one I'd go back for if they still existed in the same form today**, and nobody else measures up to.

*free as in paid for by the company

** they were bought out by a larger competitor who they were taking market share from, and the new overlords put a stop to all that caring nonsense and offshored most of the work

Data science before algorithms, declares Bosch's new top techie

In this thread, a surprisingly depressing sight. AManFromMars making more sense than some new talking head making a PR release.

FIrst thoughts on reading the statement, "and this guy wants me to share road space with products designed by people he's given this advice to???"

Who wanted a future in which AI can copy your voice and say things you never uttered? Who?!

page 3, did I miss the post where someone commented that it was a good job half of society is installing automated remote upload recording devices* into their homes to generate content for this "service"?

Ties in really nicely doesn't it.

* Alexa, google home etc.

Dell EMC squashes pair of VMAX virtual appliance bugs

Re-reads comments on :-

https://forums.theregister.co.uk/forum/1/2018/01/12/storage_area_networks_patches_spectre_meltdown_bugs/

*says nothing*.

Should SANs be patched to fix the Spectre and Meltdown bugs? Er ... yes and no

Re: Safe enough - IF no third party code

"If there is a "secret" engineering backdoor then this is a much significnat problem than spectre or meltdown."

Go down and watch the team commissioning all your new hardware, discreetly shoulder surf them, if it has in life failure, see how the vendor's engineer recovers it. It can be very very enlightening.

These are our industries dirty secrets tucked away and not spoken of openly much because they make the life of people running the hardware easier on a day to day basis. Trot out the DC and pull that chassis and recover it back to base as per official procedure to get it back vs get a coffee sit at your desk and use the "shortcut" to make life easier. I know what the majority of (human) people would do.

People leave teams, move companies, talk to other people inappropriately occasionally, find things independently when they shouldn't and other shenanigans. Yes its been our role if its discovered to have that removed or controlled when it becomes known but then you are into asking for vendor fixes for issues on a black box appliance. Are you suggesting this simply does not happen?

Its a much broader topic I agree, but its why I have difficulties taking at face values any statements from PR releases that something is a black box system therefore does not require any attention to the insides. Ever.

Last post in this thread.

Re: Safe enough - IF no third party code

This is the classic "its ok to bake secret recovery/engineering/legal intercept accounts into things" fallacy.

All I know is if I find it (and they don't fess up and tell me about these things beforehand usually), its there, so could others, I wasn't blessed with super powers or the ability to do things other clever people could not do given sufficient commitment or the right combination of circumstances...

Re: Safe enough - IF no third party code

In the murky commercial world, that is a over simplistic view of what the situation is however. I know of several SAN products that do not officially offer any way to get execution on them, but find the "secret" engineering backdoor, and you are in.

Do you implicitly trust the fox with the henhouse in this case?

Some of the responses are true, they're x86 but not all Linux underneath. Netapp for one was originally a fork of a *bsd (as anyone who's played with the 22/7 menu will be aware). A tool reported security issues in a Netapp Filer during testing although I couldn't reproduce the attack manually, due diligence process meant it had to be raised as a incident and after some work with NetApp themselves, the tool was found to be misidentifying the version of the daemon (relying on simple version string), and code analysis shown they fixed the vulnerable code in their library but didn't bump the version string up, so to a dumb analysis tool, it looked like it was open to the world to attack.

For the others, that's quite common, "its like a washing machine, blackbox system" ergo, they do not feel they have to fix the mess inside. Which is acceptable in some quarters, unless there really is no vectors that they haven't taken into consideration or are hiding for business reasons.

WD My Cloud NAS devices have hard-wired backdoor

Re: Down with this sort of thing...

Code review? insert jaundiced cackle...

What like these, reviewed by el reg some time back with no consideration of security or how it might be a pwn point for your entire network by the reviewer...

https://forums.theregister.co.uk/forum/1/2017/09/26/my_cloud_home_review/

Interesting user name choice. :-

"Noun 1. briony - a vine of the genus Bryonia having large leaves and small flowers and yielding acrid juice with emetic and purgative properties

WDC's My Cloud Home Duo is a natty piece of kit but beware iContent

It seems not , neither did everyone else.

https://thehackernews.com/2018/01/western-digital-mycloud.html

Interesting review from a strictly home consumer point of view, but this is el reg not which magazine so I bet the first burning question might go along the lines of :-

What security testing has it undergone to make sure its not tomorrows pwn point in your local subnet?

Did I miss this in the review somewhere?

Russia could chop vital undersea web cables, warns Brit military chief

This isnt a new threat, I remember having this discussion and the possibility of intercept/monitoring on the repeaters with collegues. There's alarming systems and other devices of course but to be fair, dragging a ships anchor through one "accidentally" would be rather little green man style of operations.

However timing of this in reality makes It fit being a military budget inducing narrative to suddenly care and acknowledge it publically.

It would cause economic chaos and have all sorts of not immediately obvious side effects, which even someone as insular and bubble inhabiting as Ledswinger would be heavily affected by.

Hey, we've toned down the 'destroying society' shtick, Facebook insists

Re: facebook eventually imploding.

RE el reg as social media. Apparently only if you use your actual name :-)

If anyone is curious, my current username stems from demonstrating to a co-worker who insisted that el reg usernames were all genuine and vetted that he knew even less about user validation than he did about network security.

Tired of despairing of Trump and Brexit? Why not despair about YouTube stars instead?

Re: WTF is wrong with this world?

But Kiwi, this is exactly the issue. A few years ago, there would be a small thread in a forum or on a wiki etc, and you'd view it, and there'd be some photo's showing you what a good valve seat looks like, what a bad one is, how to check if a valve is pocketed, another couple of shots showing pencil marks or however your tracking contact on the seats and the process, maybe a bit about making a lapping tool so it gave the correct reciprocating motion, or at least where to get one of the nasty plastic versions that last a few heads.

It was dead easy to grasp, because it was clear, concise and well, you could see.

Now, hardly anyone bothers to make pages like that, if I make up a static page detailing how I built something, there's immediately some dick saying "where's the youtube of it?" because they want spoon feeding or maybe they just fancy spaffing half a hour of their life away.

When in reality, what they were being given before was the pure information, and the chance to step up and learn a little, which when your doing simple stuff like lapping in a valve, will lead you to develop critical thinking, a eye for things and the ability to think a bit.

Throw into that mix that a staggering amount of yt engineering has massive glaring errors (look at the amount of yt "honing" videos using ball hones to try and correct out of round cylinders because the person doesn't know better) and you have the perfect crap storm forming. I realized that a few years ago when I watched some guy trying to turn his pistons for his engine undersize to fit a different block. Not only did he attempt it on a mini lathe (and fair play, you can turn out good work on even a mini lathe) but then he used a 3 jaw to chuck it in, and didnt dial the piston in. Even if he'd dialed it in correct, pistons are oval anyway to allow fo expansion around skirt near the pin bosses. The guy had thousands of likes on his video, and people posting up "oh great, I'll that too", but when I tried to mention the above was called all sorts.

so tl,dr; none of its curated, and its riddled with drivel, so you might pull off a complex job you couldnt tackle before, or you might fubar it up.

This is not a pop at people learning stuff. Everyone starts somewhere and not being a simple consumer is to be lauded. I just despair a bit at big content moneytising the niche stuff and turning it to shit with their policies.

I still watch yt, but for entertainment shows (roadkill etc). Yeah its just like switching on a tv, I know its going to be mindless scripted drivel but eyes wide open on that.

Sod clickbait gamers appealing to the masses, what I really hate is all the people who now view it as a legitimate way to make money.

Suddenly what was a couple of years back a few posts on a forum that took 2 minutes to read and view a few static pictures which explained what the widget or special thing was about so you could reuse the idea and it was shared just because people had a common altriustic desire to share, is now elbowed aside for 30 minute rambling videos, pumped at every single site that might possibly be interested, and riddled with mistakes, where they get their friends to shrill how good it is because they used a expensive webcam, or a quality mic, while whatever they made is spinning on "precision" ebay "abec" bearings with a noticable wobble. Its turning the enthusiast sites outside the mainstream ad supported universe to shit slowly.

If it involves me even having to go to youtube to get the gist of what someone is trying to convey I don't have anything to do with it on principle, and I am pretty sure I am not alone in this backlash.

If I didnt need to film a youtube vid to build my own 5 axis cnc milling machine, or repair then program my wire edm after it had been written off economically by the previous owner, you dont need to film a 30 minute spam-athon to explain how you put a bearing on something so it could spin.

US intelligence blabs classified Linux VM to world via leaky S3 silo

Forget for a moment it being on a unsecured bucket. Why is such material even in the cloud on a 3rd party hosting resource?

The rules are, once its uploaded somewhere outside your ownership and direct control, you have lost control. Simple as.

This fail cant be fixed by clickying a few flags on the container, only obscured a little.

Exim-ergency! Unix mailer has RCE, DoS vulnerabilities

If your here wasting time wondering about percentages of mta in use, why not just go and do the workaround pushing it through your internal QA processes as quickly as possible, and then patch it in a few days when its patched instead.

RCE in a MTA is a classic way in, if anyone has been eyeing up your org as a juicy target, they might just have been waiting for this day for opportunity to knock. Best close that window asap.

This post from the done_the_workaround_already dept of the obvious...

Think the US is alone? 18 countries had their elections hacked last year

They did their best with Le Pen believe me (I work in network security and reside in France). There was a massive leak during the purdue prior to voting smearing macron and others with real emails chopped with fake ones, and all sorts of other stuff going on via twitter etc. Most of the twitter stuff however was in either english or very bad google translate french and the leak was widely seen but read with caveats due to the obviousness of its timing, so it missed the mark significantly.

And happily as a result, Le pencil brain got battered in the polls.

Thousand-dollar iPhone X's Face ID wrecked by '$150 3D-printed mask'

Interestingly nobody seems to have wondered if the mask itself is unique to the user being unlocked, or you can use the generic printed human shaped mask and just glue new bits of photo onto it for each case. In which case, productionized unlock, photo, print, done.

Makes it more serious of a issue. Especially when cheap "costume masks" start coming onto alibaba moulded off some generic face by a enterprising company with a vacumn former at pence apiece.

My wife's always on at me why I use a pin when I have face unlock on my samsung. But then she's also bemoning the fact we wont ever have a alexa or a google mini in our house.

Automatic for the people: Telcos forced to pay for giving you crap services

Once upon a time I was owed a tidy sum by BT under work not being delivered compensation, when it took them 7 months to provision a line that I had been committed to getting within 30 days back in the modem days, because they had ran out of pole capacity locally and oversold it. At one point they split a sold as a modem line with a dac's unit to give me two useless lines, until I made them remove it.

All the way through the months the standard line to fob me off was dont worry, you will get compensation. Until it was due, and by which time It had amassed up to 800 quid in compensation fees. The nice lady dealing with me told me that was too much and breached some department limit and they were only permitted to award up to 250 quid. I threatened them with the ombudsman and all sorts, but in the end settled for 450 pound after a few more months which they made "as a gesture of good faith, as we had already provided you with a solution" (the dacs), all of which was swallowed by call charges in the first quarterly bill (it was a modem line to my office... people forget how much we paid for basic connectivity back then). I did enquire during the process if what I owned them was subject to departmental hard limits with a grin on my face and was brushed away.

So, I'll believe it when I see reports of the actual agreed figures being honored on time...

Metal 3D printing at 100 times the speed and a twentieth of the cost

Re: Problems to overcome

This, lets see metal lab reports on samples showing the yield points and microscopic grain structure of the dendrites before we get too excited with how its going to sweep traditional machining away. How those dendrites form as the metal recrystalizes makes a massive difference to the final material properties.

Some parts do not require known qualities in these aspects and will be suited to it, but there's also the risk of people applying the "if all you have is a hammer, every problem is a nail" ethos expecting it to replace every other tool in the workshop, and there are things which rely on these material properties to not fail in service.

Another feather to your cap to have around, to complement a rapid proto shop, if it lives up to the hype.

Leaky-by-design location services show outsourced security won't ever work

No, not in my job description to crusade to fix universal stupid.

Im pretty sure most of the exif data on my photo's are from a location called "Created with GIMP".

I use my phone to take snaps, but I store them offline in my own private location and edit them on a computer before publishing a select few of them because I'm old fashioned like that.

No instant gratification selfies of my breakfast here.

Frustrated Britons struggle to locate their packages: Royal Mail tracker smacked

Re: Reasons

But but but it passed the unit test harness!

Wry social commentry masquerading as a joke imported from the tesla self driving comments section...

Ghost in Musk's machines: Software bugs' autonomous joy ride

Re: Software testing is the key to knowing whether it works or not

Thats interesting but in short, it'll be transferring the primary source of bugs from the coder to the person who devises the unit test harness? So not much of a long term final answer to the issue at all really.

I see packages that are shipped when they pass a test harness each release, and every release new and interesting bugs are found that the test harness doesn't cover. Really a test harness will only detect things you already know about and fixed from popping back up into your code base.

See the commentard earlier who mentioned that some of the systems failing and killing people were working as designed, its just the initial design wasn't sufficient in scope or definition to catch the oopsie that lead to the accident.

Patch your WordPress plugins: Scum are right now hijacking blogs

Wonder if I'm still going to get downvoted for saying to deploy wordpress as a static site after exporting it with wp-static and deploying THAT on the hosting proper, and keeping the whizzy cms bit hidden on a deployment intranet server?

I like these alerts though, reminds me to go update the plugins for my wpscan tool.

HPE coughed up source code for Pentagon's IT defenses to ... Russia

So, here's my concern. Everyone is talking about vulnerabilities in the code, for a log moniting package.

I'd be as concerned about someone spotting a way to evade its monitoring during an attack, and that information falling into the hands of my attacker.

Would that be a vulnerability in HP managementspeak? no, not really. Would the other side even need to cough up they have spotted it if they can implement work arounds locally?

Pretty sure the US gov would be analysing the software, they probably already know where it has flaws and are interestedly looking at who else buys it in ready to add it to the list of toys their cyber ops teams can use against that entity!

Dnsmasq and the seven flaws: Patch these nasty remote-control holes

One someone can get remote code execution on your local devices, its game over. Its trivial to generate say a reverse shell tcp connection as part of that payload, and have it traverse a nat gateway, even wrap it up to look like normal web traffic or pick a common port (and since this is a dns attack, I'd be telling it to use 53 outbound since to forward it has to have that open). If the payload isnt large enough to support a full binary, its easy to generate a staged payload and boot strap in a larger component, or instruct the device to download the payload proper via its own means (wget, curl etc if installed).

A lot of people may say "oh they only have my router/print server/nas box, its ok", but no, what they have then is a really good foothold inside your permiter defences and a great point to further attack/enumerate your privileged lan.

As for how to make this a full remote exploit, it might take some creativity because on the surface you only answer queries from the local subnet to start with, but what if someone sends your client machines a email with urls, or they are redirected to a sequence of domains by a infected page or advert? will your local subnet dnsmasq server not get asked for those domains to be looked up if they look like domain names?

Patching the stuff I can thats affected as quick as I can here. You pays your money and takes your choice.

NatWest customer services: We're aware of security glitch

I wonder if chars 9,10 and 11 are %0a ;)

Secure microkernel in a KVM switch offers spy-grade app virtualization

Airgapped isolation, interesting. Sounds difficult to circumvent.

*click* takes smartphone shot of monitor.

Thousands of hornets swarm over innocent fire service drone

Had asian hornet nest here (mainland europe). All summer the hornets were mooching round the house and patio looking for food, and they were BIG. Not incredibly aggressive but not something thats pleasant to share a room with when theyve annoyed after been trapped in there. We'd not been able to find the nest then a neighbor pointed it out as it was way up in the treeline on a boundary that it was binoculars territory to confirm what it was, and they were having the same experience.

So we called the fire brigade as they deal with them here as theyre dangerous, and they came out and confirmed it was a asian hornet hive, but it was so high they were talking of us privately hiring a specialist lift access platform so they could deliver the poisen, 1000e for a day... I was mulling over how I could use my drone to deliver some poison to the nest direct or how it would cope with being attacked while doing this but that night, the nest mysteriously fell out the tree after a large gunshot sound from the neighbors garden during the early hours, and the firebrigade were called to come and deal with the peed off mass now sat on the ground underneath the tree which they did wearing masses of protective clothing. They took part of the nest off for analysis, and the rest and some of the larve were taken to the local schools to teach them about them.

So yeah, a) I'm shocked nobody is yet using drones for poisen control delivery, and b)theyre dangerous buggers.