It should be safe to test IoT hardware & firmware on my main machine right? It's handy to just test natively and I don't think something like a security camera would try to do anything bad when connected.

@JohnZhau as with all things: probably. two questions though: 1. does it even run on your main machine? 2. how much trouble is it, to set up a separate vm/container/sandbox whatever

git.zx2c4.com/american-unsigned-language/tree/…

@TomK. Cool exploit, but one would at least require the privileges to reboot a machine as far as I can tell

exactly

should've added: It's a secure boot circumvention

so attacking root isn't the goal

In which scenario would this harm someone's security?

If you have secure boot enabled, you can't load unsigned kernel modules, therefore even when an attacker gains root privileges, once you regain control of a machine that had secure boot enabled, you can be moderately sure, that the kernel has been left untouched

this exploit circumvents exactly this

Yes, that makes sense, but I'd wager if any malicious code has run on my machine, the only safe way is a complete wipe and reinstall

so as an attacker you would be able to gain persistent access to a machine through modifying the kernel with an unsigned

that's the textbook way of doing things, but it's not always doable

Yes, live servers can be shit to work with.

plus: you have to see secure boot as a control that works as a bit of a reinsurance

you had an incident some time ago and now something funky is happening in your DC

could this be the same attacker who has gained persistence?

no, because your machines had secure boot enabled

Yes, I agree, though I'm taking it with a grain of salt. First, because of exploits like this, and secondly because you never quite know who may have legitimate signing keys

sure, but that's a different conversation

again: in an ideal world, it's the organization itself that has control over all the key material

but a lot of orgs struggle with this

@TomK. That's an understatement

Yes, I get where you're coming from. Though from what I could gather, it's more a problem of the kernel trusting boot args than with secureboot itself

yes

U/EFI if I got it right

Luckily, I haven't had the pleasure of worrying about bootloaders yet

Some time ago it wasn't possible to run VirtualBox on Ubuntu unless you signed some kernel module yourself, or disabled secure boot. Then things changed, and I guess Ubuntu made it possible to sign modules "automatically", so VirtualBox just installs and runs correctly right away. I wonder if this way of doing things defeats the purpose of secure boot

@reed Virtualbox is still a bitch to set up. You need to install their extensions to bridge a webcam to the VM, and those extensions need to be licensed

Plus, I had a ton of problems with a VM just completely dying on boot. Why? Because Audio was enabled. No idea why, but whenever I enable audio on the guest, it crashes on boot

@MechMK1, what do you mean "extensions need to be licensed"?

@reed Virtualbox has the virualbox extensions (not the Guest Additions)

And as far as I know, they're not free for commercial use

Oh, I didn't know that. What a shame

Yes, it's under the Personal Use and Evaluation License

Which means I can't use it professionally, which sucks.

Luckily, since I only needed it once, that falls under the "Evaluation" umbrella

I've seen orgs use community editions and "not for commercial use" software so often

MechMK1 lawful neutral

I only realized recently that TeamViewer is not free for commercial use. I'm pretty sure my "boss" has never paid for a license. He doesn't use it very often though.

I still wonder what's the most convenient option for occasional remote assistance. I'd have to check out Google's product (Chrome Remote Desktop if I'm not mistaken)

@TomK. Despite me not liking oracle, I think that licenses that are not technically enforced should still be obeyed. because the alternative is so much worse

Sure, just go right ahead an install some Denuvo stuff in my kernel. Not that I mind either

@TomK. Isn't zx2c4 the guy who made WireGuard? I didn't know he looked for exploits also.

@reed "Joe, who is the company in this invoice.pdf? They just sent me this email..." - true story

I never found out about the PDF being passed around until we changed our email provider and the new provider wouldn't allow me to import that email chain.

@reed TeamViewer is the most versatile, IMO. But ugh. There's licensing and then you have to think about having this TeamViewer left installed on people's computers.

ConnectWise Control allows you to have disposable end clients. For the free version, you can have up to 3 simultaneous sessions, which should be enough for occasional use. I think the license allows business also.

What boils my blood is when fortune 500 companies use some small tool that is free for non-commercial use and don't even have the decency to pay for it.

Not going to name any names. You know who you are and what you did.

It wasn't me!

My company isn't a fortune 500 company, so we're completely justified when we don't pay for software.

That's how it works, right?

I can neither confirm or deny that statement.

OTOH a lot of business models rely on the fact that people will use your product and make it popular only if it is free (or can be cracked and used for free, etc.)

@reed Just say Adobe :D

I wonder if they did themselves a favour by making photoshop a monthly subscription

I thought you were going to mention how they released Photoshop CS2 for free

They were taking down the licensing servers, so they published a download that did not require licensing

But you were only supposed to download it if you did have a valid license.

I assume everybody followed the rules, because people always follow rules.

IIRC, Microsoft once admitted that they were ok with people cracking and pirating Windows, because the alternative would have been nobody would have used their OS

A large company like adobe or microsoft can use this as a business strategy

But if you're smaller, it is a lot worse, especially in the entertainment industry

That's why I haven't pirated any games since I was a kid

And back then, I had no way of legitimately buying them

New Mobile Internet Protocol Vulnerabilities Let Hackers Target 4G/5G Users | The Hacker News

@FireQuacker I think so, yes

probably old news, saw this today on the usual Firefox security advises.

Forgive me the irony on the link text, but I found the idea quite funny.

kinda old news, yeah ;)

but what do you find funny about it?

the fact that we are trying to fix the problem by containing abusive behavior instead of correcting it.

I mean, it is not like Facebook is a virus, if you get what I mean. It is not like we are facing someone who violates the law to steal info from your pc. But still company get away with behaviors that requires us to "protect ourselves" in such elaborate ways.

We often discover legit sites performing actions to track users that are borderline malicious, yet in the end we are left here to protect ourselves on our behalf, while they get to continue to do the same.

I guess "funny" isn't the right word. More like... "sad"

Facebook is a virus of the mind...

I get what you are saying

But unfortunately policymaking in the US and elsewhere is too slow to adapt to digital change

when GDPR hit, so many people - even in IT - said, that it was all bogus and too much and whatnot

but truth be told, it's the only way to protect people's data

History of GDPR. First months: OMG we are all screwed, call the lawyer, add a banner, check this policy, you are going to jail, we are going to jail, everybody is going to get in trouble. Nowadays: put a checkbox on every form to make users accept every kind of usage of their data, and that's it.

The GDPR is actually a good law. The problem is nobody is caring about it, and if it was really applied and interpreted the way it was meant to be, then most modern business models won't be legal anymore

@reed the problem is that it goes against the wallet of the ones who should make it actually count.

I prepared the PDF with my analysis of the XSS challenge

Intel wants to bake anti-malware inside the CPU.. what could possibly go wrong?

arstechnica.com/information-technology/2020/06/…

@ThoriumBR Should we start betting on the name of the new class of vulnerabilities it creates?

nah, we should start registering domains...

when the vuln hits, we already own the domain...

am I crazy or does this edit completely change the question? security.stackexchange.com/review/suggested-edits/155659

@Luc, I saw that suggestion but I skipped it. The question is not clear to me, and the edit might even make it worse.

@Luc I dunno... I can see it as an attempt to reduce an overly worried question into just stating the facts without all the teeth-gnashing. The part about enterprise policy is the only part I would be too worried about leaving out.

I mean, it does change it from "This is malware how do I get rid of it" to "Is this malware"

It's more aggressive than I would have been, but it still gets at the problem

And it helps it be on-topic

I guess but is the point to reopen the question? It seems kinda weird to change a closed question that is not your own and not for cosmetic / http->https / archive links / that kind of edits

Redirecting an off-topic question into an on-topic question is valid

not sure whether to revert because imo this conflicts with the author's intent, and from my perspective the question is now more off-topic because it's now "you guys think this might be malware?" (an opinion: how could we know for sure?) than before ("how do I fix this security issue?")

Well, if the OP were able to add more relevant details ("I downloaded x from website z, it immediately restarted Chrome and put it into organization mode"), that would help

agreed, but the edit doesn't do anything towards that

shrugs guess I'll just let this go? If OP comes back they can just revert or re-edit or whatever

Yeah

I'm not sure that this question would be particularly useful anyway