Except there isn't a DLL hijacking vulnerability at all. The CIA "issue" is that on an already-compromised computer, an administrator-privileged attacker can replace a Notepad++ DLL with one that does something else.
Notepad++ itself cannot do anything to protect itself from being hijacked in such a way.
You are getting a phone that won't be immediately abandoned, like most other Android phones. You are paying for the support contract.
What does one get out of a support contract? Security updates. Sure, you can save money on a cheaper phone. Just make sure that you factor in the cost of a potential device compromise due to lacking security updates.
Multiple vendors really helps the Android user to get what they want.
Sure, if it's the feature set that you're talking about. If you want a new phone that isn't abandoned update-wise a year or less after you get it, you have one Android option: the Pixel.
I am viewing that setting through the process you described. It's well-known that Uber pushed out the change to remove the "while using" option at the beginning of December. https://www.eff.org/deeplinks/...
I'd say that you should consider yourself lucky to be the outlier. How you got there, I have no idea...
It's remotely exploitable with no user interaction if the web admin stuff is exposed to the internet. If the remote web admin is not enabled, then it's exploitable as the result of a user on the network viewing a malicious or compromised website.
Changing the IP address or subnet of your router will only stop the laziest/inept of attackers.
What's the point of mentioning deceptive measures of time like this? It's not like this person started from scratch, decided to jailbreak an iPhone 7, and then 24 hours later was done.
The individual likely had an iOS jailbreak, which likely chained together a number of vulnerabilities and took some undisclosed amount of time to develop, and then tweaked / confirmed it on the new hardware. The 24-hour specification means nothing.
Here is a picture of somebody in China hand-pollinating a pear tree due to one of the unintended side effects (no bees): https://2.bp.blogspot.com/-9wT...
This article has enough completely-wrong aspects that exempts it from the concept of "not even wrong" I suppose.
1) The watch does not engage in covert traffic. It's the pairing app for the watch that a user installs on a phone that does the communication.
2) What on earth does the redundant phrase "covert communications behind the users' back" even mean? Have you looked at network traffic when *any* application has been launched? If you think that any app talking on the internet without explicitly asking the user first counts as "covert communications", then I think you can label just about all of the software out there (esp. in the mobile space) as engaging in "covert communications."
3) The phrase "random IP address" used by the speaker is slang meant to convey that he didn't know what it is. In this case, it's a system referred to by its IP rather than its DNS name. So rather than looking up who owns the IP address, he says it's "random" and shrugs.
4) To give up and say that it's "very difficult to determine" what is being sent over the network because it's over an encrypted channel is ridiculous. For all we know, it's just talking to the software vendor via HTTPS. In which case it would be trivial to inspect by using MITM.
I'm not saying that there's nothing sketchy going on here. But to provide zero evidence of what's actually happening and just speculate and spread FUD is irresponsible.
As always, it wasn't the crypto which was broken -- just the lousy method it was applied.
Where on earth did the information to back up this difficult-to-parse statement come from? The video was encoded with VideoCrypt. VideoCrypt, which was released in 1989, has a number of ways that it can be attacked. Including brute force, which was used here in the form of the Antisky app (from 1994).
This site has been becoming less and less relevant as time goes on. But this makes it very clear. Slashdot is not news for nerds. It is revenue for Dice Holdings. And they're not even trying to hide it. It's been real...
US-CERT does not have a vulnerability analysis capability. That's why they contract that work out to Carnegie Mellon University. I work for CERT, so I'm pretty sure that I would know.
Yet another example of why Flash should be uninstalled at the OS level. For example, on Windows this means removing the Flash ActiveX control. If you ever encounter a web page that needs Flash (they're becoming less and less common), just open it in Chrome, which you have configured to use Flash as click-to play.
Slashdot Mirror
Perhaps you're not familiar with how security research works. Stopping at "is this being exploited in the wild now?" is shortsighted.
For some background, read:
https://blog.osvdb.org/2017/08...
(about "L0pht, Making the theoretical practical since 1992." )
Except there isn't a DLL hijacking vulnerability at all. The CIA "issue" is that on an already-compromised computer, an administrator-privileged attacker can replace a Notepad++ DLL with one that does something else.
Notepad++ itself cannot do anything to protect itself from being hijacked in such a way.
From the Notepad++ page (and even the Slashdot summary): "Note that once usersâ(TM) PCs are compromised, the hackers can do anything on the PCs."
Repeat after me: If my computer is compromised, there's nothing that any individual app on the system can do to protect itself from being hijacked.
There's nothing to see here.
Do you have any suggestions for such alternatives?
What am I getting for 3x the price?
You are getting a phone that won't be immediately abandoned, like most other Android phones. You are paying for the support contract.
What does one get out of a support contract? Security updates. Sure, you can save money on a cheaper phone. Just make sure that you factor in the cost of a potential device compromise due to lacking security updates.
Multiple vendors really helps the Android user to get what they want.
Sure, if it's the feature set that you're talking about. If you want a new phone that isn't abandoned update-wise a year or less after you get it, you have one Android option: the Pixel.
I am viewing that setting through the process you described. It's well-known that Uber pushed out the change to remove the "while using" option at the beginning of December. https://www.eff.org/deeplinks/...
I'd say that you should consider yourself lucky to be the outlier. How you got there, I have no idea...
Interesting claim. Can you please indicate where one selects "While Using" in the settings here:
http://i.imgur.com/Qb6YdLe.jpg
This is from Uber 3.225.3 on iOS 10.2.
That's what WebRTC is for. After determine your computer's internal address, it's pretty trivial to guess (or bruteforce) your router's address.
It's remotely exploitable with no user interaction if the web admin stuff is exposed to the internet. If the remote web admin is not enabled, then it's exploitable as the result of a user on the network viewing a malicious or compromised website.
Changing the IP address or subnet of your router will only stop the laziest/inept of attackers.
And yet the fix that they chose to implement STILL causes Firefox to crash. Just not in an exploitable manner. Seems kind of non-ideal to me.
The bug can be used to run any code of an attacker's choosing.
Google Desktop was discontinued over 5 years ago. What is this article even talking about?
Nit-picking about why Ubuntu isn't "Linux" won't make you many friends.
What's the point of mentioning deceptive measures of time like this? It's not like this person started from scratch, decided to jailbreak an iPhone 7, and then 24 hours later was done.
The individual likely had an iOS jailbreak, which likely chained together a number of vulnerabilities and took some undisclosed amount of time to develop, and then tweaked / confirmed it on the new hardware. The 24-hour specification means nothing.
Eliminating pests sure worked well for the Chinese, didn't it? http://io9.gizmodo.com/5927112...
Here is a picture of somebody in China hand-pollinating a pear tree due to one of the unintended side effects (no bees): https://2.bp.blogspot.com/-9wT...
This article has enough completely-wrong aspects that exempts it from the concept of "not even wrong" I suppose.
1) The watch does not engage in covert traffic. It's the pairing app for the watch that a user installs on a phone that does the communication.
2) What on earth does the redundant phrase "covert communications behind the users' back" even mean? Have you looked at network traffic when *any* application has been launched? If you think that any app talking on the internet without explicitly asking the user first counts as "covert communications", then I think you can label just about all of the software out there (esp. in the mobile space) as engaging in "covert communications."
3) The phrase "random IP address" used by the speaker is slang meant to convey that he didn't know what it is. In this case, it's a system referred to by its IP rather than its DNS name. So rather than looking up who owns the IP address, he says it's "random" and shrugs.
4) To give up and say that it's "very difficult to determine" what is being sent over the network because it's over an encrypted channel is ridiculous. For all we know, it's just talking to the software vendor via HTTPS. In which case it would be trivial to inspect by using MITM.
I'm not saying that there's nothing sketchy going on here. But to provide zero evidence of what's actually happening and just speculate and spread FUD is irresponsible.
Where on earth did the information to back up this difficult-to-parse statement come from? The video was encoded with VideoCrypt. VideoCrypt, which was released in 1989, has a number of ways that it can be attacked. Including brute force, which was used here in the form of the Antisky app (from 1994).
This site has been becoming less and less relevant as time goes on. But this makes it very clear. Slashdot is not news for nerds. It is revenue for Dice Holdings. And they're not even trying to hide it. It's been real...
"Nobody is actually losing anything." Wait a minute... You don't think...
I hope at least *some* people see what brokep did there.
US-CERT does not have a vulnerability analysis capability. That's why they contract that work out to Carnegie Mellon University. I work for CERT, so I'm pretty sure that I would know.
This article is about US-CERT, not CERT.
Yet another example of why Flash should be uninstalled at the OS level. For example, on Windows this means removing the Flash ActiveX control. If you ever encounter a web page that needs Flash (they're becoming less and less common), just open it in Chrome, which you have configured to use Flash as click-to play.
"News for Nerds. Stuff that Matters."
OpenWRT runs on 3G/4G modems?