harrysintonen

joined 2 years ago
sorted by: new top controversial old
7
#OpenSSH client is vulnerable to MitM attacks if VerifyHostKeyDNS is enabled - https://www.openwall.com/lists/oss-security/2025/02/18/1 (infosec.exchange)
 

#OpenSSH client is vulnerable to MitM attacks if VerifyHostKeyDNS is enabled - https://www.openwall.com/lists/oss-security/2025/02/18/1

#CVE_2025_26465 #coordinateddisclosure #infosec #cybersecurity

#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now. in c/[email protected]
#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now. in c/[email protected]
[–] [email protected] 1 points 1 week ago

#Nordnet services appear to be back.

#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now. in c/[email protected]
[–] [email protected] 1 points 1 week ago (2 children)

Nordnet has a lot of technical issues to sort out. If the malfunction allowed unauthorized parties to operate the accounts it will be quite messy to sort out.

Among with technical part, they will have to deal with the regulatory issues, in particular the Financial Supervisory Authority. They will demand answers.

3
#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now. (fedia.io)
 

#Nordnet - nordic digital platform for savings and investments - had an issue where people could see each others information. The website has been taken down for now.

https://www.nordnet.fi/

#infosec #infosecurity #cybersecurity #privacy

3
Another reminder to keep your critical content out of the cloud - Do no trust someone else's computer. (infosec.exchange)
 

Another reminder to keep your critical content out of the cloud - Do no trust someone else's computer.

https://www.msn.com/en-us/news/technology/uk-orders-apple-to-let-it-spy-on-users-encrypted-accounts/ar-AA1yzETB

#apple #icloud #privacy

In my youth I wrote m68k assembly programs with tens of thousands of lines and speed optimized every section of the code, even initialization/cleanup executed exactly once. It was very very silly. It in c/[email protected]
[–] [email protected] 1 points 2 weeks ago* (last edited 2 weeks ago)

I still occasionally write some m68k code and apps. These are from 2024:

- Execute code in #amiga color registers: https://sintonen.fi/src/colexec/colexec.asm
- RXS-M-XS 32bit->32bit Permuted Congruential Generator: https://sintonen.fi/src/misc/pcg_rand.asm
- Minimal modplayer (protracker music player): https://sintonen.fi/src/minimod/ (the replayer routine is mostly from Frank Wille however)

In my youth I wrote m68k assembly programs with tens of thousands of lines and speed optimized every section of the code, even initialization/cleanup executed exactly once. It was very very silly. It in c/[email protected]
[–] [email protected] 1 points 2 weeks ago

I also participated in very useless size/speedcoding competitions - some of them are still accessible from this old web page: https://amycoders.org/compo/

Note that some of the HTML is a bit broken, for example https://amycoders.org/compo/circlecompo.html - you can view source to see the full routine

#m68k #assembly #sizecoding #speedcoding

1
In my youth I wrote m68k assembly programs with tens of thousands of lines and speed optimized every section of the code, even initialization/cleanup executed exactly once. It was very very silly. It (infosec.exchange)
 

In my youth I wrote m68k assembly programs with tens of thousands of lines and speed optimized every section of the code, even initialization/cleanup executed exactly once. It was very very silly. It was a lot of fun.

#development #assembly #coding #programming

#cURL doesn't validate SSH host identity if known_hosts file is missing. I think this is a #vulnerability, but the project disagrees. Advisory is here: in c/[email protected]
[–] [email protected] 2 points 2 weeks ago

@[email protected] Curl will likely address this eventually even though they don't consider it a vulnerability. See https://github.com/curl/curl/issues/16197

#cURL doesn't validate SSH host identity if known_hosts file is missing. I think this is a #vulnerability, but the project disagrees. Advisory is here: in c/[email protected]
[–] [email protected] 3 points 2 weeks ago

The latest curl version 8.12.0 (released today) is affected.

14
#cURL doesn't validate SSH host identity if known_hosts file is missing. I think this is a #vulnerability, but the project disagrees. Advisory is here: (infosec.exchange)
 

#cURL doesn't validate SSH host identity if known_hosts file is missing. I think this is a #vulnerability, but the project disagrees. Advisory is here: https://sintonen.fi/advisories/curl-ssh-insufficient-host-identity-verification.txt

#infosec #cybersecurity #nocve

Apparently there's a major #vulnerability in #AMD CPUs: "AMD Microcode Signature Verification Vulnerability." in c/[email protected]
[–] [email protected] 1 points 2 weeks ago

The details of the #AMD Microcode Signature Verification #Vulnerability are out:

#infosec #infosecurity #cybersecurity

42
Warning: Do not trust *.g.co urls! #GoogleWorkspace domain verification seems to be quite lax and allow arbitrary .g.co to be created. This allows for extremely convincing #phishing to be performed (infosec.exchange)
 

Warning: Do not trust *.g.co urls! #GoogleWorkspace domain verification seems to be quite lax and allow arbitrary .g.co to be created. This allows for extremely convincing #phishing to be performed where all communication appears to be coming from "google".

ref. https://gist.github.com/zachlatta/f86317493654b550c689dc6509973aa4

#infosec #cybersecurity

Apparently there's a major #vulnerability in #AMD CPUs: "AMD Microcode Signature Verification Vulnerability." in c/[email protected]
[–] [email protected] 3 points 4 weeks ago

So what could you do if the microcode signature verification can be bypassed? While not directly applicable, this #defcon presentation "DEF CON 31 - Backdoor in the Core - Altering Intel x86 Instruction Set at Runtime - Krog, Skovsende" gives some ideas: https://www.youtube.com/watch?v=Zda7yMbbW7s

23
Apparently there's a major #vulnerability in #AMD CPUs: "AMD Microcode Signature Verification Vulnerability." (fedia.io)
 

Apparently there's a major #vulnerability in #AMD CPUs: "AMD Microcode Signature Verification Vulnerability."

The vulnerability was leaked by #ASUS in their beta BIOS changelog:

https://web.archive.org/web/20250106151231/https://rog.asus.com/motherboards/rog-strix/rog-strix-x870-i-gaming-wifi/helpdesk_bios/

ASUS has since removed this entry from the changelog since it likely broke the embargo. Either way, this is not great as the new firmware is largely not yet available and likely won't be for a long while.

#infosec #cybersecurity

25
If you're using #Adobe #Acrobat you might want to check if your organization allows use of the by default enabled generative AI features: Acrobat sends the documents to cloud for processing, which (fedia.io)
 

If you're using #Adobe #Acrobat you might want to check if your organization allows use of the by default enabled generative AI features: Acrobat sends the documents to cloud for processing, which likely goes against the data #privacypolicy of many orgs.

If unsure, go to Preferences > Generative AI and deselect "Enable generative AI features in Acrobat".

https://helpx.adobe.com/acrobat/using/disable-generative-ai.html

#privacy #defaults #enshittification

Apparently #macOS now considers #Docker malware. in c/[email protected]
[–] [email protected] 5 points 1 month ago

I had actually forgotten I still had Docker installed on this system. I've now fixed this issue by uninstalling the malicious app. I'm using #podman elsewhere already, just had this install lingering still. Apple: Thanks for the warning!

Apparently #macOS now considers #Docker malware. in c/[email protected]
[–] [email protected] 4 points 1 month ago (1 children)

@[email protected] Oof, that's not good at all.

34
Apparently #macOS now considers #Docker malware. (fedia.io)
 

Apparently #macOS now considers #Docker malware.

#infosec #cybersecurity

1
The #Volkswagen #geolocation leak is a great example of why I am such a Luddite when it comes to sharing data with companies. I use as few cloud services as possible (for example, with Apple, I only (infosec.exchange)
 

The #Volkswagen #geolocation leak is a great example of why I am such a Luddite when it comes to sharing data with companies. I use as few cloud services as possible (for example, with Apple, I only use the "Find My" service from iCloud).

Even if you make an informed decision to share your data with a company, the data can still leak by accident or through a system compromise. The unfortunate fact is that these days, many services are made difficult or even impossible to use without accepting excessive data sharing.

https://www.carscoops.com/2024/12/vw-group-data-breach-exposed-location-info-for-800000-evs/

#privacy #GDPR #infoleaks #volksdaten

3
The white whale CRT, 43" #Sony KX-45ED1 / PVM-4300 found, rescued and restored. The adventure is lovingly documented in this great #shankmods video: https://www.youtube.com/watch?v=JfZxOuc9Qwk (infosec.exchange)
 

The white whale CRT, 43" #Sony KX-45ED1 / PVM-4300 found, rescued and restored. The adventure is lovingly documented in this great #shankmods video: https://www.youtube.com/watch?v=JfZxOuc9Qwk

#technology #crt #retrogaming

#Apple Intelligence is now available in the European Union. While some features may not be fully functional yet, basic functionalities such as rewriting selected text seem to be working correctly. If in c/[email protected]
[–] [email protected] 1 points 2 months ago (1 children)

@[email protected] it's restricted for other than macOS, it seems. In macOS it worked fine with location in Finland.

2
#Apple Intelligence is now available in the European Union. While some features may not be fully functional yet, basic functionalities such as rewriting selected text seem to be working correctly. If (fedia.io)
 

#Apple Intelligence is now available in the European Union. While some features may not be fully functional yet, basic functionalities such as rewriting selected text seem to be working correctly. If you’re considering enabling this feature, please review the privacy policy at https://www.apple.com/legal/privacy/data/en/intelligence-engine/ Additionally, if you’re using a work device, it’s recommended to consult your organization’s IT department for further guidance.

#appleintelligence #europeanunion #eu #privacy

view more: next ›