Episode 365: The Unfixable Exploit




TechSNAP show

Summary: <p>Hardware flaws that can’t be solved, human errors at the physical layer, and spoofing cellular networks with a $5 dongle. </p><p>Sponsored By:</p><ul> <li> <a rel="nofollow" href="http://techsnap.ting.com">Ting</a>: <a rel="nofollow" href="http://techsnap.ting.com">Save $25 off a device, or get $25 in service credits!</a> Promo Code: Visit techsnap.ting.com</li> <li> <a rel="nofollow" href="https://do.co/snap">Digital Ocean</a>: <a rel="nofollow" href="https://do.co/snap">Apply our promo snapocean after you create your account, and get a $10 credit.</a> Promo Code: snapocean</li> <li> <a rel="nofollow" href="http://ixsystems.com/techsnap">iXSystems</a>: <a rel="nofollow" href="http://ixsystems.com/techsnap">Get a system purpose built for you.</a> Promo Code: Tell them we sent you!</li> </ul><p>Links:</p><ul> <li> <a title="Sysadmin unplugged wrong server, ran away, hoped nobody noticed • The Register" rel="nofollow" href="https://www.theregister.co.uk/2018/04/23/who_me/">Sysadmin unplugged wrong server, ran away, hoped nobody noticed • The Register</a> — ‘I was a snot-nosed kid fresh out of college and thought I knew everything!’</li> <li> <a title="Spoofing Cell Networks with a USB to VGA Adapter | Hackaday" rel="nofollow" href="https://hackaday.com/2018/04/23/spoofing-cell-networks-with-a-usb-to-vga-adapter/">Spoofing Cell Networks with a USB to VGA Adapter | Hackaday</a> — Available through the usual overseas suppliers for as little has $5 USD, these devices can be used unmodified to transmit low-power FM, DAB, DVB-T, GSM, UMTS and GPS signals.</li> <li> <a title="ShofEL2, a Tegra X1 and Nintendo Switch exploit" rel="nofollow" href="https://fail0verflow.com/blog/2018/shofel2/">ShofEL2, a Tegra X1 and Nintendo Switch exploit</a> — The Tegra X1 (also known as Tegra210) SoC inside the Nintendo Switch contains an exploitable bug that allow taking control over early execution, bypassing all signature checks.</li> <li> <a title="Atlanta spends more than $2 million to recover from ransomware attack" rel="nofollow" href="https://www.engadget.com/2018/04/23/atlanta-spends-over-2-million-ransomware-recovery/">Atlanta spends more than $2 million to recover from ransomware attack</a> — . It appears that firms Secureworks and Ernst &amp; Young were paid $650,000 and $600,000, respectively, for emergency services while Edelman was paid $50,000 for crisis communication services. Overall, the funds seemingly applied to the ransomware attack response add up to approximately $2.7 million.</li> <li> <a title="Google Chrome 66 Released Today Focuses on Security" rel="nofollow" href="https://www.bleepingcomputer.com/news/google/google-chrome-66-released-today-focuses-on-security/">Google Chrome 66 Released Today Focuses on Security</a> — The biggest change is that Google Chrome will start showing SSL certificate errors for all Symantec certs issued before June 1, 2016. This is "stage two" of Google's long-term plan on distrusting Symantec certificates altogether.</li> <li><a title="Where to get started with monitoring?" rel="nofollow" href="https://pastebin.com/bPn1cGLV">Where to get started with monitoring?</a></li> <li><a title="defunkt uses a fool tools for his network" rel="nofollow" href="https://pastebin.com/aFmwbguq">defunkt uses a fool tools for his network</a></li> <li><a title="Brian shares some love for Zabbix" rel="nofollow" href="https://pastebin.com/z93N6GzR">Brian shares some love for Zabbix</a></li> <li> <a title="VMware Patches Pwn2Own VM Escape Vulnerabilities" rel="nofollow" href="https://threatpost.com/vmware-patches-pwn2own-vm-escape-vulnerabilities/124629/">VMware Patches Pwn2Own VM Escape Vulnerabilities</a> — VMware on Tuesday patched a series of vulnerabilities uncovered earlier this month at Pwn2Own. The flaws enabled an attacker to execute code on a workstation and carry out a virtual machine escape to attack a host server.</li> <li> <a title="balena - A Moby-based container engine for IoT" rel="nofollow" href="https://www.balena.io/">balena - A Moby-based container engine for IoT</a> — A Moby-based container engine for IoT</li> </ul>