Security

CameronDev , in New Wi-Fi Takeover Attack—All Windows Users Warned To Update Now

Any rightups on this? A remote WiFi takeover like this is crazy, especially if it affects all drivers and devices.

Dendr0 , in The iPhone Setting Thieves Use to Lock You Out of Your Apple Account

"They used his passcode to change the 46-year-old’s Apple ID password. They also enabled a hard-to-find Apple security setting known as the “recovery key.” In doing so, they placed an impenetrable lock on his account."

Because OP is a lazy fuck that wants us to read clickbait headlines.

yogthos OP ,
@yogthos@lemmy.ml avatar

so edgy

frauddogg , (edited )
@frauddogg@lemmygrad.ml avatar

I'm getting really fuckin sick of attention span-lacking lobotomites acting like everything that requires more than 5 minutes of skimming is a personal affront. You are NOT SO IMPORTANT that five minutes of your time is costing you money.

What you failed to bring into your edgy-assed complaint is that this isn't an isolated incident, but part of a confirmed pattern of malicious action across multiple people and multiple states that highlights how Apple's mechanisms for supposed privacy are half-assed enough that the most vulnerable userbase of technology-- old fuckers-- are getting suckered by a rising tide of cybercrime that doesn't even need specialized software to pull off. But y'know, I guess all that's just a clickbait headline to you because it's 'not your problem', isn't it, you "lazy fuck"?

Don't answer that; I've already pre-emptively decided anything you post is spam and clickbait since that's what we're doing now, apparently.

Cochise , in Stealing everything you’ve ever typed or viewed on your own Windows PC is now possible with two lines of code — inside the Copilot+ Recall disaster.

Recall is a nightmare.

davel ,
@davel@lemmy.ml avatar
thebardingreen , in Securing a computer?
@thebardingreen@lemmy.starlightkel.xyz avatar

You don't say anything about the operating system you're using.

I like Qubes for this use case. You have one Qube that handles your USB devices and then you can move data in and out of that Qube whatever way feels safest. If we're talking documents, spreadsheets and / or text files, cutting and pasting the text is a pretty safe option. If were talking image or video files, you could re encode them with imagemagick or ffmpeg before copying them between Qubes. PDFs are a bit of a tougher nut to crack. And software is... well... software.

But Qubes is a very troubleshoot it yourself OS.

TheOneCurly , (edited ) in Securing a computer?

Are you concerned about sensitive data leaving the PC or some sort of infection (like a crypto-locker) being brought onto it? Also, what is your threat level? Are you likely to be targeted specifically?

With an airgap, it would be pretty difficult to get data off of it without being onsite. The most important things would be physically securing the device (locked room), using full disk encryption, and using some sort of 2-factor login system. (hardware security key, like a yubikey ideally).

Securing against infection is nearly impossible, as stuxnet showed. Your best bet to beat these is some common sense security with what you're transferring and lots of backups. If you do find an infection, you just blow the whole system up and restore from a clean backup.

rando895 OP ,

Thanks for this reply, definitely giving me things to think about that I never would have thought to ask.

I would be concerned with both sensitive data leaving, and an infection being brought onto it during a file transfer.

Again, I appreciate you, and this all makes a lot of sense.

vk6flab , in This Undisclosed WhatsApp Vulnerability Lets Governments See Who You Message
@vk6flab@lemmy.radio avatar

You mean, a messaging app offered by Meta isn't secure? I'm shocked, I say, shocked!

Anyway..

solarvector , in This Undisclosed WhatsApp Vulnerability Lets Governments See Who You Message

Does it still count as a vulnerability if it is by design?

adespoton , in Recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution

To clarify, this is a (patched) bug in Git, not in the OS/filesystem.

davel , in Recursive clones on case-insensitive filesystems that support symlinks are susceptible to Remote Code Execution
@davel@lemmy.ml avatar

The Year of the !(MacOS | Windows) Desktop.

Cheradenine , in New Wi-Fi Vulnerability Enables Network Eavesdropping via Downgrade Attacks

"A successful SSID Confusion attack also causes any VPN with the functionality to auto-disable on trusted networks to turn itself off, leaving the victim's traffic exposed."

TWeaK , in New Wi-Fi Vulnerability Enables Network Eavesdropping via Downgrade Attacks

Damn, this could be huge, it sounds like it affects everything.

Also, I'll be damned if I'm going to use AitM. It's Man in the Middle. If you want it to be de-gendered just think of it as 'man, ie an abbreviation for human.

mihor , in How I upgraded my water heater and discovered how bad smart home security can be

A thought, one way to mitigate such security issues yourself would be to make use of subaddressing (the + sign) in your email address you use for such services, by appending your own random guid, for example, essentially making guessing your exact email address string futile. For example instead of using simply johndoe@example.com you would instead use johndoe+9be28cb9-fd22-4e9f-8144-93f90ab04a1f@example.com when registering. Assuming the service provider isn't using some lame and incorrect email address validation regex.

smegger , in How I upgraded my water heater and discovered how bad smart home security can be

Yeah this is why I'm so fascinated with the concept of designing home automation that is independent of the internet. Privacy and reliability

mihor ,

HomeAssistant is a really good piece of software. The only issue I still haven't 100% resolved are notifications, since I still need to figure out the most reliable way for when I will really need them - the push notifications simply won't work sometimes on my graphene os phone. Perhaps using the RedNode and email notification, but that again relies on the mail server being up as well, so one extra breaking point.

adespoton , in BIMI and DMARC Can't Save You: The Overlooked DKIM Exploit

DKIM exploit is still better than back when it didn’t exist. Barriers to entry and all that.

autotldr Bot , in How I upgraded my water heater and discovered how bad smart home security can be

This is the best summary I could come up with:


That, with some API tinkering and an email address, a bad actor could possibly set its temperature or make it run constantly.

Opening a tap triggers the exchanger, heats up the water (with natural gas, in my case), and the device has to push it through the line to where it's needed.

When I went into the utility closet to shut off the hose bibbs for winter, I noticed a plastic bag magnetically stuck to the back side of the water heater.

The Control-R Wi-Fi Module must be installed for recirculation to operate,” read the intense yellow warning label.

The tone of the language inside (“DO NOT TOUCH,” unless you are “a properly trained technician”) did not match that of the can-do manual (“get the most from your new module”).

I installed the device, went through the typical “Connect your phone to this weirdly named hotspot” process, and—it worked.


The original article contains 441 words, the summary contains 149 words. Saved 66%. I'm a bot and I'm open source!

  • All
  • Subscribed
  • Moderated
  • Favorites
  • random
  • security@lemmy.ml
  • test
  • worldmews
  • mews
  • All magazines