syntheticcorp

I get your point but I think pentesters are perfectly capable of thinking in graphs, including web security. Bug chains are the immediate example, where a couple of CVSS 4-7 vulns can be turned into a full rce/whatever 9.8 equivalent. This bug chaining fundamentally occurs via elements of compromise i.e a graph traversal.

Bloodhound is great, and a nice visual tool for people to conceptualise attack graphs but it’s just a part of the process of understanding the target domain from an attackers perspective. No nice tool like bloodhound exists for web pentesting because a chain of compromise can’t simply be reduced into tool form there because a chain is often specific to the app and not an underlying framework, unlike AD where the security boundaries are well(ish) understood and codified.

Pentest reports include stuff like SMB signing and “don’t admin everything with your DA account ” because they are glowing hot nodes very early in a chain of compromise, meaning that is often how stuff gets popped IRL. It’s (hopefully) not that the pentester doesn’t understand graph thinking, it’s just the the first node in the graph represents effectively complete compromise, so why traverse?

It’s pretty infrequent outside of target attacks. Most recent is probably the roundcube XSS CVE-2023-43770 that was actively exploited as 0day by a threat actor last year.

Specifically, Marriott was deauthing rather than just plain jamming.

You can’t serve a valid certificate chain to the client even if you control their traffic, because your malicious certificate isn’t signed by a trusted CA. And you can’t get a CA signature without demonstrating control of the domain to a CA.

Control over a clients DNS doesn’t let the VPN provider view the contents of TLS encrypted traffic. However they can view unencrypted data from connections like SNI headers, DNS queries etc.

It’s a vlc issue with h265 - I actually noticed this with videos from defcon last year. Pull the YouTube version or reencode to h264 to fix.

Yes it can do that now, at least on Windows 10

I’ve also encountered that a few times where a fairly anodyne bug in a codepath prevents a serious security bug from being reachable. With my attacker hat on it is very tempting to just report the first one…

The commenter you’re replying to is CTO of Cloudflare, so I’d say they likely know why the company makes these blog posts.

Found it, pg 47 https://www.cs.auckland.ac.nz/~pgut001/pubs/defending.pdf

Browsers already include this feature in a coarse grained (but utterly sufficient) manner in the form of a scroll bar.

It’s a good disassembler that is fairly expensive. https://hex-rays.com/ida-pro/

Yes it is still optional. I travelled on an ESTA a few months ago , left the social media handles section blank, and they made no comment at the border. That said it is still very capricious.

Rate limiting access to the enclave? Somewhat related, I fear this is where we are going to end up with secure attestation, limiting web access to approved devices.

I work in offense and they can be a huge impediment. Significant work goes into bypassing or staying undetected from these products. While not all the detection occurs at runtime, they report a lot of data back from the endpoint so historical detection can happen.

However what I see is essentially their true positive and false negative rate, I would be interested to know what the false positive rate is.

ESNI has been dropped, a new spec alters how it works and renames it Encrypted client hello (ECH)

https://blog.mozilla.org/security/2021/01/07/encrypted-clien...

I’ve worked in tech in NZ for 7 years or so, never actually met someone who calls themselves an SRE. Obviously I know the term, but IME we don’t use that title here

I can’t believe you can get 30 year fixed in the US , that’s amazing. The longest terms I can see where I live are 5 year fixed.

I suppose you could have income from interest on capital or stock dividends

Are you aware which website you’re on? Having strong opinions on esoteric topics is a HN mainstay. Also as a non-American driving in the US made me think about a lot of things I wouldn’t otherwise consider. (Yes you have too many stop signs)

There is none. This has been asserted for years on HN but I’ve never seen a modicum of evidence for it.

NK did personally target security researchers for compromise. See the TAG post referenced inTFA.

Postal 2 and manhunt are two fairly popular video games that were legally censored. Banned modern movies I am less familiar with, but there were many banned historically where the decision still stands today.

Average adult would include women, which are much weaker than men. It is sad if it applied to just men.

If it’s in the class path? Deserialisation gadgets.

I believe Java’s ZGC has max pause times of a few milliseconds

They used several close range photos, not the one in the article.

Australia already has a plan for this in the works to supply Singapore with solar from the outback. It’s called Sun Cable - see: https://suncable.sg/

Terrible job hiding the drug dealers identity in this article. They included her first name and location, googling that combination returns her full mugshot in a wanted poster put out by the local police.

Looks like they have doubled or tripled? Schools are still safe in absolute terms, shootings are a very small number.