Why do I hear singing, and what are those ships on the horizon? I can’t seem to make out their flags, they all just look black to me.

Even when a company is doing things pretty well with a VPN, all it takes is one mistake and the cat is out of the bag. At one of my previous employers, we had a fairly good setup with VPNs using single sign on via our IdM provider. IdM enforced SSO and the VPN had a number of policies setup which kept good control over what users could login. And then someone had the brilliant idea to take an old VPN appliance, reset it to factory defaults and configure it just enough to work on our network and then hung it out on the internet for some sort of test (our configuration management left a lot to be desired). Of course, that led to it being left there for a couple months and an attacker finally found it. They also had a valid username/password combination which got them in the door.

Security is hard and often expensive. But still, compared to “we put out OT devices on the internet” a basic VPN is a huge step up.

Sadly yes, this is exactly what happens. And it ends up being IT holding the bag at the end, with the managers having long since cashed out their stock options and left.

The hacks target internet-facing programmable logic controllers (PLCs)

Why the fuck
is your PLC
facing the fucking internet!

Jesus Zombie Christ an a pogo stick. Has no one been paying attention for the last two decades? Seriously, we learned this sort of lesson in Two Thousand and fucking Three. Your critical assets do not get public IP addresses.

In absolute terms, there is probably some small increase in risk due to the NFC interface. As a practical attack, it’s probably not worth worrying about. Directly from the paper you linked:

NB the term skimming for such an attack can be misleading if one thinks of well-known mag-stripe skimming of bank cards. When skimming mag-stripes, the attacker secretly reads the information on the mag-stripe, and can then make copies to create clones of the original bank card that cannot be distinguished from the original. For RFID tags, an attacker will not be able to create clones with a skimming attack, as long as the protocol uses some form of challenge-response.

Which, the YubiKey, at least, used a challenge-response. While there is a known vulnerability which can be used to extract the internal secret and therefore clone a YubiKey 5, it requires long term physical access and is not trivial.

The bigger concern for the NFC tag would be its use in a relay attack. And with a big enough antenna, an attacker might be able to do that. However, I would again point to the paper you linked to, their results were “long” for an RFID activation and read. But, not really all that long:

a gate with a width of 100 cm, which can communicate with a tag held near the center between the two antenna

And their setup required a couple large antennas that the victim would need to stand in between. Not impossible, but you’d notice with each side being half a meter away.

So yes, it’s a technical risk, but not one that I’d bother putting much effort into avoiding. And the being able to use the key via NFC is probably worth the risk.

Hopefully this will hasten the demise of EA and some of the IP they are holding on to will have a chance to escape to a company which cares about making good games.

If you really care that little about what happens to your corpse, why does having it stuffed in a box with your family bother you so much?

Think of it this way: It makes him happy and it resolves one of the issues your own loved ones will have to deal with after you die. Things like burials, funerals and graves aren’t really for the deceased, they are for the people who cared about the deceased. They are expressions of and a way for them to deal with their grief. So, when you kick it, the people who cared about you will be having to deal with all that. It’s rather nice of your father to be saying, “here, let me take care of that problem for them.”

Seems like a perfect time and place to try hacking the display. Unlikely to be cameras, you’re stuck there for a bit anyway, and nothing of value will be lost if you monumentally fuck up.

UI’s for movie streaming services are not designed to help you find something to watch. They are designed to keep you “engaged”, which means in the platform and not realizing that the pool of actually interesting things is about as deep as a puddle. Everything about streaming sites’ design is user hostile and this is a classic example of that.

The worst is that they set up outlook to obfuscate all urls, so you can’t even validate by eye.

I work in cybersecurity and this sort of thing drives me straight up a wall. I understand why these sort of things exist, but they fail so often that they are worthless. My work has the Microsoft “urldefense” bullshit URL mangling. As far as I can tell, it has never stopped someone from clicking on a phishing email. In fact, since the URL now looks like a Microsoft URL, users think they are safe to click on. All the money and effort for training, right in the shit can. Thanks Microslop!

The DNC also reported the matter to law enforcement, said the official, who stressed that the committee utilizes thorough training and security protocols to defend against fraud and other nefarious activity.

Those protocols obviously need a bit of a review. Though, my bet is on Martin being one of those leaders who regularly doesn’t follow protocol and throws a tantrum when other people try to insist he does. This sort of failure happens because the staffers are more afraid of pissing off the tantrum thrower than breaking protocol.

Don’t worry, it’s still in the oven.

I certainly won’t own a Mac.

So long as the demand exists and there is enough money behind that demand, eventually someone will step up to fulfill it. Taking down the Epsteins of the world does little to alleviate the harm, so long as the rapists they enable don’t end up in the ditch next to them.

This article reads like AI slop and/or a thinly veiled advertisement for a vulnerability scanning products.
Yup, configuration drift happens and you should be scanning your assets constantly. This was news circa 2006. A couple decades on, your systems are regularly being scanned for vulnerabilities. Ideally, you’re doing this yourself as well.

A 500 error is generally a server side error. If you have tried multiple images and aren’t using some oddball format (use the Linux “file” command to validate the image format). Then I’d reach out to the server admin.

AI

Are you really worried about the case where a thief steals the hard drive but not the rest of the computer?

Even if the thief steals the entire computer, BitLocker/LUKS and SecureBoot provide a reasonable level of protection against data theft. Yes, the drive (or bits of it anyway) are automatically decrypted (the whole drive is never decrypted, just the data requested by the OS). However, it still prevents the attacker from accessing that data outside the intended operating system, which makes data theft much harder. An attacker would also need a valid account to login to the system to start accessing data. It’s not an insurmountable hurdle, but it does mean that just having the computer isn’t the same as having the data.

Without encryption, once a thief has the computer, they have the data. They don’t need a valid account to access the data and they can even boot into a tool to reset passwords on the primary OS and start using it. Last I checked, chntpw still works with Windows 11. That sort of thing fails with encryption, even with TPM only. The TPM will not release the encryption key to an OS if SecureBoot fails. Granted, there is the YellowKey backdoor, but that was probably Microsoft giving the FBI a helping hand. But, that falls outside the intended design.

How would that even work? It’s literally a PC. It runs Linux. It’s as open a system as you’re going to get.

They are getting educated on just how bad of a choice Trump was.