2026-03-30T06:38:55Z https://yabu.me dragosr https://yabu.me/npub1un3szgch6zp2l74k954fw0cj7c5vmpf9wqq2pswyjjkwe6k2pe0s5xuqv2 https://assets.chaos.social/accounts/avatars/108/217/069/875/071/700/original/d68a3040d515680f.png https://assets.chaos.social/accounts/avatars/108/217/069/875/071/700/original/d68a3040d515680f.png https://yabu.me/nevent1qqswhrkwnpyppzqy3xs3p4jdplqmngzh0ftrnp7eg2gkka0llnleg8czyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg8970vy7lc A walkthrough on patching Dell UEFI firmware at the SPI flash level to disable pre-boot DMA protection — bypassing the BIOS password entirely. The interesting part: the UEFI UI still reports the setting as enabled, and TPM measured boot doesn&#39;t detect the NVRAM change, so BitLocker unlocks normally. The patch also persists through official Dell BIOS updates. From there it&#39;s DMAReaper to kill IOMMU + PCILeech for a SYSTEM shell. Significant measured boot policy gap. <a href="https://www.mdsec.co.uk/2026/03/disabling-security-features-in-a-locked-bios/">https://www.mdsec.co.uk/2026/03/disabling-security-features-in-a-locked-bios/</a> 2026-03-29T21:06:01Z https://yabu.me/nevent1qqszqnzmzgjtgqxyfw2hz5sjfdjalfqw6tl98zxmlp346d9evgvsc2szyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897lk4fhs In reply to <a href='/nevent1qqs87htskdwwsvrzpc476q7xnnztczcafy0ev4fc4jucada9fx3qlxqp5dlp7'>nevent1q…dlp7</a><br/>_________________________<br/><br/>Who cares? The new models are awesome. A new performance benchmark. 2025-08-08T07:28:32Z https://yabu.me/nevent1qqsx0cf6pg0xw9x0lwsxjhscg753nmxzq7syrvnsugavku2njat6ptszyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897f3vej6 Trivially spoofed packets from an SDR can derail trains.<br/><br/>It&#39;s a seriously low bar for attackers and I&#39;m so glad Neil is finally getting some folks to pay attention.<br/><br/><a href="https://www.theregister.com/2025/07/14/train_brakes_flaw/">https://www.theregister.com/2025/07/14/train_brakes_flaw/</a> 2025-07-14T21:44:35Z https://yabu.me/nevent1qqswplhhyfh8c0w6g8z32lectznlkspzrdx59q6fa22fuzvujp6m88szyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897rzl2rk Critical Meshtastic Vulnerability: <br/><br/>CVE-2025-52464: Meshtastic 2.5.0–2.6.10 shipped cloned or low-entropy X25519 keys via vendor pre-flash + weak RNG.<br/><br/>Collisions let attackers decrypt LoRa direct-msgs, replay/forge admin RPCs, hijack nodes; no forward secrecy, so old captures stay cleartext. <br/><br/>Firmware 2.6.11 defers key-gen, hardens entropy, flags compromised pairs. <br/><br/><a href="https://mander.xyz/post/32783704">https://mander.xyz/post/32783704</a> 2025-06-26T06:36:21Z https://yabu.me/nevent1qqs8r02l3c5knw874dlfg9qs4yfd0egwaaztt8dx7qt5ss4g3u7nc3czyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897hw47qt Time to update microcode on your Intel processors (gen &gt;9)...<br/><br/>New speculative prediction bug lets you capture /etc/shadow with 99% reliability. They didn&#39;t make anything like it work on AMD or ARM... yet...<br/><br/><a href="https://comsec.ethz.ch/research/microarch/branch-privilege-injection/">https://comsec.ethz.ch/research/microarch/branch-privilege-injection/</a><br/><br/><a href="https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01247.html">https://www.intel.com/content/www/us/en/security-center/advisory/intel-sa-01247.html</a><br/><br/><a href="https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20250512">https://github.com/intel/Intel-Linux-Processor-Microcode-Data-Files/releases/tag/microcode-20250512</a> 2025-05-13T16:57:44Z https://yabu.me/nevent1qqsz9dn6mf3y4p0c9xf8pdqhqrwwfynxrh4jqzz36jzakj0w8yjtz9qzyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897g9jkwq The Czech Republic, Ukraine joint satellite reconnaissance project sucessfully launched TROLL satellite, developing the higher-resolution Drak satellite, to provide Ukraine with independent, high-quality optical intelligence to enhance defense capabilities, autonomy.<br/><br/><a href="https://news.satnews.com/2025/03/26/first-satellite-of-planned-czech-ukrainian-network-launched/">https://news.satnews.com/2025/03/26/first-satellite-of-planned-czech-ukrainian-network-launched/</a><br/> <img src="https://assets.chaos.social/media_attachments/files/114/232/073/566/842/818/original/289dc74d7833b4d5.png"> <br/> 2025-03-27T02:39:09Z https://yabu.me/nevent1qqs2m0nyn3swdfkc84f2nw5rx5382ens24sljwhm926t3lzefw4gsvczyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897qyut7t Oh, is that all? A few (billion?) ESP32 devices let attackers establish persistency in local flash using an undocumented commands set accessible from an over the air pivot, and low level protocol injection and spoofing control...<br/><br/>ESP32 chips have 29 undocumented Bluetooth vendor-specific HCI commands (0xFC01–0xFC44) allowing direct RAM/Flash access, MAC address spoofing, injecting LMP and LLCP packets, direct Bluetooth register manipulation. <br/><br/><a href="https://tinyurl.com/ESP32-backdoor">https://tinyurl.com/ESP32-backdoor</a><br/><br/><a href="https://tinyurl.com/esp32bd">https://tinyurl.com/esp32bd</a> 2025-03-08T23:03:59Z https://yabu.me/nevent1qqsg54u6s3dc2sfagu9uu05yyvvrmn48rx8ws9ts2nw7vvsjlx4lfzgzyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897cnkz6m Framework Desktop: It&#39;s not a $3k 1Petaflop 128k Blackwell DIGITS, but it does have Strix Halo/Ryzen AI Max+ 395 unified memory(DDR5x tho) with a 256 wide bus soldered memory on the board - capability that would cost $6k in a Macbook for $2k.<br/><br/>New Framework desktop, engineering sample torn down by iFixit - skip to 7:20.<br/><br/><a href="https://www.youtube.com/watch?v=5mGzEsRM3hs&amp;t=553s">https://www.youtube.com/watch?v=5mGzEsRM3hs&amp;t=553s</a> 2025-03-01T04:14:53Z https://yabu.me/nevent1qqsdg89p7d8l54x0mm034c3rxf95qel6cgk4mgj3f4mdu5k9wd2vxdczyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg8978dn0va Admittedly below our already not high expectations for a WiFi accessible space heater:<br/><br/>An unverified OTA update process in a Govee smart space heater—using HTTP with weak integrity checks (a simple checksum and HMAC with a hardcoded key)—allows MITM attackers to inject modified firmware, enabling arbitrary control or bricking. Exposed debug interfaces with weak credentials compound the vulnerability.<br/><br/><a href="https://blog.includesecurity.com/2025/02/replacing-a-space-heater-firmware-over-wifi/">https://blog.includesecurity.com/2025/02/replacing-a-space-heater-firmware-over-wifi/</a> 2025-02-05T01:50:52Z https://yabu.me/nevent1qqsdwnny3y4s0x05fuvupw0c8juhanvmy8sfxfudk42vzhp5xjdad2szyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897gg0m2h Congratulations to the new American administration, achieving something no Canadian politician has been able to - rallying the entire country around the flag. <br/><br/>Uniting BC&#39;s left wing Eby, Ford&#39;s right wing Conservatives, Trudeau/Carney&#39;s centrist Liberals, even separatist CAQ François Legault saying Quebec must stand together with the rest of Canada and fight (!!!). <br/><br/>I don&#39;t think we have seen ALL of Canada synchronize and unify like this to respond to a threat since WW2. 2025-02-02T19:41:29Z https://yabu.me/nevent1qqsgk50e7qya3nvmkre94cc6lzy943sezvjgmzjgdjxfy0vtp066vnszyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897tlczma The CCC 38 Saal1 Presentation - BlinkenCity: Radio-Controlling Street Lamps and Power Plants by Fabian Bräunlein and Luca Melette<br/><br/>...on reversing streetlamps, ripple controls, Versacom and Semagyr, power gear, smart meters, controlling FREs with flashlights and flipper zero&#39;s(!), was a tour de force in reverse engineering, critical infrastructure risk analysis, and hacking excellence. If you use electricity or streets, you should watch it.<br/><br/><a href="https://fahrplan.events.ccc.de/congress/2024/fahrplan/talk/HSNZGR/">https://fahrplan.events.ccc.de/congress/2024/fahrplan/talk/HSNZGR/</a><br/> <img src="https://assets.chaos.social/media_attachments/files/113/732/713/711/284/922/original/6cb1d5a8ad4eb2b8.jpg"> <br/> 2024-12-28T22:06:09Z https://yabu.me/nevent1qqsd3rpawmete9lxpd07ndvmpc8j3lz0sk4c9xk7nxqgt7yx5se7nzgzyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897wcq9cx In reply to <a href='/nevent1qqsvym2z73vl3hdccr57pjxc6687cv7pvdztda3r6attlv3e4zsf3zqkr0vvh'>nevent1q…0vvh</a><br/>_________________________<br/><br/>right after you band screwdrivers. 2024-11-29T20:53:36Z https://yabu.me/nevent1qqswqtlvndjh39u7mvsp934rdqz23tw00qe8rd9ljh3puc5ty283zqgzyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897vlhucl Trying to extend reach of GDPR to BlueSky LLM training is problematic. Data is declared public, so free to train on it. The problems start trying to claim GDPR rights *after the data is no longer needed.*<br/><br/>The GDPR right to access, erasure, and modification do not extend to mandated memory wipes for any human who has ever viewed(processed) the data. It&#39;s unreasonable, and technically infeasible, to expect that kind of access to LLMs.<br/> <br/>Significant technical and legal challenges are coming up. 2024-11-29T20:52:01Z https://yabu.me/nevent1qqspgceem3znqpel5h74n8u60x77g3dhxhterd3gt4mmzzkv74p6htgzyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897lxss7a For those going home to visit family this weekend:<br/><br/>• Samsung calls it Auto Motion Plus<br/>• LG calls it TruMotion<br/>• Sony calls it Motionflow<br/>• Roku calls it Action Smoothing<br/>• Google TV calls it Motion Enhancement<br/>• Vizio calls it Smooth Motion Effect.<br/>• Panasonic calls it Intelligent Frame Creation (IFC)<br/>• Philips calls it Perfect Natural Motion<br/>• Sharp calls it AquoMotion<br/>• Toshiba calls it ClearScan<br/>• JVC calls it Clear Motion Drive<br/>• Magnavox calls it Perfect Pixel HD 2024-11-28T01:04:01Z https://yabu.me/nevent1qqspwv9z6mrxl6xq8pjjpswm7hykucwedcwyhtdj8fp35kjvvvcz66czyrjwxqfrzlgg9tl6kckj49elztmz3nv9y4cqpgxpcj22em82eg897y3fyk2 D-Link tells users to trash old VPN routers over bug too dangerous to identify.<br/><br/>Hopefully folks realize they should replace it with another vendor.<br/><br/>This vuln was covered at DEF CON 32 by Sam Curry. TR-069 is an admin access protocol that lets DLink work with your router remotely (reset device, etc.). Bad actors use spoofed requests to change config data, read the MAC address, monitor traffic, and use them as botnets. TR-069 is industry standard<br/><br/> <a href="https://www.theregister.com/2024/11/20/dlink_rip_replace_router/">https://www.theregister.com/2024/11/20/dlink_rip_replace_router/</a> 2024-11-20T16:19:02Z