I remember sharing this with @rossjanderson & Ross gleefully ran off to write it up in a book. ISTR the afflicted product was CheckpointFW1?
Back at #SunMicrosystems, we used to call this the "Cinderella Attack" - worked on Firewalls with licenses & insecure/old NTP.https://twitter.com/VickerySec/status/886290921381179392 …
-
-
-
Probably with FLEXlm license manager? Not sure about that. But it was hilarious, and moreso that the same old bugs happen time & again.
-
I'm pretty sure it was Brad Powell of Sun NSG who came up with the name; "wind the clock toward midnight, and the FW turns into a pumpkin…"
-
In fact I can cite it as 1997, when I gave this presentation to the Cambridge Security Lab: https://dropsafe.crypticide.com/alecm/presentations/1997-programming-goofs/slides.pdf …pic.twitter.com/M09oe9IQkU
-
Thinking about it some more, the book in question was likely the opus Security Engineering, v1, and lo! - https://www.cl.cam.ac.uk/~rja14/Papers/SE-06.pdf …pic.twitter.com/A7kPvbHGsR
End of conversation
New conversation -
-
-
If you can spoof GPS messages, there is much more damage you can do than turn off stingray, no?
-
Another way to turn off (some models of) StingRay is to call 911. But that's a poor strategy for someone trying to hide from the cops.
-
JI: my understanding is that GPS is so wideband that to spoof it effectively requires a very local transmitter, so geolocalising shenanigans
-
If the state of the art has progressed, then that's much more interesting.
End of conversation
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.