Look at some raspi boot dmesgs and you will get what I'm talking about. I do that so often I can sometimes pick out lines that are wierd as it scrolls by even. Please stop being patronizing. Maybe these folks are already on your some of your computers. Would you know?
-
-
Replying to @dragosr @AndreaBarisani and
I'm still waiting for a single piece of verifiable evidence that something is out of place. Where are these "weird" boot logs? Perhaps you should start considering that if everyone else can find a benign explanation for everything you point out, maybe the problem is in your head.
3 replies 0 retweets 2 likes -
Replying to @marcan42 @AndreaBarisani and
You seem to think my job is to convince you. My task's securing my computers. Ocasionally advice for others own good/public benefit. And pick big problems/threats for conferences so folks can work on. You think I'm crazy? Enjoy life in the Prepositioned Cyberasset Club.
1 reply 0 retweets 0 likes -
Replying to @dragosr @AndreaBarisani and
*My* job is security, and when stuff like BadBIOS makes headlines it's an embarrassment to my field. *You* have a delusional paranoia problem, and I'm trying to help you because otherwise you'll convince other, less clueful people of your nonsense and it'll spiral out of control.
3 replies 0 retweets 4 likes -
Replying to @marcan42 @AndreaBarisani and
Meanwhile I consider such obliviousness to advanced attackers somewhat embarrasing. I think we have detente.
1 reply 0 retweets 0 likes -
Replying to @dragosr @AndreaBarisani and
I'm cognizant of advanced attackers. They just don't happen to be your problem. Your problem is delusional paranoia.
1 reply 0 retweets 1 like -
Replying to @marcan42 @AndreaBarisani and
Really now? When was the last time you analyzed a rootkit on your machine? Caught any APTs and learned any cool new tricks from them lately? That's the fun part when they suprise you. But it sounds like you'd rather stay sleepy and oblivious.
1 reply 0 retweets 0 likes -
Replying to @dragosr @AndreaBarisani and
You see, my thing happens to be *hardware* security, not soft APTs. Which is what *you're* stumbling through, cluelessly mistaking every second triviality for an IOC. I have no idea how to analyze Windows kernel rootkits but I can damn well tell you your scope traces are normal.
2 replies 0 retweets 1 like -
Are machines compromised? Who knows, but I am carefully observant of their behavior and have no reason to believe that they are. But if I *had* a reason, I wouldn't be tweeting mains noise scope traces. Within 24 hours the world would have IDBs of whatever it was if it were real.
2 replies 0 retweets 2 likes -
Because this *is* my field, I've pentested SoCs and embedded devices, I know where you can hide things and where you can't, I know how Flash memory buses work, I have the tools and I know how to use them. And *you* clearly don't.
2 replies 0 retweets 1 like
APTs may be "A" but they aren't magic. If the pwnage is ephemeral, it *goes away after a power cycle and then your machine is clean*. If it's persistent, *you dump Flash and it's there*. There's no magic third option.
-
-
Replying to @marcan42 @AndreaBarisani and
Oh how limited your threat models are. Almost comically so. Dump flash. Lets see, using that arm32/8051 executing that code blob you can't read back, and can't even reprogram reliably at the high addresses on the flash chip on the SD/USB, that maintains that scrambled block map.
1 reply 0 retweets 0 likes -
Replying to @dragosr @AndreaBarisani and
I said "dump flash", not "use an SD card reader". That means hook up a programmer to the raw flash, where discrete. Or, if you think the issue is a compromised highly integrated microSD card, just sniff the bus with an FPGA and transparently log all reads/writes.
1 reply 0 retweets 1 like - Show replies
New conversation -
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.