HP iLO4 authentication bypass: curl -H "Connection: AAAAAAAAAAAAAAAAAAAAAAAAAAAAA" No, that's not a crash PoC. That's a full blown auth bypass. sscanf into fixed buffer overwrites a flag field that bypasses auth. Yes, really. https://airbus-seclab.github.io/ilo/SSTIC2018-Slides-EN-Backdooring_your_server_through_its_BMC_the_HPE_iLO4_case-perigaud-gazet-czarny.pdf …
-
Show this thread
-
-
But I'm writing an AAA system...
1 reply 0 retweets 1 like -
An AAA system, or an AAAAAAAAAAAAAAA system? Seriously, unless that's the product you're producing... Maybe anything else will hold higher margins and lower liabilitypic.twitter.com/SWHhZVKsXX
1 reply 0 retweets 2 likes -
It's actually intended as a dedicated open source AAA/SSO system, so yeah.
1 reply 0 retweets 0 likes -
Well, we each answer our calling as we are able. The space is certainly a shitshow right now ( with a few gems ).pic.twitter.com/lXvEolHMte
1 reply 0 retweets 0 likes
In my defense, I'm at least writing it in Rust. So there's that.
3:41 PM - 21 Jun 2018
0 replies
0 retweets
1 like
Loading seems to be taking a while.
Twitter may be over capacity or experiencing a momentary hiccup. Try again or visit Twitter Status for more information.