Onno (VK6FLAB)

Anything and everything Amateur Radio and beyond. Heavily into Open Source and SDR, working on a multi band monitor and transmitter.

#geek #nerd #hamradio VK6FLAB #podcaster #australia #ITProfessional #voiceover #opentowork

  • 27 Posts
  • 790 Comments
Joined 2 years ago
cake
Cake day: March 4th, 2024

help-circle

  • From a security perspective I’d be surprised if number of mentions as a metric has any bearing whatsoever on the impact or urgency of a CVE.

    If you’re using mentions as a proxy for affected user base, I’d hazard an opinion that there are better ways of determining the impact footprint of a CVE.

    Finally, a vulnerability rating or priority is determined and published with each CVE, so I’d expect that this would take into account some of those considerations.

    That said, a vendor ranking seems like something that I’ve not seen before, mind you, the notion that Microsoft didn’t make it into the list is gobsmacking considering that patch Tuesday addressed 81 flaws and 2 zero-days in September.

    In my opinion, he idea seems useful, but the execution needs some work.


  • This seems at first glance at least potentially doable.

    Create a website with content that’s only rendered with JavaScript and embed a miner.

    Your challenge is to get the work product back, but you might be able to create dynamically generated URLs that show up in your logs as the work result.

    You’d have to find a way to chunk the work and make it such that the work required is enough to be valuable to you, but not so costly as to stop the crawlers from using your site.

    I suspect that in order for this to actually happen you’d have to have a significant infrastructure to deal with the crawler load, which you could instead be using to do the actual work.

    Ultimately I suspect that this is the software equivalent of a perpetual motion machine, cute in theory, physically impossible.

    Good luck!





  • What’s unclear from the article is what exactly is being disrupted, since microwave radiation (from your microwave oven) is on the same frequency band as 2.4 GHz WiFi, which provides one potential failure mode for a remotely operated drone. Specifically the disruption of communication between the drone(s) and the controller.

    However, if the drone is autonomous and not using WiFi at all, the same 2.4 GHz frequency is unlikely to cause damage, unless it’s inducing currents in the on-board CPU or other circuits. This is an entirely different failure mode.

    A comment in the article mentions that the drone returns to a safe area, which is what tends to happen if WiFi connectivity is lost.

    Furthermore, there’s no information about the actual “microwave frequency”, which goes well beyond 2.4 GHz, technically ranging between 300 MHz and 300 GHz.




  • The Australian government has just emailed the following:

    ASD’s ACSC is aware of targeting of multiple vulnerabilities within Australia impacting Cisco ASA 5500-X Series models, that are running Cisco ASA Software or FTD software:

    CVE-2025-20333 (Critical) – A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an authenticated, remote attacker to execute arbitrary code on an affected device.

    CVE-2025-20363 (Critical) – A vulnerability in the web services of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software, Cisco Secure Firewall Threat Defense (FTD) Software, Cisco IOS Software, Cisco IOS XE Software, and Cisco IOS XR Software could allow an unauthenticated, remote attacker (Cisco ASA and FTD Software) or authenticated, remote attacker (Cisco IOS, IOS XE, and IOS XR Software) with low user privileges to execute arbitrary code on an affected device.

    CVE-2025-20362 (Medium) – A vulnerability in the VPN web server of Cisco Secure Firewall Adaptive Security Appliance (ASA) Software and Cisco Secure Firewall Threat Defense (FTD) Software could allow an unauthenticated, remote attacker to access restricted URL endpoints that should otherwise be inaccessible without authentication.

    A number of versions of Cisco software releases are affected, including those within the following ranges:

    Cisco ASA Software releases 9.12 to 9.23x and; Cisco FTD Software releases 7.0 to 7.7x.

    Please see

    https://sec.cloudapps.cisco.com/security/center/resources/asa_ftd_continued_attacks for specific version details.

    Cisco reports active exploitation of these vulnerabilities has been observed globally.












  • Except that in civil discussion with experts, other ideas are what helps people arrive at a solution suitable for them and their situation.

    I’ll also add that I’ve been a Linux user for 25 years and the toxicity you claim in relation to the Linux community is in my experience not evident as a “major reason”, instead I’ve found it to be innovative and flexible with a wide perspective and approach to problem solving.

    Are there dickheads in the Linux community? Yes, just like there are everywhere in society.