cybergibbons

7 ms·

1.
by cybergibbons 5y ago
The problem is, people are using solely what3words for location. Every single call recording to emergency services doesn't use any other information. The odds are around 1 in 24 that you hit one of these squares in London.
2.
by cybergibbons 5y ago
Yeah, that's not true. https://cybergibbons.com/security-2/why-what3words-is-not-su...
3.
by cybergibbons 5y ago
Yes, that's pretty much the definition of incorrect.
4.
by cybergibbons 5y ago
Old skool! Those were the days :)
5.
by cybergibbons 5y ago
A design requirement of the app is it works offline.
6.
by cybergibbons 5y ago
Your surface area is totally incorrect.
7.
by cybergibbons 5y ago
Only with a ridiculously long word list containing plurals and words people can't spell.
8.
by cybergibbons 5y ago
Yeah, multiple MRT members have contacted me to say this is a real struggle. If someone is on the move, it's virtually impossible to work out what direction they are going.
9.
by cybergibbons 5y ago
It's promoted for use in search and rescue, so other bands are in use.
10.
by cybergibbons 5y ago
Why 3 words? Why not 4?
11.
by cybergibbons 5y ago
You would still get high densities of cells which share two words being present close together, leading to any issue with the third word causing a confusing location.
12.
by cybergibbons 5y ago
No, I went from the patent and using the API instead: https://twitter.com/cybergibbons/status/1386344576856825858 https://twitter.com/cybergibbons/status/1386393951276609539 https:&#x2F
13.
by cybergibbons 5y ago
The word list already is 40k long. That's beyond most people's vocab and includes really awkward to spell words. IMO, if the solution is to use words, then What4Words would have had a word list of less than 3000, resulting in a wo
14.
by cybergibbons 5y ago
Two reasons: 1. It needs to be reversible so you can go from words to lat/lon. 2. They wanted to use shorter words in cities, so the distribution of low n didn't want to cover the full range of m. (this could probably be solved by
15.
by cybergibbons 6y ago
Yes, sorry, added that bit on my phone when out and about and made a mistake. Corrected.
16.
by cybergibbons 6y ago
RTCs are actually quite rare, especially in a lot of the lower power RF SoCs. Drift would also be an issue - most move at least 10 minutes a year. That's with good temperatures, not being left in a hot car or at body temp. If you could
17.
by cybergibbons 6y ago
Is CTR more common?
18.
by cybergibbons 6y ago
I've added a section on padding oracle attacks towards the bottom. I don't think there's a significant different in ease of understanding between most of the modes. I used CBC as it's one of the most common and familiar
19.
by cybergibbons 6y ago
I considered using a padding oracle attack in the post, but it's aimed at a very basic level of understanding. I find padding oracles are much harder to describe to newcomers. Also, the XOR malleability issue is present in lots of bloc
20.
by cybergibbons 9y ago
Why do you need to spend money to use HTTPS with IoT?
21.
by cybergibbons 9y ago
Less well tested than OpenSSL, but historically has been relatively secure.
22.
by cybergibbons 9y ago
Specifically, in the case of the firmware running on the Trådfri gateway, it already supports TLS.
23.
by cybergibbons 10y ago
No, unfortunately not. We had to do it all black box as it was on sale or return, so couldn't inspect the firmware to find vulns. It was runnign Tizen, which makes things a lot harder than Android. We did get some minor vulns on the LG
24.
by cybergibbons 10y ago
I did the work on this. Yes, the much bigger threat is taking control of these devices and using them as a pivot. We've done this for IP cameras, DVRs etc. It doesn't seem to engage the media or the public. The ransomware has thou
25.
by cybergibbons 10y ago
I did the work on this. It wasn't really meant to be a practical attack. It was largely because there has been speculation around this for the last few years, so we thought we'd actually do it. It's largely to raise awareness
26.
Hacking the Mitsubishi Outlander PHEV hybrid(pentestpartners.com)
59 points by cybergibbons 10y ago|21 comments
27.
by cybergibbons 11y ago
Yes - his GitHub actually had the repo for this in the past. Someone reported the issue on there before I found it.
28.
by cybergibbons 11y ago
Yes, the device has reference to Esee and IIRC it sends XML data to their server. I didn't look into that as the other stuff meant it was game over.
29.
by cybergibbons 11y ago
Thanks, updated the post.
30.
by cybergibbons 11y ago
Possibly. Part of the problem though is that there is not a full toolchain. You could replace the DVR app, but the OS is still going to be crap. I had a very quick go at updating the firmware with Juantech and it failed. There is some check

More ›