supernetworks

7 ms·

1.
by supernetworks 6mo ago
Another favorite, https://www.synacktiv.com/publications/cool-vulns-dont-live-... the router sniffed plaintext http to grab HTTP User agents to put them into a curl bash command line string. Nice RCE from the browser.
2.
by supernetworks 6mo ago
Not a bot. Anyway if you have questions about router security rather than moderation happy to "delve" into that.
3.
by supernetworks 6mo ago
Supernetworks -- ill update. Our initial comment got moderated for too much self promotion so also apologies there and again for anyone who is offended
4.
by supernetworks 6mo ago
You can check our comment history https://news.ycombinator.com/threads?id=supernetworks
5.
by supernetworks 6mo ago
Thanks Tom. This whole comment thread is a bit of a dumpster fire of opinions however we have been working on the wifi security problem for a long time and we have a lot to say about it. Router manufacturers competing into involution that s
6.
by supernetworks 7mo ago
Yep, unfortunately fuzzy. For enterprise wifi deployments, one amusing thing to do when configuring 802.1X is to test ARP spoofing the upstream radius server after associating, and self-authenticate. It might be interesting to go and apply
7.
by supernetworks 7mo ago
Some 802.1x have inherent mitm attacks that have been called out since 2004 and never got the v2 ( https://www.rfc-editor.org/rfc/rfc6677.html ). EAP-TLS however is the best practice here + VLANs.
8.
by supernetworks 7mo ago
Hostapd now has support for multi pass SAE /WPA3 password as well. We have an implementation of dynamic VLAN+per device PSK with WPA3 ( https://github.com/spr-networks/super ) we've been using for a few years n
9.
by supernetworks 7mo ago
This attack exploits multi PSK networks precisely. If it's all one PSK the attacker can already throw up a rogue AP for WPA3 or just sniff/inject WPA2 outright. The back half of a secure multi PSK setup is deploying VLANs for segm
10.
by supernetworks 7mo ago
This is mostly accurate, to clarify the association IDs tie into what VLANs will be assigned and that does block all of the injection/MITM attacks. This also assumes that the VLAN segments are truly isolated from one another, as in the
11.
by supernetworks 7mo ago
EAP TLS provides strong authentication, is much better than the other enterprise authentication options, but will not block these lateral attacks from other authenticated devices. The second half of the deployment is putting each identity i
12.
by supernetworks 9mo ago
yes understood, the first article isn't the main subject of the article.
13.
by supernetworks 9mo ago
by complexity class that would be consensus, although the argument for building BPP systems is about the energy cost being orders of magnitude less and perhaps also some polynomial speedup
14.
by supernetworks 9mo ago
yes, this paper is the main subject of the article
15.
by supernetworks 9mo ago
A direct equivalent, no, as stated in the introduction. "Notably, while probabilistic computers can emulate quantum interference with polynomial resources, their convergence is in general believed to require exponential time [10]. This
16.
by supernetworks 9mo ago
Some of the properties of fil-c managed heaps are very similar to what CHERI can do with Cornucopia by the way: see https://dl.acm.org/doi/10.1145/3620665.3640416
17.
by supernetworks 9mo ago
tragically, this is exactly what it is
18.
by supernetworks 1y ago
"given that destroying the correlation between two entangled particles" i think this is the assumption that is easy to make without digging deeper into entanglement. i am still in the process of reading this article ( https:/
19.
by supernetworks 1y ago
We have a similar container @juhovh, for a plugin for the router we work on. in case this is helpful for you, feel free to to review https://github.com/spr-networks/spr-tailscale/blob/main/Dock...
20.
by supernetworks 1y ago
A particularly tricky exploit in the linux futex implementation from 2014, by Pinkie Pie, https://issues.chromium.org/issues/40079619 "The requeue-once rule is enforced by only allowing requeueing to the futex pre
21.
by supernetworks 1y ago
encrypted DNS goes a long way towards mitigating this as well.
22.
by supernetworks 1y ago
Novel or not, this seems like it can be actively exploited?
23.
by supernetworks 1y ago
It is a book, "Underground: Hacking, madness and obsession on the electronic frontier". I seem to recall cross it hosted under mit.edu/~hacker/underground.txt or something like that
24.
by supernetworks 1y ago
This is not unlike the surprise in underground.txt when mendax & co discover that curiosity is not the only state of existence for being a hacker. https://www.gutenberg.org/cache/epub/4686/pg4686.txt &quo
25.
by supernetworks 3y ago
Yes -- except for limited wireguard support, usability for multicast is mostly solved. SPR services mDNS and Zeroconf/SSDP with a udp proxy[1]. [1] https://github.com/spr-networks/super/blob/main/mul
26.
by supernetworks 3y ago
We designed SPR to address problems with wifi isolation. Every wifi device runs in an isolated subnet and individual VLAN. Mac spoofing is not possible since a device's MAC identity is combined with a device-specific PSK. You can check