Shakedown Social

0 posts0 participants0 posts today

Kevin Karhan :verified:<a href="https://mastodon.social/@mrgrumpymonkey" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@mrgrumpymonkey</a> it is.One can repartition Windows installations on the fly whilst running (and even then there are tools like <a href="https://infosec.space/tags/Wubi" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Wubi</a> that made it easy to setup <a href="https://infosec.space/tags/dualboot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#dualboot</a> <a href="https://infosec.space/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> & <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a>.<ul><li>ISOLINUX does allow for "load image into RAM and boot" setups. I literally use that on <a href="https://infosec.space/@OS1337" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@OS1337</a> because no system that can boot it will have > 16 MB RAM anyway ( 8 MB is the hard limit for bare linux kernel) so merely making Windows' bootloader to chainload <a href="https://infosec.space/tags/isolinux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#isolinux</a> to load that image in RAM and yeet it isn't out of the question.</li></ul>I just have neither a <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> machine nor time and spoons to make such a tool, much less to basically create even said <a href="https://infosec.space/tags/ProofOfConcept" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ProofOfConcept</a> "<a href="https://infosec.space/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a>"…<ul><li>But thanks to <a href="https://infosec.space/tags/GoldenKeyBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GoldenKeyBoot</a>, <a href="https://infosec.space/tags/CensorBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CensorBoot</a> is unfixably insecure!</li></ul>

Kevin Karhan :verified:<a href="https://hai.z0ne.social/@kura" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@kura</a> <a href="https://catgirl.center/@lexi" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@lexi</a> basically<a href="https://infosec.space/tags/Government" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Government</a> + <a href="https://infosec.space/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a>.After all, <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> incudes not just the <a href="https://infosec.space/tags/_NSAKEY" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#_NSAKEY</a> and <a href="https://infosec.space/tags/GoldenKeyBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GoldenKeyBoot</a> <a href="https://infosec.space/tags/backdoors" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoors</a> but <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> is a <a href="https://infosec.space/tags/PRISM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PRISM</a> collaborator and falls under <a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CloudAct</a>, thus is not more trustworthy than [insert random tech company from "P.R." China here]...

Kevin Karhan :verified:<a href="https://social.hackingand.coffee/@hon1nbo" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@hon1nbo</a> <a href="https://digipres.club/@foone" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@foone</a> yeah, but all these things would essentially necessitate a fundamentally incompatible <a href="https://infosec.space/tags/Fork" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Fork</a> of the <a href="https://infosec.space/tags/USB" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#USB</a> standard, creating <a href="https://infosec.space/tags/costs" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#costs</a>, <a href="https://infosec.space/tags/fragmentation" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#fragmentation</a> and lessen the likelyhood of success.<ul><li>Not to mention it'll require significant investments in <a href="https://infosec.space/tags/UserAwareness" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#UserAwareness</a>, <a href="https://infosec.space/tags/Training" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Training</a> and would still have some issues...</li></ul>I gues a sort-of "Secure HID Port" that mandates proper authentification and does full <a href="https://infosec.space/tags/E2EE" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#E2EE</a> from the Keyboard Matrix / Pointing Device controller up is an option, but you'd have to expect state-sponsored attackers willing to do <a href="https://www.youtube.com/watch?v=RyW0lXnoFOA" rel="nofollow noopener noreferrer" target="_blank">"Kamikaze" Hacks</a>...<ul><li>There's like a <a href="https://www.youtube.com/watch?v=U7VwtOrwceo&t=4m5s" rel="nofollow noopener noreferrer" target="_blank">long talk</a> by <a href="https://infosec.space/tags/TonyChen" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TonyChen</a> from <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> explaining how they secured the <a href="https://infosec.space/tags/XboxOne" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#XboxOne</a>.</li></ul><a href="https://infosec.space/tags/TLDW" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TLDW</a>: <a href="https://www.youtube.com/watch?v=U7VwtOrwceo&t=11m2s" rel="nofollow noopener noreferrer" target="_blank">It requires custom silicon and a hard root of trust</a>…<ul><li>And as we saw with <a href="https://infosec.space/tags/GoldenKeyBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GoldenKeyBoot</a> all it takes is a single <a href="https://infosec.space/tags/leak" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#leak</a> of a <a href="https://infosec.space/tags/PrivateKey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PrivateKey</a> and that entire system is fucked!</li></ul><a href="https://infosec.space/@kkarhan/113716442182953660" translate="no" rel="nofollow noopener noreferrer" target="_blank">https://infosec.space/@kkarhan/113716442182953660</a>

Kevin Karhan :verified:<a href="https://transfem.social/@puppygirlhornypost2" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@puppygirlhornypost2</a> <a href="https://social.vlhl.dev/users/navi" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@navi</a> And whilst it's easy to blame <a href="https://infosec.space/tags/GoldenKeyBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GoldenKeyBoot</a>, a leaked <a href="https://infosec.space/tags/PrivateKey" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PrivateKey</a> that was impossible to be removed, the problem is that <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> is architecturally "insecure-able" because any changes necessary to make this not a problem would inherently mean the end for Windows as it's known to most.<ul><li>In fact, everything is done better by <a href="https://infosec.space/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> on the <a href="https://infosec.space/tags/Desktop" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Desktop</a> for almost two decades, which is why classic <a href="https://infosec.space/tags/Malware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Malware</a> isn't a thing on Linux systems.</li></ul>Shure, you get some <a href="https://infosec.space/tags/Cryptojacking" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Cryptojacking</a> and some <a href="https://infosec.space/tags/CMS" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CMS</a>|es like <a href="https://infosec.space/tags/WordPress" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WordPress</a> that are constantly being attacked but generally, the way <a href="https://infosec.space/tags/updates" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#updates</a> and <a href="https://infosec.space/tags/distribution" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#distribution</a> of <a href="https://infosec.space/tags/Software" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Software</a> works on Linux Distros for the most part is completely antithetical to Windows.<ul><li>And that's how we got <a href="https://www.stickycomics.com/computer-update/" rel="nofollow noopener noreferrer" target="_blank">this realistic scenario</a></li></ul>And anything <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> could do at this point if they weren't horny for money but avtually cared is to scrap Windows and instead invest into <a href="https://infosec.space/tags/Wine" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Wine</a> to ease the transition...

Kevin Karhan :verified:<a href="https://eightpoint.app/@JenWithGravy" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@JenWithGravy</a> <a href="https://infosec.space/tags/CensorBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CensorBoot</a> was already irrevocably fucked when <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> lost the <a href="https://infosec.space/tags/PrivateKeys" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PrivateKeys</a> for that.<ul><li><a href="https://infosec.space/tags/GoldenKeyBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GoldenKeyBoot</a> basically means all "<a href="https://infosec.space/tags/SecureBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#SecureBoot</a>" is unfixably insecure!</li></ul>And Microsoft admitted to that <a href="https://infosec.space/tags/insecurity" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#insecurity</a> with the <a href="https://infosec.space/tags/XboxOne" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#XboxOne</a>'s design in their own words! <a href="https://youtu.be/U7VwtOrwceo&t=663" rel="nofollow noopener noreferrer" translate="no" target="_blank">https://youtu.be/U7VwtOrwceo&t=663</a><a href="https://infosec.space/tags/TLDW" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TLDW</a>: Don't trust any <a href="https://infosec.space/tags/blackbox" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#blackbox</a> to do what it claims to do!

Kevin Karhan :verified:<a href="https://awscommunity.social/@Quinnypig" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@Quinnypig</a> the sheer fact that <a href="https://infosec.space/tags/Microsoft" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Microsoft</a> and <a href="https://infosec.space/tags/Windows11" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows11</a> ain't banned across the <a href="https://infosec.space/tags/EU" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#EU</a> to this day is an indictment to the <a href="https://infosec.space/tags/TechIlliteracy" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#TechIlliteracy</a> of politicans in the <a href="https://ec.social-network.europa.eu/@EUCommission" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@EUCommission</a> & <a href="https://respublicae.eu/@europarl_en" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@europarl_en</a> despite<ul><li><a href="https://infosec.space/tags/PRISM" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#PRISM</a></li><li><a href="https://infosec.space/tags/GoldenKeyBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GoldenKeyBoot</a> (aka. <a href="https://infosec.space/tags/CensorBoot" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CensorBoot</a> got owned!)</li><li><a href="https://infosec.space/tags/CryptoAPI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CryptoAPI</a> <a href="https://infosec.space/tags/backdoors" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#backdoors</a> <a href="https://github.com/kkarhan/windows-ca-backdoor-fix" rel="nofollow noopener noreferrer" target="_blank">they refuse to acknowledge or fix at all</a>!</li><li><a href="https://infosec.space/tags/CloudAct" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#CloudAct</a></li><li>Unwillingness to comply with <a href="https://infosec.space/tags/GDPR" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#GDPR</a> out if the box</li></ul>and now<ul><li><a href="https://infosec.space/tags/Recall" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Recall</a> aka. the worst disguised <a href="https://infosec.space/tags/Govware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Govware</a> / <a href="https://infosec.space/tags/Spyware" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Spyware</a> in existance that allows anyone to <a href="https://github.com/xaitax/TotalRecall" rel="nofollow noopener noreferrer" target="_blank">simply extract credentials</a> without the need to install a <a href="https://infosec.space/tags/Keylogger" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Keylogger</a>, <a href="https://infosec.space/tags/ScreenRecorder" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ScreenRecorder</a> and/or commit <a href="https://infosec.space/tags/ProvilegueEscalatiom" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ProvilegueEscalatiom</a> successfully at all...</li></ul>And since <a href="https://cyberplace.social/@GossiTheDog" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@GossiTheDog</a> managed to get it running on a system w/o "<a href="https://infosec.space/tags/AI" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#AI</a>" acceleration aka. "<a href="https://infosec.space/tags/NPU" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#NPU</a>" it's safe to assume that it'll be perfectly possible to retroactively shove it down everyones' throats without recourse!<ul><li>Actually there are options for recourse besides "<a href="https://infosec.space/tags/ThoughtsAndPrayers" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#ThoughtsAndPrayers</a>" that regulators like <a href="https://social.bund.de/@bsi" class="u-url mention" rel="nofollow noopener noreferrer" target="_blank">@bsi</a> would actually take this seriously: </li></ul>Like: Stop using <a href="https://infosec.space/tags/Windows" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Windows</a> and <a href="https://www.youtube.com/watch?v=PkKfV0ATrH4" rel="nofollow noopener noreferrer" target="_blank">get some help</a> migrating away from it to a good <a href="https://infosec.space/tags/Linux" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#Linux</a> distro!<a href="https://infosec.space/tags/WhatYouAllowIsWhatWillContinue" class="mention hashtag" rel="nofollow noopener noreferrer" target="_blank">#WhatYouAllowIsWhatWillContinue</a>

Recent searches

Search options

Administered by:

Server stats:

#goldenkeyboot