* Posts by Adam 1

2545 publicly visible posts • joined 7 May 2012

G.Fast sand-slinger says it's slung bits at 500 Mbps over 200 metres

Adam 1

Re: We really need a reference Usain

That is quite a lot of him. Of they were all carrying a DVD it would leave gfast for dead.

Swap your keyless key for keyless key-less key. You'll need: a Tesla S and Apple Watch

Adam 1

Easy, there's a USB port in the dash. Open the door, plug it in and it will start to draw power. This should provide enough charge to fire up the phone. You can then launch the app, open the door, plug it in and it will start to draw power. This should provide enough charge to fire up the phone. You can then launch the app, open the door........ Stack overflow

Still using Adobe Flash? Oh well, get updating: 15 hijack flaws patched

Adam 1

What's the El Reg stance on https?

LICKED: Behold my TOAD-PROOF ERECTION, boasts Aussie boffin

Adam 1

Problem is that they are mostly Queenslanders so it is a bit hard to tell.

Australia's (current) PM Tony Abbott again calls for metadata trove laws to pass, ASAP

Adam 1

Half term Tony trying desperately to get anything else on the front page.

Ransomware 2.0 'crypts website databases – until victims pay up

Adam 1

^ ouch

Adam 1

Any backup must be considered as of unknown success until you have successfully restored it to another machine.

If you go 6 months without noticing your backups don't restore with the encryption keys you hold, your problems are deeper than ftp passwords.

DARPA: We KNOW WHO YOU ARE... by the WAY you MOVE your MOUSE

Adam 1

A good point. This sort of authentication is not designed to be a primary authentication because you really couldn't tell whether to let them use the computer until after a length of time. Generally speaking, you want someone to authenticate before they start using it, so I see this more like a mechanism to protect workstations where the user has wandered off without locking it. As a secondary measure, it would most likely be quite forgiving to minimise the false positive rates, or could work with tertiary measures like activating the webcam for facial recognition when it has a doubt.

The point about the arc refers to the fact that it is very difficult to move your mouse in an absolutely straight fashion due to how people usually hold their mouse. The size of that arc would depend on a number of factors, such as how you grip the mouse, your usual posture and what part of your wrist is still in contact with the desk, the size of your hands etc. Also, the basic direction you move would influence the extremeness of the arc (which would go back to whether you hold it square on or at an angle).

As a result, (in answer to your question) a relatively simple calculation could create a believable profile for pressing minimise or close. The end point and clicks would be chosen by the attacker, but the mouse movements would not raise any alarms because they emulate the speed and direction such a user is likely to take. The easiest attack vector I can think of is to send some exec a "free mouse" and embed the attack code within it.

Adam 1

Wouldn't this be fooled by recording of mouse movements. I can imagine the following data points without specialist mouse hardware.

* the rate of acceleration and deceleration as you move from the original cursor point to the target.

* the angle of the arc of movement between the two points.

* the delay between movement ceasing and clicking

* double click profile (time between each click and how still you can keep the mouse)

OK, so plug those into some algorithm and give a score as to how likely it is the same user.

Now do all that again and imagine some malware software is recording your mouse movement profile (could even be embedded in a freebee mouse). A vnc style piece of software could after not too much time now allow you to perform an action but instead emulate the recorded profile in those actions.

Not as trivial as a rainbow table, but if these techniques take off you can bet such tools will become available.

Chipotle insider trading: Disproving the efficient markets hypothesis

Adam 1

Re: Much complication.

The creators of the transaction are not only the customer. Equally without the vendor, no such information would exist. The vendor will provide a receipt if you want your own record of the transaction.

More interesting, unless you opt out, Google will track your location via your android smartphone through location history. They would be in an amazing position to track the movements of customers over time through various businesses. If they play those cards right, they could well and truly beat the financial markets at their own games.

Living with a Renault Twizy: Pah! Bring out the HOVERCRAFT

Adam 1

Re: It's KW

>I think even a tiny electric car might take a few days to charge at 3W

But on the bright side, at least it could use a standard USB charger.

Apple CEO: Fandroids are BINNING Android in favour of IPHONES

Adam 1

Just because they provide updates doesn't mean you should install them. Some of the older models that scrape onto the list of compatible devices work so slow you will soon need an upgrade.

Powering the Internet of Stuff – by sucking electricity from TREES

Adam 1

>The nature of a circle means that adding 1cm to a 2m turbine blade increases the catchable wind by almost half (4.52sq m compared to 3.14), while removing 1cm reduces the harvested wind by half a square metre

Not the circles I am picturing...

Top smut site Flashes visitors, leaves behind nasty virus

Adam 1

So firing up fiddler and, um "doing research for your story" eh?

Boffin finds formula for four-year-five-nines disk arrays

Adam 1

Re: Some wierd assumptions

Plus the assumption that you run a data centre but would have to call a guy in to replace the drive?

Jellybean upgrade too hard for Choc Factory, but not for YOU

Adam 1

Re: So is Firefox safe or what?

The problem isn't so much the browser (or they would just update it in Google play or advise you to use another browser). The problem is that the WebKit rendering engine is used by apps to integrate web content into a regular app. Most commonly, this is how the ad supported apps show those ads, but there are also things like phonegap which lets you wrap an html5 website and deploy it to the various app stores in what appears to the user to be a regular app on their platform.

We are in a state where a dodgy advertisement on a free game is a relatively easy attack vector but Google won't fix it.

Not good enough Google!

(Posted from my Nexus 5 running lollipop)

Adam 1

Re: Wait 90 days and publish the exploit?

Came in here to find this comment. Was not disappointed.

Oi, Aussie sports fans! Take that selfie stick and stick it

Adam 1

Re: Wouldn't this problem take care of itself?

You have to keep an eye on the drop bear with a selfie stick. That never ends well.

Free Windows 10 could mean the END for Microsoft and the PC biz

Adam 1

>That said, 8EiB is about a couple orders of magnitude or so higher than even today's high-end RAM usage.

And the fart of a flea is also a couple of orders of magnitude quieter than a jumbo jet at take off.

The 64 bit address space is really big [citation needed].

The Titan supercomputer at oak ridge is the current largest by RAM. If you decided that you needed you needed a million times more RAM to play the latest version of Crysis, you are still an order of magnitude from running out.

Adam 1

>Because 64 bit software support is only going to last so long.

May I make a bold prediction;

16EiB ought to be enough for anybody.

LEAKED: Samsung's iPhone 6 killer... the Samsung Galaxy S6

Adam 1

Re: Apple Worried, more like happy!

Not all android is Java.

Possible Lizard Squad members claim hack of Oz travel insurer

Adam 1

Re: People still buy travel insurance?

Mostly to get you first world (or as close as available nearby) hospital cover if you fall ill or get injured abroad. Some injuries have long recovery times and prevent you travelling home on your cattle class tickets.

REGARD our TINY but POWERFUL LASER, suitable for very SMALL sharks

Adam 1

Shirley they could have used more understandable units of measure. I mean we all know that hair driers need a lot of energy [citation needed] so saying that could mean anything.

Why not just state the number in terms of how it compares to the power used by a London bus to drive one beard second.

Adam 1

Re: Lacking history

I just learnt something today from a cat on the internet.

Elon Musk: Wanna see a multimillion-dollar rocket EXPLODE? WATCH THIS

Adam 1

Re: Acronym fun

Seems a good candidate for Total Inability To Support Usual Performance...

Microsoft snubs Codeplex, moves big projects to GitHub

Adam 1

Re: Microsoft FAIL

Eadon?

Australia tries to ban crypto research – by ACCIDENT

Adam 1

Re: Necessary sacrifices

I, for one, welcome our new <noun> <adverb> overlords.

What do UK and Iran have in common? Both want to outlaw encrypted apps

Adam 1

Already happening I'm afraid. Some well known technical news sites based in the UK don't even use https in their comments section.

Tesla S P85+: Smiling all the way to the next charging point

Adam 1

you miss one important differentiating feature

With a Mondeo, you need to find a marked car spot at B. With the others you can just use the dual purpose indicator stalk and stop your vehicle somewhere you find convenient.

SpaceX in ROCKET HOVERSHIP PRANG: 'Close – but no cigar,' says Musk

Adam 1

I just hope they have the good sense to check the el reg forums before they waste any more money.

World's largest ship swallows 900 MEGATINS of baked beans

Adam 1

Re: So its more efficient in the use of fuel

Yes. Methane is a particularly potent greenhouse gas.

BILL GATES DRINKS 'boiled and treated' POO. Ah, 'delicious'

Adam 1

.... where his pennies were spent?

It's 2015 and ATMs don't know when a daughterboard is breaking them

Adam 1

Re: How come...

If the alternative is FireWire then USB is definitely more secure (can't bypass OS and read all RAM directly)

Adam 1

Hey, I am not defending them, just pointing out the real world problem. I am sure the newer machines have some sort of counter measures (like how server class machines have alarms that record when the case is open, wouldn't be too hard to do the same when the service door was opened).

My guess is that the bean counters figured that the countermeasures would cost more to retrofit than they will lose to these sort of scams.

Adam 1

No, but the level of protection around the section housing the computer innards is nowhere near the safe/cash drawer.

Search on YouTube for Barnaby jack. He demonstrates a walkup attack.

Marriott: The TRUTH about personal Wi-Fi hotel jam bid

Adam 1

It would be more convincing if their submission explicitly stated that they only sought permission to jam APs that purported to be associated with the hotel but that were not.

Ex-Microsoft Bug Bounty dev forced to decrypt laptop for Paris airport official

Adam 1

Re: Meh

>Yep. I guess 'Woman Made To Prove Laptop Worked At Airport' wouldn't be as interesting a headline

Why does it matter if it works? What if it broke whist travelling? Let's say or wonderfully reliable SSD just gave up without warning and now you just see some text about missing boot devices? Are you supposed to their away your otherwise fine laptop? Are you supposed to fart around trying to sort out warranty claims whilst abroad?

Officialdom gone mad is the kindest way to put it. Time for hidden volumes when travelling to France I suppose...

Apple's 16GB iPhones are a big fat lie, claims iOS 8 storage hog lawsuit

Adam 1

Probably because you can reallocate that partition back if you were inclined to do so (just pray that you never need to reformat)

Adam 1

It is also because in one of those cases that is over 50% of the advertised space. A reasonable consumer expects a degree of space used by OS paraphernalia but not in that magnitude. They also expect that a 32GB device from manufacturer A holds roughly the same amount of their stuff as a 32GB device from manufacturer B.

Huawei? Apple and Samsung's worst nightmare, pal

Adam 1

Re: Consequences - just like the US

>calling them "unintended consequences" would imply staggering stupidity on the part of managements

I have no trouble accepting the premise of that statement

Adam 1

>I could quite easily imagine the two current smart phone market leaders doing a Nokia/RIM

Mind you at least one of these can always fall back to selling forklifts, washing machines, HIFIs, refrigerators, vacuum cleaners, printers, cameras, air conditioners, bulldozers, CPU fans, hard drives, SSD, SD cards and a few dozen other lines. Even if they don't sell another phone ever again, they are not going to be like Nokia or RIM.

Tor de farce: NSA fails to decrypt anonymised network

Adam 1

really is a good meme candidate

> Very naughty people use ...

Very naughty people use cars

Internet Explorer 12 to shed legacy cruft in bid to BEAT Chrome

Adam 1

Some mouse manufacturers have started cutting costs by omitting the ALT button off their mice. Now I need a keyboard to access the menu. If I have to reach for the keyboard then I might as well just hit the Ctrl + XYZ combo needed to do the same thing.

The Reg's review of 2014: Naked JLaw selfies, Uber and monkey madness

Adam 1

Re: I know it's a long article...

Apple Pay works using an NFC chip in the device with touch finger-print censor.

revenge cyber attack knocking the Hermit Kingdonm offline

Adam 1

Re: 10 page spread

Mobile version is all one page.

Hilton, Marriott and co want permission to JAM guests' personal Wi-Fi

Adam 1

Re: Flaw in the WiFi specs?

Yes it is a design flaw in the spec. It has been changed so I doubt this technique will work in 10 years time. Just needs to be practical to drop support for the older protocol versions.

See here

http://en.m.wikipedia.org/wiki/IEEE_802.11w-2009

Adam 1

Another solution is for hotel booking sites to include WiFi charges in the headline rate unless the hotel forgoes deauthing shenanigans.

Dangerous NTP hole ruins your Chrissy lunch

Adam 1

Alternate attack vectors?

A lot of focus here on pwning the server itself. Fair enough, but these machines are also fully trusted by other machines to set/reset their clocks. Could this not also make it possible to trick clients into accepting expired certs used to sign malware?

Super Cali's futuristic Tesla batt swap focus – even though car tech test is an expected bonus

Adam 1

Re: What a headline...

Heard it before though.

ICANN HACKED: Intruders poke around global DNS innards

Adam 1

Re: Survey?

f) SONY - revenge against the internet.