Skip to content

One-Click RCE in ASUS's Preinstalled Driver Software

Technology
8 7 0
  • YouTube might slow down your videos if you block ads

    Technology technology
    51
    1
    246 Stimmen
    51 Beiträge
    0 Aufrufe
    M
    But I don't have adblockers installed and I still get told to turn my blocker off. I have no extensions and YouTube randomly stops my video to tell me I'm doing it wrong.
  • Using A Videocard As A Computer Enclosure

    Technology technology
    5
    1
    85 Stimmen
    5 Beiträge
    0 Aufrufe
    T
    Back in the day there was a pic floating about where someone had put a micro atx board and psu into a standard PSU chassis into a standard PC case for a spectacular "empty case" mod
  • signal blogpost on windows recall

    Technology technology
    5
    1
    69 Stimmen
    5 Beiträge
    2 Aufrufe
    P
    I wouldn't trust windows to follow their don't screenshot API, whether out of ignorance or malice.
  • 2 Stimmen
    2 Beiträge
    2 Aufrufe
    quarterswede@lemmy.worldQ
    I give it 5 years before this is on our phones.
  • 1 Stimmen
    14 Beiträge
    6 Aufrufe
    T
    ...is this some sort of joke my Nordic brain can't understand? I need to go hug a councilman.
  • 1 Stimmen
    8 Beiträge
    3 Aufrufe
    L
    I think the principle could be applied to scan outside of the machine. It is making requests to 127.0.0.1:{port} - effectively using your computer as a "server" in a sort of reverse-SSRF attack. There's no reason it can't make requests to 10.10.10.1:{port} as well. Of course you'd need to guess the netmask of the network address range first, but this isn't that hard. In fact, if you consider that at least as far as the desktop site goes, most people will be browsing the web behind a standard consumer router left on defaults where it will be the first device in the DHCP range (e.g. 192.168.0.1 or 10.10.10.1), which tends to have a web UI on the LAN interface (port 8080, 80 or 443), then you'd only realistically need to scan a few addresses to determine the network address range. If you want to keep noise even lower, using just 192.168.0.1:80 and 192.168.1.1:80 I'd wager would cover 99% of consumer routers. From there you could assume that it's a /24 netmask and scan IPs to your heart's content. You could do top 10 most common ports type scans and go in-depth on anything you get a result on. I haven't tested this, but I don't see why it wouldn't work, when I was testing 13ft.io - a self-hosted 12ft.io paywall remover, an SSRF flaw like this absolutely let you perform any network request to any LAN address in range.
  • 0 Stimmen
    6 Beiträge
    2 Aufrufe
    P
    I applaud this, but I still say it's not far enough. Adjusted, the amount might match, but 121.000 is still easier to cough up for a billionaire than 50 is for a single mother of two who can barely make ends meet
  • 0 Stimmen
    2 Beiträge
    2 Aufrufe
    G
    Wow... Just learned about that NOW. I wanted to play some games today and wondered why my account doesnt work nor the "forgot password"-Function... Fuck Meta. Fuck Oculus... Fuck this whole Enshittification that is going on lately... Is there ANY Way, to get my CV1 to run Without an account?!