VirulentVirus - Slashdot User

Comment Re:Something doesn't add up (Score 2) 92

by VirulentVirus on Tuesday May 12, 2020 @05:04AM (#60051120) Attached to: Thunderbolt Bug Lets Hackers Steal Your Data in 'Five Minutes'

In his wording, "affected" includes "partially affected". Boot Camp "undoes this", because the Apple disables all security under BootCamp.

No Thunderbolt security on Boot Camp. Apple supports running Windows on Mac systems using the Boot Camp utility [2]. When [doing so], Mac UEFI disables all Thunderbolt security by employing the Security Level “None” (SL0). As such, this vulnerability subjects the Mac system to trivial Thunderbolt-based DMA attacks.

However, on MacOS itself: Regarding Thunderbolt security, MacOS employs (i) an Apple-curated (device ID) whitelist in place of Security Levels [7], and (ii) IOMMU virtualization when hardware and driver support is available [1][3]. Vulnerabilities 2–3 (using the ID of a known-trusted device and forging DROM metadata) enable bypassing the first protection measure, and fully compromising authenticity of Thunderbolt device metadata in MacOS “SystemInformation”. However, the second protection measure (IOMMU virtualization) remains functioning and hence prevents any further impact on victim system security via DMA. The system becomes vulnerable to attacks similar to BadUSB [10].Therefore, MacOS is partially affected.

SanDisk, Music Publishers Push DRM-free SlotMusic Format 368

Posted by timothy on Monday September 22, 2008 @03:30AM from the doomed-to-fail dept.

Strudelkugel writes "The LA Times and others are reporting the music industry is working with SanDisk to try unrestricted music files on microSD memory cards to improve sales of physical media: 'In addition to music, the slotMusic cards will come pre-loaded with other things, such as liner notes, album-cover artwork and sometimes video.' The important part: 'The music on slotMusic comes without copyright protection, so it can be used on almost all computers, mobile phones and music players — but it won't play on an iPod, which doesn't have a micro-SD memory slot. It has one gigabyte of memory, and the music tracks are played back at high quality.' Could it be the labels have finally recognized that providing features and convenience to customers is preferable to suing them?" Most computers also don't have microSD slots; according to EMI's press release, there will be a "tiny USB sleeve" packaged with each card, and the "high quality" format means up to 320kbps MP3. From the given description, it seems like it would be no harder to transfer the tracks to an iPod (via a computer) than to most other players.

How Asus Recovery Disks Ended Up Carrying Software Cracks 241

Posted by timothy on Monday September 22, 2008 @12:18AM from the nice-thing-about-free-software-is-no-cracks dept.

Anthony_Cargile writes "We all now know about Asus shipping illegal software cracks and confidential documents/source code on their recovery DVD (and in the system root), but this article tells exactly how it happened. It's even more careless than you think, and most likely an accident."

Slashdot Top Deals