Comment Re:they could have built the hardware capacity the (Score 1) 117
Comment Re: Why does such a level of notability really mat (Score 1) 51
Comment Re:AI can solve this (Score 1) 51
Comment Who in their right mind would want one? (Score 1) 51
Comment Re:Why does such a level of notability really matt (Score 2) 51
Comment Re: "On Planet Earth" (Score 1) 152
Comment Re: "On Planet Earth" (Score 1) 152
Comment Re: "On Planet Earth" (Score 1) 152
Comment Re: "On Planet Earth" (Score 1) 152
Comment Re: "On Planet Earth" (Score 1) 152
Comment Re:Public domain data is now public domain (Score 3, Insightful) 89
Comment Re:Leftists in Prison (Score 0) 89
Comment Re: "On Planet Earth" (Score 1) 152
"you tried to claim someone could plug in a network cable...to a server in a secure datacenter, during a few -second reboot window where they'd already have physical access to plug in a malicious boot USB"
1. It doesn't have to plug in to the server. It just needs to be able to send ICMP packets that can reach the server. 2. It can be plugged in at any time outside of the window, you don't have to plug the device in while it is rebooting 3. A boot USB wouldn't work because the vulnerable code has already executed by the time EUFI tries to boot. 4. USB boot is a much more time consuming approach to hack the server in general, since the attacker would need to change the boot options at the console and then change them back, and in between boot the USB based tools (e.g. Kali) and do any actual hacking, which requires skills. The console is generally not anywhere near the server. The opportunity windows for being caught is much bigger. 5. "Secure Datacenter" doesn't mean anything when the people with access to the physical network are the ones who are doing the device installation, and those people don't need to have *any* hacking skills.
This hack allows a bad actor to hack the system simply by having access to a switch for a moment (they can hide a small EPS32 or similar device behind it that will go unnoticed until it is too late), and then it occurs without any way to trace who did the hack, or even that the hack occurred.
If someone told you that you are a "qualified infosec professional" they lied to you, and you should seek a refund.