Nick Percoco

When the attack lives in the physical device, every software check is looking in the wrong place. After a reseller-level hardware compromise cost people tens of millions, here’s how I’d secure a hardware supply chain if I were the manufacturer. x.com/i/article/2108…

If you run sshd on Alpine, OpenWrt, or musl Docker images with password auth still on, patch today.

@kultekin found that OpenSSH on musl without PAM accepts any password of 257 to 1024 characters for accounts locked with a lone * in /etc/shadow. That covers key-only users and the default alpine user on official AWS and Azure images (passwordless doas). The box also needs another account with a real password hash.

@damienmiller shipped OpenSSH 10.6p2 this morning as a workaround. @alpinelinux edge already has 10.6_p2-r0. Can't update yet? Set PasswordAuthentication no and restart sshd.

glibc, PAM builds, Dropbear, and OpenBSD are not in scope. musl without PAM is.

Don’t miss out! This will be our 14th conference. Hope to see you there!

The Bitcoin white paper turns 18 today. Pull the metadata from the copy at bitcoin.org and you get a small opsec lesson from an author who has stayed anonymous ever since.

Creator: Writer
Producer: OpenOffice.org 2.4
Language: en-GB
CreationDate: 2009-03-24 11:33:15 at UTC-6

That file is the March 2009 revision. The draft announced on Oct 31, 2008 was created Oct 3, 2008 at UTC-7. People have spent years trying to place Satoshi with those offsets. Once you account for daylight saving time, no single US time zone fits both, so they prove very little.

That may be the point. A language setting in a word processor and a system clock set to a different time zone are enough to send years of sleuthing in different directions. No special tools, just knowing which defaults your software writes into every file.

The lesson isn't to strip everything. It's to know what the systems and applications you use reveal out of the box, and which settings you can change to make that work for you instead of against you.

No one wants this