Zeph (./37467) :Y'en a qui sont plus rigolos : https://mk.absturztau.be/notes/ac4flpaaskjc0231
Intéressant avec les exemples
(cliquez sur les images pour zoomer si vous ne voyez pas le souci)
Le Top 20 des forums
Zeph (./37467) :Y'en a qui sont plus rigolos : https://mk.absturztau.be/notes/ac4flpaaskjc0231
Intéressant avec les exemples
Dès le départ, les choses commencent mal : alors que ces sites proposent plusieurs solutions de vérification, à savoir AgeGO ou Yoti, avant même que le moindre clic soit fait une requête est envoyée vers les serveurs d’AgeGO, contenant non seulement l’adresse du site que l’utilisateur souhaite consulter mais aussi celle de la vidéo exacte qu’il souhaite visionner. Aie, première entaille dans le contrat.(en chœur) « Oh ben ça alors, quelle surprise ! »
Ensuite, si AgeGO est sélectionné, l’utilisateur se voit proposé de prendre un selfie pour vérifier son âge. AgeGO utilise ensuite les services d’un autre prestataire, qui n’est mentionné nul part dans ses conditions d’utilisation, seul le fait que celui-ci « respecte les directives EU-US sur la vie privée » est indiqué.
Le prestataire n’est autre qu’Amazon, avec son service AWS et sa technologie Amazon Rekognition. Ce qui veut dire que le flux total de la webcam de l’utilisateur est envoyé vers les serveurs d’Amazon, ainsi que son adresse IP, l’user agent de son navigateur, et le fait qu’il souhaite accéder à un site interdit aux mineurs (le site exact n’est pas précisé à Amazon). Aucune garantie n’est donnée concernant le traitement des données acquises par AWS : Amazon peut très bien les effacer après utilisation... ou pas. Aie, seconde entaille.
Cerise sur le gâteau, AgeGO oblige l’utilisateur à laisser une adresse e-mail à la fin du processus de reconnaissance faciale. S’il est possible de mettre n’importe quelle adresse, y compris fausse, cette étape n’est absolument pas requise par les autorités.
UK supermarket giant Tesco has sued Broadcom for breach of contracts pertaining to its VMware licenses, named Computacenter as a co-defendant, and warned it may not be able to put food on the shelves if the situation goes pear-shaped.
Court documents seen by The Register assert that in January 2021 Tesco acquired perpetual licenses for VMware’s vSphere Foundation and Cloud Foundation products, plus subscriptions to Virtzilla’s Tanzu products, and agreed a contract for support services and software upgrades that run until 2026. Tesco claims VMware also agreed to give it an option to extend support services for an additional four years.
All of this happened before Broadcom acquired VMware and stopped selling support services for software sold under perpetual licenses. Broadcom does sell support to those who sign for its new software subscriptions.
The supermarket giant says Broadcom's subscriptions mean it must pay “excessive and inflated prices for virtualisation software for which Tesco has already paid,” and “is unable any longer to purchase stand-alone Virtualisation Support Services for its Perpetually Licensed Software without also having to purchase duplicative subscription-based licenses for those same Software products which it already owns.”
Burger King hacked, attackers 'impressed by the commitment to terrible security practices' — systems described as 'solid as a paper Whopper wrapper in the rain,’ other RBI brands like Tim Hortons and Popeyes also vulnerable
Tom's Hardware
Ethical hackers BobDaHacker and BobTheShoplifter have detailed their claim that they uncovered “catastrophic” vulnerabilities in multiple platforms hosted by Restaurant Brands International (RBI). While RBI may not be a very familiar name, this lax security means that systems powering mega brands like Burger King, Tim Hortons, and Popeyes, with over 30,000 locations worldwide, and all were almost trivially easy to hack. “Their security was about as solid as a paper Whopper wrapper in the rain,” snarks the BobDaHacker blog, sharing the full technical exposé (the blog has since been taken down, but it's archived here).
The vulnerabilities found were a big deal, as we will detail below, including allowing the duo to access employee accounts, ordering systems, and listen to recorded drive-thru conversations, among other exploits. Despite this, the ethical hacking duo that responsibly informed RBI of the flaws were never acknowledged.
China’s Great Firewall suffers its biggest leak ever as 500GB of source code and docs spill online — censorship tool has been sold to three different countries
Tom's Hardware
Chinese censorship sprang a major leak on September 11, when researchers confirmed that more than 500GB of internal documents, source code, work logs, and internal communications from the so-called Great Firewall were dumped online, including packaging repos and operational runbooks used to build and maintain China’s national traffic filtering system.
The files appear to originate from Geedge Networks, a company that has long been linked to Fang Binxing — widely described as the “father” of the Great Firewall — and from the MESA lab at the Institute of Information Engineering, a research arm of the Chinese Academy of Sciences.
Contained in the leak are what appear to be full build systems for deep packet inspection platforms, as well as code modules that reference the identification and throttling of specific circumvention tools. Much of the stack is geared toward DPI-based VPN detection, SSL fingerprinting, and full-session logging.
