Courses:

Offensive Countermeasures: The Art Of Active Defense: SANSFIRE June 15-16, Blackhat USA July 27-28 & 29-30


Defensive Countermeasures: Foundations for Becoming A Devious Defender: Blackhat USA July 27-28 & 29-30


Conferences:

Check out the entire PaulDotCom crew at BsidesRI June 14-15th!



Subscribe:

Blog:
Videos:
Podcast:


PaulDotCom Español


Hack Naked TV


Hack Naked At Night


Stogie Geeks


Sponsored By:


www.coresecurity.com


www.tenablesecurity.com


www.sans.org



Follow Us On:


twitter.com/pauldotcom

PaulDotCom YouTube Channel


Thunderbolt, now with more hacking

|

I really wish Darren was here for this one, but oh well. So, the speculation is now, that with the new Thunderbolt technology on the Macs is apparently connected directly to the PCIe bus. This means that a potential rogue device can be plugged in and would have unauthenticated access to anything else on the PCIe bus - including complete read access to memory and hard drives. Of course this isn't a big deal as most of the Macs already have the same issues with Firewire Express cards and SD ports. Intel does have a solution with VT-d that allows the chipset to be configured so that devices on the PCIe bus don’t have free reign. Unfortunately the chipset in the Mac doesn't support VT-d.

Additionally, ladies and gentlemen, boys and girls of all ages: Making mistakes is okay. We know there are tight deadlines that you have to meet. But please try your absolute best to make new mistakes. Seriously, did the developers of this technology even look vulnerabilities in Firewire and USB? It is unacceptable if you look at your connectivity technology and it turns out that Bluetooth is more secure.

fail_headset_phone[2].jpg
Finally! A secure bluetooth headset!!

So, from the PDC crew to all of the developers who insist on making and remaking the same mistakes as others in the past:

bill-murray-you-suck.jpg

Brought to you by: haxorthematrix and John Strand

Originally discussed during episode 233