@nazokiyoubinbou @Viss Exactly

[vrek@mastodon.social]

@DelilahTech @Viss @funnymonkey basically... I was friends with the security guard. It wasn't like you're in trouble more like oh thank God I'm not going insane.

[argv_minus_one@mastodon.sdf.org]

@funnymonkey @Viss

Perhaps not, but you do need to make sure you don't pair with any potentially insecure devices.

Pairing a phone with a laptop is hopefully fine. They both get security updates. But gadgets like speakers and keyboards? Don't even think about it. Wired or bust.

[argv_minus_one@mastodon.sdf.org]

@vrek

Those badges are supposed to do a cryptographic handshake with the reader so that you can't just clone them.

So are car keys, for that matter.

The problem is that the cryptographic handshake proves identity but does *not* prove *proximity*. Attackers can't clone the key/badge but they can boost the signal to confuse the reader into thinking the key/badge is nearby when it's actually not.

I don't know how feasible such an attack is with badges, but cars were stolen.

@Viss @funnymonkey

[argv_minus_one@mastodon.sdf.org]

@ellie @Viss

Speaking of which, I wonder how long it'll be before some psycho hacks a bunch of people's earbuds to make a noise loud enough to destroy their hearing.

There's no fun or profit in it, but there must be some “watch the world burn” kind of character somewhere who thinks this is a good idea…

[viss@mastodon.social]

@argv_minus_one @funnymonkey this hack happens outside of pairing

[vrek@mastodon.social]

@argv_minus_one @Viss @funnymonkey if only I was smarter this would be interesting to investigate... But alas I'm a idiot loser so it will end up being a mental experiment

[vrek@mastodon.social]

@argv_minus_one @Viss @funnymonkey if only I was smarter this would be interesting to investigate... But alas I'm a idiot loser so it will end up being a mental experiment

[aburka@hachyderm.io]

@Viss @argv_minus_one @funnymonkey this part involves pairing, no?

> Then they impersonated the headphone from their laptop and connected to the phone (pretending to be the headphone).

[viss@mastodon.social]

@aburka @argv_minus_one @funnymonkey its possible to talk btle without pairing. check out lightblue if youre on Android

[aburka@hachyderm.io]

@Viss @argv_minus_one @funnymonkey huh, til

[viss@mastodon.social]

@aburka @argv_minus_one @funnymonkey let me know when you soft brick your first thing. i like changing the names of peoples fitbits while on flights

[aburka@hachyderm.io]

@Viss @argv_minus_one @funnymonkey my Fitbit that's paired to the same phone doesn't even show 🤷‍♀️

[argv_minus_one@mastodon.sdf.org]

@Viss

Yes but they can't impersonate the headphone to the phone if the headphone isn't paired to the phone, can they?

@aburka @funnymonkey

[winterknight1337@infosec.exchange]

@Viss still looking like Saturday to me :D

[viss@mastodon.social]

@winterknight1337 i like your brain

[winterknight1337@infosec.exchange]

@Viss helps that I was playing Rimworld till 0330 and I just got up lol

[viss@mastodon.social]

@winterknight1337 that works too! i was in arc raiders for like. 7 hours yesterday

[viss@mastodon.social]

@da_667 @winterknight1337 i wish other folks were into arc raiders. cruising around in a team of 3 would be so rad

[viss@mastodon.social]

@da_667 @winterknight1337 its a sneakmode one tho

[ncrazed@fd00.space]

@Viss @da_667 @winterknight1337 I've been eyeing it for a while, especially since it appears to not be outright hostile to Linux.

But I'm also using an old enough NVIDIA card to be affected by the recent Arch kernel/driver shenanigans 😅