@nazokiyoubinbou @Viss Exactly

[argv_minus_one@mastodon.sdf.org]

@vrek

Those badges are supposed to do a cryptographic handshake with the reader so that you can't just clone them.

So are car keys, for that matter.

The problem is that the cryptographic handshake proves identity but does *not* prove *proximity*. Attackers can't clone the key/badge but they can boost the signal to confuse the reader into thinking the key/badge is nearby when it's actually not.

I don't know how feasible such an attack is with badges, but cars were stolen.

@Viss @funnymonkey

[argv_minus_one@mastodon.sdf.org]

@ellie @Viss

Speaking of which, I wonder how long it'll be before some psycho hacks a bunch of people's earbuds to make a noise loud enough to destroy their hearing.

There's no fun or profit in it, but there must be some “watch the world burn” kind of character somewhere who thinks this is a good idea…

[viss@mastodon.social]

@argv_minus_one @funnymonkey this hack happens outside of pairing

[vrek@mastodon.social]

@argv_minus_one @Viss @funnymonkey if only I was smarter this would be interesting to investigate... But alas I'm a idiot loser so it will end up being a mental experiment

[vrek@mastodon.social]

@argv_minus_one @Viss @funnymonkey if only I was smarter this would be interesting to investigate... But alas I'm a idiot loser so it will end up being a mental experiment

[aburka@hachyderm.io]

@Viss @argv_minus_one @funnymonkey this part involves pairing, no?

> Then they impersonated the headphone from their laptop and connected to the phone (pretending to be the headphone).

[viss@mastodon.social]

@aburka @argv_minus_one @funnymonkey its possible to talk btle without pairing. check out lightblue if youre on Android

[aburka@hachyderm.io]

@Viss @argv_minus_one @funnymonkey huh, til

[viss@mastodon.social]

@aburka @argv_minus_one @funnymonkey let me know when you soft brick your first thing. i like changing the names of peoples fitbits while on flights

[aburka@hachyderm.io]

@Viss @argv_minus_one @funnymonkey my Fitbit that's paired to the same phone doesn't even show 🤷‍♀️

[argv_minus_one@mastodon.sdf.org]

@Viss

Yes but they can't impersonate the headphone to the phone if the headphone isn't paired to the phone, can they?

@aburka @funnymonkey

[winterknight1337@infosec.exchange]

@Viss still looking like Saturday to me :D

[viss@mastodon.social]

@winterknight1337 i like your brain

[winterknight1337@infosec.exchange]

@Viss helps that I was playing Rimworld till 0330 and I just got up lol

[viss@mastodon.social]

@winterknight1337 that works too! i was in arc raiders for like. 7 hours yesterday

[viss@mastodon.social]

@da_667 @winterknight1337 i wish other folks were into arc raiders. cruising around in a team of 3 would be so rad

[viss@mastodon.social]

@da_667 @winterknight1337 its a sneakmode one tho

[ncrazed@fd00.space]

@Viss @da_667 @winterknight1337 I've been eyeing it for a while, especially since it appears to not be outright hostile to Linux.

But I'm also using an old enough NVIDIA card to be affected by the recent Arch kernel/driver shenanigans 😅

[viss@mastodon.social]

@nCrazed @da_667 @winterknight1337 its platinum on protondb

[viss@mastodon.social]

@da_667 @winterknight1337 you can go full 100% stealth if you want, or you can go picking fights, or you can snipe from halfway across the map. i turned on that thing in steam where friends can watch me stream if im playing, if you wanna creep on me