Pen Test Partners

However your IOMMU may not actually be in use. It's not in use by default on Linux and on most Linux distros as it tends to break things on random hardware that isn't setup right. It tends to work most of the time on servers.

Ubuntu 22.04 tried to turn it on by default but switched it off again due to random mostly graphics related regressions on random hardware: https://bugs.launchpad.net/ubuntu/+source/linux/+bug/1971699

Some other history: https://www.phoronix.com/news/Intel-IOMMU-Gfx-Default-Try

We really do need it though. I am always reminded of the very old Apple "Firewire Memory Bypass" which rendered flames to the screen just by plugging a firewire device in - because firewire had direct and originally unprotected DMA access: https://www.pentestpartners.com/security-blog/hack-demo-video/firewire-memory-attack-a-how-to-video/

It is for this reason that even without IOMMU, as a workaround, you have to often give permission to thunderbolt devices to connect. Some details on that here: https://wiki.archlinux.org/title/Thunderbolt

There is also a small but noticable performance hit to using the IOMMU, not so noticable on a general setup but if you are doing high-speed disk & network I/O like ceph storage in excess of 10Gbit/s or millions of IOPS you will notice it. You can Google that.

You can also run into other weird behaviour, for example when using kdump to create a kernel crash dump it will kexec from the old kernel into a new kernel to produce the crash dump.…

Using HTTP meta-headers is actually something we seem to have forgotten how to do.

The one that annoys me most is the accept-language header which is almost entirely ignored in favour of GeoIP lookups to figure out regionality... which I find super odd; as if people are walking around using a browser in a language they don't speak. (or, an operating system configured for a language they don't speak).

ETAG's though, are a bit fraught- if you're a company, a security scan will fire if an etag is detected because you might be able to figure out the inode on the filesystem based on it... which, idk why that's a security problem eitherway[0], but it's common for there to be false-positives[1]... which makes people not respect the header.

Last-Modified should work though, I love the idea of checking headers and not content.

I think people don't care to imagine the computer doing as little as possible to get the job done, and instead use the near unlimited computing power to just avoid thinking about consequences.

[0]: https://www.pentestpartners.com/security-blog/vulnerabilities-that-arent-etag-headers/

[1]: https://github.com/sullo/nikto/issues/469

That was FUD[1] spread by Chris Roberts who has been called out for it. He claimed he was able to issue climb commands from the IFE to the CAN bus.

Apart from this being technologically impossible, if he would have really done it he would have been charged for endangering an aircraft and prosecuted. (So the only explanation why he isn't in prison is that it didn't happen). The technical reason is Data diodes are common in aviation to separate IFE and CAN bus or position data. (e.g in the ARINC)

[1] https://www.pentestpartners.com/security-blog/a-pen-testers-first-solo-aviation-security-101/

Apparently it is a 128Mb stick, with a pdf on it.

"The stick comes loaded with a 25 page PDF version of the material from 5GbioShield ‘s website. It included a Q&A of distances for the “bubble” and how to know if it is working. It’s an “always on” system apparently, is always working, powered or not, so no visual checks needed.

A review of the stick’s properties revealed nothing more that what you’d expect from a regular 128MB USB key. We weren’t even sure that 128s are still in production!"

https://www.pentestpartners.com/security-blog/reverse-engineering-a-5g-bioshield/

They're just mass scanning for known IoT ports. UPnP opens up the port for everyone. My port number is an example. This blogger found his camera opening up port 80 via UPnP:

https://www.pentestpartners.com/blog/hacking-the-aldi-ip-cctv-camera-part-2/

Also Brian Krebs examined that Foscam camera and found it enabled a P2P protocol and opened a port on the firewall using UPnP as well:

https://krebsonsecurity.com/2016/02/this-is-why-people-fear-the-internet-of-things/