Share this page!

Enter URL or ID to Unroll

You can paste full URL like: https://x.com/threadreaderapp/status/1644127596119195649
or just the ID like: 1644127596119195649

How to get URL link on X (Twitter) App

  1. On the Twitter thread, click on or icon on the bottom
  2. Click again on or Share Via icon
  3. Click on Copy Link to Tweet
  4. Paste it above and click "Unroll Thread"!
  5. More info at Twitter Help
Graham Sutherland (Polynomial^DSS) ➡️ chaos.social Profile picture
Graham Sutherland (Polynomial^DSS) ➡️ chaos.social
@gsuberland
Electronics, windows internals, cryptography, hardware, lasers, chemistry, demoscene, ADHD. I run @unsafe_warnings and hack stuff for a living, I guess (he/him)
Aug 20, 2022 • 12 tweets • 3 min read
me: "hmm, I've always wanted to learn about air gap in inductors, I'll give this video a go"

me, minutes later: "oh no" TV showing a YouTube video ... the TL;DR seems to be that you can moderate the permeability by introducing larger air gaps, which reduces the inductance factor but increases the saturation current.
Aug 20, 2022 • 4 tweets • 1 min read
I suspect a large part of this is that advice around standby power draw became popularised in media in the 80s and 90s, when quiescent power draw from power supplies was orders of magnitude higher than it is in modern appliances.

I agree with OP that much of this comes down to people generally not having an intuition for scale when it comes to power draw, and I also think it doesn't help that the concept of watts vs kWh is rather unintuitive to anyone who isn't familiar with power/energy & compound units.
Aug 20, 2022 • 5 tweets • 1 min read
BT router says "you can't have the router IP start with 10.x.x.x or 100.x.x.x (???), nor can the DHCP pool be in either of those ranges.

I bypassed the client side validation and of course it works fine anyway. 🙄 This is temporary anyway. When my new server turns up I'll be doing all the routing, DHCP, etc. on OPNsense and the router will be swapped to modem mode.
Aug 17, 2022 • 15 tweets • 3 min read
ahahahahahahahahaaaaaa this is going to bite them in the ass almost as much as their obsession with data overclassification
Jun 19, 2021 • 15 tweets • 3 min read
EIGHT GIGAWATTS.

that's as much as the top four solar parks in the world can generate, combined.

it's more than the largest wind farm in the world can generate at peak capacity, and that's the 8th largest power production facility on the planet. if you ran all seven reactors at the Kashiwazaki-Kariwa Nuclear Power Plant - the world's most powerful nuclear power facility - at full tilt, and tried to power these miners, they'd come up short by about 35MW.
Jun 19, 2021 • 11 tweets • 2 min read
New feature in Cheat Engine (just in GitHub source for now - not yet in a release) adds valid pointers as a groupscan field option. Really great for finding particular structs in memory when you only know a couple of the field values and they're mostly zeroes. For example, imagine you want to find instances of this GC structure in memory:

uint16_t tag;
bool present;
uint8_t** markList;
uint8_t** markListCopy;
size_t markListSize;
bool markListOverflow;
segment_t* segmentTable;
Jun 19, 2021 • 4 tweets • 1 min read
Couldn't find anything off-the-shelf, so I wrote a tool to dump security properties of all MSMQ queues on a system. This helps quickly spot unauthenticated queues, unencrypted queues, queues that can be reached via multicast, and any potentially weak ACLs. Screenshot of output from the tool. Each queue's name and fo (yes this will be going on github)
Jun 18, 2021 • 4 tweets • 1 min read
MSMQ is confusing as hell, but once you get your head around how it works you are in for some fun on the attack side.

Protip: private local queues are neither private nor limited to local access. Private just means you can't enumerate it from AD. You have to know the endpoint name.

Local means you're talking to it from the same box, but that doesn't actually mean you can't access it from elsewhere. Like over TCP, RPC, or HTTP(S) listeners. Which are on by default.
Jun 18, 2021 • 4 tweets • 1 min read
the line I take is this: is it some sort of language that is learned or utilised in a specific or unique way by folks who develop things on computers? then it's probably code and there are only two main cases where someone would say it isn't: gatekeeping and useless pedantry. yes that means I consider a word document full of application documentation to be code, or close enough to it that there's no point making a distinction, and I don't care if most people don't hold that same view.
Jun 17, 2021 • 5 tweets • 1 min read
There's a fairly prominent subculture on twitter of bored twentysomethings coming up with the Problematique Of The Week. I feel old saying this, and I know some of it is just them finding their feet, but I wish they'd channel that energy and passion into useful campaigning. To be absolutely clear, since I have a bunch of new followers that don't know me well: this isn't some "they're a bunch of snowflakes" bullshit. Fuck that.

It's just frustrating to see wasted effort on conversations about non-issues while powerful assholes erode trans rights.
May 25, 2021 • 24 tweets • 4 min read
There's a new rowhammer attack called "half-double", which bypassing existing countermeasures.

Instead of attacking an adjacent row directly, it attacks the next row over using periodic accesses to the adjacent row as a kind of charge carrier.

github.com/google/hammer-… RAM is basically just a big array of tightly packed transistors and capacitors. The capacitors store the "state" of each cell as charge. Rowhammer exploits the fact that a very tiny amount of charge leaks between these cells each time you access them.
May 24, 2021 • 4 tweets • 1 min read
Pfizer mRNA side effects so far:

First 8-12 hours: mild muscle soreness, slight headache, feeling warm.

12-36h: kinda sore injection site, tiny bit of arm ache, all other symptoms cleared.

The sore arm is by far the most noticeable thing so far, and it's barely uncomfortable. So far it's less of a thing than your average mild cold. Pretty much as expected. The second shot is the one you often get the big immune response to. First one is generally easy.
May 23, 2021 • 6 tweets • 1 min read
I was just wondering if all the beams at Eurovision last night were Claypaky's new laser source fixtures. Yup, 481 of them! Really cool tech.

livedesignonline.com/news/claypaky-… At the retail sticker price that's £4M worth of lights.
May 23, 2021 • 4 tweets • 1 min read
Oh, interesting. I had thought the big semi-transparent video screen they dropped down on the left (stage right) at Eurovision was some ridiculous bleeding-edge transparent OLED tech, but it's just a *really* well made LED mesh grid. Dark from the rear. Photo of the transparent vi... Usually you can see all the minor grid lines from the front - the inconsistent pixel pitch is a dead giveaway that they're using mesh - and there can be nasty moire patterns. But this thing was flawless.
Jan 30, 2021 • 10 tweets • 2 min read
All GNU stuff is a fucking shitshow. Maintainers complain about not having the resources to solve long-term issues but at the same time make every possible effort to alienate people and discourage contributions.
May 11, 2020 • 4 tweets • 1 min read
I feel like pentesting as a job forces you to internalise a lot of pressure to find security issues, and that tends to lead to being slightly less realistic about threat models because you really want your findings to be important. The mental gymnastics become automatic. This isn't a dig at pentesters or infosec folks, and it's only somewhat spurred by the Thunderbolt paper. I am 100% guilty of overstating the realistic likelihood of issues. The longer I've been out of the pentest industry, the more I realise I was probably doing it all the time.
Jan 2, 2020 • 16 tweets • 10 min read
@kiwi_kali @Asher_Wolf This doesn't actually work very well on electronics. The idea is that the rice acts as a moisture absorption agent because it's mildly hygrophilic, which reduces the relative humidity of the air in the bag, so that the water in the device is slightly more likely to evapourate. @kiwi_kali @Asher_Wolf Unfortunately, water has really good surface tension, which means small pockets of water get stuck under components and parts inside the phone, and even if you strip all of the moisture out of the surrounding air those pockets will effectively never evapourate.
Dec 3, 2019 • 22 tweets • 8 min read
@cybergibbons Oh I have an absolute belter.

Have you ever been literally kidnapped and held at ransom by a client? I have! @cybergibbons I think this was my second on site job ever. It was way up north, a very long train ride home. The client was a finance org. I was with a slightly more experienced tester.

We arrived, the app wasn't ready.
Dec 3, 2019 • 12 tweets • 4 min read
Speaking of 4-pin Molex to 15-pin SATA cables catching fire, I thought this was a super interesting failure case so I did a bit of research into why they so commonly fail.

Thread. Just to be super clear about it, I'm talking about these things. They take a 4-pin Molex power connector from your PSU and turn it into a 15-pin SATA power connector for a modern disk drive.
Sep 22, 2019 • 33 tweets • 6 min read
I got frustrated at Gigabyte's RGB control stuff (I just REALLY want to turn my GPU LEDs off!) so I caved in and started reverse engineering RGB Fusion and OH GOD WHY DID I DO THAT IT IS SO HORRIBLY CURSED 1) They expose PCH GPIOs so they can bit-bang WS2812B LEDs from usermode.

2) Driver also gives direct read/write access to one of the smbus ports. Actually it might be more than one.

3) They expose some sort of ICSP flashing interface to an MCU?!

4) Driver object has no DACL.
Jan 4, 2018 • 4 tweets • 1 min read
It was known by Intel, AMD, Google Project Zero, and a few others during the multiparty responsible disclosure process, which took a couple of months. There's some speculation that Intel's CEO made his recent share divestment decision based on the disclosure timeline. Now that it has been disclosed I fully expect others to focus on more microarchitectural vulnerability research on x86, ARM, and other architectures. I think a lot of this was spurred by recent developments in cache side-channel attacks, so we're likely to see a repeat pattern.