Active Topics
-
Maemo repository (5)
to Community by dredlok706 - 1 day, 17 hrs ago -
Re-commissioning N9 in 2018 (127)
to MeeGo / Harmattan by smatkovi - 1 day, 20 hrs ago -
Porting apps to Leste (41)
to Maemo 7 / Leste by Arno_11 - 2 days, 13 hrs ago -
List of well performing apps on Leste (33)
to Maemo 7 / Leste by teroyk - 2 days, 22 hrs ago -
N900 is not recognizable on any of my devices (windows 10,7, xp) What can I do? (1)
to Nokia N900 by nieldk - 4 days, 1 hr ago - more...
|
nieldk
|
2014-09-26
, 09:34
|
|
Guest |
Posts: n/a |
Thanked: 0 times |
Joined on
|
#31
|
Originally Posted by javispedro
Will test later when I am at home on my linux box
 |
|
2014-09-26
, 16:31
|
|
Posts: 4,708 |
Thanked: 4,649 times |
Joined on Oct 2007
@ Bulgaria
|
#32
|
Originally Posted by LadyBug
Here is the whole page:
If someone is curious how shellshock could be used to attack a Sailfish device, this illustrates one attack vector: https://pbs.twimg.com/media/ByZZUzmIIAAuFaR.jpg:large
That is, a malicious DHCP server could attack by sending code in the options field. I haven't verified this with my Jolla, but in theory this could be bad. Think of public WIFI access points...
https://www.trustedsec.com/september...proof-concept/
__________________
Technically, there are three determinate states the cat could be in: Alive, Dead, and Bloody Furious.
Technically, there are three determinate states the cat could be in: Alive, Dead, and Bloody Furious.
| The Following User Says Thank You to Bundyo For This Useful Post: | ||
 |
|
2014-09-26
, 17:25
|
|
Moderator |
Posts: 3,718 |
Thanked: 7,420 times |
Joined on Dec 2009
@ Bize Her Yer Trabzon
|
#33
|
why do I keep thinking of Turtles in Time (for the SNES) when I read 'Shellshock'?
(when you died, it said 'shellshock'. good old times)
(when you died, it said 'shellshock'. good old times)
| The Following 4 Users Say Thank You to HtheB For This Useful Post: | ||
|
|
2014-09-26
, 20:05
|
|
Posts: 252 |
Thanked: 597 times |
Joined on Oct 2011
@ Denmark
|
#34
|
Originally Posted by Bundyo
Closing a bug report before the bug is fixed is not a good idea if you ask me.
https://together.jolla.com/question/...#post-id-56855
This is the official answer, the thread was closed
Last edited by LouisDK; 2014-09-27 at 16:04.
|
|
2014-09-26
, 20:49
|
|
Guest |
Posts: n/a |
Thanked: 0 times |
Joined on
|
#35
|
Originally Posted by HtheB
That game was good and hard; the good kind of frustrating hard. Damn you... now I want to play it again...
why do I keep thinking of Turtles in Time (for the SNES) when I read 'Shellshock'?
(when you died, it said 'shellshock'. good old times)
| The Following User Says Thank You to For This Useful Post: | ||
 |
|
2014-09-27
, 00:04
|
|
Posts: 2,355 |
Thanked: 5,249 times |
Joined on Jan 2009
@ Barcelona
|
#36
|
Originally Posted by nieldk
Try to write to a file in /tmp since you're not going to easily know where stdout from connman is redirected.
Will test later when I am at home on my linux box :
| The Following User Says Thank You to javispedro For This Useful Post: | ||
|
|
2014-09-27
, 08:09
|
|
Posts: 1,067 |
Thanked: 2,383 times |
Joined on Jan 2012
@ Finland
|
#37
|
gdhcp is not setting any env variables, so it should not be vulnerable. But if you manage to find an exploit then feel free to send steps to reproduce email to security@jolla.com
__________________
IRC: jonni@freenode
Sailfish: ¤ Qt5 SailfishTouchExample ¤ Qt5 MultiPointTouchArea Example ¤ ipaddress ¤ stoken ¤ Sailbox (Dropbox client) ¤
Harmattan: ¤ Presence VNC for Harmattan ¤ Live-F1 ¤ BTinput-terminal ¤ BabyLock ¤ BabyLock Trial ¤ QML TextTV ¤
Disclaimer: all my posts in this forum are personal trolling and I never post in any official capacity on behalf of any company.
IRC: jonni@freenode
Sailfish: ¤ Qt5 SailfishTouchExample ¤ Qt5 MultiPointTouchArea Example ¤ ipaddress ¤ stoken ¤ Sailbox (Dropbox client) ¤
Harmattan: ¤ Presence VNC for Harmattan ¤ Live-F1 ¤ BTinput-terminal ¤ BabyLock ¤ BabyLock Trial ¤ QML TextTV ¤
Disclaimer: all my posts in this forum are personal trolling and I never post in any official capacity on behalf of any company.
| The Following 2 Users Say Thank You to rainisto For This Useful Post: | ||
|
|
2014-09-27
, 11:42
|
|
Guest |
Posts: n/a |
Thanked: 0 times |
Joined on
|
#38
|
Originally Posted by rainisto
seems true, I couldnt use dhcp to trick connman exploit, neither with included bash, or my build
gdhcp is not setting any env variables, so it should not be vulnerable. But if you manage to find an exploit then feel free to send steps to reproduce email to security@jolla.com
| The Following 2 Users Say Thank You to For This Useful Post: | ||
|
|
2014-09-27
, 11:52
|
|
Guest |
Posts: n/a |
Thanked: 0 times |
Joined on
|
#39
|
| The Following 4 Users Say Thank You to For This Useful Post: | ||
|
|
2014-09-27
, 14:00
|
|
Community Council |
Posts: 4,920 |
Thanked: 12,867 times |
Joined on May 2012
@ Southerrn Finland
|
#40
|
Originally Posted by nieldk
All so true. Yet, this is something that happens all over again, whether the used components are FFOS or developed in-house. Sometimes a first-implemented solution works so well that proper break-in testing is not done... usually because of not enough time[*].
internet of things - worth a reading
http://paste.lisp.org/display/143864
[*] There's never enough time to do things properly, but always time to fix them later
