Hacker Newsnew | past | comments | ask | show | jobs | submit | WaitWaitWha's commentslogin


Anyone seen similar research at least the same depth for other countries?

Some pen test teams use laptop stickers as an excellent resource for proper social engineering.

Some cyber companies explicitly prohibit stickers on company laptops.


>Some pen test teams use laptop stickers as an excellent resource for proper social engineering.

How?


Not the OP, but I have heard something similar from a sec conf before. Gist being if a laptop has stickers like this, then the chances of the owner being an engineer is significantly higher, so pentest teams / malicious actors can better focus their efforts on those individuals, and have a higher chance of gaining access to internal systems than if they targeted random folks in public.

Doesn't help as well that arguably the kind of stickers a laptop displays tends to hint at who's a sysadmin or not, etc.


That sounds like info you would already have by taking a look at LinkedIn or am I missing something?


You're missing something, but that's sorta the point. The idea of what a full-stack developer or back-end engineer or hacker (or whatever term we want to bandy about) looks like is largely based on stereotyping and a bit of myth. You can't tell what someone does for a living just by looking at them all of the time, but you can some of the time, so it's easy to play on that by dressing the part because we humans can be easily tricked into trusting our own information by default. If you cosplay as a network engineer, it's pretty likely that's what most people will think you do.

Say you're red teaming, and you are on-site looking to gain access to the server closet of a business. Some initial setup about you being there comes into play, but once there, it's up to you to look like you belong there, when some unwitting person with access to the server closet will lead you to it, then leave you to do your thing on the pleasant notion that you'll have the "problem" fixed by the end of the day. This is an ultra-simple scenario used as an example, but looking the part sometimes means having some stickers on your laptop that tell people you're really into a specific language or tool chain, or that you've been in the SOC trenches long enough to know what a lot of those inside jokes mean. Details often sell the lie.


The classic clipboard and high-vis hack.


I thought you could just measure the length of their beard.


Well, the _corporate_ stickers are a major giveaway, of course; if you have 15 AWS-related stickers it is highly likely that you work at Amazon, say, and it may not necessarily be wise to make it clear that your laptop is an Amazon corporate laptop, in public.

Beyond that, you could _maybe_ use it to identify a person's interests for social engineering purposes, but that feels a lot more tenuous.


Many of the stickers display political affiliation.


How would pen testers leverage this?



The number of years I got "free credit monitoring" I can pass it down to my children . . .


I feel like only in the US is credit monitoring something sold as an optional service.

I got a confirmation mail from System76, because apparently they feel the need to validate my credit card can’t be used without my approval, but my back does this by default…


Yes. US residents' ability to obtain credit (cards, cars, houses) is based on three shadowy for-profit organizations who each keep a secret score on each resident.

One's employment history is not a factor in the score at all (contrast this with Europe).

Furthermore, privacy in the USA is so bad, the leaking of one's personal details which criminals can use to fraudulently obtain credit and ruin said score and possibly also one's finances is a major concern. Hence, "credit monitoring" exists in order to catch this kind of criminal activity in the act, and I don't know, become completely exasperated with the amount of ass pain that dealing with this then causes.


Credit monitoring has nothing to do with Credit Cards.

Most banks in America indeed do offer (for free) the option to be notified for each transactions if you want.


Vendor lock in.

https://news.ycombinator.com/item?id=45658056

edit: Feel free to down but the evidence is in the products.

Zigbee will work with any other Zigbee device if it is properly implemented. not so with Thread.


Please enlighten me how the ip-network-using mattress in any way relates to a Matter and Thread network


>I can only speak to my experience, certified devices by the largest firms will mostly not interoperate (fails around authN).

>Apple: Keeps Thread credentials locked to HomeKit's border routers.

>Google: Shares some credentials, but only within Google Account environment.

>Amazon: TBD, but their Matter implementation is mostly cloud-tied.

>Samsung: Hybrid approach; still best when used inside SmartThings, their 1.4 update seems to support for joining existing Thread networks. Still have to test it.

>So, even though Thread theoretically allows full interoperability, no vendor wants to be reduced to a dumb router in someone else’s ecosystem.

>there is no easy way to bridge Apple Thread to Home Assistant or Google Thread, even though it is theoretically supposed to be possible from a protocol standpoint.

>If you have such solutions, let me know, because I would take full advantage of it, and will regale your contributions in multiple home automation threads.



The third one appears to be cooperating with LEO based on how they are being left unnamed.


Possible. My first random guess was that they are underage.


Zero Cool.


I would like to understand the first half of the demands, fight for living wages. How much do the union members currently make? It is very easy to understand 32 hours workweek in 4 days, but there is nothing I can find in the article about what is their current wages. I did find the minimum they are looking for is $85,000.

On one of the pages the demand is written as "Codifying the 32-hour, 4-day work week that has been our reality for over three years". So they work 32-hour workweek just not codified in company policy? Are there US labour laws or health insurance agreements that doing 32 hours officially will create problems?


I think this might be an opportunity for runner-up mobile hardware manufacturers to build their models so alternate OSes can be loaded.


to your point, not exactly a one-to-one, but several discount airlines (e.g., RyanAir, PLAY, Allegiant, Frontier, Spirit, Wizz, Flair, AirAsia) already require an app to check in for a flight, or pay a fee. No app (or the horrors, no mobile), it cannot be done on a regular computer, must go to a ticket counter and pay a fee.


This isn't a problem, these apps will probably run fine under emulators. It's only wildvine/play protect stuff that barfs.


They'll run fine until they don't, because they'll hook up to remote attestation "for sekhurity" like more important apps do. Not to mention, those apps' vendors don't particularly want you to run their apps in emulators either - there's no use case for this they consider not harmful to their business.


Maybe some, but certainly not all in the list. Neither Ryanair nor Wizzair need app, you can do everything in the browser.


Guidelines | FAQ | Lists | API | Security | Legal | Apply to YC | Contact

Search: