Conversation

Notices

1. Embed this notice
   Sick Sun (sun@shitposter.world)'s status on Friday, 30-Aug-2024 01:16:22 JST Sick Sun
   A specially-crafted IPv6 packet can let you completely own a Windows 10, 11 or Server. The only solution right now is to completely disable IPv6
   
   https://www.theregister.com/2024/08/28/proofofconcept_code_released_for_zeroclick/
   • Doughnut Lollipop 【記録係】:blobfoxgooglymlem: likes this.
   • Embed this notice
     Doughnut Lollipop 【記録係】:blobfoxgooglymlem: (tk@bbs.kawa-kun.com)'s status on Friday, 30-Aug-2024 01:18:16 JST Doughnut Lollipop 【記録係】:blobfoxgooglymlem:

     in reply to
     @sun Microsoft really should put more effort into the code safety of the Windows codebase. :blobfoxgoogly:
     Haelwenn /элвэн/ :triskell: likes this.
   • Embed this notice
     翠星石 (suiseiseki@freesoftwareextremist.com)'s status on Friday, 30-Aug-2024 01:19:56 JST 翠星石

     in reply to
     @sun I'm not sure if it's possible to disable IPv6 from windows itself, as really the vulnerability hits before the firewall.
     
     microsoft has released an update that fixes the vulnerability, but the only proper solution is to install GNU clearly.
   • Embed this notice
     Sick Sun (sun@shitposter.world)'s status on Friday, 30-Aug-2024 01:20:50 JST Sick Sun

     in reply to

     • 翠星石
     @Suiseiseki The way you used to do it is, you navigate through control panel to network connections then get the properties of the network interface, and remove IPv6.
   • Embed this notice
     Doughnut Lollipop 【記録係】:blobfoxgooglymlem: (tk@bbs.kawa-kun.com)'s status on Friday, 30-Aug-2024 01:22:27 JST Doughnut Lollipop 【記録係】:blobfoxgooglymlem:

     in reply to

     • Doughnut Lollipop 【記録係】:blobfoxgooglymlem:
     @sun Maybe they could get some tips from the #OpenBSD folks. :blobfoxgooglytrash:
   • Embed this notice
     guizzy (guizzy@shitposter.world)'s status on Friday, 30-Aug-2024 01:27:44 JST guizzy

     in reply to
     @sun Or patch, no?
   • Embed this notice
     Sick Sun (sun@shitposter.world)'s status on Friday, 30-Aug-2024 01:27:44 JST Sick Sun

     in reply to

     • guizzy
     @guizzy I read it can still be done but maybe they patched again
   • Embed this notice
     Haelwenn /элвэн/ :triskell: (lanodan@queer.hacktivis.me)'s status on Friday, 30-Aug-2024 01:33:32 JST Haelwenn /элвэн/ :triskell:

     in reply to

     • Doughnut Lollipop 【記録係】:blobfoxgooglymlem:
     @tk @sun At the same time it makes me wonder about how well network stacks are tested and fuzzed, it doesn't seems that great so wouldn't say it couldn't also happen in Linux.
     Doughnut Lollipop 【記録係】:blobfoxgooglymlem: likes this.
   • Embed this notice
     guizzy (guizzy@shitposter.world)'s status on Friday, 30-Aug-2024 01:41:23 JST guizzy

     in reply to
     @sun Do you have a link to where it was mentionned the august patch was ineffective? If it is, I have clients to advise and maybe emergency maintenances to schedule
   • Embed this notice
     Sick Sun (sun@shitposter.world)'s status on Friday, 30-Aug-2024 01:41:23 JST Sick Sun

     in reply to

     • guizzy
     @guizzy I was mistaken. The issue is that it's easier now because poc code was released, but yes it is patched.