Tenable TechBlog

Excellent catches. I would like to put https://medium.com/tenable-techblog/g-3po-a-protocol-droid-for-ghidra-… in the second-chance pool (so it would get a random placement on HN's front page - see https://news.ycombinator.com/item?id=26998308), but unfortunately https://news.ycombinator.com/item?id=34161642 is too old and I can't contact the submitter. Would you be willing to submit https://medium.com/tenable-techblog/g-3po-a-protocol-droid-for-ghidra-… and email us at [email protected] so we can put it in the SCP manually?

Web server itself could be an attack vector too. Although not specified to TP-Link, There are many exploits on other brands that can bypass the Authentication. For example this one: https://medium.com/tenable-techblog/bypassing-authentication-on-arcady… Even allowing access the web server from internet could be dangerous.

Data from a lot of users? I mean, they inspect all audio/video communications in real-time[1] and save all your messages, pictures etc. It also helps a lot that basically no one cares about privacy anymore, so further growth seems secured. [1] https://medium.com/tenable-techblog/lets-reverse-engineer-discord-1976…

You are right, ICE does support TCP. Not all ICE implementations support it though, probably where the incorrect anecdote comes from. ICE TCP did get a little more limited recently in Chromium though [0] because of the TCP port scanning issue [1] I have also heard that some gateways/firewalls/$x don't allow any non-TLS traffic, so you can't even establish ICE. In those cases the DTLS/TLS transport of TURN is nice. [0] https://lists.w3.org/Archives/Public/public-webrtc/2020Feb/0022.html [1] https://medium.com/tenable-techblog/using-webrtc-ice-servers-for-port-…

This is linking to a specific reddit comment, which is downvoted to -12. Why link to that instead of the original blog post? https://medium.com/tenable-techblog/lets-reverse-engineer-discord-1976…

Yes, a few days ago there was a story in HN that went mostly ignored: “G-3PO: A Protocol Droid for Ghidra” https://medium.com/tenable-techblog/g-3po-a-protocol-droid-for-ghidra-… https://news.ycombinator.com/item?id=34161642 That’s a script for the reverse-engineering tool Ghidra that uses GPT-3 to de-compile machine code and to write plain English explanations of what a piece of code does. The article is quite detailed and describes both its capabilities and its limitations. That G-3PO script is open source, MIT license: https://github.com/tenable/ghidra_tools/tree/main/g3po There was also another HN story about what at first sight looks like an alternative implementation of the same idea: “GptHidra – Ghidra plugin that asks OpenAI Chat GPT to explain functions” https://news.ycombinator.com/item?id=34165291 This one is more recent and lacks that good write-up mentioned above. The script is smaller and it seems to have fewer features. I suggest checking both of them.

Pretty much, yes. WakaSaba's major offering - at least, that's what the headline and demo video focused on - seems to be a new control toolkit for video meetings, and I feel like it should be possible to get a good chunk of that without doing all the hard to work to develop, host, and maintain your own videoconferencing suite. Like, say I wanted to advance my slideshow without walking over to the keyboard on the podium; I could build a fancy smart remote that talks to the cloud with its own GSM radio and interfaces with a novel presentation suite specifically designed to integrate with my remote, or I could make my remote a bluetooth keyboard that can only press the left and right arrow keys and then keep PowerPoint focused. I don't know what enterprise conferencing suite would be easiest to talk to. It'd be straightforward if I wanted to use a local video stream, proxy `navigator.mediaDevices.getUserMedia` and generate synthetic click/keyboard events as necessary [1] or make like the remote and pretend to be a keyboard, but the really interesting thing would be to run WakaSaba on a second device and use it to control my "primary" presence. I took a quick spin through some different videoconferencing suites to see what looked doable: FaceTime: No API, no client SDK, no browser client, dead end. Google Meet: No API, no client SDK, but a web client. If they're using html5 video elements (which I haven't checked) you could probably intercept the streams, correlate them with…