A group of Security researchers has officially fucked hardware-level Intel botnet officially branded as "Intel Management Engine" they did so by gathering it all the autism they were able to get from StackOverflow mods... though they officially call it a Buffer Overflow.
On Wednesday, in a presentation at Black Hat Europe, Positive Technologies security researchers Mark Ermolov and Maxim Goryachy plan to explain the firmware flaws they found in Intel Management Engine 11, along with a warning that vendor patches for the vulnerability may not be enough.

Two weeks ago, the pair received thanks from Intel for working with the company to disclose the bugs responsibility. At the time, Chipzilla published 10 vulnerability notices affecting its Management Engine (ME), Server Platform Services (SPS), and Trusted Execution Engine (TXE).

The Intel Management Engine, which resides in the Platform Controller Hub, is a coprocessor that powers the company's vPro administrative features across a variety of chip families. It has its own OS, MINIX 3, a Unix-like operating system that runs at a level below the kernel of the device's main operating system.

It's a computer designed to monitor your computer. In that position, it has access to most of the processes and data on the main CPU. For admins, it can be useful for managing fleets of PCs; it's equally appealing to hackers for what Positive Technologies has dubbed "God mode."

The flaws cited by Intel could let an attacker run arbitrary code on affected hardware that wouldn't be visible to the user or the main operating system. Fears of such an attack led Chipzilla to implement an off switch, to comply with the NSA-developed IT security program called HAP.

But having identified this switch earlier this year, Ermolov and Goryachy contend it fails to protect against the bugs identified in three of the ten disclosures: CVE-2017-5705, CVE-2017-5706, and CVE-2017-5707.

The duo say they found a locally exploitable stack buffer overflow that allows the execution of unsigned code on any device with Intel ME 11, even if the device is turned off or protected by security software.

For more of the complete story go here:
https://blackhat.com/eu-17/...
https://theregister.co.uk/2017/12/...

I post mostly daily news, commentaries and such on my site for anyone that wish to drop by there

Hey all! It's a me, Skayo, you might know me from the very early years of devRant, my highlight bot, my random quote bot, the devRant-Community on GitHub or any of the dumb rants and things that I've posted during my time.

Since I'm currently doing a cleanup of my old GitHub repos and this platform is still somewhat active, I have decided to pass on or publish all my projects and things I've created for this community back in the days.

Firstly, I have just published and transferred the source codes for the @highlight bot, the @RandomQuote bot, the @here bot, and some weird bot framework to the devRant-Community GitHub organization (https://github.com/devRant-Communit...).
Feel free to check them out if you've ever wondered what awful, awful code was running in the background all these years!

Secondly, I am offering any of the following to anyone who's interested:
- Ownership of the "devRant-Community" organization on GitHub (https://github.com/devRant-Communit...)
- Credentials for the @RandomQuote devRant user
- Credentials for the @highlight devRant user
- Credentials for the @here devRant user
- Credentials for the @devNews devRant user
- Ownership of the "devNews" Discord server
- Ownership of the "Community Programming Book" Discord server
- Anything else that I've forgotten about, maybe check the comments

If you're interested, message me on Discord "@skayodev" or anywhere else I am active under that alias (f.e. Telegram).
I might do a little background check to prevent abuse and I AM NOT SELLING THEM, just giving them away.

Thank you devRant for all the fun we had together and for introducing me to some of my current best friends :)
A thank you especially to @dfox and @trogus, who have created this amazing platform! (and sorry for all of the bullshit I did back then lol)

I wish you all the best <3
~ Skayo

I’m back for a fucking rant.

My previous post I was happy, I’ve had an interview today and I felt the interviewer acted with integrity and made the role seem worthwhile. Fuck it, here’s the link:
https://www.devrant.io/rants/889363

So, since then; the recruiter got in touch: “smashed it son, sending the tech demo your way, if you can get it done this evening that would be amazing”

Obviously I said based on the exact brief I think that’s possible, I’ll take a look and let them know if it isn’t.

Having done loads of these, I know I can usually knock them out and impress in an evening with no trouble.

Here’s where shit gets fucked up; i opened the brief.

I was met with a brief for an MVP using best practice patterns and flexing every muscle with the tech available...

Then I see the requirements, these fucking dicks are after 10 functional requirements averaging an hour a piece.

+TDD so * 1.25,
+DI and dependency inversion principle * 1.1
+CI setup (1h on this platform)
+One ill requirement to use a stored proc in SQL server to return a view (1h)
+UX/UI design consideration using an old tech (1-2h)
+unobtrusive jquery form post validation (2h)
+AES-256 encryption in the db... add 2h for proper testing.

These cunts want me to knock 15-20h of Work into their interview tech demo.

I’ve done a lot of these recently, all of them topped out at 3h max.

The job is middling: average package, old tech, not the most exciting or decent work.

The interviewer alluded to his lead being a bit of a dick; one of those “the code comes first” devs.

Here’s where shit gets realer:
They’ve included mock ups in the tech demo brief’s zip... I looked at them to confirm I wasn’t over estimating the job... I wasn’t.

Then I looked at the other files in the fucking zip.

I found 3 of the images they wanted to use were copyright withheld... there’s no way these guys have the right to distribute these.

Then I look in the font folder, it’s a single ttf, downloaded from fucking DA Font... it was published less than 2mo ago, the license file had been removed: free for Personal, anything else; contact me.

There’s no way these guys have any rights to this font, and I’ve never seen a font redistributed legally without it’s accompanying licence files.

This fucking company is constantly talking about its ethical behaviours.

Given that I know what I’m doing; I know it would have taken less time to find free-for-commercial images and use a google font... this sloppy bullshit is beyond me.

Anyway, I said I’d get back to the recruiter, he wasn’t to know and he’s a good guy. I let him know I’d complete the tech demo over the weekend, he’s looked after me and I don’t want him having trouble with his client...

I’ll substitute the copyright fuckery with images I have a license for because there’s no way I’m pushing copyright stolen material to a public github repo.

I’ll also be substituting the topic and leaving a few js bombs in there to ensure they don’t just steal my shit.

Here’s my hypotheses, anyone with any more would be greatly welcomed...
1: the lead dev is just a stuck up arsehole, with no real care for his work and a relaxed view on stealing other people’s.
2: they are looking for 15-20h free work on an MVP they can modify and take to market
3: they are looking for people to turn down this job so they can support someone’s fucking visa.

In any case, it’s a shit show and I’ll just be seeing this as box checking and interview practice...

Arguments for 1: the head told me about his lead’s problems within 20mn of the interview.
2: he said his biggest problem was getting products out quickly enough.
3: the recruiter told me they’d been “picky”, and they’re making themselves people who can’t be worked for.

I’m going to knock out the demo, keep it private and protect my work well. It’s going to smash their tits off because I’m a fucking great developer... I’ll make sure I get the offer to keep the recruiter looked after.

Then fuck those guys, I’m fucking livid.

After a wonderful interview experience and a nice introduction to the company I’ve been completely put off...

So here’s the update: if you’re interviewing for a shitty middle level dev position, amongst difficult people, on an out of date stack... you need people to want you, don’t fuck them off.

If they want my time to rush out MVPs, they can pay my day rate.

Fuuuuuuuuck... I typed this out whilst listening to the podcast, I’m glad I’m not the only one dealing with shit.

Oh also; I had a lovely discriminatory as fuck application, personality test and disability request email sent to me from a company that seems like it’s still in the 90s. Fuck those guys too, I reported them to the relevant authorities and hope they’re made to look at how morally reprehensible their recruitment process is. The law is you don’t ask if the job can be done by anyone.