Linux TCP Flaw

The one that I think was biggest was the Linux TCP flaw.

The people in the know, like the head of Cloudflare, have said that there's a flood of serious vulnerabilities going to come out at the rate of about once a week, like the massive PHP flaw we talked about last time, and we ought to get used to it.

And this looks like the big one for this week, a Linux kernel TCP flaw with the rating of 9.8% It affects Ubuntu, Red Hat, and other distributions.

It's a race condition that causes use after free.

The attack takes an hour to run, and then you get root-level command execution.

Some Linux distributions have patches, and others don't.

And I think there are a ton of these.

I think everything we use pretty much has got serious flaws like this that have been neglected for years because without AI, they either couldn't find them or they couldn't exploit them.

And they're all coming out now.

And there's graphs showing the number of vulnerabilities found is going up really massively this year.

And so there's just going to be a lot of these.

And do you know much about it? No.

No. no just that much uh and they tend to be difficult to exploit but ai writes the attack so um yeah And so I got a lot of other vulnerabilities and I think there's just gonna be a ton of vulnerabilities every week for a long time now.

I think we're finally hitting the crunch where AI is pumping them out.

There's a nice, I think it's a Wired article showing SS7 flaws.

Now it's believing computer, but really it's nice.

I've read about this all my life.

SS7 and diameter are the protocols used for telephones.

And the SS7 is apparently so old it has no authentication at all.

otherwise ridiculously vulnerable.

Diameter, he's used in 4G and 5G, and in principle could be more secure, but in practice is often deployed without turning on the encryption or authentication.

So it remains outrageously vulnerable.

So this is what I've heard for decades, is it's very easy to intercept SMS messages and reroute phone calls and such.

Apparently that is still true.

Well, for a while there, it was not backed up.

The one that I think was biggest was the Linux TCP flaw.

The people in the know, like the head of Cloudflare, have said that there's a flood of serious vulnerabilities going to come out at the rate of about once a week, like the massive PHP flaw we talked about last time, and we ought to get used to it.

And this looks like the big one for this week, a Linux kernel TCP flaw with the rating of 9.8% It affects Ubuntu, Red Hat, and other distributions.

It's a race condition that causes use after free.

The attack takes an hour to run, and then you get root-level command execution.

Some Linux distributions have patches, and others don't.

And I think there are a ton of these.

I think everything we use pretty much has got serious flaws like this that have been neglected for years because without AI, they either couldn't find them or they couldn't exploit them.

And they're all coming out now.

And there's graphs showing the number of vulnerabilities found is going up really massively this year.

And so there's just going to be a lot of these.

And do you know much about it? No.

No. no just that much uh and they tend to be difficult to exploit but ai writes the attack so um yeah And so I got a lot of other vulnerabilities and I think there's just gonna be a ton of vulnerabilities every week for a long time now.

I think we're finally hitting the crunch where AI is pumping them out.

There's a nice, I think it's a Wired article showing SS7 flaws.

Now it's believing computer, but really it's nice.

I've read about this all my life.

SS7 and diameter are the protocols used for telephones.

And the SS7 is apparently so old it has no authentication at all.

otherwise ridiculously vulnerable.

Diameter, he's used in 4G and 5G, and in principle could be more secure, but in practice is often deployed without turning on the encryption or authentication.

So it remains outrageously vulnerable.

So this is what I've heard for decades, is it's very easy to intercept SMS messages and reroute phone calls and such.

Apparently that is still true.

Well, for a while there, it was not backed up.