Microsoft's fingerprint authentication has been hacked

So here's the thing. When you're dealing with a fingerprint reader, you've got multiple things interfacing. You've got the operating system, you've got the security library interfacing between the OS and fingerprint reader, and you've got the fingerprint reader.

Microsoft did a good job on the library. It's widely regarded as being secure and does a good job of authenticating fingerprints. And that's not where the problem is. The top three fingerprint scanner readers did a bad job of implementing their software that talks to Microsoft's library, and therein is the flaw.

At a Microsoft security conference, "A Dell Inspiron 15, Lenovo ThinkPad T14, and Microsoft Surface Pro X all fell victim to fingerprint reader attacks, allowing the researchers to bypass the Windows Hello protection as long as someone was previously using fingerprint authentication on a device." Three very common machines, including one sold by Microsoft themselves - but containing parts made by other vendors.

This is where being hard-assed on your vendors to make sure they're correctly implementing important things - such as security protocols - is VERY important!

I bought a new MacBook Pro earlier this year, and if my Apple Watch is unlocked, when I open up my laptop, it unlocks automatically. The laptop also has a fingerprint reader, but I never use it. My 2015 iMac also unlocks to my Watch - most of the time. It's pretty cool stuff. But if my Watch is off my wrist charging or in the case of my iMac, it just is feeling like being a bit troublesome, I can always enter my password manually.

As I have said many times before, and am sure that I'll be saying many times again, computer security is hard! It only takes one vendor to screw up, and a whole platform line can be compromised.

https://www.theverge.com/2023/11/22/23972220/microsoft-windows-hello-fingerprint-authentication-bypass-security-vulnerability

https://tech.slashdot.org/story/23/11/22/144250/microsofts-windows-hello-fingerprint-authentication-has-been-bypassed

Massive cryptomining rig found under the floor of a courtroom in Poland!

Very interesting. Arrests have been made and a computer consulting firm responsible for maintaining systems in the court house has been fired.

The computer rig was not connected to the court's network - apparently it had its own "modems", but it was stealing a significant amount of power, which makes it a prosecutable offense. There is also no indication as to how long the rig had been running. I'm sure the investigation will uncover these points of information.

https://arstechnica.com/tech-policy/2023/11/secret-cryptomining-rig-found-hidden-in-the-floors-of-a-polish-court/

https://slashdot.org/story/23/11/21/2213231/massive-cryptocurrency-rig-discovered-under-polish-courts-floor-stealing-power

The Muskbrat tells advertisers to "Go fuck yourselves"

He literally said this, on camera, in front of a live audience, in an interview at the New York Times DealBook Summit.

The event in question: ''On November 15, Musk replied, "You have said the actual truth" to an X post that said Jewish communities are "pushing hatred against whites."

Many major advertisers immediately suspended advertising on the platform or flat-out cancelled contracts due to this on-going shit by the head shit-gibbon.

In the Ars article, he goes on to say "he regretted making the post that kicked off the advertiser boycott. "I should in retrospect not have replied to that one person and should have written in greater length what I meant," Musk reportedly said. "But those clarifications were ignored by the media and essentially I handed a loaded gun to those who hate me and arguably to those who are antisemitic. And for that I'm quite sorry, that was not my intention."

Musk also called it "one of the most foolish—if not the most foolish—thing I've done on the platform."

Well, yeah. We know you're an idiot. You're embracing Nazis, Pizzagate apparently, and you're not doing much to deny or shut down such trolls. And you're wondering why advertisers are fleeing your site?

I appreciate what he's done with SpaceX, it has truly revolutionized space flight, though the concept of colonizing Mars is really idiotic. The only thing that impresses me about Tesla is the nation-wide charging network, the build quality of their cars has massively plummeted. And the fact that he kicked out the guys who invented the car from the corporation just plain sucks. But that's the kind of asshole that he is. He thinks because he was born with a gold spoon in his mouth that he's brilliant. The problem is, he's not as smart as he thinks he is and doesn't appreciate how much privilege his money has brought him, especially that his starting money came from daddy's opal mine in South Africa.

https://arstechnica.com/tech-policy/2023/11/elon-musk-on-x-antisemitism-controversy-dont-advertise-go-f-yourself/