The linked article really beats around the bush before describing the attack. This link is a bit better:
https://dheatattack.gitlab.io/dheater/
It honestly doesn't seem that impactful to me.
Where is the actuation mechanism for that that though? There does not appear to be any circuitry for that here. At a minimum you'd need something that would engage/disengage the cells, either a FET or a IGBT. (the voltage drop on other devices would be too large).
For cell #1, my guess is that the 4 parallel resistors (R3) are the balancing resistors and that Q1 is a small logic level MOSFET which enables cell balancing.
On a BMS project I'm working on balancing current is only 250mA, so a small SOT-23 MOSFET is all you would need.
I agree with the discussion here. State machines are very useful. The best thing about them is how easy they makes documentation. You just draw a state diagram and you're done!
This is answered in a response[1] to the grandparent post.
"The reason that PI was not detected is because the attacker embedded a Flash object inside the Excel file. The Flash file was a 0day exploit that could download and execute a file, which in this case was the attacker's PI client."
The reason that PI was not detected is because the attacker embedded a Flash object inside the Excel file. The Flash file was a 0day exploit that could download and execute a file, which in this case was the attacker's PI client.
The Poison Ivy client was downloaded to the target system. Why did the anti-malware software installed there not pick it up? (Attempting to hand-wave this away by talking about 0-day flash exploits really isn't answering the question.)
It's common for the free detectable version of popular trojans to be used as the advertisement for the paid undetectable one.
Looking at the poison ivy website they have a customer portal, so presumably this is how they did it.
There are also methods to pay without leaving a paper trail back to you (pre-paid cards I think).
Edit: It's also possible to modify detectable executables to make them undetectable if you don't want to pay. Virus scanners for the most part work by reading a few bytes from an executable at a particular point, hashing those bytes and if they match a known virus, report it as one. By finding those parts of the executable (there are often multiple signatures, and different vendors will have different signatures too) and modifying them slightly, the resultant hash will be different and the executable undetected.
ianaee, but the board from the led bulb looks just as hand soldered as the board from the cfl. I don't think the following argument holds up very well.
"I was quite impressed by the use of connectors in this bulb rather than relying on low-cost-labor for hand-soldering which has been used in the manufacturing of CFLs."
The OP also argues that the patent could be defeated by a patent review.
"Virtually none of the patents that patent trolls buy would be issued today. The vast majority of these patents would not survive a U.S. Patent & Trademark Office patent review. Most were issued during the 1990s when the standards for business process patents were very low."
The OP goes on to say that the victims of patent trolls band together to finance the review to make it cheaper than settling.
It is impossible to expect the USPTO to determine novelty and non-obviousness for software patents. Imagine how difficult it would be to examine mechanical engineering patents if millions of people carried machine shops around in their backpacks.
> The OP also argues that the patent could be defeated by a patent review.
Yes, but the OP ignores the probability of failure. I'm claiming that even a small probability of failure would be sufficient to deter most businesses from pursuing the OP's advice because the costs of a defeat are so much greater than the costs of a settlement.
> The OP goes on to say that the victims of patent trolls band together to finance the review to make it cheaper than settling.
I'm not disputing that. The problem I'm pointing out does not have to do with financing the review, but with the fines that are due if you lose the case. Even if you band together to finance the review, if you lose, you have to pay the fines individually.
Maybe I'm naive but it could simply be because they are evaluating it for internal use. The FBI and CIA don't want to use vulnerable browsers any more than we do.
I'm going to say that's definitely naive. It's a well-known fact that the US government has gradually been placing more and more emphasis on "cyber-warfare" over the last several years. A 0-day vulnerability allowing code execution (in a browser that's popular with tech-savvy users, even) is a very valuable tool in that regard.
No. You can't put statements in this, only expressions. It's a limited special case instead of a generic tool (and putting a sequence of conditionals and actions is not going to look good, though I'm sure you can coerce them into it using the "," operator, as long as you don't need to have an iteration as well).
There are languages which have pretty much exactly what he describes (Smalltalk for instance), but "many mainstream languages" don't.
They should think about building this into the bottom of an insulated coffee cup. Another good product would be to put the thermal material in a silicon jacket instead of stainless steel so that it could be microwave safe.
