• 2 Posts
  • 29 Comments
Joined 1 year ago
cake
Cake day: June 5th, 2023

help-circle

  • Economists at JP Morgan, the largest US bank by assets, published a research paper on de-dollarization in 2023.

    In reference to the global economy as a whole, they concluded that, “while marginal de-dollarization is expected, rapid de-dollarization is not on the cards”.

    However, they argued that, “Instead, partial de-dollarization — in which the renminbi assumes some of the current functions of the dollar among non-aligned countries and China’s trading partners — is more plausible, especially against a backdrop of strategic competition”.

    The JP Morgan economists added, “This could over time give rise to regionalism, creating distinct economic and financial spheres of influence in which different currencies and markets assume central roles”.

    This seems inline with the Chinese leadership game of influence, as well as the clown show that the US has become. Even with the interest still there from the US standpoint two decades of GWT, the lack of prioritize spending on following our so called values, the very high debt to GDP ratio we are running, the lack of real legislative ability, plus other challenges, all make the fundamentals seem less fundamental. Although China very much has it’s own issues such as an excess of manufacturing, a housing bubble, and a very steep demographic bubble. So their fundamentals are seemingly similar in question, but they have a marked ability to pivot quickly and do seem to be using their status as the 2nd largest economic to garner the same level of influence.

    Whether either has staying power of economics and global influence for the next 50 years is a very interesting question.

    I certainly don’t count the US out yet, but even if the election settles things down, there is some real work to do which has little to do with the current hotly discussed policy topics. I’d be curious about your opinions?





  • A brief technical summary from iMAP reveals what happens when users attempt to access sites using Cloudflare and Google DNS.

    • On Maxis, DNS queries to Google Public DNS (8.8.8.8) servers are being automatically redirected to Maxis ISP DNS Servers;

    **

    • On Time, DNS queries to both Google Public DNS (8.8.8.8) and Cloudflare Public DNS (1.1.1.1) are being automatically redirected to Time ISP DNS servers.

    “Instead of the intended Google and Cloudflare servers, users are being served results from ISP DNS servers. In addition to MCMC blocked websites, other addresses returned from ISP DNS servers can also differ from those returned by Google and Cloudflare,” iMAP warns.

    "Users that are affected, can configure their browser settings to enable DNS over HTTPS to secure their DNS lookups by using direct encrypted connection to private or public trusted DNS servers. This will also bypass transparent DNS proxy interference and provide warning of interference,” iMAP concludes.

    Essentially Malaysia law required ISP to drop DNS entries for some sites, local users started using public DNS. ISP started redirecting public DNS requests, and local users started using DNS over HTTPS.

    The pirate wars continue in their arms races.













  • If this request worked, it meant that I could use an “encryptedValue” parameter in the API that didn’t have to have a matching account ID.

    I sent the request and saw the exact same HTTP response as above! This confirmed that we didn’t need any extra parameters, we could just query any hardware device arbitrarily by just knowing the MAC address (something that we could retrieve by querying a customer by name, fetching their account UUID, then fetching all of their connected devices via their UUID). We now had essentially a full kill chain.

    I formed the following HTTP request to update my own device MAC addresses SSID as a proof of concept to update my own hardware:

    Did it work? It had only given me a blank 200 OK response. I tried re-sending the HTTP request, but the request timed out. My network was offline. The update request must’ve reset my device.

    About 5 minutes later, my network rebooted. The SSID name had been updated to “Curry”. I could write and read from anyone’s device using this exploit.

    This demonstrated that the API calls to update the device configuration worked. This meant that an attacker could’ve accessed this API to overwrite configuration settings, access the router, and execute commands on the device. At this point, we had a similar set of permissions as the ISP tech support and could’ve used this access to exploit any of the millions of Cox devices that were accessible through these APIs.

    Blows me a away that an unauthenticated API with sensitive controls and data was publicly facing. Corporations these days want all your data but wonder why some customers are worry about how it is protected, it let alone if it’s being sold. Why should I allow you to control my hardware when you can’t protect yourself.


  • Trying to find independent analysis that I read, but can’t find it. This will likely have the most impact on swing voters in the 7 states, which are the most important voters in the US. Everyone else is much more likely to have already made their mind up. And remember about 50-66% of the registered voters in the US actually vote even in a presidential year, although the electoral college complicates the proportional representation of those voters.

    From Washington post article

    With 158 days until Election Day, he is fighting for a plurality of 30 million voters in seven battleground states — a far cry from the tens of thousands of Iowa party activists he courted a year ago. His advisers have long feared that a felony conviction could hurt Trump with independent voters, particularly skeptical suburban women. In places such as the Atlanta suburbs, those voters cost him the 2020 election.