<|endoftext|>
That's what Cisco Talos's William Largent found when he took a look at "Circle with Disney", a Circle Media parental control device on which the entertainment giant slapped its brand.
Whatever its qualities in filtering an screen time management, the US$99 box is riddled with 23 vulns, as the Talos post discloses.
The good news is that Talos described Circle Media as ��exemplary to work with��, which is just as well when you've got to deal with backdooring, privilege escalation, remote code execution, authentication bypass, firmware substitution, certificate impersonation and more.
The backdoor arises in CVE-2017-12084, described in full here.
A remote client binary is meant to give admins remote cloud control of the device via a Meet Circle domain, but it lets an attacker send a sequence of packets to the device's SSH server, open a persistent backdoor, and send API calls to the server.
In CVE-2017-2865 (full description here), firmware is fetched over HTTP using wget, so an attacker can MITM the process and install their own firmware.
If the Circle with Disney device is visible to an attacker through the firewall (or installed outside the firewall), they can exploit CVE-2017-12087, a buffer overrun bug in the tinysvcmdns DNS responder.
Helpfully (to an attacker), CVE-2017-12085 provides one such path to the target device: ��An exploitable routing vulnerability exists in the Circle with Disney cloud infrastructure. A specially crafted packet can make the Circle cloud route a packet to any arbitrary Circle device.��
Circle Media pushed updates to devices before Talos went public. ®<|endoftext|>Vince Gilligan, creator of Breaking Bad, told the TV Fanatic website before the premiere of Sunday��s ��Ozymandias�� that it was ��the best episode we ever had or ever will have.��
Looks like he was dead right about that.
PHOTOS: 'Breaking Bad': 20 Most Badass Quotes
��Ozymandias,�� like the Percy Bysshe Shelley poem it was named after, echoed the king��s (or in this case, kingpin's) failed bravado and the desert wasteland of utter failure:
My name is Ozymandias, king of kings: Look on my works, ye Mighty, and despair!
Nothing beside remains. Round the decay
Of that colossal wreck, boundless and bare
The lone and level sands stretch far away.
It was an episode that put an exclamation point of a climax on last week��s unfinished but predictably bad business: Gomey is killed in the shootout. Hank lives long enough to be shot dead in cold blood by Jack. Hank��s death both simultaneously crushes Walt and in turn makes him embrace the evil that he��s become. Marie, still thinking Hank is alive, confronts Skyler and makes her tell Walter Jr. the tragic truth. In scenes that rushed by so quickly and were heart-stopping in their intensity and crushing truth, the White family lies came undone.
But it didn��t stop there. The episode seemed to race through reveals and shocking moments -- Walter Jr.��s anguish and anger at both of his parents and calling out Skyler for being an accomplice. ��How can you keep this a secret? Why would you go along?�� he yells at Skyler. ��If all this is true and you knew about it, then you��re as bad as him.��
Except that she��s not, because it would be almost impossible to be as bad, broken, disillusioned, unrepentant and evil as Walt. This episode was written by Moira Walley-Beckett and directed by Rian Johnson. The duo worked real genius in this hour. Johnson, in the middle of a tense scene after Hank has been shot dead in front of Walt, lets Walt��s eyes drift under the Cadillac where Jesse has avoided detection. Other elements play out -- the hint being that Walt said nothing and Jack and his Nazi pals, plus Todd (��Sorry for your loss��) have stolen all but one barrel of Walt��s money and are about to leave. The elapsed time is a wonderful feint because of what Walt does before they leave. He doesn't save Jesse. He doesn't protect him. He calls for his killing. ��Pinkman. You still owe me,�� he says to Jack, who in turn replies, ��If you can find him, we��ll kill him.��
��Found him.��
God, was that last line chilling. I might even argue that��s the precise moment