|
https://www.usenix.org/system/files/conference/woot16/woot16-paper-wustrow.pdfquote:DDoSCoin: Cryptocurrency with a Malicious Proof-of-Work
|
#
?
Aug 11, 2016 19:06
|
|
|
|
| # ? Jun 6, 2024 16:56 |
|
|
finally, a cryptocurrency actually worth something
|
|
#
?
Aug 11, 2016 19:12
|
|
|
it's a rewards program for ddosing but you don't get a free footlong sub at the end
|
|
#
?
Aug 11, 2016 19:18
|
|
|
spankmeister posted:Here's some really cool research that i can finally share with you guys: This is fuckin sick
|
|
#
?
Aug 11, 2016 20:19
|
|
|
My gym's website is a entire security fuckup De jour. 1) The signup doesn't ask for a password. 2) They email you a non-temp password in plain text to you. 3) The default password is 7 characters long. Mine was: I135479 4) It doesn't ask you to change your password. 5) When you eventually DO find the area on their website to change your password here are the requirements: Password must be between 5 and 12 characters, containing at least 1 letter and 1 number. (Nice varchar guys!) At least they obscure your credit card number! I wouldn't be surprised if you could straight up inject sql code into the password field.
|
|
#
?
Aug 11, 2016 20:29
|
|
|
http://www.reuters.com/article/us-france-internet-encryption-idUSKCN10M1KB
|
|
#
?
Aug 11, 2016 20:31
|
|
|
This cyberpunk future we live in loving owns. Perhaps if your counter-terrorism end-game is to ban math you should try a different approach? ate shit on live tv fucked around with this message at 20:48 on Aug 11, 2016 |
|
#
?
Aug 11, 2016 20:44
|
|
|
Powercrazy posted:This cyberpunk future we live in loving owns. The end-goal isn't so much to get rid of encryption programs but to make possession or use of them an arrestable offense or at the very least probable cause for a search warrant.
|
|
#
?
Aug 11, 2016 20:50
|
|
|
Trabisnikof posted:https://www.crowdstrike.com/blog/bears-midst-intrusion-democratic-national-committee/?_ga=1.157373434.1197647518.1466197788 Well not so fast: https://www.washingtonpost.com/loca...9d78_story.html
|
|
#
?
Aug 11, 2016 20:50
|
|
|
Optimus_Rhyme posted:Well not so fast: https://www.washingtonpost.com/loca...9d78_story.html gotta tie up loose ends (I know this because I watch The Americans on FX)
|
|
#
?
Aug 11, 2016 20:53
|
|
|
Optimus_Rhyme posted:Well not so fast: https://www.washingtonpost.com/loca...9d78_story.html Assange should listen to less Alex Jones, probably.
|
|
#
?
Aug 11, 2016 21:03
|
|
|
i'm having this waved in my face as a thing that i need to religiously stick to if i am using aws - https://d0.awsstatic.com/whitepapers/compliance/AWS_CIS_Foundations_Benchmark.pdf - but it seems like common-sense stuff and then also completely arbitrary at the same time (90 days for rotating keys), and doesn't really make the 'minimum required access on every account you make' angle hard enough. i think you could make a user that had access to everything on your aws account and put the keys into a lovely aws management app that you secure with a terrible password and that would tick all the boxes in that document.
Thanks Ants fucked around with this message at 22:19 on Aug 11, 2016 |
|
#
?
Aug 11, 2016 22:16
|
|
|
ratbert90 posted:My gym's website Yeah you could have just ended it there.
|
|
#
?
Aug 12, 2016 00:29
|
|
|
Parallel Paraplegic posted:The end-goal isn't so much to get rid of encryption programs but to make possession or use of them an arrestable offense or at the very least probable cause for a search warrant. I suppose civilian grade weaponized encryption is Cyberpunk as gently caress though.
|
|
#
?
Aug 12, 2016 01:08
|
|
|
spankmeister posted:Here's some really cool research that i can finally share with you guys: i may be way behind but oh my god this is really loving cool
|
|
#
?
Aug 12, 2016 02:44
|
|
|
spankmeister posted:Here's some really cool research that i can finally share with you guys: rowhammer the great sandbox killer is there any estimate for when computers will not be vulnerable to this? are new chipsets and ram less susceptible? quote:One significant remark about the Key ID changing (as a result of a bit flip) is that this caused the self-signature on the public keyring to be ignored by GPG! The signature contains the original Key ID, but it is now attached to a key with a different ID due to the public key mutation. As a result, GPG ignores the attached signature as an integrity check of the bit-flipped public key and the self-signing mechanism fails to catch our bit flip. The only side-effect is harmless to our attack GPG reports that the trusted key is not signed. apt ignores this without even showing a warning.
|
|
#
?
Aug 12, 2016 09:56
|
|
|
ratbert90 posted:My gym's website is a entire security fuckup De jour. The place I play badminton in has the password set as my post code and I can't change it. I haven't played around with because #care
|
|
#
?
Aug 12, 2016 10:47
|
|
|
suffix posted:rowhammer the great sandbox killer Well ECC doesn't fully mitigate it and DDR4 has a mitigation called TRR, but this doesn't always seem to work. I'd say it'll be at least a year or two until H/W mfg get their poo poo together and at least 5 years before most old hardware has been rotated out of service.
|
|
#
?
Aug 12, 2016 11:32
|
|
|
quote:Tavis Ormandy (@taviso) 1Pass supremacy remains.
|
|
#
?
Aug 12, 2016 11:50
|
|
|
bobfather posted:1Pass supremacy remains. quote:KeePass and KeePassX both look sane 
|
|
#
?
Aug 12, 2016 11:52
|
|
|
Mobile apps for Keepass lack polish. Ironically, the mobile 1Pass apps are leaps and bounds better than either the Windows or MacOS versions, solely because they support multiple Dropbox accounts.
|
|
#
?
Aug 12, 2016 12:05
|
|
|
Parallel Paraplegic posted:The end-goal isn't so much to get rid of encryption programs but to make possession or use of them an arrestable offense or at the very least probable cause for a search warrant. If it was gotten rid of completely then the governments wouldn't be able to keep their information secrets and we just can't have that.
|
|
#
?
Aug 12, 2016 12:22
|
|
|
spankmeister posted:Well ECC doesn't fully mitigate it and DDR4 has a mitigation called TRR, but this doesn't always seem to work. I'd say it'll be at least a year or two until H/W mfg get their poo poo together and at least 5 years before most old hardware has been rotated out of service. 5 years? Maybe at the far side of the bell curve! Also, easily mitigated by single bit ram
|
|
#
?
Aug 12, 2016 12:29
|
|
|
You know, a sufficiently paranoid system could probably mitigate it by only using half the rows in a given bit of dram. Has anyone investigated the relative likelihood of bit-flips in rows that aren't immediately adjacent?
|
|
#
?
Aug 12, 2016 15:02
|
|
|
ESXi disables memory dedupe by default now, right?
|
|
#
?
Aug 12, 2016 15:20
|
|
|
Raere posted:ESXi disables memory dedupe by default now, right? yeah
|
|
#
?
Aug 12, 2016 15:21
|
|
|
Raere posted:ESXi disables memory dedupe by default now, right? vms that should be separated for security reasons ought not to have their resources combined for security reasons
|
|
#
?
Aug 12, 2016 15:34
|
|
|
spankmeister posted:yeah as of what version? I just patched to 6-something and it was still on. e: I didn't actually do the upgrade, so maybe it stayed on, or was turned back on. idk Winkle-Daddy fucked around with this message at 15:59 on Aug 12, 2016 |
|
#
?
Aug 12, 2016 15:56
|
|
|
Winkle-Daddy posted:as of what version? I just patched to 6-something and it was still on. As of 5.1 ish it was turned off by default. Mind you that ESXi still does page sharing on a per-vm basis, but inter-VM TPS has been turned off by default. e: this page has all the info: https://kb.vmware.com/selfservice/microsites/search.do?language=en_US&cmd=displayKC&externalId=2080735
|
|
#
?
Aug 12, 2016 16:09
|
|
|
flakeloaf posted:vms that should be separated for security reasons ought not to have their resources combined for security reasons
|
|
#
?
Aug 12, 2016 17:16
|
|
|
flakeloaf posted:vms that should be separated for security reasons ought not to have their resources combined for security reasons exactly this. we had a big argument with our customers sec ops leader over this. we wanted to enable page sharing as we are already massively over-provisioned however the dink overruled us with some diatribe about exactly that basically if the threat posed by the successful exploitation of a page sharing info disclosure vuln is big enough then you'd already be running your poo poo on physical hardware. ofc this is assuming that you'd done threat modelling and come to the conclusion that a hypervisor escape being exploited is far more likely than some incredibly esoteric info disclosure vuln being exploited... Pile Of Garbage fucked around with this message at 18:50 on Aug 12, 2016 |
|
#
?
Aug 12, 2016 18:45
|
|
|
flakeloaf posted:vms that should be separated for security reasons ought not to have their resources combined for security reasons
|
|
#
?
Aug 12, 2016 18:47
|
|
|
outfits that have no money always very quickly and conveniently stop caring about security edit: vvv lucky bastard vvv Pile Of Garbage fucked around with this message at 19:31 on Aug 12, 2016 |
|
#
?
Aug 12, 2016 18:52
|
|
|
cheese-cube posted:outfits that have no money always very quickly and conveniently stop caring about security
|
|
#
?
Aug 12, 2016 19:10
|
|
|
my favourite part of this is quote:Websites could also attempt to thwart DDoSCoin by
|
|
#
?
Aug 12, 2016 21:42
|
|
|
This is kinda silly. https://www.youtube.com/watch?v=H7lQXmSLiP8 https://arxiv.org/ftp/arxiv/papers/1608/1608.03431.pdf
|
|
#
?
Aug 12, 2016 22:01
|
|
|
thanks for spoiling the next mr robot 
|
|
#
?
Aug 12, 2016 22:09
|
|
|
Agile Vector posted:thanks for spoiling the next mr robot we've already talked about the air gap vector and how that person is psychotic oh yeah, you're right 
|
|
#
?
Aug 12, 2016 22:36
|
|
|
use ssds for increased security
|
|
#
?
Aug 13, 2016 01:32
|
|
|
|
| # ? Jun 6, 2024 16:56 |
|
|
i need some advice with the legal side of reverse engineering stuff. i'm not looking for an actual legal opinion, more like how sarcastic i should set my tone we have many logistics partners, and the software for one of them is a huge pain in the rear end to work with because all the data entry has to be done by hand, which basically means someone full time in our case the software has n features to it for whatever reason, in tyool 2016 those features neither included the ability to do batch importation of stuff (ie ingest a csv full of stuff instead of typing everything in) nor the ability to pull down info from any external system we contracted the partner to add a batch import feature (for several thousand dollars, and this was before my time, otherwise i would have call dingo on them right then and there) and they eventually delivered 2 months late with me basically having to guide them the whole time during this period i was basically spending 5-6 hours a week rummaging through their poo poo show of a code base via ida pro and no one complained we were supposed to online the system today, but we realized that the import thing only did n-1 features, in this case automatic email subscription to status updates. we can't run with this without those updates, email or otherwise, because we need real time monitoring of events like customs issues and train derailments (happens alarmingly often). of course, there's no way to retroactively subscribe to these updates and there's no way to fetch the info otherwise (ie via api) the partner vaguely hinted that they could add support for the missing feature for an additional cost. rummaging through some more with ida i can see that the code to subscribe us to stuff is in there, but it's just not enabled. at this point i can reasonably state that they intentionally bricked a feature with the intent of asking for more money to fix this. i have sent them code excerpts validating my claim that poo poo should work, and for the first time someone decided to try and play the "the eula explicitly states no reverse engineering, stop it" card at no point have i been presented with or accepted a eula, but as a developer/project manager, my understanding is that i'm not actually an end user anyway furthermore, this whole thing is pretty much textbook interoperability work therefore receives broad exclusions from dmca & c-42 statutes regarding reverse engineering bottom line, have you ever dealt with a vendor like this and what tips could you give me? i know  is going to be popular, tbh i'm considering it
|
|
#
?
Aug 13, 2016 02:09
|
|
