Register a SA Forums Account here!
JOINING THE SA FORUMS WILL REMOVE THIS BIG AD, THE ANNOYING UNDERLINED ADS, AND STUPID INTERSTITIAL ADS!!!

You can: log in, read the tech support FAQ, or request your lost password. This dumb message (and those ads) will appear on every screen until you register! Get rid of this crap by registering your own SA Forums Account and joining roughly 150,000 Goons, for the one-time price of $9.95! We charge money because it costs us money per month for bills, and since we don't believe in showing ads to our users, we try to make the money back through forum registrations.
 
  • Post
  • Reply
RFC2324
Jun 7, 2012

http 418

BlankSystemDaemon posted:

What about it reads like a confession?
Nah, rlogin is the predecessor to ssh, both in that it comes before it and also in that it doesn't do any encryption, only regular authentication.
PSK31 is a way of modulating a radio signal by shifting the phase, allowing you to send at approximately 31 baud - it's mostly used for things like talk(1) or similar radioteletype-like stuff.

Ah, I misunderstood psk31 and am posting from a nice bubble bath ☺️

And this is a perfect snipe, gently caress you

Adbot
ADBOT LOVES YOU

KillHour
Oct 28, 2007


Radio stuff is just all craziness and I'm glad I don't have to deal with any of it.

Speaking of SDR, I can't wait for some spyware to be found creating adhoc c&c networks over licensed bands. It's going to happen.

BlankSystemDaemon
Mar 13, 2009



RFC2324 posted:

Ah, I misunderstood psk31 and am posting from a nice bubble bath ☺️

And this is a perfect snipe, gently caress you
Ah, you thought it was something like ROT13? :v:
Now I want a bubble bath. :(

RFC2324
Jun 7, 2012

http 418

BlankSystemDaemon posted:

Ah, you thought it was something like ROT13? :v:
Now I want a bubble bath. :(

I just parsed psk as 'preshared key' which implies encryption to me.

Also, I recommend. I tried the dr teals elderberry stuff and it smells so nice

Guy Axlerod
Dec 29, 2008
I suppose if you used a digital signature on your messages, you could ensure that they were all authentic while they were all still sent in the clear. Other people receiving the signal could also ensure they were authentic if the public keys were available to them. Not sure if that meets the letter of the law but would make me feel better if I had to go that way.

RFC2324
Jun 7, 2012

http 418

Guy Axlerod posted:

I suppose if you used a digital signature on your messages, you could ensure that they were all authentic while they were all still sent in the clear. Other people receiving the signal could also ensure they were authentic if the public keys were available to them. Not sure if that meets the letter of the law but would make me feel better if I had to go that way.

This was literally a conversation I had with someone trying to say Blockchain can do this... Or it can be a document that proves, say, you own your car or house. He could not explain how it would be better than gpg, or how the latter was better thanthe current system of "i have a piece of paper, and the state has records" other than "omg government in my affairs!!!"

Small defense, hes only 23, but drat

KillHour
Oct 28, 2007


It's more useful in real time stuff if you have a public system of trust that you can check it against that is faster than submitting a request to the government but we have that too and it's called ssl certs.

SlowBloke
Aug 14, 2017

Guy Axlerod posted:

I suppose if you used a digital signature on your messages, you could ensure that they were all authentic while they were all still sent in the clear. Other people receiving the signal could also ensure they were authentic if the public keys were available to them. Not sure if that meets the letter of the law but would make me feel better if I had to go that way.

That's what PADES does for files or eidas for messages and is the standard in most European countries

Pablo Bluth
Sep 7, 2007

I've made a huge mistake.
Got another Have I Been Pwned notification. Looks like its just old stuff recycled.

Pablo Bluth fucked around with this message at 15:03 on Feb 15, 2022

BaseballPCHiker
Jan 16, 2006

At least it didnt faill into the hands of the sadness-team. That would be way worse.

Tryzzub
Jan 1, 2007

Mudslide Experiment
https://twitter.com/zebpalmer/status/1492742757185556483?s=21

happy monday

BlankSystemDaemon
Mar 13, 2009



PoC||GTFO 0x21.

KillHour
Oct 28, 2007


Maybe some context on what's in that 60MB PDF?

Achmed Jones
Oct 16, 2004



it's poc or gtfo. it's gonna have some cool exploits in it ranging from "writing up a novel thing" to basically CS research. if that's the sort of thing that interests you, click on it and wait 90 seconds and then look at the table of contents

BlankSystemDaemon
Mar 13, 2009



It's also a ZIP file, and a PCAP-NG packet capture.

A summary of the summary:
  • Anti-debugger tips
  • Nion, a 2000-era ISA by Altera that everyone including me has forgotten about
  • A bit on palindrome ELF files and palindrome machine code used in x86 boot
  • IPIP tunneling exploit that caused a months-long coordinated disclosure that you probably haven't heard about
  • A few hundred gigabytes worth of microcontroller SDKs accessible through JSON
  • Messing with scoreboard displays
  • How to build a rotary phone network

And these three I'm just going to quote verbatum, because they're actually wizardry:

quote:

Suppose that you have a bit of raw firmware that
you’re pretty sure is executable code, but you don’t
yet know the architecture. You might try looking for
common sequences, or you might check that relative
function calls match entry points. EVM has a sim-
pler method, which is to draw a windrose diagram of
byte frequencies, skipping universally common ones
like 0x00. Page 55.
In the early eighties, a gizmo called the Text Lite
PX-1000 allowed folks to encrypt short messages
with DES, then transmit them by audio coupler mo-
dem. At some point the NSA got nervous about
this, purchased all outstanding units, and convinced
the manufacturer to update the ROM to support a
unique and proprietary encryption protocol, rather
than the standard for which it was made. On page
59, Stefan Marsiske explains how he reverse engi-
neered the backdoored algorithm and cracked it with
modern tooling.
It’s not so uncommon to find a firmware image,
but not a load address. On page 67, EVM describes
a generalized solution to this problem, first defin-
ing function entry points as a function of the load
address and then solving for the load address that
matches a strong majority of any absolute calls.

KillHour
Oct 28, 2007


Achmed Jones posted:

it's poc or gtfo. it's gonna have some cool exploits in it ranging from "writing up a novel thing" to basically CS research. if that's the sort of thing that interests you, click on it and wait 90 seconds and then look at the table of contents

Oh it's like a magazine. Wanted to make sure it wasn't an actual POC of a turing-complete PDF that's going to steal my bank account info and send it to the mods.

spankmeister
Jun 15, 2008






Its a zine OP

tagesschau
Sep 1, 2006

D&D: HASBARA SQUAD
THE SPEECH SUPPRESSOR


Remember: it's "antisemitic" to protest genocide as long as the targets are brown.

BlankSystemDaemon posted:

  • How to build a rotary phone network

Your scientists were so preoccupied with whether or not they could that they didn't stop to think if they should.

KillHour
Oct 28, 2007


spankmeister posted:

Its a zine OP

What is this, 1997?

BlankSystemDaemon
Mar 13, 2009



tagesschau posted:

Your scientists were so preoccupied with whether or not they could that they didn't stop to think if they should.
Science doesn't know the meaning of should. :colbert:

KillHour posted:

What is this, 1997?
Yes, it's the best part of 1997: a hackerzine with a foreword that's written in a semi-arcane style and documents all sorts of wonderfully zany ideas.

Methylethylaldehyde
Oct 23, 2004

BAKA BAKA

BlankSystemDaemon posted:

Science doesn't know the meaning of should. :colbert:

"Should we do this?" is only asked if the answer needs to be "yes, because it will secure us more funding".

Potato Salad
Oct 23, 2014

nobody cares


tagesschau posted:

Your scientists were so preoccupied with whether or not they could that they didn't stop to think if they should.

generally speaking I think people intend to refer to engineers product managers here

spankmeister
Jun 15, 2008






KillHour posted:

What is this, 1997?

What, you don't like fun?

CommieGIR
Aug 22, 2006

The blue glow is a feature, not a bug


Pillbug
And now for peak comedy:

https://twitter.com/web3isgreat/status/1493640197732458505?s=20&t=z5P5k5hwtjIxqkk8Xk8Wbw

KillHour
Oct 28, 2007


How is that different from someone buying up 51% of your stocks and declaring themselves director of the board? I mean, other than the fact that real companies try to prevent that from happening.

CommieGIR
Aug 22, 2006

The blue glow is a feature, not a bug


Pillbug

KillHour posted:

How is that different from someone buying up 51% of your stocks and declaring themselves director of the board? I mean, other than the fact that real companies try to prevent that from happening.

DAO's assume the code cannot be wrong, so if the code is okay with it, its okay.

Because nobody EVER exploits code.

KillHour
Oct 28, 2007


CommieGIR posted:

DAO's assume the code cannot be wrong, so if the code is okay with it, its okay.

Because nobody EVER exploits code.

Right, but that's how laws / company charters work too. Laws have exploits - they're called loopholes. It's just that those things are slow and actually have humans to both write and interpret them. It's kind of like HFT, except now with legal frameworks (or in this case, self-governing rules).

I'm not saying it's not loving dumb. I'm just saying it's not new, outside of the normal trope of "x but with computers"

Edit: It's almost like we shouldn't be inventing ways of making extremely important things happen so fast that nobody can possibly understand what is happening as it's happening.

Double edit: This is also why in every Corporate-Libertarian Dystopia, corporations have their own police force to shoot anyone trying this poo poo.

Triple edit: BRB, founding a company where if you can find all 9 of the phylacteries I've hidden around the world behind cryptic puzzles, you become the CEO for no apparent reason other than it sounds cool.

KillHour fucked around with this message at 22:38 on Feb 16, 2022

Absurd Alhazred
Mar 27, 2010

by Athanatos
DAOs need to hire cryptobouncers, easy peasy.

KillHour
Oct 28, 2007


When the gently caress did libertarians secretly win and found a new reality where laws and regulations don't matter as long as you can say "but it's different because computers"?

SolusLunes
Oct 10, 2011

I now have several regrets.

:barf:

KillHour posted:

When the gently caress did libertarians secretly win and found a new reality where laws and regulations don't matter as long as you can say "but it's different because computers"?

1980ish, give or take a decade

Cup Runneth Over
Aug 8, 2009

She said life's
Too short to worry
Life's too long to wait
It's too short
Not to love everybody
Life's too long to hate


KillHour posted:

Right, but that's how laws / company charters work too. Laws have exploits - they're called loopholes. It's just that those things are slow and actually have humans to both write and interpret them. It's kind of like HFT, except now with legal frameworks (or in this case, self-governing rules).

I'm not saying it's not loving dumb. I'm just saying it's not new, outside of the normal trope of "x but with computers"

Edit: It's almost like we shouldn't be inventing ways of making extremely important things happen so fast that nobody can possibly understand what is happening as it's happening.

Double edit: This is also why in every Corporate-Libertarian Dystopia, corporations have their own police force to shoot anyone trying this poo poo.

Triple edit: BRB, founding a company where if you can find all 9 of the phylacteries I've hidden around the world behind cryptic puzzles, you become the CEO for no apparent reason other than it sounds cool.

if you want to do this with a law or a company charter you have to put your real name on the record, and you can't take the cash you stole by doing it and immediately launder it for free with a service built into the economy for that explicit purpose

who are you going to shoot? the guy doing this is just a hexadecimal code if he wants to be

KillHour
Oct 28, 2007


Cup Runneth Over posted:

if you want to do this with a law or a company charter you have to put your real name on the record, and you can't take the cash you stole by doing it and immediately launder it for free with a service built into the economy for that explicit purpose

who are you going to shoot? the guy doing this is just a hexadecimal code if he wants to be

Give it time - IBM's Corporate Security division will get your information from Facebook as part of their data sharing agreement so they can figure out you're the xxWeedlordBonerHitlerxx who stole their money and raid your lovely capsule apartment.

Cup Runneth Over
Aug 8, 2009

She said life's
Too short to worry
Life's too long to wait
It's too short
Not to love everybody
Life's too long to hate


KillHour posted:

Give it time - IBM's Corporate Security division will get your information from Facebook as part of their data sharing agreement so they can figure out you're the xxWeedlordBonerHitlerxx who stole their money and raid your lovely capsule apartment.

You're not getting it man. You can make a new crypto wallet address whenever you want and it only has a funny name like that if you give it one. Anonymity is literally built into the platform, it was part of the whole point. That includes anonymity in taking over your dumbass decentralized organization by literally buying votes, and then draining all its accounts. There's no one to go after, they don't even have to live in your country. They run it through a mixer and then twenty fresh new wallets and then send it to a cartel in exchange for a dozen crates of AKs they resell on the black market. Good luck finding them.

But as crypto nuts are so fond of defending the buying-votes thing with, if they invested that money into your DAO to buy the governance tokens then why shouldn't they have a bigger say in what it does than you? There's no problem here because it was clearly the will of the organization to give all its money to that guy. :)

Subjunctive
Sep 12, 2006

✨sparkle and shine✨

I thought mixers were generally ineffective at hiding meaningful transfers. Have they gotten better?

KillHour
Oct 28, 2007


Cup Runneth Over posted:

You're not getting it man. You can make a new crypto wallet address whenever you want and it only has a funny name like that if you give it one. Anonymity is literally built into the platform, it was part of the whole point. That includes anonymity in taking over your dumbass decentralized organization by literally buying votes, and then draining all its accounts. There's no one to go after, they don't even have to live in your country. They run it through a mixer and then twenty fresh new wallets and then send it to a cartel in exchange for a dozen crates of AKs they resell on the black market. Good luck finding them.

But as crypto nuts are so fond of defending the buying-votes thing with, if they invested that money into your DAO to buy the governance tokens then why shouldn't they have a bigger say in what it does than you? There's no problem here because it was clearly the will of the organization to give all its money to that guy. :)

Yeah except for all the companies that you have to trust to make that security happen. Your browser, your OS, your ISP, your SSL cert provider....

In our future dystopia, everyone will have all the dirt on you, don't worry.

Cup Runneth Over
Aug 8, 2009

She said life's
Too short to worry
Life's too long to wait
It's too short
Not to love everybody
Life's too long to hate


Subjunctive posted:

I thought mixers were generally ineffective at hiding meaningful transfers. Have they gotten better?

AFAIK from the article I read it's not super effective laundering, you're still able to track whether currency is "dirty" if you try hard enough and banks won't take it, but it's nonetheless hilarious that money laundering is just a free service built into the currency. Anyway, that's why you trade it to the cartel for tangible goods instead of selling it on an exchange. Eventually it will end up with some sucker who didn't know any better and they will be unable to get rid of it.

https://www.reddit.com/r/CryptoCurrency/comments/skxpr7/blockfi_horrible_loan_experience_fortune_lost/

KillHour posted:

Yeah except for all the companies that you have to trust to make that security happen. Your browser, your OS, your ISP, your SSL cert provider....

In our future dystopia, everyone will have all the dirt on you, don't worry.

The Internet (and probably our species) will go extinct long before that happens, which probably won't be that long.

Potato Salad
Oct 23, 2014

nobody cares


Subjunctive posted:

I thought mixers were generally ineffective at hiding meaningful transfers. Have they gotten better?

The biggest ones have gotten better, and they aren't the ones that are based on dumb smart contracts and funny money in, funny money out on a fixed schedule later, blah blah blah

The effective, large mixers are in eastern europe, they're integrated with organized crime, and they require a conventional, real-world trust relationship. Bear in mind that these are large modern criminal services and their methodologies aren't going to be public.

Potato Salad fucked around with this message at 23:43 on Feb 16, 2022

Cup Runneth Over
Aug 8, 2009

She said life's
Too short to worry
Life's too long to wait
It's too short
Not to love everybody
Life's too long to hate


Ransomware is truly becoming a last-gen game the more and more money gets pumped into the crypto sphere. Why hold data hostage in exchange for money when you can just take the money directly, and no one can do anything about it? Cybergangs are gonna get in on this, mark my words.

Jabor
Jul 16, 2010

#1 Loser at SpaceChem
Swapping your dirty bitcoins for someone else's dirty bitcoins doesn't seem like it actually helps unless you're such a small-timer that law enforcement doesn't actually care to investigate.

The feds were able to trace the bitcoins from the bitfinex hack even though they went through a whole bunch of mixers, exchanges, and other cryptocurrencies (including supposed privacy coins).

Adbot
ADBOT LOVES YOU

Potato Salad
Oct 23, 2014

nobody cares


The Bitfinex cash--fiat--was also laundered by stupid people lacking the sense or connections to do it right.

Had they approached Deutsche Bank, they'd be unencumbered by legal trouble right now.

  • 1
  • 2
  • 3
  • 4
  • 5
  • Post
  • Reply