The DMZ

The unix/linux utility ccrypt claims to be a more secure replacement for the old unix cryypt. However it seems to me that it has a fundamental flaw. When you encrypt a file using ccrypt it uses the password you provide to create a random 256-bit key to use with AES. To decrypt the file you pro...

Guys AES-256 is broken

Iszi

4:48 PM

Anyone know if there's a Windows version of O-SAFT?

kalina

I'm sure Google always ignore my first couple of attempts to log in regardless of password I use so that they can prompt for my phone number and warn me about losing my account if they don't have it

CodesInChaos

@Iszi It's certainly possible dump orange juice through a window.

But I don't know why you'd want to do that.

kalina

@CodesInChaos to cover the people standing on the sidewalk in orange juice obv

Iszi

@kalina You saying Google's got a crush on you?

kalina

no I'm saying Google are playing psychological games with me to try and extort private information

unfortunately for Google, I'm largely immune to such games

Rоry McCune

4:59 PM

@kalina did you see google's creepy audio history page history.google.com/history/audio

they keep a note of everything you say to your phone

kalina

wow

that's a little disturbing

Rоry McCune

@kalina it's all totally private though and purely so they can improve the recognition algorithms

kalina

it's fine, they provide a delete button

Rоry McCune

yeah I don't enable cortana/siri/googleNow on any device I own..

kalina

oh there's like 9000 audio clips of me asking for random directions

my Google location history is starting to look fantastic

red dots all over the world

Rоry McCune

5:03 PM

@kalina rly, I wondered exectly what it'd store as I don't use the feature

that's fairly creepy

kalina

@RоryMcCune basically the full audio from the moment the microphone activates until it starts searching

"I NEED FOOD, FOOD ME"

Rоry McCune

@kalina I wonder if it catches background noise...

kalina

well, that's depending on how good your noise cancellation works I'd guess

Rоry McCune

so google have a huge database of geo-located, time-stamped audio files from all round the world

but then I suppose, so do Apple

kalina

and Microsoft

and the NSA

Rоry McCune

5:05 PM

well the NSA one is the one they nick of Google/MS/Apple

the only limit to this stuff is really the ability to analyze the data effectively

they're all sitting on absolutely vast piles of information now

kalina

pls the NSA have phone line recordings as well

Rоry McCune

@kalina yeah harder to analyze large bodies of analogue signal data

the stuff from smartphones is all neatly meta-data'd

kalina

I wonder if I'm a target because I hang up on calls I can't be bothered to continue with "oh, somebody is calling on the other line, I'll call you back"

and there's rarely another call

Rоry McCune

@kalina nono we're targets 'cause we're in the same chat room as adi

Simon

lulz

Rоry McCune

5:07 PM

and he's a target 'cause he is from a country of interest

and we get dragnetted under their 2/3 degrees of separation stuff

kalina

I need more dots in Canada

Rоry McCune

@Simon where was it you're based again?

Simon

@RоryMcCune Laval, which is literally 5 minutes away from Montréal.

Iszi

@RоryMcCune No, you're targets simply for being foreign nationals.

Rоry McCune

@Simon in Canada

Simon

5:09 PM

@RоryMcCune Yes.

Rоry McCune

@Iszi well that too, but that only gets us on the low-level lists

@Simon righto

Simon

Laval, Montréal, Québec, Canada.

, America.

, Earth, whatever our solar system is named, Universe.

I'm probably forgetting a layer.

kalina

@Simon well several, actually

I have more dots in the ukraine than in spain

I should fix that, I like spain

Simon

That's because you didn't play la cucaracha when you went there.

kalina

-.-

Simon

5:14 PM

Whoa, what kind of mess up was that? Laval is not in Montréal.

I lied to you again lads, I'm sorry.

4 mins ago, by Simon

Laval, Montréal, Québec, Canada.

^ THIS IS A LIE

kalina

it's ok, it's totally normally that you don't know where you live

Simon

totally normally

kalina

we don't think you're strange because of it at all

Simon

At least I'm not an Australian with an orange as a profile picture.

Cauterite

>_>

Simon

5:16 PM

Hahaha, sorry dude, that was too easy.

Rоry McCune

bit late in the land downunder ain't it!

Cauterite

it's not late anymore, it's early

Rоry McCune

all relatively I guess

Simon

The only difference is that kangaroos are waking up.

I wanna pet a kangaroo one day.

Gilles

@Adi riiiiight

Simon

5:18 PM

@Cauterite Hey man, if you let me pet a kangaroo, I'll let you pet a beaver.

Rоry McCune

@kalina ever actually played a gig in Scotland, or does that fall into your region of TC;DP; ?

Cauterite

help yourself!

Gilles

copying some halfway-related text is easier than writing from scratch

especially for someone who clearly can't write a complete English sentence

kalina

did you turn up specifically to hate on somebody who you've just clearly stated can't write a complete English sentence?

or do you actually have a point, rather than just criticizing people who contribute to a site that relies entirely on people contributing?

Rory Alsop

@RоryMcCune mine isn't creepy at all. There is no data on thatg page :-)

Simon

5:21 PM

Whoa there, don't be too harsh to Guigui.

Rоry McCune

@RoryAlsop yeah mine either, as I would never enable such a thing...

@RoryAlsop but I bet your average non-sec user would get a nasty shock if they knew how much data was held in easily accessible form.

Simon

Mine is probably loaded with trying to make it understand French words when the device is set to English.

Rоry McCune

@Simon what like "la sange est dans l arbre"

Simon

sange?

Rоry McCune

Eddie Izzard - Learning French

►

@Simon s/sange/singe/ apparently

Simon

5:28 PM

His accent is not too bad at all.

kalina

says the Canadian

Simon

????

I'm talking about his French accent for being his second language.

kalina

and I'm talking about how you're Canadian

Simon

Do you wanna wrestle or something young boi?

kalina

that sounds like you'd enjoy it more than I would

RoraΖ

5:31 PM

@kalina Unlikelyl since you'd kick his ass

kalina

you'd be surprised how difficult it is to throw somebody who is significantly heavier than yourself

especially when said individual is pinning you by the shoulders

Cauterite

is there some rules for this room?

kalina

yes

it's a DMZ, of course there are rules

2

Cauterite

are they stored securely to prevent unauthorised reading?

Rоry McCune

@Cauterite the rules are in the room description (largely)

RoraΖ

5:34 PM

@Cauterite <privileged response>

Rоry McCune

along with acceptable topics of converstion

kalina

@Cauterite private rules are private, our public rules are contradictory and designed to catch you out

trust no one

Simon

The rules are made up by my ween.

2

kalina

I assume based on how much you talk about it that it isn't getting much use recently

Rоry McCune

@Simon you're just saying that 'cause you think @AviD and @RoraΖ aren't paying attention

kalina

5:35 PM

hands don't count

Simon

@RоryMcCune pls i wuz trying to be sneaky

Rоry McCune

@Simon I know that's why I tagged them :op

RoraΖ

pfft, what happened. I wasn't paying attention.

Gilles

@BlueBerry-Vignesh4303 Since you've been so far incapable of making a worthwhile contribution here, my advice is to learn. Practice by writing original content instead of only ever copying stuff from elsewhere.

Simon

@RoraΖ I said something about my Loch Ness monster.

RoraΖ

5:38 PM

@Simon The mythical creatures that no one has proof of?

Rоry McCune

@RoraΖ @Simon is getting in sneaky references to bodily parts that he would likely have censored were @AviD or @RoryAlsop about

kalina

inb4'd me

Simon

@RoraΖ Except those who witnessed it!

Rоry McCune

@RoraΖ have you not been asked for tree fiddy yet?

David Freitag

@RoraΖ One does not simply get a clear picture of Nessy.

RoraΖ

5:38 PM

@Simon Yeah the crazies that no one believes.

Simon

@RoraΖ <3

RoraΖ

@RоryMcCune I ain't givin' no Lockness monster tree-fiddy!

@Gilles ugh oh, what'd he do this time?

Simon

@RoraΖ Read the revisions: security.stackexchange.com/posts/102195/revisions

Especially Guigui's.

kalina

yes, specifically the one where a loud mouthed moderator turned some stuff into quotes and then whined about quality while missing all the spelling, grammar, and other issues in the post

RoraΖ

-1

A: Is the newly adopted NFC technology going to be safe?

This link should clear some of that up. You can even try your hand at it Here. Sure there is some worry about this tech, but it is already being used everywhere. Mostly passive tags such as in business cards and this sticker that showed up in Australia around 2 years ago (I think) : Now I use...

Rоry McCune

5:41 PM

twitter.com/spazef0rze/status/650613366432514049/photo/1

^heh

Simon

@kalina Some people are preparing the arena.

kalina

ultimately the guy didn't indent some stuff even though it's correctly cited

RoraΖ

hahaha

security.stackexchange.com/revisions/102195/4

@kalina Nice comment

kalina

don't bring attention to me having fun, he'll take issue with it

Rоry McCune

ya know I think this room has more active users who are either in france, or speak french compared to english at the moment..

RoraΖ

5:47 PM

@RоryMcCune Well go have a sandwich then

Rоry McCune

@RoraΖ mmm Sandwiches

although I've had my tea, so not really hungry now

soon whisky time :)

Cauterite

I was pondering some, kind of, 'exploitable' properties of x86 today, and came up with this technique that could be used as part of an attack,

it sounds like something that could've been used in the wild before, but I don't really know what to search for,

i was wondering if anyone knows if there's a name for this?

AviD

@RоryMcCune pls, I starred that

RoraΖ

@Cauterite How do you get to the point of writing 64k of memory?

Gilles

@RoraΖ same thing as last time, apparently: plagiarism

RoraΖ

5:57 PM

@Cauterite It's called a NOP-slide

AviD

@RoraΖ your mom is called a NOPE-slide

RoraΖ

@Gilles Yeah I see it now.

@AviD Nope slide?

AviD

hey dont blame me, this is @RоryMcCune's fault

Rоry McCune

@AviD it is?

Cauterite

@RoraΖ i know that much, but i was referring more to the use of a truncated 16-bit jump opcode to target the 64k region,

Rоry McCune

5:58 PM

What'I do this time?

AviD

@RоryMcCune made me come in here and raise a ruckus

Gilles

@RoraΖ bah, not a patch on meta.stackexchange.com/users/9314/…

Rоry McCune

@AviD ahh, yeh, that's my fault, sorry everyone

AviD

oo that ought to be the title of my next talk, wherever

RoraΖ

@Cauterite I mean it's kind of like using a ROP gadget to gain execution.

AviD

5:59 PM

> Raisin' Ruckus: Something about something...

whatever the talk is about

Rоry McCune

@AviD My next one is "Docker: Security Myths, Security Legends"

Thomas Pornin

@Cauterite jump opcodes on x86 use a relative offset

AviD

@RоryMcCune ha, nice

Cauterite

if it's a 16-bit jump, it always lands in the first 64k of address space; i tested it @ThomasPornin

Rоry McCune

@AviD well I figured I had to do one about docker, so that's my working title. Got an internal NCC Con to put it in for then Securi-Tay in Feb

RoraΖ

6:00 PM

@Gilles I don't know what you're pointing me to there

AviD

cool. you should start thinking about AppSecIL 2016.

Rоry McCune

@AviD true, I'm thinking Docker will be a bit old-hat for an international audience in 2016, but something else may come along..

AviD

nah, Israelis are not such hipsters.

RoraΖ

@Cauterite I'm still not sure how you write to the first 64k of space to begin with. Generally there are some important system level modules running in those high address spaces.

AviD

Cowboys, sure, but not so much hipsters.

Rоry McCune

6:03 PM

@AviD ahh but Israel always gives the impression of being very cutting edge when it comes to security stuff

AviD

@RоryMcCune sure

Simon

@RоryMcCune Doesn't it give you an impression involving pyramids to you too?

AviD

but not so hipster with the dockers and such

Rоry McCune

@Simon ... no, that's Egypt you're thinking of there

Thomas Pornin

@RoraΖ Most systems will take care to unmap the first page, in order to better trap NULL pointer dereferences. Linux will also map some other pages to present some read-only kernel data to process (e.g. so that getpid() or gettimeofday() don't incur a system call overhead).

AviD

6:04 PM

though I hear there is quite a big node.js community here, and the Israel Ruby conf is pretty big...

RoraΖ

@ThomasPornin That makes sense. Either way, seems like trying to use the first page of memory could result in bad things happening in the OS.

Rоry McCune

@AviD all you need now is some gohphers and you'll be sorted

Simon

@RоryMcCune pls roro, we both know that it's the same place.

Thomas Pornin

Ah ! "user was removed: +2"

Cauterite

instead, lets say there's a page allocated at address 0xF000; with the right two trailing-bytes you could use such a jump to target very close to 0x10000
though it is very unusual to have pages in the 0 to 0x10000 region, Windows at least does let you do it

AviD

6:05 PM

heh

Rоry McCune

@ThomasPornin so you got @kalina 's 2 points..

Simon

@ThomasPornin I bet you deserved that downvote.

kalina

thief

Simon

Wait, is it -2 for downvote or -5?

kalina

serious?

do you even Stack Exchange, bro?

Gilles

6:06 PM

@RoraΖ his edit comments

RoraΖ

@Cauterite Yes you could. But I don't think the act of jumping to a place in memory is any specific technique. Regardless of a 2 or 5 byte jump.

Simon

@kalina Sorry, my answers are so high quality that I don't ever get downvotes.

RoraΖ

@Gilles Oh wow that's useless

@Simon You don't ever answer

Simon

@RoraΖ SHUT UP I KNEW SOMEONE WOULD SAY THAT

kalina

Simon

6:08 PM

<pls>

RoraΖ

#sleds

Cauterite

i actually came up with it as a way to intercept conditional jumps as an alternative to replacing them them with int3,
since `call eax` and the like are all two-byte instructions

Simon

@Cauterite fkin rekt

kalina

6:22 PM

#chatkiller

Simon

#me

MRW when I try to copy a line from host machine to a remote machine to a VM console and it doesn't work: "nice try m8, nice try".

Rоry McCune

@Simon sooo annoying

linux can be weird sometimes too, you need to copy to an intermediate program before the clipboard will pick it up..

Simon

@RоryMcCune I think it's vSphere console is where it failed.

Rоry McCune

@Simon better than frickin' Hyper-V

Simon

@RоryMcCune lulz, is it?

Rоry McCune

6:31 PM

trying to get the Hyper-V management stuff to work in a workgroup is awful

they've had 8 years to make it easy and the new version still sucks

you can't, by default, supply alternate creds to the management tool

and there's a hacky work-around that sometimes doesn't work

kalina

6:53 PM

pls why no domain

Rоry McCune

@kalina domains are overkill for home networks

IMO

TildalWave

7:26 PM

notheyrenot

Simon

7:38 PM

domainsarea#windoesconcept

Rоry McCune

@Simon well the same concept exists in Unix land but it is generally considered to s4ck t3h b4llz0rs

NIS+

NIS+ is a directory service developed by Sun Microsystems to replace its older 'NIS' (Network Information Service). It is designed to eliminate the need for duplication across many computers of configuration data such as user accounts, host names and addresses, printer information and NFS disk mounts on individual systems, instead using a central repository on a master server, simplifying system administration. NIS+ client software has been ported to other Unix and Unix-like platforms. Prior to the release of Solaris 9 in 2002, Sun announced its intent to remove NIS+ from Solaris in a future release...

Of course the one true directory Service is NDS

David Freitag

@RоryMcCune I have no idea what you just said

Rоry McCune

@DavidFreitag I was suggesting that Unix large scale user management services, e.g. NIS+ weren't very good

which is why no-one uses them outside of universities and Solaris houses

David Freitag

The first part of that sentence was good, but then I think I may have had a stroke near the end of that sentence

Rоry McCune

</sweeping Generalisation>

@DavidFreitag I was doing it in leet-speak so that @Simon would understand

on an unrelated note, woohoo, got paid for my article :)